@synopackageland/cli 0.9.3 → 0.9.5

package/dist/standalone/inspect-spk.js

@@ -6,7 +6,7 @@ import { tmpdir } from "node:os";
 import { join } from "node:path";
 import * as tar from "tar";
 import { familyOfArchToken, NATIVE_ARCH_FAMILIES } from "../build-spk/dsm-arch.js";
-import { CONTAINER_MIN_DSM, isDsmAtLeast, PORTAL_MIN_DSM } from "../build-spk/dsm-version.js";
+import { CONTAINER_MIN_DSM, isDsmAtLeast, PORTAL_EXECUTOR_MIN_DSM, PORTAL_MIN_DSM, PORTAL_MIN_DSM_REASON } from "../build-spk/dsm-version.js";
 import { ELF_MACHINE } from "./binary.js";
 import { CGI_PAYLOAD_PATH, entryLauncherAccess } from "./dsm-window.js";
 import { daemonConfig, readDaemon } from "./daemon.js";
@@ -73,7 +73,7 @@ export async function inspectSpk(spkPath, expectedKind) {
         // A Compose App has no executor, so its SPK never carries a portal.
         const portal = standalone ? await recoverPortal(dir, info, `SYNO.SDS.${info.package}.Instance`, paths, payload, findings) : undefined;
         if (portal && info.os_min_ver && OS_MIN_VER.test(info.os_min_ver) && !isDsmAtLeast(info.os_min_ver, PORTAL_MIN_DSM)) {
-            findings.push(`INFO os_min_ver「${info.os_min_ver}」低於 portal 需要的 DSM ${PORTAL_MIN_DSM}；DSM 7.1.1 以錯誤 320 拒裝帶 web-config app-portal 的未簽章套件，7.2 未驗證`);
+            findings.push(`INFO os_min_ver「${info.os_min_ver}」低於 portal 需要的 DSM ${PORTAL_MIN_DSM}；${PORTAL_MIN_DSM_REASON}`);
         }
         checkConf(dir, findings, kind, background, sharedFolder, info.package, portal);
         checkScripts(dir, findings);
@@ -96,6 +96,9 @@ export async function inspectSpk(spkPath, expectedKind) {
             executor = inspected.executor;
             if (executor)
                 findings.push(...inspectExecutorAnchor(readFileSync(join(dir, "INFO"), "utf8"), executor.executorDigest));
+            if (executor?.policy.portal && info.os_min_ver && OS_MIN_VER.test(info.os_min_ver) && !isDsmAtLeast(info.os_min_ver, PORTAL_EXECUTOR_MIN_DSM)) {
+                findings.push(`INFO os_min_ver「${info.os_min_ver}」低於 executor 註冊 portal 需要的 DSM ${PORTAL_EXECUTOR_MIN_DSM}`);
+            }
             if (payload.find(p => p.path === "executor/executor")?.mode !== "0755")
                 findings.push("Executor must be executable.");
             if (payload.find(p => p.path === "executor/lifecycle")?.mode !== "0755")
@@ -107,7 +110,7 @@ export async function inspectSpk(spkPath, expectedKind) {
                         findings.push(`Executor scripts/${hook} differs from fixed lifecycle.`);
                 }
             }
-            for (const [name, text] of Object.entries(renderUninstallWizardFiles(info.package, "native", { executor: true, portal: Boolean(portal) }))) {
+            for (const [name, text] of Object.entries(renderUninstallWizardFiles(info.package, "native", { executor: true, portal: Boolean(portal), portalEntry: Boolean(executor?.policy.portal) }))) {
                 if (readOptional(join(dir, "WIZARD_UIFILES", name)) !== text)
                     findings.push(`Executor WIZARD_UIFILES/${name} is missing cleanup guidance.`);
             }
@@ -132,8 +135,9 @@ export async function inspectSpk(spkPath, expectedKind) {
             icon,
             ...(executor ? { executor } : {}),
             ...(portal ? { portal: { appId: portal.appId, alias: portal.alias } } : {}),
+            ...(executor?.policy.portal ? { portal: { appId: executor.policy.app, alias: executor.policy.portal.alias } } : {}),
             ...(metadata.entry ? { entry: metadata.entry } : {}),
-            ...(standalone ? { uninstallCleanup: uninstallCleanup(info.package, { executor: hasExecutor, portal: Boolean(portal) }) } : {}),
+            ...(standalone ? { uninstallCleanup: uninstallCleanup(info.package, { executor: hasExecutor, portal: Boolean(portal), portalEntry: Boolean(executor?.policy.portal) }) } : {}),
             package: info.package,
             version: info.version,
             arch: info.arch,

package/dist/standalone/manifest.js

@@ -8,10 +8,10 @@ import { checkGlossary, loadCatalogs, readInfoTranslations } from "./i18n.js";
 import { loadRootOps, ROOT_OPS_DIR } from "./root-ops.js";
 import { readDaemon } from "./daemon.js";
 import { readBackground } from "./background.js";
-import { DEFAULT_MIN_DSM, isDsmAtLeast, PORTAL_MIN_DSM, portalMinDsmMessage } from "../build-spk/dsm-version.js";
+import { DEFAULT_MIN_DSM, isDsmAtLeast, PORTAL_EXECUTOR_MIN_DSM, portalByExecutor, portalMinDsmMessage } from "../build-spk/dsm-version.js";
 import { readSharedFolder } from "./shared-folder.js";
 import { floorAtAdministrators, permitsOrdinaryUsers, readApiPermissions } from "./api-permissions.js";
-import { PORTAL_REQUIRES_EXECUTOR, readPortalDeclaration } from "../portal/alias.js";
+import { PORTAL_REQUIRES_EXECUTOR, portalEntryProblem, readPortalDeclaration } from "../portal/alias.js";
 import { renderPackageIcons } from "../build-spk/dsm-icons.js";
 import { validateReproducible } from "../reproducible-config.js";
 import { SDK_MODULE, sdkRequirement } from "../runtime/sdk-source.js";
@@ -180,9 +180,13 @@ function readManifest(raw, c) {
     if (portal && !capabilities.rootOps && !capabilities.delegate) {
         c.fail("STANDALONE_PORTAL_REQUIRES_EXECUTOR", PORTAL_REQUIRES_EXECUTOR);
     }
-    if (portal && osMinVer && !isDsmAtLeast(osMinVer, PORTAL_MIN_DSM)) {
+    if (portal && osMinVer && !isDsmAtLeast(osMinVer, PORTAL_EXECUTOR_MIN_DSM)) {
         c.fail("STANDALONE_PORTAL_MIN_DSM", portalMinDsmMessage(osMinVer, "portal"));
     }
+    const entryProblem = portal && packageId && displayname && osMinVer && portalByExecutor(osMinVer)
+        ? portalEntryProblem(packageId, { application: displayname, alias: portal.alias }) : undefined;
+    if (entryProblem)
+        c.fail("STANDALONE_PORTAL_ENTRY_INVALID", entryProblem);
     if (!packageId || !version || !build || !osMinVer || !displayname || !description || !maintainer
         || !arches || !backend || !ui || (capabilities.rootOps === true && !rootOps)) {
         return undefined;

package/dist/standalone/native-layout.d.ts

@@ -1,5 +1,6 @@
 import { type PackageMetadata } from "../package-metadata.js";
 import type { CommandRunner } from './build.js';
+import { type PortalDeclaration } from '../portal/alias.js';
 export declare const LAYOUT_ARCHES: {
     readonly x86_64: readonly [2, 62];
     readonly aarch64: readonly [2, 183];
@@ -50,6 +51,8 @@ export interface NativeLayout {
         hook: Hook;
         toolkits: Partial<Record<LayoutArch, Toolkit[]>>;
     };
+    /** The product's own root helper registers this Application Portal entry; the CLI only names it in INFO. */
+    portal?: PortalDeclaration;
 }
 export declare function isNativeLayout(root: string): boolean;
 export declare function loadNativeLayout(root: string): {

package/dist/standalone/native-layout.js

@@ -9,7 +9,8 @@ import { createReproducibleTar } from '../build-spk/reproducible-archive.js';
 import { runCommand, runnerFor } from './build.js';
 import { checkJobs, commitOutputs, forEachArch } from './arch-jobs.js';
 import { validateReproducible } from '../reproducible-config.js';
-import { resolveMinDsm } from '../build-spk/dsm-version.js';
+import { isDsmAtLeast, PORTAL_EXECUTOR_MIN_DSM, resolveMinDsm } from '../build-spk/dsm-version.js';
+import { portalEntryProblem, readPortalDeclaration } from '../portal/alias.js';
 import { infoArchValue } from '../build-spk/dsm-arch.js';
 import { LIFECYCLE_SCRIPTS, REPLACE_SCRIPTS } from '../spk/dsm-spec.js';
 import { renderPackageIcons, writePackageCenterIcons } from '../build-spk/dsm-icons.js';
@@ -58,6 +59,19 @@ function anchors(value) {
     }
     return a;
 }
+// Like the anchors, INFO is the root helper's trusted copy of the entry it
+// registers in DSM's app.d: the alias, under the INFO displayname.
+const PORTAL_INFO_KEY = 'synopkgland_portal_alias';
+function portal(value, packageId) {
+    return readPortalDeclaration(value, packageId) ?? fail('portal must be {} or {alias: <lowercase letters, digits and -, 1-64, not a DSM path>}');
+}
+function checkPortal(p, packageId, displayname, osMinVer) {
+    if (!isDsmAtLeast(osMinVer, PORTAL_EXECUTOR_MIN_DSM))
+        fail(`portal needs DSM ${PORTAL_EXECUTOR_MIN_DSM} or later, where the app.d entry format is verified; os_min_ver is ${osMinVer}`);
+    const problem = portalEntryProblem(packageId, { application: displayname, alias: p.alias });
+    if (problem)
+        fail(problem);
+}
 function hook(value) {
     const h = object(value, ['command', 'cwd', 'env']);
     if (!Array.isArray(h.command) || !h.command.length || !h.command.every((x) => typeof x === 'string' && x.length > 0 && !x.includes('\0')))
@@ -90,7 +104,7 @@ export function isNativeLayout(root) {
 }
 export function loadNativeLayout(root) {
     try {
-        const m = object(parse(readFileSync(join(root, 'dsm-package.yaml'), 'utf8')), ['schema', 'backend', 'package', 'version', 'build', 'displayname', 'description', 'maintainer', 'metadata', 'os_min_ver', 'privilege', 'arches', 'layout', 'native', 'icon', 'reproducible']);
+        const m = object(parse(readFileSync(join(root, 'dsm-package.yaml'), 'utf8')), ['schema', 'backend', 'package', 'version', 'build', 'displayname', 'description', 'maintainer', 'metadata', 'os_min_ver', 'privilege', 'arches', 'layout', 'native', 'icon', 'reproducible', 'portal']);
         if (m.schema !== 2)
             fail('schema 2 required; migrate schema: 1 to schema: 2 and add backend: {kind: native}');
         const backend = object(m.backend, ['kind']);
@@ -113,6 +127,10 @@ export function loadNativeLayout(root) {
             m.icon = icon(root, m.icon);
         if (m.reproducible !== undefined)
             validateReproducible(m.reproducible);
+        if (m.portal !== undefined) {
+            m.portal = portal(m.portal, m.package);
+            checkPortal(m.portal, m.package, m.displayname, m.os_min_ver);
+        }
         const layout = object(m.layout, ['payload', 'metadata', 'binaries', 'anchors']);
         layout.payload = pathText(layout.payload);
         layout.metadata = pathText(layout.metadata);
@@ -363,6 +381,8 @@ export async function buildNativeLayout(options) {
             fail('invalid build override');
         m.build = options.build;
     }
+    if (m.portal)
+        checkPortal(m.portal, m.package, m.displayname, m.os_min_ver);
     const arches = options.arches ?? m.arches;
     if (!arches.length || new Set(arches).size !== arches.length || arches.some(a => !m.arches.includes(a)))
         fail('architecture not declared');
@@ -402,11 +422,11 @@ export async function buildNativeLayout(options) {
             await createReproducibleTar(target, join(stage, 'package.tgz'), { gzip: true });
             rmSync(target, { recursive: true });
             const fields = { package: m.package, version, arch: layoutInfoArch(arch), os_min_ver: m.os_min_ver, displayname: m.displayname, description: m.description, maintainer: m.maintainer, dsmuidir: 'ui', dsmappname: `SYNO.SDS.${m.package}.Instance`, startable: 'yes', thirdparty: 'yes', checksum: createHash('md5').update(readFileSync(join(stage, 'package.tgz'))).digest('hex') };
-            const info = [...Object.entries(fields), ...metadataInfoFields(m.metadata), ...anchorFields(m.layout.anchors ?? {}, files)];
+            const info = [...Object.entries(fields), ...metadataInfoFields(m.metadata), ...anchorFields(m.layout.anchors ?? {}, files), ...portalFields(m.portal)];
             if (new Set(info.map(([k]) => k)).size !== info.length)
                 fail('INFO anchor collides with an INFO field');
             writeFileSync(join(stage, 'INFO'), info.map(([k, v]) => `${k}="${v.replace(/([\\"$`])/g, '\\$1')}"\n`).join(''));
-            writeFileSync(join(stage, 'native-layout.json'), JSON.stringify({ format: 1, arch, binaries: binaries.map(({ path, linkage }) => ({ path, linkage })), files, ...(m.layout.anchors ? { anchors: m.layout.anchors } : {}) }));
+            writeFileSync(join(stage, 'native-layout.json'), JSON.stringify({ format: 1, arch, binaries: binaries.map(({ path, linkage }) => ({ path, linkage })), files, ...(m.layout.anchors ? { anchors: m.layout.anchors } : {}), ...(m.portal ? { portal: m.portal } : {}) }));
             const output = join(outDir, `${m.package}-${version}-${arch}.spk`);
             await createReproducibleTar(stage, output);
             return output;
@@ -423,7 +443,7 @@ export function inspectNativeLayout(dir, payload, info) {
     try {
         if (!/^[A-Za-z][A-Za-z0-9]{1,63}$/.test(info.package ?? '') || !/^\d+(\.\d+){0,3}-\d+$/.test(info.version ?? '') || !/^7\.\d+(\.\d+)?-\d+$/.test(info.os_min_ver ?? ''))
             fail('invalid native INFO identity/version/DSM');
-        const inv = object(JSON.parse(readFileSync(join(dir, 'native-layout.json'), 'utf8')), ['format', 'arch', 'binaries', 'files', 'anchors']);
+        const inv = object(JSON.parse(readFileSync(join(dir, 'native-layout.json'), 'utf8')), ['format', 'arch', 'binaries', 'files', 'anchors', 'portal']);
         if (inv.format !== 1 || !Object.hasOwn(LAYOUT_ARCHES, inv.arch) || layoutInfoArch(inv.arch) !== info.arch)
             fail('invalid native layout inventory');
         checkLayoutMetadata(dir, true, info.package);
@@ -442,6 +462,10 @@ export function inspectNativeLayout(dir, payload, info) {
         if (createHash('md5').update(readFileSync(join(dir, 'package.tgz'))).digest('hex') !== info.checksum)
             fail('package checksum mismatch');
         checkInfoAnchors(readFileSync(join(dir, 'INFO'), 'utf8'), inv.anchors === undefined ? {} : anchors(inv.anchors), actual);
+        const declared = inv.portal === undefined ? undefined : portal(inv.portal, info.package);
+        if (declared)
+            checkPortal(declared, info.package, info.displayname ?? '', info.os_min_ver);
+        checkInfoPortal(readFileSync(join(dir, 'INFO'), 'utf8'), declared);
         return [];
     }
     catch (e) {
@@ -457,3 +481,11 @@ function checkInfoAnchors(info, declared, files) {
     if (JSON.stringify(lines.sort()) !== JSON.stringify(expected.sort()))
         fail('INFO anchors do not match the payload');
 }
+function portalFields(declared) {
+    return declared ? [[PORTAL_INFO_KEY, declared.alias]] : [];
+}
+function checkInfoPortal(info, declared) {
+    const lines = info.split('\n').filter(line => line.startsWith('synopkgland_portal_'));
+    if (JSON.stringify(lines) !== JSON.stringify(portalFields(declared).map(([key, value]) => `${key}="${value}"`)))
+        fail('INFO portal alias does not match the declared portal');
+}

package/dist/standalone/native-root-window.d.ts

@@ -16,7 +16,8 @@ export interface RootTask {
  * - authorize: DSM's own password confirmation, then one disabled root task
  *   with exactly the embedded script. The one-use token goes into that single
  *   create call and is never kept.
- * - run: re-reads the task and runs it only if it is still exactly ours, then
+ * - run: re-reads the task and runs it only if it is still exactly ours (the
+ *   first run after an authorize uses the task that authorize just read back), then
  *   waits for its history entry and asks the backend for the output. A queued
  *   or running task keeps the wait going, up to RUN_LIMIT_MS (loaded NAS took
  *   4.5 minutes), and `options.progress({op, state, elapsedMs})` hears each poll. Repair

package/dist/standalone/native-root-window.js

@@ -7,7 +7,8 @@ import { versionUnsupported } from "../runtime/dsm-version.js";
  * - authorize: DSM's own password confirmation, then one disabled root task
  *   with exactly the embedded script. The one-use token goes into that single
  *   create call and is never kept.
- * - run: re-reads the task and runs it only if it is still exactly ours, then
+ * - run: re-reads the task and runs it only if it is still exactly ours (the
+ *   first run after an authorize uses the task that authorize just read back), then
  *   waits for its history entry and asks the backend for the output. A queued
  *   or running task keeps the wait going, up to RUN_LIMIT_MS (loaded NAS took
  *   4.5 minutes), and `options.progress({op, state, elapsedMs})` hears each poll. Repair
@@ -18,8 +19,9 @@ import { versionUnsupported } from "../runtime/dsm-version.js";
  */
 export const ROOT_RUNTIME = `function createRootAccess(options) {
   var API = "SYNO.Core.TaskScheduler";
-  var POLL_MS = 500, MAX_POLL_MS = 2000, RUN_LIMIT_MS = 10 * 60 * 1000;
-  var byOp = {}, running = {};
+  var POLL_MS = 500, MAX_POLL_MS = 1000, RUN_LIMIT_MS = 10 * 60 * 1000;
+  // The task an authorize just read back as exactly ours, for the run that follows.
+  var byOp = {}, running = {}, verified = {};
   var legacy = null, probe = null;
   var versionUnsupported = ${versionUnsupported.toString()};
   options.tasks.forEach(function (task) { byOp[task.op] = task; });
@@ -218,9 +220,14 @@ export const ROOT_RUNTIME = `function createRootAccess(options) {
       });
     });
   }
+  function verify(op) {
+    var ref = verified[op];
+    delete verified[op];
+    return ref && op !== "helper_repair" ? Promise.resolve({ state: "ready", ref: ref }) : find(byOp[op]);
+  }
   function performRun(op) {
     return begin(op).then(function (task) {
-      return find(task).then(function (found) {
+      return verify(op).then(function (found) {
         if (found.state !== "ready") throw fail("root_not_ready");
         var consent = op === "helper_repair" ? options.confirmPassword() : Promise.resolve({ confirmed: true });
         return consent.then(function (confirmation) {
@@ -239,9 +246,10 @@ export const ROOT_RUNTIME = `function createRootAccess(options) {
       return begin(op).then(find).then(function (found) { return found.state; });
     },
     authorize: function (op) {
+      delete verified[op];
       return begin(op).then(function (task) {
         return find(task).then(function (found) {
-          if (found.state === "ready") return "ready";
+          if (found.state === "ready") { verified[op] = found.ref; return "ready"; }
           if (found.state === "conflict") throw fail("root_conflict");
           return options.confirmPassword().then(function (confirmation) {
             if (!confirmation || confirmation.confirmed !== true) return "cancelled";
@@ -259,6 +267,7 @@ export const ROOT_RUNTIME = `function createRootAccess(options) {
               return find(task);
             }).then(function (after) {
               if (after.state !== "ready") throw fail("root_verify_failed");
+              verified[op] = after.ref;
               return "ready";
             });
           });
@@ -277,6 +286,7 @@ export const ROOT_RUNTIME = `function createRootAccess(options) {
       return pending;
     },
     remove: function (op) {
+      delete verified[op];
       return begin(op).then(function (task) {
         return find(task).then(function (found) {
           if (found.state === "missing") return "missing";

package/dist/standalone/portal-window.d.ts

@@ -12,8 +12,10 @@ export declare const PORTAL_MESSAGES: Record<string, Record<PortalLocale, string
  * Control Panel shortcut.
  *
  * `status()` resolves `{state, alias?, url?, canManage, controlPanel,
- * defaultAlias}`; `apply(alias)` and `disable()` resolve the new status or
- * reject `{code}`; `openControlPanel()` opens Login Portal > Applications.
+ * defaultAlias, entry?}`; `apply(alias)` and `disable()` resolve the new
+ * status or reject `{code}`. With `options.entry` (below DSM 7.2) the
+ * backend's `portal.status` also reports the executor's entry, and
+ * administrators get `register()` and `unregister()`; `openControlPanel()` opens Login Portal > Applications.
  * `messages` is the panel text in the window's locale; `mountPanel(element)`
  * renders a plain panel for UIs without their own.
  */

package/dist/standalone/portal-window.js

@@ -4,17 +4,22 @@ export const PORTAL_MESSAGES = {
     title: { en: "Application Portal", "zh-TW": "應用程式入口", "zh-CN": "应用程序门户", ja: "アプリケーションポータル", ko: "응용 프로그램 포털", de: "Anwendungsportal", fr: "Portail d'application", es: "Portal de aplicaciones", it: "Portale applicazioni" },
     link: { en: "Direct link after DSM sign-in:", "zh-TW": "DSM 登入後的直接連結：", "zh-CN": "DSM 登录后的直接链接：", ja: "DSM サインイン後の直接リンク：", ko: "DSM 로그인 후 바로 가기 링크:", de: "Direkter Link nach der DSM-Anmeldung:", fr: "Lien direct après connexion à DSM :", es: "Enlace directo tras iniciar sesión en DSM:", it: "Link diretto dopo l'accesso a DSM:" },
     inactive: { en: "Not active. Apply an alias to let users open this app directly after DSM sign-in.", "zh-TW": "尚未啟用。套用別名後，使用者可在 DSM 登入後直接開啟這個 App。", "zh-CN": "尚未启用。应用别名后，用户可在 DSM 登录后直接打开此应用。", ja: "無効です。エイリアスを適用すると、DSM サインイン後にこのアプリを直接開けます。", ko: "비활성 상태입니다. 별칭을 적용하면 DSM 로그인 후 이 앱을 바로 열 수 있습니다.", de: "Nicht aktiv. Wenden Sie einen Alias an, damit Benutzer diese App nach der DSM-Anmeldung direkt öffnen können.", fr: "Inactif. Appliquez un alias pour ouvrir cette application directement après connexion à DSM.", es: "Inactivo. Aplique un alias para abrir esta aplicación directamente tras iniciar sesión en DSM.", it: "Non attivo. Applica un alias per aprire questa app direttamente dopo l'accesso a DSM." },
-    askAdmin: { en: "Ask an administrator to set this up", "zh-TW": "請管理員設定", "zh-CN": "请管理员设置", ja: "管理者に設定を依頼してください", ko: "관리자에게 설정을 요청하세요", de: "Bitten Sie einen Administrator, dies einzurichten", fr: "Demandez à un administrateur de le configurer", es: "Pida a un administrador que lo configure", it: "Chiedi a un amministratore di configurarlo" },
+    askAdmin: { en: "Ask an administrator to set this up", "zh-TW": "請管理員設定", "zh-CN": "请管理员设置", ja: "管理者に設定を依頼してください", ko: "관리자에게 설정을 요청하십시오", de: "Bitten Sie einen Administrator, dies einzurichten", fr: "Demandez à un administrateur de le configurer", es: "Pida a un administrador que lo configure", it: "Chiedi a un amministratore di configurarlo" },
     alias: { en: "Alias", "zh-TW": "別名", "zh-CN": "别名", ja: "エイリアス", ko: "별칭", de: "Alias", fr: "Alias", es: "Alias", it: "Alias" },
     apply: { en: "Apply", "zh-TW": "套用", "zh-CN": "应用", ja: "適用", ko: "적용", de: "Übernehmen", fr: "Appliquer", es: "Aplicar", it: "Applica" },
     disable: { en: "Turn off", "zh-TW": "停用", "zh-CN": "停用", ja: "無効にする", ko: "끄기", de: "Ausschalten", fr: "Désactiver", es: "Desactivar", it: "Disattiva" },
     advanced: { en: "Advanced settings in Control Panel", "zh-TW": "在控制台進行進階設定", "zh-CN": "在控制面板中进行高级设置", ja: "コントロールパネルの詳細設定", ko: "제어판의 고급 설정", de: "Erweiterte Einstellungen in der Systemsteuerung", fr: "Paramètres avancés dans le Panneau de configuration", es: "Ajustes avanzados en el Panel de control", it: "Impostazioni avanzate nel Pannello di controllo" },
     controlPanel: { en: "Open Control Panel Application Portal", "zh-TW": "開啟控制台 Application Portal", "zh-CN": "打开控制面板 Application Portal", ja: "コントロールパネルの Application Portal を開く", ko: "제어판 Application Portal 열기", de: "Application Portal in der Systemsteuerung öffnen", fr: "Ouvrir Application Portal dans le Panneau de configuration", es: "Abrir Application Portal en el Panel de control", it: "Apri Application Portal nel Pannello di controllo" },
-    portal_alias_invalid: { en: "Use 1-64 lowercase letters, digits or hyphens, not starting or ending with a hyphen.", "zh-TW": "請使用 1–64 個小寫英文字母、數字或連字號，且不可以連字號開頭或結尾。", "zh-CN": "请使用 1–64 个小写英文字母、数字或连字符，且不能以连字符开头或结尾。", ja: "1～64 文字の小文字英字・数字・ハイフンを使用し、先頭と末尾にハイフンは使えません。", ko: "1~64자의 영문 소문자, 숫자 또는 하이픈을 사용하고 하이픈으로 시작하거나 끝나지 않게 하세요.", de: "Verwenden Sie 1–64 Kleinbuchstaben, Ziffern oder Bindestriche, ohne Bindestrich am Anfang oder Ende.", fr: "Utilisez 1 à 64 lettres minuscules, chiffres ou tirets, sans tiret au début ni à la fin.", es: "Use de 1 a 64 letras minúsculas, dígitos o guiones, sin guion al principio ni al final.", it: "Usa da 1 a 64 lettere minuscole, cifre o trattini, senza trattino all'inizio o alla fine." },
-    portal_alias_reserved: { en: "DSM already uses this alias. Choose another one.", "zh-TW": "DSM 已使用這個別名，請改用其他別名。", "zh-CN": "DSM 已使用此别名，请改用其他别名。", ja: "このエイリアスは DSM で使用されています。別のものを選んでください。", ko: "DSM에서 이미 사용하는 별칭입니다. 다른 별칭을 선택하세요.", de: "DSM verwendet diesen Alias bereits. Wählen Sie einen anderen.", fr: "DSM utilise déjà cet alias. Choisissez-en un autre.", es: "DSM ya usa este alias. Elija otro.", it: "DSM usa già questo alias. Scegline un altro." },
-    portal_alias_in_use: { en: "Another app already uses this alias. Choose another one.", "zh-TW": "另一個 App 已使用這個別名，請改用其他別名。", "zh-CN": "另一个应用已使用此别名，请改用其他别名。", ja: "別のアプリがこのエイリアスを使用しています。別のものを選んでください。", ko: "다른 앱이 이미 이 별칭을 사용합니다. 다른 별칭을 선택하세요.", de: "Eine andere App verwendet diesen Alias bereits. Wählen Sie einen anderen.", fr: "Une autre application utilise déjà cet alias. Choisissez-en un autre.", es: "Otra aplicación ya usa este alias. Elija otro.", it: "Un'altra app usa già questo alias. Scegline un altro." },
+    entryOff: { en: "This app has no Application Portal entry yet. Enable the entry so that an alias can open it after DSM sign-in.", "zh-TW": "這個 App 尚未加入應用程式入口。啟用入口後，即可用別名在 DSM 登入後直接開啟。", "zh-CN": "此应用尚未加入应用程序门户。启用入口后，即可用别名在 DSM 登录后直接打开。", ja: "このアプリはまだアプリケーションポータルに登録されていません。エントリを有効にすると、DSM サインイン後にエイリアスで直接開けます。", ko: "이 앱은 아직 응용 프로그램 포털에 등록되지 않았습니다. 항목을 활성화하면 DSM 로그인 후 별칭으로 바로 열 수 있습니다.", de: "Diese App hat noch keinen Eintrag im Anwendungsportal. Aktivieren Sie den Eintrag, damit ein Alias sie nach der DSM-Anmeldung öffnet.", fr: "Cette application n'a pas encore d'entrée dans le Portail d'application. Activez l'entrée pour qu'un alias l'ouvre après connexion à DSM.", es: "Esta aplicación aún no tiene una entrada en el Portal de aplicaciones. Active la entrada para que un alias la abra tras iniciar sesión en DSM.", it: "Questa app non ha ancora una voce nel Portale applicazioni. Attivare la voce per aprirla con un alias dopo l'accesso a DSM." },
+    cleanupRequired: { en: "The Application Portal entry was not fully removed. Remove the entry again.", "zh-TW": "應用程式入口未完全移除。請再移除一次入口。", "zh-CN": "应用程序门户入口未完全移除。请再移除一次入口。", ja: "アプリケーションポータルのエントリが完全に削除されていません。もう一度エントリを削除してください。", ko: "응용 프로그램 포털 항목이 완전히 제거되지 않았습니다. 항목을 다시 제거하십시오.", de: "Der Eintrag im Anwendungsportal wurde nicht vollständig entfernt. Entfernen Sie den Eintrag erneut.", fr: "L'entrée du Portail d'application n'a pas été entièrement supprimée. Supprimez de nouveau l'entrée.", es: "La entrada del Portal de aplicaciones no se eliminó por completo. Elimine la entrada de nuevo.", it: "La voce del Portale applicazioni non è stata rimossa completamente. Rimuovere di nuovo la voce." },
+    register: { en: "Enable entry", "zh-TW": "啟用入口", "zh-CN": "启用入口", ja: "エントリを有効にする", ko: "항목 활성화", de: "Eintrag aktivieren", fr: "Activer l'entrée", es: "Activar entrada", it: "Attiva voce" },
+    unregister: { en: "Remove entry", "zh-TW": "移除入口", "zh-CN": "移除入口", ja: "エントリを削除", ko: "항목 제거", de: "Eintrag entfernen", fr: "Supprimer l'entrée", es: "Eliminar entrada", it: "Rimuovi voce" },
+    portal_alias_invalid: { en: "Use 1-64 lowercase letters, digits or hyphens, not starting or ending with a hyphen.", "zh-TW": "請使用 1–64 個小寫英文字母、數字或連字號，且不可以連字號開頭或結尾。", "zh-CN": "请使用 1–64 个小写英文字母、数字或连字符，且不能以连字符开头或结尾。", ja: "1～64 文字の小文字英字・数字・ハイフンを使用し、先頭と末尾にハイフンは使えません。", ko: "1~64자의 영문 소문자, 숫자 또는 하이픈을 사용하고 하이픈으로 시작하거나 끝나지 않게 하십시오.", de: "Verwenden Sie 1–64 Kleinbuchstaben, Ziffern oder Bindestriche, ohne Bindestrich am Anfang oder Ende.", fr: "Utilisez 1 à 64 lettres minuscules, chiffres ou tirets, sans tiret au début ni à la fin.", es: "Use de 1 a 64 letras minúsculas, dígitos o guiones, sin guion al principio ni al final.", it: "Usa da 1 a 64 lettere minuscole, cifre o trattini, senza trattino all'inizio o alla fine." },
+    portal_alias_reserved: { en: "DSM already uses this alias. Choose another one.", "zh-TW": "DSM 已使用這個別名，請改用其他別名。", "zh-CN": "DSM 已使用此别名，请改用其他别名。", ja: "このエイリアスは DSM で使用されています。別のものを選んでください。", ko: "DSM에서 이미 사용하는 별칭입니다. 다른 별칭을 선택하십시오.", de: "DSM verwendet diesen Alias bereits. Wählen Sie einen anderen.", fr: "DSM utilise déjà cet alias. Choisissez-en un autre.", es: "DSM ya usa este alias. Elija otro.", it: "DSM usa già questo alias. Scegline un altro." },
+    portal_alias_in_use: { en: "Another app already uses this alias. Choose another one.", "zh-TW": "另一個 App 已使用這個別名，請改用其他別名。", "zh-CN": "另一个应用已使用此别名，请改用其他别名。", ja: "別のアプリがこのエイリアスを使用しています。別のものを選んでください。", ko: "다른 앱이 이미 이 별칭을 사용합니다. 다른 별칭을 선택하십시오.", de: "Eine andere App verwendet diesen Alias bereits. Wählen Sie einen anderen.", fr: "Une autre application utilise déjà cet alias. Choisissez-en un autre.", es: "Otra aplicación ya usa este alias. Elija otro.", it: "Un'altra app usa già questo alias. Scegline un altro." },
     admin_required: { en: "Only a DSM administrator can change this.", "zh-TW": "只有 DSM 管理員可以變更這項設定。", "zh-CN": "只有 DSM 管理员可以更改此设置。", ja: "これを変更できるのは DSM 管理者のみです。", ko: "DSM 관리자만 변경할 수 있습니다.", de: "Nur ein DSM-Administrator kann dies ändern.", fr: "Seul un administrateur DSM peut modifier ce paramètre.", es: "Solo un administrador de DSM puede cambiar esto.", it: "Solo un amministratore DSM può modificarlo." },
-    portal_unavailable: { en: "DSM did not accept the change. Try again or use Control Panel.", "zh-TW": "DSM 未接受變更。請再試一次或改用控制台。", "zh-CN": "DSM 未接受更改。请重试或改用控制面板。", ja: "DSM は変更を受け付けませんでした。再試行するか、コントロールパネルを使用してください。", ko: "DSM이 변경을 받아들이지 않았습니다. 다시 시도하거나 제어판을 사용하세요.", de: "DSM hat die Änderung nicht übernommen. Versuchen Sie es erneut oder verwenden Sie die Systemsteuerung.", fr: "DSM n'a pas accepté la modification. Réessayez ou utilisez le Panneau de configuration.", es: "DSM no aceptó el cambio. Inténtelo de nuevo o use el Panel de control.", it: "DSM non ha accettato la modifica. Riprova o usa il Pannello di controllo." },
+    portal_unavailable: { en: "DSM did not accept the change. Try again or use Control Panel.", "zh-TW": "DSM 未接受變更。請再試一次或改用控制台。", "zh-CN": "DSM 未接受更改。请重试或改用控制面板。", ja: "DSM は変更を受け付けませんでした。再試行するか、コントロールパネルを使用してください。", ko: "DSM이 변경을 받아들이지 않았습니다. 다시 시도하거나 제어판을 사용하십시오.", de: "DSM hat die Änderung nicht übernommen. Versuchen Sie es erneut oder verwenden Sie die Systemsteuerung.", fr: "DSM n'a pas accepté la modification. Réessayez ou utilisez le Panneau de configuration.", es: "DSM no aceptó el cambio. Inténtelo de nuevo o use el Panel de control.", it: "DSM non ha accettato la modifica. Riprova o usa il Pannello di controllo." },
+    PORTAL_FAILED: { en: "DSM did not accept the Application Portal change. Try again.", "zh-TW": "DSM 未接受應用程式入口的變更。請再試一次。", "zh-CN": "DSM 未接受应用程序门户的更改。请重试。", ja: "DSM はアプリケーションポータルの変更を受け付けませんでした。再試行してください。", ko: "DSM이 응용 프로그램 포털 변경을 받아들이지 않았습니다. 다시 시도하십시오.", de: "DSM hat die Änderung am Anwendungsportal nicht übernommen. Versuchen Sie es erneut.", fr: "DSM n'a pas accepté la modification du Portail d'application. Réessayez.", es: "DSM no aceptó el cambio en el Portal de aplicaciones. Inténtelo de nuevo.", it: "DSM non ha accettato la modifica al Portale applicazioni. Riprovare." },
 };
 function localizedMessages() {
     const out = {};
@@ -35,8 +40,10 @@ function localizedMessages() {
  * Control Panel shortcut.
  *
  * `status()` resolves `{state, alias?, url?, canManage, controlPanel,
- * defaultAlias}`; `apply(alias)` and `disable()` resolve the new status or
- * reject `{code}`; `openControlPanel()` opens Login Portal > Applications.
+ * defaultAlias, entry?}`; `apply(alias)` and `disable()` resolve the new
+ * status or reject `{code}`. With `options.entry` (below DSM 7.2) the
+ * backend's `portal.status` also reports the executor's entry, and
+ * administrators get `register()` and `unregister()`; `openControlPanel()` opens Login Portal > Applications.
  * `messages` is the panel text in the window's locale; `mountPanel(element)`
  * renders a plain panel for UIs without their own.
  */
@@ -46,6 +53,7 @@ export const PORTAL_RUNTIME = `function createPortalAccess(options) {
   var LINKABLE = /^[A-Za-z0-9][A-Za-z0-9_-]{0,63}$/;
   var CATALOGS = ${JSON.stringify(localizedMessages())};
   var messages = CATALOGS[options.locale] || CATALOGS.en;
+  var ENTRIES = ["registered", "unregistered", "cleanup-required"];
   var ERRORS = { dsm_4100: "portal_alias_invalid", dsm_4102: "portal_alias_reserved", dsm_4103: "portal_alias_in_use", dsm_105: "admin_required" };
   function result(state, alias, managed) {
     var out = { state: state, canManage: managed === true, controlPanel: managed !== undefined, defaultAlias: options.defaultAlias };
@@ -55,11 +63,12 @@ export const PORTAL_RUNTIME = `function createPortalAccess(options) {
     }
     return out;
   }
+  function readBackend(data) {
+    if (data && data.state === "active" && typeof data.alias === "string" && LINKABLE.test(data.alias)) return result("active", data.alias);
+    return result(data && data.state === "inactive" ? "inactive" : "unavailable");
+  }
   function fromBackend() {
-    return options.call("portal.status", {}).then(function (data) {
-      if (data && data.state === "active" && typeof data.alias === "string" && LINKABLE.test(data.alias)) return result("active", data.alias);
-      return result(data && data.state === "inactive" ? "inactive" : "unavailable");
-    }, function () {
+    return options.call("portal.status", {}).then(readBackend, function () {
       return result("unavailable");
     });
   }
@@ -79,9 +88,33 @@ export const PORTAL_RUNTIME = `function createPortalAccess(options) {
       return result("unavailable", undefined, false);
     });
   }
+  function withEntry(out, entry) {
+    out.entry = entry;
+    return out;
+  }
+  // Below DSM 7.2 the executor registers the entry; DSM lists the App only while it is registered.
+  function fromEntry() {
+    return options.call("portal.status", {}).then(function (data) {
+      var entry = data && ENTRIES.indexOf(data.entry) >= 0 ? data.entry : "";
+      if (!options.isAdmin()) return readBackend(data);
+      if (entry === "registered") return fromDsm().then(function (out) { return withEntry(out, entry); });
+      if (!entry) return result("unavailable", undefined, false);
+      var read = readBackend(data);
+      return withEntry(result(entry === "unregistered" ? "inactive" : read.state, read.alias, true), entry);
+    }, function () {
+      return options.isAdmin() ? result("unavailable", undefined, false) : result("unavailable");
+    });
+  }
   function status() {
+    if (options.entry) return fromEntry();
     return options.isAdmin() ? fromDsm() : fromBackend();
   }
+  function change(method) {
+    if (!options.isAdmin()) return Promise.reject({ code: "admin_required" });
+    return options.call(method, {}).then(status, function (error) {
+      throw { code: error && error.code === "ADMIN_REQUIRED" ? "admin_required" : "PORTAL_FAILED" };
+    });
+  }
   function set(alias) {
     if (!options.isAdmin()) return Promise.reject({ code: "admin_required" });
     return options.send("SYNO.Core.AppPortal", "set", 2, { id: options.appId, alias: alias }).then(status, function (error) {
@@ -106,6 +139,10 @@ export const PORTAL_RUNTIME = `function createPortalAccess(options) {
       return mountPanel(element);
     }
   };
+  if (options.entry) {
+    access.register = function () { return change("portal.register"); };
+    access.unregister = function () { return change("portal.unregister"); };
+  }
   function node(tag, attrs, children) {
     var out = document.createElement(tag);
     for (var key in attrs) {
@@ -129,7 +166,11 @@ export const PORTAL_RUNTIME = `function createPortalAccess(options) {
       if (current.state === "active") {
         parts.push(node("p", {}, [node("span", { text: messages.link + " " }), node("a", { href: current.url, target: "_blank", rel: "noopener", text: current.url })]));
       }
-      if (current.canManage) {
+      if (current.canManage && current.entry && current.entry !== "registered") {
+        var off = current.entry === "unregistered";
+        parts.push(node("p", { text: off ? messages.entryOff : messages.cleanupRequired }));
+        parts.push(off ? button(messages.register, function () { settle(access.register()); }) : button(messages.unregister, function () { settle(access.unregister()); }));
+      } else if (current.canManage) {
         if (current.state !== "active") parts.push(node("p", { text: messages.inactive }));
         var input = node("input", { type: "text", maxlength: "64", autocomplete: "off", "aria-label": messages.alias });
         input.value = current.alias || current.defaultAlias;
@@ -137,6 +178,7 @@ export const PORTAL_RUNTIME = `function createPortalAccess(options) {
         form.addEventListener("submit", function (event) { event.preventDefault(); settle(access.apply(input.value)); });
         if (current.state === "active") form.appendChild(button(messages.disable, function () { settle(access.disable()); }));
         parts.push(form, button(messages.advanced, access.openControlPanel));
+        if (current.entry) parts.push(button(messages.unregister, function () { settle(access.unregister()); }));
       } else if (current.controlPanel) {
         parts.push(button(messages.controlPanel, access.openControlPanel));
       } else if (current.state !== "active") {

package/dist/standalone/portal.d.ts

@@ -1,4 +1,7 @@
 import type { StandaloneManifest } from "./manifest.js";
 import type { PortalPackage } from "../portal/package.js";
-/** A native portal opens the package's own DSM window. */
+/**
+ * A native portal registered through DSM's web-config resource; it opens the
+ * package's own DSM window. Below DSM 7.2 the executor registers it instead.
+ */
 export declare function nativePortal(manifest: StandaloneManifest): PortalPackage | undefined;

package/dist/standalone/portal.js

@@ -1,4 +1,10 @@
-/** A native portal opens the package's own DSM window. */
+import { portalByExecutor } from "../build-spk/dsm-version.js";
+/**
+ * A native portal registered through DSM's web-config resource; it opens the
+ * package's own DSM window. Below DSM 7.2 the executor registers it instead.
+ */
 export function nativePortal(manifest) {
-    return manifest.portal && { appId: `SYNO.SDS.${manifest.package}.Instance`, application: manifest.displayname, alias: manifest.portal.alias };
+    if (!manifest.portal || portalByExecutor(manifest.os_min_ver))
+        return undefined;
+    return { appId: `SYNO.SDS.${manifest.package}.Instance`, application: manifest.displayname, alias: manifest.portal.alias };
 }

package/dist/standalone/spk.js

@@ -22,6 +22,7 @@ import { copyDaemonPayload } from "./daemon.js";
 import { BACKGROUND_UNIT_DIR, BACKGROUND_WORKER_PAYLOAD, backgroundUnitName, renderBackgroundUnit } from "./background.js";
 import { renderStandaloneResource } from "./resource.js";
 import { nativePortal } from "./portal.js";
+import { portalByExecutor } from "../build-spk/dsm-version.js";
 import { PORTAL_JSON_RELPATH, PORTAL_MUSTACHE_RELPATH, renderPortalJson, renderPortalMustache, renderPortalWizardStep } from "../portal/package.js";
 import { executorPlan } from "../runtime/executor-build.js";
 import { EXECUTOR_ANCHOR } from "../runtime/executor-inspect.js";
@@ -131,7 +132,7 @@ export async function assembleStandaloneSpk(options) {
             ...install.static,
             ...install.dynamic,
             ...(folder ? renderSharedFolderUpgradeWizardFiles(manifest.package, folder) : {}),
-            ...renderUninstallWizardFiles(manifest.package, "native", { executor: Boolean(options.executor), portal: Boolean(portal) }),
+            ...renderUninstallWizardFiles(manifest.package, "native", { executor: Boolean(options.executor), portal: Boolean(portal), portalEntry: Boolean(manifest.portal && portalByExecutor(manifest.os_min_ver)) }),
         });
         writePackageCenterIcons(staging, icons);
         mkdirSync(dirname(options.outputPath), { recursive: true });

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@synopackageland/cli",
-  "version": "0.9.3",
+  "version": "0.9.5",
   "description": "Syno Package Land Developer Kit CLI",
   "type": "module",
   "bin": {
@@ -19,12 +19,12 @@
   "scripts": {
     "build": "rm -rf dist && tsc",
     "test": "npm run build && node --import tsx --test test/**/*.test.ts",
-    "test:scripts": "node --test scripts/test/release.test.mjs scripts/test/pack-docker.test.mjs scripts/test/npm-pack.test.mjs scripts/test/executor-bump.test.mjs scripts/test/smoke-exports.test.mjs scripts/test/executor-digests.test.mjs",
+    "test:scripts": "node --test scripts/test/gate.test.mjs scripts/test/release.test.mjs scripts/test/pack-docker.test.mjs scripts/test/npm-pack.test.mjs scripts/test/executor-bump.test.mjs scripts/test/smoke-exports.test.mjs scripts/test/executor-digests.test.mjs",
     "gates": "bash scripts/ci/gate.sh npm && bash scripts/ci/gate.sh native-go && bash scripts/ci/gate.sh daemon-gateway",
     "prepublishOnly": "npm run build"
   },
   "dependencies": {
-    "@synopackageland/templates": "0.9.3",
+    "@synopackageland/templates": "0.9.5",
     "ajv": "^8.17.1",
     "commander": "^13.1.0",
     "tar": "^7.4.3",

package/skills/reference/portal.md

@@ -2,20 +2,24 @@
 
 Tier: only an App with the executor (`capabilities.rootOps` or `capabilities.delegate`) may declare a portal, because after uninstall only root can make nginx stop serving the alias. A no-privilege native App fails check/build with `STANDALONE_PORTAL_REQUIRES_EXECUTOR`, `add portal` refuses it unless the same call adds `root-ops` or `delegate`, and inspect flags such an SPK with `PORTAL_REQUIRES_EXECUTOR`. A Compose App has no executor: `integration.web.portal` always fails with `CONTRACT_PORTAL_REQUIRES_EXECUTOR`. Without the executor, an administrator can set up a reverse proxy in DSM instead.
 
-Declare: native-go/binary with rootOps or delegate, `portal: {}` or `portal: {alias: my-app}` in dsm-package.yaml (`synopkgland add root-ops portal`, or `add portal` once the executor is declared). The alias defaults to the package name in lowercase. Aliases are 1–64 lowercase letters, digits or `-`, not starting or ending with `-`, and not a DSM path or Synology App alias (`webman`, `file`, …). The native-layout `backend: {kind: native}` owns its conf/scripts: the SDK does not register a portal for it.
+Declare: native-go/binary with rootOps or delegate, `portal: {}` or `portal: {alias: my-app}` in dsm-package.yaml (`synopkgland add root-ops portal`, or `add portal` once the executor is declared). The alias defaults to the package name in lowercase. Aliases are 1–64 lowercase letters, digits or `-`, not starting or ending with `-`, and not a DSM path or Synology App alias (`webman`, `file`, …). The native-layout `backend: {kind: native}` owns its conf/scripts and its own root helper: `portal: {}` or `{alias}` there needs os_min_ver 7.1-42661+ and writes only `synopkgland_portal_alias="<alias>"` into INFO, which Package Center writes as root, so the product's root helper can trust it; the helper registers the app.d entry (application = INFO displayname) and owns its uninstall cleanup and wizard. inspect checks that INFO line against `native-layout.json`.
 
-Build: the SPK carries `etc/portal.json` (every field DSM's app-portal worker needs) and `etc/portal.mustache`, `conf/resource` registers them, and the install wizard adds a prefilled alias step. preinst validates the answer; postinst stores it as the package's own draft and default alias. Nothing is active until an administrator applies it. `inspect <spk> --json` reports `portal: {appId, alias}` and refuses any other portal content.
+Build (os_min_ver 7.2-64570+): the SPK carries `etc/portal.json` (every field DSM's app-portal worker needs) and `etc/portal.mustache`, `conf/resource` registers them, and the install wizard adds a prefilled alias step. preinst validates the answer; postinst stores it as the package's own draft and default alias. Nothing is active until an administrator applies it. `inspect <spk> --json` reports `portal: {appId, alias}` and refuses any other portal content.
 
 Activate: DSM owns the saved setting. Administrators use the app's portal panel (`ctx.portal.apply(alias)` / `disable()`, DSM `SYNO.Core.AppPortal set` with their own session; DSM refuses non-administrators with 105) or Control Panel > Login Portal > Applications (`ctx.portal.openControlPanel()`). DSM errors map to `portal_alias_invalid`, `portal_alias_reserved`, `portal_alias_in_use`, `admin_required`, `portal_unavailable`.
 
 Read: ordinary users call the Go backend's `portal.status` (`authenticated`), which reads `/var/packages/<package>/etc/AppPortal.json` read-only, bounded (64 KiB, no symlinks, one JSON object, matching app id). Anything else is `unavailable` and the UI shows "ask an administrator". A binary CGI must implement the same `{state, alias}` answer itself or ordinary users never see the link.
 
-DSM floor: os_min_ver must be 7.3.2-86009 or later. DSM 7.1.1-42962 refuses an unsigned SPK whose conf/resource carries web-config app-portal (Package Center error 320, "non-synology-signed package should not use internal worker"); 7.3.2-86009 and 7.4 install it; 7.2 and 7.3.0/7.3.1 are untested (unknown). validate/build fail with `STANDALONE_PORTAL_MIN_DSM`, `--min-dsm` cannot go below it, `add portal` raises a lower os_min_ver, and inspect flags a lower INFO os_min_ver. Fix: raise os_min_ver or remove the portal.
+Executor mode (7.1-42661 ≤ os_min_ver < 7.2-64570): no web-config resource, no `etc/portal.*`, no alias wizard step or alias lifecycle. The executor policy carries `portal: {application: <displayname>, alias}` and the operations `portal.register` and `portal.unregister`; the executor writes `/usr/syno/etc/www/app.d/<package>.{json,mustache}`. The package name must match `^[A-Za-z0-9]+(?:[._-][A-Za-z0-9]+)*$` (≤ 64) and displayname be 1–64 characters without control characters, or build fails with `STANDALONE_PORTAL_ENTRY_INVALID`. The CGI is built with `-X main.portal=executor`: `portal.status` adds `entry` (`registered`, `unregistered`, `cleanup-required`; an unreadable executor is `unavailable`), and `portal.register` / `portal.unregister` take the administrator's DSM session and return the fresh status. `ctx.portal.register()` / `unregister()` call them; the plain panel shows text and "Enable entry" while unregistered, the alias form and "Remove entry" once registered, text and "Remove entry" when cleanup is required, and no entry buttons for non-administrators. Executor refusals keep their code (`PORTAL_FAILED`). Needs templates with the executor portal routes (after 0.9.4) and an SDK with the `portal` entry API (after 0.9.5).
+
+DSM floor: os_min_ver must be 7.1-42661 or later; below 7.2-64570 the executor registers the entry (above). DSM 7.1 marks the web-config worker Synology-only, so it refuses an unsigned SPK whose conf/resource carries web-config (Package Center error 320, "non-synology-signed package should not use internal worker"; seen on 7.1.1-42962). synopkg from DSM 7.2 on drops that mark, the only change to its worker table; the 7.2 floor comes from that source and is not yet verified on a 7.2 NAS. 7.3.2-86009 and 7.4 install it. Below 7.1 validate/build fail with `STANDALONE_PORTAL_MIN_DSM`, `--min-dsm` cannot go below 7.1, `add portal` raises a lower os_min_ver to 7.1-42661, and inspect flags an INFO os_min_ver below the floor of the SPK's mode. Fix: raise os_min_ver or remove the portal.
 
 Capability: beyond that floor, no version gate. The panel needs SYNO.API.Info to list `SYNO.Core.AppPortal` (v2) and the app's registration to exist; otherwise administrators get only the Control Panel shortcut.
 
 UI: plain JS calls `ctx.portal && ctx.portal.mountPanel(element)` and disposes it on unmount; Vue renders `portal/PortalSettings.vue`. `ctx.portal.messages` carries the SDK text in all nine languages.
 
-Never: write `AppPortal.json`, `@appconf/<package>` or `/usr/syno/etc/www/app.d`; add a backend route that changes the alias; relay QuickConnect responses or build QuickConnect links; reboot or change other packages' portal entries while testing. DSM keeps the alias across upgrades and removes the entry on uninstall, but it does not reload nginx, and it keeps the App's Application Privileges rules.
+Never: write `AppPortal.json`, `@appconf/<package>` or `/usr/syno/etc/www/app.d` from the App (only the executor's approved `portal.*` operations write app.d); add a backend route that changes the alias; relay QuickConnect responses or build QuickConnect links; reboot or change other packages' portal entries while testing. DSM keeps the alias across upgrades and removes the entry on uninstall, but it does not reload nginx, and it keeps the App's Application Privileges rules.
 
 Uninstall: the root executor's purge deletes the rules of `SYNO.SDS.<package>.Instance` through the Application Privileges API and, once DSM has removed the alias files, reloads nginx (`synosystemctl reload nginx`), so the alias stops at once. Failures are only logged to the system log entry `synopkgland-executor`; then an administrator saves an alias in Control Panel > Login Portal > Applications (which reloads nginx) or restarts the NAS, and removes the rules in Control Panel > Application Privileges. The uninstall wizard and the `status`/`inspect` cleanup list say this in that order: automatic first, manual only as the fallback.
+
+Executor mode uninstall: the purge reads the retained policy and unregisters the entry. If the executor is not running or was never approved, uninstall does not remove the entry; the wizard and cleanup list say so and give the root commands (`rm -f /usr/syno/etc/www/app.d/<package>.json /usr/syno/etc/www/app.d/<package>.mustache /usr/syno/etc/packages/<package>/AppPortal.json`, `synow3tool --disable-nginx-confd/--unreg-nginx-confd` for `dsm www alias .alias`, `--disable-nginx-sites/--unreg-nginx-sites` for `server .server` on `<c>.syno-app-portal.<package>.conf`, then `nginx -t && synow3tool --nginx=reload`).

package/skills/reference/ui-json.md

@@ -68,7 +68,11 @@ also exports `@synopackageland/ui/json-catalog.schema.json` and
 
 In DSM windows, keep a bounded `AppRoot` (for example `height: 100%`), use its
 default app modal scope or explicit `modalScope: "app"`, and set JSON `AppShell`
-`wideLayout: "window"`. Vue `AppLayout` uses `wide-layout="window"`. Reserve
+`wideLayout: "window"`. Vue `AppLayout` uses `wide-layout="window"`. In a DSM
+window (`ctx.host.platform().host === 'dsm'`), the Vue wrapper gives `AppRoot`
+`dialog-bounds="viewport"` and connects its `activate` event to
+`ctx.host.activateWindow()`, so Dialogs can leave the window and pressing one
+brings the window to the front; below 600px they are bottom sheets. Reserve
 root sizing for the Vue/host wrapper; only use props exposed by the current JSON
 schema inside the spec. Reserve
 `modalScope: "document"` and `wideLayout: "web"` for whole-page web/Portal apps.

package/skills/reference/ui-vue.md

@@ -34,6 +34,13 @@ do not guess APIs or copy a version-specific component inventory.
 - Keep a bounded `AppRoot`, for example `<AppRoot style="height: 100%">`, with
   a sized host/mount container. Use its default app modal scope (`modalScope`);
   avoid overriding it to document scope in a DSM window.
+- In a DSM window (`ctx.host.platform().host === 'dsm'`), give `AppRoot`
+  `dialog-bounds="viewport"` so Dialogs can be dragged out of the window as
+  DSM's own are, and connect its `activate` event to
+  `ctx.host.activateWindow()` so pressing a Dialog brings the window to the
+  front. Below 600px of viewport width the UI turns them into bottom sheets.
+  Keep the default `app` bounds outside DSM windows (standalone web, Portal,
+  previews).
 - Import only `@synopackageland/ui/themes/dsm7-embedded.css` for the template.
   The standalone `theme.css` and `dsm7.css` entrypoints affect the host page.
 - Set a unique `app.config.idPrefix` for every independent Vue app before