@synopackageland/cli 0.6.1 → 0.7.1

package/dist/templates/native-authorization/AuthorizationGate.vue

@@ -22,9 +22,9 @@ const canAuthorize=computed(()=>required.value&&!untrusted.value)
 const unavailableKey=computed(()=>shown.value?.reason==='credential_not_ready'?'credential':'unavailable')
 const title=computed(()=>!shown.value?text.value('checking'):required.value?text.value('title'):shown.value.state==='ready'?text.value('ready'):shown.value.state==='not_admin'?text.value('not_admin.title'):shown.value.state==='session_expired'?text.value('session_expired.title'):text.value(unavailableKey.value+'.title'))
 const body=computed(()=>required.value?text.value('purpose'):shown.value?.state==='not_admin'?text.value('not_admin.body'):shown.value?.state==='session_expired'?text.value('session_expired.body'):shown.value?.state==='unavailable'?text.value(unavailableKey.value+'.body'):text.value('purpose'))
-const reasons=['grant_missing','helper_untrusted','cli_untrusted','grant_incompatible','package_identity_changed','maintenance_task_missing','maintenance_task_mismatch','helper_health_rejected','capability_missing']
+const reasons=['grant_missing','upgrade_reapproval','helper_untrusted','cli_untrusted','grant_incompatible','package_identity_changed','maintenance_task_missing','maintenance_task_mismatch','helper_health_rejected','capability_missing']
 const reason=computed(()=>reasons.includes(shown.value?.reason||'')?shown.value!.reason!:'unknown')
-const next=computed(()=>untrusted.value?'next.reinstall':reason.value==='grant_missing'?'next.install':reason.value==='grant_incompatible'?'next.update':'next.repair')
+const next=computed(()=>untrusted.value?'next.reinstall':reason.value==='grant_missing'?'next.install':reason.value==='upgrade_reapproval'||reason.value==='grant_incompatible'?'next.update':'next.repair')
 async function action(method:'status'|'request'|'revoke'){
  if(busy.value||disposed)return
  const current=++sequence
@@ -37,6 +37,8 @@ async function action(method:'status'|'request'|'revoke'){
   const result=await props.ctx.authorization?.[method]()
   if(disposed||current!==sequence)return
   if(!result||result.command!=='authorization'||result.schema_version!==1||!['ready','authorization_required','not_admin','session_expired','unavailable'].includes(result.state))throw Error('invalid status')
+  // A reason-only upgrade tombstone never accompanies a usable authorization.
+  if(result.reason==='upgrade_reapproval'&&result.state!=='authorization_required')throw Error('invalid status')
   state.value=result
   if(result.state==='ready')emit('ready')
  } catch(e){if(!disposed&&current===sequence){
@@ -54,7 +56,7 @@ onUnmounted(()=>{disposed=true;sequence++;if(typeof unsubscribe==='function')uns
    <span class="authorization-icon" aria-hidden="true"><component :is="shown?.state==='unavailable'||shown?.state==='session_expired'?TriangleAlert:ShieldCheck" class="authorization-icon-glyph" /></span>
    <h1 class="authorization-title">{{ title }}</h1>
    <p class="authorization-body">{{ body }}</p>
-   <Callout v-if="required" class="authorization-status" :tone="reason==='grant_missing'?'info':'warning'" :title="text('reason.'+reason)">{{ text(next) }}</Callout>
+   <Callout v-if="required" class="authorization-status" :tone="['grant_missing','upgrade_reapproval'].includes(reason)?'info':'warning'" :title="text('reason.'+reason)">{{ text(next) }}</Callout>
    <Callout v-if="failure" class="authorization-failed" tone="warning">{{ text('failed') }}</Callout>
    <div class="authorization-actions">
     <Button v-if="canAuthorize" variant="primary" :loading="busy" :disabled="busy" @click="action('request')">{{ busy ? text('authorizing') : text('authorize') }}</Button>

package/dist/templates/native-authorization/i18n/de.json

@@ -2,6 +2,7 @@
   "authorization.title": "{package} benötigt Ihre Erlaubnis",
   "authorization.purpose": "Dieses Paket benötigt eine Genehmigung für feste Root-Operationen. DSM verarbeitet Ihr Passwort; das Paket sieht oder speichert es nicht.",
   "authorization.reason.grant_missing": "Root-Operationen sind noch nicht autorisiert.",
+  "authorization.reason.upgrade_reapproval": "Das Paket wurde im Paket-Zentrum aktualisiert, daher wurde die bisherige Autorisierung widerrufen.",
   "authorization.reason.helper_untrusted": "Dem privilegierten Helfer konnte nicht vertraut werden.",
   "authorization.reason.cli_untrusted": "Dem privilegierten Befehl konnte nicht vertraut werden.",
   "authorization.reason.grant_incompatible": "Der privilegierte Helfer muss aktualisiert werden.",

package/dist/templates/native-authorization/i18n/en.json

@@ -2,6 +2,7 @@
   "authorization.title": "{package} needs your permission",
   "authorization.purpose": "This package needs approval for its fixed root operations. DSM handles your password; the package never sees or stores it.",
   "authorization.reason.grant_missing": "Root operations are not authorized yet.",
+  "authorization.reason.upgrade_reapproval": "The package was updated in Package Center, so its previous authorization was revoked.",
   "authorization.reason.helper_untrusted": "The privileged helper could not be trusted.",
   "authorization.reason.cli_untrusted": "The privileged command could not be trusted.",
   "authorization.reason.grant_incompatible": "The privileged helper needs an update.",

package/dist/templates/native-authorization/i18n/es.json

@@ -2,6 +2,7 @@
   "authorization.title": "{package} necesita su permiso",
   "authorization.purpose": "Este paquete requiere aprobación para sus operaciones root fijas. DSM gestiona su contraseña; el paquete no la ve ni la almacena.",
   "authorization.reason.grant_missing": "Las operaciones root aún no están autorizadas.",
+  "authorization.reason.upgrade_reapproval": "El paquete se actualizó en el Centro de paquetes, por lo que se revocó la autorización anterior.",
   "authorization.reason.helper_untrusted": "No se pudo confiar en el asistente privilegiado.",
   "authorization.reason.cli_untrusted": "No se pudo confiar en el comando privilegiado.",
   "authorization.reason.grant_incompatible": "El asistente privilegiado necesita una actualización.",
@@ -30,7 +31,7 @@
   "authorization.ready": "Autorizado",
   "authorization.revoke": "Revocar autorización",
   "authorization.revoke.title": "¿Revocar autorización?",
-  "authorization.revoke.body": "Se desactivarán los nuevos accesos del helper. Se conservan los datos del paquete y los resultados anteriores.",
+  "authorization.revoke.body": "Se desactivarán los nuevos accesos del asistente privilegiado. Se conservan los datos del paquete y los resultados anteriores.",
   "authorization.cancel": "Cancelar",
   "authorization.checking": "Comprobando autorización…"
 }

package/dist/templates/native-authorization/i18n/fr.json

@@ -2,6 +2,7 @@
   "authorization.title": "{package} demande votre autorisation",
   "authorization.purpose": "Ce paquet nécessite une autorisation pour ses opérations root fixes. DSM traite votre mot de passe ; le paquet ne le voit ni ne le stocke.",
   "authorization.reason.grant_missing": "Les opérations root ne sont pas encore autorisées.",
+  "authorization.reason.upgrade_reapproval": "Le paquet a été mis à jour dans le Centre de paquets ; l'autorisation précédente a donc été révoquée.",
   "authorization.reason.helper_untrusted": "L'assistant privilégié n'a pas pu être approuvé.",
   "authorization.reason.cli_untrusted": "La commande privilégiée n'a pas pu être approuvée.",
   "authorization.reason.grant_incompatible": "L'assistant privilégié doit être mis à jour.",

package/dist/templates/native-authorization/i18n/it.json

@@ -1,7 +1,8 @@
 {
-  "authorization.title": "{package} richiede il tuo permesso",
+  "authorization.title": "{package} richiede l’autorizzazione",
   "authorization.purpose": "Questo pacchetto richiede l’approvazione per le sue operazioni root fisse. DSM gestisce la password; il pacchetto non la vede né la memorizza.",
   "authorization.reason.grant_missing": "Le operazioni root non sono ancora autorizzate.",
+  "authorization.reason.upgrade_reapproval": "Il pacchetto è stato aggiornato in Centro pacchetti, quindi l'autorizzazione precedente è stata revocata.",
   "authorization.reason.helper_untrusted": "Non è stato possibile considerare attendibile l'helper privilegiato.",
   "authorization.reason.cli_untrusted": "Non è stato possibile considerare attendibile il comando privilegiato.",
   "authorization.reason.grant_incompatible": "L'helper privilegiato deve essere aggiornato.",
@@ -11,22 +12,22 @@
   "authorization.reason.helper_health_rejected": "L'helper privilegiato non ha superato il controllo di integrità.",
   "authorization.reason.capability_missing": "All'helper privilegiato manca una capacità necessaria.",
   "authorization.reason.unknown": "L'autorizzazione è mancante o non più valida.",
-  "authorization.next.install": "Scegli Autorizza e conferma la password DSM per approvare questa versione.",
-  "authorization.next.update": "Questa versione richiede una nuova autorizzazione. Scegli Autorizza e conferma la password DSM.",
-  "authorization.next.repair": "Controlla le attività del pacchetto nell’Utilità di pianificazione e riprova.",
+  "authorization.next.install": "Scegliere «Autorizza» e confermare la password DSM per approvare questa versione.",
+  "authorization.next.update": "Questa versione richiede una nuova autorizzazione. Scegliere «Autorizza» e confermare la password DSM.",
+  "authorization.next.repair": "Controllare le attività del pacchetto nell’Utilità di pianificazione, quindi riprovare.",
   "authorization.authorize": "Autorizza",
   "authorization.authorizing": "In attesa di DSM…",
-  "authorization.failed": "L'autorizzazione non è stata completata. Puoi riprovare.",
+  "authorization.failed": "L’autorizzazione non è stata completata. È possibile riprovare.",
   "authorization.unavailable.title": "Impossibile verificare l'autorizzazione",
-  "authorization.unavailable.body": "Di solito è temporaneo. Riprova; {package} non chiederà la password.",
+  "authorization.unavailable.body": "Di solito è temporaneo. Riprovare; {package} non chiederà la password.",
   "authorization.credential.title": "Le credenziali di accesso di DSM non sono pronte",
-  "authorization.credential.body": "Questa sessione DSM è stata ripristinata senza accesso con password, quindi DSM non può garantire per le richieste di {package}. Disconnettiti da DSM, accedi di nuovo con la password e riapri {package}.",
+  "authorization.credential.body": "Questa sessione DSM è stata ripristinata senza accesso con password, quindi DSM non può garantire per le richieste di {package}. Disconnettersi da DSM, accedere di nuovo con la password e riaprire {package}.",
   "authorization.retry": "Riprova",
-  "authorization.next.reinstall": "I file installati non corrispondono a questa versione. Reinstalla il pacchetto da una fonte attendibile e riprova.",
+  "authorization.next.reinstall": "I file installati non corrispondono a questa versione. Reinstallare il pacchetto da una fonte attendibile, quindi riprovare.",
   "authorization.not_admin.title": "Amministratore necessario",
-  "authorization.not_admin.body": "Chiedi a un amministratore DSM di aprire e autorizzare questo pacchetto.",
+  "authorization.not_admin.body": "Chiedere a un amministratore DSM di aprire e autorizzare questo pacchetto.",
   "authorization.session_expired.title": "Sessione scaduta",
-  "authorization.session_expired.body": "Accedi nuovamente a DSM e riapri questo pacchetto.",
+  "authorization.session_expired.body": "Accedere nuovamente a DSM e riaprire questo pacchetto.",
   "authorization.ready": "Autorizzato",
   "authorization.revoke": "Revoca autorizzazione",
   "authorization.revoke.title": "Revocare l’autorizzazione?",

package/dist/templates/native-authorization/i18n/ja.json

@@ -2,6 +2,7 @@
   "authorization.title": "{package} に承認が必要です",
   "authorization.purpose": "このパッケージの固定 root 操作には承認が必要です。パスワードは DSM が処理し、パッケージは閲覧も保存もしません。",
   "authorization.reason.grant_missing": "root 操作はまだ承認されていません。",
+  "authorization.reason.upgrade_reapproval": "パッケージ センターでパッケージが更新されたため、以前の承認は取り消されました。",
   "authorization.reason.helper_untrusted": "特権ヘルパーを信頼できませんでした。",
   "authorization.reason.cli_untrusted": "特権コマンドを信頼できませんでした。",
   "authorization.reason.grant_incompatible": "特権ヘルパーの更新が必要です。",

package/dist/templates/native-authorization/i18n/ko.json

@@ -1,7 +1,8 @@
 {
   "authorization.title": "{package} 승인 필요",
-  "authorization.purpose": "이 패키지의 고정 root 작업에는 승인이 필요합니다. 비밀번호는 DSM이 처리하며 패키지는 비밀번호를 보거나 저장하지 않습니다.",
+  "authorization.purpose": "이 패키지의 고정 root 작업에는 승인이 필요합니다. 암호는 DSM이 처리하며 패키지는 암호를 보거나 저장하지 않습니다.",
   "authorization.reason.grant_missing": "root 작업이 아직 승인되지 않았습니다.",
+  "authorization.reason.upgrade_reapproval": "패키지 센터에서 패키지가 업데이트되어 이전 승인이 취소되었습니다.",
   "authorization.reason.helper_untrusted": "권한 있는 도우미를 신뢰할 수 없습니다.",
   "authorization.reason.cli_untrusted": "권한 있는 명령을 신뢰할 수 없습니다.",
   "authorization.reason.grant_incompatible": "권한 있는 도우미를 업데이트해야 합니다.",
@@ -11,22 +12,22 @@
   "authorization.reason.helper_health_rejected": "권한 있는 도우미가 상태 검사를 통과하지 못했습니다.",
   "authorization.reason.capability_missing": "권한 있는 도우미에 필요한 기능이 없습니다.",
   "authorization.reason.unknown": "권한이 없거나 더 이상 유효하지 않습니다.",
-  "authorization.next.install": "승인을 선택하고 DSM 비밀번호로 이 빌드를 승인하세요.",
-  "authorization.next.update": "이 빌드는 새 승인이 필요합니다. 승인을 선택하고 DSM 비밀번호로 확인하세요.",
-  "authorization.next.repair": "작업 스케줄러에서 패키지 작업을 확인한 후 다시 시도하세요.",
+  "authorization.next.install": "승인을 선택하고 DSM 암호로 이 빌드를 승인하십시오.",
+  "authorization.next.update": "이 빌드는 새 승인이 필요합니다. 승인을 선택하고 DSM 암호로 확인하십시오.",
+  "authorization.next.repair": "작업 스케줄러에서 패키지 작업을 확인한 후 다시 시도하십시오.",
   "authorization.authorize": "권한 부여",
   "authorization.authorizing": "DSM을 기다리는 중…",
   "authorization.failed": "권한 부여가 완료되지 않았습니다. 다시 시도할 수 있습니다.",
   "authorization.unavailable.title": "권한을 확인할 수 없습니다",
-  "authorization.unavailable.body": "일반적으로 일시적인 문제입니다. 다시 시도하세요. {package}은 비밀번호를 요구하지 않습니다.",
+  "authorization.unavailable.body": "일반적으로 일시적인 문제입니다. 다시 시도하십시오. {package}은 암호를 요구하지 않습니다.",
   "authorization.credential.title": "DSM 로그인 자격 증명이 준비되지 않았습니다",
-  "authorization.credential.body": "이 DSM 세션은 비밀번호 로그인 없이 복원되었으므로 DSM이 {package}의 요청을 보증할 수 없습니다. DSM에서 로그아웃한 후 비밀번호로 다시 로그인하고 {package}을 다시 여세요.",
+  "authorization.credential.body": "이 DSM 세션은 암호 로그인 없이 복원되었으므로 DSM이 {package}의 요청을 보증할 수 없습니다. DSM에서 로그아웃한 후 암호로 다시 로그인하고 {package}을 다시 여십시오.",
   "authorization.retry": "다시 시도",
-  "authorization.next.reinstall": "설치된 파일이 이 빌드와 일치하지 않습니다. 신뢰할 수 있는 출처에서 패키지를 다시 설치한 후 다시 시도하세요.",
+  "authorization.next.reinstall": "설치된 파일이 이 빌드와 일치하지 않습니다. 신뢰할 수 있는 출처에서 패키지를 다시 설치한 후 다시 시도하십시오.",
   "authorization.not_admin.title": "관리자가 필요합니다",
-  "authorization.not_admin.body": "DSM 관리자에게 이 패키지를 열고 승인하도록 요청하세요.",
+  "authorization.not_admin.body": "DSM 관리자에게 이 패키지를 열고 승인하도록 요청하십시오.",
   "authorization.session_expired.title": "세션이 만료되었습니다",
-  "authorization.session_expired.body": "DSM에 다시 로그인한 후 패키지를 다시 여세요.",
+  "authorization.session_expired.body": "DSM에 다시 로그인한 후 패키지를 다시 여십시오.",
   "authorization.ready": "승인됨",
   "authorization.revoke": "승인 취소",
   "authorization.revoke.title": "승인을 취소하시겠습니까?",

package/dist/templates/native-authorization/i18n/zh-CN.json

@@ -1,7 +1,8 @@
 {
-  "authorization.title": "{package} 需要您的授权",
+  "authorization.title": "{package} 需要授权",
   "authorization.purpose": "此套件执行固定的 root 操作前需要批准。密码由 DSM 处理，套件不会看到或存储。",
   "authorization.reason.grant_missing": "尚未授权 root 操作。",
+  "authorization.reason.upgrade_reapproval": "套件已通过套件中心更新，之前的授权已撤销。",
   "authorization.reason.helper_untrusted": "无法信任特权 helper。",
   "authorization.reason.cli_untrusted": "无法信任特权命令。",
   "authorization.reason.grant_incompatible": "特权 helper 需要更新。",
@@ -11,14 +12,14 @@
   "authorization.reason.helper_health_rejected": "特权 helper 未通过健康检查。",
   "authorization.reason.capability_missing": "特权 helper 缺少必要的能力。",
   "authorization.reason.unknown": "授权已丢失或不再有效。",
-  "authorization.next.install": "选择“授权”，并使用您的 DSM 密码确认，即可批准此版本。",
-  "authorization.next.update": "此版本需要重新授权。请选择“授权”，并使用您的 DSM 密码确认。",
+  "authorization.next.install": "选择“授权”，并使用 DSM 密码确认，即可批准此版本。",
+  "authorization.next.update": "此版本需要重新授权。请选择“授权”，并使用 DSM 密码确认。",
   "authorization.next.repair": "请在任务计划中检查此套件的任务，再重试。",
   "authorization.authorize": "授权",
   "authorization.authorizing": "正在等待 DSM…",
-  "authorization.failed": "授权未完成，您可以重试。",
+  "authorization.failed": "授权未完成，请重试。",
   "authorization.unavailable.title": "无法检查授权",
-  "authorization.unavailable.body": "这通常是暂时的。请重试，{package} 不会要求您的密码。",
+  "authorization.unavailable.body": "这通常是暂时的。请重试，{package} 不会要求输入密码。",
   "authorization.credential.title": "DSM 的登录凭据尚未就绪",
   "authorization.credential.body": "此 DSM 会话是恢复而来，并未使用密码登录，因此 DSM 无法为 {package} 的请求作证。请注销 DSM，使用密码重新登录，然后再打开 {package}。",
   "authorization.retry": "重试",

package/dist/templates/native-authorization/i18n/zh-TW.json

@@ -1,7 +1,8 @@
 {
-  "authorization.title": "{package} 需要您的授權",
+  "authorization.title": "{package} 需要授權",
   "authorization.purpose": "此套件執行固定的 root 操作前需要核准。密碼由 DSM 處理，套件不會看到或儲存。",
   "authorization.reason.grant_missing": "尚未授權 root 操作。",
+  "authorization.reason.upgrade_reapproval": "套件已透過套件中心更新，先前的授權已撤銷。",
   "authorization.reason.helper_untrusted": "無法信任特權 helper。",
   "authorization.reason.cli_untrusted": "無法信任特權命令。",
   "authorization.reason.grant_incompatible": "特權 helper 需要更新。",
@@ -11,14 +12,14 @@
   "authorization.reason.helper_health_rejected": "特權 helper 未通過健康檢查。",
   "authorization.reason.capability_missing": "特權 helper 缺少必要的能力。",
   "authorization.reason.unknown": "授權已遺失或不再有效。",
-  "authorization.next.install": "選擇「授權」，並以您的 DSM 密碼確認，即可核准此版本。",
-  "authorization.next.update": "此版本需要重新授權。請選擇「授權」，並以您的 DSM 密碼確認。",
+  "authorization.next.install": "選擇「授權」，並以 DSM 密碼確認，即可核准此版本。",
+  "authorization.next.update": "此版本需要重新授權。請選擇「授權」，並以 DSM 密碼確認。",
   "authorization.next.repair": "請在任務排程表中檢查此套件的任務，再重試。",
   "authorization.authorize": "授權",
   "authorization.authorizing": "正在等待 DSM…",
-  "authorization.failed": "授權未完成，您可以再試一次。",
+  "authorization.failed": "授權未完成，請再試一次。",
   "authorization.unavailable.title": "無法檢查授權",
-  "authorization.unavailable.body": "這通常是暫時的。請再試一次，{package} 不會要求您的密碼。",
+  "authorization.unavailable.body": "這通常是暫時的。請再試一次，{package} 不會要求輸入密碼。",
   "authorization.credential.title": "DSM 的登入憑證尚未就緒",
   "authorization.credential.body": "此 DSM 工作階段是還原而來，並未使用密碼登入，因此 DSM 無法為 {package} 的要求作證。請登出 DSM，以密碼重新登入，然後再開啟 {package}。",
   "authorization.retry": "重試",

package/dist/templates/native-go/README.md

@@ -38,8 +38,9 @@ Declare `capabilities.files: session` for interactive File Station access,
 `capabilities.jobs: true` for persistent package-account jobs,
 `capabilities.identity: standalone` for independent DSM login, and
 `capabilities.rootOps: true` for administrator-approved fixed executor operations.
-`init --with files,jobs,login,root-ops` supports plain and Vue UI.
-Jobs and `daemon` are mutually exclusive; `delegate` is not implemented until P2.
+`init --with files,jobs,root-ops` supports plain and Vue UI; `login` and
+`delegate` need the Vue UI. `daemon` cannot be combined with `jobs`, but it can
+be combined with an until-revoked `delegate`.
 
 ```sh
 synopkgland add files jobs login
@@ -126,7 +127,7 @@ access. The template ships no exceptions and sets DSM `allUsers` to `false`.
 | absent or `administrators` | `session_required` | `admin_required` | runs |
 | explicit `authenticated` | `session_required` | runs | runs |
 | explicit `public` | runs | runs | runs |
-| unregistered method | `session_required` | `admin_required` | `unknown_method` |
+| unregistered method | `session_required` | `unknown_method` | `unknown_method` |
 
 Missing or invalid JSON, duplicate keys, unknown permissions and rules for
 unregistered methods fail closed. The CLI validates the file and binds its
@@ -193,13 +194,24 @@ Known limits:
 - Directory reachability and DSM name-service freshness affect native role
   checks. The bridge bypasses DSM's administrator-role cache but cannot force
   an upstream directory replica to be current. It refuses unknown results.
-- The static Go CGI embeds a minimal native bridge for Linux amd64/arm64,
+- The static Go CGI embeds a minimal native bridge for Linux amd64/arm64/armv7,
   reproduced with Zig 0.16.0 from `internal/dsm/native/admin_check.c`. The bridge
   runs from a sealed memory file with a clean environment, a 3-second deadline
   and bounded output; no runtime Zig, compiler, writable executable or root
   privilege is required. The ELF files and build/source hashes are recorded in
   `native/provenance.json`. DSM must expose the native SDK symbol; otherwise
   authentication refuses access.
+- Kernels without `memfd_create` (DSM 7 on Linux 3.10: armv7 and the x86_64
+  `avoton`, `braswell`, `bromolow`, `grantley` and `cedarview` platforms) cannot
+  seal the bridge. Only there, the CGI stages it in the package's own
+  `/var/packages/<package>/tmp` (DSM mounts `/tmp` noexec): a fresh 0700
+  directory, a 0500 file reopened read-only and unlinked before it runs. The
+  seal guarantee is lost: between the write and the unlink, a process running
+  as the same package account could replace the bridge. That account already
+  runs the CGI, so the bridge never trusts anything that account does not
+  already control; other accounts cannot write the directory, which must be
+  owned by the package account and not group- or world-writable. Any other
+  memfd failure still refuses.
 
 ## Customize the UI
 
@@ -323,6 +335,11 @@ use a DSM term, copy its `text` from the glossary and add your key to the
 term's `keys`. A Vue or React UI can keep its own i18n library; `ctx.t` and
 `ctx.locale` are there if you want them.
 
+The Vue shell (`--ui vue`) keeps its text in `frontend/src/**/i18n/<locale>.json`,
+one folder per area (status page, sign-in, files, background jobs), in the same
+nine languages. Add new text to all nine files rather than writing it into a
+`.vue` file.
+
 ## Package an existing binary
 
 Keep the Go backend and call your tool from a handler (recommended: auth
@@ -343,6 +360,22 @@ It then owns everything `backend/internal/api` does for you: bounded reads,
 POST-only JSON, same-origin checks, authentication before any work, and a
 refusal for unknown methods.
 
+## DSM Application Portal link
+
+`synopkgland add portal` adds `portal: {}` to dsm-package.yaml so
+`https://<nas>/<alias>/` opens this app right after DSM sign-in. The install
+wizard proposes the alias (the package name in lowercase by default); an
+administrator turns it on from the app's portal panel or Control Panel >
+Login Portal > Applications. Ordinary users then see the link; until then
+they see "ask an administrator". DSM owns the setting: the backend's
+`portal.status` only reads it, and nothing in the package may write it. See
+`synopkgland skill show portal`.
+
+A portal needs DSM 7.3.2-86009 or later, so `add portal` raises a lower
+`os_min_ver` and build refuses one below it. DSM 7.1.1 rejects an unsigned
+package that registers a portal (Package Center error 320); 7.3.2 and 7.4
+install it; 7.2 is untested. To keep supporting older DSM, remove `portal:`.
+
 ## Data, upgrades, uninstall
 
 The backend stores data in `/var/packages/__PACKAGE__/var` (the package's
@@ -384,9 +417,9 @@ install reuses the old data and how to start clean.
 The generated SPK ships
 an uninstall wizard (English, plus eight other languages) with one box, **Also
 delete the app data listed above** (`pkgwizard_remove_additional`), unchecked by
-default. Ticked, `postuninst` empties `@appdata/<package>` and `@apphome/<package>`
-and nothing else: not `@appconf`, Shared Folders, the package account or other
-packages. An upgrade never deletes anything. Do not write your own `postuninst`;
+default. Ticked, `postuninst` empties `@appdata/<package>`, `@apphome/<package>`
+and `@appconf/<package>` and nothing else: not Shared Folders, the package
+account or other packages. An upgrade never deletes anything. Do not write your own `postuninst`;
 `synopkgland inspect` flags a deleting script that lacks the upgrade guard
 or deletes outside the package's own folders.
 
@@ -421,6 +454,6 @@ DSM testing.
 | | Status |
 | --- | --- |
 | Build hosts | macOS, Linux (any OS with Go and Node) |
-| Target CPUs | x86_64 and aarch64 DSM models (one SPK each) |
-| DSM | 7.1 or later declared (`os_min_ver`, change it with `init --min-dsm` or `build --min-dsm`). Installed and tested on DSM 7.4 (x86_64). aarch64 SPKs are built the same way but have not been run on a NAS. |
-| Not supported | 32-bit ARM, DSM 6, running anything as root without an administrator's approval |
+| Target CPUs | x86_64 and aarch64 DSM models (one SPK each). armv7 (DSM 7.2+ platforms `alpine`, `alpine4k`, `armada38x`, `monaco`) is opt-in: add it to `arches`; it covers the Go CGI (plain or Vue UI), jobs, daemon, root-ops and delegate. armv7 jobs, daemon and executor (root-ops, delegate) are built and checked locally but have not been verified on a NAS |
+| DSM | 7.1 or later declared (`os_min_ver`, change it with `init --min-dsm` or `build --min-dsm`). Installed and tested on DSM 7.4 and 7.3.2 (x86_64). armv7 was installed and tested on DSM 7.1.1 (`alpine4k`, Linux 3.10, where the bridge runs from the package tmp fallback) with administrator, AppPriv and unauthenticated requests; `armada38x` and `monaco` have not been run on a NAS. No x86_64 Linux 3.10 model has been tested. aarch64 SPKs are built the same way but have not been run on a NAS. |
+| Not supported | armv7 platforms only DSM 7.0/7.1 ship (`armada370`, `armada375`, `armadaxp`, `comcerto2k`); DSM 6, running anything as root without an administrator's approval |

package/dist/templates/native-go/backend/cmd/app/main.go

@@ -20,15 +20,22 @@ import (
 
 // Set by `synopkgland build-spk` through -ldflags -X; never read from a request.
 var (
-	delegateScope  = ""
-	executorDigest = ""
-	policyDigest   = ""
-	packageID      = "dev"
-	version        = "0.0.0"
+	delegateScope            = ""
+	delegateOperationsJSON   = ""
+	delegateDestinationsJSON = ""
+	delegateLifetime         = ""
+	executorDigest           = ""
+	policyDigest             = ""
+	packageID                = "dev"
+	version                  = "0.0.0"
 	// "session" when the project opted into the interactive File Station adapter.
 	fileStation = ""
 	// "standalone" enables the SDK identity adapter; the runtime owns authentication.
 	identity = ""
+	// dsm-package.yaml entry: "admin-only" or "app-privilege"; empty keeps the route policy alone.
+	entry = ""
+	// "on" when dsm-package.yaml declares portal: serves portal.status.
+	portal = ""
 )
 
 func main() {
@@ -39,15 +46,24 @@ func main() {
 		os.Exit(2)
 	}
 	cfg := app.Config{
-		DelegateScope:  delegateScope,
-		ExecutorDigest: executorDigest, PolicyDigest: policyDigest,
+		DelegateScope:            delegateScope,
+		DelegateOperationsJSON:   delegateOperationsJSON,
+		DelegateDestinationsJSON: delegateDestinationsJSON,
+		DelegateLifetime:         delegateLifetime,
+		ExecutorDigest:           executorDigest, PolicyDigest: policyDigest,
 		PackageID: packageID,
 		Version:   version,
 		DataDir:   "/var/packages/" + packageID + "/var",
+		Portal:    portal == "on",
+	}
+	if _, err := app.ParseDelegateConfig(cfg); err != nil {
+		log.Fatal(err)
 	}
 	if app.SessionFilesEnabled(fileStation) {
 		cfg.SessionFiles = filestation.Local(cfg.DataDir)
 	}
+	// Kernels without memfd_create stage DSM's bridges in the package's own temp.
+	dsm.SetBridgeFallbackDir("/var/packages/" + packageID + "/tmp")
 	var auth api.Authenticator = dsm.NewAuthenticator()
 	var standalone *standaloneidentity.Service
 	if identity == "standalone" {
@@ -58,6 +74,10 @@ func main() {
 		}
 		auth = standalone
 	}
+	auth, err := dsm.NewEntryGate(auth, entry, packageID, cfg.DataDir)
+	if err != nil {
+		log.Fatal(err)
+	}
 	srv, err := api.NewServer(auth, app.Routes(cfg)...)
 	if err != nil {
 		log.Fatal(err)

package/dist/templates/native-go/backend/go.mod

@@ -2,7 +2,7 @@ module dsmapp
 
 go 1.25.0
 
-toolchain go1.26.8
+toolchain go1.26.9
 
 require github.com/godbus/dbus/v5 v5.2.3-0.20260924123156-0ea052abeb82
 

package/dist/templates/native-go/backend/internal/api/entry_test.go

@@ -0,0 +1,47 @@
+package api
+
+import (
+	"context"
+	"encoding/json"
+	"errors"
+	"testing"
+)
+
+func TestEntryRefusalsReachTheBrowserAsStableCodes(t *testing.T) {
+	raw := []byte(`{"schema":1,"default":"administrators","methods":{"demo.user":"authenticated"}}`)
+	for _, tc := range []struct {
+		err  error
+		code string
+	}{
+		{ErrAdminRequired, "admin_required"},
+		{ErrAppPrivilegeDenied, "app_privilege_denied"},
+		{errors.New("bridge exited 2"), "auth_unavailable"},
+	} {
+		executed := 0
+		srv, err := NewServerWithPermissions(&fakeAuth{err: tc.err}, raw, Handle("demo.user", func(context.Context, Caller, json.RawMessage) (any, error) {
+			executed++
+			return nil, nil
+		}))
+		if err != nil {
+			t.Fatal(err)
+		}
+		for _, method := range []string{"demo.user", "future.unknown"} {
+			_, env := post(t, srv, `{"method":"`+method+`"}`)
+			if env.Error == nil || env.Error.Code != tc.code || executed != 0 {
+				t.Fatalf("%v %s: %+v executed=%d", tc.err, method, env.Error, executed)
+			}
+		}
+	}
+}
+
+func TestRequireAdminLetsHandlersReserveGlobalSettings(t *testing.T) {
+	if err := RequireAdmin(Caller{identity: Identity{User: "alice", Admin: true}, authenticated: true}); err != nil {
+		t.Fatal(err)
+	}
+	for _, c := range []Caller{{identity: Identity{User: "bob"}, authenticated: true}, {identity: Identity{User: "alice", Admin: true}}, {}} {
+		var apiErr *Error
+		if err := RequireAdmin(c); !errors.As(err, &apiErr) || apiErr.Code != "admin_required" {
+			t.Fatalf("%+v: %v", c, err)
+		}
+	}
+}

package/dist/templates/native-go/backend/internal/api/permissions_test.go

@@ -9,7 +9,7 @@ import (
 
 func TestDefaultPermissionsRequireAdministratorGroup(t *testing.T) {
 	for _, makeRoute := range []func(string, Handler) Route{User, Public, Admin} {
-		for _, method := range []string{"future.read", "future.unknown"} {
+		for method, code := range map[string]string{"future.read": "admin_required", "future.unknown": "unknown_method"} {
 			executed := 0
 			auth := &fakeAuth{user: "admin"} // Name alone confers no group membership.
 			srv, err := NewServer(auth, makeRoute("future.read", func(context.Context, Caller, json.RawMessage) (any, error) {
@@ -20,7 +20,7 @@ func TestDefaultPermissionsRequireAdministratorGroup(t *testing.T) {
 				t.Fatal(err)
 			}
 			_, env := post(t, srv, `{"method":"`+method+`","params":{"admin":true,"groups":["administrators"]}}`)
-			if env.Error == nil || env.Error.Code != "admin_required" || executed != 0 || auth.calls != 1 {
+			if env.Error == nil || env.Error.Code != code || executed != 0 || auth.calls != 1 {
 				t.Fatalf("method=%s error=%+v executed=%d auth=%d", method, env.Error, executed, auth.calls)
 			}
 		}
@@ -39,7 +39,7 @@ func TestCentralPermissionsAreTheOnlyAccessDecision(t *testing.T) {
 		t.Fatal(err)
 	}
 	for _, tc := range []struct{ method, code string }{
-		{"demo.user", ""}, {"demo.ping", ""}, {"demo.private", "admin_required"}, {"future.unknown", "admin_required"},
+		{"demo.user", ""}, {"demo.ping", ""}, {"demo.private", "admin_required"}, {"future.unknown", "unknown_method"},
 	} {
 		_, env := post(t, srv, `{"method":"`+tc.method+`"}`)
 		if tc.code == "" {

package/dist/templates/native-go/backend/internal/api/registry.go

@@ -102,6 +102,17 @@ func (c Caller) Authenticated() bool { return c.authenticated }
 func (c Caller) User() string        { return c.identity.User }
 func (c Caller) Admin() bool         { return c.authenticated && c.identity.Admin }
 
+var adminRequired = &Error{"admin_required", "this action needs the DSM administrators group"}
+
+// RequireAdmin reserves part of a shared route, such as global settings, for
+// DSM administrators. Whole routes are reserved in permissions.json instead.
+func RequireAdmin(c Caller) error {
+	if !c.Admin() {
+		return adminRequired
+	}
+	return nil
+}
+
 var methodName = regexp.MustCompile(`^[a-z][a-z0-9_]*(\.[a-z][a-z0-9_]*)+$`)
 
 func buildRegistry(routes []Route) (map[string]Route, error) {

package/dist/templates/native-go/backend/internal/api/sdk-permissions.json

@@ -23,6 +23,9 @@
     "bg.jobs.purge": "administrators",
     "bg.schedules.enable": "administrators"
   },
+  "portal": {
+    "portal.status": "authenticated"
+  },
   "identity": {
     "identity.status": "public",
     "identity.login": "public",
@@ -35,12 +38,22 @@
     "root.run": "administrators"
   },
   "delegate": {
+    "delegate.destination": "authenticated",
     "delegate.status": "authenticated",
     "delegate.create": "authenticated",
     "delegate.list": "authenticated",
     "delegate.revoke": "authenticated",
     "delegate.jobs.submit": "authenticated",
     "delegate.jobs.list": "authenticated",
-    "delegate.jobs.cancel": "authenticated"
+    "delegate.jobs.cancel": "authenticated",
+    "delegate.select_destination": "authenticated",
+    "delegate.move_from_staging": "authenticated",
+    "delegate.operations.get": "authenticated",
+    "delegate.operations.list": "authenticated",
+    "delegate.operations.cancel": "authenticated",
+    "delegate.disable": "administrators",
+    "delegate.enable": "administrators",
+    "delegate.audit": "authenticated",
+    "delegate.example.export": "authenticated"
   }
 }

package/dist/templates/native-go/backend/internal/api/server.go

@@ -40,6 +40,13 @@ func WithRequestDeadline(next http.Handler) http.Handler {
 // ErrNoSession means the request carries no valid DSM session.
 var ErrNoSession = errors.New("no valid DSM session")
 
+// ErrAdminRequired is an entry refusal: the app admits only administrators.
+var ErrAdminRequired = errors.New("app entry requires an administrator")
+
+// ErrAppPrivilegeDenied is an entry refusal: DSM Application Privileges do not
+// allow this account to use the app from this address.
+var ErrAppPrivilegeDenied = errors.New("DSM Application Privileges deny this app")
+
 // Authenticator verifies the DSM session behind a request.
 type Authenticator interface {
 	Authenticate(r *http.Request) (Identity, error)
@@ -212,18 +219,24 @@ func (s *Server) authorize(r *http.Request, method string) (Caller, Route, *Erro
 	if errors.Is(err, ErrNoSession) {
 		return Caller{}, Route{}, &Error{"session_required", "sign in to DSM again"}
 	}
+	if errors.Is(err, ErrAdminRequired) {
+		return Caller{}, Route{}, adminRequired
+	}
+	if errors.Is(err, ErrAppPrivilegeDenied) {
+		return Caller{}, Route{}, &Error{"app_privilege_denied", "DSM Application Privileges do not allow this account to use this app"}
+	}
 	if err != nil {
 		log.Printf("authentication unavailable: %v", err)
 		return Caller{}, Route{}, &Error{"auth_unavailable", "DSM authentication is unavailable"}
 	}
-	// Unknown methods inherit the fixed administrators default before revealing
-	// whether a handler exists. Route constructors never grant permission.
-	if (!known || route.policy == policyAdmin) && !identity.Admin {
-		return Caller{}, Route{}, &Error{"admin_required", "this action needs the DSM administrators group"}
-	}
+	// Signed-in callers learn that a method is unregistered; method names
+	// already ship in the app's UI. Route constructors never grant permission.
 	if !known {
 		return Caller{}, Route{}, &Error{"unknown_method", "unknown method"}
 	}
+	if route.policy == policyAdmin && !identity.Admin {
+		return Caller{}, Route{}, adminRequired
+	}
 	caller := Caller{identity: identity, authenticated: true}
 	return caller, route, nil
 }