@synopackageland/cli 0.9.4 → 0.9.5

package/CHANGELOG.md

@@ -1,5 +1,63 @@
 # Changelog
 
+## 0.9.5 (2026-10-12)
+
+Builds with SDK 0.9.6 and templates 0.9.5: `init` writes SDK v0.9.6,
+`@synopackageland/sdk` 0.9.6 and `@synopackageland/ui` 0.9.2. The executor
+digest table records SDK 0.9.6, whose executor registers the portal entry
+and checks a grant's background work from the browser address it recorded,
+so a rebuilt App carries new executor digests. The policy digest changes
+only for an App whose executor registers its portal entry (a portal and
+os_min_ver below 7.2): after the upgrade it asks for approval again. Other
+Apps keep their policy digest.
+
+繁中摘要：使用 SDK 0.9.6 與 templates 0.9.5（UI 0.9.2）。executor digest 表加入
+SDK 0.9.6，重建的 App 會帶新的 executor digest。只有由 executor 註冊入口的
+portal App（宣告 portal 且 os_min_ver 低於 7.2）policy digest 會變，升級後需重新
+核准；其他 App 的 policy digest 不變。DSM 7.1 起可用 portal（executor 模式）。
+
+- The generated DSM window stays inside the desktop: its width is at most the
+  viewport's and its height at most the viewport's less the DSM taskbar. This
+  applies to the default 960×640 and to the size DSM restores from
+  `restoreSizePos`, which may have been saved on a larger screen. Position and
+  maximized state are restored as before.
+- Native root authorization (`createRootAccess` from
+  `@synopackageland/cli/authorization-sdk`): the first `run` after an `authorize`
+  runs the task that `authorize` just read back as exactly ours, instead of
+  reading the TaskScheduler list and task again. Any later run, a repair, and
+  a run after `remove` still read DSM first; `authorize` still reads the task
+  back after creating it and checks its identity and script.
+- Native root authorization polls the task history every 0.5 s, then at most
+  once a second (was up to every 2 s), so a finished root task is seen up to
+  1 s sooner.
+- A portal works from DSM 7.1-42661 on. Below 7.2-64570 (executor mode) the
+  SPK carries no web-config resource, `etc/portal.*`, alias wizard step or
+  alias lifecycle; the executor policy carries `portal: {application, alias}`
+  and the `portal.register` / `portal.unregister` operations, and the CGI is
+  built with `-X main.portal=executor`. A package name or displayname the
+  executor would refuse fails with `STANDALONE_PORTAL_ENTRY_INVALID`; below
+  7.1 `STANDALONE_PORTAL_MIN_DSM` still refuses the portal, and `add portal`
+  raises os_min_ver only to 7.1-42661. inspect reports the policy's entry
+  and flags an INFO os_min_ver below 7.1. Needs templates 0.9.5 and SDK 0.9.6.
+- `ctx.portal` in executor mode: `status()` carries `entry`, administrators
+  get `register()` and `unregister()`, and the plain panel offers "Enable
+  entry", "Remove entry" or the alias form by entry state. New texts in nine
+  languages, including `PORTAL_FAILED`. The panel's Korean texts use the
+  formal -십시오 register.
+- The uninstall wizard and the cleanup list of an executor-mode portal App
+  warn that a stopped or never-approved executor leaves the entry, and give
+  the root cleanup commands.
+- native-layout: `portal: {}` or `{alias}` (DSM 7.1-42661+) writes
+  `synopkgland_portal_alias` into INFO for the product's own root helper;
+  inspect checks it against `native-layout.json`.
+- DSM's web-config portal registration now needs `os_min_ver` 7.2-64570 or
+  later instead of 7.3.2-86009. DSM 7.1's package manager marks the web-config
+  worker Synology-only and refuses it in an unsigned SPK (error 320); synopkg
+  from DSM 7.2 on drops that mark, the only change to its worker table. The
+  7.2 floor comes from that source and is not yet verified on a 7.2 NAS.
+  inspect flags a web-config portal SPK whose INFO os_min_ver is lower, with
+  this reason.
+
 ## 0.9.4 (2026-10-12)
 
 Builds with SDK 0.9.5 and templates 0.9.4: `init` writes SDK v0.9.5 and

package/README.md

@@ -72,7 +72,7 @@ Add them with `init --with …` or later with `synopkgland add <capability…>`.
 | `login` | Sign users in with their DSM account, without the DSM desktop | Nobody; requires HTTPS for password sign-in |
 | `delegate` | Move files into a user's chosen folder while the user is offline | An administrator, once |
 | `root-ops` | Run fixed `root/*.sh` scripts for administrators | An administrator, once |
-| `portal` | Open the app from its own Application Portal alias | An administrator sets the alias; needs `root-ops` or `delegate` and DSM 7.3.2-86009+ |
+| `portal` | Open the app from its own Application Portal alias | An administrator sets the alias; needs `root-ops` or `delegate` and DSM 7.1-42661+ (below 7.2-64570 the executor registers the entry) |
 
 Delegate is implemented; its default operation is `files.moveFromStaging`.
 Device lifecycle acceptance on real hardware is still pending for delegate and root operations.

package/dist/add.js

@@ -6,7 +6,7 @@ import { capabilityNames, capabilitySettings } from './capabilities.js';
 import { initFromTemplate, nativeCapabilitySettings } from './init.js';
 import { templatesRoot } from './template-paths.js';
 import { borrowedTarget, capabilityOverlays } from './capability-overlays.js';
-import { DEFAULT_MIN_DSM, isDsmAtLeast, PORTAL_MIN_DSM } from './build-spk/dsm-version.js';
+import { DEFAULT_MIN_DSM, isDsmAtLeast, PORTAL_EXECUTOR_MIN_DSM } from './build-spk/dsm-version.js';
 import { loadStandaloneManifest } from './standalone/manifest.js';
 import { PORTAL_REQUIRES_EXECUTOR } from './portal/alias.js';
 function files(root, dir = root) {
@@ -51,7 +51,7 @@ function withNotes(result, notes) {
 }
 /**
  * `portal: {}` in dsm-package.yaml; the Go and binary starters already carry the UI and backend side.
- * A lower os_min_ver is raised to PORTAL_MIN_DSM, the oldest DSM verified to install a portal.
+ * A lower os_min_ver is raised to PORTAL_EXECUTOR_MIN_DSM; below PORTAL_MIN_DSM the executor registers the entry.
  */
 function addPortal(root, result) {
     const loaded = loadStandaloneManifest(root);
@@ -64,7 +64,7 @@ function addPortal(root, result) {
     const manifestPath = join(root, 'dsm-package.yaml');
     const doc = parseDocument(readFileSync(manifestPath, 'utf8'));
     doc.set('portal', doc.createNode({}, { flow: true }));
-    const notes = raiseOsMinVer(doc, loaded.manifest.os_min_ver, PORTAL_MIN_DSM, 'portal');
+    const notes = raiseOsMinVer(doc, loaded.manifest.os_min_ver, PORTAL_EXECUTOR_MIN_DSM, 'portal');
     writeFileSync(manifestPath, String(doc));
     return withNotes({ ...result, added: [...result.added, 'portal'] }, notes);
 }

package/dist/build-spk/dsm-version.d.ts

@@ -8,11 +8,21 @@ export declare const DEFAULT_MIN_DSM: string;
 export declare const CONTAINER_MIN_DSM: string;
 /**
  * DSM registers an Application Portal through the package's web-config
- * app-portal resource. DSM 7.1.1-42962 refuses that resource in an unsigned
- * package (error 320, "internal worker"); DSM 7.3.2-86009 and 7.4 install it.
- * 7.2 and 7.3.0/7.3.1 are untested, so the floor is the oldest verified build.
+ * app-portal resource. DSM 7.1's package manager marks the web-config worker
+ * Synology-only and refuses it in an unsigned package (error 320, "internal
+ * worker"); synopkg from DSM 7.2 on does not. That 7.2 floor comes from the
+ * source and is not yet verified on a 7.2 NAS.
  */
-export declare const PORTAL_MIN_DSM = "7.3.2-86009";
+export declare const PORTAL_MIN_DSM: string;
+/** Why DSM below PORTAL_MIN_DSM refuses a package that declares the web-config portal resource. */
+export declare const PORTAL_MIN_DSM_REASON = "DSM 7.1 \u628A web-config \u5217\u70BA Synology \u5C08\u7528 worker\uFF0C\u4EE5\u932F\u8AA4 320 \u62D2\u88DD\u5E36 portal\uFF08web-config app-portal\uFF09\u7684\u672A\u7C3D\u7AE0\u5957\u4EF6\uFF1B7.2 \u8D77\u958B\u653E\u662F\u4F9D synopkg \u539F\u59CB\u78BC\u5224\u65B7\uFF0C\u5C1A\u672A\u5BE6\u6A5F\u9A57\u8B49";
+/**
+ * Below {@link PORTAL_MIN_DSM} the root executor registers the portal entry in
+ * DSM's app.d instead; that file format is verified from DSM 7.1 on.
+ */
+export declare const PORTAL_EXECUTOR_MIN_DSM: string;
+/** `true` when a portal package for `osMinVer` has its executor register the entry instead of web-config. */
+export declare function portalByExecutor(osMinVer: string): boolean;
 /** Why a portal package cannot declare `value`, and how to fix it; `field` names the portal key. */
 export declare function portalMinDsmMessage(value: string, field: string): string;
 /** `true` when `value` is not older than `floor`, comparing version parts then build. */

package/dist/build-spk/dsm-version.js

@@ -15,14 +15,26 @@ export const DEFAULT_MIN_DSM = FIRST_BUILD["7.1"];
 export const CONTAINER_MIN_DSM = FIRST_BUILD["7.2.1"];
 /**
  * DSM registers an Application Portal through the package's web-config
- * app-portal resource. DSM 7.1.1-42962 refuses that resource in an unsigned
- * package (error 320, "internal worker"); DSM 7.3.2-86009 and 7.4 install it.
- * 7.2 and 7.3.0/7.3.1 are untested, so the floor is the oldest verified build.
+ * app-portal resource. DSM 7.1's package manager marks the web-config worker
+ * Synology-only and refuses it in an unsigned package (error 320, "internal
+ * worker"); synopkg from DSM 7.2 on does not. That 7.2 floor comes from the
+ * source and is not yet verified on a 7.2 NAS.
  */
-export const PORTAL_MIN_DSM = "7.3.2-86009";
+export const PORTAL_MIN_DSM = FIRST_BUILD["7.2"];
+/** Why DSM below PORTAL_MIN_DSM refuses a package that declares the web-config portal resource. */
+export const PORTAL_MIN_DSM_REASON = "DSM 7.1 把 web-config 列為 Synology 專用 worker，以錯誤 320 拒裝帶 portal（web-config app-portal）的未簽章套件；7.2 起開放是依 synopkg 原始碼判斷，尚未實機驗證";
+/**
+ * Below {@link PORTAL_MIN_DSM} the root executor registers the portal entry in
+ * DSM's app.d instead; that file format is verified from DSM 7.1 on.
+ */
+export const PORTAL_EXECUTOR_MIN_DSM = FIRST_BUILD["7.1"];
+/** `true` when a portal package for `osMinVer` has its executor register the entry instead of web-config. */
+export function portalByExecutor(osMinVer) {
+    return !isDsmAtLeast(osMinVer, PORTAL_MIN_DSM);
+}
 /** Why a portal package cannot declare `value`, and how to fix it; `field` names the portal key. */
 export function portalMinDsmMessage(value, field) {
-    return `${field} 需要 DSM ${PORTAL_MIN_DSM} 以上，os_min_ver 是「${value}」。DSM 7.1.1 以錯誤 320 拒裝帶 portal（web-config app-portal）的未簽章套件；DSM 7.3.2 與 7.4 已驗證可裝，7.2 未驗證。請把 os_min_ver 提高到 ${PORTAL_MIN_DSM} 以上，或移除 ${field}。`;
+    return `${field} 需要 DSM ${PORTAL_EXECUTOR_MIN_DSM} 以上，os_min_ver 是「${value}」。DSM ${PORTAL_MIN_DSM} 以前由 executor 寫入 DSM 的 app.d 註冊入口，這個格式只在 DSM 7.1 起驗證過。請把 os_min_ver 提高到 ${PORTAL_EXECUTOR_MIN_DSM} 以上，或移除 ${field}。`;
 }
 /** `true` when `value` is not older than `floor`, comparing version parts then build. */
 export function isDsmAtLeast(value, floor) {

package/dist/build-spk/uninstall-wizard.d.ts

@@ -6,6 +6,8 @@ interface UninstallWizardOptions {
     executor?: boolean;
     /** The App declares a Login Portal alias (web-config app-portal); only the executor tier can. */
     portal?: boolean;
+    /** Below DSM 7.2 the executor registered the App's Application Portal entry. */
+    portalEntry?: boolean;
 }
 /** `uninstall_uifile` (English) plus one `uninstall_uifile_<dsm language>` per locale. */
 export declare function renderUninstallWizardFiles(packageName: string, kind: UninstallWizardKind, options?: UninstallWizardOptions): Record<string, string>;

package/dist/build-spk/uninstall-wizard.js

@@ -1,10 +1,12 @@
+import { portalEntryCleanupCommands } from "../runtime/uninstall-cleanup.js";
 import { renderWizardFiles } from "./wizard-i18n.js";
 /** The key DSM's built-in packages use for their "also remove my data" box. */
 export const REMOVE_ADDITIONAL_KEY = "pkgwizard_remove_additional";
 function list(items) {
     return `<ul class="synopkg-ul-list">${items.map((item) => `<li>${item}</li>`).join("")}</ul>`;
 }
-function renderUninstallWizard(t, packageName, kind, { executor = false, portal = false }) {
+const html = (text) => text.replace(/&/g, "&amp;").replace(/</g, "&lt;").replace(/>/g, "&gt;");
+function renderUninstallWizard(t, packageName, kind, { executor = false, portal = false, portalEntry = false }) {
     const vars = { package: packageName };
     return [{
             step_title: t("uninstall.step"),
@@ -23,6 +25,10 @@ function renderUninstallWizard(t, packageName, kind, { executor = false, portal
                 ...(executor ? [{ desc: t("uninstall.executor", vars) }] : []),
                 { desc: t(executor ? "uninstall.appPrivilege.auto" : "uninstall.appPrivilege", vars) },
                 ...(executor && portal ? [{ desc: t("uninstall.portal.auto", vars) }] : []),
+                ...(executor && portalEntry ? [
+                    { desc: t("uninstall.portalEntry", vars) },
+                    { desc: portalEntryCleanupCommands(packageName).map((line) => `<code>${html(line)}</code>`).join("<br>") },
+                ] : []),
                 { desc: t("uninstall.backup") },
                 {
                     type: "multiselect",

package/dist/build-spk/wizard-messages.d.ts

@@ -417,6 +417,17 @@ export declare const WIZARD_MESSAGES: {
         es: string;
         it: string;
     };
+    "uninstall.portalEntry": {
+        en: string;
+        "zh-TW": string;
+        "zh-CN": string;
+        ja: string;
+        ko: string;
+        de: string;
+        fr: string;
+        es: string;
+        it: string;
+    };
     "uninstall.keep.native": {
         en: string;
         "zh-TW": string;

package/dist/build-spk/wizard-messages.js

@@ -417,6 +417,17 @@ export const WIZARD_MESSAGES = {
         es: "Después de que DSM elimine el alias del Portal de inicio de sesión de {package}, la desinstalación recarga automáticamente el servidor web, de modo que el alias deja de funcionar al instante. Solo si esta recarga falla, como indica la entrada synopkgland-executor del registro del sistema, un administrador debe guardar un alias de aplicación en Panel de control > Portal de inicio de sesión > Aplicaciones, lo que recarga el servidor web, o reiniciar el NAS.",
         it: "Dopo che DSM ha rimosso l’alias del Portale di accesso di {package}, la disinstallazione ricarica automaticamente il server web, così l’alias smette subito di funzionare. Solo se questo ricaricamento non riesce, come segnala la voce synopkgland-executor del registro di sistema, un amministratore deve salvare un alias di applicazione in Pannello di controllo > Portale di accesso > Applicazioni, che ricarica il server web, oppure riavviare il NAS.",
     },
+    "uninstall.portalEntry": {
+        en: "Uninstall asks the root executor to remove the Application Portal entry of {package}. If the executor is not running or was never approved, uninstall does not remove the entry; an administrator then runs these commands as root:",
+        "zh-TW": "解除安裝會由 root executor 移除 {package} 的應用程式入口。如果 executor 未執行或從未核准，解除安裝不會移除應用程式入口，管理員需以 root 執行下列指令：",
+        "zh-CN": "卸载会由 root executor 移除 {package} 的应用程序门户入口。如果 executor 未运行或从未核准，卸载不会移除应用程序门户入口，管理员需以 root 执行下列命令：",
+        ja: "アンインストール時に root executor が {package} のアプリケーションポータルのエントリを削除します。executor が実行されていない、または承認されていない場合、アンインストールではエントリが削除されないため、管理者が root で次のコマンドを実行してください:",
+        ko: "제거 시 root executor가 {package}의 응용 프로그램 포털 항목을 제거합니다. executor가 실행 중이 아니거나 승인된 적이 없으면 제거 과정에서 항목이 제거되지 않으므로 관리자가 root로 다음 명령을 실행하십시오.",
+        de: "Bei der Deinstallation entfernt der Root-Executor den Eintrag von {package} im Anwendungsportal. Läuft der Executor nicht oder wurde er nie genehmigt, entfernt die Deinstallation den Eintrag nicht; ein Administrator führt dann diese Befehle als root aus:",
+        fr: "La désinstallation demande à l’executor root de supprimer l’entrée de {package} dans le Portail d’application. Si l’executor ne s’exécute pas ou n’a jamais été approuvé, la désinstallation ne supprime pas l’entrée ; un administrateur exécute alors ces commandes en tant que root :",
+        es: "La desinstalación pide al executor root que elimine la entrada de {package} del Portal de aplicaciones. Si el executor no se está ejecutando o nunca se aprobó, la desinstalación no elimina la entrada; un administrador debe ejecutar estos comandos como root:",
+        it: "La disinstallazione chiede all’executor root di rimuovere la voce di {package} dal Portale applicazioni. Se l’executor non è in esecuzione o non è mai stato approvato, la disinstallazione non rimuove la voce; un amministratore deve eseguire questi comandi come root:",
+    },
     "uninstall.keep.native": {
         en: "Never deleted: Shared Folders, the package account, and other apps' data.",
         "zh-TW": "不會被刪除：共用資料夾（Shared Folder）、套件帳號，以及其他 App 的資料。",

package/dist/error-registry.js

@@ -649,7 +649,8 @@ for (const [code, description, suggestion] of [
     ERROR_REGISTRY[code] = { code, description, suggestion };
 ERROR_REGISTRY["ADD_LAYOUT_UNSUPPORTED"] = { "code": "ADD_LAYOUT_UNSUPPORTED", "description": "SDK overlay 需要標準 backend 目錄。", "suggestion": "使用 backend.dir: backend，或手動合併 SDK overlay。" };
 ERROR_REGISTRY["MIN_DSM_CONTAINER_FLOOR"] = { "code": "MIN_DSM_CONTAINER_FLOOR", "description": "Compose 最低 DSM 版本過低。", "suggestion": "Compose 需要 DSM 7.2.1-69057 或以上。" };
-ERROR_REGISTRY.STANDALONE_PORTAL_MIN_DSM = { "code": "STANDALONE_PORTAL_MIN_DSM", "description": "宣告 portal 的套件 os_min_ver 低於 DSM 7.3.2-86009。", "suggestion": "DSM 7.1.1 以 320 拒裝帶 portal 的未簽章套件、7.2 未驗證；把 os_min_ver 提高到 7.3.2-86009 以上，或移除 portal。" };
+ERROR_REGISTRY.STANDALONE_PORTAL_ENTRY_INVALID = { "code": "STANDALONE_PORTAL_ENTRY_INVALID", "description": "os_min_ver 低於 DSM 7.2-64570 時由 executor 註冊 portal，套件名稱或 displayname 不符合它的規則。", "suggestion": "套件名稱只能用英數字，以 . _ - 分隔，最多 64 字；displayname 1–64 個字，不可含控制字元。" };
+ERROR_REGISTRY.STANDALONE_PORTAL_MIN_DSM = { "code": "STANDALONE_PORTAL_MIN_DSM", "description": "宣告 portal 的套件 os_min_ver 低於 DSM 7.1-42661。", "suggestion": "DSM 7.2-64570 以前由 executor 寫入 DSM 的 app.d 註冊入口，這個格式只在 DSM 7.1 起驗證過。把 os_min_ver 提高到 7.1-42661 以上，或移除 portal。" };
 ERROR_REGISTRY["MIN_DSM_INVALID"] = { "code": "MIN_DSM_INVALID", "description": "最低 DSM 版本格式不合法。", "suggestion": "指定 7.x release 或完整 7.x-build。" };
 ERROR_REGISTRY["NOTICE_UNSAFE"] = { "code": "NOTICE_UNSAFE", "description": "授權檔案不符合一般檔案限制。", "suggestion": "移除 symlink、特殊檔與超大授權檔案。" };
 ERROR_REGISTRY["NOTICE_MISSING"] = { "code": "NOTICE_MISSING", "description": "缺少第三方授權資訊。", "suggestion": "重新安裝模板依賴並產生 third-party notices。" };

package/dist/info.js

@@ -1,5 +1,6 @@
 import { existsSync } from "node:fs";
 import { join } from "node:path";
+import { portalByExecutor } from "./build-spk/dsm-version.js";
 import { loadContract } from "./contract/load.js";
 import { appOriginFromContract } from "./host/open-url.js";
 import { resolveDeployIdentity } from "./deploy/identity.js";
@@ -169,7 +170,7 @@ export async function standaloneInfo(options) {
         ...state,
         capabilities,
         ...(executor ? { executor } : {}),
-        uninstallCleanup: uninstallCleanup(m.package, { executor: Boolean(m.capabilities.rootOps || m.capabilities.delegate), portal: Boolean(m.portal) }),
+        uninstallCleanup: uninstallCleanup(m.package, { executor: Boolean(m.capabilities.rootOps || m.capabilities.delegate), portal: Boolean(m.portal && !portalByExecutor(m.os_min_ver)), portalEntry: Boolean(m.portal && portalByExecutor(m.os_min_ver)) }),
     };
 }
 /** What the installed App's portal.status says; DSM owns the alias, an administrator sets it. */

package/dist/portal/alias.d.ts

@@ -25,3 +25,11 @@ export declare function isPortalAlias(value: unknown): value is string;
 export declare function defaultPortalAlias(packageId: string): string;
 /** `{}` or `{alias}`; undefined for any other shape. */
 export declare function readPortalDeclaration(value: unknown, packageId: string): PortalDeclaration | undefined;
+/** The Application Portal entry a root executor registers in DSM's app.d, as its approved policy states it. */
+export interface PortalEntry {
+    /** Control Panel display name. */
+    application: string;
+    alias: string;
+}
+/** Why the executor would refuse this entry; undefined when it accepts it. */
+export declare function portalEntryProblem(packageId: string, entry: PortalEntry): string | undefined;

package/dist/portal/alias.js

@@ -41,3 +41,19 @@ export function readPortalDeclaration(value, packageId) {
         return { alias: defaultPortalAlias(packageId) };
     return isPortalAlias(alias) ? { alias } : undefined;
 }
+/**
+ * The executor's own rules (executor/portal_entry.go): the package name and
+ * alias become DSM file and nginx names, the application a JSON string.
+ */
+const ENTRY_PACKAGE = /^[A-Za-z0-9]+(?:[._-][A-Za-z0-9]+)*$/;
+const ENTRY_ALIAS = /^[A-Za-z0-9][A-Za-z0-9_-]{0,63}$/;
+/** Why the executor would refuse this entry; undefined when it accepts it. */
+export function portalEntryProblem(packageId, entry) {
+    if (packageId.length > 64 || !ENTRY_PACKAGE.test(packageId))
+        return `套件名稱「${packageId}」不能當作 Application Portal 的檔名：只能用英數字，以 . _ - 分隔，最多 64 字。`;
+    if (!ENTRY_ALIAS.test(entry.alias))
+        return `portal 別名「${entry.alias}」不能當作 Application Portal 的路徑。`;
+    if (!entry.application || [...entry.application].length > 64 || /\p{Cc}/u.test(entry.application))
+        return `displayname「${entry.application}」不能當作 Application Portal 的名稱：1–64 個字，不可含控制字元。`;
+    return undefined;
+}

package/dist/runtime/executor-digests.json

@@ -64,5 +64,16 @@
             "armv7": "b65a14f0fc77a1d3221c7dc6781eb66059aa200956b094d58a62bd1cad10f116"
         },
         "goToolchain": "go1.26.9"
+    },
+    "0.9.6": {
+        "x86_64": "4241dfebd2b819c2566eca062ee0021b99e7f86bbe4703f50833874f79b3cf54",
+        "aarch64": "923514aca8cf6576c6c52c737d53c2c7cc4bfcec40591dcec995005be41add95",
+        "armv7": "df959648ac8e6201f1cf9b86b57730c09ba1afb7ecc151ba2f530ad15dd90ccf",
+        "lifecycle": {
+            "x86_64": "819459580135e016184ad80c258350d57194d6134e8aa4cf1caf5237085b1004",
+            "aarch64": "5abcfc21403e84a0af15d972bcb819ac6fedfd9aaf5898ddc8c4bb06130f9f59",
+            "armv7": "b65a14f0fc77a1d3221c7dc6781eb66059aa200956b094d58a62bd1cad10f116"
+        },
+        "goToolchain": "go1.26.9"
     }
 }

package/dist/runtime/executor-policy.d.ts

@@ -1,8 +1,11 @@
 import type { RootOp } from '../standalone/root-ops.js';
 import type { EntryMode } from '../standalone/manifest.js';
+import { type PortalDeclaration, type PortalEntry } from '../portal/alias.js';
 export declare const FILE_OPERATIONS: readonly ["files.list", "files.info", "files.createFolder", "files.checkPermission", "files.write", "files.read", "files.rename", "files.copy", "files.move", "files.delete"];
 /** Started File Station tasks are followed with these; they are implied, never declared. */
 export declare const FILE_TASK_OPERATIONS: readonly ["files.taskStatus", "files.taskCancel"];
+/** An executor that registers the portal entry serves both, and only with a policy `portal`. */
+export declare const PORTAL_OPERATIONS: readonly ["portal.register", "portal.unregister"];
 export interface DelegateCapability {
     operations: string[];
     scope: string;
@@ -21,6 +24,8 @@ export interface ExecutorPolicy {
     lifetime?: 'until-revoked';
     package: string;
     operations: string[];
+    /** Below DSM 7.2 the executor registers this Application Portal entry; DSM 7.1 refuses web-config for unsigned packages. */
+    portal?: PortalEntry;
     root: Record<string, string>;
 }
 /** The exact policy file bytes whose sha256 is the policy pin. */
@@ -34,6 +39,9 @@ export declare function executorPolicy(m: {
         rootOps?: true;
     };
     rootOps?: RootOp[];
+    portal?: PortalDeclaration;
+    os_min_ver?: string;
+    displayname?: string;
 }): ExecutorPolicy;
 /** Inventory rejects malformed extensions even if a caller recomputes every pin. */
 export declare function validExecutorPolicy(value: unknown, pkg: string): value is ExecutorPolicy;

package/dist/runtime/executor-policy.js

@@ -1,9 +1,13 @@
 import { createHash } from 'node:crypto';
 import { MOVE_FROM_STAGING, DELEGATE_EXTENSION_OPERATIONS } from './delegate-contract.js';
+import { portalByExecutor } from '../build-spk/dsm-version.js';
+import { portalEntryProblem } from '../portal/alias.js';
 export const FILE_OPERATIONS = ['files.list', 'files.info', 'files.createFolder', 'files.checkPermission', 'files.write', 'files.read', 'files.rename', 'files.copy', 'files.move', 'files.delete'];
 /** Started File Station tasks are followed with these; they are implied, never declared. */
 export const FILE_TASK_OPERATIONS = ['files.taskStatus', 'files.taskCancel'];
 const TASK_STARTING_OPERATIONS = ['files.copy', 'files.move', 'files.delete'];
+/** An executor that registers the portal entry serves both, and only with a policy `portal`. */
+export const PORTAL_OPERATIONS = ['portal.register', 'portal.unregister'];
 export function validDelegate(value) {
     if (!value || typeof value !== 'object' || Array.isArray(value))
         return false;
@@ -24,7 +28,8 @@ export const executorPolicyText = (policy) => JSON.stringify(policy) + '\n';
 export function executorPolicy(m) {
     if (m.capabilities.delegate && !validDelegate(m.capabilities.delegate))
         throw new Error('[EXECUTOR_POLICY] Invalid delegate operations or scope.');
-    const operations = ['status'];
+    const portal = executorPortal(m);
+    const operations = ['status', ...(portal ? PORTAL_OPERATIONS : [])];
     if (m.capabilities.delegate) {
         operations.push('delegate.create', 'delegate.list', 'delegate.revoke', ...m.capabilities.delegate.operations);
         if (m.capabilities.delegate.operations.some(op => TASK_STARTING_OPERATIONS.includes(op)))
@@ -41,21 +46,33 @@ export function executorPolicy(m) {
     const d = m.capabilities.delegate;
     return { v: 1, package: m.package, app: `SYNO.SDS.${m.package}.Instance`, ...(m.entry ? { entry: m.entry } : {}), ...(d ? { scope: d.scope } : {}),
         ...(d?.lifetime ? { destinations: [...d.destinations].sort(), lifetime: d.lifetime } : {}),
-        operations: [...new Set(operations)].sort(), root };
+        operations: [...new Set(operations)].sort(), ...(portal ? { portal } : {}), root };
+}
+/** The entry the executor registers: a portal App whose os_min_ver is below DSM 7.2. */
+function executorPortal(m) {
+    if (!m.portal || !m.os_min_ver || !portalByExecutor(m.os_min_ver))
+        return undefined;
+    const entry = { application: m.displayname ?? '', alias: m.portal.alias };
+    const problem = portalEntryProblem(m.package, entry);
+    if (problem)
+        throw new Error(`[EXECUTOR_POLICY] ${problem}`);
+    return entry;
 }
 /** Inventory rejects malformed extensions even if a caller recomputes every pin. */
 export function validExecutorPolicy(value, pkg) {
     if (!value || typeof value !== 'object' || Array.isArray(value))
         return false;
     const p = value;
-    if (Object.keys(p).some(key => !['v', 'package', 'app', 'entry', 'scope', 'destinations', 'lifetime', 'operations', 'root'].includes(key))
+    if (Object.keys(p).some(key => !['v', 'package', 'app', 'entry', 'scope', 'destinations', 'lifetime', 'operations', 'portal', 'root'].includes(key))
         || p.v !== 1 || p.package !== pkg || p.app !== `SYNO.SDS.${pkg}.Instance`
         || 'entry' in p && p.entry !== 'admin-only' && p.entry !== 'app-privilege'
         || !Array.isArray(p.operations) || !p.operations.includes('status') || new Set(p.operations).size !== p.operations.length
         || !p.root || typeof p.root !== 'object' || Array.isArray(p.root))
         return false;
     const base = ['status', 'root.run', 'delegate.create', 'delegate.list', 'delegate.revoke'];
-    if (p.operations.some(op => ![...base, ...FILE_OPERATIONS, ...FILE_TASK_OPERATIONS, ...DELEGATE_EXTENSION_OPERATIONS].includes(op)))
+    if (p.operations.some(op => ![...base, ...FILE_OPERATIONS, ...FILE_TASK_OPERATIONS, ...DELEGATE_EXTENSION_OPERATIONS, ...PORTAL_OPERATIONS].includes(op)))
+        return false;
+    if (!PORTAL_OPERATIONS.every(op => p.operations.includes(op) === (p.portal !== undefined)) || p.portal !== undefined && !validPortalEntry(p.portal, pkg))
         return false;
     const delegated = p.operations.some(op => op.startsWith('files.') || op.startsWith('delegate.'));
     if (!delegated)
@@ -65,5 +82,12 @@ export function validExecutorPolicy(value, pkg) {
     if (!validDelegate(capability))
         return false;
     const expected = executorPolicy({ package: pkg, capabilities: { delegate: capability, ...(p.operations.includes('root.run') ? { rootOps: true } : {}) } }).operations;
-    return expected.length === p.operations.length && expected.every(op => p.operations.includes(op));
+    const declared = p.operations.filter(op => !PORTAL_OPERATIONS.includes(op));
+    return expected.length === declared.length && expected.every(op => declared.includes(op));
+}
+function validPortalEntry(value, pkg) {
+    if (!value || typeof value !== 'object' || Array.isArray(value) || Object.keys(value).some(key => key !== 'application' && key !== 'alias'))
+        return false;
+    const { application, alias } = value;
+    return typeof application === 'string' && typeof alias === 'string' && portalEntryProblem(pkg, { application, alias }) === undefined;
 }

package/dist/runtime/uninstall-cleanup.d.ts

@@ -9,5 +9,9 @@ export interface UninstallCleanupOptions {
     executor?: boolean;
     /** The App declares a Login Portal alias; only the executor tier can. */
     portal?: boolean;
+    /** Below DSM 7.2 the executor registered the App's Application Portal entry. */
+    portalEntry?: boolean;
 }
-export declare function uninstallCleanup(pkg: string, { executor, portal }?: UninstallCleanupOptions): UninstallCleanupItem[];
+/** The root commands that remove an Application Portal entry the executor could not unregister. */
+export declare function portalEntryCleanupCommands(pkg: string): string[];
+export declare function uninstallCleanup(pkg: string, { executor, portal, portalEntry }?: UninstallCleanupOptions): UninstallCleanupItem[];

package/dist/runtime/uninstall-cleanup.js

@@ -1,5 +1,14 @@
+/** The root commands that remove an Application Portal entry the executor could not unregister. */
+export function portalEntryCleanupCommands(pkg) {
+    return [
+        `rm -f /usr/syno/etc/www/app.d/${pkg}.json /usr/syno/etc/www/app.d/${pkg}.mustache /usr/syno/etc/packages/${pkg}/AppPortal.json`,
+        `for c in dsm www alias .alias; do n=$c.syno-app-portal.${pkg}.conf; synow3tool --disable-nginx-confd=$n; synow3tool --unreg-nginx-confd=$n; done`,
+        `for c in server .server; do n=$c.syno-app-portal.${pkg}.conf; synow3tool --disable-nginx-sites=$n; synow3tool --unreg-nginx-sites=$n; done`,
+        'nginx -t && synow3tool --nginx=reload',
+    ];
+}
 const AUTOMATIC_FAILED = 'Only if automatic cleanup failed after uninstall; see the system log entry synopkgland-executor.';
-export function uninstallCleanup(pkg, { executor = false, portal = false } = {}) {
+export function uninstallCleanup(pkg, { executor = false, portal = false, portalEntry = false } = {}) {
     const items = [
         { target: `@appdata/${pkg}, @appconf/${pkg}, @apphome/${pkg}`, condition: 'After uninstall, if retained data or empty DSM directories are no longer needed.', action: 'Back up retained data; an administrator may remove only these package-specific directories. The delete-data checkbox empties their contents and preserves DSM directory roots.' },
         { target: `@appshare/${pkg}, /usr/syno/etc/packages/${pkg}`, condition: 'After uninstall, if DSM leaves package infrastructure or a package-config symlink.', action: 'Administrator: inspect these package-specific paths and remove unused infrastructure; do not follow the symlink to delete shared data.' },
@@ -8,6 +17,7 @@ export function uninstallCleanup(pkg, { executor = false, portal = false } = {})
             ? { target: `SYNO.SDS.${pkg}.Instance rules in Application Privileges`, condition: AUTOMATIC_FAILED, action: 'The root executor removes these rules automatically through the Application Privileges API on uninstall. Administrator: remove surviving rules in Control Panel > Application Privileges; DSM would apply them again to a later install under the same name.' }
             : { target: `SYNO.SDS.${pkg}.Instance rules in Application Privileges`, condition: 'After uninstall, if this package will not be reinstalled.', action: 'DSM keeps these rules in /etc/synoappprivilege.db and applies them again to a later install under the same name. Administrator: remove them in Control Panel > Application Privileges.' },
         ...(executor && portal ? [{ target: `${pkg} Login Portal alias`, condition: AUTOMATIC_FAILED, action: 'DSM removes the alias configuration without reloading its web server; the root executor then reloads the web server automatically. Administrator: if the alias still opens a DSM page, save an application alias in Control Panel > Login Portal > Applications to reload it, or restart the NAS.' }] : []),
+        ...(executor && portalEntry ? [{ target: `${pkg} Application Portal entry`, condition: 'After uninstall, if the executor was not running or was never approved, so it could not remove the entry.', action: `Administrator, as root: ${portalEntryCleanupCommands(pkg).join('; ')}` }] : []),
         { target: `${pkg} package account/group`, condition: 'After uninstall, only if this package will not be reinstalled and the identity is unused.', action: 'Administrator: review DSM internal account/group and associated ACLs before cleanup. Package scripts do not delete system identities.' },
     ];
     if (executor)

package/dist/standalone/build.js

@@ -4,7 +4,7 @@ import { existsSync, mkdirSync, mkdtempSync, rmSync } from "node:fs";
 import { tmpdir } from "node:os";
 import { join } from "node:path";
 import { goBuildEnv } from "../build-spk/dsm-arch.js";
-import { resolveMinDsm, DEFAULT_MIN_DSM, isDsmAtLeast, PORTAL_MIN_DSM, portalMinDsmMessage } from "../build-spk/dsm-version.js";
+import { resolveMinDsm, DEFAULT_MIN_DSM, isDsmAtLeast, PORTAL_EXECUTOR_MIN_DSM, portalByExecutor, portalMinDsmMessage } from "../build-spk/dsm-version.js";
 import { checkCgiBinary } from "./binary.js";
 import { loadStandaloneManifest } from "./manifest.js";
 import { assembleStandaloneSpk, StandaloneBuildError } from "./spk.js";
@@ -80,7 +80,7 @@ export async function buildStandalone(options) {
     if (manifest.capabilities.rootOps === true && !isDsmAtLeast(manifest.os_min_ver, DEFAULT_MIN_DSM)) {
         throw new StandaloneBuildError("STANDALONE_OS_MIN_VER_INVALID", `root templates require DSM ${DEFAULT_MIN_DSM} or later.`);
     }
-    if (manifest.portal && !isDsmAtLeast(manifest.os_min_ver, PORTAL_MIN_DSM)) {
+    if (manifest.portal && !isDsmAtLeast(manifest.os_min_ver, PORTAL_EXECUTOR_MIN_DSM)) {
         throw new StandaloneBuildError("STANDALONE_PORTAL_MIN_DSM", `[STANDALONE_PORTAL_MIN_DSM] ${portalMinDsmMessage(manifest.os_min_ver, "portal")}`);
     }
     const jobs = checkJobs(options.jobs);
@@ -160,7 +160,7 @@ async function backendFor(manifest, arch, work, run) {
         ...(manifest.capabilities.identity ? [`-X main.identity=${manifest.capabilities.identity}`] : []),
         ...(manifest.capabilities.files || manifest.capabilities.delegate ? [`-X main.fileStation=session`] : []),
         ...(manifest.entry ? [`-X main.entry=${manifest.entry}`] : []),
-        ...(manifest.portal ? ["-X main.portal=on"] : []),
+        ...(manifest.portal ? [`-X main.portal=${portalByExecutor(manifest.os_min_ver) ? "executor" : "on"}`] : []),
     ].join(" ");
     const result = await run("go", ["build", "-trimpath", "-buildvcs=false", "-ldflags", ldflags, "-o", out, backend.main], {
         cwd: backend.dir,

package/dist/standalone/dsm-window.js

@@ -4,6 +4,7 @@ import { PASSWORD_CONFIRM, ROOT_PANEL, ROOT_RUNTIME, rootPanelCatalogs } from ".
 import { HOST_ADAPTER_RUNTIME } from "./host-adapter.js";
 import { permitsOrdinaryUsers } from "./api-permissions.js";
 import { PORTAL_RUNTIME } from "./portal-window.js";
+import { portalByExecutor } from "../build-spk/dsm-version.js";
 import { uiTitleFields } from "../build-spk/ui-texts.js";
 /** Same path the generated wrapper POSTs to, and the payload location of the CGI. */
 export const CGI_PAYLOAD_PATH = "ui/cgi/api.cgi";
@@ -172,6 +173,15 @@ ${root ? root.definitions : ""}${manifest.portal ? renderPortalDefinition(ns) :
   document.head.appendChild(js);
 };
 
+// DSM reopens a window at the size it was last left at, even one saved on a
+// larger screen, and only moves a window that does not fit: keep it inside.
+${ns}.fitDesktop = function (size) {
+  var taskbar = SYNO.SDS.TaskBar ? SYNO.SDS.TaskBar.height() : 0;
+  size.width = Math.min(size.width, Ext.lib.Dom.getViewWidth());
+  size.height = Math.min(size.height, Ext.lib.Dom.getViewHeight() - taskbar);
+  return size;
+};
+
 Ext.define(${JSON.stringify(`${ns}.Instance`)}, {
   extend: "SYNO.SDS.AppInstance",
   appWindowName: ${JSON.stringify(`${ns}.MainWindow`)}
@@ -180,10 +190,13 @@ Ext.define(${JSON.stringify(`${ns}.Instance`)}, {
 Ext.define(${JSON.stringify(`${ns}.MainWindow`)}, {
   extend: "SYNO.SDS.AppWindow",
   constructor: function (config) {
-    this.callParent([Ext.apply({
+    this.callParent([${ns}.fitDesktop(Ext.apply({
       width: 960, height: 640, minWidth: 700, minHeight: 420, layout: "fit",
       ${root ? root.html : `html: '<div class="dsmapp-root" style="height:100%"></div>'`}
-    }, config)]);
+    }, config))]);
+  },
+  getRestoreSizePos: function (config) {
+    return ${ns}.fitDesktop(Ext.apply({ width: config.width, height: config.height }, this.callParent(arguments)));
   },
   onOpen: function () {
     this.callParent(arguments);
@@ -267,7 +280,7 @@ ${PORTAL_RUNTIME}
 function renderPortalAccess(ns, manifest) {
     return `${ns}.createPortalAccess({
             appId: ${JSON.stringify(`${ns}.Instance`)},
-            defaultAlias: ${JSON.stringify(manifest.portal.alias)},
+            defaultAlias: ${JSON.stringify(manifest.portal.alias)},${portalByExecutor(manifest.os_min_ver) ? "\n            entry: true," : ""}
             isAdmin: function () { return ${ns}.sessionUser().isAdmin; },
             send: ${ns}.webApi(me),
             call: ${ns}.call,

package/dist/standalone/inspect-spk.js

@@ -6,7 +6,7 @@ import { tmpdir } from "node:os";
 import { join } from "node:path";
 import * as tar from "tar";
 import { familyOfArchToken, NATIVE_ARCH_FAMILIES } from "../build-spk/dsm-arch.js";
-import { CONTAINER_MIN_DSM, isDsmAtLeast, PORTAL_MIN_DSM } from "../build-spk/dsm-version.js";
+import { CONTAINER_MIN_DSM, isDsmAtLeast, PORTAL_EXECUTOR_MIN_DSM, PORTAL_MIN_DSM, PORTAL_MIN_DSM_REASON } from "../build-spk/dsm-version.js";
 import { ELF_MACHINE } from "./binary.js";
 import { CGI_PAYLOAD_PATH, entryLauncherAccess } from "./dsm-window.js";
 import { daemonConfig, readDaemon } from "./daemon.js";
@@ -73,7 +73,7 @@ export async function inspectSpk(spkPath, expectedKind) {
         // A Compose App has no executor, so its SPK never carries a portal.
         const portal = standalone ? await recoverPortal(dir, info, `SYNO.SDS.${info.package}.Instance`, paths, payload, findings) : undefined;
         if (portal && info.os_min_ver && OS_MIN_VER.test(info.os_min_ver) && !isDsmAtLeast(info.os_min_ver, PORTAL_MIN_DSM)) {
-            findings.push(`INFO os_min_ver「${info.os_min_ver}」低於 portal 需要的 DSM ${PORTAL_MIN_DSM}；DSM 7.1.1 以錯誤 320 拒裝帶 web-config app-portal 的未簽章套件，7.2 未驗證`);
+            findings.push(`INFO os_min_ver「${info.os_min_ver}」低於 portal 需要的 DSM ${PORTAL_MIN_DSM}；${PORTAL_MIN_DSM_REASON}`);
         }
         checkConf(dir, findings, kind, background, sharedFolder, info.package, portal);
         checkScripts(dir, findings);
@@ -96,6 +96,9 @@ export async function inspectSpk(spkPath, expectedKind) {
             executor = inspected.executor;
             if (executor)
                 findings.push(...inspectExecutorAnchor(readFileSync(join(dir, "INFO"), "utf8"), executor.executorDigest));
+            if (executor?.policy.portal && info.os_min_ver && OS_MIN_VER.test(info.os_min_ver) && !isDsmAtLeast(info.os_min_ver, PORTAL_EXECUTOR_MIN_DSM)) {
+                findings.push(`INFO os_min_ver「${info.os_min_ver}」低於 executor 註冊 portal 需要的 DSM ${PORTAL_EXECUTOR_MIN_DSM}`);
+            }
             if (payload.find(p => p.path === "executor/executor")?.mode !== "0755")
                 findings.push("Executor must be executable.");
             if (payload.find(p => p.path === "executor/lifecycle")?.mode !== "0755")
@@ -107,7 +110,7 @@ export async function inspectSpk(spkPath, expectedKind) {
                         findings.push(`Executor scripts/${hook} differs from fixed lifecycle.`);
                 }
             }
-            for (const [name, text] of Object.entries(renderUninstallWizardFiles(info.package, "native", { executor: true, portal: Boolean(portal) }))) {
+            for (const [name, text] of Object.entries(renderUninstallWizardFiles(info.package, "native", { executor: true, portal: Boolean(portal), portalEntry: Boolean(executor?.policy.portal) }))) {
                 if (readOptional(join(dir, "WIZARD_UIFILES", name)) !== text)
                     findings.push(`Executor WIZARD_UIFILES/${name} is missing cleanup guidance.`);
             }
@@ -132,8 +135,9 @@ export async function inspectSpk(spkPath, expectedKind) {
             icon,
             ...(executor ? { executor } : {}),
             ...(portal ? { portal: { appId: portal.appId, alias: portal.alias } } : {}),
+            ...(executor?.policy.portal ? { portal: { appId: executor.policy.app, alias: executor.policy.portal.alias } } : {}),
             ...(metadata.entry ? { entry: metadata.entry } : {}),
-            ...(standalone ? { uninstallCleanup: uninstallCleanup(info.package, { executor: hasExecutor, portal: Boolean(portal) }) } : {}),
+            ...(standalone ? { uninstallCleanup: uninstallCleanup(info.package, { executor: hasExecutor, portal: Boolean(portal), portalEntry: Boolean(executor?.policy.portal) }) } : {}),
             package: info.package,
             version: info.version,
             arch: info.arch,

package/dist/standalone/manifest.js

@@ -8,10 +8,10 @@ import { checkGlossary, loadCatalogs, readInfoTranslations } from "./i18n.js";
 import { loadRootOps, ROOT_OPS_DIR } from "./root-ops.js";
 import { readDaemon } from "./daemon.js";
 import { readBackground } from "./background.js";
-import { DEFAULT_MIN_DSM, isDsmAtLeast, PORTAL_MIN_DSM, portalMinDsmMessage } from "../build-spk/dsm-version.js";
+import { DEFAULT_MIN_DSM, isDsmAtLeast, PORTAL_EXECUTOR_MIN_DSM, portalByExecutor, portalMinDsmMessage } from "../build-spk/dsm-version.js";
 import { readSharedFolder } from "./shared-folder.js";
 import { floorAtAdministrators, permitsOrdinaryUsers, readApiPermissions } from "./api-permissions.js";
-import { PORTAL_REQUIRES_EXECUTOR, readPortalDeclaration } from "../portal/alias.js";
+import { PORTAL_REQUIRES_EXECUTOR, portalEntryProblem, readPortalDeclaration } from "../portal/alias.js";
 import { renderPackageIcons } from "../build-spk/dsm-icons.js";
 import { validateReproducible } from "../reproducible-config.js";
 import { SDK_MODULE, sdkRequirement } from "../runtime/sdk-source.js";
@@ -180,9 +180,13 @@ function readManifest(raw, c) {
     if (portal && !capabilities.rootOps && !capabilities.delegate) {
         c.fail("STANDALONE_PORTAL_REQUIRES_EXECUTOR", PORTAL_REQUIRES_EXECUTOR);
     }
-    if (portal && osMinVer && !isDsmAtLeast(osMinVer, PORTAL_MIN_DSM)) {
+    if (portal && osMinVer && !isDsmAtLeast(osMinVer, PORTAL_EXECUTOR_MIN_DSM)) {
         c.fail("STANDALONE_PORTAL_MIN_DSM", portalMinDsmMessage(osMinVer, "portal"));
     }
+    const entryProblem = portal && packageId && displayname && osMinVer && portalByExecutor(osMinVer)
+        ? portalEntryProblem(packageId, { application: displayname, alias: portal.alias }) : undefined;
+    if (entryProblem)
+        c.fail("STANDALONE_PORTAL_ENTRY_INVALID", entryProblem);
     if (!packageId || !version || !build || !osMinVer || !displayname || !description || !maintainer
         || !arches || !backend || !ui || (capabilities.rootOps === true && !rootOps)) {
         return undefined;

package/dist/standalone/native-layout.d.ts

@@ -1,5 +1,6 @@
 import { type PackageMetadata } from "../package-metadata.js";
 import type { CommandRunner } from './build.js';
+import { type PortalDeclaration } from '../portal/alias.js';
 export declare const LAYOUT_ARCHES: {
     readonly x86_64: readonly [2, 62];
     readonly aarch64: readonly [2, 183];
@@ -50,6 +51,8 @@ export interface NativeLayout {
         hook: Hook;
         toolkits: Partial<Record<LayoutArch, Toolkit[]>>;
     };
+    /** The product's own root helper registers this Application Portal entry; the CLI only names it in INFO. */
+    portal?: PortalDeclaration;
 }
 export declare function isNativeLayout(root: string): boolean;
 export declare function loadNativeLayout(root: string): {

package/dist/standalone/native-layout.js

@@ -9,7 +9,8 @@ import { createReproducibleTar } from '../build-spk/reproducible-archive.js';
 import { runCommand, runnerFor } from './build.js';
 import { checkJobs, commitOutputs, forEachArch } from './arch-jobs.js';
 import { validateReproducible } from '../reproducible-config.js';
-import { resolveMinDsm } from '../build-spk/dsm-version.js';
+import { isDsmAtLeast, PORTAL_EXECUTOR_MIN_DSM, resolveMinDsm } from '../build-spk/dsm-version.js';
+import { portalEntryProblem, readPortalDeclaration } from '../portal/alias.js';
 import { infoArchValue } from '../build-spk/dsm-arch.js';
 import { LIFECYCLE_SCRIPTS, REPLACE_SCRIPTS } from '../spk/dsm-spec.js';
 import { renderPackageIcons, writePackageCenterIcons } from '../build-spk/dsm-icons.js';
@@ -58,6 +59,19 @@ function anchors(value) {
     }
     return a;
 }
+// Like the anchors, INFO is the root helper's trusted copy of the entry it
+// registers in DSM's app.d: the alias, under the INFO displayname.
+const PORTAL_INFO_KEY = 'synopkgland_portal_alias';
+function portal(value, packageId) {
+    return readPortalDeclaration(value, packageId) ?? fail('portal must be {} or {alias: <lowercase letters, digits and -, 1-64, not a DSM path>}');
+}
+function checkPortal(p, packageId, displayname, osMinVer) {
+    if (!isDsmAtLeast(osMinVer, PORTAL_EXECUTOR_MIN_DSM))
+        fail(`portal needs DSM ${PORTAL_EXECUTOR_MIN_DSM} or later, where the app.d entry format is verified; os_min_ver is ${osMinVer}`);
+    const problem = portalEntryProblem(packageId, { application: displayname, alias: p.alias });
+    if (problem)
+        fail(problem);
+}
 function hook(value) {
     const h = object(value, ['command', 'cwd', 'env']);
     if (!Array.isArray(h.command) || !h.command.length || !h.command.every((x) => typeof x === 'string' && x.length > 0 && !x.includes('\0')))
@@ -90,7 +104,7 @@ export function isNativeLayout(root) {
 }
 export function loadNativeLayout(root) {
     try {
-        const m = object(parse(readFileSync(join(root, 'dsm-package.yaml'), 'utf8')), ['schema', 'backend', 'package', 'version', 'build', 'displayname', 'description', 'maintainer', 'metadata', 'os_min_ver', 'privilege', 'arches', 'layout', 'native', 'icon', 'reproducible']);
+        const m = object(parse(readFileSync(join(root, 'dsm-package.yaml'), 'utf8')), ['schema', 'backend', 'package', 'version', 'build', 'displayname', 'description', 'maintainer', 'metadata', 'os_min_ver', 'privilege', 'arches', 'layout', 'native', 'icon', 'reproducible', 'portal']);
         if (m.schema !== 2)
             fail('schema 2 required; migrate schema: 1 to schema: 2 and add backend: {kind: native}');
         const backend = object(m.backend, ['kind']);
@@ -113,6 +127,10 @@ export function loadNativeLayout(root) {
             m.icon = icon(root, m.icon);
         if (m.reproducible !== undefined)
             validateReproducible(m.reproducible);
+        if (m.portal !== undefined) {
+            m.portal = portal(m.portal, m.package);
+            checkPortal(m.portal, m.package, m.displayname, m.os_min_ver);
+        }
         const layout = object(m.layout, ['payload', 'metadata', 'binaries', 'anchors']);
         layout.payload = pathText(layout.payload);
         layout.metadata = pathText(layout.metadata);
@@ -363,6 +381,8 @@ export async function buildNativeLayout(options) {
             fail('invalid build override');
         m.build = options.build;
     }
+    if (m.portal)
+        checkPortal(m.portal, m.package, m.displayname, m.os_min_ver);
     const arches = options.arches ?? m.arches;
     if (!arches.length || new Set(arches).size !== arches.length || arches.some(a => !m.arches.includes(a)))
         fail('architecture not declared');
@@ -402,11 +422,11 @@ export async function buildNativeLayout(options) {
             await createReproducibleTar(target, join(stage, 'package.tgz'), { gzip: true });
             rmSync(target, { recursive: true });
             const fields = { package: m.package, version, arch: layoutInfoArch(arch), os_min_ver: m.os_min_ver, displayname: m.displayname, description: m.description, maintainer: m.maintainer, dsmuidir: 'ui', dsmappname: `SYNO.SDS.${m.package}.Instance`, startable: 'yes', thirdparty: 'yes', checksum: createHash('md5').update(readFileSync(join(stage, 'package.tgz'))).digest('hex') };
-            const info = [...Object.entries(fields), ...metadataInfoFields(m.metadata), ...anchorFields(m.layout.anchors ?? {}, files)];
+            const info = [...Object.entries(fields), ...metadataInfoFields(m.metadata), ...anchorFields(m.layout.anchors ?? {}, files), ...portalFields(m.portal)];
             if (new Set(info.map(([k]) => k)).size !== info.length)
                 fail('INFO anchor collides with an INFO field');
             writeFileSync(join(stage, 'INFO'), info.map(([k, v]) => `${k}="${v.replace(/([\\"$`])/g, '\\$1')}"\n`).join(''));
-            writeFileSync(join(stage, 'native-layout.json'), JSON.stringify({ format: 1, arch, binaries: binaries.map(({ path, linkage }) => ({ path, linkage })), files, ...(m.layout.anchors ? { anchors: m.layout.anchors } : {}) }));
+            writeFileSync(join(stage, 'native-layout.json'), JSON.stringify({ format: 1, arch, binaries: binaries.map(({ path, linkage }) => ({ path, linkage })), files, ...(m.layout.anchors ? { anchors: m.layout.anchors } : {}), ...(m.portal ? { portal: m.portal } : {}) }));
             const output = join(outDir, `${m.package}-${version}-${arch}.spk`);
             await createReproducibleTar(stage, output);
             return output;
@@ -423,7 +443,7 @@ export function inspectNativeLayout(dir, payload, info) {
     try {
         if (!/^[A-Za-z][A-Za-z0-9]{1,63}$/.test(info.package ?? '') || !/^\d+(\.\d+){0,3}-\d+$/.test(info.version ?? '') || !/^7\.\d+(\.\d+)?-\d+$/.test(info.os_min_ver ?? ''))
             fail('invalid native INFO identity/version/DSM');
-        const inv = object(JSON.parse(readFileSync(join(dir, 'native-layout.json'), 'utf8')), ['format', 'arch', 'binaries', 'files', 'anchors']);
+        const inv = object(JSON.parse(readFileSync(join(dir, 'native-layout.json'), 'utf8')), ['format', 'arch', 'binaries', 'files', 'anchors', 'portal']);
         if (inv.format !== 1 || !Object.hasOwn(LAYOUT_ARCHES, inv.arch) || layoutInfoArch(inv.arch) !== info.arch)
             fail('invalid native layout inventory');
         checkLayoutMetadata(dir, true, info.package);
@@ -442,6 +462,10 @@ export function inspectNativeLayout(dir, payload, info) {
         if (createHash('md5').update(readFileSync(join(dir, 'package.tgz'))).digest('hex') !== info.checksum)
             fail('package checksum mismatch');
         checkInfoAnchors(readFileSync(join(dir, 'INFO'), 'utf8'), inv.anchors === undefined ? {} : anchors(inv.anchors), actual);
+        const declared = inv.portal === undefined ? undefined : portal(inv.portal, info.package);
+        if (declared)
+            checkPortal(declared, info.package, info.displayname ?? '', info.os_min_ver);
+        checkInfoPortal(readFileSync(join(dir, 'INFO'), 'utf8'), declared);
         return [];
     }
     catch (e) {
@@ -457,3 +481,11 @@ function checkInfoAnchors(info, declared, files) {
     if (JSON.stringify(lines.sort()) !== JSON.stringify(expected.sort()))
         fail('INFO anchors do not match the payload');
 }
+function portalFields(declared) {
+    return declared ? [[PORTAL_INFO_KEY, declared.alias]] : [];
+}
+function checkInfoPortal(info, declared) {
+    const lines = info.split('\n').filter(line => line.startsWith('synopkgland_portal_'));
+    if (JSON.stringify(lines) !== JSON.stringify(portalFields(declared).map(([key, value]) => `${key}="${value}"`)))
+        fail('INFO portal alias does not match the declared portal');
+}

package/dist/standalone/native-root-window.d.ts

@@ -16,7 +16,8 @@ export interface RootTask {
  * - authorize: DSM's own password confirmation, then one disabled root task
  *   with exactly the embedded script. The one-use token goes into that single
  *   create call and is never kept.
- * - run: re-reads the task and runs it only if it is still exactly ours, then
+ * - run: re-reads the task and runs it only if it is still exactly ours (the
+ *   first run after an authorize uses the task that authorize just read back), then
  *   waits for its history entry and asks the backend for the output. A queued
  *   or running task keeps the wait going, up to RUN_LIMIT_MS (loaded NAS took
  *   4.5 minutes), and `options.progress({op, state, elapsedMs})` hears each poll. Repair

package/dist/standalone/native-root-window.js

@@ -7,7 +7,8 @@ import { versionUnsupported } from "../runtime/dsm-version.js";
  * - authorize: DSM's own password confirmation, then one disabled root task
  *   with exactly the embedded script. The one-use token goes into that single
  *   create call and is never kept.
- * - run: re-reads the task and runs it only if it is still exactly ours, then
+ * - run: re-reads the task and runs it only if it is still exactly ours (the
+ *   first run after an authorize uses the task that authorize just read back), then
  *   waits for its history entry and asks the backend for the output. A queued
  *   or running task keeps the wait going, up to RUN_LIMIT_MS (loaded NAS took
  *   4.5 minutes), and `options.progress({op, state, elapsedMs})` hears each poll. Repair
@@ -18,8 +19,9 @@ import { versionUnsupported } from "../runtime/dsm-version.js";
  */
 export const ROOT_RUNTIME = `function createRootAccess(options) {
   var API = "SYNO.Core.TaskScheduler";
-  var POLL_MS = 500, MAX_POLL_MS = 2000, RUN_LIMIT_MS = 10 * 60 * 1000;
-  var byOp = {}, running = {};
+  var POLL_MS = 500, MAX_POLL_MS = 1000, RUN_LIMIT_MS = 10 * 60 * 1000;
+  // The task an authorize just read back as exactly ours, for the run that follows.
+  var byOp = {}, running = {}, verified = {};
   var legacy = null, probe = null;
   var versionUnsupported = ${versionUnsupported.toString()};
   options.tasks.forEach(function (task) { byOp[task.op] = task; });
@@ -218,9 +220,14 @@ export const ROOT_RUNTIME = `function createRootAccess(options) {
       });
     });
   }
+  function verify(op) {
+    var ref = verified[op];
+    delete verified[op];
+    return ref && op !== "helper_repair" ? Promise.resolve({ state: "ready", ref: ref }) : find(byOp[op]);
+  }
   function performRun(op) {
     return begin(op).then(function (task) {
-      return find(task).then(function (found) {
+      return verify(op).then(function (found) {
         if (found.state !== "ready") throw fail("root_not_ready");
         var consent = op === "helper_repair" ? options.confirmPassword() : Promise.resolve({ confirmed: true });
         return consent.then(function (confirmation) {
@@ -239,9 +246,10 @@ export const ROOT_RUNTIME = `function createRootAccess(options) {
       return begin(op).then(find).then(function (found) { return found.state; });
     },
     authorize: function (op) {
+      delete verified[op];
       return begin(op).then(function (task) {
         return find(task).then(function (found) {
-          if (found.state === "ready") return "ready";
+          if (found.state === "ready") { verified[op] = found.ref; return "ready"; }
           if (found.state === "conflict") throw fail("root_conflict");
           return options.confirmPassword().then(function (confirmation) {
             if (!confirmation || confirmation.confirmed !== true) return "cancelled";
@@ -259,6 +267,7 @@ export const ROOT_RUNTIME = `function createRootAccess(options) {
               return find(task);
             }).then(function (after) {
               if (after.state !== "ready") throw fail("root_verify_failed");
+              verified[op] = after.ref;
               return "ready";
             });
           });
@@ -277,6 +286,7 @@ export const ROOT_RUNTIME = `function createRootAccess(options) {
       return pending;
     },
     remove: function (op) {
+      delete verified[op];
       return begin(op).then(function (task) {
         return find(task).then(function (found) {
           if (found.state === "missing") return "missing";

package/dist/standalone/portal-window.d.ts

@@ -12,8 +12,10 @@ export declare const PORTAL_MESSAGES: Record<string, Record<PortalLocale, string
  * Control Panel shortcut.
  *
  * `status()` resolves `{state, alias?, url?, canManage, controlPanel,
- * defaultAlias}`; `apply(alias)` and `disable()` resolve the new status or
- * reject `{code}`; `openControlPanel()` opens Login Portal > Applications.
+ * defaultAlias, entry?}`; `apply(alias)` and `disable()` resolve the new
+ * status or reject `{code}`. With `options.entry` (below DSM 7.2) the
+ * backend's `portal.status` also reports the executor's entry, and
+ * administrators get `register()` and `unregister()`; `openControlPanel()` opens Login Portal > Applications.
  * `messages` is the panel text in the window's locale; `mountPanel(element)`
  * renders a plain panel for UIs without their own.
  */

package/dist/standalone/portal-window.js

@@ -4,17 +4,22 @@ export const PORTAL_MESSAGES = {
     title: { en: "Application Portal", "zh-TW": "應用程式入口", "zh-CN": "应用程序门户", ja: "アプリケーションポータル", ko: "응용 프로그램 포털", de: "Anwendungsportal", fr: "Portail d'application", es: "Portal de aplicaciones", it: "Portale applicazioni" },
     link: { en: "Direct link after DSM sign-in:", "zh-TW": "DSM 登入後的直接連結：", "zh-CN": "DSM 登录后的直接链接：", ja: "DSM サインイン後の直接リンク：", ko: "DSM 로그인 후 바로 가기 링크:", de: "Direkter Link nach der DSM-Anmeldung:", fr: "Lien direct après connexion à DSM :", es: "Enlace directo tras iniciar sesión en DSM:", it: "Link diretto dopo l'accesso a DSM:" },
     inactive: { en: "Not active. Apply an alias to let users open this app directly after DSM sign-in.", "zh-TW": "尚未啟用。套用別名後，使用者可在 DSM 登入後直接開啟這個 App。", "zh-CN": "尚未启用。应用别名后，用户可在 DSM 登录后直接打开此应用。", ja: "無効です。エイリアスを適用すると、DSM サインイン後にこのアプリを直接開けます。", ko: "비활성 상태입니다. 별칭을 적용하면 DSM 로그인 후 이 앱을 바로 열 수 있습니다.", de: "Nicht aktiv. Wenden Sie einen Alias an, damit Benutzer diese App nach der DSM-Anmeldung direkt öffnen können.", fr: "Inactif. Appliquez un alias pour ouvrir cette application directement après connexion à DSM.", es: "Inactivo. Aplique un alias para abrir esta aplicación directamente tras iniciar sesión en DSM.", it: "Non attivo. Applica un alias per aprire questa app direttamente dopo l'accesso a DSM." },
-    askAdmin: { en: "Ask an administrator to set this up", "zh-TW": "請管理員設定", "zh-CN": "请管理员设置", ja: "管理者に設定を依頼してください", ko: "관리자에게 설정을 요청하세요", de: "Bitten Sie einen Administrator, dies einzurichten", fr: "Demandez à un administrateur de le configurer", es: "Pida a un administrador que lo configure", it: "Chiedi a un amministratore di configurarlo" },
+    askAdmin: { en: "Ask an administrator to set this up", "zh-TW": "請管理員設定", "zh-CN": "请管理员设置", ja: "管理者に設定を依頼してください", ko: "관리자에게 설정을 요청하십시오", de: "Bitten Sie einen Administrator, dies einzurichten", fr: "Demandez à un administrateur de le configurer", es: "Pida a un administrador que lo configure", it: "Chiedi a un amministratore di configurarlo" },
     alias: { en: "Alias", "zh-TW": "別名", "zh-CN": "别名", ja: "エイリアス", ko: "별칭", de: "Alias", fr: "Alias", es: "Alias", it: "Alias" },
     apply: { en: "Apply", "zh-TW": "套用", "zh-CN": "应用", ja: "適用", ko: "적용", de: "Übernehmen", fr: "Appliquer", es: "Aplicar", it: "Applica" },
     disable: { en: "Turn off", "zh-TW": "停用", "zh-CN": "停用", ja: "無効にする", ko: "끄기", de: "Ausschalten", fr: "Désactiver", es: "Desactivar", it: "Disattiva" },
     advanced: { en: "Advanced settings in Control Panel", "zh-TW": "在控制台進行進階設定", "zh-CN": "在控制面板中进行高级设置", ja: "コントロールパネルの詳細設定", ko: "제어판의 고급 설정", de: "Erweiterte Einstellungen in der Systemsteuerung", fr: "Paramètres avancés dans le Panneau de configuration", es: "Ajustes avanzados en el Panel de control", it: "Impostazioni avanzate nel Pannello di controllo" },
     controlPanel: { en: "Open Control Panel Application Portal", "zh-TW": "開啟控制台 Application Portal", "zh-CN": "打开控制面板 Application Portal", ja: "コントロールパネルの Application Portal を開く", ko: "제어판 Application Portal 열기", de: "Application Portal in der Systemsteuerung öffnen", fr: "Ouvrir Application Portal dans le Panneau de configuration", es: "Abrir Application Portal en el Panel de control", it: "Apri Application Portal nel Pannello di controllo" },
-    portal_alias_invalid: { en: "Use 1-64 lowercase letters, digits or hyphens, not starting or ending with a hyphen.", "zh-TW": "請使用 1–64 個小寫英文字母、數字或連字號，且不可以連字號開頭或結尾。", "zh-CN": "请使用 1–64 个小写英文字母、数字或连字符，且不能以连字符开头或结尾。", ja: "1～64 文字の小文字英字・数字・ハイフンを使用し、先頭と末尾にハイフンは使えません。", ko: "1~64자의 영문 소문자, 숫자 또는 하이픈을 사용하고 하이픈으로 시작하거나 끝나지 않게 하세요.", de: "Verwenden Sie 1–64 Kleinbuchstaben, Ziffern oder Bindestriche, ohne Bindestrich am Anfang oder Ende.", fr: "Utilisez 1 à 64 lettres minuscules, chiffres ou tirets, sans tiret au début ni à la fin.", es: "Use de 1 a 64 letras minúsculas, dígitos o guiones, sin guion al principio ni al final.", it: "Usa da 1 a 64 lettere minuscole, cifre o trattini, senza trattino all'inizio o alla fine." },
-    portal_alias_reserved: { en: "DSM already uses this alias. Choose another one.", "zh-TW": "DSM 已使用這個別名，請改用其他別名。", "zh-CN": "DSM 已使用此别名，请改用其他别名。", ja: "このエイリアスは DSM で使用されています。別のものを選んでください。", ko: "DSM에서 이미 사용하는 별칭입니다. 다른 별칭을 선택하세요.", de: "DSM verwendet diesen Alias bereits. Wählen Sie einen anderen.", fr: "DSM utilise déjà cet alias. Choisissez-en un autre.", es: "DSM ya usa este alias. Elija otro.", it: "DSM usa già questo alias. Scegline un altro." },
-    portal_alias_in_use: { en: "Another app already uses this alias. Choose another one.", "zh-TW": "另一個 App 已使用這個別名，請改用其他別名。", "zh-CN": "另一个应用已使用此别名，请改用其他别名。", ja: "別のアプリがこのエイリアスを使用しています。別のものを選んでください。", ko: "다른 앱이 이미 이 별칭을 사용합니다. 다른 별칭을 선택하세요.", de: "Eine andere App verwendet diesen Alias bereits. Wählen Sie einen anderen.", fr: "Une autre application utilise déjà cet alias. Choisissez-en un autre.", es: "Otra aplicación ya usa este alias. Elija otro.", it: "Un'altra app usa già questo alias. Scegline un altro." },
+    entryOff: { en: "This app has no Application Portal entry yet. Enable the entry so that an alias can open it after DSM sign-in.", "zh-TW": "這個 App 尚未加入應用程式入口。啟用入口後，即可用別名在 DSM 登入後直接開啟。", "zh-CN": "此应用尚未加入应用程序门户。启用入口后，即可用别名在 DSM 登录后直接打开。", ja: "このアプリはまだアプリケーションポータルに登録されていません。エントリを有効にすると、DSM サインイン後にエイリアスで直接開けます。", ko: "이 앱은 아직 응용 프로그램 포털에 등록되지 않았습니다. 항목을 활성화하면 DSM 로그인 후 별칭으로 바로 열 수 있습니다.", de: "Diese App hat noch keinen Eintrag im Anwendungsportal. Aktivieren Sie den Eintrag, damit ein Alias sie nach der DSM-Anmeldung öffnet.", fr: "Cette application n'a pas encore d'entrée dans le Portail d'application. Activez l'entrée pour qu'un alias l'ouvre après connexion à DSM.", es: "Esta aplicación aún no tiene una entrada en el Portal de aplicaciones. Active la entrada para que un alias la abra tras iniciar sesión en DSM.", it: "Questa app non ha ancora una voce nel Portale applicazioni. Attivare la voce per aprirla con un alias dopo l'accesso a DSM." },
+    cleanupRequired: { en: "The Application Portal entry was not fully removed. Remove the entry again.", "zh-TW": "應用程式入口未完全移除。請再移除一次入口。", "zh-CN": "应用程序门户入口未完全移除。请再移除一次入口。", ja: "アプリケーションポータルのエントリが完全に削除されていません。もう一度エントリを削除してください。", ko: "응용 프로그램 포털 항목이 완전히 제거되지 않았습니다. 항목을 다시 제거하십시오.", de: "Der Eintrag im Anwendungsportal wurde nicht vollständig entfernt. Entfernen Sie den Eintrag erneut.", fr: "L'entrée du Portail d'application n'a pas été entièrement supprimée. Supprimez de nouveau l'entrée.", es: "La entrada del Portal de aplicaciones no se eliminó por completo. Elimine la entrada de nuevo.", it: "La voce del Portale applicazioni non è stata rimossa completamente. Rimuovere di nuovo la voce." },
+    register: { en: "Enable entry", "zh-TW": "啟用入口", "zh-CN": "启用入口", ja: "エントリを有効にする", ko: "항목 활성화", de: "Eintrag aktivieren", fr: "Activer l'entrée", es: "Activar entrada", it: "Attiva voce" },
+    unregister: { en: "Remove entry", "zh-TW": "移除入口", "zh-CN": "移除入口", ja: "エントリを削除", ko: "항목 제거", de: "Eintrag entfernen", fr: "Supprimer l'entrée", es: "Eliminar entrada", it: "Rimuovi voce" },
+    portal_alias_invalid: { en: "Use 1-64 lowercase letters, digits or hyphens, not starting or ending with a hyphen.", "zh-TW": "請使用 1–64 個小寫英文字母、數字或連字號，且不可以連字號開頭或結尾。", "zh-CN": "请使用 1–64 个小写英文字母、数字或连字符，且不能以连字符开头或结尾。", ja: "1～64 文字の小文字英字・数字・ハイフンを使用し、先頭と末尾にハイフンは使えません。", ko: "1~64자의 영문 소문자, 숫자 또는 하이픈을 사용하고 하이픈으로 시작하거나 끝나지 않게 하십시오.", de: "Verwenden Sie 1–64 Kleinbuchstaben, Ziffern oder Bindestriche, ohne Bindestrich am Anfang oder Ende.", fr: "Utilisez 1 à 64 lettres minuscules, chiffres ou tirets, sans tiret au début ni à la fin.", es: "Use de 1 a 64 letras minúsculas, dígitos o guiones, sin guion al principio ni al final.", it: "Usa da 1 a 64 lettere minuscole, cifre o trattini, senza trattino all'inizio o alla fine." },
+    portal_alias_reserved: { en: "DSM already uses this alias. Choose another one.", "zh-TW": "DSM 已使用這個別名，請改用其他別名。", "zh-CN": "DSM 已使用此别名，请改用其他别名。", ja: "このエイリアスは DSM で使用されています。別のものを選んでください。", ko: "DSM에서 이미 사용하는 별칭입니다. 다른 별칭을 선택하십시오.", de: "DSM verwendet diesen Alias bereits. Wählen Sie einen anderen.", fr: "DSM utilise déjà cet alias. Choisissez-en un autre.", es: "DSM ya usa este alias. Elija otro.", it: "DSM usa già questo alias. Scegline un altro." },
+    portal_alias_in_use: { en: "Another app already uses this alias. Choose another one.", "zh-TW": "另一個 App 已使用這個別名，請改用其他別名。", "zh-CN": "另一个应用已使用此别名，请改用其他别名。", ja: "別のアプリがこのエイリアスを使用しています。別のものを選んでください。", ko: "다른 앱이 이미 이 별칭을 사용합니다. 다른 별칭을 선택하십시오.", de: "Eine andere App verwendet diesen Alias bereits. Wählen Sie einen anderen.", fr: "Une autre application utilise déjà cet alias. Choisissez-en un autre.", es: "Otra aplicación ya usa este alias. Elija otro.", it: "Un'altra app usa già questo alias. Scegline un altro." },
     admin_required: { en: "Only a DSM administrator can change this.", "zh-TW": "只有 DSM 管理員可以變更這項設定。", "zh-CN": "只有 DSM 管理员可以更改此设置。", ja: "これを変更できるのは DSM 管理者のみです。", ko: "DSM 관리자만 변경할 수 있습니다.", de: "Nur ein DSM-Administrator kann dies ändern.", fr: "Seul un administrateur DSM peut modifier ce paramètre.", es: "Solo un administrador de DSM puede cambiar esto.", it: "Solo un amministratore DSM può modificarlo." },
-    portal_unavailable: { en: "DSM did not accept the change. Try again or use Control Panel.", "zh-TW": "DSM 未接受變更。請再試一次或改用控制台。", "zh-CN": "DSM 未接受更改。请重试或改用控制面板。", ja: "DSM は変更を受け付けませんでした。再試行するか、コントロールパネルを使用してください。", ko: "DSM이 변경을 받아들이지 않았습니다. 다시 시도하거나 제어판을 사용하세요.", de: "DSM hat die Änderung nicht übernommen. Versuchen Sie es erneut oder verwenden Sie die Systemsteuerung.", fr: "DSM n'a pas accepté la modification. Réessayez ou utilisez le Panneau de configuration.", es: "DSM no aceptó el cambio. Inténtelo de nuevo o use el Panel de control.", it: "DSM non ha accettato la modifica. Riprova o usa il Pannello di controllo." },
+    portal_unavailable: { en: "DSM did not accept the change. Try again or use Control Panel.", "zh-TW": "DSM 未接受變更。請再試一次或改用控制台。", "zh-CN": "DSM 未接受更改。请重试或改用控制面板。", ja: "DSM は変更を受け付けませんでした。再試行するか、コントロールパネルを使用してください。", ko: "DSM이 변경을 받아들이지 않았습니다. 다시 시도하거나 제어판을 사용하십시오.", de: "DSM hat die Änderung nicht übernommen. Versuchen Sie es erneut oder verwenden Sie die Systemsteuerung.", fr: "DSM n'a pas accepté la modification. Réessayez ou utilisez le Panneau de configuration.", es: "DSM no aceptó el cambio. Inténtelo de nuevo o use el Panel de control.", it: "DSM non ha accettato la modifica. Riprova o usa il Pannello di controllo." },
+    PORTAL_FAILED: { en: "DSM did not accept the Application Portal change. Try again.", "zh-TW": "DSM 未接受應用程式入口的變更。請再試一次。", "zh-CN": "DSM 未接受应用程序门户的更改。请重试。", ja: "DSM はアプリケーションポータルの変更を受け付けませんでした。再試行してください。", ko: "DSM이 응용 프로그램 포털 변경을 받아들이지 않았습니다. 다시 시도하십시오.", de: "DSM hat die Änderung am Anwendungsportal nicht übernommen. Versuchen Sie es erneut.", fr: "DSM n'a pas accepté la modification du Portail d'application. Réessayez.", es: "DSM no aceptó el cambio en el Portal de aplicaciones. Inténtelo de nuevo.", it: "DSM non ha accettato la modifica al Portale applicazioni. Riprovare." },
 };
 function localizedMessages() {
     const out = {};
@@ -35,8 +40,10 @@ function localizedMessages() {
  * Control Panel shortcut.
  *
  * `status()` resolves `{state, alias?, url?, canManage, controlPanel,
- * defaultAlias}`; `apply(alias)` and `disable()` resolve the new status or
- * reject `{code}`; `openControlPanel()` opens Login Portal > Applications.
+ * defaultAlias, entry?}`; `apply(alias)` and `disable()` resolve the new
+ * status or reject `{code}`. With `options.entry` (below DSM 7.2) the
+ * backend's `portal.status` also reports the executor's entry, and
+ * administrators get `register()` and `unregister()`; `openControlPanel()` opens Login Portal > Applications.
  * `messages` is the panel text in the window's locale; `mountPanel(element)`
  * renders a plain panel for UIs without their own.
  */
@@ -46,6 +53,7 @@ export const PORTAL_RUNTIME = `function createPortalAccess(options) {
   var LINKABLE = /^[A-Za-z0-9][A-Za-z0-9_-]{0,63}$/;
   var CATALOGS = ${JSON.stringify(localizedMessages())};
   var messages = CATALOGS[options.locale] || CATALOGS.en;
+  var ENTRIES = ["registered", "unregistered", "cleanup-required"];
   var ERRORS = { dsm_4100: "portal_alias_invalid", dsm_4102: "portal_alias_reserved", dsm_4103: "portal_alias_in_use", dsm_105: "admin_required" };
   function result(state, alias, managed) {
     var out = { state: state, canManage: managed === true, controlPanel: managed !== undefined, defaultAlias: options.defaultAlias };
@@ -55,11 +63,12 @@ export const PORTAL_RUNTIME = `function createPortalAccess(options) {
     }
     return out;
   }
+  function readBackend(data) {
+    if (data && data.state === "active" && typeof data.alias === "string" && LINKABLE.test(data.alias)) return result("active", data.alias);
+    return result(data && data.state === "inactive" ? "inactive" : "unavailable");
+  }
   function fromBackend() {
-    return options.call("portal.status", {}).then(function (data) {
-      if (data && data.state === "active" && typeof data.alias === "string" && LINKABLE.test(data.alias)) return result("active", data.alias);
-      return result(data && data.state === "inactive" ? "inactive" : "unavailable");
-    }, function () {
+    return options.call("portal.status", {}).then(readBackend, function () {
       return result("unavailable");
     });
   }
@@ -79,9 +88,33 @@ export const PORTAL_RUNTIME = `function createPortalAccess(options) {
       return result("unavailable", undefined, false);
     });
   }
+  function withEntry(out, entry) {
+    out.entry = entry;
+    return out;
+  }
+  // Below DSM 7.2 the executor registers the entry; DSM lists the App only while it is registered.
+  function fromEntry() {
+    return options.call("portal.status", {}).then(function (data) {
+      var entry = data && ENTRIES.indexOf(data.entry) >= 0 ? data.entry : "";
+      if (!options.isAdmin()) return readBackend(data);
+      if (entry === "registered") return fromDsm().then(function (out) { return withEntry(out, entry); });
+      if (!entry) return result("unavailable", undefined, false);
+      var read = readBackend(data);
+      return withEntry(result(entry === "unregistered" ? "inactive" : read.state, read.alias, true), entry);
+    }, function () {
+      return options.isAdmin() ? result("unavailable", undefined, false) : result("unavailable");
+    });
+  }
   function status() {
+    if (options.entry) return fromEntry();
     return options.isAdmin() ? fromDsm() : fromBackend();
   }
+  function change(method) {
+    if (!options.isAdmin()) return Promise.reject({ code: "admin_required" });
+    return options.call(method, {}).then(status, function (error) {
+      throw { code: error && error.code === "ADMIN_REQUIRED" ? "admin_required" : "PORTAL_FAILED" };
+    });
+  }
   function set(alias) {
     if (!options.isAdmin()) return Promise.reject({ code: "admin_required" });
     return options.send("SYNO.Core.AppPortal", "set", 2, { id: options.appId, alias: alias }).then(status, function (error) {
@@ -106,6 +139,10 @@ export const PORTAL_RUNTIME = `function createPortalAccess(options) {
       return mountPanel(element);
     }
   };
+  if (options.entry) {
+    access.register = function () { return change("portal.register"); };
+    access.unregister = function () { return change("portal.unregister"); };
+  }
   function node(tag, attrs, children) {
     var out = document.createElement(tag);
     for (var key in attrs) {
@@ -129,7 +166,11 @@ export const PORTAL_RUNTIME = `function createPortalAccess(options) {
       if (current.state === "active") {
         parts.push(node("p", {}, [node("span", { text: messages.link + " " }), node("a", { href: current.url, target: "_blank", rel: "noopener", text: current.url })]));
       }
-      if (current.canManage) {
+      if (current.canManage && current.entry && current.entry !== "registered") {
+        var off = current.entry === "unregistered";
+        parts.push(node("p", { text: off ? messages.entryOff : messages.cleanupRequired }));
+        parts.push(off ? button(messages.register, function () { settle(access.register()); }) : button(messages.unregister, function () { settle(access.unregister()); }));
+      } else if (current.canManage) {
         if (current.state !== "active") parts.push(node("p", { text: messages.inactive }));
         var input = node("input", { type: "text", maxlength: "64", autocomplete: "off", "aria-label": messages.alias });
         input.value = current.alias || current.defaultAlias;
@@ -137,6 +178,7 @@ export const PORTAL_RUNTIME = `function createPortalAccess(options) {
         form.addEventListener("submit", function (event) { event.preventDefault(); settle(access.apply(input.value)); });
         if (current.state === "active") form.appendChild(button(messages.disable, function () { settle(access.disable()); }));
         parts.push(form, button(messages.advanced, access.openControlPanel));
+        if (current.entry) parts.push(button(messages.unregister, function () { settle(access.unregister()); }));
       } else if (current.controlPanel) {
         parts.push(button(messages.controlPanel, access.openControlPanel));
       } else if (current.state !== "active") {

package/dist/standalone/portal.d.ts

@@ -1,4 +1,7 @@
 import type { StandaloneManifest } from "./manifest.js";
 import type { PortalPackage } from "../portal/package.js";
-/** A native portal opens the package's own DSM window. */
+/**
+ * A native portal registered through DSM's web-config resource; it opens the
+ * package's own DSM window. Below DSM 7.2 the executor registers it instead.
+ */
 export declare function nativePortal(manifest: StandaloneManifest): PortalPackage | undefined;

package/dist/standalone/portal.js

@@ -1,4 +1,10 @@
-/** A native portal opens the package's own DSM window. */
+import { portalByExecutor } from "../build-spk/dsm-version.js";
+/**
+ * A native portal registered through DSM's web-config resource; it opens the
+ * package's own DSM window. Below DSM 7.2 the executor registers it instead.
+ */
 export function nativePortal(manifest) {
-    return manifest.portal && { appId: `SYNO.SDS.${manifest.package}.Instance`, application: manifest.displayname, alias: manifest.portal.alias };
+    if (!manifest.portal || portalByExecutor(manifest.os_min_ver))
+        return undefined;
+    return { appId: `SYNO.SDS.${manifest.package}.Instance`, application: manifest.displayname, alias: manifest.portal.alias };
 }

package/dist/standalone/spk.js

@@ -22,6 +22,7 @@ import { copyDaemonPayload } from "./daemon.js";
 import { BACKGROUND_UNIT_DIR, BACKGROUND_WORKER_PAYLOAD, backgroundUnitName, renderBackgroundUnit } from "./background.js";
 import { renderStandaloneResource } from "./resource.js";
 import { nativePortal } from "./portal.js";
+import { portalByExecutor } from "../build-spk/dsm-version.js";
 import { PORTAL_JSON_RELPATH, PORTAL_MUSTACHE_RELPATH, renderPortalJson, renderPortalMustache, renderPortalWizardStep } from "../portal/package.js";
 import { executorPlan } from "../runtime/executor-build.js";
 import { EXECUTOR_ANCHOR } from "../runtime/executor-inspect.js";
@@ -131,7 +132,7 @@ export async function assembleStandaloneSpk(options) {
             ...install.static,
             ...install.dynamic,
             ...(folder ? renderSharedFolderUpgradeWizardFiles(manifest.package, folder) : {}),
-            ...renderUninstallWizardFiles(manifest.package, "native", { executor: Boolean(options.executor), portal: Boolean(portal) }),
+            ...renderUninstallWizardFiles(manifest.package, "native", { executor: Boolean(options.executor), portal: Boolean(portal), portalEntry: Boolean(manifest.portal && portalByExecutor(manifest.os_min_ver)) }),
         });
         writePackageCenterIcons(staging, icons);
         mkdirSync(dirname(options.outputPath), { recursive: true });

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@synopackageland/cli",
-  "version": "0.9.4",
+  "version": "0.9.5",
   "description": "Syno Package Land Developer Kit CLI",
   "type": "module",
   "bin": {
@@ -24,7 +24,7 @@
     "prepublishOnly": "npm run build"
   },
   "dependencies": {
-    "@synopackageland/templates": "0.9.4",
+    "@synopackageland/templates": "0.9.5",
     "ajv": "^8.17.1",
     "commander": "^13.1.0",
     "tar": "^7.4.3",

package/skills/reference/portal.md

@@ -2,20 +2,24 @@
 
 Tier: only an App with the executor (`capabilities.rootOps` or `capabilities.delegate`) may declare a portal, because after uninstall only root can make nginx stop serving the alias. A no-privilege native App fails check/build with `STANDALONE_PORTAL_REQUIRES_EXECUTOR`, `add portal` refuses it unless the same call adds `root-ops` or `delegate`, and inspect flags such an SPK with `PORTAL_REQUIRES_EXECUTOR`. A Compose App has no executor: `integration.web.portal` always fails with `CONTRACT_PORTAL_REQUIRES_EXECUTOR`. Without the executor, an administrator can set up a reverse proxy in DSM instead.
 
-Declare: native-go/binary with rootOps or delegate, `portal: {}` or `portal: {alias: my-app}` in dsm-package.yaml (`synopkgland add root-ops portal`, or `add portal` once the executor is declared). The alias defaults to the package name in lowercase. Aliases are 1–64 lowercase letters, digits or `-`, not starting or ending with `-`, and not a DSM path or Synology App alias (`webman`, `file`, …). The native-layout `backend: {kind: native}` owns its conf/scripts: the SDK does not register a portal for it.
+Declare: native-go/binary with rootOps or delegate, `portal: {}` or `portal: {alias: my-app}` in dsm-package.yaml (`synopkgland add root-ops portal`, or `add portal` once the executor is declared). The alias defaults to the package name in lowercase. Aliases are 1–64 lowercase letters, digits or `-`, not starting or ending with `-`, and not a DSM path or Synology App alias (`webman`, `file`, …). The native-layout `backend: {kind: native}` owns its conf/scripts and its own root helper: `portal: {}` or `{alias}` there needs os_min_ver 7.1-42661+ and writes only `synopkgland_portal_alias="<alias>"` into INFO, which Package Center writes as root, so the product's root helper can trust it; the helper registers the app.d entry (application = INFO displayname) and owns its uninstall cleanup and wizard. inspect checks that INFO line against `native-layout.json`.
 
-Build: the SPK carries `etc/portal.json` (every field DSM's app-portal worker needs) and `etc/portal.mustache`, `conf/resource` registers them, and the install wizard adds a prefilled alias step. preinst validates the answer; postinst stores it as the package's own draft and default alias. Nothing is active until an administrator applies it. `inspect <spk> --json` reports `portal: {appId, alias}` and refuses any other portal content.
+Build (os_min_ver 7.2-64570+): the SPK carries `etc/portal.json` (every field DSM's app-portal worker needs) and `etc/portal.mustache`, `conf/resource` registers them, and the install wizard adds a prefilled alias step. preinst validates the answer; postinst stores it as the package's own draft and default alias. Nothing is active until an administrator applies it. `inspect <spk> --json` reports `portal: {appId, alias}` and refuses any other portal content.
 
 Activate: DSM owns the saved setting. Administrators use the app's portal panel (`ctx.portal.apply(alias)` / `disable()`, DSM `SYNO.Core.AppPortal set` with their own session; DSM refuses non-administrators with 105) or Control Panel > Login Portal > Applications (`ctx.portal.openControlPanel()`). DSM errors map to `portal_alias_invalid`, `portal_alias_reserved`, `portal_alias_in_use`, `admin_required`, `portal_unavailable`.
 
 Read: ordinary users call the Go backend's `portal.status` (`authenticated`), which reads `/var/packages/<package>/etc/AppPortal.json` read-only, bounded (64 KiB, no symlinks, one JSON object, matching app id). Anything else is `unavailable` and the UI shows "ask an administrator". A binary CGI must implement the same `{state, alias}` answer itself or ordinary users never see the link.
 
-DSM floor: os_min_ver must be 7.3.2-86009 or later. DSM 7.1.1-42962 refuses an unsigned SPK whose conf/resource carries web-config app-portal (Package Center error 320, "non-synology-signed package should not use internal worker"); 7.3.2-86009 and 7.4 install it; 7.2 and 7.3.0/7.3.1 are untested (unknown). validate/build fail with `STANDALONE_PORTAL_MIN_DSM`, `--min-dsm` cannot go below it, `add portal` raises a lower os_min_ver, and inspect flags a lower INFO os_min_ver. Fix: raise os_min_ver or remove the portal.
+Executor mode (7.1-42661 ≤ os_min_ver < 7.2-64570): no web-config resource, no `etc/portal.*`, no alias wizard step or alias lifecycle. The executor policy carries `portal: {application: <displayname>, alias}` and the operations `portal.register` and `portal.unregister`; the executor writes `/usr/syno/etc/www/app.d/<package>.{json,mustache}`. The package name must match `^[A-Za-z0-9]+(?:[._-][A-Za-z0-9]+)*$` (≤ 64) and displayname be 1–64 characters without control characters, or build fails with `STANDALONE_PORTAL_ENTRY_INVALID`. The CGI is built with `-X main.portal=executor`: `portal.status` adds `entry` (`registered`, `unregistered`, `cleanup-required`; an unreadable executor is `unavailable`), and `portal.register` / `portal.unregister` take the administrator's DSM session and return the fresh status. `ctx.portal.register()` / `unregister()` call them; the plain panel shows text and "Enable entry" while unregistered, the alias form and "Remove entry" once registered, text and "Remove entry" when cleanup is required, and no entry buttons for non-administrators. Executor refusals keep their code (`PORTAL_FAILED`). Needs templates with the executor portal routes (after 0.9.4) and an SDK with the `portal` entry API (after 0.9.5).
+
+DSM floor: os_min_ver must be 7.1-42661 or later; below 7.2-64570 the executor registers the entry (above). DSM 7.1 marks the web-config worker Synology-only, so it refuses an unsigned SPK whose conf/resource carries web-config (Package Center error 320, "non-synology-signed package should not use internal worker"; seen on 7.1.1-42962). synopkg from DSM 7.2 on drops that mark, the only change to its worker table; the 7.2 floor comes from that source and is not yet verified on a 7.2 NAS. 7.3.2-86009 and 7.4 install it. Below 7.1 validate/build fail with `STANDALONE_PORTAL_MIN_DSM`, `--min-dsm` cannot go below 7.1, `add portal` raises a lower os_min_ver to 7.1-42661, and inspect flags an INFO os_min_ver below the floor of the SPK's mode. Fix: raise os_min_ver or remove the portal.
 
 Capability: beyond that floor, no version gate. The panel needs SYNO.API.Info to list `SYNO.Core.AppPortal` (v2) and the app's registration to exist; otherwise administrators get only the Control Panel shortcut.
 
 UI: plain JS calls `ctx.portal && ctx.portal.mountPanel(element)` and disposes it on unmount; Vue renders `portal/PortalSettings.vue`. `ctx.portal.messages` carries the SDK text in all nine languages.
 
-Never: write `AppPortal.json`, `@appconf/<package>` or `/usr/syno/etc/www/app.d`; add a backend route that changes the alias; relay QuickConnect responses or build QuickConnect links; reboot or change other packages' portal entries while testing. DSM keeps the alias across upgrades and removes the entry on uninstall, but it does not reload nginx, and it keeps the App's Application Privileges rules.
+Never: write `AppPortal.json`, `@appconf/<package>` or `/usr/syno/etc/www/app.d` from the App (only the executor's approved `portal.*` operations write app.d); add a backend route that changes the alias; relay QuickConnect responses or build QuickConnect links; reboot or change other packages' portal entries while testing. DSM keeps the alias across upgrades and removes the entry on uninstall, but it does not reload nginx, and it keeps the App's Application Privileges rules.
 
 Uninstall: the root executor's purge deletes the rules of `SYNO.SDS.<package>.Instance` through the Application Privileges API and, once DSM has removed the alias files, reloads nginx (`synosystemctl reload nginx`), so the alias stops at once. Failures are only logged to the system log entry `synopkgland-executor`; then an administrator saves an alias in Control Panel > Login Portal > Applications (which reloads nginx) or restarts the NAS, and removes the rules in Control Panel > Application Privileges. The uninstall wizard and the `status`/`inspect` cleanup list say this in that order: automatic first, manual only as the fallback.
+
+Executor mode uninstall: the purge reads the retained policy and unregisters the entry. If the executor is not running or was never approved, uninstall does not remove the entry; the wizard and cleanup list say so and give the root commands (`rm -f /usr/syno/etc/www/app.d/<package>.json /usr/syno/etc/www/app.d/<package>.mustache /usr/syno/etc/packages/<package>/AppPortal.json`, `synow3tool --disable-nginx-confd/--unreg-nginx-confd` for `dsm www alias .alias`, `--disable-nginx-sites/--unreg-nginx-sites` for `server .server` on `<c>.syno-app-portal.<package>.conf`, then `nginx -t && synow3tool --nginx=reload`).