@synopackageland/cli 0.8.0 → 0.9.1

package/CHANGELOG.md

@@ -1,5 +1,272 @@
 # Changelog
 
+## 0.9.1 (2026-10-12)
+
+Fixes from the 0.9.0 acceptance on DSM (t-0294, t-0290, t-0292).
+
+繁中摘要：`build` 重複 `--arch` 時每個架構都建置；SDK 下載失敗回報
+`SDK_DOWNLOAD_FAILED`（不再包成 `STANDALONE_API_PERMISSIONS_INVALID`），`check`
+顯示每個錯誤碼自己的建議；`status` 列出 portal；Vue App 只在 SDK 的
+ExecutorSettings 核准，plain UI 的 DSM 視窗面板改為有樣式、跟隨 DSM 語言並在面板內
+輸入密碼。更正 0.9.0 的核准說明：policy 不變的升級不需重新核准，只有
+install-selected 的 scope 需要管理員確認一次。記錄 SDK 0.9.1 executor digests（只換
+executor、policy digest 不變，免重新核准）。App 分兩層：有 executor（rootOps 或
+delegate）的 App 解除安裝時自動移除應用程式權限規則，宣告 portal 時再 reload nginx，
+精靈與 cleanup 清單只把它們列為自動清除失敗時的後備；無升權 App 任何階段都不用 root，
+應用程式權限規則仍由管理員手動移除。破壞性變更：portal 只限 executor 層級，無升權
+native App 以 `STANDALONE_PORTAL_REQUIRES_EXECUTOR` 拒絕，Compose App 以
+`CONTRACT_PORTAL_REQUIRES_EXECUTOR` 拒絕。並附 0.9.0 安裝殘留的清理步驟。
+
+### Build and check
+
+- `build --arch x86_64 --arch aarch64` builds every family named; 0.9.0 built
+  only the last one. Repeated values and comma lists combine.
+- An SDK version Go cannot fetch is reported as `SDK_DOWNLOAD_FAILED` with the
+  GOPRIVATE and git-credential hint. 0.9.0 wrapped it as
+  `STANDALONE_API_PERMISSIONS_INVALID`.
+- `check` shows the registry suggestion of each error code. It no longer
+  replaces every `dsm-package.yaml` error's suggestion with "fix the schema 2
+  fields".
+- `STANDALONE_ENTRY_UNSUPPORTED` names the `main.go` of the project's
+  `backend.main`, not always `cmd/app/main.go`.
+
+### Status
+
+- `status` lists `portal` for an App with `portal: {}`. It reads the App's
+  `portal.status`: `ready` with the URL when an administrator set an alias,
+  `needs-admin-approval` when none is set, and `blocked` before install or
+  when the status cannot be read.
+
+### DSM window approval
+
+- A Vue App approves the executor only in the SDK's `ExecutorSettings`. The
+  DSM window no longer adds its own approval panel to a Vue App with
+  `rootOps` or a fixed delegate scope. That panel used unstyled English
+  buttons, and its password prompt was appended below the App, so approving
+  from it never reached PasswordConfirm.
+- A plain-UI App keeps the window panel. It now uses the panel styles, shows
+  its text in the DSM language (the nine SDK locales), and asks for the
+  administrator password inside the panel. The password goes to
+  `authorize` the same way as in `ExecutorSettings`.
+- Breaking: `confirmPassword` without a password fails with
+  `password_required` and sends nothing; the masked form it appended is gone.
+
+### Portal needs the executor tier (breaking)
+
+- DSM removes a portal App's Login Portal alias at uninstall but does not
+  reload nginx (DSM 7.4, t-0294), so `/<alias>/` kept opening a DSM page.
+  Only root can reload it, so a `portal` now needs `capabilities.rootOps` or
+  `capabilities.delegate`. A no-privilege native App with `portal` fails
+  `check`/`build` with `STANDALONE_PORTAL_REQUIRES_EXECUTOR`; `add portal`
+  refuses it unless the same call adds `root-ops` or `delegate`; `inspect`
+  flags such an SPK with `PORTAL_REQUIRES_EXECUTOR`.
+- A Compose App has no executor: `integration.web.portal` now always fails
+  with `CONTRACT_PORTAL_REQUIRES_EXECUTOR` and the schema no longer describes
+  its shape. `CONTRACT_PORTAL_INVALID`, `CONTRACT_PORTAL_UNSUPPORTED` and
+  `CONTRACT_PORTAL_MIN_DSM` are gone, and `inspect` reports a Compose SPK's
+  `web-config` as an unknown resource.
+- Fix: add `root-ops` or `delegate`, or remove the portal and let an
+  administrator set up a reverse proxy in DSM.
+
+### Uninstall
+
+- An App with the executor (rootOps or delegate) cleans up after DSM itself:
+  SDK 0.9.1's root purge deletes the App's rules in Control Panel >
+  Application Privileges and, for a portal App, reloads nginx once DSM has
+  removed the alias. The uninstall wizard says so in the nine languages, and
+  `status`/`inspect` list both only as fallbacks: "Only if automatic cleanup
+  failed after uninstall; see the system log entry synopkgland-executor."
+- A no-privilege App never uses root, not even at uninstall. Its wizard keeps
+  saying that DSM keeps the App's rules in Control Panel > Application
+  Privileges, that a later install under the same name applies them again,
+  and that an administrator can remove them; the cleanup list keeps that
+  item. It never mentions a Login Portal alias, because it cannot declare one.
+  A test builds plain, files, jobs, identity and `entry: app-privilege` SPKs
+  and checks they run as the package account, ship no executor or root
+  tasks, and that their scripts never call synowebapi, nginx or a system
+  unit.
+
+### SDK 0.9.1
+
+- Depends on `@synopackageland/templates` 0.9.1: `init` scaffolds Apps that
+  require SDK 0.9.1 (`backend/go.mod` and `@synopackageland/sdk`).
+- The CLI records the SDK 0.9.1 executor digests, rebuilt with the
+  uninstall cleanup (x86_64 `5d75af3c…`, aarch64 `b0e1f817…`, armv7
+  `17db613a…`; lifecycle digests equal 0.9.0). SDK 0.9.1 only replaces the
+  executor: the policy format, task scripts and permissions are unchanged,
+  so the policy digest stays the same and no App needs a new approval. An App moved from SDK
+  0.9.0 to 0.9.1 in `backend/go.mod` keeps its approval; the installed
+  executor re-pins the new executor by itself.
+
+### Cleaning up after 0.9.0 installs
+
+An App built with SDK 0.9.0 could leave root tasks behind at uninstall
+(t-0294 bugs 1 and 3). If the App is still installed, rebuild it with SDK
+0.9.1, install that build and then uninstall it: the 0.9.1 purge rebuilds the
+task inventory from the approved policy and deletes the tasks. Otherwise an
+administrator removes them by hand:
+
+- Control Panel > Task Scheduler: delete `<package> executor control` and
+  `<package> executor selection`.
+- The boot event, which DSM's web API refuses to delete over HTTP (error
+  119): as root, run
+  `/usr/syno/bin/synowebapi --exec api=SYNO.Core.EventScheduler method=delete version=1 task_name="<package> executor boot"`.
+- Control Panel > Application Privileges: remove the App's rules. Control
+  Panel > Login Portal: if its alias still opens, save an application alias
+  there to reload nginx, or restart the NAS. The 0.9.1 rebuild-and-uninstall
+  route above does both for you.
+
+### Approval after upgrading (correction to 0.9.0)
+
+- 0.9.0 said a delegate App rebuilt with it needs one new approval. Measured
+  on DSM 7.4 (t-0294): a `files.moveFromStaging` App upgraded from 0.8.0 to
+  0.9.0 kept the same policy digest. The installed executor re-pinned the new
+  executor by itself, with no new approval. Only an `install-selected` scope
+  needed one administrator confirmation (PasswordConfirm) of the shared
+  folder.
+- A new approval is needed only when the executor policy changes, for
+  example new operations, another scope or changed root scripts.
+
+### Release tooling
+
+- `node scripts/executor-digests.mjs <sdk>/release/vX.Y.Z.json` records a
+  released SDK's executor and lifecycle digests in
+  `src/runtime/executor-digests.json`. It checks the three architectures,
+  go1.26.9 and the CLI minor. A tagged release (`commit` set) never changes
+  a recorded version; a release not yet tagged (`commit: null`) replaces its
+  own entry. SDK 0.9.1's digests were recorded this way.
+- `test/fixtures/executor-setup/` holds the `executor/setup.json` this CLI
+  writes for delegate, time-limited delegate with jobs, root-ops and
+  install-selected Apps, for the SDK executor's contract test.
+  `UPDATE_EXECUTOR_SETUP_FIXTURES=1 npm test` regenerates them.
+- The npm gate runs `scripts/smoke-exports.mjs`, the export check of
+  `smoke-pack.sh`. In 0.9.0 that check still imported the removed
+  `authorizationTemplateDirectory`, so `gate.sh docker` always failed.
+
+## 0.9.0 (2026-10-11)
+
+The CLI, the SDK and the project templates are now three repositories, and
+the CLI only packages, deploys and checks. An App names its SDK version once,
+in `backend/go.mod`. Background saves can create subfolders and choose what
+happens on a name conflict, and time-limited delegate jobs gain read, rename,
+copy, move and delete.
+
+繁中摘要：CLI 移到 github.com/synopackageland/syno-pkg-land-cli，只負責打包、部署與檢查；
+範本改由 `@synopackageland/templates`（精確 pin）提供；SDK 是
+`github.com/synopackageland/syno-pkg-land-sdk`（Go）與 `@synopackageland/sdk`（前端，含
+`./vue`），版本只寫在 `backend/go.mod`。`build` 依該版本 `go mod download`
+executor 並比對 CLI 內建的 sha256 表。`check` 新增 `SDK_REQUIRED`、
+`SDK_VERSION_MISMATCH`、`SDK_UNSUPPORTED`。`files.moveFromStaging` 的 `name`
+可帶子資料夾，新增 `conflict: fail|overwrite|rename`；有時限的 delegate 新增
+`files.read`、`files.rename`、`files.copy`、`files.move`、`files.delete`。
+管理員只在 executor policy 改變時需要重新核准；0.9.0 的 policy 有改變。
+
+### Repositories and the SDK version
+
+- The CLI is github.com/synopackageland/syno-pkg-land-cli, published as
+  `@synopackageland/cli`. The SDK is github.com/synopackageland/syno-pkg-land-sdk: the Go
+  module `github.com/synopackageland/syno-pkg-land-sdk` and the npm package
+  `@synopackageland/sdk`, which includes the Vue components at
+  `@synopackageland/sdk/vue`.
+- The `require github.com/synopackageland/syno-pkg-land-sdk` line in `backend/go.mod` is the
+  only SDK version. `dsm-package.yaml` has no SDK field.
+- `check` and `build` report `SDK_REQUIRED` when `capabilities.delegate` or
+  `rootOps` is declared without that line (an `entry` mode without it fails
+  with `STANDALONE_ENTRY_UNSUPPORTED`), `SDK_UNSUPPORTED` when its minor version is not the CLI's (CLI 0.9.x builds
+  SDK 0.9.x), and `SDK_VERSION_MISMATCH` when the frontend's
+  `@synopackageland/sdk` differs from it. A `file:` frontend dependency is
+  compared through that folder's `package.json` version.
+- `build` reads the SDK version from `backend/go.mod`, runs `go mod download`
+  for the executor of that version, and builds it with go1.26.9. Its sha256
+  must match the table shipped in this CLI, or the build fails with
+  `EXECUTOR_DIGEST_MISMATCH`. A version Go cannot fetch fails with
+  `SDK_DOWNLOAD_FAILED`. While the SDK repositories are private, set
+  `GOPRIVATE=github.com/synopackageland/*` and give git a credential for
+  github.com; the error says which of the two is missing. Root task scripts
+  and `sdk-permissions.json` come from the same SDK version.
+- The CGI binds both policy digests at link time:
+  `<module>/internal/api.expectedPermissionsDigest` for the App and
+  `github.com/synopackageland/syno-pkg-land-sdk/api.expectedSDKPermissionsDigest` for the
+  SDK.
+- `@synopackageland/cli/authorization-sdk` exports `AUTHORIZATION_RUNTIME`
+  and `ROOT_RUNTIME`. `authorizationTemplateDirectory` is removed;
+  `AuthorizationGate` is in `@synopackageland/sdk/vue`.
+
+### Templates
+
+- `init` and `add` read the templates from `@synopackageland/templates`, a
+  dependency pinned to an exact version. `SYNOPKGLAND_TEMPLATES_DIR` points
+  them at a templates checkout; without either, `TEMPLATES_MISSING`.
+- `init` fills the placeholders in every generated file; the Go module path
+  of a new backend is the package id. The next steps say
+  `(cd frontend && npm install)`: the templates ship no lockfile.
+- `init` and `add` share one capability overlay table (`root-ops`, `jobs`,
+  `delegate`).
+
+### Local SDK checkout
+
+- With `SYNOPKGLAND_SDK_DIR`, `init` adds
+  `replace github.com/synopackageland/syno-pkg-land-sdk => $SYNOPKGLAND_SDK_DIR` to
+  `backend/go.mod` and sets the frontend dependency to
+  `file:$SYNOPKGLAND_SDK_DIR/ts`; install it with
+  `(cd frontend && npm install --install-links)`, which packs the SDK like the
+  released package. npm does not build a `file:` package, so a Vue project
+  needs `(cd $SYNOPKGLAND_SDK_DIR/ts && npm ci && npm run build)` first, and
+  again after SDK changes; `init` refuses a checkout without `ts/dist`, or
+  without a root `go.mod`, with `SDK_DIR_NOT_READY`.
+- `build` uses `$SYNOPKGLAND_SDK_DIR/executor`, skips the digest table and
+  warns with `EXECUTOR_DIGEST_UNVERIFIED`. Do not
+  publish such an SPK; the release script refuses to run while
+  `SYNOPKGLAND_SDK_DIR` or `SYNOPKGLAND_TEMPLATES_DIR` is set.
+
+### Delegate: subfolders and conflict policy
+
+- `files.moveFromStaging` (Go: `delegate.MoveParams.Name`) accepts folders
+  below the destination, for example `Album/CD1/01.flac`. The executor's move
+  child creates missing folders as the user, after the final revoke check, so
+  a canceled move leaves none behind. Existing folders are reused. Limits: 16
+  folders, 255 bytes per name, 1024 bytes in total. A name without folders
+  behaves exactly as before.
+- New `conflict` field for `files.moveFromStaging` and the time-limited
+  `files.write`: `fail` (default, unchanged), `overwrite` (atomic replace of a
+  regular file the user can write) or `rename` (`name (1).ext` up to
+  `name (99).ext`; the receipt path reports the name used).
+- New error codes: `invalid-path`, `path-too-deep`,
+  `destination-not-directory`, `name-too-long`.
+
+### Delegate: file operations for time-limited grants
+
+- New operations `files.read`, `files.rename`, `files.copy`, `files.move` and
+  `files.delete`, each declared on its own; a write operation never implies
+  delete. Go: `job.Files()` returns `delegate.JobFiles` with `Read`, `Rename`,
+  `CreateFolderAll`, `Copy`, `Move`, `Delete`, `TaskStatus` and `CancelTask`.
+- `files.createFolder` takes `parents` (`CreateFolderAll`, like `mkdir -p`).
+- Except `files.write` and `files.read`, the executor calls File Station as the
+  user through one root-side allowlist of methods, and re-checks the paths File
+  Station reports against the grant. `files.read` copies the file into staging
+  in a child that drops to the user and never follows symlinks.
+- Copy, move and delete run as File Station background tasks followed with the
+  implied `files.taskStatus` and `files.taskCancel`; revoking the grant stops
+  them. Delete needs `recursive` for folders and goes to the recycle bin; a
+  Shared Folder without one needs `permanent`.
+- File Station refusals now report SDK codes (`PERMISSION_DENIED`,
+  `not-found`, `destination-exists`, `NO_SPACE`, `invalid-path`,
+  `name-too-long`) instead of `DSM_FAILED`. New codes: `not-a-file`,
+  `recursive-required`, `recycle-bin-disabled`, `task-not-found`,
+  `too-many-tasks`, `READ_FAILED`.
+
+### Approval
+
+- An administrator approves the executor policy (operations, scope and root
+  tasks), not the executor binary. When an upgrade keeps the policy and the
+  new executor matches the `INFO` anchor, it installs without a new approval.
+  When the policy changes, the App stays at `needs-admin-approval` until an
+  administrator approves again.
+- The 0.9.0 policy changes (new operations and `conflict`), so a delegate App
+  rebuilt with this CLI needs one new approval after the upgrade.
+  Moving the SDK to its own repository does not add one. Apps not rebuilt are
+  not affected.
+
 ## 0.8.0 (2026-10-11)
 
 Faster builds, one SPK checker for any package, and a guide for scripts and

package/README.md

@@ -18,7 +18,7 @@ Native Go apps need Go 1.25+ and npm. The CLI is tested on Node.js 22.19.
 ```sh
 synopkgland init -t native-go --with files,jobs,login --package MyApp my-app
 cd my-app
-(cd frontend && npm ci)
+(cd frontend && npm install)
 synopkgland check --json
 synopkgland build --arch x86_64 --json
 synopkgland inspect dist/MyApp-0.1.0-0001-x86_64.spk --json
@@ -40,6 +40,27 @@ the SPK with Package Center's Manual Install.
 Existing native products with their own payload layout use `backend: {kind: native}` in
 `dsm-package.yaml`.
 
+## SDK and templates
+
+The CLI packages, deploys and checks. The app-side code is the SDK
+([synopackageland/syno-pkg-land-sdk](https://github.com/synopackageland/syno-pkg-land-sdk)): the Go module
+`github.com/synopackageland/syno-pkg-land-sdk` and the npm package `@synopackageland/sdk` (Vue components at
+`@synopackageland/sdk/vue`). The `require github.com/synopackageland/syno-pkg-land-sdk` line in
+`backend/go.mod` is the app's only SDK version; `build` compiles the executor of that version
+and checks it against the digests shipped in this CLI. CLI 0.9.x builds SDK 0.9.x.
+
+The SDK repositories are private for now, so Go cannot fetch them from proxy.golang.org. Set
+`go env -w GOPRIVATE=github.com/synopackageland/*` and give git a credential that can read
+`https://github.com/synopackageland/syno-pkg-land-sdk` (check with `git ls-remote`); a failed
+fetch reports `SDK_DOWNLOAD_FAILED` with the step that is missing.
+
+`init` and `add` read their templates from `@synopackageland/templates`, an exact-pinned
+dependency. For development against local checkouts, set `SYNOPKGLAND_TEMPLATES_DIR` to a
+templates checkout and `SYNOPKGLAND_SDK_DIR` to an SDK checkout; SPKs built with
+`SYNOPKGLAND_SDK_DIR` warn `EXECUTOR_DIGEST_UNVERIFIED` and must not be published. A Vue project
+packs the local SDK into its frontend (`npm install --install-links`) without building it: run
+`npm ci && npm run build` in `$SYNOPKGLAND_SDK_DIR/ts` first, and again after SDK changes.
+
 ## Capabilities
 
 Add them with `init --with …` or later with `synopkgland add <capability…>`.
@@ -51,7 +72,7 @@ Add them with `init --with …` or later with `synopkgland add <capability…>`.
 | `login` | Sign users in with their DSM account, without the DSM desktop | Nobody; requires HTTPS for password sign-in |
 | `delegate` | Move files into a user's chosen folder while the user is offline | An administrator, once |
 | `root-ops` | Run fixed `root/*.sh` scripts for administrators | An administrator, once |
-| `portal` | Open the app from its own Application Portal alias | An administrator sets the alias; needs DSM 7.3.2-86009+ |
+| `portal` | Open the app from its own Application Portal alias | An administrator sets the alias; needs `root-ops` or `delegate` and DSM 7.3.2-86009+ |
 
 Delegate is implemented; its default operation is `files.moveFromStaging`.
 Device lifecycle acceptance on real hardware is still pending for delegate and root operations.
@@ -86,14 +107,15 @@ UI components and `npx --no syno-pkg-land-ui describe Button --json` describes o
 
 ## Licensing
 
-The CLI and its original templates are MIT licensed, Copyright (c) 2026 synopkgland.
+The CLI is MIT licensed, Copyright (c) 2026 synopkgland.
 Third-party components keep their own terms.
 
 - Generated projects keep the template terms in `LICENSES/TEMPLATE.txt`. `init` does not choose a
   license for your app: add your own `LICENSE`.
 - An SPK carries its legal notices under `LICENSES/` in the installed payload: `TEMPLATE.txt`,
-  an optional `APP.txt`, Go's license, patents and third-party notices, and the Vue UI notices.
-- Vue builds generate the UI notices from the installed, locked dependencies; run `npm ci` in
+  an optional `APP.txt`, `SDK.txt` (the SDK's MIT license, when `backend/go.mod` requires the SDK),
+  Go's license, patents and third-party notices, and the Vue UI notices.
+- Vue builds generate the UI notices from the installed dependencies; run `npm install` in
   `frontend/` first. A missing notice or version mismatch fails the build.
 - Keep `backend/THIRD_PARTY_NOTICES.txt` current when you change Go modules. Your own binaries,
   added modules, container images and upstream apps need their own notices.

package/dist/add.js

@@ -5,19 +5,10 @@ import { isScalar, parseDocument } from 'yaml';
 import { capabilityNames, capabilitySettings } from './capabilities.js';
 import { initFromTemplate, nativeCapabilitySettings } from './init.js';
 import { templatesRoot } from './template-paths.js';
+import { borrowedTarget, capabilityOverlays } from './capability-overlays.js';
 import { DEFAULT_MIN_DSM, isDsmAtLeast, PORTAL_MIN_DSM } from './build-spk/dsm-version.js';
 import { loadStandaloneManifest } from './standalone/manifest.js';
-const overlays = {
-    jobs: ['native-go-jobs'],
-    'root-ops': ['native-go-root-ops'],
-    delegate: ['native-go-jobs', 'native-go-delegate'],
-    files: ['native-go-files'], login: ['native-go-identity'],
-};
-const removed = {
-    jobs: ['backend/internal/app/background_none.go'],
-    'root-ops': ['backend/internal/app/root_none.go'],
-    delegate: ['backend/internal/app/background_none.go', 'backend/internal/app/root_none.go', 'backend/internal/app/delegate_none.go'],
-};
+import { PORTAL_REQUIRES_EXECUTOR } from './portal/alias.js';
 function files(root, dir = root) {
     if (!existsSync(dir))
         return [];
@@ -77,10 +68,21 @@ function addPortal(root, result) {
     writeFileSync(manifestPath, String(doc));
     return withNotes({ ...result, added: [...result.added, 'portal'] }, notes);
 }
+/** A portal needs the executor tier, already declared or added in the same call; nothing is written otherwise. */
+function refuseNoPrivilegePortal(root, rest) {
+    const loaded = loadStandaloneManifest(root);
+    if (!loaded.ok)
+        throw new Error(loaded.errors.map(e => `[${e.code}] ${e.message}`).join('\n'));
+    const { rootOps, delegate } = loaded.manifest.capabilities;
+    if (!rootOps && !delegate && !rest.some(name => name === 'root-ops' || name === 'delegate')) {
+        throw new Error(`[STANDALONE_PORTAL_REQUIRES_EXECUTOR] ${PORTAL_REQUIRES_EXECUTOR}`);
+    }
+}
 export function addCapabilities(root, requested) {
     const wanted = [...new Set(requested.flatMap(value => value.split(',')).map(value => value.trim()))];
     if (wanted.includes('portal')) {
         const rest = wanted.filter(name => name !== 'portal');
+        refuseNoPrivilegePortal(root, rest);
         return addPortal(root, rest.length ? addCapabilities(root, rest) : { added: [], unchanged: [] });
     }
     const names = capabilityNames(requested);
@@ -106,12 +108,9 @@ export function addCapabilities(root, requested) {
         const before = join(work, 'before'), generated = join(work, 'generated');
         initFromTemplate('native-go', before, { ui: m.ui.build ? 'vue' : 'plain', with: existingNames, packageId: m.package, displayName: m.displayname });
         initFromTemplate('native-go', generated, { ui: m.ui.build ? 'vue' : 'plain', with: [...existingNames, ...added], packageId: m.package, displayName: m.displayname });
-        const destinations = [...new Set(added.flatMap(name => overlays[name].flatMap(overlay => files(join(templatesRoot(), overlay)))))].filter(file => existsSync(join(generated, file)));
-        if (added.includes('delegate'))
-            destinations.push('backend/internal/background/store.go', 'backend/internal/app/executor.go', 'backend/internal/app/executor_test.go', 'backend/internal/api/sdk-permissions.json');
-        if (added.includes('jobs') || added.includes('delegate') || added.includes('root-ops'))
-            destinations.push('backend/internal/app/routes_test.go');
-        const deletions = added.flatMap(name => removed[name] ?? []);
+        const capability = capabilityOverlays(added);
+        const destinations = [...new Set([...capability.overlays.flatMap(overlay => files(join(templatesRoot(), overlay))), ...capability.borrowed.map(borrowedTarget)])].filter(file => existsSync(join(generated, file)));
+        const deletions = capability.removed;
         const conflicts = [];
         for (const file of destinations) {
             if (existsSync(join(before, file)) && safePath(root, file) && existsSync(join(root, file)) && lstatSync(join(root, file)).isFile() && readFileSync(join(root, file)).equals(readFileSync(join(before, file))))

package/dist/authorization-sdk.d.ts

@@ -4,4 +4,3 @@
  */
 export { ROOT_RUNTIME, type RootTask } from './standalone/native-root-window.js';
 export { AUTHORIZATION_RUNTIME } from './standalone/native-authorization-window.js';
-export declare const authorizationTemplateDirectory: URL;

package/dist/authorization-sdk.js

@@ -4,4 +4,3 @@
  */
 export { ROOT_RUNTIME } from './standalone/native-root-window.js';
 export { AUTHORIZATION_RUNTIME } from './standalone/native-authorization-window.js';
-export const authorizationTemplateDirectory = new URL('../templates/native-authorization/', import.meta.url);

package/dist/build-spk/dsm-version.d.ts

@@ -19,7 +19,5 @@ export declare function portalMinDsmMessage(value: string, field: string): strin
 export declare function isDsmAtLeast(value: string, floor: string): boolean;
 /** Container Apps cannot declare an os_min_ver below {@link CONTAINER_MIN_DSM}. */
 export declare function assertContainerMinDsm(value: string): void;
-/** A compose portal cannot be built for an os_min_ver below {@link PORTAL_MIN_DSM}. */
-export declare function assertPortalMinDsm(value: string): void;
 /** `--min-dsm`: a release (`7.1`) or a full `<version>-<build>` string (`7.2-69057`). */
 export declare function resolveMinDsm(value: string): string;

package/dist/build-spk/dsm-version.js

@@ -44,12 +44,6 @@ export function assertContainerMinDsm(value) {
         throw new Error(`[MIN_DSM_CONTAINER_FLOOR] 容器 App 需要 DSM ${CONTAINER_MIN_DSM} 以上（docker-project／Container Manager 從 DSM 7.2.1 才有），收到「${value}」。`);
     }
 }
-/** A compose portal cannot be built for an os_min_ver below {@link PORTAL_MIN_DSM}. */
-export function assertPortalMinDsm(value) {
-    if (!isDsmAtLeast(value, PORTAL_MIN_DSM)) {
-        throw new Error(`[CONTRACT_PORTAL_MIN_DSM] ${portalMinDsmMessage(value, "integration.web.portal")}`);
-    }
-}
 const FULL_VERSION = /^7\.\d+(\.\d+)?-\d+$/;
 /** `--min-dsm`: a release (`7.1`) or a full `<version>-<build>` string (`7.2-69057`). */
 export function resolveMinDsm(value) {

package/dist/build-spk/gateway.js

@@ -3,7 +3,7 @@ import { join } from "node:path";
 import { checkCgiBinary } from "../standalone/binary.js";
 import { runCommand } from "../standalone/build.js";
 import { resolvedWebAccess } from "../contract/web-launch.js";
-import { templatesRoot } from "../template-paths.js";
+import { goAssetDir } from "../template-paths.js";
 import { PINNED_GO_HINT, pinnedGoBuildEnv, pinnedGoProblem } from "./go-toolchain.js";
 export { gatewayEntryPath } from "../contract/web-launch.js";
 /** Where the gateway CGI sits in the package payload; DSM serves `ui/` under /webman/3rdparty/<package>/. */
@@ -28,7 +28,7 @@ export async function buildGatewayBinary(input) {
     const out = join(input.work, `gateway-${input.arch}.cgi`);
     const ldflags = ["-s", "-w", "-buildid=", `-X main.packageID=${input.packageId}`, `-X 'main.configJSON=${JSON.stringify(input.config)}'`].join(" ");
     const result = await (input.run ?? runCommand)("go", ["build", "-trimpath", "-buildvcs=false", "-ldflags", ldflags, "-o", out, "."], {
-        cwd: join(templatesRoot(), "_gateway"),
+        cwd: goAssetDir("gateway"),
         env: { ...process.env, ...pinnedGoBuildEnv(input.arch) },
     });
     if (result.missing) {

package/dist/build-spk/generator.js

@@ -1,7 +1,7 @@
 import { metadataInfoFields } from "../package-metadata.js";
 import { chmodSync, copyFileSync, cpSync, existsSync, mkdirSync, mkdtempSync, readFileSync, readdirSync, rmSync, statSync, writeFileSync, } from "node:fs";
 import { tmpdir } from "node:os";
-import { dirname, join } from "node:path";
+import { join } from "node:path";
 import { createHash } from "node:crypto";
 import * as tar from "tar";
 import { parseDocument, Scalar } from "yaml";
@@ -14,13 +14,12 @@ import { validateProject } from "../validate.js";
 import { packageIcons, writeDsmWindowIcons, writePackageCenterIcons } from "./dsm-icons.js";
 import { contractIconPath } from "../contract/icon.js";
 import { infoArchValue, isContainerArchFamily } from "./dsm-arch.js";
-import { assertContainerMinDsm, assertPortalMinDsm, resolveMinDsm } from "./dsm-version.js";
+import { assertContainerMinDsm, resolveMinDsm } from "./dsm-version.js";
 import { createReproducibleTar } from "./reproducible-archive.js";
 import { copyProjectNotices } from "./notices.js";
 import { renderDeleteAppDataBlock } from "./delete-app-data.js";
 import { renderUninstallWizardFiles } from "./uninstall-wizard.js";
 import { renderInstallWizardFiles } from "./install-wizard.js";
-import { contractPortal, PORTAL_JSON_RELPATH, PORTAL_MUSTACHE_RELPATH, renderPortalJson, renderPortalLifecycle, renderPortalMustache, renderPortalWizardStep } from "../portal/package.js";
 import { renderWizardFiles, writeWizardUiFiles } from "./wizard-i18n.js";
 import { sharedFolderCombobox } from "./share-combobox.js";
 import { writeUiTexts } from "./ui-texts.js";
@@ -70,8 +69,6 @@ export async function buildSpk(options) {
     }
     if (options.minDsm !== undefined) {
         assertContainerMinDsm(String(contract.os_min_ver));
-        if (contractPortal(contract))
-            assertPortalMinDsm(String(contract.os_min_ver));
     }
     const parsedCompose = loadCompose(options.project.composePath);
     const route = parsedCompose?.compose
@@ -126,7 +123,7 @@ export async function buildSpk(options) {
         mkdirSync(join(staging, "scripts"), { recursive: true });
         for (const name of SCRIPT_NAMES) {
             const scriptPath = join(staging, "scripts", name);
-            writeFileSync(scriptPath, withPortalLifecycle(name, contract, renderManagedScript(name, contract, isResourceWorkerRoute, rwEligibility?.adminport, isDynamicRoute, rwEligibility?.headless === true)), "utf8");
+            writeFileSync(scriptPath, renderManagedScript(name, contract, isResourceWorkerRoute, rwEligibility?.adminport, isDynamicRoute, rwEligibility?.headless === true), "utf8");
             chmodSync(scriptPath, SCRIPT_MODE);
         }
         mkdirSync(join(staging, "package"), { recursive: true });
@@ -185,14 +182,6 @@ export async function buildSpk(options) {
             writeDsmWindowIcons(uiDir, icons);
             writeUiTexts(uiDir, contractAppTitle(contract));
         }
-        const portal = contractPortal(contract);
-        if (portal) {
-            for (const [path, text] of [[PORTAL_JSON_RELPATH, renderPortalJson(portal)], [PORTAL_MUSTACHE_RELPATH, renderPortalMustache()]]) {
-                mkdirSync(dirname(join(staging, "package", path)), { recursive: true });
-                writeFileSync(join(staging, "package", path), text, "utf8");
-                chmodSync(join(staging, "package", path), FILE_MODE);
-            }
-        }
         if (gateway && gatewayBinary) {
             writeGatewayPayload(join(staging, "package"), gatewayBinary, gateway);
         }
@@ -615,11 +604,7 @@ function renderUpgradeWizard(t, contract, compose) {
         }];
 }
 function writeWizards(staging, contract, compose, kind) {
-    const portal = contractPortal(contract);
-    const install = renderInstallWizardFiles(String(contract.package), (t) => [
-        ...renderInstallWizard(t, contract, compose),
-        ...(portal ? [renderPortalWizardStep(t, portal.alias)] : []),
-    ]);
+    const install = renderInstallWizardFiles(String(contract.package), (t) => renderInstallWizard(t, contract, compose));
     writeWizardUiFiles(staging, {
         ...install.static,
         ...install.dynamic,
@@ -818,10 +803,6 @@ function renderDynamicCanonicalMirror(headless = false) {
 function shellQuote(value) {
     return "'" + value.replace(/'/g, "'\\''") + "'";
 }
-function withPortalLifecycle(name, contract, script) {
-    const portal = contractPortal(contract);
-    return portal ? script.replace("#!/bin/sh\n", () => `#!/bin/sh\n${renderPortalLifecycle(name, portal)}`) : script;
-}
 function renderManagedScript(name, contract, isResourceWorker = false, resourceWorkerAdminport, isDynamicRoute = false, isHeadlessRoute = false) {
     if (isResourceWorker) {
         if (name === "start-stop-status") {

package/dist/build-spk/notices.js

@@ -1,5 +1,6 @@
 import { copyFileSync, existsSync, lstatSync, mkdirSync, readFileSync, readdirSync } from 'node:fs';
 import { dirname, join } from 'node:path';
+import { sdkRequirement, sdkSource } from '../runtime/sdk-source.js';
 /** Copy legal text only; never follow a project-supplied symlink. */
 export function copyNoticeTree(source, target) {
     const stat = lstatSync(source);
@@ -28,7 +29,7 @@ export function copyProjectNotices(root, payload) {
 export function copyStandaloneNotices(root, uiDir, payload, go, goDir = join(root, 'backend')) {
     copyProjectNotices(root, payload);
     const dest = join(payload, 'LICENSES');
-    const shared = new URL('../../templates/_shared/', import.meta.url);
+    const shared = new URL('../../assets/licenses/', import.meta.url);
     if (go) {
         mkdirSync(dest, { recursive: true });
         for (const name of ['GO-LICENSE', 'GO-PATENTS'])
@@ -36,14 +37,17 @@ export function copyStandaloneNotices(root, uiDir, payload, go, goDir = join(roo
         if (existsSync(join(goDir, 'THIRD_PARTY_NOTICES.txt')))
             copyNoticeTree(join(goDir, 'THIRD_PARTY_NOTICES.txt'), join(dest, 'GO-THIRD_PARTY_NOTICES.txt'));
     }
-    const nativeAdmin = join(goDir, 'internal/dsm/native');
-    if (go && existsSync(join(nativeAdmin, 'admin_check.c'))) {
-        for (const name of ['admin_check.c', 'apppriv_check.c', 'build.sh', 'provenance.json', 'licenses']) {
-            // Projects scaffolded before the AppPriv bridge carry only the administrator bridge.
-            if (name === 'apppriv_check.c' && !existsSync(join(nativeAdmin, name)))
-                continue;
+    // The SDK's dsm package embeds the native administrator and AppPriv bridges; their sources and terms ship with them.
+    const sdk = go ? sdkRequirement(goDir) : undefined;
+    if (sdk) {
+        const source = sdkSource(sdk);
+        const license = join(source.goDir, 'LICENSE');
+        if (!existsSync(license))
+            throw new Error(`[NOTICE_MISSING] SDK license missing: ${license}`);
+        copyNoticeTree(license, join(dest, 'SDK.txt'));
+        const nativeAdmin = join(source.goDir, 'dsm/native');
+        for (const name of ['admin_check.c', 'apppriv_check.c', 'build.sh', 'provenance.json', 'licenses'])
             copyNoticeTree(join(nativeAdmin, name), join(dest, 'native-admin', name));
-        }
     }
     const frontend = join(root, 'frontend/package.json');
     const usesUi = existsSync(frontend) && Boolean(JSON.parse(readFileSync(frontend, 'utf8')).dependencies?.['@synopackageland/ui']);

package/dist/build-spk/resource-worker.js

@@ -1,4 +1,3 @@
-import { contractPortal, portalResource } from "../portal/package.js";
 import { collectUnpinnedImages } from "../compose/analyze.js";
 import { cookieStripHeaders, resolvedWebLaunch, usesAuthGateway, webStationAlias, webStationServiceName, } from "../contract/web-launch.js";
 export { classifyComposeRoute, resourceWorkerEligibility, } from "../compose/analyze.js";
@@ -79,8 +78,6 @@ export function renderResourceConfig(contract, eligibility, compose) {
             ...webResource,
         };
     }
-    if (contractPortal(contract))
-        combined = { ...combined, ...portalResource() };
     return `${JSON.stringify(combined, null, 2)}\n`;
 }
 /**

package/dist/build-spk/uninstall-wizard.d.ts

@@ -1,7 +1,12 @@
 /** The key DSM's built-in packages use for their "also remove my data" box. */
 export declare const REMOVE_ADDITIONAL_KEY = "pkgwizard_remove_additional";
 export type UninstallWizardKind = "native" | "container";
-/** `uninstall_uifile` (English) plus one `uninstall_uifile_<dsm language>` per locale. */
-export declare function renderUninstallWizardFiles(packageName: string, kind: UninstallWizardKind, options?: {
+interface UninstallWizardOptions {
+    /** The App runs the root executor (rootOps or delegate), which purges DSM's leftovers on uninstall. */
     executor?: boolean;
-}): Record<string, string>;
+    /** The App declares a Login Portal alias (web-config app-portal); only the executor tier can. */
+    portal?: boolean;
+}
+/** `uninstall_uifile` (English) plus one `uninstall_uifile_<dsm language>` per locale. */
+export declare function renderUninstallWizardFiles(packageName: string, kind: UninstallWizardKind, options?: UninstallWizardOptions): Record<string, string>;
+export {};

package/dist/build-spk/uninstall-wizard.js

@@ -4,7 +4,7 @@ export const REMOVE_ADDITIONAL_KEY = "pkgwizard_remove_additional";
 function list(items) {
     return `<ul class="synopkg-ul-list">${items.map((item) => `<li>${item}</li>`).join("")}</ul>`;
 }
-function renderUninstallWizard(t, packageName, kind, executor) {
+function renderUninstallWizard(t, packageName, kind, { executor = false, portal = false }) {
     const vars = { package: packageName };
     return [{
             step_title: t("uninstall.step"),
@@ -21,6 +21,8 @@ function renderUninstallWizard(t, packageName, kind, executor) {
                 { desc: t(kind === "container" ? "uninstall.keep.container" : "uninstall.keep.native") },
                 ...(kind === "native" ? [{ desc: t("uninstall.retained.native", vars) }] : []),
                 ...(executor ? [{ desc: t("uninstall.executor", vars) }] : []),
+                { desc: t(executor ? "uninstall.appPrivilege.auto" : "uninstall.appPrivilege", vars) },
+                ...(executor && portal ? [{ desc: t("uninstall.portal.auto", vars) }] : []),
                 { desc: t("uninstall.backup") },
                 {
                     type: "multiselect",
@@ -31,5 +33,5 @@ function renderUninstallWizard(t, packageName, kind, executor) {
 }
 /** `uninstall_uifile` (English) plus one `uninstall_uifile_<dsm language>` per locale. */
 export function renderUninstallWizardFiles(packageName, kind, options = {}) {
-    return renderWizardFiles("uninstall_uifile", (t) => renderUninstallWizard(t, packageName, kind, options.executor === true));
+    return renderWizardFiles("uninstall_uifile", (t) => renderUninstallWizard(t, packageName, kind, options));
 }