@synopackageland/cli 0.6.1 → 0.7.1

package/dist/standalone/native-authorization-window.js

@@ -4,6 +4,8 @@ export const AUTHORIZATION_RUNTIME = `function createAuthorizationAccess(options
   function fail(code) { var error = new Error(code); error.code = code; return error; }
   function status() { return options.call("authorization.status").then(function (d) {
     if (!d || d.command !== "authorization" || d.schema_version !== 1 || ["ready","authorization_required","not_admin","session_expired","unavailable"].indexOf(d.state) < 0) throw fail("authorization_bad_response");
+    // upgrade_reapproval is a reason-only tombstone: it can only explain a pending request.
+    if (d.reason === "upgrade_reapproval" && d.state !== "authorization_required") throw fail("authorization_bad_response");
     return d;
   }); }
   function plan(method) { return options.call(method).then(function (p) {
@@ -12,9 +14,15 @@ export const AUTHORIZATION_RUNTIME = `function createAuthorizationAccess(options
     p.operations.forEach(function (op) { if (seen[op] || !options.tasks.some(function (t) { return t.op === op; })) throw fail("authorization_bad_response"); seen[op] = true; });
     return p;
   }); }
+  // The backend's grant decides: a task still waiting at the window's limit, or
+  // one signalled after it wrote the grant, has still authorized the package.
+  function settled(e) {
+    if (!e || (e.code !== "root_timeout" && e.code !== "root_task_failed")) throw e;
+    return status().then(function (d) { if (d.state !== "ready") throw e; });
+  }
   function exclusive(fn) { if (busy) return busy; busy = Promise.resolve().then(fn).then(function (s) { busy = null; return s; },function (e) { busy = null; throw e; });return busy; }
   function authorize(ops,run) { return ops.reduce(function (previous,op) { return previous.then(function () {
-    return options.root.authorize(op).then(function (state) { if (state !== "ready") throw fail("root_cancelled"); return run ? options.root.run(op) : null; });
+    return options.root.authorize(op).then(function (state) { if (state !== "ready") throw fail("root_cancelled"); return run ? options.root.run(op).catch(settled) : null; });
   }); },Promise.resolve()); }
   return {canManage:function () {return !!options.user && options.user().admin === true;},status:status,request:function () { return exclusive(function () {
     return plan("authorization.request").then(function (p) { return authorize(p.operations,p.run === true); }).then(status,function (e) { if (e.code === "root_cancelled") return status();throw e; });

package/dist/standalone/native-layout.d.ts

@@ -1,3 +1,4 @@
+import { type PackageMetadata } from "../package-metadata.js";
 import type { CommandRunner } from './build.js';
 export declare const LAYOUT_ARCHES: {
     readonly x86_64: readonly [2, 62];
@@ -21,6 +22,7 @@ type Binary = {
     arches?: LayoutArch[];
 };
 export interface NativeLayout {
+    metadata?: PackageMetadata;
     root: string;
     package: string;
     version: string;
@@ -39,6 +41,7 @@ export interface NativeLayout {
         payload: string;
         metadata: string;
         binaries: Binary[];
+        anchors?: Record<string, string>;
     };
     native: {
         prepare?: Hook;

package/dist/standalone/native-layout.js

@@ -1,3 +1,4 @@
+import { validateMetadata, metadataInfoFields } from "../package-metadata.js";
 /** Existing native products: the CLI owns archives/INFO, the project owns its layout. */
 import { createHash } from 'node:crypto';
 import { chmodSync, copyFileSync, existsSync, lstatSync, mkdirSync, mkdtempSync, readFileSync, readdirSync, realpathSync, renameSync, rmSync, writeFileSync } from 'node:fs';
@@ -36,6 +37,20 @@ function inside(root, path) {
         fail('path escapes project');
     return full;
 }
+// Package Center writes INFO as root, so product root helpers can trust these
+// payload digests across upgrades. The synopkgland_ prefix stays reserved.
+function anchors(value) {
+    const a = object(value, Object.keys(value ?? {}));
+    if (Object.keys(a).length > 16)
+        fail('at most 16 INFO anchors');
+    for (const [key, path] of Object.entries(a)) {
+        if (!/^[a-z][a-z0-9_]{0,48}_sha256$/.test(key) || key.startsWith('synopkgland_'))
+            fail(`invalid INFO anchor key: ${key}`);
+        if (pathText(path).includes('{arch}'))
+            fail('INFO anchor path is relative to the architecture payload');
+    }
+    return a;
+}
 function hook(value) {
     const h = object(value, ['command', 'cwd', 'env']);
     if (!Array.isArray(h.command) || !h.command.length || !h.command.every((x) => typeof x === 'string' && x.length > 0 && !x.includes('\0')))
@@ -56,13 +71,15 @@ export function isNativeLayout(root) {
 }
 export function loadNativeLayout(root) {
     try {
-        const m = object(parse(readFileSync(join(root, 'dsm-package.yaml'), 'utf8')), ['schema', 'backend', 'package', 'version', 'build', 'displayname', 'description', 'maintainer', 'os_min_ver', 'privilege', 'arches', 'layout', 'native']);
+        const m = object(parse(readFileSync(join(root, 'dsm-package.yaml'), 'utf8')), ['schema', 'backend', 'package', 'version', 'build', 'displayname', 'description', 'maintainer', 'metadata', 'os_min_ver', 'privilege', 'arches', 'layout', 'native']);
         if (m.schema !== 2)
             fail('schema 2 required; migrate schema: 1 to schema: 2 and add backend: {kind: native}');
         const backend = object(m.backend, ['kind']);
         if (backend.kind !== 'native' || (m.privilege !== undefined && m.privilege !== 'none'))
             fail('backend.kind: native and package-only privilege required');
         m.privilege = 'none';
+        if (m.metadata !== undefined)
+            m.metadata = validateMetadata(m.metadata);
         if (existsSync(join(root, 'compose.yaml')))
             fail('compose.yaml and dsm-package.yaml are mutually exclusive');
         if (!/^[A-Za-z][A-Za-z0-9]{1,63}$/.test(text(m.package)) || !/^\d+(\.\d+){0,3}$/.test(text(m.version)) || !/^7\.\d+(\.\d+)?-\d+$/.test(text(m.os_min_ver)))
@@ -73,11 +90,13 @@ export function loadNativeLayout(root) {
             text(m[k]);
         if (!Array.isArray(m.arches) || !m.arches.length || new Set(m.arches).size !== m.arches.length || m.arches.some((a) => !Object.hasOwn(LAYOUT_ARCHES, a)))
             fail('invalid architecture list');
-        const layout = object(m.layout, ['payload', 'metadata', 'binaries']);
+        const layout = object(m.layout, ['payload', 'metadata', 'binaries', 'anchors']);
         layout.payload = pathText(layout.payload);
         layout.metadata = pathText(layout.metadata);
         if (!Array.isArray(layout.binaries) || !layout.binaries.length)
             fail('binary assertions required');
+        if (layout.anchors !== undefined)
+            layout.anchors = anchors(layout.anchors);
         for (const b of layout.binaries) {
             object(b, ['path', 'linkage', 'arches']);
             pathText(b.path);
@@ -300,8 +319,11 @@ export async function buildNativeLayout(options) {
             await createReproducibleTar(target, join(stage, 'package.tgz'), { gzip: true });
             rmSync(target, { recursive: true });
             const fields = { package: m.package, version, arch, os_min_ver: m.os_min_ver, displayname: m.displayname, description: m.description, maintainer: m.maintainer, dsmuidir: 'ui', dsmappname: `SYNO.SDS.${m.package}.Instance`, startable: 'yes', thirdparty: 'yes', checksum: createHash('md5').update(readFileSync(join(stage, 'package.tgz'))).digest('hex') };
-            writeFileSync(join(stage, 'INFO'), Object.entries(fields).map(([k, v]) => `${k}="${v}"\n`).join(''));
-            writeFileSync(join(stage, 'native-layout.json'), JSON.stringify({ format: 1, arch, binaries: binaries.map(({ path, linkage }) => ({ path, linkage })), files }));
+            const info = [...Object.entries(fields), ...metadataInfoFields(m.metadata), ...anchorFields(m.layout.anchors ?? {}, files)];
+            if (new Set(info.map(([k]) => k)).size !== info.length)
+                fail('INFO anchor collides with an INFO field');
+            writeFileSync(join(stage, 'INFO'), info.map(([k, v]) => `${k}="${v.replace(/([\\"$`])/g, '\\$1')}"\n`).join(''));
+            writeFileSync(join(stage, 'native-layout.json'), JSON.stringify({ format: 1, arch, binaries: binaries.map(({ path, linkage }) => ({ path, linkage })), files, ...(m.layout.anchors ? { anchors: m.layout.anchors } : {}) }));
             const output = join(options.outDir ?? join(m.root, 'dist'), `${m.package}-${version}-${arch}.spk`);
             mkdirSync(dirname(output), { recursive: true });
             await createReproducibleTar(stage, output);
@@ -319,7 +341,7 @@ export function inspectNativeLayout(dir, payload, info) {
     try {
         if (!/^[A-Za-z][A-Za-z0-9]{1,63}$/.test(info.package ?? '') || !/^\d+(\.\d+){0,3}-\d+$/.test(info.version ?? '') || !/^7\.\d+(\.\d+)?-\d+$/.test(info.os_min_ver ?? ''))
             fail('invalid native INFO identity/version/DSM');
-        const inv = object(JSON.parse(readFileSync(join(dir, 'native-layout.json'), 'utf8')), ['format', 'arch', 'binaries', 'files']);
+        const inv = object(JSON.parse(readFileSync(join(dir, 'native-layout.json'), 'utf8')), ['format', 'arch', 'binaries', 'files', 'anchors']);
         if (inv.format !== 1 || inv.arch !== info.arch || !Object.hasOwn(LAYOUT_ARCHES, inv.arch))
             fail('invalid native layout inventory');
         checkLayoutMetadata(dir, true, info.package);
@@ -337,9 +359,19 @@ export function inspectNativeLayout(dir, payload, info) {
         }
         if (createHash('md5').update(readFileSync(join(dir, 'package.tgz'))).digest('hex') !== info.checksum)
             fail('package checksum mismatch');
+        checkInfoAnchors(readFileSync(join(dir, 'INFO'), 'utf8'), inv.anchors === undefined ? {} : anchors(inv.anchors), actual);
         return [];
     }
     catch (e) {
         return [String(e)];
     }
 }
+function anchorFields(declared, files) {
+    return Object.entries(declared).map(([key, path]) => [key, files.find(f => f.path === path)?.sha256 ?? fail(`INFO anchor file missing: ${path}`)]);
+}
+function checkInfoAnchors(info, declared, files) {
+    const lines = info.split('\n').filter(line => /^[a-z0-9_]+_sha256=/.test(line));
+    const expected = anchorFields(declared, files).map(([key, digest]) => `${key}="${digest}"`);
+    if (JSON.stringify(lines.sort()) !== JSON.stringify(expected.sort()))
+        fail('INFO anchors do not match the payload');
+}

package/dist/standalone/native-root-window.d.ts

@@ -17,10 +17,12 @@ export interface RootTask {
  *   with exactly the embedded script. The one-use token goes into that single
  *   create call and is never kept.
  * - run: re-reads the task and runs it only if it is still exactly ours, then
- *   waits for its history entry and asks the backend for the output. Repair
+ *   waits for its history entry and asks the backend for the output. A queued
+ *   or running task keeps the wait going, up to RUN_LIMIT_MS (loaded NAS took
+ *   4.5 minutes), and `options.progress({op, state, elapsedMs})` hears each poll. Repair
  *   additionally requires fresh PasswordConfirm and another exact task check.
  * - an older version of our task is "outdated" and never runs; authorizing
  *   again replaces it. A same-named task that is not ours is a "conflict" and
  *   is never run, replaced or deleted.
  */
-export declare const ROOT_RUNTIME = "function createRootAccess(options) {\n  var API = \"SYNO.Core.TaskScheduler\";\n  var POLL_MS = 500, POLLS = 60;\n  var byOp = {}, running = {};\n  var legacy = null, probe = null;\n  options.tasks.forEach(function (task) { byOp[task.op] = task; });\n\n  function fail(code) {\n    var error = new Error(code);\n    error.code = code;\n    return error;\n  }\n  function begin(op) {\n    if (!Object.prototype.hasOwnProperty.call(byOp, op)) return Promise.reject(fail(\"root_unknown_op\"));\n    if (options.user().admin !== true) return Promise.reject(fail(\"admin_required\"));\n    return Promise.resolve(byOp[op]);\n  }\n  function readOutput(task) {\n    return task.output ? options.call(\"root.output\", { op: task.op }) : Promise.resolve(null);\n  }\n  function isRootTask(summary) {\n    return summary.owner === \"root\" && summary.real_owner === \"root\" && summary.enable === false && summary.type === \"script\";\n  }\n  function listTasks() {\n    if (legacy === false) return options.send(API, \"list\", 3, { start: 0, limit: 500 });\n    if (legacy === true) return legacyList();\n    if (!probe) {\n      probe = options.send(API, \"list\", 3, { start: 0, limit: 500 }).then(function (data) {\n        legacy = false;\n        return data;\n      }, function (error) {\n        if (!error || (error.code !== \"dsm_103\" && error.code !== 103)) {\n          probe = null;\n          throw error;\n        }\n        legacy = true;\n        return legacyList();\n      });\n    }\n    return probe;\n  }\n  function legacyList() {\n    return options.send(API, \"list\", 2, { offset: 0, limit: 500 }).then(function (data) {\n      // Refuse a truncated snapshot: a same-named task could lie outside it.\n      if (!data || !Array.isArray(data.tasks) || data.tasks.length > 500\n          || !(typeof data.total === \"number\" && isFinite(data.total) && Math.floor(data.total) === data.total) || data.total !== data.tasks.length) throw fail(\"root_bad_response\");\n      return data;\n    });\n  }\n  function readTask(ref) {\n    return options.send(API, \"get\", legacy ? 3 : 4, ref);\n  }\n  function createTask(params) {\n    return options.send(legacy ? API : API + \".Root\", \"create\", legacy ? 3 : 4, params);\n  }\n  function deleteTask(ref) {\n    return options.send(API, \"delete\", 2, { tasks: [ref] });\n  }\n  function runTask(ref) {\n    return options.send(API, \"run\", 2, { tasks: [ref] });\n  }\n  function find(task) {\n    return listTasks().then(function (data) {\n      if (!data || !Array.isArray(data.tasks)) throw fail(\"root_bad_response\");\n      var named = data.tasks.filter(function (summary) { return summary && summary.name === task.name; });\n      if (named.length === 0) return { state: \"missing\" };\n      if (named.length > 1 || !isRootTask(named[0])) return { state: \"conflict\" };\n      var ref = { id: named[0].id, real_owner: named[0].real_owner };\n      return readTask(ref).then(function (detail) {\n        var script = detail && detail.extra && detail.extra.script;\n        if (!detail || String(detail.id) !== String(ref.id) || detail.name !== task.name\n            || detail.owner !== \"root\" || detail.real_owner !== ref.real_owner || detail.enable !== false || detail.type !== \"script\" || typeof script !== \"string\") {\n          return { state: \"conflict\" };\n        }\n        if (script === task.script) return { state: \"ready\", ref: ref };\n        if (script.indexOf(task.header) === 0) return { state: \"outdated\", ref: ref };\n        return { state: \"conflict\" };\n      });\n    });\n  }\n  function definition(task, user) {\n    var hours = [];\n    for (var h = 1; h <= 23; h++) hours.push(h);\n    return {\n      name: task.name,\n      real_owner: user,\n      owner: \"root\",\n      enable: false,\n      type: \"script\",\n      schedule: {\n        date_type: 0, week_day: \"0,1,2,3,4,5,6\", repeat_date: 1001, monthly_week: [], hour: 0, minute: 0,\n        repeat_hour: 0, repeat_min: 0, last_work_hour: 0,\n        repeat_min_store_config: [1, 5, 10, 15, 20, 30], repeat_hour_store_config: hours\n      },\n      extra: { notify_enable: false, script: task.script, notify_mail: \"\", notify_if_error: false }\n    };\n  }\n  function newest(history) {\n    if (!Array.isArray(history)) throw fail(\"root_bad_response\");\n    return history.reduce(function (latest, entry) {\n      return entry && (!latest || Number(entry.timestamp) > Number(latest.timestamp)) ? entry : latest;\n    }, null);\n  }\n  function history(ref) {\n    return options.send(API, \"get_history_status_list\", 1, { id: ref.id }).then(newest);\n  }\n  function waitForRun(ref, before, polls) {\n    return history(ref).then(function (latest) {\n      var finished = latest && (!before || latest.timestamp !== before.timestamp)\n        && latest.exit_type !== \"running\" && latest.stop_time;\n      if (finished) {\n        if (latest.exit_code !== 0) throw fail(\"root_task_failed\");\n        return;\n      }\n      if (polls <= 1) throw fail(\"root_timeout\");\n      return options.wait(POLL_MS).then(function () { return waitForRun(ref, before, polls - 1); });\n    });\n  }\n\n  function validTime(value) {\n    if (typeof value !== \"string\" || !/^\\d{4}-\\d{2}-\\d{2} \\d{2}:\\d{2}:\\d{2}$/.test(value)) return false;\n    var normalized = value.replace(\" \", \"T\") + \"Z\";\n    var date = new Date(normalized);\n    return !isNaN(date.getTime()) && date.toISOString().slice(0, 19) === normalized.slice(0, 19);\n  }\n  function bounded(call, deadline) {\n    // A poll count alone cannot bound a stalled DSM callback. Discard late replies.\n    return new Promise(function (resolve, reject) {\n      var remaining = deadline - Date.now();\n      if (remaining <= 0) { reject(fail(\"root_timeout\")); return; }\n      var timer = setTimeout(function () { reject(fail(\"root_timeout\")); }, remaining);\n      Promise.resolve().then(call).then(function (value) {\n        clearTimeout(timer);\n        if (Date.now() >= deadline) reject(fail(\"root_timeout\"));\n        else resolve(value);\n      }, function (error) { clearTimeout(timer); reject(error); });\n    });\n  }\n  function legacyHistory(ref, deadline) {\n    return bounded(function () { return options.send(API, \"view\", 1, { id: ref.id }); }, deadline).then(function (records) {\n      // DSM 7.1 omits data entirely when a task has never run.\n      if (records === undefined) records = [];\n      if (!Array.isArray(records) || records.length > 500) throw fail(\"root_bad_response\");\n      var seen = {};\n      records.forEach(function (record) {\n        if (!record || !validTime(record.start_time) || typeof record.stop_time !== \"string\"\n            || (record.stop_time && (!validTime(record.stop_time) || record.stop_time < record.start_time))\n            || typeof record.exit_type !== \"string\" || !(typeof record.exit_code === \"number\" && isFinite(record.exit_code) && Math.floor(record.exit_code) === record.exit_code)\n            || seen[record.start_time]) throw fail(\"root_bad_response\");\n        seen[record.start_time] = true;\n      });\n      return records;\n    });\n  }\n  function waitForLegacyRun(ref, before, deadline, polls) {\n    return legacyHistory(ref, deadline).then(function (records) {\n      var previous = before.map(function (record) { return record.start_time; });\n      var newestBefore = previous.slice().sort().pop();\n      var fresh = records.filter(function (record) { return previous.indexOf(record.start_time) === -1; });\n      if (fresh.length > 1) throw fail(\"root_bad_response\");\n      var latest = fresh[0];\n      if (latest && (!newestBefore || latest.start_time > newestBefore) && latest.stop_time) {\n        if (latest.exit_code !== 0 || latest.exit_type !== \"normal\") throw fail(\"root_task_failed\");\n        return;\n      }\n      if (polls <= 1 || Date.now() >= deadline) throw fail(\"root_timeout\");\n      return options.wait(Math.min(POLL_MS, deadline - Date.now())).then(function () {\n        return waitForLegacyRun(ref, before, deadline, polls - 1);\n      });\n    });\n  }\n  function execute(task, verified) {\n    if (!legacy) {\n      return history(verified.ref).then(function (before) {\n        return runTask(verified.ref).then(function () { return waitForRun(verified.ref, before, POLLS); });\n      });\n    }\n    var deadline = Date.now() + POLL_MS * POLLS;\n    return legacyHistory(verified.ref, deadline).then(function (before) {\n      if (before.some(function (record) { return !record.stop_time || record.exit_type === \"running\"; })) throw fail(\"root_not_ready\");\n      // Mutating calls are sent exactly once, never retried with another profile.\n      return bounded(function () { return runTask(verified.ref); }, deadline).then(function () {\n        return waitForLegacyRun(verified.ref, before, deadline, POLLS);\n      });\n    }).then(function () {\n      return bounded(function () { return find(task); }, deadline).then(function (after) {\n        if (after.state !== \"ready\" || String(after.ref.id) !== String(verified.ref.id)) throw fail(\"root_verify_failed\");\n      });\n    });\n  }\n  function performRun(op) {\n    return begin(op).then(function (task) {\n      return find(task).then(function (found) {\n        if (found.state !== \"ready\") throw fail(\"root_not_ready\");\n        var consent = op === \"helper_repair\" ? options.confirmPassword() : Promise.resolve({ confirmed: true });\n        return consent.then(function (confirmation) {\n          if (!confirmation || confirmation.confirmed !== true) throw fail(\"root_cancelled\");\n          return op === \"helper_repair\" ? begin(op).then(find) : found;\n        }).then(function (verified) {\n          if (verified.state !== \"ready\") throw fail(\"root_not_ready\");\n          return execute(task, verified);\n        });\n      }).then(function () { return readOutput(task); });\n    });\n  }\n\n  return {\n    state: function (op) {\n      return begin(op).then(find).then(function (found) { return found.state; });\n    },\n    authorize: function (op) {\n      return begin(op).then(function (task) {\n        return find(task).then(function (found) {\n          if (found.state === \"ready\") return \"ready\";\n          if (found.state === \"conflict\") throw fail(\"root_conflict\");\n          return options.confirmPassword().then(function (confirmation) {\n            if (!confirmation || confirmation.confirmed !== true) return \"cancelled\";\n            if (!legacy && (typeof confirmation.token !== \"string\" || !confirmation.token)) throw fail(\"root_verify_failed\");\n            var params = definition(task, options.user().name);\n            if (!legacy) params.SynoConfirmPWToken = confirmation.token;\n            // Re-read after the legacy client-side dialog before replacing a task.\n            var checked = legacy ? begin(op).then(find) : Promise.resolve(found);\n            return checked.then(function (current) {\n              if (current.state === \"conflict\") throw fail(\"root_conflict\");\n              if (current.state === \"ready\") return;\n              var replaced = current.state === \"outdated\" ? deleteTask(current.ref) : Promise.resolve();\n              return replaced.then(function () { return createTask(params); });\n            }).then(function () {\n              return find(task);\n            }).then(function (after) {\n              if (after.state !== \"ready\") throw fail(\"root_verify_failed\");\n              return \"ready\";\n            });\n          });\n        });\n      });\n    },\n    run: function (op) {\n      if (!Object.prototype.hasOwnProperty.call(byOp, op)) return Promise.reject(fail(\"root_unknown_op\"));\n      if (options.user().admin !== true) return Promise.reject(fail(\"admin_required\"));\n      if (running[op]) return running[op];\n      var pending = performRun(op).then(function (value) {\n        delete running[op];\n        return value;\n      }, function (error) { delete running[op]; throw error; });\n      running[op] = pending;\n      return pending;\n    },\n    remove: function (op) {\n      return begin(op).then(function (task) {\n        return find(task).then(function (found) {\n          if (found.state === \"missing\") return \"missing\";\n          if (found.state === \"conflict\") throw fail(\"root_conflict\");\n          return deleteTask(found.ref).then(function () {\n            return find(task);\n          }).then(function (after) {\n            if (after.state !== \"missing\") throw fail(\"root_verify_failed\");\n            return \"missing\";\n          });\n        });\n      });\n    },\n    output: function (op) {\n      return begin(op).then(readOutput);\n    }\n  };\n}";
+export declare const ROOT_RUNTIME: string;

package/dist/standalone/native-root-window.js

@@ -1,3 +1,4 @@
+import { versionUnsupported } from "../runtime/dsm-version.js";
 /**
  * `createRootAccess(options)` → `{ state, authorize, run, remove }`, plain
  * ES5 for DSM's desktop. Every DSM call goes through `options.send` (the
@@ -7,7 +8,9 @@
  *   with exactly the embedded script. The one-use token goes into that single
  *   create call and is never kept.
  * - run: re-reads the task and runs it only if it is still exactly ours, then
- *   waits for its history entry and asks the backend for the output. Repair
+ *   waits for its history entry and asks the backend for the output. A queued
+ *   or running task keeps the wait going, up to RUN_LIMIT_MS (loaded NAS took
+ *   4.5 minutes), and `options.progress({op, state, elapsedMs})` hears each poll. Repair
  *   additionally requires fresh PasswordConfirm and another exact task check.
  * - an older version of our task is "outdated" and never runs; authorizing
  *   again replaces it. A same-named task that is not ours is a "conflict" and
@@ -15,11 +18,20 @@
  */
 export const ROOT_RUNTIME = `function createRootAccess(options) {
   var API = "SYNO.Core.TaskScheduler";
-  var POLL_MS = 500, POLLS = 60;
+  var POLL_MS = 500, MAX_POLL_MS = 2000, RUN_LIMIT_MS = 10 * 60 * 1000;
   var byOp = {}, running = {};
   var legacy = null, probe = null;
+  var versionUnsupported = ${versionUnsupported.toString()};
   options.tasks.forEach(function (task) { byOp[task.op] = task; });
 
+  function now() { return options.now ? options.now() : Date.now(); }
+  function report(task, state, started) {
+    if (typeof options.progress !== "function") return;
+    try { options.progress({ op: task.op, state: state, elapsedMs: now() - started }); } catch (error) {}
+  }
+  function pause(interval, deadline) {
+    return options.wait(Math.max(0, Math.min(interval, deadline - now())));
+  }
   function fail(code) {
     var error = new Error(code);
     error.code = code;
@@ -44,7 +56,7 @@ export const ROOT_RUNTIME = `function createRootAccess(options) {
         legacy = false;
         return data;
       }, function (error) {
-        if (!error || (error.code !== "dsm_103" && error.code !== 103)) {
+        if (!error || !versionUnsupported(error.code)) {
           probe = null;
           throw error;
         }
@@ -119,16 +131,18 @@ export const ROOT_RUNTIME = `function createRootAccess(options) {
   function history(ref) {
     return options.send(API, "get_history_status_list", 1, { id: ref.id }).then(newest);
   }
-  function waitForRun(ref, before, polls) {
+  function waitForRun(task, ref, before, started, deadline, interval) {
     return history(ref).then(function (latest) {
-      var finished = latest && (!before || latest.timestamp !== before.timestamp)
-        && latest.exit_type !== "running" && latest.stop_time;
-      if (finished) {
+      var fresh = latest && (!before || latest.timestamp !== before.timestamp);
+      if (fresh && latest.exit_type !== "running" && latest.stop_time) {
         if (latest.exit_code !== 0) throw fail("root_task_failed");
         return;
       }
-      if (polls <= 1) throw fail("root_timeout");
-      return options.wait(POLL_MS).then(function () { return waitForRun(ref, before, polls - 1); });
+      report(task, fresh ? "running" : "queued", started);
+      if (now() >= deadline) throw fail("root_timeout");
+      return pause(interval, deadline).then(function () {
+        return waitForRun(task, ref, before, started, deadline, Math.min(interval * 2, MAX_POLL_MS));
+      });
     });
   }
 
@@ -141,12 +155,12 @@ export const ROOT_RUNTIME = `function createRootAccess(options) {
   function bounded(call, deadline) {
     // A poll count alone cannot bound a stalled DSM callback. Discard late replies.
     return new Promise(function (resolve, reject) {
-      var remaining = deadline - Date.now();
+      var remaining = deadline - now();
       if (remaining <= 0) { reject(fail("root_timeout")); return; }
       var timer = setTimeout(function () { reject(fail("root_timeout")); }, remaining);
       Promise.resolve().then(call).then(function (value) {
         clearTimeout(timer);
-        if (Date.now() >= deadline) reject(fail("root_timeout"));
+        if (now() >= deadline) reject(fail("root_timeout"));
         else resolve(value);
       }, function (error) { clearTimeout(timer); reject(error); });
     });
@@ -167,7 +181,7 @@ export const ROOT_RUNTIME = `function createRootAccess(options) {
       return records;
     });
   }
-  function waitForLegacyRun(ref, before, deadline, polls) {
+  function waitForLegacyRun(task, ref, before, started, deadline, interval) {
     return legacyHistory(ref, deadline).then(function (records) {
       var previous = before.map(function (record) { return record.start_time; });
       var newestBefore = previous.slice().sort().pop();
@@ -178,24 +192,25 @@ export const ROOT_RUNTIME = `function createRootAccess(options) {
         if (latest.exit_code !== 0 || latest.exit_type !== "normal") throw fail("root_task_failed");
         return;
       }
-      if (polls <= 1 || Date.now() >= deadline) throw fail("root_timeout");
-      return options.wait(Math.min(POLL_MS, deadline - Date.now())).then(function () {
-        return waitForLegacyRun(ref, before, deadline, polls - 1);
+      report(task, latest ? "running" : "queued", started);
+      if (now() >= deadline) throw fail("root_timeout");
+      return pause(interval, deadline).then(function () {
+        return waitForLegacyRun(task, ref, before, started, deadline, Math.min(interval * 2, MAX_POLL_MS));
       });
     });
   }
   function execute(task, verified) {
+    var started = now(), deadline = started + RUN_LIMIT_MS;
     if (!legacy) {
       return history(verified.ref).then(function (before) {
-        return runTask(verified.ref).then(function () { return waitForRun(verified.ref, before, POLLS); });
+        return runTask(verified.ref).then(function () { return waitForRun(task, verified.ref, before, started, deadline, POLL_MS); });
       });
     }
-    var deadline = Date.now() + POLL_MS * POLLS;
     return legacyHistory(verified.ref, deadline).then(function (before) {
       if (before.some(function (record) { return !record.stop_time || record.exit_type === "running"; })) throw fail("root_not_ready");
       // Mutating calls are sent exactly once, never retried with another profile.
       return bounded(function () { return runTask(verified.ref); }, deadline).then(function () {
-        return waitForLegacyRun(verified.ref, before, deadline, POLLS);
+        return waitForLegacyRun(task, verified.ref, before, started, deadline, POLL_MS);
       });
     }).then(function () {
       return bounded(function () { return find(task); }, deadline).then(function (after) {

package/dist/standalone/portal-window.d.ts

@@ -0,0 +1,21 @@
+type PortalLocale = "en" | "zh-TW" | "zh-CN" | "ja" | "ko" | "de" | "fr" | "es" | "it";
+/** SDK-owned portal panel text, shared by the plain panel and the Vue template. */
+export declare const PORTAL_MESSAGES: Record<string, Record<PortalLocale, string>>;
+/**
+ * `createPortalAccess(options)` → `ctx.portal`, plain ES5 for DSM's desktop.
+ *
+ * An administrator reads and sets the alias with DSM's own
+ * SYNO.Core.AppPortal API in their own session, after SYNO.API.Info shows the
+ * API; DSM itself refuses everyone else (105). An ordinary user reads the
+ * alias only through the package backend's `portal.status`. Anything
+ * unexpected reads as `unavailable`; an administrator then gets only the
+ * Control Panel shortcut.
+ *
+ * `status()` resolves `{state, alias?, url?, canManage, controlPanel,
+ * defaultAlias}`; `apply(alias)` and `disable()` resolve the new status or
+ * reject `{code}`; `openControlPanel()` opens Login Portal > Applications.
+ * `messages` is the panel text in the window's locale; `mountPanel(element)`
+ * renders a plain panel for UIs without their own.
+ */
+export declare const PORTAL_RUNTIME: string;
+export {};

package/dist/standalone/portal-window.js

@@ -0,0 +1,155 @@
+import { PORTAL_ALIAS_PATTERN, RESERVED_PORTAL_ALIASES } from "../portal/alias.js";
+/** SDK-owned portal panel text, shared by the plain panel and the Vue template. */
+export const PORTAL_MESSAGES = {
+    title: { en: "Application Portal", "zh-TW": "應用程式入口", "zh-CN": "应用程序门户", ja: "アプリケーションポータル", ko: "응용 프로그램 포털", de: "Anwendungsportal", fr: "Portail d'application", es: "Portal de aplicaciones", it: "Portale applicazioni" },
+    link: { en: "Direct link after DSM sign-in:", "zh-TW": "DSM 登入後的直接連結：", "zh-CN": "DSM 登录后的直接链接：", ja: "DSM サインイン後の直接リンク：", ko: "DSM 로그인 후 바로 가기 링크:", de: "Direkter Link nach der DSM-Anmeldung:", fr: "Lien direct après connexion à DSM :", es: "Enlace directo tras iniciar sesión en DSM:", it: "Link diretto dopo l'accesso a DSM:" },
+    inactive: { en: "Not active. Apply an alias to let users open this app directly after DSM sign-in.", "zh-TW": "尚未啟用。套用別名後，使用者可在 DSM 登入後直接開啟這個 App。", "zh-CN": "尚未启用。应用别名后，用户可在 DSM 登录后直接打开此应用。", ja: "無効です。エイリアスを適用すると、DSM サインイン後にこのアプリを直接開けます。", ko: "비활성 상태입니다. 별칭을 적용하면 DSM 로그인 후 이 앱을 바로 열 수 있습니다.", de: "Nicht aktiv. Wenden Sie einen Alias an, damit Benutzer diese App nach der DSM-Anmeldung direkt öffnen können.", fr: "Inactif. Appliquez un alias pour ouvrir cette application directement après connexion à DSM.", es: "Inactivo. Aplique un alias para abrir esta aplicación directamente tras iniciar sesión en DSM.", it: "Non attivo. Applica un alias per aprire questa app direttamente dopo l'accesso a DSM." },
+    askAdmin: { en: "Ask an administrator to set this up", "zh-TW": "請管理員設定", "zh-CN": "请管理员设置", ja: "管理者に設定を依頼してください", ko: "관리자에게 설정을 요청하세요", de: "Bitten Sie einen Administrator, dies einzurichten", fr: "Demandez à un administrateur de le configurer", es: "Pida a un administrador que lo configure", it: "Chiedi a un amministratore di configurarlo" },
+    alias: { en: "Alias", "zh-TW": "別名", "zh-CN": "别名", ja: "エイリアス", ko: "별칭", de: "Alias", fr: "Alias", es: "Alias", it: "Alias" },
+    apply: { en: "Apply", "zh-TW": "套用", "zh-CN": "应用", ja: "適用", ko: "적용", de: "Übernehmen", fr: "Appliquer", es: "Aplicar", it: "Applica" },
+    disable: { en: "Turn off", "zh-TW": "停用", "zh-CN": "停用", ja: "無効にする", ko: "끄기", de: "Ausschalten", fr: "Désactiver", es: "Desactivar", it: "Disattiva" },
+    advanced: { en: "Advanced settings in Control Panel", "zh-TW": "在控制台進行進階設定", "zh-CN": "在控制面板中进行高级设置", ja: "コントロールパネルの詳細設定", ko: "제어판의 고급 설정", de: "Erweiterte Einstellungen in der Systemsteuerung", fr: "Paramètres avancés dans le Panneau de configuration", es: "Ajustes avanzados en el Panel de control", it: "Impostazioni avanzate nel Pannello di controllo" },
+    controlPanel: { en: "Open Control Panel Application Portal", "zh-TW": "開啟控制台 Application Portal", "zh-CN": "打开控制面板 Application Portal", ja: "コントロールパネルの Application Portal を開く", ko: "제어판 Application Portal 열기", de: "Application Portal in der Systemsteuerung öffnen", fr: "Ouvrir Application Portal dans le Panneau de configuration", es: "Abrir Application Portal en el Panel de control", it: "Apri Application Portal nel Pannello di controllo" },
+    portal_alias_invalid: { en: "Use 1-64 lowercase letters, digits or hyphens, not starting or ending with a hyphen.", "zh-TW": "請使用 1–64 個小寫英文字母、數字或連字號，且不可以連字號開頭或結尾。", "zh-CN": "请使用 1–64 个小写英文字母、数字或连字符，且不能以连字符开头或结尾。", ja: "1～64 文字の小文字英字・数字・ハイフンを使用し、先頭と末尾にハイフンは使えません。", ko: "1~64자의 영문 소문자, 숫자 또는 하이픈을 사용하고 하이픈으로 시작하거나 끝나지 않게 하세요.", de: "Verwenden Sie 1–64 Kleinbuchstaben, Ziffern oder Bindestriche, ohne Bindestrich am Anfang oder Ende.", fr: "Utilisez 1 à 64 lettres minuscules, chiffres ou tirets, sans tiret au début ni à la fin.", es: "Use de 1 a 64 letras minúsculas, dígitos o guiones, sin guion al principio ni al final.", it: "Usa da 1 a 64 lettere minuscole, cifre o trattini, senza trattino all'inizio o alla fine." },
+    portal_alias_reserved: { en: "DSM already uses this alias. Choose another one.", "zh-TW": "DSM 已使用這個別名，請改用其他別名。", "zh-CN": "DSM 已使用此别名，请改用其他别名。", ja: "このエイリアスは DSM で使用されています。別のものを選んでください。", ko: "DSM에서 이미 사용하는 별칭입니다. 다른 별칭을 선택하세요.", de: "DSM verwendet diesen Alias bereits. Wählen Sie einen anderen.", fr: "DSM utilise déjà cet alias. Choisissez-en un autre.", es: "DSM ya usa este alias. Elija otro.", it: "DSM usa già questo alias. Scegline un altro." },
+    portal_alias_in_use: { en: "Another app already uses this alias. Choose another one.", "zh-TW": "另一個 App 已使用這個別名，請改用其他別名。", "zh-CN": "另一个应用已使用此别名，请改用其他别名。", ja: "別のアプリがこのエイリアスを使用しています。別のものを選んでください。", ko: "다른 앱이 이미 이 별칭을 사용합니다. 다른 별칭을 선택하세요.", de: "Eine andere App verwendet diesen Alias bereits. Wählen Sie einen anderen.", fr: "Une autre application utilise déjà cet alias. Choisissez-en un autre.", es: "Otra aplicación ya usa este alias. Elija otro.", it: "Un'altra app usa già questo alias. Scegline un altro." },
+    admin_required: { en: "Only a DSM administrator can change this.", "zh-TW": "只有 DSM 管理員可以變更這項設定。", "zh-CN": "只有 DSM 管理员可以更改此设置。", ja: "これを変更できるのは DSM 管理者のみです。", ko: "DSM 관리자만 변경할 수 있습니다.", de: "Nur ein DSM-Administrator kann dies ändern.", fr: "Seul un administrateur DSM peut modifier ce paramètre.", es: "Solo un administrador de DSM puede cambiar esto.", it: "Solo un amministratore DSM può modificarlo." },
+    portal_unavailable: { en: "DSM did not accept the change. Try again or use Control Panel.", "zh-TW": "DSM 未接受變更。請再試一次或改用控制台。", "zh-CN": "DSM 未接受更改。请重试或改用控制面板。", ja: "DSM は変更を受け付けませんでした。再試行するか、コントロールパネルを使用してください。", ko: "DSM이 변경을 받아들이지 않았습니다. 다시 시도하거나 제어판을 사용하세요.", de: "DSM hat die Änderung nicht übernommen. Versuchen Sie es erneut oder verwenden Sie die Systemsteuerung.", fr: "DSM n'a pas accepté la modification. Réessayez ou utilisez le Panneau de configuration.", es: "DSM no aceptó el cambio. Inténtelo de nuevo o use el Panel de control.", it: "DSM non ha accettato la modifica. Riprova o usa il Pannello di controllo." },
+};
+function localizedMessages() {
+    const out = {};
+    for (const [key, texts] of Object.entries(PORTAL_MESSAGES)) {
+        for (const [locale, text] of Object.entries(texts))
+            (out[locale] ??= {})[key] = text;
+    }
+    return out;
+}
+/**
+ * `createPortalAccess(options)` → `ctx.portal`, plain ES5 for DSM's desktop.
+ *
+ * An administrator reads and sets the alias with DSM's own
+ * SYNO.Core.AppPortal API in their own session, after SYNO.API.Info shows the
+ * API; DSM itself refuses everyone else (105). An ordinary user reads the
+ * alias only through the package backend's `portal.status`. Anything
+ * unexpected reads as `unavailable`; an administrator then gets only the
+ * Control Panel shortcut.
+ *
+ * `status()` resolves `{state, alias?, url?, canManage, controlPanel,
+ * defaultAlias}`; `apply(alias)` and `disable()` resolve the new status or
+ * reject `{code}`; `openControlPanel()` opens Login Portal > Applications.
+ * `messages` is the panel text in the window's locale; `mountPanel(element)`
+ * renders a plain panel for UIs without their own.
+ */
+export const PORTAL_RUNTIME = `function createPortalAccess(options) {
+  var ALIAS = new RegExp(${JSON.stringify(PORTAL_ALIAS_PATTERN.source)});
+  var RESERVED = ${JSON.stringify(RESERVED_PORTAL_ALIASES)};
+  var LINKABLE = /^[A-Za-z0-9][A-Za-z0-9_-]{0,63}$/;
+  var CATALOGS = ${JSON.stringify(localizedMessages())};
+  var messages = CATALOGS[options.locale] || CATALOGS.en;
+  var ERRORS = { dsm_4100: "portal_alias_invalid", dsm_4102: "portal_alias_reserved", dsm_4103: "portal_alias_in_use", dsm_105: "admin_required" };
+  function result(state, alias, managed) {
+    var out = { state: state, canManage: managed === true, controlPanel: managed !== undefined, defaultAlias: options.defaultAlias };
+    if (state === "active") {
+      out.alias = alias;
+      out.url = options.location.protocol + "//" + options.location.host + "/" + encodeURIComponent(alias) + "/";
+    }
+    return out;
+  }
+  function fromBackend() {
+    return options.call("portal.status", {}).then(function (data) {
+      if (data && data.state === "active" && typeof data.alias === "string" && LINKABLE.test(data.alias)) return result("active", data.alias);
+      return result(data && data.state === "inactive" ? "inactive" : "unavailable");
+    }, function () {
+      return result("unavailable");
+    });
+  }
+  function fromDsm() {
+    return options.send("SYNO.API.Info", "query", 1, { query: "SYNO.Core.AppPortal" }).then(function (info) {
+      var api = info && info["SYNO.Core.AppPortal"];
+      if (!api || !(api.maxVersion >= 2)) return null;
+      return options.send("SYNO.Core.AppPortal", "get", 2, { id: options.appId, additional: ["default_setting"] });
+    }).then(function (item) {
+      if (!item || item.id !== options.appId) return result("unavailable", undefined, false);
+      var alias = typeof item.alias === "string" && LINKABLE.test(item.alias) ? item.alias : "";
+      var out = result(alias ? "active" : "inactive", alias, true);
+      var setting = item.additional && item.additional.default_setting;
+      if (setting && typeof setting.alias === "string" && ALIAS.test(setting.alias)) out.defaultAlias = setting.alias;
+      return out;
+    }, function () {
+      return result("unavailable", undefined, false);
+    });
+  }
+  function status() {
+    return options.isAdmin() ? fromDsm() : fromBackend();
+  }
+  function set(alias) {
+    if (!options.isAdmin()) return Promise.reject({ code: "admin_required" });
+    return options.send("SYNO.Core.AppPortal", "set", 2, { id: options.appId, alias: alias }).then(status, function (error) {
+      throw { code: ERRORS[error && error.code] || "portal_unavailable" };
+    });
+  }
+  var access = {
+    messages: messages,
+    status: status,
+    apply: function (alias) {
+      if (typeof alias !== "string" || !ALIAS.test(alias)) return Promise.reject({ code: "portal_alias_invalid" });
+      if (RESERVED.indexOf(alias) >= 0) return Promise.reject({ code: "portal_alias_reserved" });
+      return set(alias);
+    },
+    disable: function () {
+      return set(null);
+    },
+    openControlPanel: function () {
+      options.launch("SYNO.SDS.AdminCenter.Application", { fn: "SYNO.SDS.AdminCenter.Login.Main", tab: "applications" });
+    },
+    mountPanel: function (element) {
+      return mountPanel(element);
+    }
+  };
+  function node(tag, attrs, children) {
+    var out = document.createElement(tag);
+    for (var key in attrs) {
+      if (key === "text") out.textContent = attrs[key];
+      else out.setAttribute(key, attrs[key]);
+    }
+    for (var i = 0; children && i < children.length; i++) out.appendChild(children[i]);
+    return out;
+  }
+  function button(text, onClick) {
+    var out = node("button", { type: "button", text: text });
+    out.addEventListener("click", function (event) { event.preventDefault(); onClick(); });
+    return out;
+  }
+  function mountPanel(element) {
+    var disposed = false;
+    function render(current, error) {
+      if (disposed) return;
+      var parts = [node("h2", { text: messages.title })];
+      var settle = function (next) { return next.then(function (fresh) { render(fresh); }, function (failure) { render(current, failure); }); };
+      if (current.state === "active") {
+        parts.push(node("p", {}, [node("span", { text: messages.link + " " }), node("a", { href: current.url, target: "_blank", rel: "noopener", text: current.url })]));
+      }
+      if (current.canManage) {
+        if (current.state !== "active") parts.push(node("p", { text: messages.inactive }));
+        var input = node("input", { type: "text", maxlength: "64", autocomplete: "off", "aria-label": messages.alias });
+        input.value = current.alias || current.defaultAlias;
+        var form = node("form", { class: "dsmapp-portal-form" }, [node("label", { text: messages.alias }), input, node("button", { type: "submit", text: messages.apply })]);
+        form.addEventListener("submit", function (event) { event.preventDefault(); settle(access.apply(input.value)); });
+        if (current.state === "active") form.appendChild(button(messages.disable, function () { settle(access.disable()); }));
+        parts.push(form, button(messages.advanced, access.openControlPanel));
+      } else if (current.controlPanel) {
+        parts.push(button(messages.controlPanel, access.openControlPanel));
+      } else if (current.state !== "active") {
+        parts.push(node("p", { text: messages.askAdmin }));
+      }
+      if (error) parts.push(node("p", { role: "alert", class: "dsmapp-portal-error", text: messages[error.code] || messages.portal_unavailable }));
+      element.replaceChildren.apply(element, parts);
+    }
+    status().then(function (current) { render(current); });
+    return {
+      refresh: function () { return status().then(function (current) { render(current); }); },
+      dispose: function () { disposed = true; element.replaceChildren(); }
+    };
+  }
+  return access;
+}`;

package/dist/standalone/portal.d.ts

@@ -0,0 +1,4 @@
+import type { StandaloneManifest } from "./manifest.js";
+import type { PortalPackage } from "../portal/package.js";
+/** A native portal opens the package's own DSM window. */
+export declare function nativePortal(manifest: StandaloneManifest): PortalPackage | undefined;

package/dist/standalone/portal.js

@@ -0,0 +1,4 @@
+/** A native portal opens the package's own DSM window. */
+export function nativePortal(manifest) {
+    return manifest.portal && { appId: `SYNO.SDS.${manifest.package}.Instance`, application: manifest.displayname, alias: manifest.portal.alias };
+}

package/dist/standalone/resource.d.ts

@@ -1,11 +1,13 @@
 import type { Capabilities } from "./manifest.js";
 import { type SharedFolder } from "./shared-folder.js";
+import { type PortalPackage } from "../portal/package.js";
 /**
- * `conf/resource` for a native package: only DSM's official `data-share` and
- * `systemd-user-unit` workers, in a fixed key order. Undefined when neither applies.
+ * `conf/resource` for a native package: only DSM's official `data-share`,
+ * `systemd-user-unit` and `web-config` workers, in a fixed key order.
+ * Undefined when none applies.
  */
 export declare function renderStandaloneResource(m: {
     package: string;
     capabilities: Capabilities;
     sharedFolder?: SharedFolder;
-}): string | undefined;
+}, portal?: PortalPackage): string | undefined;

package/dist/standalone/resource.js

@@ -1,13 +1,16 @@
 import { sharedFolderResource } from "./shared-folder.js";
+import { portalResource } from "../portal/package.js";
 /**
- * `conf/resource` for a native package: only DSM's official `data-share` and
- * `systemd-user-unit` workers, in a fixed key order. Undefined when neither applies.
+ * `conf/resource` for a native package: only DSM's official `data-share`,
+ * `systemd-user-unit` and `web-config` workers, in a fixed key order.
+ * Undefined when none applies.
  */
-export function renderStandaloneResource(m) {
+export function renderStandaloneResource(m, portal) {
     const dataShare = m.sharedFolder && sharedFolderResource(m.package, m.sharedFolder);
     const resource = {
         ...(dataShare ? { "data-share": dataShare } : {}),
         ...(m.capabilities.jobs ? { "systemd-user-unit": {} } : {}),
+        ...(portal ? portalResource() : {}),
     };
     return Object.keys(resource).length > 0 ? JSON.stringify(resource) : undefined;
 }

package/dist/standalone/root-window.d.ts

@@ -2,4 +2,7 @@ export { executorTasks as rootTasks, type ExecutorTask as RootTask } from '../ru
 /** Exact readback is authoritative. PasswordConfirm tokens are reused immediately,
  * across both Root APIs, and never persisted (DSM validity is about 300 seconds). */
 export declare const ROOT_RUNTIME: string;
-export declare const ROOT_PANEL = "function mountRootPanel(host, access, i18n, tasks, admin) {\n  if (!admin) return;\n  var status = document.createElement(\"p\"), approve = document.createElement(\"button\"), retry = document.createElement(\"button\");\n  approve.textContent = \"Approve background access\"; retry.textContent = \"Check status\";\n  host.appendChild(status); host.appendChild(approve); host.appendChild(retry);\n  function show(result) { status.textContent = result.state + (result.reason ? \": \" + result.reason : \"\"); approve.hidden = result.state !== \"needs-admin-approval\"; }\n  function run(fn) { approve.disabled = retry.disabled = true; return fn().then(show, function(e) { show({state: \"blocked\", reason: e.message || e.code}); }).then(function() { approve.disabled = retry.disabled = false; }); }\n  approve.onclick = function() { return run(function() { return access.authorize(); }); };\n  retry.onclick = function() { return run(function() { return access.status(); }); };\n  run(function() { return access.status().then(function(result) { return result.tasks && result.tasks.boot && result.tasks.control && result.tasks.boot.state === \"ready\" && result.tasks.control.state === \"ready\" ? access.control(\"start\") : result; }); });\n}";
+export declare const ROOT_PANEL = "function mountRootPanel(host, access, i18n, tasks, admin) {\n  if (!admin) return;\n  var status = document.createElement(\"p\"), approve = document.createElement(\"button\"), retry = document.createElement(\"button\");\n  approve.textContent = \"Approve background access\"; retry.textContent = \"Check status\";\n  host.appendChild(status); host.appendChild(approve); host.appendChild(retry);\n  function show(result) { status.textContent = result.state + (result.reason ? \": \" + result.reason : \"\"); approve.hidden = result.state !== \"needs-admin-approval\" && result.retry !== true; }\n  function run(fn) { approve.disabled = retry.disabled = true; return fn().then(show, function(e) { show({state: \"blocked\", reason: e.message || e.code}); }).then(function() { approve.disabled = retry.disabled = false; }); }\n  access.subscribe(show);\n  approve.onclick = function() { return run(function() { return access.authorize(); }); };\n  retry.onclick = function() { return run(function() { return access.status(); }); };\n  run(function() { return access.status().then(function(result) { return result.tasks && result.tasks.boot && result.tasks.control && result.tasks.boot.state === \"ready\" && result.tasks.control.state === \"ready\" ? access.control(\"start\") : result; }); });\n}";
+/** Administrator password confirmation in the window's own session: a supplied
+ * password, or a masked form when none is given. */
+export declare const PASSWORD_CONFIRM: string;