@synopackageland/cli 0.9.4 → 0.9.6

package/dist/standalone/manifest.js

@@ -7,14 +7,15 @@ import { isNativeArchFamily } from "../build-spk/dsm-arch.js";
 import { checkGlossary, loadCatalogs, readInfoTranslations } from "./i18n.js";
 import { loadRootOps, ROOT_OPS_DIR } from "./root-ops.js";
 import { readDaemon } from "./daemon.js";
+import { readUninstall } from "./uninstall.js";
 import { readBackground } from "./background.js";
-import { DEFAULT_MIN_DSM, isDsmAtLeast, PORTAL_MIN_DSM, portalMinDsmMessage } from "../build-spk/dsm-version.js";
+import { DEFAULT_MIN_DSM, isDsmAtLeast, PORTAL_EXECUTOR_MIN_DSM, portalByExecutor, portalMinDsmMessage } from "../build-spk/dsm-version.js";
 import { readSharedFolder } from "./shared-folder.js";
-import { floorAtAdministrators, permitsOrdinaryUsers, readApiPermissions } from "./api-permissions.js";
-import { PORTAL_REQUIRES_EXECUTOR, readPortalDeclaration } from "../portal/alias.js";
+import { API_PERMISSIONS_FILE, floorAtAdministrators, permitsOrdinaryUsers, readApiPermissions } from "./api-permissions.js";
+import { PORTAL_REQUIRES_EXECUTOR, portalEntryProblem, readPortalDeclaration } from "../portal/alias.js";
 import { renderPackageIcons } from "../build-spk/dsm-icons.js";
 import { validateReproducible } from "../reproducible-config.js";
-import { SDK_MODULE, sdkRequirement } from "../runtime/sdk-source.js";
+import { appSdkVersion, SDK_CRATE, SDK_MODULE } from "../runtime/sdk-source.js";
 import { sdkProblems } from "./sdk-check.js";
 /**
  * `dsm-package.yaml`: a Standalone Package, i.e. an unsigned native SPK that
@@ -23,13 +24,15 @@ import { sdkProblems } from "./sdk-check.js";
 export const STANDALONE_MANIFEST = "dsm-package.yaml";
 export const KNOWN_FIELDS = new Set([
     "schema", "package", "version", "build", "displayname", "description",
-    "metadata", "maintainer", "os_min_ver", "arches", "backend", "ui", "capabilities", "i18n", "daemon", "install", "entry", "portal", "icon", "reproducible",
+    "metadata", "maintainer", "os_min_ver", "arches", "backend", "ui", "capabilities", "i18n", "daemon", "install", "uninstall", "entry", "portal", "icon", "reproducible",
 ]);
 const I18N_FIELDS = new Set(["messages", "glossary", "info"]);
 const PACKAGE_ID = /^[A-Za-z][A-Za-z0-9]{1,63}$/;
 const VERSION = /^\d+(\.\d+){0,3}$/;
 const OS_MIN_VER = /^\d+\.\d+(\.\d+)?-\d+$/;
 const GO_MAIN = /^\.\/[A-Za-z0-9_./-]*$/;
+/** A Cargo package or binary name. */
+const CARGO_NAME = /^[A-Za-z][A-Za-z0-9_-]{0,63}$/;
 function isRecord(value) {
     return typeof value === "object" && value !== null && !Array.isArray(value);
 }
@@ -132,17 +135,19 @@ function readManifest(raw, c) {
     const arches = readArches(raw.arches, c);
     const backend = arches && readBackend(raw.backend, arches, c);
     let permissions;
-    if (backend?.kind === "go") {
+    if (backend && backend.kind !== "binary") {
         try {
-            permissions = readApiPermissions(backend.dir, capabilities);
+            permissions = readApiPermissions(backend, capabilities);
         }
         catch (error) {
-            // The SDK's own routes come from its module; a failed download is not a policy problem.
-            const download = /^\[SDK_DOWNLOAD_FAILED\] ([\s\S]*)$/.exec(error.message);
+            // The SDK's own routes come from its module; a failed download or an
+            // untagged SDK (reported by sdkProblems) is not a policy problem.
+            const message = error.message;
+            const download = /^\[SDK_DOWNLOAD_FAILED\] ([\s\S]*)$/.exec(message);
             if (download)
                 c.fail("SDK_DOWNLOAD_FAILED", download[1]);
-            else
-                c.fail("STANDALONE_API_PERMISSIONS_INVALID", `backend/internal/api/permissions.json must define the centralized API policy: ${String(error)}`);
+            else if (!message.startsWith("[SDK_TAG_REQUIRED]"))
+                c.fail("STANDALONE_API_PERMISSIONS_INVALID", `backend/${API_PERMISSIONS_FILE[backend.kind]} must define the centralized API policy: ${String(error)}`);
         }
     }
     const daemon = arches && readDaemon(raw.daemon, c.root, arches, e => c.fail(e.code, e.message));
@@ -169,20 +174,25 @@ function readManifest(raw, c) {
         c.fail("CAPABILITY_COMBINATION_INVALID", "capabilities.identity 需要獨立登入頁；plain UI 不支援，請改用 vue UI（init --ui vue）。");
     if (capabilities.delegate?.scope === "install-selected" && ui && !ui.build)
         c.fail("CAPABILITY_COMBINATION_INVALID", "delegate scope install-selected 只能在 Vue 面板確認；plain UI 不支援，請改用 vue UI（init --ui vue）。");
-    if (backend?.kind === "go") {
-        for (const problem of sdkProblems(backend.dir, ui?.build?.cwd, Boolean(capabilities.delegate || capabilities.rootOps)))
+    if (backend && backend.kind !== "binary") {
+        for (const problem of sdkProblems(backend, ui?.build?.cwd, Boolean(capabilities.delegate || capabilities.rootOps)))
             c.fail(problem.code, problem.message);
     }
     const i18n = raw.i18n === undefined ? undefined : readI18n(raw.i18n, c);
     const icon = raw.icon === undefined ? undefined : readIcon(raw.icon, c);
+    const uninstall = readUninstall(raw.uninstall, { rootOps: capabilities.rootOps === true, ops: rootOps, en: i18n?.catalogs?.en }, e => c.fail(e.code, e.message));
     const portal = raw.portal === undefined || !packageId ? undefined : readPortalDeclaration(raw.portal, packageId)
         ?? c.fail("STANDALONE_PORTAL_INVALID", "portal 必須是 {} 或 { alias: <小寫英數與 -，1–64 字，不可為 DSM 保留路徑> }。");
     if (portal && !capabilities.rootOps && !capabilities.delegate) {
         c.fail("STANDALONE_PORTAL_REQUIRES_EXECUTOR", PORTAL_REQUIRES_EXECUTOR);
     }
-    if (portal && osMinVer && !isDsmAtLeast(osMinVer, PORTAL_MIN_DSM)) {
+    if (portal && osMinVer && !isDsmAtLeast(osMinVer, PORTAL_EXECUTOR_MIN_DSM)) {
         c.fail("STANDALONE_PORTAL_MIN_DSM", portalMinDsmMessage(osMinVer, "portal"));
     }
+    const entryProblem = portal && packageId && displayname && osMinVer && portalByExecutor(osMinVer)
+        ? portalEntryProblem(packageId, { application: displayname, alias: portal.alias }) : undefined;
+    if (entryProblem)
+        c.fail("STANDALONE_PORTAL_ENTRY_INVALID", entryProblem);
     if (!packageId || !version || !build || !osMinVer || !displayname || !description || !maintainer
         || !arches || !backend || !ui || (capabilities.rootOps === true && !rootOps)) {
         return undefined;
@@ -206,12 +216,17 @@ function readManifest(raw, c) {
         capabilities,
         ...(rootOps ? { rootOps } : {}),
         ...(daemon ? { daemon } : {}),
+        ...(uninstall ? { uninstall } : {}),
         ...(sharedFolder ? { sharedFolder } : {}),
         ...(entry ? { entry } : {}),
         ...(portal ? { portal } : {}),
         ...(icon ? { icon } : {}),
     };
 }
+/** Where an App's SDK version is declared: its Go or Rust backend; a prebuilt binary declares it in the project's go.mod. */
+export function sdkBackend(m) {
+    return m.backend.kind === "binary" ? { kind: "go", dir: m.root } : m.backend;
+}
 function readIcon(value, c) {
     const path = c.path(value, "icon");
     if (!path)
@@ -224,6 +239,20 @@ function readIcon(value, c) {
         return c.fail("STANDALONE_ICON_INVALID", `icon：${error.message}`);
     }
 }
+/** Where each backend kind's CGI main wraps its authenticator in the SDK entry gate. */
+const ENTRY_GATE = {
+    go: { main: b => b.kind === "go" ? join(b.dir, b.main, "main.go") : "", call: "dsm.NewEntryGate(", sdk: `backend/go.mod 要 require ${SDK_MODULE}` },
+    rust: { main: b => b.kind === "rust" ? join(b.dir, "src/bin", `${b.bin}.rs`) : "", call: "new_entry_gate(", sdk: `backend/Cargo.toml 要以 release tag 相依 ${SDK_CRATE}` },
+};
+/** The SDK version, or none when the backend has none or pins it wrongly (reported by sdkProblems). */
+function sdkVersionOrUndefined(backend) {
+    try {
+        return appSdkVersion(backend);
+    }
+    catch {
+        return undefined;
+    }
+}
 /**
  * The CGI enforces the entry mode only when the project's backend carries the
  * SDK gate and main wires it; `-X main.entry` on an older main would be
@@ -235,11 +264,12 @@ function readEntry(value, backend, policy, c) {
     }
     if (!backend)
         return undefined;
-    const main = backend.kind === "go" ? join(backend.dir, backend.main, "main.go") : "";
-    if (backend.kind !== "go" || !sdkRequirement(backend.dir)
-        || !existsSync(main) || !readFileSync(main, "utf8").includes("dsm.NewEntryGate(")) {
+    const gate = ENTRY_GATE[backend.kind];
+    const main = gate?.main(backend) ?? "";
+    if (!gate || !sdkVersionOrUndefined(backend)
+        || !existsSync(main) || !readFileSync(main, "utf8").includes(gate.call)) {
         const shown = main ? relative(c.root, main) : "backend.main 的 main.go";
-        return c.fail("STANDALONE_ENTRY_UNSUPPORTED", `entry 需要 SDK 的 entry gate：backend/go.mod 要 require ${SDK_MODULE}，並在 ${shown} 以 dsm.NewEntryGate 包住 authenticator。`);
+        return c.fail("STANDALONE_ENTRY_UNSUPPORTED", `entry 需要 SDK 的 entry gate：${gate?.sdk ?? `backend/go.mod 要 require ${SDK_MODULE}`}，並在 ${shown} 以 ${gate?.call.slice(0, -1) ?? "dsm.NewEntryGate"} 包住 authenticator。`);
     }
     if (value === "app-privilege" && !permitsOrdinaryUsers(policy)) {
         return c.fail("STANDALONE_ENTRY_INVALID", "entry: app-privilege 需要至少一個 permissions.json 標為 authenticated 的 route，一般使用者才有功能可用。");
@@ -270,9 +300,11 @@ function readArches(value, c) {
         : c.fail("STANDALONE_ARCHES_INVALID", "arches 必須是不重複的 x86_64／aarch64／armv7 清單，至少一個。");
 }
 function readBackend(value, arches, c) {
-    if (!isRecord(value) || !["go", "binary"].includes(String(value.kind))) {
-        return c.fail("STANDALONE_BACKEND_INVALID", "backend.kind 必須是 go 或 binary。");
+    if (!isRecord(value) || !["go", "rust", "binary"].includes(String(value.kind))) {
+        return c.fail("STANDALONE_BACKEND_INVALID", "backend.kind 必須是 go、rust 或 binary。");
     }
+    if (value.kind === "rust")
+        return readRustBackend(value, c);
     if (value.kind === "go") {
         if (Object.keys(value).some(key => !["kind", "dir", "main"].includes(key)) || (value.main !== undefined && (typeof value.main !== "string" || !GO_MAIN.test(value.main) || value.main.includes("..")))) {
             return c.fail("STANDALONE_BACKEND_INVALID", "backend.kind: go 需要 dir，可選 main（預設 ./cmd/app）。");
@@ -299,6 +331,16 @@ function readBackend(value, arches, c) {
     }
     return Object.values(files).every(Boolean) ? { kind: "binary", files } : undefined;
 }
+function readRustBackend(value, c) {
+    const { package: pkg, bin = "api", worker = "background-worker" } = value;
+    const names = [pkg, bin, worker];
+    if (Object.keys(value).some(key => !["kind", "dir", "package", "bin", "worker"].includes(key))
+        || !names.every(name => typeof name === "string" && CARGO_NAME.test(name)) || bin === worker) {
+        return c.fail("STANDALONE_BACKEND_INVALID", "backend.kind: rust 需要 dir 與 package（Cargo package），可選 bin（CGI，預設 api）與 worker（背景程序，預設 background-worker），兩者不可相同。");
+    }
+    const dir = c.path(value.dir, "backend.dir");
+    return dir ? { kind: "rust", dir, package: pkg, bin: bin, worker: worker } : undefined;
+}
 function readUi(value, c) {
     if (!isRecord(value)) {
         return c.fail("STANDALONE_UI_INVALID", "ui 必須包含 dir。");

package/dist/standalone/native-layout.d.ts

@@ -1,5 +1,7 @@
 import { type PackageMetadata } from "../package-metadata.js";
 import type { CommandRunner } from './build.js';
+import { type Toolkit } from './toolkit.js';
+import { type PortalDeclaration } from '../portal/alias.js';
 export declare const LAYOUT_ARCHES: {
     readonly x86_64: readonly [2, 62];
     readonly aarch64: readonly [2, 183];
@@ -12,10 +14,6 @@ type Hook = {
     cwd: string;
     env: Record<string, string>;
 };
-type Toolkit = {
-    url: string;
-    sha256: string;
-};
 type Binary = {
     path: string;
     linkage: 'static' | 'dynamic';
@@ -50,6 +48,8 @@ export interface NativeLayout {
         hook: Hook;
         toolkits: Partial<Record<LayoutArch, Toolkit[]>>;
     };
+    /** The product's own root helper registers this Application Portal entry; the CLI only names it in INFO. */
+    portal?: PortalDeclaration;
 }
 export declare function isNativeLayout(root: string): boolean;
 export declare function loadNativeLayout(root: string): {
@@ -62,9 +62,6 @@ export declare function loadNativeLayout(root: string): {
         message: string;
     }[];
 };
-export declare function verifyToolkitArchive(path: string, expected: string): void;
-/** One cache per user, shared by every project and worktree; archives are checked against sha256 on every use. */
-export declare function toolkitCacheDir(env: Record<string, string | undefined>, platform: string, home: string): string;
 export declare function layoutFiles(root: string): Array<{
     path: string;
     mode: number;

package/dist/standalone/native-layout.js

@@ -1,15 +1,17 @@
 import { validateMetadata, metadataInfoFields } from "../package-metadata.js";
 /** Existing native products: the CLI owns archives/INFO, the project owns its layout. */
 import { createHash } from 'node:crypto';
-import { chmodSync, copyFileSync, existsSync, lstatSync, mkdirSync, mkdtempSync, readFileSync, readdirSync, realpathSync, renameSync, rmSync, writeFileSync } from 'node:fs';
-import { homedir, tmpdir } from 'node:os';
+import { chmodSync, copyFileSync, existsSync, lstatSync, mkdirSync, mkdtempSync, readFileSync, readdirSync, realpathSync, rmSync, writeFileSync } from 'node:fs';
+import { tmpdir } from 'node:os';
 import { dirname, isAbsolute, join, relative, resolve } from 'node:path';
 import { parse } from 'yaml';
 import { createReproducibleTar } from '../build-spk/reproducible-archive.js';
 import { runCommand, runnerFor } from './build.js';
 import { checkJobs, commitOutputs, forEachArch } from './arch-jobs.js';
+import { prepareToolkit } from './toolkit.js';
 import { validateReproducible } from '../reproducible-config.js';
-import { resolveMinDsm } from '../build-spk/dsm-version.js';
+import { isDsmAtLeast, PORTAL_EXECUTOR_MIN_DSM, resolveMinDsm } from '../build-spk/dsm-version.js';
+import { portalEntryProblem, readPortalDeclaration } from '../portal/alias.js';
 import { infoArchValue } from '../build-spk/dsm-arch.js';
 import { LIFECYCLE_SCRIPTS, REPLACE_SCRIPTS } from '../spk/dsm-spec.js';
 import { renderPackageIcons, writePackageCenterIcons } from '../build-spk/dsm-icons.js';
@@ -58,6 +60,19 @@ function anchors(value) {
     }
     return a;
 }
+// Like the anchors, INFO is the root helper's trusted copy of the entry it
+// registers in DSM's app.d: the alias, under the INFO displayname.
+const PORTAL_INFO_KEY = 'synopkgland_portal_alias';
+function portal(value, packageId) {
+    return readPortalDeclaration(value, packageId) ?? fail('portal must be {} or {alias: <lowercase letters, digits and -, 1-64, not a DSM path>}');
+}
+function checkPortal(p, packageId, displayname, osMinVer) {
+    if (!isDsmAtLeast(osMinVer, PORTAL_EXECUTOR_MIN_DSM))
+        fail(`portal needs DSM ${PORTAL_EXECUTOR_MIN_DSM} or later, where the app.d entry format is verified; os_min_ver is ${osMinVer}`);
+    const problem = portalEntryProblem(packageId, { application: displayname, alias: p.alias });
+    if (problem)
+        fail(problem);
+}
 function hook(value) {
     const h = object(value, ['command', 'cwd', 'env']);
     if (!Array.isArray(h.command) || !h.command.length || !h.command.every((x) => typeof x === 'string' && x.length > 0 && !x.includes('\0')))
@@ -90,7 +105,7 @@ export function isNativeLayout(root) {
 }
 export function loadNativeLayout(root) {
     try {
-        const m = object(parse(readFileSync(join(root, 'dsm-package.yaml'), 'utf8')), ['schema', 'backend', 'package', 'version', 'build', 'displayname', 'description', 'maintainer', 'metadata', 'os_min_ver', 'privilege', 'arches', 'layout', 'native', 'icon', 'reproducible']);
+        const m = object(parse(readFileSync(join(root, 'dsm-package.yaml'), 'utf8')), ['schema', 'backend', 'package', 'version', 'build', 'displayname', 'description', 'maintainer', 'metadata', 'os_min_ver', 'privilege', 'arches', 'layout', 'native', 'icon', 'reproducible', 'portal']);
         if (m.schema !== 2)
             fail('schema 2 required; migrate schema: 1 to schema: 2 and add backend: {kind: native}');
         const backend = object(m.backend, ['kind']);
@@ -113,6 +128,10 @@ export function loadNativeLayout(root) {
             m.icon = icon(root, m.icon);
         if (m.reproducible !== undefined)
             validateReproducible(m.reproducible);
+        if (m.portal !== undefined) {
+            m.portal = portal(m.portal, m.package);
+            checkPortal(m.portal, m.package, m.displayname, m.os_min_ver);
+        }
         const layout = object(m.layout, ['payload', 'metadata', 'binaries', 'anchors']);
         layout.payload = pathText(layout.payload);
         layout.metadata = pathText(layout.metadata);
@@ -146,100 +165,6 @@ export function loadNativeLayout(root) {
         return { ok: false, errors: [{ code: 'NATIVE_LAYOUT_INVALID', message: String(error) }] };
     }
 }
-export function verifyToolkitArchive(path, expected) {
-    if (!lstatSync(path).isFile() || digest(readFileSync(path)) !== expected)
-        fail('toolkit checksum mismatch');
-}
-/** One cache per user, shared by every project and worktree; archives are checked against sha256 on every use. */
-export function toolkitCacheDir(env, platform, home) {
-    if (env.SYNOPKGLAND_CACHE_DIR)
-        return resolve(env.SYNOPKGLAND_CACHE_DIR);
-    if (platform === 'darwin')
-        return join(home, 'Library', 'Caches', 'synopkgland');
-    const xdg = env.XDG_CACHE_HOME;
-    return join(xdg && isAbsolute(xdg) ? xdg : join(home, '.cache'), 'synopkgland');
-}
-// Concurrent architectures that pin the same archive share one download.
-const downloads = new Map();
-async function download(m, cache, input, archive, run) {
-    const tmp = mkdtempSync(join(cache, '.download-'));
-    try {
-        const out = join(tmp, 'archive');
-        const r = await run('curl', ['--fail', '--location', '--proto', '=https', '--proto-redir', '=https', '--retry', '2', '--retry-all-errors', '--connect-timeout', '20', '--max-time', '600', '--output', out, input.url], { cwd: m.root, env: { ...process.env } });
-        if (r.status !== 0)
-            fail('toolkit download failed');
-        // Rename is atomic, so another build process sees either no archive or a verified one.
-        verifyToolkitArchive(out, input.sha256);
-        renameSync(out, archive);
-    }
-    finally {
-        rmSync(tmp, { recursive: true, force: true });
-    }
-}
-async function toolkitFor(m, arch, run) {
-    const inputs = m.native.toolkits[arch] ?? [];
-    if (!inputs.length)
-        return '';
-    const cache = toolkitCacheDir(process.env, process.platform, homedir());
-    mkdirSync(cache, { recursive: true, mode: 0o700 });
-    if (lstatSync(cache).isSymbolicLink() || (lstatSync(cache).mode & 0o022))
-        fail('toolkit cache must be owned and private');
-    const archives = [];
-    for (const input of inputs) {
-        const archive = join(cache, `${input.sha256}.txz`);
-        if (!existsSync(archive)) {
-            let pending = downloads.get(archive);
-            if (!pending) {
-                pending = download(m, cache, input, archive, run).finally(() => downloads.delete(archive));
-                downloads.set(archive, pending);
-            }
-            await pending;
-        }
-        verifyToolkitArchive(archive, input.sha256);
-        archives.push(archive);
-    }
-    // Re-extract verified bytes: a package-writable marker never authenticates an extracted tree.
-    const stage = mkdtempSync(join(cache, `toolkit-${arch}-`));
-    try {
-        const flavor = await tarFlavor(m, run);
-        for (const archive of archives) {
-            if (flavor === 'bsdtar')
-                await refuseEscapingMembers(m, archive, run);
-            const r = await run('tar', flavor === 'gnu' ? ['-xJf', archive, '-C', stage, '--keep-directory-symlink'] : ['-xPJf', archive, '-C', stage], { cwd: m.root, env: { ...process.env } });
-            if (r.status !== 0)
-                fail('toolkit extraction failed');
-        }
-        return stage;
-    }
-    catch (e) {
-        rmSync(stage, { recursive: true, force: true });
-        throw e;
-    }
-}
-/**
- * A later toolkit archive may write through a directory symlink an earlier one
- * created. GNU tar keeps such a symlink only with --keep-directory-symlink;
- * bsdtar only with -P, which also allows absolute and .. members, so those are
- * refused from the listing first.
- */
-async function tarFlavor(m, run) {
-    const r = await run('tar', ['--version'], { cwd: m.root, env: { ...process.env }, capture: true });
-    const version = r.status === 0 ? r.stdout ?? '' : '';
-    if (/\bGNU tar\b/.test(version))
-        return 'gnu';
-    if (/\bbsdtar\b/.test(version))
-        return 'bsdtar';
-    throw Object.assign(new Error(`NATIVE_TOOLKIT_TAR_UNSUPPORTED: extracting native.toolkits needs GNU tar or bsdtar as \`tar\`; found ${r.missing ? 'no tar' : JSON.stringify(version.split('\n')[0] ?? '')}`), { code: 'NATIVE_TOOLKIT_TAR_UNSUPPORTED' });
-}
-async function refuseEscapingMembers(m, archive, run) {
-    const r = await run('tar', ['-tJf', archive], { cwd: m.root, env: { ...process.env }, capture: true });
-    if (r.status !== 0)
-        fail('toolkit extraction failed');
-    for (const member of (r.stdout ?? '').split('\n').filter(Boolean)) {
-        if (member.startsWith('/') || member.split('/').includes('..'))
-            fail(`toolkit member escapes the toolkit folder: ${member}`);
-    }
-}
 async function runHook(m, h, env, run) {
     const [cmd, ...args] = h.command;
     const r = await run(cmd, args, { cwd: inside(m.root, h.cwd), env: { ...process.env, ...h.env, ...env } });
@@ -363,6 +288,8 @@ export async function buildNativeLayout(options) {
             fail('invalid build override');
         m.build = options.build;
     }
+    if (m.portal)
+        checkPortal(m.portal, m.package, m.displayname, m.os_min_ver);
     const arches = options.arches ?? m.arches;
     if (!arches.length || new Set(arches).size !== arches.length || arches.some(a => !m.arches.includes(a)))
         fail('architecture not declared');
@@ -376,7 +303,7 @@ export async function buildNativeLayout(options) {
         await runHook(m, m.native.prepare, env, options.run ?? runCommand);
     const outputs = await commitOutputs(options.outDir ?? join(m.root, 'dist'), (outDir) => forEachArch(arches, jobs, async (arch) => {
         const run = runnerFor(options.run, jobs, arch);
-        const toolkit = await toolkitFor(m, arch, run);
+        const toolkit = await prepareToolkit(m.root, arch, m.native.toolkits[arch] ?? [], run);
         const stage = mkdtempSync(join(tmpdir(), 'synopkgland-layout-'));
         const work = mkdtempSync(join(tmpdir(), 'synopkgland-work-'));
         try {
@@ -402,11 +329,11 @@ export async function buildNativeLayout(options) {
             await createReproducibleTar(target, join(stage, 'package.tgz'), { gzip: true });
             rmSync(target, { recursive: true });
             const fields = { package: m.package, version, arch: layoutInfoArch(arch), os_min_ver: m.os_min_ver, displayname: m.displayname, description: m.description, maintainer: m.maintainer, dsmuidir: 'ui', dsmappname: `SYNO.SDS.${m.package}.Instance`, startable: 'yes', thirdparty: 'yes', checksum: createHash('md5').update(readFileSync(join(stage, 'package.tgz'))).digest('hex') };
-            const info = [...Object.entries(fields), ...metadataInfoFields(m.metadata), ...anchorFields(m.layout.anchors ?? {}, files)];
+            const info = [...Object.entries(fields), ...metadataInfoFields(m.metadata), ...anchorFields(m.layout.anchors ?? {}, files), ...portalFields(m.portal)];
             if (new Set(info.map(([k]) => k)).size !== info.length)
                 fail('INFO anchor collides with an INFO field');
             writeFileSync(join(stage, 'INFO'), info.map(([k, v]) => `${k}="${v.replace(/([\\"$`])/g, '\\$1')}"\n`).join(''));
-            writeFileSync(join(stage, 'native-layout.json'), JSON.stringify({ format: 1, arch, binaries: binaries.map(({ path, linkage }) => ({ path, linkage })), files, ...(m.layout.anchors ? { anchors: m.layout.anchors } : {}) }));
+            writeFileSync(join(stage, 'native-layout.json'), JSON.stringify({ format: 1, arch, binaries: binaries.map(({ path, linkage }) => ({ path, linkage })), files, ...(m.layout.anchors ? { anchors: m.layout.anchors } : {}), ...(m.portal ? { portal: m.portal } : {}) }));
             const output = join(outDir, `${m.package}-${version}-${arch}.spk`);
             await createReproducibleTar(stage, output);
             return output;
@@ -423,7 +350,7 @@ export function inspectNativeLayout(dir, payload, info) {
     try {
         if (!/^[A-Za-z][A-Za-z0-9]{1,63}$/.test(info.package ?? '') || !/^\d+(\.\d+){0,3}-\d+$/.test(info.version ?? '') || !/^7\.\d+(\.\d+)?-\d+$/.test(info.os_min_ver ?? ''))
             fail('invalid native INFO identity/version/DSM');
-        const inv = object(JSON.parse(readFileSync(join(dir, 'native-layout.json'), 'utf8')), ['format', 'arch', 'binaries', 'files', 'anchors']);
+        const inv = object(JSON.parse(readFileSync(join(dir, 'native-layout.json'), 'utf8')), ['format', 'arch', 'binaries', 'files', 'anchors', 'portal']);
         if (inv.format !== 1 || !Object.hasOwn(LAYOUT_ARCHES, inv.arch) || layoutInfoArch(inv.arch) !== info.arch)
             fail('invalid native layout inventory');
         checkLayoutMetadata(dir, true, info.package);
@@ -442,6 +369,10 @@ export function inspectNativeLayout(dir, payload, info) {
         if (createHash('md5').update(readFileSync(join(dir, 'package.tgz'))).digest('hex') !== info.checksum)
             fail('package checksum mismatch');
         checkInfoAnchors(readFileSync(join(dir, 'INFO'), 'utf8'), inv.anchors === undefined ? {} : anchors(inv.anchors), actual);
+        const declared = inv.portal === undefined ? undefined : portal(inv.portal, info.package);
+        if (declared)
+            checkPortal(declared, info.package, info.displayname ?? '', info.os_min_ver);
+        checkInfoPortal(readFileSync(join(dir, 'INFO'), 'utf8'), declared);
         return [];
     }
     catch (e) {
@@ -457,3 +388,11 @@ function checkInfoAnchors(info, declared, files) {
     if (JSON.stringify(lines.sort()) !== JSON.stringify(expected.sort()))
         fail('INFO anchors do not match the payload');
 }
+function portalFields(declared) {
+    return declared ? [[PORTAL_INFO_KEY, declared.alias]] : [];
+}
+function checkInfoPortal(info, declared) {
+    const lines = info.split('\n').filter(line => line.startsWith('synopkgland_portal_'));
+    if (JSON.stringify(lines) !== JSON.stringify(portalFields(declared).map(([key, value]) => `${key}="${value}"`)))
+        fail('INFO portal alias does not match the declared portal');
+}

package/dist/standalone/native-root-window.d.ts

@@ -16,7 +16,8 @@ export interface RootTask {
  * - authorize: DSM's own password confirmation, then one disabled root task
  *   with exactly the embedded script. The one-use token goes into that single
  *   create call and is never kept.
- * - run: re-reads the task and runs it only if it is still exactly ours, then
+ * - run: re-reads the task and runs it only if it is still exactly ours (the
+ *   first run after an authorize uses the task that authorize just read back), then
  *   waits for its history entry and asks the backend for the output. A queued
  *   or running task keeps the wait going, up to RUN_LIMIT_MS (loaded NAS took
  *   4.5 minutes), and `options.progress({op, state, elapsedMs})` hears each poll. Repair

package/dist/standalone/native-root-window.js

@@ -7,7 +7,8 @@ import { versionUnsupported } from "../runtime/dsm-version.js";
  * - authorize: DSM's own password confirmation, then one disabled root task
  *   with exactly the embedded script. The one-use token goes into that single
  *   create call and is never kept.
- * - run: re-reads the task and runs it only if it is still exactly ours, then
+ * - run: re-reads the task and runs it only if it is still exactly ours (the
+ *   first run after an authorize uses the task that authorize just read back), then
  *   waits for its history entry and asks the backend for the output. A queued
  *   or running task keeps the wait going, up to RUN_LIMIT_MS (loaded NAS took
  *   4.5 minutes), and `options.progress({op, state, elapsedMs})` hears each poll. Repair
@@ -18,8 +19,9 @@ import { versionUnsupported } from "../runtime/dsm-version.js";
  */
 export const ROOT_RUNTIME = `function createRootAccess(options) {
   var API = "SYNO.Core.TaskScheduler";
-  var POLL_MS = 500, MAX_POLL_MS = 2000, RUN_LIMIT_MS = 10 * 60 * 1000;
-  var byOp = {}, running = {};
+  var POLL_MS = 500, MAX_POLL_MS = 1000, RUN_LIMIT_MS = 10 * 60 * 1000;
+  // The task an authorize just read back as exactly ours, for the run that follows.
+  var byOp = {}, running = {}, verified = {};
   var legacy = null, probe = null;
   var versionUnsupported = ${versionUnsupported.toString()};
   options.tasks.forEach(function (task) { byOp[task.op] = task; });
@@ -218,9 +220,14 @@ export const ROOT_RUNTIME = `function createRootAccess(options) {
       });
     });
   }
+  function verify(op) {
+    var ref = verified[op];
+    delete verified[op];
+    return ref && op !== "helper_repair" ? Promise.resolve({ state: "ready", ref: ref }) : find(byOp[op]);
+  }
   function performRun(op) {
     return begin(op).then(function (task) {
-      return find(task).then(function (found) {
+      return verify(op).then(function (found) {
         if (found.state !== "ready") throw fail("root_not_ready");
         var consent = op === "helper_repair" ? options.confirmPassword() : Promise.resolve({ confirmed: true });
         return consent.then(function (confirmation) {
@@ -239,9 +246,10 @@ export const ROOT_RUNTIME = `function createRootAccess(options) {
       return begin(op).then(find).then(function (found) { return found.state; });
     },
     authorize: function (op) {
+      delete verified[op];
       return begin(op).then(function (task) {
         return find(task).then(function (found) {
-          if (found.state === "ready") return "ready";
+          if (found.state === "ready") { verified[op] = found.ref; return "ready"; }
           if (found.state === "conflict") throw fail("root_conflict");
           return options.confirmPassword().then(function (confirmation) {
             if (!confirmation || confirmation.confirmed !== true) return "cancelled";
@@ -259,6 +267,7 @@ export const ROOT_RUNTIME = `function createRootAccess(options) {
               return find(task);
             }).then(function (after) {
               if (after.state !== "ready") throw fail("root_verify_failed");
+              verified[op] = after.ref;
               return "ready";
             });
           });
@@ -277,6 +286,7 @@ export const ROOT_RUNTIME = `function createRootAccess(options) {
       return pending;
     },
     remove: function (op) {
+      delete verified[op];
       return begin(op).then(function (task) {
         return find(task).then(function (found) {
           if (found.state === "missing") return "missing";

package/dist/standalone/portal-window.d.ts

@@ -12,8 +12,10 @@ export declare const PORTAL_MESSAGES: Record<string, Record<PortalLocale, string
  * Control Panel shortcut.
  *
  * `status()` resolves `{state, alias?, url?, canManage, controlPanel,
- * defaultAlias}`; `apply(alias)` and `disable()` resolve the new status or
- * reject `{code}`; `openControlPanel()` opens Login Portal > Applications.
+ * defaultAlias, entry?}`; `apply(alias)` and `disable()` resolve the new
+ * status or reject `{code}`. With `options.entry` (below DSM 7.2) the
+ * backend's `portal.status` also reports the executor's entry, and
+ * administrators get `register()` and `unregister()`; `openControlPanel()` opens Login Portal > Applications.
  * `messages` is the panel text in the window's locale; `mountPanel(element)`
  * renders a plain panel for UIs without their own.
  */