@synopackageland/cli 0.9.0 → 0.9.2

package/dist/error-registry.js

@@ -59,15 +59,10 @@ export const ERROR_REGISTRY = {
         "description": "Headless App 不需要宣告 Web Launch Mode。",
         "suggestion": "請省略 integration.web.launch，或補上對應 Compose published port 的 adminport。"
     },
-    "CONTRACT_PORTAL_INVALID": {
-        "code": "CONTRACT_PORTAL_INVALID",
-        "description": "integration.web.portal 的格式或 alias 不正確。",
-        "suggestion": "請使用 {} 或 { alias: my-app }；alias 為 1–64 個小寫英數字或 -，且不是 DSM 保留路徑。"
-    },
-    "CONTRACT_PORTAL_UNSUPPORTED": {
-        "code": "CONTRACT_PORTAL_UNSUPPORTED",
-        "description": "這個 App 的網頁入口無法加入 DSM Application Portal。",
-        "suggestion": "Application Portal 需要 adminport、launch: dsm-window 與非 public 的 access；否則請移除 integration.web.portal。"
+    "CONTRACT_PORTAL_REQUIRES_EXECUTOR": {
+        "code": "CONTRACT_PORTAL_REQUIRES_EXECUTOR",
+        "description": "Compose App 宣告了 integration.web.portal；Compose App 沒有 executor，登入入口別名在解除安裝後要 root 才能讓 nginx 停止提供。",
+        "suggestion": "請移除 integration.web.portal；需要登入入口別名時，由管理員在 DSM 手動設定反向代理。"
     },
     "CONTRACT_ACCESS_INVALID": {
         "code": "CONTRACT_ACCESS_INVALID",
@@ -594,6 +589,11 @@ export const ERROR_REGISTRY = {
         "description": "dsm-package.yaml 的 portal 格式或 alias 不正確。",
         "suggestion": "請使用 portal: {} 或 portal: { alias: my-app }；alias 為 1–64 個小寫英數字或 -，且不是 DSM 保留路徑。"
     },
+    "STANDALONE_PORTAL_REQUIRES_EXECUTOR": {
+        "code": "STANDALONE_PORTAL_REQUIRES_EXECUTOR",
+        "description": "沒有 executor（capabilities.rootOps 或 delegate）的 App 宣告了 portal。",
+        "suggestion": "登入入口別名在解除安裝後要 root 才能讓 nginx 停止提供，而無升權 App 任何階段都不使用 root。請加 capabilities.rootOps 或 delegate（executor 層級），或移除 portal，改由管理員在 DSM 手動設定反向代理。"
+    },
     "STANDALONE_I18N_INVALID": {
         "code": "STANDALONE_I18N_INVALID",
         "description": "dsm-package.yaml 的 i18n 設定不合法。",
@@ -649,8 +649,7 @@ for (const [code, description, suggestion] of [
     ERROR_REGISTRY[code] = { code, description, suggestion };
 ERROR_REGISTRY["ADD_LAYOUT_UNSUPPORTED"] = { "code": "ADD_LAYOUT_UNSUPPORTED", "description": "SDK overlay 需要標準 backend 目錄。", "suggestion": "使用 backend.dir: backend，或手動合併 SDK overlay。" };
 ERROR_REGISTRY["MIN_DSM_CONTAINER_FLOOR"] = { "code": "MIN_DSM_CONTAINER_FLOOR", "description": "Compose 最低 DSM 版本過低。", "suggestion": "Compose 需要 DSM 7.2.1-69057 或以上。" };
-for (const code of ["STANDALONE_PORTAL_MIN_DSM", "CONTRACT_PORTAL_MIN_DSM"])
-    ERROR_REGISTRY[code] = { code, "description": "宣告 portal 的套件 os_min_ver 低於 DSM 7.3.2-86009。", "suggestion": "DSM 7.1.1 以 320 拒裝帶 portal 的未簽章套件、7.2 未驗證；把 os_min_ver 提高到 7.3.2-86009 以上，或移除 portal。" };
+ERROR_REGISTRY.STANDALONE_PORTAL_MIN_DSM = { "code": "STANDALONE_PORTAL_MIN_DSM", "description": "宣告 portal 的套件 os_min_ver 低於 DSM 7.3.2-86009。", "suggestion": "DSM 7.1.1 以 320 拒裝帶 portal 的未簽章套件、7.2 未驗證；把 os_min_ver 提高到 7.3.2-86009 以上，或移除 portal。" };
 ERROR_REGISTRY["MIN_DSM_INVALID"] = { "code": "MIN_DSM_INVALID", "description": "最低 DSM 版本格式不合法。", "suggestion": "指定 7.x release 或完整 7.x-build。" };
 ERROR_REGISTRY["NOTICE_UNSAFE"] = { "code": "NOTICE_UNSAFE", "description": "授權檔案不符合一般檔案限制。", "suggestion": "移除 symlink、特殊檔與超大授權檔案。" };
 ERROR_REGISTRY["NOTICE_MISSING"] = { "code": "NOTICE_MISSING", "description": "缺少第三方授權資訊。", "suggestion": "重新安裝模板依賴並產生 third-party notices。" };
@@ -714,7 +713,7 @@ for (const [code, description, suggestion] of [
     ERROR_REGISTRY[code] = { code, description, suggestion };
 ERROR_REGISTRY["STANDALONE_ENTRY_INVALID"] = { "code": "STANDALONE_ENTRY_INVALID", "description": "entry 設定不合法。", "suggestion": "entry 填 admin-only 或 app-privilege；app-privilege 需要至少一個 authenticated route。" };
 ERROR_REGISTRY["STANDALONE_ENTRY_WIDENED"] = { "code": "STANDALONE_ENTRY_WIDENED", "description": "entry: admin-only 與放寬權限的 route 設定衝突。", "suggestion": "把 permissions.json 中 authenticated 或 public 的 route 改為 administrators；要開放給一般使用者請改用 entry: app-privilege 或省略 entry。" };
-ERROR_REGISTRY["STANDALONE_ENTRY_UNSUPPORTED"] = { "code": "STANDALONE_ENTRY_UNSUPPORTED", "description": "backend 無法強制 entry 模式。", "suggestion": "使用 Go backend：backend/go.mod require github.com/synopackageland/syno-pkg-land-sdk，並在 cmd/app/main.go 以 dsm.NewEntryGate 包住 authenticator。" };
+ERROR_REGISTRY["STANDALONE_ENTRY_UNSUPPORTED"] = { "code": "STANDALONE_ENTRY_UNSUPPORTED", "description": "backend 無法強制 entry 模式。", "suggestion": "使用 Go backend：backend/go.mod require github.com/synopackageland/syno-pkg-land-sdk，並在 backend.main 的 main.go（init 預設為 cmd/app/main.go）以 dsm.NewEntryGate 包住 authenticator。" };
 ERROR_REGISTRY["DSM_TLS_UNTRUSTED"] = { "code": "DSM_TLS_UNTRUSTED", "description": "DSM 的 TLS 憑證不受這台電腦信任（自簽、過期或名稱不符）。", "suggestion": "把 NAS 憑證或其 CA 匯出成 PEM，用 NODE_EXTRA_CA_CERTS=<該檔> 執行；或讓 DSM 使用與 host profile 名稱相符的受信任憑證。不要關閉憑證驗證。" };
 ERROR_REGISTRY["STANDALONE_ICON_INVALID"] = { "code": "STANDALONE_ICON_INVALID", "description": "dsm-package.yaml 的 icon 不是可用的套件圖示。", "suggestion": "icon 填專案內的正方形 PNG（至少 256×256），或含 icon_256.png 的 icon_<size>.png 目錄；省略則使用 SDK 預設圖示。" };
 ERROR_REGISTRY["CONTRACT_ICON_INVALID"] = { "code": "CONTRACT_ICON_INVALID", "description": "synology-app.yaml 的 icon 不是可用的套件圖示。", "suggestion": "icon 填專案內的正方形 PNG（至少 256×256），或含 icon_256.png 的 icon_<size>.png 目錄；省略則使用 SDK 預設圖示。" };

package/dist/errors.d.ts

@@ -3,4 +3,6 @@ export declare function makeError(code: string, span: SourceSpan, message: strin
 export declare function contractSpan(file: string, line: number, column: number, path?: string): SourceSpan;
 export declare function composeSpan(file: string, line: number, column: number, path?: string): SourceSpan;
 export declare function formatError(error: ValidationError): string;
+/** The message of an error thrown with a code: the code in brackets, then the message; the code only once. */
+export declare function codedMessage(code: string, message: string): string;
 export declare function formatErrors(errors: ValidationError[]): string;

package/dist/errors.js

@@ -13,6 +13,11 @@ export function formatError(error) {
         : `${error.span.file}:${error.span.line}:${error.span.column}`;
     return `[${error.code}] ${location}\n${error.message}\n建議：${error.suggestion}`;
 }
+/** The message of an error thrown with a code: the code in brackets, then the message; the code only once. */
+export function codedMessage(code, message) {
+    const prefix = `[${code}] `;
+    return message.startsWith(prefix) ? message : prefix + message;
+}
 export function formatErrors(errors) {
     return errors.map(formatError).join("\n\n");
 }

package/dist/host/dsm-client.js

@@ -92,6 +92,43 @@ function createDsmNasHost(credentials, profileName) {
         if (!cookieHeader)
             throw new Error("DSM login returned no session cookie");
     };
+    /**
+     * One read-only call of the App's own CGI as the administrator. identity:
+     * standalone wraps business methods in an App session: trade the DSM cookie
+     * for one (same Origin), read once, then end that session. Undefined when
+     * the App refuses; `error` when no App session could be opened.
+     */
+    const readApp = async (packageIdentity, method) => {
+        await ensureLogin();
+        const appCall = async (name, cookie) => {
+            const response = await dsmFetch(`${dsmOrigin}/webman/3rdparty/${encodeURIComponent(packageIdentity)}/cgi/api.cgi`, {
+                method: "POST", headers: { cookie, origin: dsmOrigin, "content-type": "application/json" },
+                body: JSON.stringify({ method: name, params: name === "identity.session" ? { bootstrap: true } : {} }),
+            });
+            const body = await response.json();
+            return { body, setCookie: setCookiePairs(response.headers) };
+        };
+        const direct = await appCall(method, cookieHeader ?? "");
+        if (direct.body.success)
+            return { data: direct.body.data };
+        if (direct.body.error?.code !== "session_required")
+            return undefined;
+        const session = await appCall("identity.session", cookieHeader ?? "");
+        if (!session.body.success) {
+            const code = session.body.error?.code;
+            return { error: code === "https_required"
+                    ? "identity: standalone status needs an https:// DSM host profile to open an App session."
+                    : `identity: standalone App session bootstrap failed (${code ?? "error"}).` };
+        }
+        const appCookie = [cookieHeader ?? "", ...session.setCookie].filter(Boolean).join("; ");
+        try {
+            const status = await appCall(method, appCookie);
+            return status.body.success ? { data: status.body.data } : undefined;
+        }
+        finally {
+            await appCall("identity.logout", appCookie).catch(() => undefined);
+        }
+    };
     return {
         dsmOrigin,
         async installFromLocalSpk(input) {
@@ -108,39 +145,23 @@ function createDsmNasHost(credentials, profileName) {
         },
         async getExecutorStatus(packageIdentity) {
             try {
-                await ensureLogin();
-                const appCall = async (method, cookie) => {
-                    const response = await dsmFetch(`${dsmOrigin}/webman/3rdparty/${encodeURIComponent(packageIdentity)}/cgi/api.cgi`, {
-                        method: "POST", headers: { cookie, origin: dsmOrigin, "content-type": "application/json" },
-                        body: JSON.stringify({ method, params: method === "identity.session" ? { bootstrap: true } : {} }),
-                    });
-                    const body = await response.json();
-                    return { body, setCookie: setCookiePairs(response.headers) };
-                };
                 // A paused executor answers with why and what to do next.
                 const explain = (status) => status.state === "paused" ? { ...status, error: `Executor paused (${status.reason}). ${status.next}` } : status;
-                const direct = await appCall("executor.status", cookieHeader ?? "");
-                if (direct.body.success)
-                    return explain(direct.body.data);
-                // identity: standalone wraps business methods in an App session; trade the
-                // administrator's DSM cookie for one, read once, then end that session.
-                if (direct.body.error?.code !== "session_required")
+                const read = await readApp(packageIdentity, "executor.status");
+                if (!read)
                     return undefined;
-                const session = await appCall("identity.session", cookieHeader ?? "");
-                if (!session.body.success) {
-                    const code = session.body.error?.code;
-                    return { ready: false, executor_digest: "", policy_digest: "", error: code === "https_required"
-                            ? "identity: standalone status needs an https:// DSM host profile to open an App session."
-                            : `identity: standalone App session bootstrap failed (${code ?? "error"}).` };
-                }
-                const appCookie = [cookieHeader ?? "", ...session.setCookie].filter(Boolean).join("; ");
-                try {
-                    const status = await appCall("executor.status", appCookie);
-                    return status.body.success ? explain(status.body.data) : undefined;
-                }
-                finally {
-                    await appCall("identity.logout", appCookie).catch(() => undefined);
-                }
+                if ("error" in read)
+                    return { ready: false, executor_digest: "", policy_digest: "", error: read.error };
+                return explain(read.data);
+            }
+            catch {
+                return undefined;
+            }
+        },
+        async getPortalStatus(packageIdentity) {
+            try {
+                const read = await readApp(packageIdentity, "portal.status");
+                return read && "data" in read ? read.data : undefined;
             }
             catch {
                 return undefined;

package/dist/host/types.d.ts

@@ -35,6 +35,11 @@ export interface NasHost {
         policy_digest: string;
         error?: string;
     } | undefined>;
+    /** The App's `portal.status`: whether an administrator set its Application Portal alias. */
+    getPortalStatus?(packageIdentity: string): Promise<{
+        state: string;
+        alias?: string;
+    } | undefined>;
     getArchFamily?(): Promise<NativeArchFamily | undefined>;
     /** List the current logical Shared Folder names using an administrator session. */
     listShareNames?(): Promise<string[]>;

package/dist/images/pin.js

@@ -9,7 +9,6 @@ import { isScalar, parseDocument } from "yaml";
  * (Docker Hub and ghcr both issue an anonymous Bearer token for public repos).
  */
 const DIGEST_VALUE = /^sha256:[0-9a-f]{64}$/i;
-const DIGEST_AT_END = /@sha256:([0-9a-f]{64})$/i;
 /** A registry returns the index (manifest list) digest when we ask for it. */
 const MANIFEST_ACCEPT = [
     "application/vnd.oci.image.index.v1+json",

package/dist/info.js

@@ -161,13 +161,26 @@ export async function standaloneInfo(options) {
                 reason: "Installed package supports this capability without administrator approval.",
             });
     }
+    if (m.portal)
+        capabilities.push(installed ? await portalCapability(m.package, m.portal.alias, options.host) : {
+            name: "portal", state: "blocked", reason: "Package is not installed; deploy first.",
+        });
     return {
         ...state,
         capabilities,
         ...(executor ? { executor } : {}),
-        uninstallCleanup: uninstallCleanup(m.package, Boolean(m.capabilities.rootOps || m.capabilities.delegate)),
+        uninstallCleanup: uninstallCleanup(m.package, { executor: Boolean(m.capabilities.rootOps || m.capabilities.delegate), portal: Boolean(m.portal) }),
     };
 }
+/** What the installed App's portal.status says; DSM owns the alias, an administrator sets it. */
+async function portalCapability(pkg, defaultAlias, host) {
+    const status = await host.getPortalStatus?.(pkg);
+    if (status?.state === "active" && status.alias)
+        return { name: "portal", state: "ready", reason: `Users open the App at ${host.dsmOrigin.replace(/\/$/, "")}/${encodeURIComponent(status.alias)}/ after DSM sign-in.` };
+    if (status?.state === "inactive")
+        return { name: "portal", state: "needs-admin-approval", reason: `No alias is set; an administrator applies one (default ${defaultAlias}) in the App's Application Portal panel.` };
+    return { name: "portal", state: "blocked", reason: "The App's portal.status could not be read; open the App window to check the Application Portal." };
+}
 /** A native layout has no SDK capabilities; report package state only. */
 async function nativeLayoutInfo(root, host) {
     const loaded = loadNativeLayout(root);

package/dist/init.js

@@ -119,7 +119,7 @@ export function initFromTemplate(template, targetDir, options = {}) {
     const shared = join(templatesRoot(), "_shared");
     const sharedFiles = ["LICENSES/TEMPLATE.txt", "AGENTS.md", "CLAUDE.md"];
     const files = [...templateFiles(source), ...sharedFiles, ...overlays.flatMap(root => templateFiles(root)),
-        ...(ui === "vue" ? ["frontend/third-party-notices.mjs"] : [])];
+        ...capability.borrowed.map(borrowedTarget), ...(ui === "vue" ? ["frontend/third-party-notices.mjs"] : [])];
     const collisions = files.map(targetName).filter((file) => existsSync(join(targetDir, file)));
     if (collisions.length > 0) {
         throw new Error(`[INIT_TARGET_NOT_EMPTY] ${targetDir} 已有 ${collisions.join(", ")}；init 不會覆蓋既有檔案。請改用空目錄。`);
@@ -257,7 +257,6 @@ function substitute(path, substitutions) {
         writeFileSync(path, text);
 }
 function substitutionsFor(template, targetDir, options) {
-    const ui = resolvedUi(template, options);
     const caps = capabilityNames(options.with ?? []);
     if (options.ui !== undefined && template !== "native-go")
         throw new Error("[INIT_OPTIONS_UNSUPPORTED] --ui 只適用於 native-go。");

package/dist/portal/alias.d.ts

@@ -1,4 +1,3 @@
-import type { AppContract } from "../types.js";
 /**
  * DSM Application Portal alias: `https://<nas>/<alias>/` opens the App after
  * DSM sign-in. DSM itself only refuses empty aliases (4100), synoman
@@ -12,6 +11,12 @@ export declare const PORTAL_ALIAS_MAX = 64;
  * of Synology Apps, as observed on DSM 7.4-90069. DSM stays the authority.
  */
 export declare const RESERVED_PORTAL_ALIASES: readonly string[];
+/**
+ * A portal needs the executor tier: DSM removes the alias files on uninstall
+ * but leaves nginx serving the alias, and only the root executor purge can
+ * reload it. A no-privilege App never runs anything as root.
+ */
+export declare const PORTAL_REQUIRES_EXECUTOR = "portal \u9700\u8981 executor \u5C64\u7D1A\uFF08capabilities.rootOps \u6216 delegate\uFF09\uFF1A\u89E3\u9664\u5B89\u88DD\u5F8C DSM \u4E0D\u6703 reload nginx\uFF0C\u767B\u5165\u5165\u53E3\u5225\u540D\u8981\u7531 root executor \u6E05\u9664\u3002\u6C92\u6709 executor \u7684 App \u8ACB\u79FB\u9664 portal\uFF0C\u6539\u7531\u7BA1\u7406\u54E1\u5728 DSM \u624B\u52D5\u8A2D\u5B9A\u53CD\u5411\u4EE3\u7406\u3002";
 export interface PortalDeclaration {
     alias: string;
 }
@@ -20,6 +25,3 @@ export declare function isPortalAlias(value: unknown): value is string;
 export declare function defaultPortalAlias(packageId: string): string;
 /** `{}` or `{alias}`; undefined for any other shape. */
 export declare function readPortalDeclaration(value: unknown, packageId: string): PortalDeclaration | undefined;
-/** A Compose App reaches the portal only as a DSM window behind the DSM-authenticated gateway. */
-export declare function contractPortalSupported(contract: AppContract): boolean;
-export declare function resolvedContractPortal(contract: AppContract): PortalDeclaration | undefined;

package/dist/portal/alias.js

@@ -1,5 +1,4 @@
 import { createHash } from "node:crypto";
-import { readWebIntegration, resolvedWebLaunch, usesAuthGateway } from "../contract/web-launch.js";
 /**
  * DSM Application Portal alias: `https://<nas>/<alias>/` opens the App after
  * DSM sign-in. DSM itself only refuses empty aliases (4100), synoman
@@ -16,6 +15,12 @@ export const RESERVED_PORTAL_ALIASES = [
     "dsfile", "indexdb", "mobile", "oauth", "scripts", "sharing", "ssdp", "synosdsjslib", "synohdpack", "webapi", "webman",
     "calendar", "chatplus", "contacts", "drive", "file", "photo", "sso", "synologymeet",
 ];
+/**
+ * A portal needs the executor tier: DSM removes the alias files on uninstall
+ * but leaves nginx serving the alias, and only the root executor purge can
+ * reload it. A no-privilege App never runs anything as root.
+ */
+export const PORTAL_REQUIRES_EXECUTOR = "portal 需要 executor 層級（capabilities.rootOps 或 delegate）：解除安裝後 DSM 不會 reload nginx，登入入口別名要由 root executor 清除。沒有 executor 的 App 請移除 portal，改由管理員在 DSM 手動設定反向代理。";
 export function isPortalAlias(value) {
     return typeof value === "string" && PORTAL_ALIAS_PATTERN.test(value) && !RESERVED_PORTAL_ALIASES.includes(value);
 }
@@ -36,13 +41,3 @@ export function readPortalDeclaration(value, packageId) {
         return { alias: defaultPortalAlias(packageId) };
     return isPortalAlias(alias) ? { alias } : undefined;
 }
-/** A Compose App reaches the portal only as a DSM window behind the DSM-authenticated gateway. */
-export function contractPortalSupported(contract) {
-    return resolvedWebLaunch(contract) === "dsm-window" && usesAuthGateway(contract);
-}
-export function resolvedContractPortal(contract) {
-    const portal = readWebIntegration(contract)?.portal;
-    if (portal === undefined || !contractPortalSupported(contract))
-        return undefined;
-    return readPortalDeclaration(portal, String(contract.package ?? ""));
-}

package/dist/portal/package.d.ts

@@ -1,6 +1,5 @@
 import type { Translate } from "../build-spk/wizard-i18n.js";
 import type { InstallWizardStep } from "../build-spk/install-wizard.js";
-import type { AppContract } from "../types.js";
 /** Package payload paths DSM's app-portal worker copies to /usr/syno/etc/www/app.d at start. */
 export declare const PORTAL_JSON_RELPATH = "etc/portal.json";
 export declare const PORTAL_MUSTACHE_RELPATH = "etc/portal.mustache";
@@ -16,8 +15,6 @@ export interface PortalPackage {
     /** Default alias; the wizard answer replaces it. */
     alias: string;
 }
-/** A Compose portal opens the App's `.url` entry of ui/config, keyed by the package id. */
-export declare function contractPortal(contract: AppContract): PortalPackage | undefined;
 export declare function portalResource(): Record<string, unknown>;
 /** Every field of DSM's own app.d files; the worker refuses a partial file (synopkg start 272). */
 export declare function renderPortalJson(portal: PortalPackage): string;

package/dist/portal/package.js

@@ -1,4 +1,4 @@
-import { PORTAL_ALIAS_MAX, PORTAL_ALIAS_PATTERN, RESERVED_PORTAL_ALIASES, resolvedContractPortal } from "./alias.js";
+import { PORTAL_ALIAS_MAX, PORTAL_ALIAS_PATTERN, RESERVED_PORTAL_ALIASES } from "./alias.js";
 /** Package payload paths DSM's app-portal worker copies to /usr/syno/etc/www/app.d at start. */
 export const PORTAL_JSON_RELPATH = "etc/portal.json";
 export const PORTAL_MUSTACHE_RELPATH = "etc/portal.mustache";
@@ -6,12 +6,6 @@ export const PORTAL_MUSTACHE_RELPATH = "etc/portal.mustache";
 export const PORTAL_INSTALL_KEY = "portal_alias";
 /** Package-owned install draft, never DSM's saved portal configuration. */
 export const PORTAL_DRAFT = "portal-install.json";
-/** A Compose portal opens the App's `.url` entry of ui/config, keyed by the package id. */
-export function contractPortal(contract) {
-    const portal = resolvedContractPortal(contract);
-    const packageId = String(contract.package);
-    return portal && { appId: packageId, application: String(contract.displayname ?? packageId), alias: portal.alias };
-}
 export function portalResource() {
     return { "web-config": { "app-portal": { "json-relpath": PORTAL_JSON_RELPATH, "mustache-relpath": PORTAL_MUSTACHE_RELPATH } } };
 }

package/dist/runtime/executor-digests.json

@@ -9,5 +9,38 @@
             "armv7": "b65a14f0fc77a1d3221c7dc6781eb66059aa200956b094d58a62bd1cad10f116"
         },
         "goToolchain": "go1.26.9"
+    },
+    "0.9.1": {
+        "x86_64": "5d75af3ce1de5b1d3ef5d89e062be1651a8e8b84edbca9903eb1a0b81d122fb5",
+        "aarch64": "b0e1f8174bf53eb435616ae0faf39ac929b515056f0b2fad5a6c264a1ff7f6e2",
+        "armv7": "17db613a4bdb181e0aa0f127822bfc13d7473fa846aadfbac3344b7c17700a84",
+        "lifecycle": {
+            "x86_64": "819459580135e016184ad80c258350d57194d6134e8aa4cf1caf5237085b1004",
+            "aarch64": "5abcfc21403e84a0af15d972bcb819ac6fedfd9aaf5898ddc8c4bb06130f9f59",
+            "armv7": "b65a14f0fc77a1d3221c7dc6781eb66059aa200956b094d58a62bd1cad10f116"
+        },
+        "goToolchain": "go1.26.9"
+    },
+    "0.9.2": {
+        "x86_64": "89c26f18ef05b601963341da6cce43f588bdf2a74039feaf3dfcffdd1295207f",
+        "aarch64": "6616953ac1721da64a134898ed1bec93d8e5a81fc044f8bc822751df1a871bdd",
+        "armv7": "d9c62b601454b8806a6eeef18a503385b508a8a3b947afa9b433a092979cc6da",
+        "lifecycle": {
+            "x86_64": "819459580135e016184ad80c258350d57194d6134e8aa4cf1caf5237085b1004",
+            "aarch64": "5abcfc21403e84a0af15d972bcb819ac6fedfd9aaf5898ddc8c4bb06130f9f59",
+            "armv7": "b65a14f0fc77a1d3221c7dc6781eb66059aa200956b094d58a62bd1cad10f116"
+        },
+        "goToolchain": "go1.26.9"
+    },
+    "0.9.3": {
+        "x86_64": "89c26f18ef05b601963341da6cce43f588bdf2a74039feaf3dfcffdd1295207f",
+        "aarch64": "6616953ac1721da64a134898ed1bec93d8e5a81fc044f8bc822751df1a871bdd",
+        "armv7": "d9c62b601454b8806a6eeef18a503385b508a8a3b947afa9b433a092979cc6da",
+        "lifecycle": {
+            "x86_64": "819459580135e016184ad80c258350d57194d6134e8aa4cf1caf5237085b1004",
+            "aarch64": "5abcfc21403e84a0af15d972bcb819ac6fedfd9aaf5898ddc8c4bb06130f9f59",
+            "armv7": "b65a14f0fc77a1d3221c7dc6781eb66059aa200956b094d58a62bd1cad10f116"
+        },
+        "goToolchain": "go1.26.9"
     }
 }

package/dist/runtime/uninstall-cleanup.d.ts

@@ -4,4 +4,10 @@ export interface UninstallCleanupItem {
     condition: string;
     action: string;
 }
-export declare function uninstallCleanup(pkg: string, executor: boolean): UninstallCleanupItem[];
+export interface UninstallCleanupOptions {
+    /** The App runs the root executor, which purges DSM's leftovers on uninstall. */
+    executor?: boolean;
+    /** The App declares a Login Portal alias; only the executor tier can. */
+    portal?: boolean;
+}
+export declare function uninstallCleanup(pkg: string, { executor, portal }?: UninstallCleanupOptions): UninstallCleanupItem[];

package/dist/runtime/uninstall-cleanup.js

@@ -1,7 +1,13 @@
-export function uninstallCleanup(pkg, executor) {
+const AUTOMATIC_FAILED = 'Only if automatic cleanup failed after uninstall; see the system log entry synopkgland-executor.';
+export function uninstallCleanup(pkg, { executor = false, portal = false } = {}) {
     const items = [
         { target: `@appdata/${pkg}, @appconf/${pkg}, @apphome/${pkg}`, condition: 'After uninstall, if retained data or empty DSM directories are no longer needed.', action: 'Back up retained data; an administrator may remove only these package-specific directories. The delete-data checkbox empties their contents and preserves DSM directory roots.' },
         { target: `@appshare/${pkg}, /usr/syno/etc/packages/${pkg}`, condition: 'After uninstall, if DSM leaves package infrastructure or a package-config symlink.', action: 'Administrator: inspect these package-specific paths and remove unused infrastructure; do not follow the symlink to delete shared data.' },
+        // Package scripts run as the package account; only the root executor can edit these DSM files.
+        executor
+            ? { target: `SYNO.SDS.${pkg}.Instance rules in Application Privileges`, condition: AUTOMATIC_FAILED, action: 'The root executor removes these rules automatically through the Application Privileges API on uninstall. Administrator: remove surviving rules in Control Panel > Application Privileges; DSM would apply them again to a later install under the same name.' }
+            : { target: `SYNO.SDS.${pkg}.Instance rules in Application Privileges`, condition: 'After uninstall, if this package will not be reinstalled.', action: 'DSM keeps these rules in /etc/synoappprivilege.db and applies them again to a later install under the same name. Administrator: remove them in Control Panel > Application Privileges.' },
+        ...(executor && portal ? [{ target: `${pkg} Login Portal alias`, condition: AUTOMATIC_FAILED, action: 'DSM removes the alias configuration without reloading its web server; the root executor then reloads the web server automatically. Administrator: if the alias still opens a DSM page, save an application alias in Control Panel > Login Portal > Applications to reload it, or restart the NAS.' }] : []),
         { target: `${pkg} package account/group`, condition: 'After uninstall, only if this package will not be reinstalled and the identity is unused.', action: 'Administrator: review DSM internal account/group and associated ACLs before cleanup. Package scripts do not delete system identities.' },
     ];
     if (executor)

package/dist/standalone/dsm-window.js

@@ -1,6 +1,6 @@
 import { REOPEN_EVENTS_RUNTIME } from "./reopen-events.js";
 import { DSM_LANGS } from "./i18n.js";
-import { PASSWORD_CONFIRM, ROOT_PANEL, ROOT_RUNTIME } from "./root-window.js";
+import { PASSWORD_CONFIRM, ROOT_PANEL, ROOT_RUNTIME, rootPanelCatalogs } from "./root-window.js";
 import { HOST_ADAPTER_RUNTIME } from "./host-adapter.js";
 import { permitsOrdinaryUsers } from "./api-permissions.js";
 import { PORTAL_RUNTIME } from "./portal-window.js";
@@ -297,21 +297,18 @@ ${ns}.webApi = function (win) {
 }
 const ROOT_PANEL_CSS = [
     ".dsmapp-rootpanel{margin:16px 20px;padding:12px 16px;border:1px solid #d5dce5;border-radius:4px;background:#f7f9fb;font-size:13px;line-height:1.5}",
-    ".dsmapp-rootpanel h2{margin:0 0 6px;font-size:14px;font-weight:600}",
-    ".dsmapp-rootpanel dl{display:grid;grid-template-columns:max-content 1fr;gap:2px 12px;margin:8px 0}",
-    ".dsmapp-rootpanel dt{color:#526070}.dsmapp-rootpanel dd{margin:0}",
-    ".dsmapp-rootpanel pre{margin:4px 0 8px;padding:6px 8px;background:#fff;border:1px solid #e1e6ec;white-space:pre-wrap;max-height:160px;overflow:auto}",
+    ".dsmapp-rootpanel h2{margin:0 0 6px;font-size:14px;font-weight:600}.dsmapp-rootpanel p{margin:4px 0}",
+    ".dsmapp-rootpanel label{display:block;margin:8px 0}.dsmapp-rootpanel input{margin-left:8px;padding:3px 6px}",
     ".dsmapp-rootpanel-actions button{margin-right:8px;padding:4px 14px}",
     ".dsmapp-rootpanel-primary{background:#057feb;color:#fff;border:1px solid #057feb;border-radius:3px}",
-    ".dsmapp-rootpanel-message{color:#c0392b}.dsmapp-rootpanel-hint{color:#526070;font-size:12px}",
+    ".dsmapp-rootpanel-hint{color:#526070;font-size:12px}.dsmapp-rootpanel [hidden]{display:none}",
 ].join("");
 /**
- * An install-selected delegate scope is approved only in the app's settings: the
- * approval carries the scope the administrator picks there, and the window panel
- * has no scope picker.
+ * A Vue app approves in the SDK's ExecutorSettings, which also carries an
+ * install-selected scope; the window panel serves plain-UI apps only.
  */
 function settingsOnlyApproval(manifest) {
-    return manifest.ui.build !== undefined && manifest.capabilities.delegate?.scope === "install-selected";
+    return manifest.ui.build !== undefined;
 }
 /**
  * The capabilities.rootOps: true additions to the window: the exact tasks and panel
@@ -352,7 +349,7 @@ ${PASSWORD_CONFIRM}
     });
 ${settingsOnlyApproval(manifest) ? "" : `    var panels = me.body && me.body.dom.querySelector(".dsmapp-rootpanels");
     if (panels) {
-      ${ns}.mountRootPanel(panels, access, null, ${ns}.rootTasks, session().admin);
+      ${ns}.mountRootPanel(panels, access, ${ns}.createI18n(lang, ${JSON.stringify(rootPanelCatalogs())}).t, session().admin);
     }
 `}`,
     };

package/dist/standalone/inspect-spk.js

@@ -19,7 +19,7 @@ import { renderUninstallWizardFiles } from "../build-spk/uninstall-wizard.js";
 import { renderStandaloneScript } from "./lifecycle.js";
 import { listPortExposures, loadCompose } from "../compose/analyze.js";
 import { uninstallCleanup } from "../runtime/uninstall-cleanup.js";
-import { PORTAL_JSON_RELPATH, PORTAL_MUSTACHE_RELPATH, portalResource, renderPortalJson, renderPortalLifecycle, renderPortalMustache, renderPortalWizardStep } from "../portal/package.js";
+import { PORTAL_JSON_RELPATH, PORTAL_MUSTACHE_RELPATH, renderPortalJson, renderPortalLifecycle, renderPortalMustache, renderPortalWizardStep } from "../portal/package.js";
 import { isPortalAlias } from "../portal/alias.js";
 import { defaultPackageIcons, MAX_ICON_BYTES } from "../build-spk/dsm-icons.js";
 import { decodePng } from "../build-spk/png.js";
@@ -70,7 +70,8 @@ export async function inspectSpk(spkPath, expectedKind) {
         await checkArch(dir, info, kind, paths.has(CGI_PAYLOAD_PATH), findings);
         const background = kind === "native-go" && paths.has(BACKGROUND_WORKER_PAYLOAD);
         const sharedFolder = standalone ? recoverSharedFolder(readOptional(join(dir, "scripts/postinst"))) : undefined;
-        const portal = await recoverPortal(dir, info, kind === "container" ? info.package ?? "" : `SYNO.SDS.${info.package}.Instance`, paths, payload, findings);
+        // A Compose App has no executor, so its SPK never carries a portal.
+        const portal = standalone ? await recoverPortal(dir, info, `SYNO.SDS.${info.package}.Instance`, paths, payload, findings) : undefined;
         if (portal && info.os_min_ver && OS_MIN_VER.test(info.os_min_ver) && !isDsmAtLeast(info.os_min_ver, PORTAL_MIN_DSM)) {
             findings.push(`INFO os_min_ver「${info.os_min_ver}」低於 portal 需要的 DSM ${PORTAL_MIN_DSM}；DSM 7.1.1 以錯誤 320 拒裝帶 web-config app-portal 的未簽章套件，7.2 未驗證`);
         }
@@ -80,6 +81,8 @@ export async function inspectSpk(spkPath, expectedKind) {
         if (kind === "container")
             await checkContainerExposure(dir, join(dir, "package.tgz"), findings);
         const hasExecutor = (metadata.capabilities ?? []).some(name => name === "rootOps" || name === "delegate") || paths.has("executor/executor");
+        if (standalone && portal && !hasExecutor)
+            findings.push("PORTAL_REQUIRES_EXECUTOR portal 需要 executor 層級（rootOps 或 delegate）：解除安裝後只有 root purge 能讓 nginx 停止提供別名");
         const daemon = standalone ? await checkDaemon(dir, info, paths, payload, findings, hasExecutor, background) : undefined;
         if (background)
             checkBackground(dir, info, payload, findings, hasExecutor, daemon);
@@ -104,7 +107,7 @@ export async function inspectSpk(spkPath, expectedKind) {
                         findings.push(`Executor scripts/${hook} differs from fixed lifecycle.`);
                 }
             }
-            for (const [name, text] of Object.entries(renderUninstallWizardFiles(info.package, "native", { executor: true }))) {
+            for (const [name, text] of Object.entries(renderUninstallWizardFiles(info.package, "native", { executor: true, portal: Boolean(portal) }))) {
                 if (readOptional(join(dir, "WIZARD_UIFILES", name)) !== text)
                     findings.push(`Executor WIZARD_UIFILES/${name} is missing cleanup guidance.`);
             }
@@ -115,7 +118,7 @@ export async function inspectSpk(spkPath, expectedKind) {
         if (metadata.entry)
             await checkEntryLauncher(dir, info.package, metadata.entry, findings);
         if (standalone)
-            checkSharedFolder(dir, findings, info.package, sharedFolder, executor?.policy.scope === 'install-selected', portal);
+            checkSharedFolder(dir, findings, info.package, sharedFolder, executor?.policy.scope === 'install-selected', portal, hasExecutor);
         const icon = inspectPackageIcons(dir, findings);
         const cgiEntry = payload.find((entry) => entry.path === CGI_PAYLOAD_PATH);
         if (standalone && !cgiEntry) {
@@ -130,7 +133,7 @@ export async function inspectSpk(spkPath, expectedKind) {
             ...(executor ? { executor } : {}),
             ...(portal ? { portal: { appId: portal.appId, alias: portal.alias } } : {}),
             ...(metadata.entry ? { entry: metadata.entry } : {}),
-            ...(standalone ? { uninstallCleanup: uninstallCleanup(info.package, hasExecutor) } : {}),
+            ...(standalone ? { uninstallCleanup: uninstallCleanup(info.package, { executor: hasExecutor, portal: Boolean(portal) }) } : {}),
             package: info.package,
             version: info.version,
             arch: info.arch,
@@ -324,11 +327,9 @@ function checkConf(dir, findings, kind, background, sharedFolder, pkg, portal) {
             if (!resource["docker-project"])
                 findings.push("container 缺少 docker-project resource");
             for (const key of Object.keys(resource)) {
-                if (!["docker-project", "webservice", ...(portal ? ["web-config"] : [])].includes(key))
+                if (!["docker-project", "webservice"].includes(key))
                     findings.push(`未知 container resource: ${key}`);
             }
-            if (portal && JSON.stringify(resource["web-config"]) !== JSON.stringify(portalResource()["web-config"]))
-                findings.push("container web-config 必須只有固定的 app-portal 註冊");
         }
         catch {
             findings.push("container 缺少有效的 conf/resource");
@@ -380,7 +381,7 @@ function checkBackground(dir, info, payload, findings, executor, daemon) {
  * declaration (without one, any present file must be the default native
  * install wizard), and no other install/upgrade wizard file may exist.
  */
-function checkSharedFolder(dir, findings, pkg, folder, selected = false, portal) {
+function checkSharedFolder(dir, findings, pkg, folder, selected = false, portal, executor = false) {
     const wizardDir = join(dir, "WIZARD_UIFILES");
     const present = (existsSync(wizardDir) ? readdirSync(wizardDir) : []).filter(name => /^(install|upgrade)_uifile(_|\.|$)/.test(name)).sort();
     const postinst = readOptional(join(dir, "scripts/postinst"));
@@ -406,7 +407,7 @@ function checkSharedFolder(dir, findings, pkg, folder, selected = false, portal)
     if (!folder)
         return;
     for (const hook of ["postinst", "postupgrade"]) {
-        if (readOptional(join(dir, "scripts", hook)) !== renderStandaloneScript(hook, { package: pkg, sharedFolder: folder, ...(selected ? { capabilities: { delegate: { scope: "install-selected" } } } : {}), ...portalManifest(portal) })) {
+        if (readOptional(join(dir, "scripts", hook)) !== renderStandaloneScript(hook, { package: pkg, sharedFolder: folder, ...(selected ? { capabilities: { delegate: { scope: "install-selected" } } } : executor ? { capabilities: { rootOps: true } } : {}), ...portalManifest(portal) })) {
             findings.push(`scripts/${hook} 與 install.sharedFolder 宣告的固定腳本不符`);
         }
     }

package/dist/standalone/manifest.js

@@ -11,7 +11,7 @@ import { readBackground } from "./background.js";
 import { DEFAULT_MIN_DSM, isDsmAtLeast, PORTAL_MIN_DSM, portalMinDsmMessage } from "../build-spk/dsm-version.js";
 import { readSharedFolder } from "./shared-folder.js";
 import { floorAtAdministrators, permitsOrdinaryUsers, readApiPermissions } from "./api-permissions.js";
-import { readPortalDeclaration } from "../portal/alias.js";
+import { PORTAL_REQUIRES_EXECUTOR, readPortalDeclaration } from "../portal/alias.js";
 import { renderPackageIcons } from "../build-spk/dsm-icons.js";
 import { validateReproducible } from "../reproducible-config.js";
 import { SDK_MODULE, sdkRequirement } from "../runtime/sdk-source.js";
@@ -137,7 +137,12 @@ function readManifest(raw, c) {
             permissions = readApiPermissions(backend.dir, capabilities);
         }
         catch (error) {
-            c.fail("STANDALONE_API_PERMISSIONS_INVALID", `backend/internal/api/permissions.json must define the centralized API policy: ${String(error)}`);
+            // The SDK's own routes come from its module; a failed download is not a policy problem.
+            const download = /^\[SDK_DOWNLOAD_FAILED\] ([\s\S]*)$/.exec(error.message);
+            if (download)
+                c.fail("SDK_DOWNLOAD_FAILED", download[1]);
+            else
+                c.fail("STANDALONE_API_PERMISSIONS_INVALID", `backend/internal/api/permissions.json must define the centralized API policy: ${String(error)}`);
         }
     }
     const daemon = arches && readDaemon(raw.daemon, c.root, arches, e => c.fail(e.code, e.message));
@@ -172,6 +177,9 @@ function readManifest(raw, c) {
     const icon = raw.icon === undefined ? undefined : readIcon(raw.icon, c);
     const portal = raw.portal === undefined || !packageId ? undefined : readPortalDeclaration(raw.portal, packageId)
         ?? c.fail("STANDALONE_PORTAL_INVALID", "portal 必須是 {} 或 { alias: <小寫英數與 -，1–64 字，不可為 DSM 保留路徑> }。");
+    if (portal && !capabilities.rootOps && !capabilities.delegate) {
+        c.fail("STANDALONE_PORTAL_REQUIRES_EXECUTOR", PORTAL_REQUIRES_EXECUTOR);
+    }
     if (portal && osMinVer && !isDsmAtLeast(osMinVer, PORTAL_MIN_DSM)) {
         c.fail("STANDALONE_PORTAL_MIN_DSM", portalMinDsmMessage(osMinVer, "portal"));
     }
@@ -230,7 +238,8 @@ function readEntry(value, backend, policy, c) {
     const main = backend.kind === "go" ? join(backend.dir, backend.main, "main.go") : "";
     if (backend.kind !== "go" || !sdkRequirement(backend.dir)
         || !existsSync(main) || !readFileSync(main, "utf8").includes("dsm.NewEntryGate(")) {
-        return c.fail("STANDALONE_ENTRY_UNSUPPORTED", `entry 需要 SDK 的 entry gate：backend/go.mod 要 require ${SDK_MODULE}，並在 cmd/app/main.go 以 dsm.NewEntryGate 包住 authenticator。`);
+        const shown = main ? relative(c.root, main) : "backend.main 的 main.go";
+        return c.fail("STANDALONE_ENTRY_UNSUPPORTED", `entry 需要 SDK 的 entry gate：backend/go.mod 要 require ${SDK_MODULE}，並在 ${shown} 以 dsm.NewEntryGate 包住 authenticator。`);
     }
     if (value === "app-privilege" && !permitsOrdinaryUsers(policy)) {
         return c.fail("STANDALONE_ENTRY_INVALID", "entry: app-privilege 需要至少一個 permissions.json 標為 authenticated 的 route，一般使用者才有功能可用。");