@synopackageland/cli 0.8.0 → 0.9.1

package/dist/runtime/executor-tasks.js

@@ -1,6 +1,5 @@
 import { readFileSync } from 'node:fs';
 import { join } from 'node:path';
-import { templatesRoot } from '../template-paths.js';
 export function validateTaskScript(script, limit) {
     if (script.includes('%'))
         throw new Error('[EXECUTOR_TASK_PERCENT] Task scripts must not contain percent characters.');
@@ -8,14 +7,17 @@ export function validateTaskScript(script, limit) {
         throw new Error('[EXECUTOR_TASK_LENGTH] Task script exceeds DSM byte limit.');
     return script;
 }
-/** Tasks pin only the approved policy; the SPK's root-owned INFO anchors executor bytes. */
-export function executorTasks(pins) {
+/**
+ * Tasks pin only the approved policy; the SPK's root-owned INFO anchors executor bytes.
+ * The task scripts come from the SDK executor module the App builds with.
+ */
+export function executorTasks(pins, executorDir) {
     if (!/^[A-Za-z][A-Za-z0-9]{1,63}$/.test(pins.package))
         throw new Error('[EXECUTOR_PACKAGE] Invalid package identity.');
     if (!/^[a-f0-9]{64}$/.test(pins.policyDigest))
         throw new Error('[EXECUTOR_DIGEST] Invalid sha256 pin.');
     return ['boot', 'control'].map(kind => {
-        const script = readFileSync(join(templatesRoot(), '_executor', 'internal', 'taskscript', `${kind}.sh`), 'utf8')
+        const script = readFileSync(join(executorDir, 'internal', 'taskscript', `${kind}.sh`), 'utf8')
             .replaceAll('@PACKAGE@', pins.package).replaceAll('@POLICY_DIGEST@', pins.policyDigest);
         return { kind, name: `${pins.package} executor ${kind}`, header: `#!/bin/sh\n# synopkgland executor ${kind}\n`, script: validateTaskScript(script, kind === 'boot' ? 1024 : 6000) };
     });

package/dist/runtime/sdk-source.d.ts

@@ -0,0 +1,31 @@
+export declare const SDK_PACKAGE = "@synopackageland/sdk";
+export declare const SDK_MODULE = "github.com/synopackageland/syno-pkg-land-sdk";
+export declare const EXECUTOR_MODULE = "github.com/synopackageland/syno-pkg-land-sdk/executor";
+/** Where one SDK version's Go client and executor sources are read from. */
+export interface SdkSource {
+    version: string;
+    goDir: string;
+    executorDir: string;
+    local: boolean;
+}
+/** The SDK version an App requires: `require github.com/synopackageland/syno-pkg-land-sdk vX.Y.Z` in backend/go.mod, the only version source. */
+export declare function sdkRequirement(backendDir: string): string | undefined;
+/** The App's own Go module path, the prefix of every `-X` that targets its packages. */
+export declare function goModulePath(backendDir: string): string | undefined;
+/**
+ * The module directories of one SDK version. SYNOPKGLAND_SDK_DIR names a
+ * local sdk checkout (development and gates only); otherwise both modules
+ * come from `go mod download` of exactly that version.
+ */
+export declare function sdkSource(version: string, env?: NodeJS.ProcessEnv, download?: (spec: string) => string): SdkSource;
+/** The module cache directory of module@version; the cache is read-only, so builds copy it first. */
+export declare function goModDownload(spec: string, env?: NodeJS.ProcessEnv): string;
+/** The SDK an App builds its executor with; delegate and rootOps cannot build without one. */
+export declare function requiredSdk(backendDir: string, env?: NodeJS.ProcessEnv, download?: (spec: string) => string): SdkSource;
+/**
+ * The SDK repositories are private: Go must fetch them with git, not from
+ * proxy.golang.org and sum.golang.org. Says which of the two is missing.
+ */
+export declare function privateSdkHint(env?: NodeJS.ProcessEnv): string;
+/** Whether a comma-separated GOPRIVATE-style glob list matches a module path or one of its prefixes, as go does. */
+export declare function goPrivateCovers(patterns: string, modulePath: string): boolean;

package/dist/runtime/sdk-source.js

@@ -0,0 +1,92 @@
+import { spawnSync } from 'node:child_process';
+import { readFileSync } from 'node:fs';
+import { tmpdir } from 'node:os';
+import { join } from 'node:path';
+export const SDK_PACKAGE = '@synopackageland/sdk';
+export const SDK_MODULE = 'github.com/synopackageland/syno-pkg-land-sdk';
+export const EXECUTOR_MODULE = `${SDK_MODULE}/executor`;
+/** The SDK version an App requires: `require github.com/synopackageland/syno-pkg-land-sdk vX.Y.Z` in backend/go.mod, the only version source. */
+export function sdkRequirement(backendDir) {
+    const module = SDK_MODULE.replaceAll('.', '\\.');
+    return new RegExp(`^\\s*(?:require\\s+)?${module}\\s+v(\\S+)`, 'm').exec(goMod(backendDir))?.[1];
+}
+/** The App's own Go module path, the prefix of every `-X` that targets its packages. */
+export function goModulePath(backendDir) {
+    return /^\s*module\s+(\S+)/m.exec(goMod(backendDir))?.[1];
+}
+/** backend/go.mod without comments; empty when the backend has none. */
+function goMod(backendDir) {
+    try {
+        return readFileSync(join(backendDir, 'go.mod'), 'utf8').replace(/\/\/.*$/gm, '');
+    }
+    catch {
+        return '';
+    }
+}
+/**
+ * The module directories of one SDK version. SYNOPKGLAND_SDK_DIR names a
+ * local sdk checkout (development and gates only); otherwise both modules
+ * come from `go mod download` of exactly that version.
+ */
+export function sdkSource(version, env = process.env, download = (spec) => goModDownload(spec, env)) {
+    const dir = env.SYNOPKGLAND_SDK_DIR;
+    if (dir)
+        return { version, goDir: dir, executorDir: join(dir, 'executor'), local: true };
+    return { version, goDir: download(`${SDK_MODULE}@v${version}`), executorDir: download(`${EXECUTOR_MODULE}@v${version}`), local: false };
+}
+const downloaded = new Map();
+/** The module cache directory of module@version; the cache is read-only, so builds copy it first. */
+export function goModDownload(spec, env = process.env) {
+    const key = [spec, env.GOPROXY, env.GOMODCACHE, env.GOPATH].join('\0');
+    const cached = downloaded.get(key);
+    if (cached)
+        return cached;
+    const result = spawnSync('go', ['mod', 'download', '-json', spec], { cwd: tmpdir(), env: { ...env, GOWORK: 'off', GOFLAGS: '' }, encoding: 'utf8' });
+    let info = {};
+    try {
+        info = JSON.parse(result.stdout);
+    }
+    catch { /* reported below */ }
+    if (result.error || result.status !== 0 || !info.Dir) {
+        throw new Error(`[SDK_DOWNLOAD_FAILED] go mod download ${spec} failed: ${info.Error ?? result.stderr ?? result.error?.message}${privateSdkHint(env)}`);
+    }
+    downloaded.set(key, info.Dir);
+    return info.Dir;
+}
+/** The SDK an App builds its executor with; delegate and rootOps cannot build without one. */
+export function requiredSdk(backendDir, env = process.env, download) {
+    const version = sdkRequirement(backendDir);
+    if (!version)
+        throw new Error(`[SDK_REQUIRED] capabilities.delegate and rootOps need the SDK: add \`require ${SDK_MODULE} v<version>\` to backend/go.mod.`);
+    return download ? sdkSource(version, env, download) : sdkSource(version, env);
+}
+/**
+ * The SDK repositories are private: Go must fetch them with git, not from
+ * proxy.golang.org and sum.golang.org. Says which of the two is missing.
+ */
+export function privateSdkHint(env = process.env) {
+    const result = spawnSync('go', ['env', '-json', 'GONOPROXY', 'GONOSUMDB'], { cwd: tmpdir(), env: { ...env, GOFLAGS: '' }, encoding: 'utf8' });
+    let goEnv = {};
+    try {
+        goEnv = JSON.parse(result.stdout);
+    }
+    catch { /* treated as not covered */ }
+    if (goPrivateCovers(goEnv.GONOPROXY ?? '', SDK_MODULE) && goPrivateCovers(goEnv.GONOSUMDB ?? '', SDK_MODULE)) {
+        return ` GOPRIVATE covers the SDK, so Go fetches it with git: check that \`git ls-remote https://${SDK_MODULE}\` works with your git credential.`;
+    }
+    return ' The SDK repositories are private, and Go looks up modules outside GOPRIVATE on proxy.golang.org and sum.golang.org.'
+        + ' Set GOPRIVATE=github.com/synopackageland/* (for example `go env -w GOPRIVATE=github.com/synopackageland/*`) and give git a credential for github.com.';
+}
+/** Whether a comma-separated GOPRIVATE-style glob list matches a module path or one of its prefixes, as go does. */
+export function goPrivateCovers(patterns, modulePath) {
+    const elements = modulePath.split('/');
+    return patterns.split(',').map(glob => glob.trim().replace(/\/+$/, '')).filter(Boolean).some(glob => {
+        const prefix = elements.slice(0, glob.split('/').length).join('/');
+        return globRegExp(glob).test(prefix);
+    });
+}
+/** path.Match syntax: `*` and `?` never cross a slash. */
+function globRegExp(glob) {
+    const body = glob.replace(/[.+^${}()|\\]/g, '\\$&').replaceAll('*', '[^/]*').replaceAll('?', '[^/]');
+    return new RegExp(`^${body}$`);
+}

package/dist/runtime/uninstall-cleanup.d.ts

@@ -4,4 +4,10 @@ export interface UninstallCleanupItem {
     condition: string;
     action: string;
 }
-export declare function uninstallCleanup(pkg: string, executor: boolean): UninstallCleanupItem[];
+export interface UninstallCleanupOptions {
+    /** The App runs the root executor, which purges DSM's leftovers on uninstall. */
+    executor?: boolean;
+    /** The App declares a Login Portal alias; only the executor tier can. */
+    portal?: boolean;
+}
+export declare function uninstallCleanup(pkg: string, { executor, portal }?: UninstallCleanupOptions): UninstallCleanupItem[];

package/dist/runtime/uninstall-cleanup.js

@@ -1,7 +1,13 @@
-export function uninstallCleanup(pkg, executor) {
+const AUTOMATIC_FAILED = 'Only if automatic cleanup failed after uninstall; see the system log entry synopkgland-executor.';
+export function uninstallCleanup(pkg, { executor = false, portal = false } = {}) {
     const items = [
         { target: `@appdata/${pkg}, @appconf/${pkg}, @apphome/${pkg}`, condition: 'After uninstall, if retained data or empty DSM directories are no longer needed.', action: 'Back up retained data; an administrator may remove only these package-specific directories. The delete-data checkbox empties their contents and preserves DSM directory roots.' },
         { target: `@appshare/${pkg}, /usr/syno/etc/packages/${pkg}`, condition: 'After uninstall, if DSM leaves package infrastructure or a package-config symlink.', action: 'Administrator: inspect these package-specific paths and remove unused infrastructure; do not follow the symlink to delete shared data.' },
+        // Package scripts run as the package account; only the root executor can edit these DSM files.
+        executor
+            ? { target: `SYNO.SDS.${pkg}.Instance rules in Application Privileges`, condition: AUTOMATIC_FAILED, action: 'The root executor removes these rules automatically through the Application Privileges API on uninstall. Administrator: remove surviving rules in Control Panel > Application Privileges; DSM would apply them again to a later install under the same name.' }
+            : { target: `SYNO.SDS.${pkg}.Instance rules in Application Privileges`, condition: 'After uninstall, if this package will not be reinstalled.', action: 'DSM keeps these rules in /etc/synoappprivilege.db and applies them again to a later install under the same name. Administrator: remove them in Control Panel > Application Privileges.' },
+        ...(executor && portal ? [{ target: `${pkg} Login Portal alias`, condition: AUTOMATIC_FAILED, action: 'DSM removes the alias configuration without reloading its web server; the root executor then reloads the web server automatically. Administrator: if the alias still opens a DSM page, save an application alias in Control Panel > Login Portal > Applications to reload it, or restart the NAS.' }] : []),
         { target: `${pkg} package account/group`, condition: 'After uninstall, only if this package will not be reinstalled and the identity is unused.', action: 'Administrator: review DSM internal account/group and associated ACLs before cleanup. Package scripts do not delete system identities.' },
     ];
     if (executor)

package/dist/standalone/api-permissions.d.ts

@@ -1,5 +1,6 @@
 import type { Capabilities } from "./manifest.js";
 export declare const API_PERMISSIONS_FILE = "internal/api/permissions.json";
+type SdkPermissions = Record<string, Record<string, ApiPermission>>;
 export declare const MAX_PERMISSIONS_BYTES = 65536;
 export declare const MAX_PERMISSION_METHODS = 1024;
 export type ApiPermission = "administrators" | "authenticated" | "public";
@@ -13,6 +14,7 @@ export declare function readApiPermissions(backendDir: string, capabilities?: Ca
     policy: ApiPermissions;
     digest: string;
     sdkDigest: string;
+    sdk: SdkPermissions;
 };
 /**
  * `entry: admin-only` makes administrators the floor of every route. App
@@ -20,9 +22,10 @@ export declare function readApiPermissions(backendDir: string, capabilities?: Ca
  * capability added are raised, except the public login ceremony of
  * `identity: standalone`, which admits no one by itself.
  */
-export declare function floorAtAdministrators(policy: ApiPermissions): {
+export declare function floorAtAdministrators(policy: ApiPermissions, sdkPermissions: SdkPermissions): {
     policy: ApiPermissions;
     widened: string[];
 };
 /** Launcher access is derived from the same API policy; no second setting. */
 export declare function permitsOrdinaryUsers(policy?: ApiPermissions): boolean;
+export {};

package/dist/standalone/api-permissions.js

@@ -1,10 +1,11 @@
 import { createHash } from "node:crypto";
-import { existsSync, lstatSync, readFileSync } from "node:fs";
+import { lstatSync, readFileSync } from "node:fs";
 import { join } from "node:path";
-import { templatesRoot } from "../template-paths.js";
+import { sdkRequirement, sdkSource } from "../runtime/sdk-source.js";
 import { parseDocument } from "yaml";
 export const API_PERMISSIONS_FILE = "internal/api/permissions.json";
-const SDK_PERMISSIONS_TEMPLATE = "native-go/backend/internal/api/sdk-permissions.json";
+/** SDK-owned routes per capability, in the Go module of the SDK version the App requires. */
+const SDK_PERMISSIONS_FILE = "api/sdk-permissions.json";
 export const MAX_PERMISSIONS_BYTES = 65536;
 export const MAX_PERMISSION_METHODS = 1024;
 export function parseApiPermissions(raw) {
@@ -38,15 +39,9 @@ export function readApiPermissions(backendDir, capabilities = {}) {
         throw new Error("permissions must be a regular bounded JSON file");
     const raw = readFileSync(file);
     const policy = parseApiPermissions(raw);
-    const sdkRaw = readFileSync(join(templatesRoot(), SDK_PERMISSIONS_TEMPLATE));
-    const sdkFile = join(backendDir, 'internal/api/sdk-permissions.json');
-    if (existsSync(sdkFile)) {
-        const sdkStat = lstatSync(sdkFile);
-        if (!sdkStat.isFile() || sdkStat.size !== sdkRaw.length || !readFileSync(sdkFile).equals(sdkRaw)) {
-            throw new Error('SDK route policy differs from the CLI policy; restore the SDK-owned file');
-        }
-    }
-    const sdk = readSdkPermissions();
+    const version = sdkRequirement(backendDir);
+    const sdkRaw = version ? readFileSync(join(sdkSource(version).goDir, SDK_PERMISSIONS_FILE)) : Buffer.from("{}");
+    const sdk = JSON.parse(sdkRaw.toString("utf8"));
     for (const methods of Object.values(sdk))
         for (const method of Object.keys(methods)) {
             if (Object.hasOwn(policy.methods, method))
@@ -56,7 +51,7 @@ export function readApiPermissions(backendDir, capabilities = {}) {
         if (capabilities[capability] || ['rootOps', 'files'].includes(capability) && capabilities.delegate)
             Object.assign(policy.methods, methods);
     }
-    return { policy, sdkDigest: createHash("sha256").update(sdkRaw).digest("hex"), digest: createHash("sha256").update(raw).digest("hex") };
+    return { policy, sdk, sdkDigest: createHash("sha256").update(sdkRaw).digest("hex"), digest: createHash("sha256").update(raw).digest("hex") };
 }
 /**
  * `entry: admin-only` makes administrators the floor of every route. App
@@ -64,16 +59,13 @@ export function readApiPermissions(backendDir, capabilities = {}) {
  * capability added are raised, except the public login ceremony of
  * `identity: standalone`, which admits no one by itself.
  */
-export function floorAtAdministrators(policy) {
-    const sdk = new Set(Object.values(readSdkPermissions()).flatMap(methods => Object.keys(methods)));
+export function floorAtAdministrators(policy, sdkPermissions) {
+    const sdk = new Set(Object.values(sdkPermissions).flatMap(methods => Object.keys(methods)));
     const methods = Object.fromEntries(Object.entries(policy.methods)
         .map(([method, permission]) => [method, sdk.has(method) && permission === "public" ? permission : "administrators"]));
     const widened = Object.entries(policy.methods).filter(([method, permission]) => !sdk.has(method) && permission !== "administrators").map(([method]) => method);
     return { policy: { ...policy, methods }, widened };
 }
-function readSdkPermissions() {
-    return JSON.parse(readFileSync(join(templatesRoot(), SDK_PERMISSIONS_TEMPLATE), 'utf8'));
-}
 /** Launcher access is derived from the same API policy; no second setting. */
 export function permitsOrdinaryUsers(policy) {
     return policy !== undefined && Object.values(policy.methods).some(permission => permission !== "administrators");

package/dist/standalone/build.d.ts

@@ -33,4 +33,5 @@ export declare function runnerFor(run: CommandRunner | undefined, jobs: number,
 /** `build` for a Standalone Package: build the UI, compile the CGI, pack one SPK per arch. */
 export declare function buildStandalone(options: StandaloneBuildOptions): Promise<{
     outputs: string[];
+    warnings: string[];
 }>;

package/dist/standalone/build.js

@@ -1,4 +1,5 @@
 import { spawn } from "node:child_process";
+import { goModulePath, privateSdkHint, SDK_MODULE } from "../runtime/sdk-source.js";
 import { existsSync, mkdirSync, mkdtempSync, rmSync } from "node:fs";
 import { tmpdir } from "node:os";
 import { join } from "node:path";
@@ -92,12 +93,14 @@ export async function buildStandalone(options) {
     await buildUi(manifest, options.run ?? runCommand);
     const outDir = options.outDir ?? join(options.root, "dist");
     const work = mkdtempSync(join(tmpdir(), "syno-standalone-build-"));
+    const warnings = new Set();
     try {
         const outputs = await commitOutputs(outDir, (stage) => forEachArch(arches, jobs, async (arch) => {
             const run = runnerFor(options.run, jobs, arch);
             const archWork = join(work, arch);
             mkdirSync(archWork);
             const executor = await buildExecutor(manifest, arch, archWork, run);
+            executor?.warnings.forEach(warning => warnings.add(warning));
             const builtManifest = executor ? { ...manifest, executor } : manifest;
             const cgiPath = await backendFor(builtManifest, arch, archWork, run);
             const problem = checkCgiBinary(manifest.backend.kind === "go" ? archWork : manifest.root, cgiPath, arch);
@@ -110,7 +113,7 @@ export async function buildStandalone(options) {
             await assembleStandaloneSpk({ manifest: builtManifest, arch, cgiPath, outputPath, daemonControl, backgroundWorker, executor });
             return outputPath;
         }));
-        return { outputs };
+        return { outputs, warnings: [...warnings] };
     }
     finally {
         rmSync(work, { recursive: true, force: true });
@@ -140,6 +143,9 @@ async function backendFor(manifest, arch, work, run) {
     if (readApiPermissions(backend.dir, manifest.capabilities).digest !== manifest.apiPermissionsDigest || readApiPermissions(backend.dir, manifest.capabilities).sdkDigest !== manifest.apiSDKPermissionsDigest) {
         throw new StandaloneBuildError("STANDALONE_API_PERMISSIONS_CHANGED", "API permissions changed during build; check and rebuild.");
     }
+    const module = goModulePath(backend.dir);
+    if (!module)
+        throw new StandaloneBuildError("STANDALONE_GO_BUILD_FAILED", `${join(backend.dir, "go.mod")} 沒有 module 行；backend 必須是一個 Go module。`);
     const out = join(work, `api-${arch}.cgi`);
     const ldflags = [
         "-s",
@@ -147,8 +153,8 @@ async function backendFor(manifest, arch, work, run) {
         "-buildid=",
         `-X main.packageID=${manifest.package}`,
         `-X main.version=${manifest.spkVersion}`,
-        `-X dsmapp/internal/api.expectedPermissionsDigest=${manifest.apiPermissionsDigest}`,
-        `-X dsmapp/internal/api.expectedSDKPermissionsDigest=${manifest.apiSDKPermissionsDigest}`,
+        `-X ${module}/internal/api.expectedPermissionsDigest=${manifest.apiPermissionsDigest}`,
+        `-X ${SDK_MODULE}/api.expectedSDKPermissionsDigest=${manifest.apiSDKPermissionsDigest}`,
         ...delegateBuildFlags(manifest),
         ...(manifest.executor ? [`-X main.executorDigest=${manifest.executor.executorDigest}`, `-X main.policyDigest=${manifest.executor.policyDigest}`] : []),
         ...(manifest.capabilities.identity ? [`-X main.identity=${manifest.capabilities.identity}`] : []),
@@ -164,7 +170,8 @@ async function backendFor(manifest, arch, work, run) {
         throw new StandaloneBuildError("STANDALONE_GO_MISSING", "找不到 go 指令。請安裝 Go 1.25 以上版本（https://go.dev/dl/），或改用 backend.binary 打包既有執行檔。");
     }
     if (result.status !== 0) {
-        throw new StandaloneBuildError("STANDALONE_GO_BUILD_FAILED", `go build（${arch}）失敗。\n${result.stderr}`);
+        const fetchingSdk = result.stderr.includes(`${SDK_MODULE}@`) ? privateSdkHint() : "";
+        throw new StandaloneBuildError("STANDALONE_GO_BUILD_FAILED", `go build（${arch}）失敗。\n${result.stderr}${fetchingSdk}`);
     }
     return out;
 }

package/dist/standalone/daemon.js

@@ -1,7 +1,7 @@
 import { chmodSync, copyFileSync, lstatSync, mkdirSync, readdirSync, realpathSync, writeFileSync } from "node:fs";
 import { isAbsolute, join, relative, resolve } from "node:path";
 import { PINNED_GO_HINT, pinnedGoBuildEnv, pinnedGoProblem } from "../build-spk/go-toolchain.js";
-import { templatesRoot } from "../template-paths.js";
+import { goAssetDir } from "../template-paths.js";
 import { checkCgiBinary } from "./binary.js";
 import { StandaloneBuildError } from "./spk.js";
 const fields = new Set(["exec", "targets", "args", "env", "timeouts", "uninstall_args"]);
@@ -60,7 +60,7 @@ export async function buildDaemonControl(manifest, arch, work, run) {
         return undefined;
     const out = join(work, `daemon-control-${arch}`);
     const result = await run("go", ["build", "-trimpath", "-buildvcs=false", "-ldflags", "-s -w -buildid=", "-o", out, "."], {
-        cwd: join(templatesRoot(), "_daemon"), env: { ...process.env, ...pinnedGoBuildEnv(arch) },
+        cwd: goAssetDir("daemon"), env: { ...process.env, ...pinnedGoBuildEnv(arch) },
     });
     if (result.missing || result.status !== 0)
         throw new StandaloneBuildError("STANDALONE_DAEMON_BUILD_FAILED", `daemon controller build failed (${arch}). ${PINNED_GO_HINT}\n${result.stderr}`);

package/dist/standalone/dsm-window.js

@@ -1,6 +1,6 @@
 import { REOPEN_EVENTS_RUNTIME } from "./reopen-events.js";
 import { DSM_LANGS } from "./i18n.js";
-import { PASSWORD_CONFIRM, ROOT_PANEL, ROOT_RUNTIME, rootTasks } from "./root-window.js";
+import { PASSWORD_CONFIRM, ROOT_PANEL, ROOT_RUNTIME, rootPanelCatalogs } from "./root-window.js";
 import { HOST_ADAPTER_RUNTIME } from "./host-adapter.js";
 import { permitsOrdinaryUsers } from "./api-permissions.js";
 import { PORTAL_RUNTIME } from "./portal-window.js";
@@ -297,21 +297,18 @@ ${ns}.webApi = function (win) {
 }
 const ROOT_PANEL_CSS = [
     ".dsmapp-rootpanel{margin:16px 20px;padding:12px 16px;border:1px solid #d5dce5;border-radius:4px;background:#f7f9fb;font-size:13px;line-height:1.5}",
-    ".dsmapp-rootpanel h2{margin:0 0 6px;font-size:14px;font-weight:600}",
-    ".dsmapp-rootpanel dl{display:grid;grid-template-columns:max-content 1fr;gap:2px 12px;margin:8px 0}",
-    ".dsmapp-rootpanel dt{color:#526070}.dsmapp-rootpanel dd{margin:0}",
-    ".dsmapp-rootpanel pre{margin:4px 0 8px;padding:6px 8px;background:#fff;border:1px solid #e1e6ec;white-space:pre-wrap;max-height:160px;overflow:auto}",
+    ".dsmapp-rootpanel h2{margin:0 0 6px;font-size:14px;font-weight:600}.dsmapp-rootpanel p{margin:4px 0}",
+    ".dsmapp-rootpanel label{display:block;margin:8px 0}.dsmapp-rootpanel input{margin-left:8px;padding:3px 6px}",
     ".dsmapp-rootpanel-actions button{margin-right:8px;padding:4px 14px}",
     ".dsmapp-rootpanel-primary{background:#057feb;color:#fff;border:1px solid #057feb;border-radius:3px}",
-    ".dsmapp-rootpanel-message{color:#c0392b}.dsmapp-rootpanel-hint{color:#526070;font-size:12px}",
+    ".dsmapp-rootpanel-hint{color:#526070;font-size:12px}.dsmapp-rootpanel [hidden]{display:none}",
 ].join("");
 /**
- * An install-selected delegate scope is approved only in the app's settings: the
- * approval carries the scope the administrator picks there, and the window panel
- * has no scope picker.
+ * A Vue app approves in the SDK's ExecutorSettings, which also carries an
+ * install-selected scope; the window panel serves plain-UI apps only.
  */
 function settingsOnlyApproval(manifest) {
-    return manifest.ui.build !== undefined && manifest.capabilities.delegate?.scope === "install-selected";
+    return manifest.ui.build !== undefined;
 }
 /**
  * The capabilities.rootOps: true additions to the window: the exact tasks and panel
@@ -320,7 +317,7 @@ function settingsOnlyApproval(manifest) {
  */
 function renderRootParts(ns, manifest) {
     return {
-        definitions: `${ns}.rootTasks = ${JSON.stringify(rootTasks(manifest.executor))};
+        definitions: `${ns}.rootTasks = ${JSON.stringify(manifest.executor.tasks)};
 ${ns}.createRootAccess = (function () {
 ${ROOT_RUNTIME}
   return createRootAccess;
@@ -352,7 +349,7 @@ ${PASSWORD_CONFIRM}
     });
 ${settingsOnlyApproval(manifest) ? "" : `    var panels = me.body && me.body.dom.querySelector(".dsmapp-rootpanels");
     if (panels) {
-      ${ns}.mountRootPanel(panels, access, null, ${ns}.rootTasks, session().admin);
+      ${ns}.mountRootPanel(panels, access, ${ns}.createI18n(lang, ${JSON.stringify(rootPanelCatalogs())}).t, session().admin);
     }
 `}`,
     };

package/dist/standalone/inspect-spk.js

@@ -19,7 +19,7 @@ import { renderUninstallWizardFiles } from "../build-spk/uninstall-wizard.js";
 import { renderStandaloneScript } from "./lifecycle.js";
 import { listPortExposures, loadCompose } from "../compose/analyze.js";
 import { uninstallCleanup } from "../runtime/uninstall-cleanup.js";
-import { PORTAL_JSON_RELPATH, PORTAL_MUSTACHE_RELPATH, portalResource, renderPortalJson, renderPortalLifecycle, renderPortalMustache, renderPortalWizardStep } from "../portal/package.js";
+import { PORTAL_JSON_RELPATH, PORTAL_MUSTACHE_RELPATH, renderPortalJson, renderPortalLifecycle, renderPortalMustache, renderPortalWizardStep } from "../portal/package.js";
 import { isPortalAlias } from "../portal/alias.js";
 import { defaultPackageIcons, MAX_ICON_BYTES } from "../build-spk/dsm-icons.js";
 import { decodePng } from "../build-spk/png.js";
@@ -70,7 +70,8 @@ export async function inspectSpk(spkPath, expectedKind) {
         await checkArch(dir, info, kind, paths.has(CGI_PAYLOAD_PATH), findings);
         const background = kind === "native-go" && paths.has(BACKGROUND_WORKER_PAYLOAD);
         const sharedFolder = standalone ? recoverSharedFolder(readOptional(join(dir, "scripts/postinst"))) : undefined;
-        const portal = await recoverPortal(dir, info, kind === "container" ? info.package ?? "" : `SYNO.SDS.${info.package}.Instance`, paths, payload, findings);
+        // A Compose App has no executor, so its SPK never carries a portal.
+        const portal = standalone ? await recoverPortal(dir, info, `SYNO.SDS.${info.package}.Instance`, paths, payload, findings) : undefined;
         if (portal && info.os_min_ver && OS_MIN_VER.test(info.os_min_ver) && !isDsmAtLeast(info.os_min_ver, PORTAL_MIN_DSM)) {
             findings.push(`INFO os_min_ver「${info.os_min_ver}」低於 portal 需要的 DSM ${PORTAL_MIN_DSM}；DSM 7.1.1 以錯誤 320 拒裝帶 web-config app-portal 的未簽章套件，7.2 未驗證`);
         }
@@ -80,6 +81,8 @@ export async function inspectSpk(spkPath, expectedKind) {
         if (kind === "container")
             await checkContainerExposure(dir, join(dir, "package.tgz"), findings);
         const hasExecutor = (metadata.capabilities ?? []).some(name => name === "rootOps" || name === "delegate") || paths.has("executor/executor");
+        if (standalone && portal && !hasExecutor)
+            findings.push("PORTAL_REQUIRES_EXECUTOR portal 需要 executor 層級（rootOps 或 delegate）：解除安裝後只有 root purge 能讓 nginx 停止提供別名");
         const daemon = standalone ? await checkDaemon(dir, info, paths, payload, findings, hasExecutor, background) : undefined;
         if (background)
             checkBackground(dir, info, payload, findings, hasExecutor, daemon);
@@ -104,7 +107,7 @@ export async function inspectSpk(spkPath, expectedKind) {
                         findings.push(`Executor scripts/${hook} differs from fixed lifecycle.`);
                 }
             }
-            for (const [name, text] of Object.entries(renderUninstallWizardFiles(info.package, "native", { executor: true }))) {
+            for (const [name, text] of Object.entries(renderUninstallWizardFiles(info.package, "native", { executor: true, portal: Boolean(portal) }))) {
                 if (readOptional(join(dir, "WIZARD_UIFILES", name)) !== text)
                     findings.push(`Executor WIZARD_UIFILES/${name} is missing cleanup guidance.`);
             }
@@ -130,7 +133,7 @@ export async function inspectSpk(spkPath, expectedKind) {
             ...(executor ? { executor } : {}),
             ...(portal ? { portal: { appId: portal.appId, alias: portal.alias } } : {}),
             ...(metadata.entry ? { entry: metadata.entry } : {}),
-            ...(standalone ? { uninstallCleanup: uninstallCleanup(info.package, hasExecutor) } : {}),
+            ...(standalone ? { uninstallCleanup: uninstallCleanup(info.package, { executor: hasExecutor, portal: Boolean(portal) }) } : {}),
             package: info.package,
             version: info.version,
             arch: info.arch,
@@ -324,11 +327,9 @@ function checkConf(dir, findings, kind, background, sharedFolder, pkg, portal) {
             if (!resource["docker-project"])
                 findings.push("container 缺少 docker-project resource");
             for (const key of Object.keys(resource)) {
-                if (!["docker-project", "webservice", ...(portal ? ["web-config"] : [])].includes(key))
+                if (!["docker-project", "webservice"].includes(key))
                     findings.push(`未知 container resource: ${key}`);
             }
-            if (portal && JSON.stringify(resource["web-config"]) !== JSON.stringify(portalResource()["web-config"]))
-                findings.push("container web-config 必須只有固定的 app-portal 註冊");
         }
         catch {
             findings.push("container 缺少有效的 conf/resource");

package/dist/standalone/manifest.d.ts

@@ -1,6 +1,6 @@
 import { type PackageMetadata } from "../package-metadata.js";
 import { type DelegateCapability } from "../runtime/executor-policy.js";
-import type { ExecutorPins } from "../runtime/executor-tasks.js";
+import type { ExecutorPins, ExecutorTask } from "../runtime/executor-tasks.js";
 import { type NativeArchFamily } from "../build-spk/dsm-arch.js";
 import { type Catalogs, type InfoTranslations } from "./i18n.js";
 export type { InfoText } from "./i18n.js";
@@ -58,7 +58,10 @@ export interface StandaloneManifest {
     capabilities: Capabilities;
     /** Fixed root/<name>.sh operations, enabled by capabilities.rootOps. */
     rootOps?: RootOp[];
-    executor?: ExecutorPins;
+    /** Set by build: the pins and the root tasks generated from the App's SDK executor. */
+    executor?: ExecutorPins & {
+        tasks: ExecutorTask[];
+    };
     daemon?: Daemon;
     /** `install.sharedFolder`: the Shared Folder the install wizard selects or `data-share` creates. */
     sharedFolder?: SharedFolder;

package/dist/standalone/manifest.js

@@ -11,9 +11,11 @@ import { readBackground } from "./background.js";
 import { DEFAULT_MIN_DSM, isDsmAtLeast, PORTAL_MIN_DSM, portalMinDsmMessage } from "../build-spk/dsm-version.js";
 import { readSharedFolder } from "./shared-folder.js";
 import { floorAtAdministrators, permitsOrdinaryUsers, readApiPermissions } from "./api-permissions.js";
-import { readPortalDeclaration } from "../portal/alias.js";
+import { PORTAL_REQUIRES_EXECUTOR, readPortalDeclaration } from "../portal/alias.js";
 import { renderPackageIcons } from "../build-spk/dsm-icons.js";
 import { validateReproducible } from "../reproducible-config.js";
+import { SDK_MODULE, sdkRequirement } from "../runtime/sdk-source.js";
+import { sdkProblems } from "./sdk-check.js";
 /**
  * `dsm-package.yaml`: a Standalone Package, i.e. an unsigned native SPK that
  * runs as its own DSM package account with a CGI backend and a DSM window UI.
@@ -135,7 +137,12 @@ function readManifest(raw, c) {
             permissions = readApiPermissions(backend.dir, capabilities);
         }
         catch (error) {
-            c.fail("STANDALONE_API_PERMISSIONS_INVALID", `backend/internal/api/permissions.json must define the centralized API policy: ${String(error)}`);
+            // The SDK's own routes come from its module; a failed download is not a policy problem.
+            const download = /^\[SDK_DOWNLOAD_FAILED\] ([\s\S]*)$/.exec(error.message);
+            if (download)
+                c.fail("SDK_DOWNLOAD_FAILED", download[1]);
+            else
+                c.fail("STANDALONE_API_PERMISSIONS_INVALID", `backend/internal/api/permissions.json must define the centralized API policy: ${String(error)}`);
         }
     }
     const daemon = arches && readDaemon(raw.daemon, c.root, arches, e => c.fail(e.code, e.message));
@@ -151,7 +158,7 @@ function readManifest(raw, c) {
     const sharedFolder = raw.install === undefined ? undefined : readSharedFolder(raw.install, e => c.fail(e.code, e.message));
     const entry = raw.entry === undefined ? undefined : readEntry(raw.entry, backend, permissions?.policy, c);
     if (entry === "admin-only" && permissions) {
-        const floored = floorAtAdministrators(permissions.policy);
+        const floored = floorAtAdministrators(permissions.policy, permissions.sdk);
         if (floored.widened.length) {
             c.fail("STANDALONE_ENTRY_WIDENED", `entry: admin-only 以管理員為所有 route 的下限；permissions.json 的 ${floored.widened.join("、")} 會開放給其他人。請改為 administrators，或改用 entry: app-privilege／省略 entry。`);
         }
@@ -162,10 +169,17 @@ function readManifest(raw, c) {
         c.fail("CAPABILITY_COMBINATION_INVALID", "capabilities.identity 需要獨立登入頁；plain UI 不支援，請改用 vue UI（init --ui vue）。");
     if (capabilities.delegate?.scope === "install-selected" && ui && !ui.build)
         c.fail("CAPABILITY_COMBINATION_INVALID", "delegate scope install-selected 只能在 Vue 面板確認；plain UI 不支援，請改用 vue UI（init --ui vue）。");
+    if (backend?.kind === "go") {
+        for (const problem of sdkProblems(backend.dir, ui?.build?.cwd, Boolean(capabilities.delegate || capabilities.rootOps)))
+            c.fail(problem.code, problem.message);
+    }
     const i18n = raw.i18n === undefined ? undefined : readI18n(raw.i18n, c);
     const icon = raw.icon === undefined ? undefined : readIcon(raw.icon, c);
     const portal = raw.portal === undefined || !packageId ? undefined : readPortalDeclaration(raw.portal, packageId)
         ?? c.fail("STANDALONE_PORTAL_INVALID", "portal 必須是 {} 或 { alias: <小寫英數與 -，1–64 字，不可為 DSM 保留路徑> }。");
+    if (portal && !capabilities.rootOps && !capabilities.delegate) {
+        c.fail("STANDALONE_PORTAL_REQUIRES_EXECUTOR", PORTAL_REQUIRES_EXECUTOR);
+    }
     if (portal && osMinVer && !isDsmAtLeast(osMinVer, PORTAL_MIN_DSM)) {
         c.fail("STANDALONE_PORTAL_MIN_DSM", portalMinDsmMessage(osMinVer, "portal"));
     }
@@ -222,9 +236,10 @@ function readEntry(value, backend, policy, c) {
     if (!backend)
         return undefined;
     const main = backend.kind === "go" ? join(backend.dir, backend.main, "main.go") : "";
-    if (backend.kind !== "go" || !existsSync(join(backend.dir, "internal/dsm/entry.go"))
+    if (backend.kind !== "go" || !sdkRequirement(backend.dir)
         || !existsSync(main) || !readFileSync(main, "utf8").includes("dsm.NewEntryGate(")) {
-        return c.fail("STANDALONE_ENTRY_UNSUPPORTED", "entry 需要 Go backend 內的 SDK entry gate：請從 SDK 範本複製 internal/dsm/entry.go、apppriv.go 與 native bridge，並在 cmd/app/main.go 以 dsm.NewEntryGate 包住 authenticator。");
+        const shown = main ? relative(c.root, main) : "backend.main 的 main.go";
+        return c.fail("STANDALONE_ENTRY_UNSUPPORTED", `entry 需要 SDK 的 entry gate：backend/go.mod 要 require ${SDK_MODULE}，並在 ${shown} 以 dsm.NewEntryGate 包住 authenticator。`);
     }
     if (value === "app-privilege" && !permitsOrdinaryUsers(policy)) {
         return c.fail("STANDALONE_ENTRY_INVALID", "entry: app-privilege 需要至少一個 permissions.json 標為 authenticated 的 route，一般使用者才有功能可用。");

package/dist/standalone/root-window.d.ts

@@ -1,8 +1,15 @@
-export { executorTasks as rootTasks, type ExecutorTask as RootTask } from '../runtime/executor-tasks.js';
+export { type ExecutorTask as RootTask } from '../runtime/executor-tasks.js';
 /** Exact readback is authoritative. PasswordConfirm tokens are reused immediately,
  * across both Root APIs, and never persisted (DSM validity is about 300 seconds). */
 export declare const ROOT_RUNTIME: string;
-export declare const ROOT_PANEL = "function mountRootPanel(host, access, i18n, tasks, admin) {\n  if (!admin) return;\n  var status = document.createElement(\"p\"), approve = document.createElement(\"button\"), retry = document.createElement(\"button\");\n  approve.textContent = \"Approve background access\"; retry.textContent = \"Check status\";\n  host.appendChild(status); host.appendChild(approve); host.appendChild(retry);\n  function show(result) { status.textContent = result.state + (result.reason ? \": \" + result.reason : \"\"); approve.hidden = result.state !== \"needs-admin-approval\" && result.retry !== true; }\n  function run(fn) { approve.disabled = retry.disabled = true; return fn().then(show, function(e) { show({state: \"blocked\", reason: e.message || e.code}); }).then(function() { approve.disabled = retry.disabled = false; }); }\n  access.subscribe(show);\n  approve.onclick = function() { return run(function() { return access.authorize(); }); };\n  retry.onclick = function() { return run(function() { return access.status(); }); };\n  run(function() { return access.status().then(function(result) { return result.tasks && result.tasks.boot && result.tasks.control && result.tasks.boot.state === \"ready\" && result.tasks.control.state === \"ready\" ? access.control(\"start\") : result; }); });\n}";
-/** Administrator password confirmation in the window's own session: a supplied
- * password, or a masked form when none is given. */
+type PanelLocale = "en" | "zh-TW" | "zh-CN" | "ja" | "ko" | "de" | "fr" | "es" | "it";
+/** The plain-UI window panel's text; a state's reason stays the runtime's English detail. */
+export declare const ROOT_PANEL_MESSAGES: Record<string, Record<PanelLocale, string>>;
+/** ROOT_PANEL_MESSAGES as createI18n catalogs, one per locale. */
+export declare function rootPanelCatalogs(): Record<string, Record<string, string>>;
+/** The plain-UI approval panel: it asks for the password itself and passes it
+ * to `access.authorize`, the same PasswordConfirm path as ExecutorSettings. */
+export declare const ROOT_PANEL = "function mountRootPanel(host, access, t, admin) {\n  if (!admin) return;\n  function el(tag, className) { var e = document.createElement(tag); if (className) e.className = className; return e; }\n  var panel = el(\"div\", \"dsmapp-rootpanel\"), title = el(\"h2\"), status = el(\"p\"), reason = el(\"p\", \"dsmapp-rootpanel-hint\");\n  var form = el(\"form\"), label = el(\"label\"), password = el(\"input\"), actions = el(\"div\", \"dsmapp-rootpanel-actions\");\n  var approve = el(\"button\", \"dsmapp-rootpanel-primary\"), check = el(\"button\");\n  title.textContent = t(\"title\"); label.textContent = t(\"password\");\n  password.type = \"password\"; password.autocomplete = \"current-password\";\n  approve.type = \"submit\"; approve.textContent = t(\"approve\");\n  check.type = \"button\"; check.textContent = t(\"check\");\n  label.appendChild(password); actions.appendChild(approve); actions.appendChild(check);\n  form.appendChild(label); form.appendChild(actions);\n  panel.appendChild(title); panel.appendChild(status); panel.appendChild(reason); panel.appendChild(form);\n  host.appendChild(panel);\n  function show(result) {\n    status.textContent = t(\"state.\" + result.state);\n    reason.textContent = result.reason || \"\"; reason.hidden = !result.reason;\n    label.hidden = approve.hidden = result.state !== \"needs-admin-approval\" && result.retry !== true;\n  }\n  function run(fn) { approve.disabled = check.disabled = true; return fn().then(show, function(e) { show({state: \"blocked\", reason: e.message || e.code}); }).then(function() { approve.disabled = check.disabled = false; }); }\n  access.subscribe(show);\n  form.onsubmit = function(event) {\n    if (event) event.preventDefault();\n    var entered = password.value; password.value = \"\";\n    if (!entered) return Promise.resolve();\n    return run(function() { return access.authorize(entered); });\n  };\n  check.onclick = function() { return run(function() { return access.status(); }); };\n  run(function() { return access.status().then(function(result) { return result.tasks && result.tasks.boot && result.tasks.control && result.tasks.boot.state === \"ready\" && result.tasks.control.state === \"ready\" ? access.control(\"start\") : result; }); });\n}";
+/** Administrator password confirmation in the window's own session, for the
+ * password an approval panel collected. */
 export declare const PASSWORD_CONFIRM: string;