@synopackageland/cli 0.6.1 → 0.7.1

package/dist/standalone/binary.js

@@ -1,6 +1,7 @@
 import { closeSync, lstatSync, openSync, readSync, realpathSync } from "node:fs";
 import { relative } from "node:path";
-export const ELF_MACHINE = { x86_64: 62, aarch64: 183 };
+export const ELF_MACHINE = { x86_64: 62, aarch64: 183, armv7: 40 };
+const ELF_CLASS64 = { x86_64: true, aarch64: true, armv7: false };
 const PT_INTERP = 3;
 const MAX_BINARY_BYTES = 256 * 1024 * 1024;
 const HEADER_BYTES = 64 * 1024;
@@ -9,7 +10,7 @@ function fail(code, message) {
 }
 /**
  * Checks a prebuilt CGI before it is packaged: a regular file inside the
- * project, a 64-bit little-endian ELF for `arch`, and statically linked
+ * project, a little-endian ELF of `arch`'s class and machine, and statically linked
  * (no PT_INTERP), because DSM models ship different libc versions.
  * Returns undefined when the file is acceptable.
  */
@@ -43,18 +44,31 @@ function readHeader(file) {
         closeSync(fd);
     }
 }
+/** The little-endian Linux ELF header fields the checks need, for either ELF class. */
+function readElfHeader(buf) {
+    if (buf.length < 52 || buf.toString("latin1", 0, 4) !== "\x7fELF" || buf[5] !== 1) {
+        return undefined;
+    }
+    const machine = buf.readUInt16LE(18);
+    if (buf[4] === 2 && buf.length >= 64) {
+        return { class64: true, machine, phoff: Number(buf.readBigUInt64LE(32)), phentsize: buf.readUInt16LE(54), phnum: buf.readUInt16LE(56) };
+    }
+    if (buf[4] === 1) {
+        return { class64: false, machine, phoff: buf.readUInt32LE(28), phentsize: buf.readUInt16LE(42), phnum: buf.readUInt16LE(44) };
+    }
+    return undefined;
+}
 function checkElf(buf, file, arch) {
-    const notElf = fail("STANDALONE_BINARY_NOT_ELF", `${file} 不是 64-bit little-endian Linux ELF 執行檔。`);
-    if (buf.length < 64 || buf.toString("latin1", 0, 4) !== "\x7fELF" || buf[4] !== 2 || buf[5] !== 1) {
+    const bits = ELF_CLASS64[arch] ? 64 : 32;
+    const notElf = fail("STANDALONE_BINARY_NOT_ELF", `${file} 不是 ${arch} 需要的 ${bits}-bit little-endian Linux ELF 執行檔。`);
+    const header = readElfHeader(buf);
+    if (!header || header.class64 !== ELF_CLASS64[arch]) {
         return notElf;
     }
-    const machine = buf.readUInt16LE(18);
+    const { machine, phoff, phentsize, phnum } = header;
     if (machine !== ELF_MACHINE[arch]) {
         return fail("STANDALONE_BINARY_ARCH_MISMATCH", `${file} 的 ELF machine 是 ${machine}，不是 ${arch}。`);
     }
-    const phoff = Number(buf.readBigUInt64LE(32));
-    const phentsize = buf.readUInt16LE(54);
-    const phnum = buf.readUInt16LE(56);
     if (phentsize < 4 || phoff + phentsize * phnum > buf.length) {
         return notElf;
     }

package/dist/standalone/build.d.ts

@@ -1,4 +1,4 @@
-import type { NativeArchFamily } from "../build-spk/dsm-arch.js";
+import { type NativeArchFamily } from "../build-spk/dsm-arch.js";
 export interface CommandResult {
     status: number | null;
     stderr: string;

package/dist/standalone/build.js

@@ -2,7 +2,8 @@ import { spawnSync } from "node:child_process";
 import { existsSync, mkdtempSync, rmSync } from "node:fs";
 import { tmpdir } from "node:os";
 import { join } from "node:path";
-import { resolveMinDsm, DEFAULT_MIN_DSM, isDsmAtLeast } from "../build-spk/dsm-version.js";
+import { goBuildEnv } from "../build-spk/dsm-arch.js";
+import { resolveMinDsm, DEFAULT_MIN_DSM, isDsmAtLeast, PORTAL_MIN_DSM, portalMinDsmMessage } from "../build-spk/dsm-version.js";
 import { checkCgiBinary } from "./binary.js";
 import { loadStandaloneManifest } from "./manifest.js";
 import { assembleStandaloneSpk, StandaloneBuildError } from "./spk.js";
@@ -10,7 +11,6 @@ import { buildDaemonControl } from "./daemon.js";
 import { buildExecutor } from "../runtime/executor-build.js";
 import { BACKGROUND_WORKER_MAIN } from "./background.js";
 import { readApiPermissions } from "./api-permissions.js";
-const GOARCH = { x86_64: "amd64", aarch64: "arm64" };
 /** Argv only, never a shell; output streams to the terminal except stderr, which is also kept. */
 export const runCommand = (command, args, options) => {
     const result = spawnSync(command, args, {
@@ -38,11 +38,14 @@ export async function buildStandalone(options) {
     if (manifest.capabilities.rootOps === true && !isDsmAtLeast(manifest.os_min_ver, DEFAULT_MIN_DSM)) {
         throw new StandaloneBuildError("STANDALONE_OS_MIN_VER_INVALID", `root templates require DSM ${DEFAULT_MIN_DSM} or later.`);
     }
+    if (manifest.portal && !isDsmAtLeast(manifest.os_min_ver, PORTAL_MIN_DSM)) {
+        throw new StandaloneBuildError("STANDALONE_PORTAL_MIN_DSM", `[STANDALONE_PORTAL_MIN_DSM] ${portalMinDsmMessage(manifest.os_min_ver, "portal")}`);
+    }
     const run = options.run ?? runCommand;
     const arches = options.arches ?? manifest.arches;
     for (const arch of arches) {
         if (!manifest.arches.includes(arch)) {
-            throw new StandaloneBuildError("STANDALONE_ARCH_NOT_DECLARED", `${arch} 不在 dsm-package.yaml 的 arches 內。`);
+            throw new StandaloneBuildError("STANDALONE_ARCH_NOT_DECLARED", `${arch} 不在 dsm-package.yaml 的 arches 內；要建置它，請先把 ${arch} 加進 arches。`);
         }
     }
     buildUi(manifest, run);
@@ -60,7 +63,7 @@ export async function buildStandalone(options) {
             }
             const outputPath = join(outDir, `${manifest.package}-${manifest.spkVersion}-${arch}.spk`);
             const daemonControl = buildDaemonControl(manifest, arch, work, run);
-            const backgroundWorker = buildBackgroundWorker(manifest, arch, work, run);
+            const backgroundWorker = buildBackgroundWorker(builtManifest, arch, work, run);
             await assembleStandaloneSpk({ manifest: builtManifest, arch, cgiPath, outputPath, daemonControl, backgroundWorker, executor });
             outputs.push(outputPath);
         }
@@ -103,14 +106,16 @@ function backendFor(manifest, arch, work, run) {
         `-X main.version=${manifest.spkVersion}`,
         `-X dsmapp/internal/api.expectedPermissionsDigest=${manifest.apiPermissionsDigest}`,
         `-X dsmapp/internal/api.expectedSDKPermissionsDigest=${manifest.apiSDKPermissionsDigest}`,
-        ...(manifest.capabilities.delegate ? [`-X ${JSON.stringify(`main.delegateScope=${manifest.capabilities.delegate.scope}`)}`] : []),
+        ...delegateBuildFlags(manifest),
         ...(manifest.executor ? [`-X main.executorDigest=${manifest.executor.executorDigest}`, `-X main.policyDigest=${manifest.executor.policyDigest}`] : []),
         ...(manifest.capabilities.identity ? [`-X main.identity=${manifest.capabilities.identity}`] : []),
         ...(manifest.capabilities.files || manifest.capabilities.delegate ? [`-X main.fileStation=session`] : []),
+        ...(manifest.entry ? [`-X main.entry=${manifest.entry}`] : []),
+        ...(manifest.portal ? ["-X main.portal=on"] : []),
     ].join(" ");
     const result = run("go", ["build", "-trimpath", "-buildvcs=false", "-ldflags", ldflags, "-o", out, backend.main], {
         cwd: backend.dir,
-        env: { ...process.env, CGO_ENABLED: "0", GOOS: "linux", GOARCH: GOARCH[arch] },
+        env: { ...process.env, ...goBuildEnv(arch) },
     });
     if (result.missing) {
         throw new StandaloneBuildError("STANDALONE_GO_MISSING", "找不到 go 指令。請安裝 Go 1.25 以上版本（https://go.dev/dl/），或改用 backend.binary 打包既有執行檔。");
@@ -125,10 +130,12 @@ function buildBackgroundWorker(manifest, arch, work, run) {
     if (!manifest.capabilities.jobs || manifest.backend.kind !== "go")
         return undefined;
     const out = join(work, `background-worker-${arch}`);
-    const ldflags = ["-s", "-w", "-buildid=", `-X main.packageID=${manifest.package}`].join(" ");
+    const ldflags = ["-s", "-w", "-buildid=", `-X main.packageID=${manifest.package}`, ...delegateBuildFlags(manifest),
+        ...(manifest.executor ? [`-X main.executorDigest=${manifest.executor.executorDigest}`, `-X main.policyDigest=${manifest.executor.policyDigest}`] : []),
+    ].join(" ");
     const result = run("go", ["build", "-trimpath", "-buildvcs=false", "-ldflags", ldflags, "-o", out, BACKGROUND_WORKER_MAIN], {
         cwd: manifest.backend.dir,
-        env: { ...process.env, CGO_ENABLED: "0", GOOS: "linux", GOARCH: GOARCH[arch] },
+        env: { ...process.env, ...goBuildEnv(arch) },
     });
     if (result.missing || result.status !== 0) {
         throw new StandaloneBuildError("STANDALONE_BACKGROUND_BUILD_FAILED", `background worker（${BACKGROUND_WORKER_MAIN}）build 失敗；這個專案的 backend 需要含該 package。\n${result.stderr}`);
@@ -138,3 +145,26 @@ function buildBackgroundWorker(manifest, arch, work, run) {
         throw new StandaloneBuildError(problem.code, problem.message);
     return out;
 }
+function delegateBuildFlags(manifest) {
+    const d = manifest.capabilities.delegate;
+    if (!d)
+        return [];
+    const values = {
+        delegateScope: d.scope,
+        delegateOperationsJSON: JSON.stringify([...d.operations].sort()),
+        delegateDestinationsJSON: JSON.stringify(d.destinations ? [...d.destinations].sort() : []),
+        delegateLifetime: d.lifetime ?? '',
+    };
+    // Go's quoted.Split does not process backslash escapes. Interior JSON quotes
+    // in a whitespace-free argument are literal; never shell-escape this string.
+    return Object.entries(values).map(([key, value]) => {
+        const arg = `main.${key}=${value}`;
+        if (!/\s/.test(arg))
+            return `-X ${arg}`;
+        if (!arg.includes("'"))
+            return `-X '${arg}'`;
+        if (!arg.includes('"'))
+            return `-X "${arg}"`;
+        throw new StandaloneBuildError('STANDALONE_GO_BUILD_FAILED', 'Delegate scope with whitespace and both quote types cannot be represented in Go linker flags.');
+    });
+}

package/dist/standalone/daemon.d.ts

@@ -15,6 +15,7 @@ export interface Daemon {
         start: number;
         stop: number;
         status: number;
+        uninstall: number;
     };
 }
 export declare function readDaemon(value: unknown, root: string, arches: NativeArchFamily[], fail: (error: StandaloneError) => void): Daemon | undefined;

package/dist/standalone/daemon.js

@@ -1,5 +1,6 @@
 import { chmodSync, copyFileSync, lstatSync, mkdirSync, readdirSync, realpathSync, writeFileSync } from "node:fs";
 import { isAbsolute, join, relative, resolve } from "node:path";
+import { PINNED_GO_HINT, pinnedGoBuildEnv, pinnedGoProblem } from "../build-spk/go-toolchain.js";
 import { templatesRoot } from "../template-paths.js";
 import { checkCgiBinary } from "./binary.js";
 import { StandaloneBuildError } from "./spk.js";
@@ -40,11 +41,12 @@ export function readDaemon(value, root, arches, fail) {
     if (!record(env) || Object.keys(env).length > 64 || Object.entries(env).some(([k, v]) => !envKey(k) || !token(v)))
         return invalid();
     const limits = value.timeouts ?? {};
-    if (!record(limits) || Object.keys(limits).some(k => !["start", "stop", "status"].includes(k)))
+    if (!record(limits) || Object.keys(limits).some(k => !["start", "stop", "status", "uninstall"].includes(k)))
         return invalid();
-    const timeouts = { start: limits.start ?? 5, stop: limits.stop ?? 10, status: limits.status ?? 2 };
+    // Defaults hold under IO load on a busy NAS; DSM's package unit allows 3600 s.
+    const timeouts = { start: limits.start ?? 30, stop: limits.stop ?? 30, status: limits.status ?? 5, uninstall: limits.uninstall ?? 60 };
     for (const [key, v] of Object.entries(timeouts)) {
-        if (!Number.isInteger(v) || v < (key === "start" ? 2 : key === "stop" ? 2 : 1) || v > (key === "status" ? 10 : 120))
+        if (!Number.isInteger(v) || v < (key === "status" ? 1 : 2) || v > (key === "status" ? 10 : 120))
             return invalid();
     }
     return { exec: value.exec, targets, args, ...(uninstall ? { uninstall_args: uninstall } : {}), env: Object.fromEntries(Object.keys(env).sort().map(key => [key, env[key]])), timeouts: timeouts };
@@ -58,13 +60,16 @@ export function buildDaemonControl(manifest, arch, work, run) {
         return undefined;
     const out = join(work, `daemon-control-${arch}`);
     const result = run("go", ["build", "-trimpath", "-buildvcs=false", "-ldflags", "-s -w -buildid=", "-o", out, "."], {
-        cwd: join(templatesRoot(), "_daemon"), env: { ...process.env, CGO_ENABLED: "0", GOOS: "linux", GOARCH: arch === "x86_64" ? "amd64" : "arm64" },
+        cwd: join(templatesRoot(), "_daemon"), env: { ...process.env, ...pinnedGoBuildEnv(arch) },
     });
     if (result.missing || result.status !== 0)
-        throw new StandaloneBuildError("STANDALONE_DAEMON_BUILD_FAILED", `daemon controller build 需要 Go 1.24 以上。\n${result.stderr}`);
+        throw new StandaloneBuildError("STANDALONE_DAEMON_BUILD_FAILED", `daemon controller build failed (${arch}). ${PINNED_GO_HINT}\n${result.stderr}`);
     const problem = checkCgiBinary(work, out, arch);
     if (problem)
         throw new StandaloneBuildError(problem.code, problem.message);
+    const toolchainProblem = pinnedGoProblem(out);
+    if (toolchainProblem)
+        throw new StandaloneBuildError("STANDALONE_DAEMON_BUILD_FAILED", toolchainProblem);
     return out;
 }
 export function copyDaemonPayload(manifest, arch, target, controller) {

package/dist/standalone/dsm-window.d.ts

@@ -1,4 +1,4 @@
-import type { StandaloneManifest } from "./manifest.js";
+import type { EntryMode, StandaloneManifest } from "./manifest.js";
 /** Same path the generated wrapper POSTs to, and the payload location of the CGI. */
 export declare const CGI_PAYLOAD_PATH = "ui/cgi/api.cgi";
 export declare function cgiUrl(packageId: string): string;
@@ -14,6 +14,8 @@ export declare const I18N_RUNTIME: string;
  * cached from the previous version after an upgrade.
  */
 export declare function windowScriptName(manifest: Pick<StandaloneManifest, "build">): string;
+/** The launcher fields an entry mode fixes; inspect checks a built SPK against them. */
+export declare function entryLauncherAccess(entry: EntryMode): Record<string, unknown>;
 /** `ui/config`: registers the DSM main-menu app and its window class. */
 export declare function renderUiConfig(manifest: StandaloneManifest): string;
 /**

package/dist/standalone/dsm-window.js

@@ -1,8 +1,9 @@
 import { REOPEN_EVENTS_RUNTIME } from "./reopen-events.js";
 import { DSM_LANGS } from "./i18n.js";
-import { ROOT_PANEL, ROOT_RUNTIME, rootTasks } from "./root-window.js";
+import { PASSWORD_CONFIRM, ROOT_PANEL, ROOT_RUNTIME, rootTasks } from "./root-window.js";
 import { HOST_ADAPTER_RUNTIME } from "./host-adapter.js";
 import { permitsOrdinaryUsers } from "./api-permissions.js";
+import { PORTAL_RUNTIME } from "./portal-window.js";
 /** Same path the generated wrapper POSTs to, and the payload location of the CGI. */
 export const CGI_PAYLOAD_PATH = "ui/cgi/api.cgi";
 export function cgiUrl(packageId) {
@@ -47,6 +48,20 @@ export const I18N_RUNTIME = `function createI18n(dsmLang, catalogs) {
 export function windowScriptName(manifest) {
     return `window-${String(manifest.build).padStart(4, "0")}.js`;
 }
+/**
+ * Who sees the main-menu entry. app-privilege also registers the app in
+ * Control Panel > Application Privileges (local and directory accounts, with
+ * IP rules); DSM then filters the launcher and the CGI checks the same rule.
+ */
+function launcherAccess(manifest) {
+    return manifest.entry ? entryLauncherAccess(manifest.entry) : { allUsers: permitsOrdinaryUsers(manifest.apiPermissions) };
+}
+/** The launcher fields an entry mode fixes; inspect checks a built SPK against them. */
+export function entryLauncherAccess(entry) {
+    return entry === "admin-only"
+        ? { allUsers: false }
+        : { allUsers: true, grantPrivilege: "all", advanceGrantPrivilege: true };
+}
 /** `ui/config`: registers the DSM main-menu app and its window class. */
 export function renderUiConfig(manifest) {
     const ns = `SYNO.SDS.${manifest.package}`;
@@ -59,7 +74,7 @@ export function renderUiConfig(manifest) {
                 icon: "images/app_{0}.png",
                 appWindow: `${ns}.MainWindow`,
                 allowMultiInstance: false,
-                allUsers: permitsOrdinaryUsers(manifest.apiPermissions),
+                ...launcherAccess(manifest),
                 depend: [`${ns}.MainWindow`],
             },
             [`${ns}.MainWindow`]: {
@@ -127,7 +142,14 @@ ${HOST_ADAPTER_RUNTIME}
   return createHostAdapter;
 })();
 
-${root ? root.definitions : ""}${ns}.loadApp = function (done) {
+${root || manifest.portal ? renderWebApi(ns) : ""}// A display hint for hiding or disabling administrator settings; the CGI
+// decides access on its own and never trusts this value.
+${ns}.sessionUser = function () {
+  var session = (SYNO.SDS && SYNO.SDS.Session) || {};
+  return { name: typeof session.user === "string" ? session.user : "", isAdmin: session.is_admin === true };
+};
+
+${root ? root.definitions : ""}${manifest.portal ? renderPortalDefinition(ns) : ""}${ns}.loadApp = function (done) {
   var apps = window.DsmPackageApps || {};
   if (apps[${p}]) {
     done(apps[${p}]);
@@ -186,6 +208,7 @@ ${root ? root.mount : ""}    ${ns}.loadApp(function (app) {
           call: ${ns}.call,
           files: {endpoint: ${JSON.stringify(cgiUrl(pkg))}, token: function () { return SYNO.SDS.Session && SYNO.SDS.Session.SynoToken; }},
           reopen: me.reopenEvents.subscribe,
+          user: ${ns}.sessionUser(),${manifest.portal ? `\n          portal: ${renderPortalAccess(ns, manifest)},` : ""}
           host: me.hostAccess,
           appWindow: me,
           lang: lang,
@@ -221,6 +244,50 @@ ${root ? root.mount : ""}    ${ns}.loadApp(function (app) {
     }
   }
 });
+`;
+}
+function renderPortalDefinition(ns) {
+    return `${ns}.createPortalAccess = (function () {
+${PORTAL_RUNTIME}
+  return createPortalAccess;
+})();
+
+`;
+}
+/**
+ * `ctx.portal`: administrators use their own DSM session; isAdmin only picks
+ * the path. The SDK ships the panel text in every DSM language, so it follows
+ * DSM even where the app has no catalog.
+ */
+function renderPortalAccess(ns, manifest) {
+    return `${ns}.createPortalAccess({
+            appId: ${JSON.stringify(`${ns}.Instance`)},
+            defaultAlias: ${JSON.stringify(manifest.portal.alias)},
+            isAdmin: function () { return ${ns}.sessionUser().isAdmin; },
+            send: ${ns}.webApi(me),
+            call: ${ns}.call,
+            launch: function (app, params) { SYNO.SDS.AppLaunch(app, params); },
+            location: window.location,
+            locale: ${ns}.createI18n(lang, ${JSON.stringify(Object.fromEntries(Object.keys(DSM_LANGS).map((locale) => [locale, {}])))}).locale
+          })`;
+}
+/** DSM WebAPI in the window's own session: resolves data, rejects `{code: "dsm_<n>"}`. */
+function renderWebApi(ns) {
+    return `// DSM WebAPI in the window's own session: resolves data, rejects {code: "dsm_<n>"}.
+${ns}.webApi = function (win) {
+  return function (api, method, version, params) {
+    return new Promise(function (resolve, reject) {
+      win.sendWebAPI({
+        api: api, method: method, version: version, params: params, scope: win,
+        callback: function (success, response) {
+          if (success) resolve(response);
+          else reject({ code: "dsm_" + ((response && response.code) || "error") });
+        }
+      });
+    });
+  };
+};
+
 `;
 }
 const ROOT_PANEL_CSS = [
@@ -249,6 +316,10 @@ ${ns}.mountRootPanel = (function () {
 ${ROOT_PANEL}
   return mountRootPanel;
 })();
+${ns}.createPasswordConfirm = (function () {
+${PASSWORD_CONFIRM}
+  return createPasswordConfirm;
+})();
 
 `,
         html: `autoScroll: true,
@@ -259,57 +330,15 @@ ${ROOT_PANEL}
     };
     var access = ${ns}.createRootAccess({
       tasks: ${ns}.rootTasks,
-      pins: ${JSON.stringify({ executorDigest: manifest.executor.executorDigest, policyDigest: manifest.executor.policyDigest })},
+      pins: ${JSON.stringify({ package: manifest.package, executorDigest: manifest.executor.executorDigest, policyDigest: manifest.executor.policyDigest })},
       user: session,
-      send: function (api, method, version, params) {
-        return new Promise(function (resolve, reject) {
-          me.sendWebAPI({
-            api: api, method: method, version: version, params: params, scope: me,
-            callback: function (success, response) {
-              if (success) resolve(response);
-              else reject({ code: "dsm_" + ((response && response.code) || "error") });
-            }
-          });
-        });
-      },
-      confirmPassword: function (suppliedPassword) {
-        // Send exactly one PasswordConfirm v2 auth with a masked password field.
-        return new Promise(function (resolve, reject) {
-          if (typeof suppliedPassword === "string" && suppliedPassword) {
-            me.sendWebAPI({api: "SYNO.Core.User.PasswordConfirm", method: "auth", version: 2, params: {password: suppliedPassword}, scope: me,
-              callback: function(success, response) { suppliedPassword = ""; if (!success) reject({code: "dsm_" + ((response && response.code) || "error")}); else resolve({confirmed: true, token: response && response.SynoConfirmPWToken}); }
-            });
-            suppliedPassword = "";
-            return;
-          }
-          var form = document.createElement("form"), label = document.createElement("label"), input = document.createElement("input");
-          var submit = document.createElement("button"), cancel = document.createElement("button");
-          label.textContent = "Confirm your DSM administrator password";
-          input.type = "password"; input.autocomplete = "current-password"; input.required = true;
-          label.appendChild(input); form.appendChild(label);
-          submit.type = "submit"; submit.textContent = "Approve"; form.appendChild(submit);
-          cancel.type = "button"; cancel.textContent = "Cancel"; form.appendChild(cancel);
-          me.body.dom.appendChild(form); input.focus();
-          function close() { input.value = ""; if (form.parentNode) form.parentNode.removeChild(form); }
-          cancel.onclick = function() { close(); resolve({confirmed: false}); };
-          form.onsubmit = function(event) {
-            event.preventDefault(); submit.disabled = cancel.disabled = true;
-            var password = input.value; input.value = "";
-            me.sendWebAPI({api: "SYNO.Core.User.PasswordConfirm", method: "auth", version: 2, params: {password: password}, scope: me,
-              callback: function(success, response) {
-                password = ""; close();
-                if (!success) { reject({code: "dsm_" + ((response && response.code) || "error")}); return; }
-                resolve({confirmed: true, token: response && response.SynoConfirmPWToken});
-              }
-            });
-          };
-        });
-      },
+      send: ${ns}.webApi(me),
+      confirmPassword: ${ns}.createPasswordConfirm(me),
       call: ${ns}.call,
       wait: function (ms) { return new Promise(function (resolve) { setTimeout(resolve, ms); }); }
     });
     var panels = me.body && me.body.dom.querySelector(".dsmapp-rootpanels");
-    if (panels) {
+    if (panels && ${manifest.ui.build !== undefined && manifest.capabilities.delegate?.scope === "install-selected" ? "false" : "true"}) {
       ${ns}.mountRootPanel(panels, access, null, ${ns}.rootTasks, session().admin);
     }
 `,

package/dist/standalone/inspect-spk.d.ts

@@ -1,4 +1,5 @@
 import { type ExecutorInspection } from "../runtime/executor-inspect.js";
+import type { EntryMode } from "./manifest.js";
 import { type UninstallCleanupItem } from "../runtime/uninstall-cleanup.js";
 export type SpkKind = "native-go" | "binary" | "container" | "native-layout";
 export interface SpkInspection {
@@ -22,6 +23,13 @@ export interface SpkInspection {
     }>;
     executor?: ExecutorInspection;
     uninstallCleanup?: UninstallCleanupItem[];
+    /** Application Portal entry; inactive until an administrator applies the alias. */
+    portal?: {
+        appId: string;
+        alias: string;
+    };
+    /** Declared `entry` mode; `admin-only` is the administrator floor of every route. */
+    entry?: EntryMode;
 }
 /** Reads an SPK without installing it and reports how it would run on DSM. */
 export declare function inspectStandaloneSpk(spkPath: string): Promise<SpkInspection>;