@synopackageland/cli 0.9.7 → 0.10.0

package/CHANGELOG.md

@@ -1,5 +1,126 @@
 # Changelog
 
+## 0.10.0 (2026-10-13)
+
+Builds with SDK 0.10.0 and templates 0.10.0: `init` writes SDK v0.10.0 (Go
+module, Rust crate tag and `backend.sdk`), `@synopackageland/sdk` 0.10.0 and
+`@synopackageland/ui` 0.9.4, and the Vue templates use the SDK's `AppShell`.
+CLI 0.10 builds only SDK 0.10.x: the executor digest table records SDK
+0.10.0 and no longer lists 0.9.x, so an App on SDK 0.9.x is refused
+(`SDK_UNSUPPORTED`) and stays on CLI 0.9.7. SDK 0.10.0's executor changed, so
+a rebuilt App carries new executor and lifecycle digests and its pins are
+approved again; the policy digest changes only for a policy that uses root
+program settings, jobs, `stop` or `state`.
+
+繁中摘要：使用 SDK 0.10.0 與 templates 0.10.0（UI 0.9.4），Vue 範本改用 SDK 的
+`AppShell`；新增 Python、Node、Rust App（bridge runtime）、root programs 設定、
+`ui.window`、`backend.timeout_seconds`（預設 60 秒），CLI 輸出全改英文。CLI 0.10
+只接受 SDK 0.10.x，digest 表移除 0.9.x；executor 變更，重建的 App 要重新核准
+executor 與 lifecycle digest。
+
+- Breaking: every CLI message is English. Error descriptions and suggestions,
+  `--help` text, and check, inspect, build and deploy output no longer carry
+  Chinese. Only the multilingual data shipped to DSM end users keeps its
+  translations: the install/upgrade/uninstall wizard copy, the App UI catalogs
+  and the INFO `displayname`/`description` translations. A test now fails on
+  CJK in any other `src/` file.
+- Behavior change: every App's backend request deadline is 60 seconds instead
+  of the SDK's 20. `bridge.json` always carries `timeout_seconds`, so the
+  runtime's deadline and the `deadline_ms` it sends the App follow it; a Go
+  CGI gets it as `-X main.requestTimeout` and keeps the SDK's 20 seconds
+  until its main reads that variable into `api.Timeout`. The DSM window sets
+  `ctx.requestTimeout` to the deadline and gives up two seconds past it (62
+  seconds instead of 22), also for a prebuilt binary CGI.
+- `backend.timeout_seconds` (1–3600) sets another deadline for go, python,
+  node and rust backends. A Go main that does not read `requestTimeout` into
+  `api.Timeout` is refused (`STANDALONE_TIMEOUT_UNSUPPORTED`); a binary
+  backend refuses it.
+- `ui.window: {width, height, minWidth, minHeight}` sets the DSM window's
+  size; omitted fields keep 960×640, at least 700×420, and a standalone
+  launch keeps its 320 px minimum width. Sizes outside 320–3840 × 240–2160,
+  or a minimum larger than the size, are refused
+  (`STANDALONE_UI_WINDOW_INVALID`).
+- The generated DSM window knows a standalone (Portal) launch,
+  `_S("standalone") === true`: its minimum width drops from 700 to 320 px so
+  a phone can show it, and `mount` gets `ctx.fullPage` and `ctx.appIcon` (the
+  package's 64 px window icon) for a full-page layout and brand.
+- `init -t native-python | native-node | native-rust` creates the native-go
+  App with a Python, Node.js (TypeScript) or Rust backend: the Go template's
+  UI, frontend and root program, the language's capability overlays for
+  `--with jobs,root-ops,delegate` (jobs also declares `files: session`, which
+  its example reads; delegate opens `app.status` and `report.save` to
+  signed-in users; Rust lists the added methods in `backend.methods`), and the
+  App SDK its tests import in `backend/vendor`. `--shared-folder` stays
+  native-go only. Capability overlays carry their permission rules.
+- Breaking: `backend.kind: rust` (the Rust full SDK) is removed, and
+  `init -t native-rust` now creates the thin Rust App behind the bridge
+  runtime instead.
+- `backend.runtime: python | node | rust` builds an App in another language
+  behind the SDK's Go runtime (spec/bridge/v1). `build` compiles
+  `bridge/cmd/runtime` of the App's SDK release as `ui/cgi/api.cgi` with the
+  sha256 of `bridge.json` and `permissions.json` bound, and ships the App in
+  `target/app`: Python with the SDK in `vendor/`, Node with the SDK in
+  `node_modules/@synopackageland/app` and an `install_dep_packages` on
+  Package Center's Node.js, Rust cross-compiled with `cargo zigbuild`.
+  Methods come from `backend.methods` or the App's `--describe`. `inspect`
+  checks the manifest schema, the digests, the entry, that the App is not
+  under `ui/`, and the Node dependencies. The `bridge` gate builds all three
+  for every architecture.
+- Bridge Apps may declare `jobs`, `rootOps`, `portal` and an
+  `until-revoked` `delegate` for `files.moveFromStaging`, plus
+  `backend.transfers` and `backend.max_upload_bytes`; `bridge.json` carries
+  them. With jobs or delegate the runtime is also installed as
+  `target/background/worker` and DSM runs it with `--worker` as the package
+  account. `inspect` refuses delegate digests that are not the SPK
+  executor's. The Node SDK is copied as its `package.json` and `dist/`, so
+  the SDK checkout must be built.
+- `root` in dsm-package.yaml configures root programs for the executor's
+  root programs, root jobs, package stop step and root state directory:
+  `programs.<name>` gives a params `schema` and `run` or `job` limits,
+  `kind: binary` takes `root/<arch>/<name>` (an ELF for each architecture,
+  so the policy digest differs per architecture), `stop` names the program
+  the executor runs at package stop and upgrade, and `state: true` asks for
+  the root state directory. Programs without settings keep the bare digest,
+  so existing policies and their digests do not change. Jobs add
+  `root.start` and the `root.jobs` operations. A build whose SDK executor
+  predates these refuses them (`EXECUTOR_ROOT_PROGRAMS_UNSUPPORTED`).
+- `preupgrade` stops the executor with `executor/lifecycle stop --upgrade`;
+  an installed helper without the flag gets a plain stop.
+
+- The DSM window icons are named after their content,
+  `images/app_<hash>_<size>.png`, and `ui/config` points at that name. DSM and
+  the browser cache an App icon by its URL, so after an icon change DSM kept
+  showing the old one (the blue square in t-0391) until the cache expired; a
+  new icon now has a new URL, and an unchanged icon keeps its cached one. DSM
+  7.4 passes the config's icon path, with `{0}` for the size, to
+  `SYNO.Core.Synohdpack getHDIcon` for every `webman/3rdparty/` App, so any
+  file name works.
+- `ctx.call(method, params, {signal})` aborts its fetch when the signal does,
+  so a page the user leaves really stops its request, and rejects
+  `{code: "request_canceled"}`. It also gives up after the SDK's
+  `clientTimeout(ctx.requestTimeout)`, two seconds past the backend deadline
+  (the backend deadline unless the App sets `ctx.requestTimeout` in ms, read
+  on every call), aborts the fetch and rejects `{code: "request_timeout"}`.
+  Before, a call waited as long as the browser did. The portal and root
+  panels use the same call.
+- preuninst waits for the App's uninstall hook by looking it up in `/proc`
+  instead of `kill -0`. DSM's bash logs a failed builtin to syslog even with
+  `2>/dev/null`, so every uninstall with a hook logged `BASH_ERR ... kill: No
+  such process` twice (t-0383 B8). The wait, the timeout and the result are
+  unchanged; a host without `/proc` still uses `kill -0`.
+- preuninst stops an uninstall hook past its timeout, and prestart waits for
+  a stale package user manager to exit, without a `kill` that can fail: the
+  hook's process group and the manager are looked up in `/proc` first, so
+  neither logs `BASH_ERR ... kill: No such process` once the process has
+  exited.
+- The Application Portal panel's Italian instructions use the infinitive like
+  DSM ("Riprovare o usare il Pannello di controllo."), the same text as the
+  SDK's `i18n/portal` catalogs.
+- `ctx.portal.status()` waits for a register or unregister in progress to
+  end, whatever its result, like the SDK's `createPortalAccess`. Before, a
+  status read during a slow change could show "The Application Portal entry
+  was not fully removed".
+
 ## 0.9.7 (2026-10-13)
 
 Builds with SDK 0.9.8 and templates 0.9.7: `init` writes SDK v0.9.8 (Go

package/README.md

@@ -34,12 +34,17 @@ the SPK with Package Center's Manual Install.
 | Template | Use it for | Manifest |
 | --- | --- | --- |
 | `native-go` | A Go backend with a Vue UI (or `--ui plain`) | `dsm-package.yaml` |
+| `native-python`, `native-node`, `native-rust` | The `native-go` App with a Python, Node.js (TypeScript) or Rust backend | `dsm-package.yaml` |
 | `binary` | A static Linux program you build yourself | `dsm-package.yaml` |
 | `compose` | An existing Docker Compose app (`--from compose.yaml`) | `synology-app.yaml` |
 
 Existing native products with their own payload layout use `backend: {kind: native}` in
 `dsm-package.yaml`.
 
+A backend in Python, Node or Rust uses `backend: {runtime: python|node|rust, ...}`: the CGI is
+the SDK's Go runtime, which checks the DSM session and `permissions.json` and starts the App
+from `target/app` as the package account for each request (see `skills/reference/create.md`).
+
 ## SDK and templates
 
 The CLI packages, deploys and checks. The app-side code is the SDK

package/dist/add.js

@@ -11,7 +11,6 @@ import { API_PERMISSIONS_FILE } from './standalone/api-permissions.js';
 import { DEFAULT_MIN_DSM, isDsmAtLeast, PORTAL_EXECUTOR_MIN_DSM } from './build-spk/dsm-version.js';
 import { loadStandaloneManifest } from './standalone/manifest.js';
 import { PORTAL_REQUIRES_EXECUTOR } from './portal/alias.js';
-const NATIVE_TEMPLATE = { go: 'native-go', rust: 'native-rust' };
 function files(root, dir = root) {
     if (!existsSync(dir))
         return [];
@@ -61,7 +60,7 @@ function addPortal(root, result) {
     if (loaded.manifest.portal)
         return { ...result, unchanged: [...result.unchanged, 'portal'] };
     if (!safePath(root, 'dsm-package.yaml'))
-        throw new Error('[ADD_FILE_CONFLICT] 既有檔案與 SDK overlay 不同：dsm-package.yaml；請先移動或合併衝突，不會覆寫。');
+        throw new Error('[ADD_FILE_CONFLICT] The existing file differs from the SDK overlay: dsm-package.yaml; move or merge the conflict first, nothing is overwritten.');
     const manifestPath = join(root, 'dsm-package.yaml');
     const { values, notes } = raiseOsMinVer(loaded.manifest.os_min_ver, PORTAL_EXECUTOR_MIN_DSM, 'portal');
     writeFileSync(manifestPath, setTopLevel(readFileSync(manifestPath, 'utf8'), { ...values, portal: {} }));
@@ -89,18 +88,18 @@ export function addCapabilities(root, requested) {
     if (!loaded.ok)
         throw new Error(loaded.errors.map(e => `[${e.code}] ${e.message}`).join('\n'));
     const m = loaded.manifest;
-    if (m.backend.kind === 'binary')
-        throw new Error('[CAPABILITY_UNSUPPORTED] add 需要 backend.kind: go 或 rust。');
-    const template = NATIVE_TEMPLATE[m.backend.kind];
+    if (m.backend.kind !== 'go')
+        throw new Error('[CAPABILITY_UNSUPPORTED] add needs backend.kind: go.');
+    const template = 'native-go';
     const existing = Object.entries(capabilitySettings(names)).filter(([key]) => key in m.capabilities).map(([key]) => key);
     const unchanged = names.filter(name => existing.includes(Object.keys(capabilitySettings([name]))[0]));
     const added = names.filter(name => !unchanged.includes(name));
     if (!added.length)
         return { added, unchanged };
     if (m.daemon && added.includes('jobs') && !added.includes('delegate') && m.capabilities.delegate?.lifetime !== 'until-revoked')
-        throw new Error('[CAPABILITY_COMBINATION_INVALID] daemon 僅可與 until-revoked delegate 固定 worker 共存。');
+        throw new Error('[CAPABILITY_COMBINATION_INVALID] daemon can only coexist with an until-revoked delegate fixed worker.');
     if (m.backend.dir !== join(root, 'backend'))
-        throw new Error('[ADD_LAYOUT_UNSUPPORTED] SDK overlay 需要 backend.dir: backend。');
+        throw new Error('[ADD_LAYOUT_UNSUPPORTED] The SDK overlay needs backend.dir: backend.');
     const work = mkdtempSync(join(tmpdir(), 'synopkgland-add-'));
     try {
         // Generate SDK files using init's identical substitutions, without touching app-owned files.
@@ -130,7 +129,7 @@ export function addCapabilities(root, requested) {
         if (!safePath(root, 'dsm-package.yaml'))
             conflicts.push('dsm-package.yaml');
         if (conflicts.length)
-            throw new Error(`[ADD_FILE_CONFLICT] 既有檔案與 SDK overlay 不同：${conflicts.join(', ')}；請先移動或合併衝突，不會覆寫。`);
+            throw new Error(`[ADD_FILE_CONFLICT] Existing files differ from the SDK overlay: ${conflicts.join(', ')}; move or merge the conflict first, nothing is overwritten.`);
         const text = readFileSync(manifestPath, 'utf8');
         const capabilities = { ...parse(text).capabilities, ...nativeCapabilitySettings(added) };
         // rootOps needs DSM 7.1-42661 or later.

package/dist/build-spk/dsm-arch.js

@@ -32,7 +32,7 @@ export function parseArchList(value) {
     const families = [];
     for (const item of value.split(",").map((part) => part.trim())) {
         if (!isNativeArchFamily(item)) {
-            throw new Error(`--arch 只接受 ${NATIVE_ARCH_FAMILIES.join("、")}（可用逗號列出多個），收到「${value}」。`);
+            throw new Error(`--arch accepts only ${NATIVE_ARCH_FAMILIES.join(", ")} (list several with commas), got "${value}".`);
         }
         if (!families.includes(item)) {
             families.push(item);

package/dist/build-spk/dsm-icons.d.ts

@@ -1,4 +1,4 @@
-/** Sizes DSM loads for `images/app_{0}.png` (main menu, desktop, window, taskbar). */
+/** Sizes DSM loads for the window icon template (main menu, desktop, window, taskbar). */
 export declare const WINDOW_ICON_SIZES: readonly [16, 24, 32, 48, 64, 72, 256];
 /** The package source drops a release whose PACKAGE_ICON is larger than this. */
 export declare const MAX_ICON_BYTES: number;
@@ -27,5 +27,12 @@ export interface IconReport {
     solid: boolean;
 }
 export declare function iconReport(root: string, icon: string | undefined): IconReport;
+/**
+ * `ui/config`'s icon, relative to ui/: DSM puts the size in for {0}. DSM and
+ * the browser cache an icon by its URL, so the name carries the icons' content
+ * and a changed icon is loaded again.
+ */
+export declare function windowIconTemplate(icons: PackageIcons): string;
+export declare function windowIconFile(icons: PackageIcons, size: number): string;
 export declare function writeDsmWindowIcons(uiDir: string, icons: PackageIcons): void;
 export declare function writePackageCenterIcons(spkRoot: string, icons: PackageIcons): void;

package/dist/build-spk/dsm-icons.js

@@ -1,8 +1,9 @@
+import { createHash } from "node:crypto";
 import { chmodSync, existsSync, mkdirSync, readdirSync, readFileSync, statSync, writeFileSync } from "node:fs";
 import { basename, dirname, join, relative } from "node:path";
 import { fileURLToPath } from "node:url";
 import { decodePng, encodePng } from "./png.js";
-/** Sizes DSM loads for `images/app_{0}.png` (main menu, desktop, window, taskbar). */
+/** Sizes DSM loads for the window icon template (main menu, desktop, window, taskbar). */
 export const WINDOW_ICON_SIZES = [16, 24, 32, 48, 64, 72, 256];
 /** The package source drops a release whose PACKAGE_ICON is larger than this. */
 export const MAX_ICON_BYTES = 256 * 1024;
@@ -14,7 +15,7 @@ function readPng(path, name) {
         return decodePng(readFileSync(path));
     }
     catch (error) {
-        throw new Error(`${name}：${error.message}`);
+        throw new Error(`${name}: ${error.message}`);
     }
 }
 /** Area-average downscale in premultiplied alpha, so transparent edges stay clean. */
@@ -78,24 +79,24 @@ function readIconDirectory(dir) {
             continue;
         const size = Number(match[1]);
         if (!WINDOW_ICON_SIZES.includes(size)) {
-            throw new Error(`${name}：不支援的尺寸；只接受 ${WINDOW_ICON_SIZES.map((s) => `icon_${s}.png`).join("、")}。`);
+            throw new Error(`${name}: unsupported size; only ${WINDOW_ICON_SIZES.map((s) => `icon_${s}.png`).join(", ")} are accepted.`);
         }
         const image = readPng(join(dir, name), name);
         if (image.width !== size || image.height !== size) {
-            throw new Error(`${name}：尺寸是 ${image.width}×${image.height}，應為 ${size}×${size}。`);
+            throw new Error(`${name}: the size is ${image.width}x${image.height}; it should be ${size}x${size}.`);
         }
         drawn.set(size, image);
     }
     if (!drawn.has(256))
-        throw new Error(`圖示目錄 ${basename(dir)}/ 缺少 icon_256.png（256×256 PNG，其他尺寸可省略，由它縮小產生）。`);
+        throw new Error(`Icon directory ${basename(dir)}/ is missing icon_256.png (a 256x256 PNG; other sizes may be omitted and are generated by scaling it down).`);
     return drawn;
 }
 function readIconFile(path) {
     const image = readPng(path, basename(path));
     if (image.width !== image.height)
-        throw new Error(`${basename(path)}：尺寸 ${image.width}×${image.height} 不是正方形。`);
+        throw new Error(`${basename(path)}: the size ${image.width}x${image.height} is not square.`);
     if (image.width < 256)
-        throw new Error(`${basename(path)}：尺寸 ${image.width}×${image.height}，至少 256×256。`);
+        throw new Error(`${basename(path)}: the size ${image.width}x${image.height} must be at least 256x256.`);
     return new Map([[256, scale(image, 256)]]);
 }
 function render(drawn, source) {
@@ -104,7 +105,7 @@ function render(drawn, source) {
     for (const size of WINDOW_ICON_SIZES) {
         const png = encodePng(size, size, scale(drawn.get(size) ?? big, size).rgba);
         if (png.length > MAX_ICON_BYTES) {
-            throw new Error(`${size}×${size} 圖示編碼後 ${png.length} bytes，超過 package source 的 256 KiB 上限；請減少雜訊或細節。`);
+            throw new Error(`The encoded ${size}x${size} icon is ${png.length} bytes, over the package source limit of 256 KiB; reduce noise or detail.`);
         }
         window.set(size, png);
     }
@@ -113,7 +114,7 @@ function render(drawn, source) {
 /** A project icon: one square PNG of at least 256 px, or a directory of icon_<size>.png. */
 export function renderPackageIcons(path) {
     if (!existsSync(path))
-        throw new Error(`找不到圖示 ${basename(path)}。`);
+        throw new Error(`Icon ${basename(path)} was not found.`);
     return render(statSync(path).isDirectory() ? readIconDirectory(path) : readIconFile(path), "custom");
 }
 let defaults;
@@ -134,11 +135,24 @@ function writeIcon(path, png) {
     writeFileSync(path, png);
     chmodSync(path, 0o644);
 }
+/**
+ * `ui/config`'s icon, relative to ui/: DSM puts the size in for {0}. DSM and
+ * the browser cache an icon by its URL, so the name carries the icons' content
+ * and a changed icon is loaded again.
+ */
+export function windowIconTemplate(icons) {
+    const hash = createHash("sha256");
+    for (const [size, png] of icons.window)
+        hash.update(`${size}:${png.length}:`).update(png);
+    return `images/app_${hash.digest("hex").slice(0, 12)}_{0}.png`;
+}
+export function windowIconFile(icons, size) {
+    return windowIconTemplate(icons).replace("{0}", String(size));
+}
 export function writeDsmWindowIcons(uiDir, icons) {
-    const imagesDir = join(uiDir, "images");
-    mkdirSync(imagesDir, { recursive: true });
+    mkdirSync(join(uiDir, "images"), { recursive: true });
     for (const [size, png] of icons.window)
-        writeIcon(join(imagesDir, `app_${size}.png`), png);
+        writeIcon(join(uiDir, windowIconFile(icons, size)), png);
 }
 export function writePackageCenterIcons(spkRoot, icons) {
     writeIcon(join(spkRoot, "PACKAGE_ICON.PNG"), icons.packageIcon);

package/dist/build-spk/dsm-version.d.ts

@@ -15,7 +15,7 @@ export declare const CONTAINER_MIN_DSM: string;
  */
 export declare const PORTAL_MIN_DSM: string;
 /** Why DSM below PORTAL_MIN_DSM refuses a package that declares the web-config portal resource. */
-export declare const PORTAL_MIN_DSM_REASON = "DSM 7.1 \u628A web-config \u5217\u70BA Synology \u5C08\u7528 worker\uFF0C\u4EE5\u932F\u8AA4 320 \u62D2\u88DD\u5E36 portal\uFF08web-config app-portal\uFF09\u7684\u672A\u7C3D\u7AE0\u5957\u4EF6\uFF1B7.2 \u8D77\u958B\u653E\u662F\u4F9D synopkg \u539F\u59CB\u78BC\u5224\u65B7\uFF0C\u5C1A\u672A\u5BE6\u6A5F\u9A57\u8B49";
+export declare const PORTAL_MIN_DSM_REASON = "DSM 7.1 lists web-config as a Synology-only worker and rejects unsigned packages with a portal (web-config app-portal) with error 320; the 7.2 onward allowance is inferred from the synopkg source and is not yet verified on hardware";
 /**
  * Below {@link PORTAL_MIN_DSM} the root executor registers the portal entry in
  * DSM's app.d instead; that file format is verified from DSM 7.1 on.

package/dist/build-spk/dsm-version.js

@@ -22,7 +22,7 @@ export const CONTAINER_MIN_DSM = FIRST_BUILD["7.2.1"];
  */
 export const PORTAL_MIN_DSM = FIRST_BUILD["7.2"];
 /** Why DSM below PORTAL_MIN_DSM refuses a package that declares the web-config portal resource. */
-export const PORTAL_MIN_DSM_REASON = "DSM 7.1 把 web-config 列為 Synology 專用 worker，以錯誤 320 拒裝帶 portal（web-config app-portal）的未簽章套件；7.2 起開放是依 synopkg 原始碼判斷，尚未實機驗證";
+export const PORTAL_MIN_DSM_REASON = "DSM 7.1 lists web-config as a Synology-only worker and rejects unsigned packages with a portal (web-config app-portal) with error 320; the 7.2 onward allowance is inferred from the synopkg source and is not yet verified on hardware";
 /**
  * Below {@link PORTAL_MIN_DSM} the root executor registers the portal entry in
  * DSM's app.d instead; that file format is verified from DSM 7.1 on.
@@ -34,7 +34,7 @@ export function portalByExecutor(osMinVer) {
 }
 /** Why a portal package cannot declare `value`, and how to fix it; `field` names the portal key. */
 export function portalMinDsmMessage(value, field) {
-    return `${field} 需要 DSM ${PORTAL_EXECUTOR_MIN_DSM} 以上，os_min_ver 是「${value}」。DSM ${PORTAL_MIN_DSM} 以前由 executor 寫入 DSM 的 app.d 註冊入口，這個格式只在 DSM 7.1 起驗證過。請把 os_min_ver 提高到 ${PORTAL_EXECUTOR_MIN_DSM} 以上，或移除 ${field}。`;
+    return `${field} needs DSM ${PORTAL_EXECUTOR_MIN_DSM} or later; os_min_ver is "${value}". Before DSM ${PORTAL_MIN_DSM} the executor writes the entry into DSM's app.d, and that format is only verified from DSM 7.1. Raise os_min_ver to ${PORTAL_EXECUTOR_MIN_DSM} or later, or remove ${field}.`;
 }
 /** `true` when `value` is not older than `floor`, comparing version parts then build. */
 export function isDsmAtLeast(value, floor) {
@@ -53,7 +53,7 @@ export function isDsmAtLeast(value, floor) {
 /** Container Apps cannot declare an os_min_ver below {@link CONTAINER_MIN_DSM}. */
 export function assertContainerMinDsm(value) {
     if (!isDsmAtLeast(value, CONTAINER_MIN_DSM)) {
-        throw new Error(`[MIN_DSM_CONTAINER_FLOOR] 容器 App 需要 DSM ${CONTAINER_MIN_DSM} 以上（docker-project／Container Manager 從 DSM 7.2.1 才有），收到「${value}」。`);
+        throw new Error(`[MIN_DSM_CONTAINER_FLOOR] A container App needs DSM ${CONTAINER_MIN_DSM} or later (docker-project/Container Manager starts at DSM 7.2.1); got "${value}".`);
     }
 }
 const FULL_VERSION = /^7\.\d+(\.\d+)?-\d+$/;
@@ -64,7 +64,7 @@ export function resolveMinDsm(value) {
     }
     const build = FIRST_BUILD[value];
     if (!build) {
-        throw new Error(`[MIN_DSM_INVALID] --min-dsm 只接受 ${Object.keys(FIRST_BUILD).join("、")}，或完整的 <版本>-<build>（例如 7.2-64570），收到「${value}」。`);
+        throw new Error(`[MIN_DSM_INVALID] --min-dsm accepts only ${Object.keys(FIRST_BUILD).join(", ")}, or a full <version>-<build> (for example 7.2-64570); got "${value}".`);
     }
     return build;
 }

package/dist/build-spk/gateway.js

@@ -32,10 +32,10 @@ export async function buildGatewayBinary(input) {
         env: { ...process.env, ...pinnedGoBuildEnv(input.arch) },
     });
     if (result.missing) {
-        return { error: "GATEWAY_GO_MISSING", detail: `找不到 go 指令。DSM 驗證閘道需要 Go 1.21 以上版本（https://go.dev/dl/）才能建置。${PINNED_GO_HINT}` };
+        return { error: "GATEWAY_GO_MISSING", detail: `The go command was not found. Building the DSM verification gateway needs Go 1.21 or later (https://go.dev/dl/). ${PINNED_GO_HINT}` };
     }
     if (result.status !== 0) {
-        return { error: "GATEWAY_BUILD_FAILED", detail: `go build（${input.arch}）失敗。${PINNED_GO_HINT}\n${result.stderr}` };
+        return { error: "GATEWAY_BUILD_FAILED", detail: `go build (${input.arch}) failed. ${PINNED_GO_HINT}\n${result.stderr}` };
     }
     const problem = checkCgiBinary(input.work, out, input.arch);
     if (problem) {

package/dist/build-spk/generator.js

@@ -178,7 +178,7 @@ export async function buildSpk(options) {
         if (contract.adminport !== undefined && resolvedWebLaunch(contract) === "dsm-window") {
             const uiDir = join(staging, "package", "ui");
             mkdirSync(uiDir, { recursive: true });
-            writeFileSync(join(uiDir, "config"), renderDsmWindowConfig(contract), "utf8");
+            writeFileSync(join(uiDir, "config"), renderDsmWindowConfig(contract, icons), "utf8");
             writeDsmWindowIcons(uiDir, icons);
             writeUiTexts(uiDir, contractAppTitle(contract));
         }

package/dist/build-spk/png.js

@@ -4,7 +4,7 @@ const MAX_SIDE = 4096;
 const CHANNELS = { 0: 1, 2: 3, 3: 1, 4: 2, 6: 4 };
 const DEPTHS = { 0: [1, 2, 4, 8, 16], 2: [8, 16], 3: [1, 2, 4, 8], 4: [8, 16], 6: [8, 16] };
 function corrupt(why) {
-    throw new Error(`PNG 損壞：${why}`);
+    throw new Error(`Corrupt PNG: ${why}`);
 }
 function chunk(type, data) {
     const head = Buffer.alloc(8);
@@ -21,34 +21,34 @@ function paeth(a, b, c) {
 }
 export function decodePng(bytes) {
     if (bytes.length < 8 || !bytes.subarray(0, 8).equals(SIGNATURE))
-        throw new Error("不是 PNG 檔（檔頭簽章不符）。");
+        throw new Error("Not a PNG file (header signature mismatch).");
     let offset = 8;
     let header;
     let palette, alpha, ended = false;
     const data = [];
     while (!ended) {
         if (offset + 12 > bytes.length)
-            corrupt("檔案被截斷");
+            corrupt("file is truncated");
         const length = bytes.readUInt32BE(offset);
         const type = bytes.toString("latin1", offset + 4, offset + 8);
         const end = offset + 12 + length;
         if (end > bytes.length)
-            corrupt("檔案被截斷");
+            corrupt("file is truncated");
         const body = bytes.subarray(offset + 8, offset + 8 + length);
         if (crc32(body, crc32(bytes.subarray(offset + 4, offset + 8))) !== bytes.readUInt32BE(end - 4))
-            corrupt(`${type} CRC 不符`);
+            corrupt(`${type} CRC mismatch`);
         if (!header && type !== "IHDR")
-            corrupt("第一個 chunk 必須是 IHDR");
+            corrupt("the first chunk must be IHDR");
         if (type === "IHDR") {
             if (header || length !== 13)
-                corrupt("IHDR 無效");
+                corrupt("invalid IHDR");
             header = { width: body.readUInt32BE(0), height: body.readUInt32BE(4), depth: body[8], type: body[9] };
             if (!DEPTHS[header.type]?.includes(header.depth) || body[10] !== 0 || body[11] !== 0)
-                corrupt("不支援的色彩型態或位元深度");
+                corrupt("unsupported colour type or bit depth");
             if (body[12] !== 0)
-                throw new Error("不支援交錯（interlaced）PNG；請另存為非交錯 PNG。");
+                throw new Error("Interlaced PNG is not supported; save it as a non-interlaced PNG.");
             if (header.width < 1 || header.height < 1 || header.width > MAX_SIDE || header.height > MAX_SIDE) {
-                throw new Error(`PNG 尺寸 ${header.width}×${header.height} 超出範圍（每邊 1–${MAX_SIDE} px）。`);
+                throw new Error(`PNG size ${header.width}x${header.height} is out of range (1-${MAX_SIDE} px per side).`);
             }
         }
         else if (type === "PLTE")
@@ -62,10 +62,10 @@ export function decodePng(bytes) {
         offset = end;
     }
     if (!header || !data.length)
-        corrupt("缺少影像資料");
+        corrupt("missing image data");
     const { width, height, depth, type } = header;
     if (type === 3 && (!palette || palette.length % 3 !== 0))
-        corrupt("調色盤影像缺少 PLTE");
+        corrupt("palette image is missing PLTE");
     const bits = CHANNELS[type] * depth;
     const bpp = Math.max(1, bits >> 3);
     const stride = Math.ceil((width * bits) / 8);
@@ -74,10 +74,10 @@ export function decodePng(bytes) {
         raw = inflateSync(Buffer.concat(data), { maxOutputLength: (stride + 1) * height + 1 });
     }
     catch {
-        corrupt("影像資料無法解壓縮");
+        corrupt("image data cannot be decompressed");
     }
     if (raw.length !== (stride + 1) * height)
-        corrupt("影像資料長度不符");
+        corrupt("image data length mismatch");
     const prev = Buffer.alloc(stride), line = Buffer.alloc(stride);
     const rgba = Buffer.alloc(width * height * 4);
     const sample = (x, channel) => {
@@ -94,7 +94,7 @@ export function decodePng(bytes) {
         const filter = raw[y * (stride + 1)];
         for (let i = 0; i < stride; i++) {
             const a = i >= bpp ? line[i - bpp] : 0, b = prev[i], c = i >= bpp ? prev[i - bpp] : 0;
-            const predictor = filter === 0 ? 0 : filter === 1 ? a : filter === 2 ? b : filter === 3 ? (a + b) >> 1 : filter === 4 ? paeth(a, b, c) : corrupt("未知的列濾波");
+            const predictor = filter === 0 ? 0 : filter === 1 ? a : filter === 2 ? b : filter === 3 ? (a + b) >> 1 : filter === 4 ? paeth(a, b, c) : corrupt("unknown row filter");
             line[i] = (row[i] + predictor) & 0xff;
         }
         for (let x = 0; x < width; x++) {
@@ -102,7 +102,7 @@ export function decodePng(bytes) {
             if (type === 3) {
                 const index = sample(x, 0);
                 if (index * 3 + 2 >= palette.length)
-                    corrupt("調色盤索引超出範圍");
+                    corrupt("palette index out of range");
                 palette.copy(rgba, out, index * 3, index * 3 + 3);
                 rgba[out + 3] = alpha && index < alpha.length ? alpha[index] : 255;
             }

package/dist/capabilities.js

@@ -3,7 +3,7 @@ export function capabilityNames(values) {
     const names = [...new Set(values.flatMap(value => value.split(',')).map(value => value.trim()))];
     for (const name of names) {
         if (!CAPABILITY_NAMES.includes(name))
-            throw new Error(`[CAPABILITY_INVALID] 不支援能力「${name}」；可選 ${CAPABILITY_NAMES.join(', ')}。`);
+            throw new Error(`[CAPABILITY_INVALID] Unsupported capability "${name}"; choose from ${CAPABILITY_NAMES.join(', ')}.`);
     }
     return names;
 }

package/dist/capability-overlays.d.ts

@@ -1,17 +1,28 @@
+import type { CapabilityName } from './capabilities.js';
+import type { ApiPermission } from './standalone/api-permissions.js';
 /**
  * How each capability of a native template is laid over its base template: the
- * template directories copied on top, files borrowed from another overlay, and
- * the base files the overlay replaces. init and add both read this table.
+ * template directories copied on top, files borrowed from another overlay, the
+ * base files the overlay replaces, and the rules it adds to the App's
+ * permissions. A bridge App's example may also need another capability, and a
+ * Rust App lists the methods it adds in its manifest. init and add both read
+ * this table.
  */
 export interface CapabilityOverlay {
     overlays: string[];
     borrowed: string[];
     removed: string[];
+    permissions: Record<string, ApiPermission>;
+    implied?: CapabilityName[];
+    methods?: string[];
 }
-export type NativeTemplate = 'native-go' | 'native-rust';
+export type BridgeTemplate = 'native-python' | 'native-node' | 'native-rust';
+export type NativeTemplate = 'native-go' | BridgeTemplate;
+export declare const BRIDGE_TEMPLATES: BridgeTemplate[];
 export declare const CAPABILITY_OVERLAYS: Record<NativeTemplate, Record<string, CapabilityOverlay>>;
-/** The overlays of a native template's Vue frontend, copied before the capabilities'. */
-export declare const VUE_OVERLAYS: Record<NativeTemplate, string[]>;
+/** What a native template's base and Vue frontend add before the capabilities: a bridge App borrows the Go template's UI. */
+export declare const BASE_BORROWED: Record<NativeTemplate, string[]>;
+export declare const VUE_OVERLAYS: Record<NativeTemplate, Pick<CapabilityOverlay, 'overlays' | 'borrowed'>>;
 /** The overlays of these capabilities, in table order, each once; a capability without one adds nothing. */
 export declare function capabilityOverlays(template: NativeTemplate, names: readonly string[]): CapabilityOverlay;
 /** Each file of the borrowed paths, a borrowed folder listed file by file, under `templates`. */

package/dist/capability-overlays.js

@@ -1,38 +1,52 @@
 import { readdirSync, statSync } from 'node:fs';
 import { join } from 'node:path';
 const EXECUTOR_SHELL = ['backend/internal/app/executor.go', 'backend/internal/app/executor_test.go'];
+export const BRIDGE_TEMPLATES = ['native-python', 'native-node', 'native-rust'];
 export const CAPABILITY_OVERLAYS = { 'native-go': {
-        'root-ops': { overlays: ['native-go-root-ops'], borrowed: [], removed: ['backend/internal/app/root_none.go'] },
-        jobs: { overlays: ['native-go-jobs'], borrowed: [], removed: ['backend/internal/app/background_none.go'] },
+        'root-ops': { overlays: ['native-go-root-ops'], borrowed: [], removed: ['backend/internal/app/root_none.go'], permissions: {} },
+        jobs: { overlays: ['native-go-jobs'], borrowed: [], removed: ['backend/internal/app/background_none.go'], permissions: {} },
         delegate: {
             overlays: ['native-go-jobs', 'native-go-delegate'],
             borrowed: EXECUTOR_SHELL.map(file => `native-go-root-ops/${file}`),
             removed: ['backend/internal/app/background_none.go', 'backend/internal/app/root_none.go', 'backend/internal/app/delegate_none.go'],
+            // Every signed-in user opens a delegate App to pick where reports go.
+            permissions: { 'app.status': 'authenticated' },
         },
-    },
-    // Rust has no build tags: an overlay overwrites the base's same-named files and
-    // nothing is removed. The frontend and root/ files come from native-go's overlays.
-    'native-rust': {
-        'root-ops': { overlays: ['native-rust-root-ops'], borrowed: ['native-go-root-ops/root'], removed: [] },
-        jobs: { overlays: ['native-rust-jobs'], borrowed: ['native-go-jobs/frontend'], removed: [] },
+    }, ...Object.fromEntries(BRIDGE_TEMPLATES.map(template => [template, bridgeOverlays(template)])) };
+/**
+ * A bridge App runs the Go template's example in its own language: each
+ * overlay replaces a stub module, and the frontend and root programs come
+ * from the Go overlays. In this order, a Rust manifest lists the methods.
+ */
+function bridgeOverlays(template) {
+    return {
+        // The example hashes a file the caller picks, which the runtime reads only for an App with files.
+        jobs: { overlays: [`${template}-jobs`], borrowed: ['native-go-jobs/frontend'], removed: [], permissions: {}, implied: ['files'], methods: ['hash.submit', 'hash.get', 'hash.cancel'] },
+        'root-ops': { overlays: [`${template}-root-ops`], borrowed: ['native-go-root-ops/root'], removed: [], permissions: {}, methods: ['whoami.run'] },
         delegate: {
-            overlays: ['native-rust-jobs', 'native-rust-delegate'],
-            borrowed: ['native-go-jobs/frontend', 'native-go-delegate/frontend', 'native-rust-root-ops/backend/src/app/root_routes.rs'],
-            removed: [],
+            overlays: [`${template}-delegate`], borrowed: ['native-go-jobs/frontend', 'native-go-delegate/frontend'], removed: [],
+            permissions: { 'app.status': 'authenticated', 'report.save': 'authenticated' }, methods: ['report.save'],
         },
-    } };
-/** The overlays of a native template's Vue frontend, copied before the capabilities'. */
-export const VUE_OVERLAYS = { 'native-go': ['native-go-vue'], 'native-rust': ['native-go-vue', 'native-rust-vue'] };
+    };
+}
+/** What a native template's base and Vue frontend add before the capabilities: a bridge App borrows the Go template's UI. */
+export const BASE_BORROWED = { 'native-go': [],
+    ...Object.fromEntries(BRIDGE_TEMPLATES.map(template => [template, ['native-go/ui', 'native-go/i18n']])) };
+export const VUE_OVERLAYS = { 'native-go': { overlays: ['native-go-vue'], borrowed: [] },
+    ...Object.fromEntries(BRIDGE_TEMPLATES.map(template => [template, { overlays: [`${template}-vue`], borrowed: ['native-go-vue/frontend'] }])) };
 /** The overlays of these capabilities, in table order, each once; a capability without one adds nothing. */
 export function capabilityOverlays(template, names) {
     const chosen = Object.entries(CAPABILITY_OVERLAYS[template]).filter(([name]) => names.includes(name)).map(([, overlay]) => overlay);
     const unique = (pick) => [...new Set(chosen.flatMap(pick))];
-    return { overlays: unique(o => o.overlays), borrowed: unique(o => o.borrowed), removed: unique(o => o.removed) };
+    return { overlays: unique(o => o.overlays), borrowed: unique(o => o.borrowed), removed: unique(o => o.removed),
+        permissions: Object.assign({}, ...chosen.map(o => o.permissions)),
+        implied: [...new Set(chosen.flatMap(o => o.implied ?? []))], methods: unique(o => o.methods ?? []) };
 }
 /** Each file of the borrowed paths, a borrowed folder listed file by file, under `templates`. */
 export function borrowedFiles(templates, borrowed) {
+    // A template folder may carry what developing it installs or builds.
     const walk = (path) => statSync(join(templates, path)).isDirectory()
-        ? readdirSync(join(templates, path)).sort().flatMap(name => walk(`${path}/${name}`))
+        ? readdirSync(join(templates, path)).sort().filter(name => name !== 'node_modules' && name !== 'dist').flatMap(name => walk(`${path}/${name}`))
         : [path];
     return [...new Set(borrowed.flatMap(walk))];
 }