@synopackageland/cli 0.9.0 → 0.9.2

package/CHANGELOG.md

@@ -1,6 +1,179 @@
 # Changelog
 
-## Unreleased (0.9.0)
+## 0.9.2 (2026-10-12)
+
+Builds with SDK 0.9.3 and templates 0.9.2: `init` writes SDK v0.9.3 and
+`@synopackageland/sdk` 0.9.3. The executor digest table records SDK 0.9.2 and
+0.9.3 (the same digests; 0.9.3 changes only translations). An App rebuilt
+with SDK 0.9.2 or 0.9.3 gets the new executor; the policy digest stays the
+same, so an installed App needs no new approval.
+
+繁中摘要：`check` 與 `build` 的錯誤訊息每個錯誤碼只出現一次；`build --json` 的 SDK
+下載失敗附上 GOPRIVATE 提示；有 executor 並宣告 `install.sharedFolder` 的 App 通過
+`inspect` 的 postinst 檢查。重新安裝後的核准只需輸入一次密碼：共用資料夾讀回等 40 s，
+沒到達 executor 的選擇任務在同一次核准內再跑一次，啟動後的健康檢查等 30 s。
+
+- `check` and `build` name each error code once. 0.9.1 printed the first code
+  twice, for example
+  `[STANDALONE_PORTAL_REQUIRES_EXECUTOR] [STANDALONE_PORTAL_REQUIRES_EXECUTOR] …`.
+- A `--json` error without its own hint takes the registry suggestion of its
+  code. `build --json` now answers `SDK_DOWNLOAD_FAILED` with the GOPRIVATE and
+  git-credential step instead of the generic hint.
+- `inspect` accepts an App with `capabilities.rootOps` or `delegate` that
+  declares `install.sharedFolder`. Its `postinst` and `postupgrade` start the
+  executor before the shared-folder script, and 0.9.1 reported them as not
+  matching.
+- Re-approval after a reinstall takes one password submission for both the
+  executor and an install-selected share. The DSM window now reads the share
+  selection back for 40 s instead of 20 s, runs a selection task that missed
+  the restarting executor once more without a new confirmation, and waits
+  30 s instead of 10 s for a started executor before withdrawing the tasks an
+  approval created.
+
+## 0.9.1 (2026-10-12)
+
+Fixes from the 0.9.0 acceptance on DSM (t-0294, t-0290, t-0292).
+
+繁中摘要：`build` 重複 `--arch` 時每個架構都建置；SDK 下載失敗回報
+`SDK_DOWNLOAD_FAILED`（不再包成 `STANDALONE_API_PERMISSIONS_INVALID`），`check`
+顯示每個錯誤碼自己的建議；`status` 列出 portal；Vue App 只在 SDK 的
+ExecutorSettings 核准，plain UI 的 DSM 視窗面板改為有樣式、跟隨 DSM 語言並在面板內
+輸入密碼。更正 0.9.0 的核准說明：policy 不變的升級不需重新核准，只有
+install-selected 的 scope 需要管理員確認一次。記錄 SDK 0.9.1 executor digests（只換
+executor、policy digest 不變，免重新核准）。App 分兩層：有 executor（rootOps 或
+delegate）的 App 解除安裝時自動移除應用程式權限規則，宣告 portal 時再 reload nginx，
+精靈與 cleanup 清單只把它們列為自動清除失敗時的後備；無升權 App 任何階段都不用 root，
+應用程式權限規則仍由管理員手動移除。破壞性變更：portal 只限 executor 層級，無升權
+native App 以 `STANDALONE_PORTAL_REQUIRES_EXECUTOR` 拒絕，Compose App 以
+`CONTRACT_PORTAL_REQUIRES_EXECUTOR` 拒絕。並附 0.9.0 安裝殘留的清理步驟。
+
+### Build and check
+
+- `build --arch x86_64 --arch aarch64` builds every family named; 0.9.0 built
+  only the last one. Repeated values and comma lists combine.
+- An SDK version Go cannot fetch is reported as `SDK_DOWNLOAD_FAILED` with the
+  GOPRIVATE and git-credential hint. 0.9.0 wrapped it as
+  `STANDALONE_API_PERMISSIONS_INVALID`.
+- `check` shows the registry suggestion of each error code. It no longer
+  replaces every `dsm-package.yaml` error's suggestion with "fix the schema 2
+  fields".
+- `STANDALONE_ENTRY_UNSUPPORTED` names the `main.go` of the project's
+  `backend.main`, not always `cmd/app/main.go`.
+
+### Status
+
+- `status` lists `portal` for an App with `portal: {}`. It reads the App's
+  `portal.status`: `ready` with the URL when an administrator set an alias,
+  `needs-admin-approval` when none is set, and `blocked` before install or
+  when the status cannot be read.
+
+### DSM window approval
+
+- A Vue App approves the executor only in the SDK's `ExecutorSettings`. The
+  DSM window no longer adds its own approval panel to a Vue App with
+  `rootOps` or a fixed delegate scope. That panel used unstyled English
+  buttons, and its password prompt was appended below the App, so approving
+  from it never reached PasswordConfirm.
+- A plain-UI App keeps the window panel. It now uses the panel styles, shows
+  its text in the DSM language (the nine SDK locales), and asks for the
+  administrator password inside the panel. The password goes to
+  `authorize` the same way as in `ExecutorSettings`.
+- Breaking: `confirmPassword` without a password fails with
+  `password_required` and sends nothing; the masked form it appended is gone.
+
+### Portal needs the executor tier (breaking)
+
+- DSM removes a portal App's Login Portal alias at uninstall but does not
+  reload nginx (DSM 7.4, t-0294), so `/<alias>/` kept opening a DSM page.
+  Only root can reload it, so a `portal` now needs `capabilities.rootOps` or
+  `capabilities.delegate`. A no-privilege native App with `portal` fails
+  `check`/`build` with `STANDALONE_PORTAL_REQUIRES_EXECUTOR`; `add portal`
+  refuses it unless the same call adds `root-ops` or `delegate`; `inspect`
+  flags such an SPK with `PORTAL_REQUIRES_EXECUTOR`.
+- A Compose App has no executor: `integration.web.portal` now always fails
+  with `CONTRACT_PORTAL_REQUIRES_EXECUTOR` and the schema no longer describes
+  its shape. `CONTRACT_PORTAL_INVALID`, `CONTRACT_PORTAL_UNSUPPORTED` and
+  `CONTRACT_PORTAL_MIN_DSM` are gone, and `inspect` reports a Compose SPK's
+  `web-config` as an unknown resource.
+- Fix: add `root-ops` or `delegate`, or remove the portal and let an
+  administrator set up a reverse proxy in DSM.
+
+### Uninstall
+
+- An App with the executor (rootOps or delegate) cleans up after DSM itself:
+  SDK 0.9.1's root purge deletes the App's rules in Control Panel >
+  Application Privileges and, for a portal App, reloads nginx once DSM has
+  removed the alias. The uninstall wizard says so in the nine languages, and
+  `status`/`inspect` list both only as fallbacks: "Only if automatic cleanup
+  failed after uninstall; see the system log entry synopkgland-executor."
+- A no-privilege App never uses root, not even at uninstall. Its wizard keeps
+  saying that DSM keeps the App's rules in Control Panel > Application
+  Privileges, that a later install under the same name applies them again,
+  and that an administrator can remove them; the cleanup list keeps that
+  item. It never mentions a Login Portal alias, because it cannot declare one.
+  A test builds plain, files, jobs, identity and `entry: app-privilege` SPKs
+  and checks they run as the package account, ship no executor or root
+  tasks, and that their scripts never call synowebapi, nginx or a system
+  unit.
+
+### SDK 0.9.1
+
+- Depends on `@synopackageland/templates` 0.9.1: `init` scaffolds Apps that
+  require SDK 0.9.1 (`backend/go.mod` and `@synopackageland/sdk`).
+- The CLI records the SDK 0.9.1 executor digests, rebuilt with the
+  uninstall cleanup (x86_64 `5d75af3c…`, aarch64 `b0e1f817…`, armv7
+  `17db613a…`; lifecycle digests equal 0.9.0). SDK 0.9.1 only replaces the
+  executor: the policy format, task scripts and permissions are unchanged,
+  so the policy digest stays the same and no App needs a new approval. An App moved from SDK
+  0.9.0 to 0.9.1 in `backend/go.mod` keeps its approval; the installed
+  executor re-pins the new executor by itself.
+
+### Cleaning up after 0.9.0 installs
+
+An App built with SDK 0.9.0 could leave root tasks behind at uninstall
+(t-0294 bugs 1 and 3). If the App is still installed, rebuild it with SDK
+0.9.1, install that build and then uninstall it: the 0.9.1 purge rebuilds the
+task inventory from the approved policy and deletes the tasks. Otherwise an
+administrator removes them by hand:
+
+- Control Panel > Task Scheduler: delete `<package> executor control` and
+  `<package> executor selection`.
+- The boot event, which DSM's web API refuses to delete over HTTP (error
+  119): as root, run
+  `/usr/syno/bin/synowebapi --exec api=SYNO.Core.EventScheduler method=delete version=1 task_name="<package> executor boot"`.
+- Control Panel > Application Privileges: remove the App's rules. Control
+  Panel > Login Portal: if its alias still opens, save an application alias
+  there to reload nginx, or restart the NAS. The 0.9.1 rebuild-and-uninstall
+  route above does both for you.
+
+### Approval after upgrading (correction to 0.9.0)
+
+- 0.9.0 said a delegate App rebuilt with it needs one new approval. Measured
+  on DSM 7.4 (t-0294): a `files.moveFromStaging` App upgraded from 0.8.0 to
+  0.9.0 kept the same policy digest. The installed executor re-pinned the new
+  executor by itself, with no new approval. Only an `install-selected` scope
+  needed one administrator confirmation (PasswordConfirm) of the shared
+  folder.
+- A new approval is needed only when the executor policy changes, for
+  example new operations, another scope or changed root scripts.
+
+### Release tooling
+
+- `node scripts/executor-digests.mjs <sdk>/release/vX.Y.Z.json` records a
+  released SDK's executor and lifecycle digests in
+  `src/runtime/executor-digests.json`. It checks the three architectures,
+  go1.26.9 and the CLI minor. A tagged release (`commit` set) never changes
+  a recorded version; a release not yet tagged (`commit: null`) replaces its
+  own entry. SDK 0.9.1's digests were recorded this way.
+- `test/fixtures/executor-setup/` holds the `executor/setup.json` this CLI
+  writes for delegate, time-limited delegate with jobs, root-ops and
+  install-selected Apps, for the SDK executor's contract test.
+  `UPDATE_EXECUTOR_SETUP_FIXTURES=1 npm test` regenerates them.
+- The npm gate runs `scripts/smoke-exports.mjs`, the export check of
+  `smoke-pack.sh`. In 0.9.0 that check still imported the removed
+  `authorizationTemplateDirectory`, so `gate.sh docker` always failed.
+
+## 0.9.0 (2026-10-11)
 
 The CLI, the SDK and the project templates are now three repositories, and
 the CLI only packages, deploys and checks. An App names its SDK version once,

package/README.md

@@ -72,7 +72,7 @@ Add them with `init --with …` or later with `synopkgland add <capability…>`.
 | `login` | Sign users in with their DSM account, without the DSM desktop | Nobody; requires HTTPS for password sign-in |
 | `delegate` | Move files into a user's chosen folder while the user is offline | An administrator, once |
 | `root-ops` | Run fixed `root/*.sh` scripts for administrators | An administrator, once |
-| `portal` | Open the app from its own Application Portal alias | An administrator sets the alias; needs DSM 7.3.2-86009+ |
+| `portal` | Open the app from its own Application Portal alias | An administrator sets the alias; needs `root-ops` or `delegate` and DSM 7.3.2-86009+ |
 
 Delegate is implemented; its default operation is `files.moveFromStaging`.
 Device lifecycle acceptance on real hardware is still pending for delegate and root operations.

package/dist/add.js

@@ -8,6 +8,7 @@ import { templatesRoot } from './template-paths.js';
 import { borrowedTarget, capabilityOverlays } from './capability-overlays.js';
 import { DEFAULT_MIN_DSM, isDsmAtLeast, PORTAL_MIN_DSM } from './build-spk/dsm-version.js';
 import { loadStandaloneManifest } from './standalone/manifest.js';
+import { PORTAL_REQUIRES_EXECUTOR } from './portal/alias.js';
 function files(root, dir = root) {
     if (!existsSync(dir))
         return [];
@@ -67,10 +68,21 @@ function addPortal(root, result) {
     writeFileSync(manifestPath, String(doc));
     return withNotes({ ...result, added: [...result.added, 'portal'] }, notes);
 }
+/** A portal needs the executor tier, already declared or added in the same call; nothing is written otherwise. */
+function refuseNoPrivilegePortal(root, rest) {
+    const loaded = loadStandaloneManifest(root);
+    if (!loaded.ok)
+        throw new Error(loaded.errors.map(e => `[${e.code}] ${e.message}`).join('\n'));
+    const { rootOps, delegate } = loaded.manifest.capabilities;
+    if (!rootOps && !delegate && !rest.some(name => name === 'root-ops' || name === 'delegate')) {
+        throw new Error(`[STANDALONE_PORTAL_REQUIRES_EXECUTOR] ${PORTAL_REQUIRES_EXECUTOR}`);
+    }
+}
 export function addCapabilities(root, requested) {
     const wanted = [...new Set(requested.flatMap(value => value.split(',')).map(value => value.trim()))];
     if (wanted.includes('portal')) {
         const rest = wanted.filter(name => name !== 'portal');
+        refuseNoPrivilegePortal(root, rest);
         return addPortal(root, rest.length ? addCapabilities(root, rest) : { added: [], unchanged: [] });
     }
     const names = capabilityNames(requested);

package/dist/build-spk/dsm-version.d.ts

@@ -19,7 +19,5 @@ export declare function portalMinDsmMessage(value: string, field: string): strin
 export declare function isDsmAtLeast(value: string, floor: string): boolean;
 /** Container Apps cannot declare an os_min_ver below {@link CONTAINER_MIN_DSM}. */
 export declare function assertContainerMinDsm(value: string): void;
-/** A compose portal cannot be built for an os_min_ver below {@link PORTAL_MIN_DSM}. */
-export declare function assertPortalMinDsm(value: string): void;
 /** `--min-dsm`: a release (`7.1`) or a full `<version>-<build>` string (`7.2-69057`). */
 export declare function resolveMinDsm(value: string): string;

package/dist/build-spk/dsm-version.js

@@ -44,12 +44,6 @@ export function assertContainerMinDsm(value) {
         throw new Error(`[MIN_DSM_CONTAINER_FLOOR] 容器 App 需要 DSM ${CONTAINER_MIN_DSM} 以上（docker-project／Container Manager 從 DSM 7.2.1 才有），收到「${value}」。`);
     }
 }
-/** A compose portal cannot be built for an os_min_ver below {@link PORTAL_MIN_DSM}. */
-export function assertPortalMinDsm(value) {
-    if (!isDsmAtLeast(value, PORTAL_MIN_DSM)) {
-        throw new Error(`[CONTRACT_PORTAL_MIN_DSM] ${portalMinDsmMessage(value, "integration.web.portal")}`);
-    }
-}
 const FULL_VERSION = /^7\.\d+(\.\d+)?-\d+$/;
 /** `--min-dsm`: a release (`7.1`) or a full `<version>-<build>` string (`7.2-69057`). */
 export function resolveMinDsm(value) {

package/dist/build-spk/generator.js

@@ -1,7 +1,7 @@
 import { metadataInfoFields } from "../package-metadata.js";
 import { chmodSync, copyFileSync, cpSync, existsSync, mkdirSync, mkdtempSync, readFileSync, readdirSync, rmSync, statSync, writeFileSync, } from "node:fs";
 import { tmpdir } from "node:os";
-import { dirname, join } from "node:path";
+import { join } from "node:path";
 import { createHash } from "node:crypto";
 import * as tar from "tar";
 import { parseDocument, Scalar } from "yaml";
@@ -14,13 +14,12 @@ import { validateProject } from "../validate.js";
 import { packageIcons, writeDsmWindowIcons, writePackageCenterIcons } from "./dsm-icons.js";
 import { contractIconPath } from "../contract/icon.js";
 import { infoArchValue, isContainerArchFamily } from "./dsm-arch.js";
-import { assertContainerMinDsm, assertPortalMinDsm, resolveMinDsm } from "./dsm-version.js";
+import { assertContainerMinDsm, resolveMinDsm } from "./dsm-version.js";
 import { createReproducibleTar } from "./reproducible-archive.js";
 import { copyProjectNotices } from "./notices.js";
 import { renderDeleteAppDataBlock } from "./delete-app-data.js";
 import { renderUninstallWizardFiles } from "./uninstall-wizard.js";
 import { renderInstallWizardFiles } from "./install-wizard.js";
-import { contractPortal, PORTAL_JSON_RELPATH, PORTAL_MUSTACHE_RELPATH, renderPortalJson, renderPortalLifecycle, renderPortalMustache, renderPortalWizardStep } from "../portal/package.js";
 import { renderWizardFiles, writeWizardUiFiles } from "./wizard-i18n.js";
 import { sharedFolderCombobox } from "./share-combobox.js";
 import { writeUiTexts } from "./ui-texts.js";
@@ -70,8 +69,6 @@ export async function buildSpk(options) {
     }
     if (options.minDsm !== undefined) {
         assertContainerMinDsm(String(contract.os_min_ver));
-        if (contractPortal(contract))
-            assertPortalMinDsm(String(contract.os_min_ver));
     }
     const parsedCompose = loadCompose(options.project.composePath);
     const route = parsedCompose?.compose
@@ -126,7 +123,7 @@ export async function buildSpk(options) {
         mkdirSync(join(staging, "scripts"), { recursive: true });
         for (const name of SCRIPT_NAMES) {
             const scriptPath = join(staging, "scripts", name);
-            writeFileSync(scriptPath, withPortalLifecycle(name, contract, renderManagedScript(name, contract, isResourceWorkerRoute, rwEligibility?.adminport, isDynamicRoute, rwEligibility?.headless === true)), "utf8");
+            writeFileSync(scriptPath, renderManagedScript(name, contract, isResourceWorkerRoute, rwEligibility?.adminport, isDynamicRoute, rwEligibility?.headless === true), "utf8");
             chmodSync(scriptPath, SCRIPT_MODE);
         }
         mkdirSync(join(staging, "package"), { recursive: true });
@@ -185,14 +182,6 @@ export async function buildSpk(options) {
             writeDsmWindowIcons(uiDir, icons);
             writeUiTexts(uiDir, contractAppTitle(contract));
         }
-        const portal = contractPortal(contract);
-        if (portal) {
-            for (const [path, text] of [[PORTAL_JSON_RELPATH, renderPortalJson(portal)], [PORTAL_MUSTACHE_RELPATH, renderPortalMustache()]]) {
-                mkdirSync(dirname(join(staging, "package", path)), { recursive: true });
-                writeFileSync(join(staging, "package", path), text, "utf8");
-                chmodSync(join(staging, "package", path), FILE_MODE);
-            }
-        }
         if (gateway && gatewayBinary) {
             writeGatewayPayload(join(staging, "package"), gatewayBinary, gateway);
         }
@@ -615,11 +604,7 @@ function renderUpgradeWizard(t, contract, compose) {
         }];
 }
 function writeWizards(staging, contract, compose, kind) {
-    const portal = contractPortal(contract);
-    const install = renderInstallWizardFiles(String(contract.package), (t) => [
-        ...renderInstallWizard(t, contract, compose),
-        ...(portal ? [renderPortalWizardStep(t, portal.alias)] : []),
-    ]);
+    const install = renderInstallWizardFiles(String(contract.package), (t) => renderInstallWizard(t, contract, compose));
     writeWizardUiFiles(staging, {
         ...install.static,
         ...install.dynamic,
@@ -818,10 +803,6 @@ function renderDynamicCanonicalMirror(headless = false) {
 function shellQuote(value) {
     return "'" + value.replace(/'/g, "'\\''") + "'";
 }
-function withPortalLifecycle(name, contract, script) {
-    const portal = contractPortal(contract);
-    return portal ? script.replace("#!/bin/sh\n", () => `#!/bin/sh\n${renderPortalLifecycle(name, portal)}`) : script;
-}
 function renderManagedScript(name, contract, isResourceWorker = false, resourceWorkerAdminport, isDynamicRoute = false, isHeadlessRoute = false) {
     if (isResourceWorker) {
         if (name === "start-stop-status") {

package/dist/build-spk/resource-worker.js

@@ -1,4 +1,3 @@
-import { contractPortal, portalResource } from "../portal/package.js";
 import { collectUnpinnedImages } from "../compose/analyze.js";
 import { cookieStripHeaders, resolvedWebLaunch, usesAuthGateway, webStationAlias, webStationServiceName, } from "../contract/web-launch.js";
 export { classifyComposeRoute, resourceWorkerEligibility, } from "../compose/analyze.js";
@@ -79,8 +78,6 @@ export function renderResourceConfig(contract, eligibility, compose) {
             ...webResource,
         };
     }
-    if (contractPortal(contract))
-        combined = { ...combined, ...portalResource() };
     return `${JSON.stringify(combined, null, 2)}\n`;
 }
 /**

package/dist/build-spk/uninstall-wizard.d.ts

@@ -1,7 +1,12 @@
 /** The key DSM's built-in packages use for their "also remove my data" box. */
 export declare const REMOVE_ADDITIONAL_KEY = "pkgwizard_remove_additional";
 export type UninstallWizardKind = "native" | "container";
-/** `uninstall_uifile` (English) plus one `uninstall_uifile_<dsm language>` per locale. */
-export declare function renderUninstallWizardFiles(packageName: string, kind: UninstallWizardKind, options?: {
+interface UninstallWizardOptions {
+    /** The App runs the root executor (rootOps or delegate), which purges DSM's leftovers on uninstall. */
     executor?: boolean;
-}): Record<string, string>;
+    /** The App declares a Login Portal alias (web-config app-portal); only the executor tier can. */
+    portal?: boolean;
+}
+/** `uninstall_uifile` (English) plus one `uninstall_uifile_<dsm language>` per locale. */
+export declare function renderUninstallWizardFiles(packageName: string, kind: UninstallWizardKind, options?: UninstallWizardOptions): Record<string, string>;
+export {};

package/dist/build-spk/uninstall-wizard.js

@@ -4,7 +4,7 @@ export const REMOVE_ADDITIONAL_KEY = "pkgwizard_remove_additional";
 function list(items) {
     return `<ul class="synopkg-ul-list">${items.map((item) => `<li>${item}</li>`).join("")}</ul>`;
 }
-function renderUninstallWizard(t, packageName, kind, executor) {
+function renderUninstallWizard(t, packageName, kind, { executor = false, portal = false }) {
     const vars = { package: packageName };
     return [{
             step_title: t("uninstall.step"),
@@ -21,6 +21,8 @@ function renderUninstallWizard(t, packageName, kind, executor) {
                 { desc: t(kind === "container" ? "uninstall.keep.container" : "uninstall.keep.native") },
                 ...(kind === "native" ? [{ desc: t("uninstall.retained.native", vars) }] : []),
                 ...(executor ? [{ desc: t("uninstall.executor", vars) }] : []),
+                { desc: t(executor ? "uninstall.appPrivilege.auto" : "uninstall.appPrivilege", vars) },
+                ...(executor && portal ? [{ desc: t("uninstall.portal.auto", vars) }] : []),
                 { desc: t("uninstall.backup") },
                 {
                     type: "multiselect",
@@ -31,5 +33,5 @@ function renderUninstallWizard(t, packageName, kind, executor) {
 }
 /** `uninstall_uifile` (English) plus one `uninstall_uifile_<dsm language>` per locale. */
 export function renderUninstallWizardFiles(packageName, kind, options = {}) {
-    return renderWizardFiles("uninstall_uifile", (t) => renderUninstallWizard(t, packageName, kind, options.executor === true));
+    return renderWizardFiles("uninstall_uifile", (t) => renderUninstallWizard(t, packageName, kind, options));
 }

package/dist/build-spk/wizard-messages.d.ts

@@ -384,6 +384,39 @@ export declare const WIZARD_MESSAGES: {
         es: string;
         it: string;
     };
+    "uninstall.appPrivilege": {
+        en: string;
+        "zh-TW": string;
+        "zh-CN": string;
+        ja: string;
+        ko: string;
+        de: string;
+        fr: string;
+        es: string;
+        it: string;
+    };
+    "uninstall.appPrivilege.auto": {
+        en: string;
+        "zh-TW": string;
+        "zh-CN": string;
+        ja: string;
+        ko: string;
+        de: string;
+        fr: string;
+        es: string;
+        it: string;
+    };
+    "uninstall.portal.auto": {
+        en: string;
+        "zh-TW": string;
+        "zh-CN": string;
+        ja: string;
+        ko: string;
+        de: string;
+        fr: string;
+        es: string;
+        it: string;
+    };
     "uninstall.keep.native": {
         en: string;
         "zh-TW": string;

package/dist/build-spk/wizard-messages.js

@@ -384,6 +384,39 @@ export const WIZARD_MESSAGES = {
         "es": "La desinstalación elimina de forma asíncrona en segundo plano el runtime executor, el socket y las delegaciones. Borra las tareas «{package} executor boot» y «{package} executor control» tras verificar el nombre exacto, el propietario root y el resumen del script. El buzón purge de preuninst solicita la limpieza inmediatamente; esta se completa de forma asíncrona. El tiempo de espera agotado no bloquea la desinstalación. Como respaldo, el monitor pausa el servicio si falta el directorio del paquete o su identidad INFO y limpia solo tras 10 minutos de ausencia continua. Su reaparición reinicia el temporizador. Si el proceso no existe, la limpieza espera al próximo arranque. Las tareas modificadas o no verificables se conservan para revisión del administrador en Panel de control > Programador de tareas.",
         "it": "La disinstallazione elimina in modo asincrono in background runtime executor, socket e deleghe. Le attività “{package} executor boot” e “{package} executor control” vengono eliminate dopo aver verificato nome esatto, proprietario root e digest dello script. La mailbox purge di preuninst richiede subito la pulizia, che termina in modo asincrono. Un timeout non blocca la disinstallazione. Come riserva, il monitor sospende il servizio se mancano la directory del pacchetto o la sua identità INFO e pulisce solo dopo 10 minuti di assenza continua. La ricomparsa azzera il timer. Se il processo è assente, la pulizia attende il prossimo avvio. Le attività modificate o non verificabili restano da esaminare da un amministratore in Pannello di controllo > Utilità di pianificazione."
     },
+    "uninstall.appPrivilege": {
+        en: "DSM keeps the rules of {package} in Control Panel > Application Privileges after uninstall, and a later install under the same name applies them again. If the app will not be reinstalled, an administrator can remove its rules there.",
+        "zh-TW": "解除安裝後，DSM 會保留 {package} 在「控制台」>「應用程式權限」中的規則；之後以相同名稱安裝時會再次套用。若不再安裝此 App，管理員可在該處移除它的規則。",
+        "zh-CN": "卸载后，DSM 会保留 {package} 在“控制面板”>“应用程序权限”中的规则；之后以相同名称安装时会再次应用。如果不再安装此应用，管理员可在该处删除它的规则。",
+        ja: "アンインストール後も DSM は [コントロール パネル] > [アプリケーション権限] にある {package} のルールを保持し、同じ名前で再インストールすると再び適用します。再インストールしない場合は、管理者がそこでルールを削除できます。",
+        ko: "제거 후에도 DSM은 제어판 > 응용 프로그램 권한에 있는 {package}의 규칙을 유지하며, 같은 이름으로 다시 설치하면 다시 적용합니다. 다시 설치하지 않을 경우 관리자가 그곳에서 규칙을 삭제할 수 있습니다.",
+        de: "DSM behält die Regeln von {package} unter Systemsteuerung > Anwendungsberechtigungen nach der Deinstallation bei und wendet sie bei einer späteren Installation unter demselben Namen erneut an. Wird die App nicht erneut installiert, kann ein Administrator die Regeln dort entfernen.",
+        fr: "DSM conserve les règles de {package} dans Panneau de configuration > Privilèges d’application après la désinstallation et les applique de nouveau lors d’une installation ultérieure sous le même nom. Si l’application ne sera pas réinstallée, un administrateur peut y supprimer ses règles.",
+        es: "DSM conserva las reglas de {package} en Panel de control > Privilegios de aplicaciones tras la desinstalación y las aplica de nuevo en una instalación posterior con el mismo nombre. Si la aplicación no se va a reinstalar, un administrador puede eliminar allí sus reglas.",
+        it: "DSM mantiene le regole di {package} in Pannello di controllo > Privilegi applicazione dopo la disinstallazione e le applica di nuovo a una successiva installazione con lo stesso nome. Se l’applicazione non verrà reinstallata, un amministratore può rimuoverne le regole da lì.",
+    },
+    "uninstall.appPrivilege.auto": {
+        en: "Uninstall removes the rules of {package} in Control Panel > Application Privileges automatically, so a later install under the same name does not apply them again. Only if this cleanup failed, as the system log entry synopkgland-executor reports, an administrator can remove the rules there.",
+        "zh-TW": "解除安裝會自動移除 {package} 在「控制台」>「應用程式權限」中的規則，之後以相同名稱安裝時不會再次套用。只有在自動清除失敗時（系統日誌 synopkgland-executor 會記錄），管理員才需要在該處移除這些規則。",
+        "zh-CN": "卸载会自动删除 {package} 在“控制面板”>“应用程序权限”中的规则，之后以相同名称安装时不会再次应用。只有在自动清理失败时（系统日志 synopkgland-executor 会记录），管理员才需要在该处删除这些规则。",
+        ja: "アンインストール時に [コントロール パネル] > [アプリケーション権限] にある {package} のルールを自動的に削除するため、同じ名前で再インストールしても再び適用されません。この削除に失敗した場合 (システム ログの synopkgland-executor に記録されます) のみ、管理者がそこでルールを削除してください。",
+        ko: "제거 시 제어판 > 응용 프로그램 권한에 있는 {package}의 규칙을 자동으로 삭제하므로, 같은 이름으로 다시 설치해도 다시 적용되지 않습니다. 이 정리가 실패한 경우에만(시스템 로그 synopkgland-executor에 기록됨) 관리자가 그곳에서 규칙을 삭제하십시오.",
+        de: "Die Deinstallation entfernt die Regeln von {package} unter Systemsteuerung > Anwendungsberechtigungen automatisch, sodass eine spätere Installation unter demselben Namen sie nicht erneut anwendet. Nur wenn diese Bereinigung fehlschlägt, was der Systemprotokolleintrag synopkgland-executor meldet, muss ein Administrator die Regeln dort entfernen.",
+        fr: "La désinstallation supprime automatiquement les règles de {package} dans Panneau de configuration > Privilèges d’application, si bien qu’une installation ultérieure sous le même nom ne les applique pas de nouveau. Seulement si ce nettoyage échoue, ce que signale l’entrée synopkgland-executor du journal système, un administrateur doit y supprimer les règles.",
+        es: "La desinstalación elimina automáticamente las reglas de {package} en Panel de control > Privilegios de aplicaciones, de modo que una instalación posterior con el mismo nombre no las aplica de nuevo. Solo si esta limpieza falla, como indica la entrada synopkgland-executor del registro del sistema, un administrador debe eliminar allí las reglas.",
+        it: "La disinstallazione rimuove automaticamente le regole di {package} in Pannello di controllo > Privilegi applicazione, così una successiva installazione con lo stesso nome non le applica di nuovo. Solo se questa pulizia non riesce, come segnala la voce synopkgland-executor del registro di sistema, un amministratore deve rimuovere le regole da lì.",
+    },
+    "uninstall.portal.auto": {
+        en: "After DSM removes the Login Portal alias of {package}, uninstall reloads the web server automatically, so the alias stops at once. Only if this reload failed, as the system log entry synopkgland-executor reports, an administrator can save an application alias in Control Panel > Login Portal > Applications, which reloads the web server, or restart the NAS.",
+        "zh-TW": "DSM 移除 {package} 的登入入口別名後，解除安裝會自動重新載入網頁伺服器，讓該別名立即失效。只有在重新載入失敗時（系統日誌 synopkgland-executor 會記錄），管理員才需要在「控制台」>「登入入口」>「應用程式」儲存任一應用程式別名（會重新載入網頁伺服器），或重新啟動 NAS。",
+        "zh-CN": "DSM 删除 {package} 的登录门户别名后，卸载会自动重新加载网页服务器，使该别名立即失效。只有在重新加载失败时（系统日志 synopkgland-executor 会记录），管理员才需要在“控制面板”>“登录门户”>“应用程序”保存任一应用程序别名（会重新加载网页服务器），或重新启动 NAS。",
+        ja: "DSM が {package} のログイン ポータルのエイリアスを削除した後、アンインストール時に Web サーバーを自動的に再読み込みするため、エイリアスはすぐに無効になります。再読み込みに失敗した場合 (システム ログの synopkgland-executor に記録されます) のみ、管理者が [コントロール パネル] > [ログイン ポータル] > [アプリケーション] でいずれかのアプリケーションのエイリアスを保存する (Web サーバーが再読み込みされます) か、NAS を再起動してください。",
+        ko: "DSM이 {package}의 로그인 포털 별칭을 삭제한 후 제거 과정에서 웹 서버를 자동으로 다시 로드하므로 별칭이 즉시 중지됩니다. 다시 로드가 실패한 경우에만(시스템 로그 synopkgland-executor에 기록됨) 관리자가 제어판 > 로그인 포털 > 응용 프로그램에서 응용 프로그램 별칭을 저장하거나(웹 서버가 다시 로드됨) NAS를 다시 시작하십시오.",
+        de: "Nachdem DSM den Anmeldeportal-Alias von {package} entfernt hat, lädt die Deinstallation den Webserver automatisch neu, sodass der Alias sofort endet. Nur wenn dieses Neuladen fehlschlägt, was der Systemprotokolleintrag synopkgland-executor meldet, muss ein Administrator unter Systemsteuerung > Anmeldeportal > Anwendungen einen Anwendungsalias speichern, wodurch der Webserver neu geladen wird, oder das NAS neu starten.",
+        fr: "Après que DSM a supprimé l’alias du Portail de connexion de {package}, la désinstallation recharge automatiquement le serveur web, si bien que l’alias cesse immédiatement. Seulement si ce rechargement échoue, ce que signale l’entrée synopkgland-executor du journal système, un administrateur doit enregistrer un alias d’application dans Panneau de configuration > Portail de connexion > Applications, ce qui recharge le serveur web, ou redémarrer le NAS.",
+        es: "Después de que DSM elimine el alias del Portal de inicio de sesión de {package}, la desinstalación recarga automáticamente el servidor web, de modo que el alias deja de funcionar al instante. Solo si esta recarga falla, como indica la entrada synopkgland-executor del registro del sistema, un administrador debe guardar un alias de aplicación en Panel de control > Portal de inicio de sesión > Aplicaciones, lo que recarga el servidor web, o reiniciar el NAS.",
+        it: "Dopo che DSM ha rimosso l’alias del Portale di accesso di {package}, la disinstallazione ricarica automaticamente il server web, così l’alias smette subito di funzionare. Solo se questo ricaricamento non riesce, come segnala la voce synopkgland-executor del registro di sistema, un amministratore deve salvare un alias di applicazione in Pannello di controllo > Portale di accesso > Applicazioni, che ricarica il server web, oppure riavviare il NAS.",
+    },
     "uninstall.keep.native": {
         en: "Never deleted: Shared Folders, the package account, and other apps' data.",
         "zh-TW": "不會被刪除：共用資料夾（Shared Folder）、套件帳號，以及其他 App 的資料。",

package/dist/cli.js

@@ -5,7 +5,8 @@ import { basename, resolve, dirname, join } from "node:path";
 import { findProjectRoot } from "./discovery.js";
 import { loadContract } from "./contract/load.js";
 import { contractIconPath } from "./contract/icon.js";
-import { formatErrors } from "./errors.js";
+import { codedMessage, formatErrors } from "./errors.js";
+import { getErrorCode } from "./error-registry.js";
 import { formatInspectReport, inspectProject } from "./inspect.js";
 import { formatPinReport, pinProjectImages } from "./images/pin.js";
 import { initFromTemplate, isTemplateName, listTemplates } from "./init.js";
@@ -33,7 +34,7 @@ import { checkJobs, commitOutputs, forEachArch } from "./standalone/arch-jobs.js
 import { checkReproducible } from "./reproducible.js";
 import { inspectAnySpk } from "./spk/inspect.js";
 function failure(code, message, hint = "修正設定後重試；使用 --help 查看指令用法。") {
-    return Object.assign(new Error(`[${code}] ${message}`), { code, hint });
+    return Object.assign(new Error(codedMessage(code, message)), { code, hint });
 }
 function requireProject(cwd, project) {
     const found = findProjectRoot(project ? resolve(cwd, project) : cwd);
@@ -460,7 +461,7 @@ export async function runCli(argv) {
         .option("--json", "輸出單一 JSON 物件")
         .option("-o, --output <path>", "輸出 SPK，搭配單一 --arch")
         .option("--out-dir <dir>", "輸出目錄，原生專案預設 dist/")
-        .option("--arch <families>", `架構，可用逗號分隔：${NATIVE_ARCH_FAMILIES.join(",")}（armv7 用於 native-go 與 binary，不用於 Container Manager App）；native layout 另支援 armv8`)
+        .option("--arch <families>", `架構，可用逗號分隔或重複指定：${NATIVE_ARCH_FAMILIES.join(",")}（armv7 用於 native-go 與 binary，不用於 Container Manager App）；native layout 另支援 armv8`, (value, previous) => [...(previous ?? []), value])
         .option("--min-dsm <version>", "最低 DSM 版本，省略時使用 manifest 值")
         .option("--jobs <n>", "同時建置的架構數，預設 1（依序）", Number)
         .option("--verify-reproducible [when]", "從乾淨狀態再建置一次並比對；when：changed（預設，依賴指紋未變時略過）或 always")
@@ -476,12 +477,12 @@ export async function runCli(argv) {
                 options.arch === undefined
                     ? undefined
                     : standalone && isNativeLayout(standalone)
-                        ? String(options.arch).split(",").map((arch) => {
+                        ? options.arch.join(",").split(",").map((arch) => {
                             if (!Object.hasOwn(LAYOUT_ARCHES, arch))
                                 throw new Error(`Native layout arch must be one of ${Object.keys(LAYOUT_ARCHES).join(", ")}`);
                             return arch;
                         })
-                        : parseArchList(String(options.arch));
+                        : parseArchList(options.arch.join(","));
         }
         catch (error) {
             throw failure("CLI_ARCH_INVALID", error instanceof Error ? error.message : String(error));
@@ -531,7 +532,7 @@ export async function runCli(argv) {
                 ok: false,
                 code,
                 message,
-                hint: detail.hint ?? "修正設定後重試；使用 --help 查看指令用法。",
+                hint: detail.hint ?? getErrorCode(code)?.suggestion ?? "修正設定後重試；使用 --help 查看指令用法。",
                 ...(detail.report ? { data: detail.report } : {}),
             }));
         }

package/dist/contract/validate.js

@@ -4,13 +4,11 @@ import { contractSpan, makeError } from "../errors.js";
 import { collectInstallParameters, getValuePosition, stringViolations, } from "./load.js";
 import { validateContractSchema } from "./schema-validate.js";
 import { DSM_GROUP_NAME, isWebAccessMode, isWebLaunchMode, readWebIntegration } from "./web-launch.js";
-import { contractPortalSupported, readPortalDeclaration } from "../portal/alias.js";
 import { validateContractIcon } from "./icon.js";
 import { validateContractI18n } from "./i18n.js";
 import { loadCompose } from "../compose/analyze.js";
 import { collectPosixAllSharesParameters, isPosixAllSharesType, validatePosixAllSharesSources, } from "./posix-all-shares.js";
 import { getErrorCode } from "../error-registry.js";
-import { isDsmAtLeast, PORTAL_MIN_DSM, portalMinDsmMessage } from "../build-spk/dsm-version.js";
 import { FORMAL_PACKAGE_IDENTITY_MAX_LENGTH, PACKAGE_IDENTITY_MAX_LENGTH, } from "../deploy/identity-shared.js";
 /** DSM 7.4 Package Center rejects a longer package identity outright. */
 const DSM_PACKAGE_IDENTITY_MAX = 32;
@@ -133,26 +131,11 @@ function validateWebPortal(parsed, contractFile) {
         return [];
     }
     const pos = getValuePosition(doc, ["integration", "web", "portal"]) ?? { line: 1, column: 1 };
-    const at = contractSpan(contractFile, pos.line, pos.column, "integration.web.portal");
-    if (!contractPortalSupported(contract)) {
-        return [
-            makeError("CONTRACT_PORTAL_UNSUPPORTED", at, "Application Portal 只支援以 DSM 視窗開啟、經 DSM 登入閘道的網頁 App。", "請使用 adminport、launch: dsm-window 與非 public 的 access，或移除 integration.web.portal。public App 已有同名的 Web Station 網址。"),
-        ];
-    }
-    if (!readPortalDeclaration(portal, String(contract.package ?? ""))) {
-        return [
-            makeError("CONTRACT_PORTAL_INVALID", at, "integration.web.portal 必須是 {} 或 { alias }，alias 為 1–64 個小寫英數字或 -，且不是 DSM 保留路徑。", "請省略 alias 以使用套件名稱，或改成例如 alias: my-app。"),
-        ];
-    }
-    const osMinVer = contract.os_min_ver;
-    if (typeof osMinVer === "string" && FULL_OS_MIN_VER.test(osMinVer) && !isDsmAtLeast(osMinVer, PORTAL_MIN_DSM)) {
-        return [
-            makeError("CONTRACT_PORTAL_MIN_DSM", at, portalMinDsmMessage(osMinVer, "integration.web.portal"), `請把 os_min_ver 改成 "${PORTAL_MIN_DSM}" 或更新，或移除 integration.web.portal。`),
-        ];
-    }
-    return [];
+    // A Compose App has no root executor, and only its purge can stop nginx serving the alias after uninstall.
+    return [
+        makeError("CONTRACT_PORTAL_REQUIRES_EXECUTOR", contractSpan(contractFile, pos.line, pos.column, "integration.web.portal"), "Compose App 沒有 executor，不能宣告 Application Portal：解除安裝後 DSM 不會 reload nginx，別名要 root 才能清除。", "請移除 integration.web.portal；需要登入入口別名時，由管理員在 DSM 手動設定反向代理。"),
+    ];
 }
-const FULL_OS_MIN_VER = /^7\.\d+(\.\d+)?-\d+$/;
 function validateDeveloperString(value, contractFile, path, pos) {
     const errors = [];
     const violations = stringViolations(value);