@synopackageland/cli 0.9.3 → 0.9.5

package/CHANGELOG.md

@@ -1,5 +1,85 @@
 # Changelog
 
+## 0.9.5 (2026-10-12)
+
+Builds with SDK 0.9.6 and templates 0.9.5: `init` writes SDK v0.9.6,
+`@synopackageland/sdk` 0.9.6 and `@synopackageland/ui` 0.9.2. The executor
+digest table records SDK 0.9.6, whose executor registers the portal entry
+and checks a grant's background work from the browser address it recorded,
+so a rebuilt App carries new executor digests. The policy digest changes
+only for an App whose executor registers its portal entry (a portal and
+os_min_ver below 7.2): after the upgrade it asks for approval again. Other
+Apps keep their policy digest.
+
+繁中摘要：使用 SDK 0.9.6 與 templates 0.9.5（UI 0.9.2）。executor digest 表加入
+SDK 0.9.6，重建的 App 會帶新的 executor digest。只有由 executor 註冊入口的
+portal App（宣告 portal 且 os_min_ver 低於 7.2）policy digest 會變，升級後需重新
+核准；其他 App 的 policy digest 不變。DSM 7.1 起可用 portal（executor 模式）。
+
+- The generated DSM window stays inside the desktop: its width is at most the
+  viewport's and its height at most the viewport's less the DSM taskbar. This
+  applies to the default 960×640 and to the size DSM restores from
+  `restoreSizePos`, which may have been saved on a larger screen. Position and
+  maximized state are restored as before.
+- Native root authorization (`createRootAccess` from
+  `@synopackageland/cli/authorization-sdk`): the first `run` after an `authorize`
+  runs the task that `authorize` just read back as exactly ours, instead of
+  reading the TaskScheduler list and task again. Any later run, a repair, and
+  a run after `remove` still read DSM first; `authorize` still reads the task
+  back after creating it and checks its identity and script.
+- Native root authorization polls the task history every 0.5 s, then at most
+  once a second (was up to every 2 s), so a finished root task is seen up to
+  1 s sooner.
+- A portal works from DSM 7.1-42661 on. Below 7.2-64570 (executor mode) the
+  SPK carries no web-config resource, `etc/portal.*`, alias wizard step or
+  alias lifecycle; the executor policy carries `portal: {application, alias}`
+  and the `portal.register` / `portal.unregister` operations, and the CGI is
+  built with `-X main.portal=executor`. A package name or displayname the
+  executor would refuse fails with `STANDALONE_PORTAL_ENTRY_INVALID`; below
+  7.1 `STANDALONE_PORTAL_MIN_DSM` still refuses the portal, and `add portal`
+  raises os_min_ver only to 7.1-42661. inspect reports the policy's entry
+  and flags an INFO os_min_ver below 7.1. Needs templates 0.9.5 and SDK 0.9.6.
+- `ctx.portal` in executor mode: `status()` carries `entry`, administrators
+  get `register()` and `unregister()`, and the plain panel offers "Enable
+  entry", "Remove entry" or the alias form by entry state. New texts in nine
+  languages, including `PORTAL_FAILED`. The panel's Korean texts use the
+  formal -십시오 register.
+- The uninstall wizard and the cleanup list of an executor-mode portal App
+  warn that a stopped or never-approved executor leaves the entry, and give
+  the root cleanup commands.
+- native-layout: `portal: {}` or `{alias}` (DSM 7.1-42661+) writes
+  `synopkgland_portal_alias` into INFO for the product's own root helper;
+  inspect checks it against `native-layout.json`.
+- DSM's web-config portal registration now needs `os_min_ver` 7.2-64570 or
+  later instead of 7.3.2-86009. DSM 7.1's package manager marks the web-config
+  worker Synology-only and refuses it in an unsigned SPK (error 320); synopkg
+  from DSM 7.2 on drops that mark, the only change to its worker table. The
+  7.2 floor comes from that source and is not yet verified on a 7.2 NAS.
+  inspect flags a web-config portal SPK whose INFO os_min_ver is lower, with
+  this reason.
+
+## 0.9.4 (2026-10-12)
+
+Builds with SDK 0.9.5 and templates 0.9.4: `init` writes SDK v0.9.5 and
+`@synopackageland/sdk` 0.9.5, and the Vue App's `AppRoot` lets Dialogs leave
+a DSM window. The executor digest table records SDK 0.9.5, whose executor
+equals 0.9.4's; the policy digest stays the same, so an installed App needs
+no new approval. AI guidance for DSM-window Dialogs matches the Vue App.
+
+繁中摘要：使用 SDK 0.9.5 與 templates 0.9.4。SDK 0.9.5 只改 TypeScript（NAS
+picker 改用 UI 0.9.1 元件），executor digest 與 0.9.4 相同，policy digest 不變，
+已安裝的 App 不需重新核准。ui-vue 與 ui-json 指引改為在 DSM 視窗內給 `AppRoot`
+`dialog-bounds="viewport"`，並把 `activate` 接到 `ctx.host.activateWindow()`：
+Dialog 可拖出 App 視窗，點 Dialog 會把視窗帶到最前；600px 以下為底部 sheet。
+
+- `ui-vue` and `ui-json`: in a DSM window (`ctx.host.platform().host === 'dsm'`),
+  give `AppRoot` `dialog-bounds="viewport"` and connect its `activate` event to
+  `ctx.host.activateWindow()`, so Dialogs can be dragged out of the window and
+  pressing one brings the window to the front. Below 600px they are bottom
+  sheets. Standalone web, Portal and previews keep Dialogs inside the App.
+- A host-window test pins that the mounted App's `activateWindow` fronts only
+  its own DSM window.
+
 ## 0.9.3 (2026-10-12)
 
 Builds with SDK 0.9.4 and templates 0.9.3: `init` writes SDK v0.9.4 and

package/README.md

@@ -72,7 +72,7 @@ Add them with `init --with …` or later with `synopkgland add <capability…>`.
 | `login` | Sign users in with their DSM account, without the DSM desktop | Nobody; requires HTTPS for password sign-in |
 | `delegate` | Move files into a user's chosen folder while the user is offline | An administrator, once |
 | `root-ops` | Run fixed `root/*.sh` scripts for administrators | An administrator, once |
-| `portal` | Open the app from its own Application Portal alias | An administrator sets the alias; needs `root-ops` or `delegate` and DSM 7.3.2-86009+ |
+| `portal` | Open the app from its own Application Portal alias | An administrator sets the alias; needs `root-ops` or `delegate` and DSM 7.1-42661+ (below 7.2-64570 the executor registers the entry) |
 
 Delegate is implemented; its default operation is `files.moveFromStaging`.
 Device lifecycle acceptance on real hardware is still pending for delegate and root operations.

package/dist/add.js

@@ -6,7 +6,7 @@ import { capabilityNames, capabilitySettings } from './capabilities.js';
 import { initFromTemplate, nativeCapabilitySettings } from './init.js';
 import { templatesRoot } from './template-paths.js';
 import { borrowedTarget, capabilityOverlays } from './capability-overlays.js';
-import { DEFAULT_MIN_DSM, isDsmAtLeast, PORTAL_MIN_DSM } from './build-spk/dsm-version.js';
+import { DEFAULT_MIN_DSM, isDsmAtLeast, PORTAL_EXECUTOR_MIN_DSM } from './build-spk/dsm-version.js';
 import { loadStandaloneManifest } from './standalone/manifest.js';
 import { PORTAL_REQUIRES_EXECUTOR } from './portal/alias.js';
 function files(root, dir = root) {
@@ -51,7 +51,7 @@ function withNotes(result, notes) {
 }
 /**
  * `portal: {}` in dsm-package.yaml; the Go and binary starters already carry the UI and backend side.
- * A lower os_min_ver is raised to PORTAL_MIN_DSM, the oldest DSM verified to install a portal.
+ * A lower os_min_ver is raised to PORTAL_EXECUTOR_MIN_DSM; below PORTAL_MIN_DSM the executor registers the entry.
  */
 function addPortal(root, result) {
     const loaded = loadStandaloneManifest(root);
@@ -64,7 +64,7 @@ function addPortal(root, result) {
     const manifestPath = join(root, 'dsm-package.yaml');
     const doc = parseDocument(readFileSync(manifestPath, 'utf8'));
     doc.set('portal', doc.createNode({}, { flow: true }));
-    const notes = raiseOsMinVer(doc, loaded.manifest.os_min_ver, PORTAL_MIN_DSM, 'portal');
+    const notes = raiseOsMinVer(doc, loaded.manifest.os_min_ver, PORTAL_EXECUTOR_MIN_DSM, 'portal');
     writeFileSync(manifestPath, String(doc));
     return withNotes({ ...result, added: [...result.added, 'portal'] }, notes);
 }

package/dist/build-spk/dsm-version.d.ts

@@ -8,11 +8,21 @@ export declare const DEFAULT_MIN_DSM: string;
 export declare const CONTAINER_MIN_DSM: string;
 /**
  * DSM registers an Application Portal through the package's web-config
- * app-portal resource. DSM 7.1.1-42962 refuses that resource in an unsigned
- * package (error 320, "internal worker"); DSM 7.3.2-86009 and 7.4 install it.
- * 7.2 and 7.3.0/7.3.1 are untested, so the floor is the oldest verified build.
+ * app-portal resource. DSM 7.1's package manager marks the web-config worker
+ * Synology-only and refuses it in an unsigned package (error 320, "internal
+ * worker"); synopkg from DSM 7.2 on does not. That 7.2 floor comes from the
+ * source and is not yet verified on a 7.2 NAS.
  */
-export declare const PORTAL_MIN_DSM = "7.3.2-86009";
+export declare const PORTAL_MIN_DSM: string;
+/** Why DSM below PORTAL_MIN_DSM refuses a package that declares the web-config portal resource. */
+export declare const PORTAL_MIN_DSM_REASON = "DSM 7.1 \u628A web-config \u5217\u70BA Synology \u5C08\u7528 worker\uFF0C\u4EE5\u932F\u8AA4 320 \u62D2\u88DD\u5E36 portal\uFF08web-config app-portal\uFF09\u7684\u672A\u7C3D\u7AE0\u5957\u4EF6\uFF1B7.2 \u8D77\u958B\u653E\u662F\u4F9D synopkg \u539F\u59CB\u78BC\u5224\u65B7\uFF0C\u5C1A\u672A\u5BE6\u6A5F\u9A57\u8B49";
+/**
+ * Below {@link PORTAL_MIN_DSM} the root executor registers the portal entry in
+ * DSM's app.d instead; that file format is verified from DSM 7.1 on.
+ */
+export declare const PORTAL_EXECUTOR_MIN_DSM: string;
+/** `true` when a portal package for `osMinVer` has its executor register the entry instead of web-config. */
+export declare function portalByExecutor(osMinVer: string): boolean;
 /** Why a portal package cannot declare `value`, and how to fix it; `field` names the portal key. */
 export declare function portalMinDsmMessage(value: string, field: string): string;
 /** `true` when `value` is not older than `floor`, comparing version parts then build. */

package/dist/build-spk/dsm-version.js

@@ -15,14 +15,26 @@ export const DEFAULT_MIN_DSM = FIRST_BUILD["7.1"];
 export const CONTAINER_MIN_DSM = FIRST_BUILD["7.2.1"];
 /**
  * DSM registers an Application Portal through the package's web-config
- * app-portal resource. DSM 7.1.1-42962 refuses that resource in an unsigned
- * package (error 320, "internal worker"); DSM 7.3.2-86009 and 7.4 install it.
- * 7.2 and 7.3.0/7.3.1 are untested, so the floor is the oldest verified build.
+ * app-portal resource. DSM 7.1's package manager marks the web-config worker
+ * Synology-only and refuses it in an unsigned package (error 320, "internal
+ * worker"); synopkg from DSM 7.2 on does not. That 7.2 floor comes from the
+ * source and is not yet verified on a 7.2 NAS.
  */
-export const PORTAL_MIN_DSM = "7.3.2-86009";
+export const PORTAL_MIN_DSM = FIRST_BUILD["7.2"];
+/** Why DSM below PORTAL_MIN_DSM refuses a package that declares the web-config portal resource. */
+export const PORTAL_MIN_DSM_REASON = "DSM 7.1 把 web-config 列為 Synology 專用 worker，以錯誤 320 拒裝帶 portal（web-config app-portal）的未簽章套件；7.2 起開放是依 synopkg 原始碼判斷，尚未實機驗證";
+/**
+ * Below {@link PORTAL_MIN_DSM} the root executor registers the portal entry in
+ * DSM's app.d instead; that file format is verified from DSM 7.1 on.
+ */
+export const PORTAL_EXECUTOR_MIN_DSM = FIRST_BUILD["7.1"];
+/** `true` when a portal package for `osMinVer` has its executor register the entry instead of web-config. */
+export function portalByExecutor(osMinVer) {
+    return !isDsmAtLeast(osMinVer, PORTAL_MIN_DSM);
+}
 /** Why a portal package cannot declare `value`, and how to fix it; `field` names the portal key. */
 export function portalMinDsmMessage(value, field) {
-    return `${field} 需要 DSM ${PORTAL_MIN_DSM} 以上，os_min_ver 是「${value}」。DSM 7.1.1 以錯誤 320 拒裝帶 portal（web-config app-portal）的未簽章套件；DSM 7.3.2 與 7.4 已驗證可裝，7.2 未驗證。請把 os_min_ver 提高到 ${PORTAL_MIN_DSM} 以上，或移除 ${field}。`;
+    return `${field} 需要 DSM ${PORTAL_EXECUTOR_MIN_DSM} 以上，os_min_ver 是「${value}」。DSM ${PORTAL_MIN_DSM} 以前由 executor 寫入 DSM 的 app.d 註冊入口，這個格式只在 DSM 7.1 起驗證過。請把 os_min_ver 提高到 ${PORTAL_EXECUTOR_MIN_DSM} 以上，或移除 ${field}。`;
 }
 /** `true` when `value` is not older than `floor`, comparing version parts then build. */
 export function isDsmAtLeast(value, floor) {

package/dist/build-spk/uninstall-wizard.d.ts

@@ -6,6 +6,8 @@ interface UninstallWizardOptions {
     executor?: boolean;
     /** The App declares a Login Portal alias (web-config app-portal); only the executor tier can. */
     portal?: boolean;
+    /** Below DSM 7.2 the executor registered the App's Application Portal entry. */
+    portalEntry?: boolean;
 }
 /** `uninstall_uifile` (English) plus one `uninstall_uifile_<dsm language>` per locale. */
 export declare function renderUninstallWizardFiles(packageName: string, kind: UninstallWizardKind, options?: UninstallWizardOptions): Record<string, string>;

package/dist/build-spk/uninstall-wizard.js

@@ -1,10 +1,12 @@
+import { portalEntryCleanupCommands } from "../runtime/uninstall-cleanup.js";
 import { renderWizardFiles } from "./wizard-i18n.js";
 /** The key DSM's built-in packages use for their "also remove my data" box. */
 export const REMOVE_ADDITIONAL_KEY = "pkgwizard_remove_additional";
 function list(items) {
     return `<ul class="synopkg-ul-list">${items.map((item) => `<li>${item}</li>`).join("")}</ul>`;
 }
-function renderUninstallWizard(t, packageName, kind, { executor = false, portal = false }) {
+const html = (text) => text.replace(/&/g, "&amp;").replace(/</g, "&lt;").replace(/>/g, "&gt;");
+function renderUninstallWizard(t, packageName, kind, { executor = false, portal = false, portalEntry = false }) {
     const vars = { package: packageName };
     return [{
             step_title: t("uninstall.step"),
@@ -23,6 +25,10 @@ function renderUninstallWizard(t, packageName, kind, { executor = false, portal
                 ...(executor ? [{ desc: t("uninstall.executor", vars) }] : []),
                 { desc: t(executor ? "uninstall.appPrivilege.auto" : "uninstall.appPrivilege", vars) },
                 ...(executor && portal ? [{ desc: t("uninstall.portal.auto", vars) }] : []),
+                ...(executor && portalEntry ? [
+                    { desc: t("uninstall.portalEntry", vars) },
+                    { desc: portalEntryCleanupCommands(packageName).map((line) => `<code>${html(line)}</code>`).join("<br>") },
+                ] : []),
                 { desc: t("uninstall.backup") },
                 {
                     type: "multiselect",

package/dist/build-spk/wizard-messages.d.ts

@@ -417,6 +417,17 @@ export declare const WIZARD_MESSAGES: {
         es: string;
         it: string;
     };
+    "uninstall.portalEntry": {
+        en: string;
+        "zh-TW": string;
+        "zh-CN": string;
+        ja: string;
+        ko: string;
+        de: string;
+        fr: string;
+        es: string;
+        it: string;
+    };
     "uninstall.keep.native": {
         en: string;
         "zh-TW": string;

package/dist/build-spk/wizard-messages.js

@@ -417,6 +417,17 @@ export const WIZARD_MESSAGES = {
         es: "Después de que DSM elimine el alias del Portal de inicio de sesión de {package}, la desinstalación recarga automáticamente el servidor web, de modo que el alias deja de funcionar al instante. Solo si esta recarga falla, como indica la entrada synopkgland-executor del registro del sistema, un administrador debe guardar un alias de aplicación en Panel de control > Portal de inicio de sesión > Aplicaciones, lo que recarga el servidor web, o reiniciar el NAS.",
         it: "Dopo che DSM ha rimosso l’alias del Portale di accesso di {package}, la disinstallazione ricarica automaticamente il server web, così l’alias smette subito di funzionare. Solo se questo ricaricamento non riesce, come segnala la voce synopkgland-executor del registro di sistema, un amministratore deve salvare un alias di applicazione in Pannello di controllo > Portale di accesso > Applicazioni, che ricarica il server web, oppure riavviare il NAS.",
     },
+    "uninstall.portalEntry": {
+        en: "Uninstall asks the root executor to remove the Application Portal entry of {package}. If the executor is not running or was never approved, uninstall does not remove the entry; an administrator then runs these commands as root:",
+        "zh-TW": "解除安裝會由 root executor 移除 {package} 的應用程式入口。如果 executor 未執行或從未核准，解除安裝不會移除應用程式入口，管理員需以 root 執行下列指令：",
+        "zh-CN": "卸载会由 root executor 移除 {package} 的应用程序门户入口。如果 executor 未运行或从未核准，卸载不会移除应用程序门户入口，管理员需以 root 执行下列命令：",
+        ja: "アンインストール時に root executor が {package} のアプリケーションポータルのエントリを削除します。executor が実行されていない、または承認されていない場合、アンインストールではエントリが削除されないため、管理者が root で次のコマンドを実行してください:",
+        ko: "제거 시 root executor가 {package}의 응용 프로그램 포털 항목을 제거합니다. executor가 실행 중이 아니거나 승인된 적이 없으면 제거 과정에서 항목이 제거되지 않으므로 관리자가 root로 다음 명령을 실행하십시오.",
+        de: "Bei der Deinstallation entfernt der Root-Executor den Eintrag von {package} im Anwendungsportal. Läuft der Executor nicht oder wurde er nie genehmigt, entfernt die Deinstallation den Eintrag nicht; ein Administrator führt dann diese Befehle als root aus:",
+        fr: "La désinstallation demande à l’executor root de supprimer l’entrée de {package} dans le Portail d’application. Si l’executor ne s’exécute pas ou n’a jamais été approuvé, la désinstallation ne supprime pas l’entrée ; un administrateur exécute alors ces commandes en tant que root :",
+        es: "La desinstalación pide al executor root que elimine la entrada de {package} del Portal de aplicaciones. Si el executor no se está ejecutando o nunca se aprobó, la desinstalación no elimina la entrada; un administrador debe ejecutar estos comandos como root:",
+        it: "La disinstallazione chiede all’executor root di rimuovere la voce di {package} dal Portale applicazioni. Se l’executor non è in esecuzione o non è mai stato approvato, la disinstallazione non rimuove la voce; un amministratore deve eseguire questi comandi come root:",
+    },
     "uninstall.keep.native": {
         en: "Never deleted: Shared Folders, the package account, and other apps' data.",
         "zh-TW": "不會被刪除：共用資料夾（Shared Folder）、套件帳號，以及其他 App 的資料。",

package/dist/error-registry.js

@@ -649,7 +649,8 @@ for (const [code, description, suggestion] of [
     ERROR_REGISTRY[code] = { code, description, suggestion };
 ERROR_REGISTRY["ADD_LAYOUT_UNSUPPORTED"] = { "code": "ADD_LAYOUT_UNSUPPORTED", "description": "SDK overlay 需要標準 backend 目錄。", "suggestion": "使用 backend.dir: backend，或手動合併 SDK overlay。" };
 ERROR_REGISTRY["MIN_DSM_CONTAINER_FLOOR"] = { "code": "MIN_DSM_CONTAINER_FLOOR", "description": "Compose 最低 DSM 版本過低。", "suggestion": "Compose 需要 DSM 7.2.1-69057 或以上。" };
-ERROR_REGISTRY.STANDALONE_PORTAL_MIN_DSM = { "code": "STANDALONE_PORTAL_MIN_DSM", "description": "宣告 portal 的套件 os_min_ver 低於 DSM 7.3.2-86009。", "suggestion": "DSM 7.1.1 以 320 拒裝帶 portal 的未簽章套件、7.2 未驗證；把 os_min_ver 提高到 7.3.2-86009 以上，或移除 portal。" };
+ERROR_REGISTRY.STANDALONE_PORTAL_ENTRY_INVALID = { "code": "STANDALONE_PORTAL_ENTRY_INVALID", "description": "os_min_ver 低於 DSM 7.2-64570 時由 executor 註冊 portal，套件名稱或 displayname 不符合它的規則。", "suggestion": "套件名稱只能用英數字，以 . _ - 分隔，最多 64 字；displayname 1–64 個字，不可含控制字元。" };
+ERROR_REGISTRY.STANDALONE_PORTAL_MIN_DSM = { "code": "STANDALONE_PORTAL_MIN_DSM", "description": "宣告 portal 的套件 os_min_ver 低於 DSM 7.1-42661。", "suggestion": "DSM 7.2-64570 以前由 executor 寫入 DSM 的 app.d 註冊入口，這個格式只在 DSM 7.1 起驗證過。把 os_min_ver 提高到 7.1-42661 以上，或移除 portal。" };
 ERROR_REGISTRY["MIN_DSM_INVALID"] = { "code": "MIN_DSM_INVALID", "description": "最低 DSM 版本格式不合法。", "suggestion": "指定 7.x release 或完整 7.x-build。" };
 ERROR_REGISTRY["NOTICE_UNSAFE"] = { "code": "NOTICE_UNSAFE", "description": "授權檔案不符合一般檔案限制。", "suggestion": "移除 symlink、特殊檔與超大授權檔案。" };
 ERROR_REGISTRY["NOTICE_MISSING"] = { "code": "NOTICE_MISSING", "description": "缺少第三方授權資訊。", "suggestion": "重新安裝模板依賴並產生 third-party notices。" };

package/dist/info.js

@@ -1,5 +1,6 @@
 import { existsSync } from "node:fs";
 import { join } from "node:path";
+import { portalByExecutor } from "./build-spk/dsm-version.js";
 import { loadContract } from "./contract/load.js";
 import { appOriginFromContract } from "./host/open-url.js";
 import { resolveDeployIdentity } from "./deploy/identity.js";
@@ -169,7 +170,7 @@ export async function standaloneInfo(options) {
         ...state,
         capabilities,
         ...(executor ? { executor } : {}),
-        uninstallCleanup: uninstallCleanup(m.package, { executor: Boolean(m.capabilities.rootOps || m.capabilities.delegate), portal: Boolean(m.portal) }),
+        uninstallCleanup: uninstallCleanup(m.package, { executor: Boolean(m.capabilities.rootOps || m.capabilities.delegate), portal: Boolean(m.portal && !portalByExecutor(m.os_min_ver)), portalEntry: Boolean(m.portal && portalByExecutor(m.os_min_ver)) }),
     };
 }
 /** What the installed App's portal.status says; DSM owns the alias, an administrator sets it. */

package/dist/portal/alias.d.ts

@@ -25,3 +25,11 @@ export declare function isPortalAlias(value: unknown): value is string;
 export declare function defaultPortalAlias(packageId: string): string;
 /** `{}` or `{alias}`; undefined for any other shape. */
 export declare function readPortalDeclaration(value: unknown, packageId: string): PortalDeclaration | undefined;
+/** The Application Portal entry a root executor registers in DSM's app.d, as its approved policy states it. */
+export interface PortalEntry {
+    /** Control Panel display name. */
+    application: string;
+    alias: string;
+}
+/** Why the executor would refuse this entry; undefined when it accepts it. */
+export declare function portalEntryProblem(packageId: string, entry: PortalEntry): string | undefined;

package/dist/portal/alias.js

@@ -41,3 +41,19 @@ export function readPortalDeclaration(value, packageId) {
         return { alias: defaultPortalAlias(packageId) };
     return isPortalAlias(alias) ? { alias } : undefined;
 }
+/**
+ * The executor's own rules (executor/portal_entry.go): the package name and
+ * alias become DSM file and nginx names, the application a JSON string.
+ */
+const ENTRY_PACKAGE = /^[A-Za-z0-9]+(?:[._-][A-Za-z0-9]+)*$/;
+const ENTRY_ALIAS = /^[A-Za-z0-9][A-Za-z0-9_-]{0,63}$/;
+/** Why the executor would refuse this entry; undefined when it accepts it. */
+export function portalEntryProblem(packageId, entry) {
+    if (packageId.length > 64 || !ENTRY_PACKAGE.test(packageId))
+        return `套件名稱「${packageId}」不能當作 Application Portal 的檔名：只能用英數字，以 . _ - 分隔，最多 64 字。`;
+    if (!ENTRY_ALIAS.test(entry.alias))
+        return `portal 別名「${entry.alias}」不能當作 Application Portal 的路徑。`;
+    if (!entry.application || [...entry.application].length > 64 || /\p{Cc}/u.test(entry.application))
+        return `displayname「${entry.application}」不能當作 Application Portal 的名稱：1–64 個字，不可含控制字元。`;
+    return undefined;
+}

package/dist/runtime/executor-digests.json

@@ -53,5 +53,27 @@
             "armv7": "b65a14f0fc77a1d3221c7dc6781eb66059aa200956b094d58a62bd1cad10f116"
         },
         "goToolchain": "go1.26.9"
+    },
+    "0.9.5": {
+        "x86_64": "fc3c206b6a8e30b7470cedabf6676c027960311469685eab2fe544fe6cc671ac",
+        "aarch64": "aa1a8a1b88758ad47ca69d30e9649a24a93b94b5b5fc181ce782035c2c77c497",
+        "armv7": "0c39cb98b67735fede6bbbe91471695e26707f377cbc50dd860a1d9a7fe06fcf",
+        "lifecycle": {
+            "x86_64": "819459580135e016184ad80c258350d57194d6134e8aa4cf1caf5237085b1004",
+            "aarch64": "5abcfc21403e84a0af15d972bcb819ac6fedfd9aaf5898ddc8c4bb06130f9f59",
+            "armv7": "b65a14f0fc77a1d3221c7dc6781eb66059aa200956b094d58a62bd1cad10f116"
+        },
+        "goToolchain": "go1.26.9"
+    },
+    "0.9.6": {
+        "x86_64": "4241dfebd2b819c2566eca062ee0021b99e7f86bbe4703f50833874f79b3cf54",
+        "aarch64": "923514aca8cf6576c6c52c737d53c2c7cc4bfcec40591dcec995005be41add95",
+        "armv7": "df959648ac8e6201f1cf9b86b57730c09ba1afb7ecc151ba2f530ad15dd90ccf",
+        "lifecycle": {
+            "x86_64": "819459580135e016184ad80c258350d57194d6134e8aa4cf1caf5237085b1004",
+            "aarch64": "5abcfc21403e84a0af15d972bcb819ac6fedfd9aaf5898ddc8c4bb06130f9f59",
+            "armv7": "b65a14f0fc77a1d3221c7dc6781eb66059aa200956b094d58a62bd1cad10f116"
+        },
+        "goToolchain": "go1.26.9"
     }
 }

package/dist/runtime/executor-policy.d.ts

@@ -1,8 +1,11 @@
 import type { RootOp } from '../standalone/root-ops.js';
 import type { EntryMode } from '../standalone/manifest.js';
+import { type PortalDeclaration, type PortalEntry } from '../portal/alias.js';
 export declare const FILE_OPERATIONS: readonly ["files.list", "files.info", "files.createFolder", "files.checkPermission", "files.write", "files.read", "files.rename", "files.copy", "files.move", "files.delete"];
 /** Started File Station tasks are followed with these; they are implied, never declared. */
 export declare const FILE_TASK_OPERATIONS: readonly ["files.taskStatus", "files.taskCancel"];
+/** An executor that registers the portal entry serves both, and only with a policy `portal`. */
+export declare const PORTAL_OPERATIONS: readonly ["portal.register", "portal.unregister"];
 export interface DelegateCapability {
     operations: string[];
     scope: string;
@@ -21,6 +24,8 @@ export interface ExecutorPolicy {
     lifetime?: 'until-revoked';
     package: string;
     operations: string[];
+    /** Below DSM 7.2 the executor registers this Application Portal entry; DSM 7.1 refuses web-config for unsigned packages. */
+    portal?: PortalEntry;
     root: Record<string, string>;
 }
 /** The exact policy file bytes whose sha256 is the policy pin. */
@@ -34,6 +39,9 @@ export declare function executorPolicy(m: {
         rootOps?: true;
     };
     rootOps?: RootOp[];
+    portal?: PortalDeclaration;
+    os_min_ver?: string;
+    displayname?: string;
 }): ExecutorPolicy;
 /** Inventory rejects malformed extensions even if a caller recomputes every pin. */
 export declare function validExecutorPolicy(value: unknown, pkg: string): value is ExecutorPolicy;

package/dist/runtime/executor-policy.js

@@ -1,9 +1,13 @@
 import { createHash } from 'node:crypto';
 import { MOVE_FROM_STAGING, DELEGATE_EXTENSION_OPERATIONS } from './delegate-contract.js';
+import { portalByExecutor } from '../build-spk/dsm-version.js';
+import { portalEntryProblem } from '../portal/alias.js';
 export const FILE_OPERATIONS = ['files.list', 'files.info', 'files.createFolder', 'files.checkPermission', 'files.write', 'files.read', 'files.rename', 'files.copy', 'files.move', 'files.delete'];
 /** Started File Station tasks are followed with these; they are implied, never declared. */
 export const FILE_TASK_OPERATIONS = ['files.taskStatus', 'files.taskCancel'];
 const TASK_STARTING_OPERATIONS = ['files.copy', 'files.move', 'files.delete'];
+/** An executor that registers the portal entry serves both, and only with a policy `portal`. */
+export const PORTAL_OPERATIONS = ['portal.register', 'portal.unregister'];
 export function validDelegate(value) {
     if (!value || typeof value !== 'object' || Array.isArray(value))
         return false;
@@ -24,7 +28,8 @@ export const executorPolicyText = (policy) => JSON.stringify(policy) + '\n';
 export function executorPolicy(m) {
     if (m.capabilities.delegate && !validDelegate(m.capabilities.delegate))
         throw new Error('[EXECUTOR_POLICY] Invalid delegate operations or scope.');
-    const operations = ['status'];
+    const portal = executorPortal(m);
+    const operations = ['status', ...(portal ? PORTAL_OPERATIONS : [])];
     if (m.capabilities.delegate) {
         operations.push('delegate.create', 'delegate.list', 'delegate.revoke', ...m.capabilities.delegate.operations);
         if (m.capabilities.delegate.operations.some(op => TASK_STARTING_OPERATIONS.includes(op)))
@@ -41,21 +46,33 @@ export function executorPolicy(m) {
     const d = m.capabilities.delegate;
     return { v: 1, package: m.package, app: `SYNO.SDS.${m.package}.Instance`, ...(m.entry ? { entry: m.entry } : {}), ...(d ? { scope: d.scope } : {}),
         ...(d?.lifetime ? { destinations: [...d.destinations].sort(), lifetime: d.lifetime } : {}),
-        operations: [...new Set(operations)].sort(), root };
+        operations: [...new Set(operations)].sort(), ...(portal ? { portal } : {}), root };
+}
+/** The entry the executor registers: a portal App whose os_min_ver is below DSM 7.2. */
+function executorPortal(m) {
+    if (!m.portal || !m.os_min_ver || !portalByExecutor(m.os_min_ver))
+        return undefined;
+    const entry = { application: m.displayname ?? '', alias: m.portal.alias };
+    const problem = portalEntryProblem(m.package, entry);
+    if (problem)
+        throw new Error(`[EXECUTOR_POLICY] ${problem}`);
+    return entry;
 }
 /** Inventory rejects malformed extensions even if a caller recomputes every pin. */
 export function validExecutorPolicy(value, pkg) {
     if (!value || typeof value !== 'object' || Array.isArray(value))
         return false;
     const p = value;
-    if (Object.keys(p).some(key => !['v', 'package', 'app', 'entry', 'scope', 'destinations', 'lifetime', 'operations', 'root'].includes(key))
+    if (Object.keys(p).some(key => !['v', 'package', 'app', 'entry', 'scope', 'destinations', 'lifetime', 'operations', 'portal', 'root'].includes(key))
         || p.v !== 1 || p.package !== pkg || p.app !== `SYNO.SDS.${pkg}.Instance`
         || 'entry' in p && p.entry !== 'admin-only' && p.entry !== 'app-privilege'
         || !Array.isArray(p.operations) || !p.operations.includes('status') || new Set(p.operations).size !== p.operations.length
         || !p.root || typeof p.root !== 'object' || Array.isArray(p.root))
         return false;
     const base = ['status', 'root.run', 'delegate.create', 'delegate.list', 'delegate.revoke'];
-    if (p.operations.some(op => ![...base, ...FILE_OPERATIONS, ...FILE_TASK_OPERATIONS, ...DELEGATE_EXTENSION_OPERATIONS].includes(op)))
+    if (p.operations.some(op => ![...base, ...FILE_OPERATIONS, ...FILE_TASK_OPERATIONS, ...DELEGATE_EXTENSION_OPERATIONS, ...PORTAL_OPERATIONS].includes(op)))
+        return false;
+    if (!PORTAL_OPERATIONS.every(op => p.operations.includes(op) === (p.portal !== undefined)) || p.portal !== undefined && !validPortalEntry(p.portal, pkg))
         return false;
     const delegated = p.operations.some(op => op.startsWith('files.') || op.startsWith('delegate.'));
     if (!delegated)
@@ -65,5 +82,12 @@ export function validExecutorPolicy(value, pkg) {
     if (!validDelegate(capability))
         return false;
     const expected = executorPolicy({ package: pkg, capabilities: { delegate: capability, ...(p.operations.includes('root.run') ? { rootOps: true } : {}) } }).operations;
-    return expected.length === p.operations.length && expected.every(op => p.operations.includes(op));
+    const declared = p.operations.filter(op => !PORTAL_OPERATIONS.includes(op));
+    return expected.length === declared.length && expected.every(op => declared.includes(op));
+}
+function validPortalEntry(value, pkg) {
+    if (!value || typeof value !== 'object' || Array.isArray(value) || Object.keys(value).some(key => key !== 'application' && key !== 'alias'))
+        return false;
+    const { application, alias } = value;
+    return typeof application === 'string' && typeof alias === 'string' && portalEntryProblem(pkg, { application, alias }) === undefined;
 }

package/dist/runtime/uninstall-cleanup.d.ts

@@ -9,5 +9,9 @@ export interface UninstallCleanupOptions {
     executor?: boolean;
     /** The App declares a Login Portal alias; only the executor tier can. */
     portal?: boolean;
+    /** Below DSM 7.2 the executor registered the App's Application Portal entry. */
+    portalEntry?: boolean;
 }
-export declare function uninstallCleanup(pkg: string, { executor, portal }?: UninstallCleanupOptions): UninstallCleanupItem[];
+/** The root commands that remove an Application Portal entry the executor could not unregister. */
+export declare function portalEntryCleanupCommands(pkg: string): string[];
+export declare function uninstallCleanup(pkg: string, { executor, portal, portalEntry }?: UninstallCleanupOptions): UninstallCleanupItem[];

package/dist/runtime/uninstall-cleanup.js

@@ -1,5 +1,14 @@
+/** The root commands that remove an Application Portal entry the executor could not unregister. */
+export function portalEntryCleanupCommands(pkg) {
+    return [
+        `rm -f /usr/syno/etc/www/app.d/${pkg}.json /usr/syno/etc/www/app.d/${pkg}.mustache /usr/syno/etc/packages/${pkg}/AppPortal.json`,
+        `for c in dsm www alias .alias; do n=$c.syno-app-portal.${pkg}.conf; synow3tool --disable-nginx-confd=$n; synow3tool --unreg-nginx-confd=$n; done`,
+        `for c in server .server; do n=$c.syno-app-portal.${pkg}.conf; synow3tool --disable-nginx-sites=$n; synow3tool --unreg-nginx-sites=$n; done`,
+        'nginx -t && synow3tool --nginx=reload',
+    ];
+}
 const AUTOMATIC_FAILED = 'Only if automatic cleanup failed after uninstall; see the system log entry synopkgland-executor.';
-export function uninstallCleanup(pkg, { executor = false, portal = false } = {}) {
+export function uninstallCleanup(pkg, { executor = false, portal = false, portalEntry = false } = {}) {
     const items = [
         { target: `@appdata/${pkg}, @appconf/${pkg}, @apphome/${pkg}`, condition: 'After uninstall, if retained data or empty DSM directories are no longer needed.', action: 'Back up retained data; an administrator may remove only these package-specific directories. The delete-data checkbox empties their contents and preserves DSM directory roots.' },
         { target: `@appshare/${pkg}, /usr/syno/etc/packages/${pkg}`, condition: 'After uninstall, if DSM leaves package infrastructure or a package-config symlink.', action: 'Administrator: inspect these package-specific paths and remove unused infrastructure; do not follow the symlink to delete shared data.' },
@@ -8,6 +17,7 @@ export function uninstallCleanup(pkg, { executor = false, portal = false } = {})
             ? { target: `SYNO.SDS.${pkg}.Instance rules in Application Privileges`, condition: AUTOMATIC_FAILED, action: 'The root executor removes these rules automatically through the Application Privileges API on uninstall. Administrator: remove surviving rules in Control Panel > Application Privileges; DSM would apply them again to a later install under the same name.' }
             : { target: `SYNO.SDS.${pkg}.Instance rules in Application Privileges`, condition: 'After uninstall, if this package will not be reinstalled.', action: 'DSM keeps these rules in /etc/synoappprivilege.db and applies them again to a later install under the same name. Administrator: remove them in Control Panel > Application Privileges.' },
         ...(executor && portal ? [{ target: `${pkg} Login Portal alias`, condition: AUTOMATIC_FAILED, action: 'DSM removes the alias configuration without reloading its web server; the root executor then reloads the web server automatically. Administrator: if the alias still opens a DSM page, save an application alias in Control Panel > Login Portal > Applications to reload it, or restart the NAS.' }] : []),
+        ...(executor && portalEntry ? [{ target: `${pkg} Application Portal entry`, condition: 'After uninstall, if the executor was not running or was never approved, so it could not remove the entry.', action: `Administrator, as root: ${portalEntryCleanupCommands(pkg).join('; ')}` }] : []),
         { target: `${pkg} package account/group`, condition: 'After uninstall, only if this package will not be reinstalled and the identity is unused.', action: 'Administrator: review DSM internal account/group and associated ACLs before cleanup. Package scripts do not delete system identities.' },
     ];
     if (executor)

package/dist/standalone/build.js

@@ -4,7 +4,7 @@ import { existsSync, mkdirSync, mkdtempSync, rmSync } from "node:fs";
 import { tmpdir } from "node:os";
 import { join } from "node:path";
 import { goBuildEnv } from "../build-spk/dsm-arch.js";
-import { resolveMinDsm, DEFAULT_MIN_DSM, isDsmAtLeast, PORTAL_MIN_DSM, portalMinDsmMessage } from "../build-spk/dsm-version.js";
+import { resolveMinDsm, DEFAULT_MIN_DSM, isDsmAtLeast, PORTAL_EXECUTOR_MIN_DSM, portalByExecutor, portalMinDsmMessage } from "../build-spk/dsm-version.js";
 import { checkCgiBinary } from "./binary.js";
 import { loadStandaloneManifest } from "./manifest.js";
 import { assembleStandaloneSpk, StandaloneBuildError } from "./spk.js";
@@ -80,7 +80,7 @@ export async function buildStandalone(options) {
     if (manifest.capabilities.rootOps === true && !isDsmAtLeast(manifest.os_min_ver, DEFAULT_MIN_DSM)) {
         throw new StandaloneBuildError("STANDALONE_OS_MIN_VER_INVALID", `root templates require DSM ${DEFAULT_MIN_DSM} or later.`);
     }
-    if (manifest.portal && !isDsmAtLeast(manifest.os_min_ver, PORTAL_MIN_DSM)) {
+    if (manifest.portal && !isDsmAtLeast(manifest.os_min_ver, PORTAL_EXECUTOR_MIN_DSM)) {
         throw new StandaloneBuildError("STANDALONE_PORTAL_MIN_DSM", `[STANDALONE_PORTAL_MIN_DSM] ${portalMinDsmMessage(manifest.os_min_ver, "portal")}`);
     }
     const jobs = checkJobs(options.jobs);
@@ -160,7 +160,7 @@ async function backendFor(manifest, arch, work, run) {
         ...(manifest.capabilities.identity ? [`-X main.identity=${manifest.capabilities.identity}`] : []),
         ...(manifest.capabilities.files || manifest.capabilities.delegate ? [`-X main.fileStation=session`] : []),
         ...(manifest.entry ? [`-X main.entry=${manifest.entry}`] : []),
-        ...(manifest.portal ? ["-X main.portal=on"] : []),
+        ...(manifest.portal ? [`-X main.portal=${portalByExecutor(manifest.os_min_ver) ? "executor" : "on"}`] : []),
     ].join(" ");
     const result = await run("go", ["build", "-trimpath", "-buildvcs=false", "-ldflags", ldflags, "-o", out, backend.main], {
         cwd: backend.dir,

package/dist/standalone/dsm-window.js

@@ -4,6 +4,7 @@ import { PASSWORD_CONFIRM, ROOT_PANEL, ROOT_RUNTIME, rootPanelCatalogs } from ".
 import { HOST_ADAPTER_RUNTIME } from "./host-adapter.js";
 import { permitsOrdinaryUsers } from "./api-permissions.js";
 import { PORTAL_RUNTIME } from "./portal-window.js";
+import { portalByExecutor } from "../build-spk/dsm-version.js";
 import { uiTitleFields } from "../build-spk/ui-texts.js";
 /** Same path the generated wrapper POSTs to, and the payload location of the CGI. */
 export const CGI_PAYLOAD_PATH = "ui/cgi/api.cgi";
@@ -172,6 +173,15 @@ ${root ? root.definitions : ""}${manifest.portal ? renderPortalDefinition(ns) :
   document.head.appendChild(js);
 };
 
+// DSM reopens a window at the size it was last left at, even one saved on a
+// larger screen, and only moves a window that does not fit: keep it inside.
+${ns}.fitDesktop = function (size) {
+  var taskbar = SYNO.SDS.TaskBar ? SYNO.SDS.TaskBar.height() : 0;
+  size.width = Math.min(size.width, Ext.lib.Dom.getViewWidth());
+  size.height = Math.min(size.height, Ext.lib.Dom.getViewHeight() - taskbar);
+  return size;
+};
+
 Ext.define(${JSON.stringify(`${ns}.Instance`)}, {
   extend: "SYNO.SDS.AppInstance",
   appWindowName: ${JSON.stringify(`${ns}.MainWindow`)}
@@ -180,10 +190,13 @@ Ext.define(${JSON.stringify(`${ns}.Instance`)}, {
 Ext.define(${JSON.stringify(`${ns}.MainWindow`)}, {
   extend: "SYNO.SDS.AppWindow",
   constructor: function (config) {
-    this.callParent([Ext.apply({
+    this.callParent([${ns}.fitDesktop(Ext.apply({
       width: 960, height: 640, minWidth: 700, minHeight: 420, layout: "fit",
       ${root ? root.html : `html: '<div class="dsmapp-root" style="height:100%"></div>'`}
-    }, config)]);
+    }, config))]);
+  },
+  getRestoreSizePos: function (config) {
+    return ${ns}.fitDesktop(Ext.apply({ width: config.width, height: config.height }, this.callParent(arguments)));
   },
   onOpen: function () {
     this.callParent(arguments);
@@ -267,7 +280,7 @@ ${PORTAL_RUNTIME}
 function renderPortalAccess(ns, manifest) {
     return `${ns}.createPortalAccess({
             appId: ${JSON.stringify(`${ns}.Instance`)},
-            defaultAlias: ${JSON.stringify(manifest.portal.alias)},
+            defaultAlias: ${JSON.stringify(manifest.portal.alias)},${portalByExecutor(manifest.os_min_ver) ? "\n            entry: true," : ""}
             isAdmin: function () { return ${ns}.sessionUser().isAdmin; },
             send: ${ns}.webApi(me),
             call: ${ns}.call,