@synopackageland/cli 0.9.7 → 0.10.1

package/dist/standalone/bridge-rust.js

@@ -0,0 +1,89 @@
+import { chmodSync, copyFileSync, mkdirSync, rmSync } from "node:fs";
+import { homedir } from "node:os";
+import { join } from "node:path";
+import { SDK_GIT_URL } from "../runtime/sdk-source.js";
+import { checkCgiBinary } from "./binary.js";
+import { RUST_BIN_DIR } from "./bridge-json.js";
+import { StandaloneBuildError } from "./spk.js";
+/** The glibc loader of DSM's ARMv7 models, the one interpreter an armv7 Rust App may name. */
+export const ARMV7_INTERPRETER = "/lib/ld-linux-armhf.so.3";
+/**
+ * x86_64 and aarch64 are static musl binaries. armv7 links against glibc
+ * (2.17, older than any DSM 7), because musl's 64-bit time calls fail on
+ * DSM's ARMv7 kernels; zig provides both, so any host can build all three.
+ */
+export const RUST_TARGETS = {
+    x86_64: { triple: "x86_64-unknown-linux-musl" },
+    aarch64: { triple: "aarch64-unknown-linux-musl" },
+    armv7: { triple: "armv7-unknown-linux-gnueabihf.2.17", interpreter: ARMV7_INTERPRETER },
+};
+const RUSTUP_HINT = "Install Rust with rustup (https://rustup.rs), run rustup target add x86_64-unknown-linux-musl aarch64-unknown-linux-musl armv7-unknown-linux-gnueabihf, and make sure the cargo on PATH is rustup's (not Homebrew's rust).";
+/** Cross-compiles the App's binary for one architecture into `work/app-<arch>/bin`; returns that App directory. */
+export async function buildRustApp(m, arch, work, run) {
+    const backend = m.backend;
+    const target = RUST_TARGETS[arch];
+    const result = await run("cargo", [
+        "zigbuild", "--release", "--locked", "--target", target.triple, "--bin", backend.entry, "--message-format=json-render-diagnostics",
+    ], { cwd: backend.dir, env: cargoEnv(backend.dir), capture: true });
+    if (result.missing)
+        fail(`cargo was not found. ${RUSTUP_HINT}`);
+    if (result.status !== 0) {
+        const hint = /no such command: `?zigbuild/.test(result.stderr) ? "Run cargo install cargo-zigbuild and install zig (https://ziglang.org/download/)."
+            : /can't find crate for `(core|std)`/.test(result.stderr) ? RUSTUP_HINT : "";
+        fail(`cargo zigbuild (${arch}) failed. ${hint}\n${result.stderr}`);
+    }
+    const app = join(work, `app-${arch}`);
+    rmSync(app, { recursive: true, force: true });
+    mkdirSync(join(app, RUST_BIN_DIR), { recursive: true });
+    const out = join(app, RUST_BIN_DIR, backend.entry);
+    copyFileSync(artifact(result.stdout ?? "", backend.entry), out);
+    chmodSync(out, 0o755);
+    const problem = checkCgiBinary(work, out, arch, target.interpreter);
+    if (problem)
+        throw new StandaloneBuildError(problem.code, problem.message);
+    return app;
+}
+/**
+ * The environment of one reproducible cargo build: the CLI's flags replace any
+ * inherited RUSTFLAGS, paths are remapped, symbols and build IDs dropped, and
+ * panics unwind so the SDK answers `internal` instead of the process ending.
+ * Cargo fetches the private SDK repository through git, with the user's credentials.
+ */
+function cargoEnv(dir) {
+    const env = { ...process.env };
+    delete env.RUSTFLAGS;
+    const cargoHome = env.CARGO_HOME || join(homedir(), ".cargo");
+    env.CARGO_ENCODED_RUSTFLAGS = [
+        `--remap-path-prefix=${dir}=/build`,
+        `--remap-path-prefix=${cargoHome}=/cargo`,
+        "-Cstrip=symbols",
+        "-Clink-arg=-Wl,--build-id=none",
+        // zig notes that it ignores rustc's own -Wl,-O1; such linker output is no warning of the App. Link errors still fail.
+        "-Alinker_messages",
+    ].join("\x1f");
+    env.CARGO_PROFILE_RELEASE_PANIC = "unwind";
+    env.SOURCE_DATE_EPOCH = "0";
+    env.CARGO_NET_GIT_FETCH_WITH_CLI = "true";
+    if (env.SYNOPKGLAND_SDK_DIR) {
+        // Development only: git reads the SDK repository from this checkout, which must hold the locked tag.
+        const n = Number(env.GIT_CONFIG_COUNT ?? 0);
+        env.GIT_CONFIG_COUNT = String(n + 1);
+        env[`GIT_CONFIG_KEY_${n}`] = `url.file://${env.SYNOPKGLAND_SDK_DIR}.insteadOf`;
+        env[`GIT_CONFIG_VALUE_${n}`] = SDK_GIT_URL;
+    }
+    return env;
+}
+/** The executable Cargo reported for `bin`. */
+function artifact(messages, bin) {
+    for (const line of messages.split("\n")) {
+        if (!line.startsWith("{"))
+            continue;
+        const message = JSON.parse(line);
+        if (message.reason === "compiler-artifact" && message.target?.kind?.includes("bin") && message.target.name === bin && message.executable)
+            return message.executable;
+    }
+    return fail(`cargo zigbuild produced no bin ${bin}; backend.entry must be the Cargo project's binary name.`);
+}
+function fail(message) {
+    throw new StandaloneBuildError("STANDALONE_RUST_BUILD_FAILED", message);
+}

package/dist/standalone/build.js

@@ -7,13 +7,15 @@ import { goBuildEnv } from "../build-spk/dsm-arch.js";
 import { resolveMinDsm, DEFAULT_MIN_DSM, isDsmAtLeast, PORTAL_EXECUTOR_MIN_DSM, portalByExecutor, portalMinDsmMessage } from "../build-spk/dsm-version.js";
 import { checkCgiBinary } from "./binary.js";
 import { loadStandaloneManifest } from "./manifest.js";
-import { buildRustBackend } from "./rust-build.js";
 import { assembleStandaloneSpk, StandaloneBuildError } from "./spk.js";
 import { buildDaemonControl } from "./daemon.js";
 import { buildExecutor } from "../runtime/executor-build.js";
 import { BACKGROUND_WORKER_MAIN } from "./background.js";
 import { readApiPermissions } from "./api-permissions.js";
 import { checkJobs, commitOutputs, forEachArch } from "./arch-jobs.js";
+import { isBridgeBackend } from "./bridge-backend.js";
+import { requestTimeoutSeconds } from "./request-timeout.js";
+import { buildBridge, prepareBridge } from "./bridge-build.js";
 /** Argv only, never a shell; output streams to the terminal except stderr, which is also kept, and captured stdout. */
 export const runCommand = (command, args, options) => new Promise((done) => {
     const child = spawn(command, args, {
@@ -88,7 +90,7 @@ export async function buildStandalone(options) {
     const arches = options.arches ?? manifest.arches;
     for (const arch of arches) {
         if (!manifest.arches.includes(arch)) {
-            throw new StandaloneBuildError("STANDALONE_ARCH_NOT_DECLARED", `${arch} 不在 dsm-package.yaml 的 arches 內；要建置它，請先把 ${arch} 加進 arches。`);
+            throw new StandaloneBuildError("STANDALONE_ARCH_NOT_DECLARED", `${arch} is not in the arches of dsm-package.yaml; to build it, add ${arch} to arches first.`);
         }
     }
     await buildUi(manifest, options.run ?? runCommand);
@@ -96,6 +98,7 @@ export async function buildStandalone(options) {
     const work = mkdtempSync(join(tmpdir(), "syno-standalone-build-"));
     const warnings = new Set();
     try {
+        const bridge = await prepareBridge(manifest, work);
         const outputs = await commitOutputs(outDir, (stage) => forEachArch(arches, jobs, async (arch) => {
             const run = runnerFor(options.run, jobs, arch);
             const archWork = join(work, arch);
@@ -103,10 +106,10 @@ export async function buildStandalone(options) {
             const executor = await buildExecutor(manifest, arch, archWork, run);
             executor?.warnings.forEach(warning => warnings.add(warning));
             const builtManifest = executor ? { ...manifest, executor } : manifest;
-            const { cgi: cgiPath, worker: backgroundWorker } = await backendFor(builtManifest, arch, archWork, run);
+            const { cgi: cgiPath, worker: backgroundWorker, app } = await backendFor(builtManifest, arch, archWork, run, bridge);
             const outputPath = join(stage, `${manifest.package}-${manifest.spkVersion}-${arch}.spk`);
             const daemonControl = await buildDaemonControl(manifest, arch, archWork, run);
-            await assembleStandaloneSpk({ manifest: builtManifest, arch, cgiPath, outputPath, daemonControl, backgroundWorker, executor });
+            await assembleStandaloneSpk({ manifest: builtManifest, arch, cgiPath, outputPath, daemonControl, backgroundWorker, executor, app });
             return outputPath;
         }));
         return { outputs, warnings: [...warnings] };
@@ -124,16 +127,16 @@ async function buildUi(manifest, run) {
     const result = await run(command, args, { cwd: build.cwd, env: { ...process.env } });
     if (result.missing || result.status !== 0) {
         const installHint = command === "npm" && existsSync(join(build.cwd, "package.json")) && !existsSync(join(build.cwd, "node_modules"))
-            ? `\nUI 依賴尚未安裝。請在 ${build.cwd} 執行 npm ${existsSync(join(build.cwd, "package-lock.json")) ? "ci" : "install"}，然後重新執行 build。`
+            ? `\nThe UI dependencies are not installed. Run npm ${existsSync(join(build.cwd, "package-lock.json")) ? "ci" : "install"} in ${build.cwd}, then run build again.`
             : "";
-        throw new StandaloneBuildError("STANDALONE_UI_BUILD_FAILED", `UI build（${build.command.join(" ")}）失敗。${installHint}\n${result.stderr}`);
+        throw new StandaloneBuildError("STANDALONE_UI_BUILD_FAILED", `UI build (${build.command.join(" ")}) failed. ${installHint}\n${result.stderr}`);
     }
 }
-/** The checked CGI of one architecture and, with capabilities.jobs, its fixed worker. */
-async function backendFor(manifest, arch, work, run) {
+/** The checked CGI of one architecture and, with capabilities.jobs, its fixed worker; or the runtime and App of a bridge App. */
+async function backendFor(manifest, arch, work, run, bridge) {
     const backend = manifest.backend;
-    if (backend.kind === "rust")
-        return buildRustBackend(manifest, arch, work, run);
+    if (isBridgeBackend(backend))
+        return buildBridge(manifest, bridge, arch, work, run);
     const cgi = backend.kind === "binary" ? backend.files[arch] : await buildGoCgi(manifest, backend, arch, work, run);
     const problem = checkCgiBinary(backend.kind === "go" ? work : manifest.root, cgi, arch);
     if (problem) {
@@ -149,7 +152,7 @@ async function buildGoCgi(manifest, backend, arch, work, run) {
     }
     const module = goModulePath(backend.dir);
     if (!module)
-        throw new StandaloneBuildError("STANDALONE_GO_BUILD_FAILED", `${join(backend.dir, "go.mod")} 沒有 module 行；backend 必須是一個 Go module。`);
+        throw new StandaloneBuildError("STANDALONE_GO_BUILD_FAILED", `${join(backend.dir, "go.mod")} has no module line; backend must be a Go module.`);
     const out = join(work, `api-${arch}.cgi`);
     const ldflags = [
         "-s",
@@ -157,6 +160,7 @@ async function buildGoCgi(manifest, backend, arch, work, run) {
         "-buildid=",
         `-X main.packageID=${manifest.package}`,
         `-X main.version=${manifest.spkVersion}`,
+        `-X main.requestTimeout=${requestTimeoutSeconds(backend)}`,
         `-X ${module}/internal/api.expectedPermissionsDigest=${manifest.apiPermissionsDigest}`,
         `-X ${SDK_MODULE}/api.expectedSDKPermissionsDigest=${manifest.apiSDKPermissionsDigest}`,
         ...delegateBuildFlags(manifest),
@@ -171,11 +175,11 @@ async function buildGoCgi(manifest, backend, arch, work, run) {
         env: { ...process.env, ...goBuildEnv(arch) },
     });
     if (result.missing) {
-        throw new StandaloneBuildError("STANDALONE_GO_MISSING", "找不到 go 指令。請安裝 Go 1.25 以上版本（https://go.dev/dl/），或改用 backend.binary 打包既有執行檔。");
+        throw new StandaloneBuildError("STANDALONE_GO_MISSING", "The go command was not found. Install Go 1.25 or later (https://go.dev/dl/), or package an existing executable with backend.binary.");
     }
     if (result.status !== 0) {
         const fetchingSdk = result.stderr.includes(`${SDK_MODULE}@`) ? privateSdkHint() : "";
-        throw new StandaloneBuildError("STANDALONE_GO_BUILD_FAILED", `go build（${arch}）失敗。\n${result.stderr}${fetchingSdk}`);
+        throw new StandaloneBuildError("STANDALONE_GO_BUILD_FAILED", `go build (${arch}) failed.\n${result.stderr}${fetchingSdk}`);
     }
     return out;
 }
@@ -192,7 +196,7 @@ async function buildBackgroundWorker(manifest, arch, work, run) {
         env: { ...process.env, ...goBuildEnv(arch) },
     });
     if (result.missing || result.status !== 0) {
-        throw new StandaloneBuildError("STANDALONE_BACKGROUND_BUILD_FAILED", `background worker（${BACKGROUND_WORKER_MAIN}）build 失敗；這個專案的 backend 需要含該 package。\n${result.stderr}`);
+        throw new StandaloneBuildError("STANDALONE_BACKGROUND_BUILD_FAILED", `background worker (${BACKGROUND_WORKER_MAIN}) build failed; this project's backend must contain that package.\n${result.stderr}`);
     }
     const problem = checkCgiBinary(work, out, arch);
     if (problem)

package/dist/standalone/daemon.js

@@ -18,7 +18,7 @@ export const relativeExec = (v) => typeof v === "string" && v.length <= 200
 export function readDaemon(value, root, arches, fail) {
     if (value === undefined)
         return undefined;
-    const invalid = () => { fail({ code: "STANDALONE_DAEMON_INVALID", message: "daemon 只接受固定 exec、targets、args、env 與 timeouts；路徑須在專案內，環境不接受 loader/shell/system 變數。" }); return undefined; };
+    const invalid = () => { fail({ code: "STANDALONE_DAEMON_INVALID", message: "daemon accepts only fixed exec, targets, args, env and timeouts; paths must be inside the project, and the environment does not accept loader/shell/system variables." }); return undefined; };
     if (!record(value) || Object.keys(value).some(k => !fields.has(k)))
         return invalid();
     if (!relativeExec(value.exec))
@@ -85,7 +85,7 @@ export function copyDaemonPayload(manifest, arch, target, controller) {
         const stat = lstatSync(from);
         const rel = relative(realpathSync(manifest.root), realpathSync(from));
         if (rel.startsWith("..") || isAbsolute(rel) || stat.isSymbolicLink())
-            invalid(`daemon payload 路徑不可含 symlink 或跳出專案：${from}`);
+            invalid(`A daemon payload path must not contain a symlink or escape the project: ${from}`);
         if (stat.isDirectory()) {
             mkdirSync(to, { recursive: true });
             chmodSync(to, 0o755);
@@ -95,22 +95,22 @@ export function copyDaemonPayload(manifest, arch, target, controller) {
         else if (stat.isFile()) {
             total += stat.size;
             if (total > 512 * 1024 * 1024 || (stat.mode & 0o6000))
-                invalid(`daemon payload 不接受 setid 或超過 512 MiB：${from}`);
+                invalid(`The daemon payload does not accept setid bits or more than 512 MiB: ${from}`);
             copyFileSync(from, to);
             chmodSync(to, stat.mode & 0o111 ? 0o755 : 0o644);
         }
         else
-            invalid(`daemon payload 只接受一般檔案及目錄：${from}`);
+            invalid(`The daemon payload accepts only regular files and directories: ${from}`);
     };
     try {
         if (!lstatSync(source).isDirectory())
-            invalid("daemon.targets 必須指向目錄。");
+            invalid("daemon.targets must point at a directory.");
         walk(source, join(target, "payload"));
     }
     catch (error) {
         if (error instanceof StandaloneBuildError)
             throw error;
-        invalid(`無法讀取 daemon payload：${String(error)}`);
+        invalid(`Cannot read the daemon payload: ${String(error)}`);
     }
     const exec = join(source, daemon.exec);
     const problem = checkCgiBinary(manifest.root, exec, arch);

package/dist/standalone/dsm-window.d.ts

@@ -1,5 +1,6 @@
 import type { EntryMode, StandaloneManifest } from "./manifest.js";
 import { type AppTitle } from "../build-spk/ui-texts.js";
+import { type PackageIcons } from "../build-spk/dsm-icons.js";
 /** Same path the generated wrapper POSTs to, and the payload location of the CGI. */
 export declare const CGI_PAYLOAD_PATH = "ui/cgi/api.cgi";
 export declare function cgiUrl(packageId: string): string;
@@ -19,12 +20,16 @@ export declare function windowScriptName(manifest: Pick<StandaloneManifest, "bui
 export declare function entryLauncherAccess(entry: EntryMode): Record<string, unknown>;
 export declare function appTitle(manifest: StandaloneManifest): AppTitle;
 /** `ui/config`: registers the DSM main-menu app and its window class. */
-export declare function renderUiConfig(manifest: StandaloneManifest): string;
+export declare function renderUiConfig(manifest: StandaloneManifest, icons?: PackageIcons): string;
 /**
  * The DSM AppWindow that hosts the project's UI. It loads app/app.js and
- * app/app.css once, then calls the app's mount(root, ctx). `ctx.call` is the
- * only transport: same-origin POST with DSM's session cookie and SynoToken.
+ * app/app.css once, then calls the app's mount(root, ctx). `ctx.call(method,
+ * params, {signal})` is the only transport: same-origin POST with DSM's session
+ * cookie and SynoToken, given up past `ctx.requestTimeout` like the SDK's.
  * `ctx.t` / `ctx.locale` translate with the catalogs embedded at build time.
- * `assetVersion` busts browser caches when the UI changes.
+ * `assetVersion` busts browser caches when the UI changes. A Portal/standalone
+ * launch owns the whole page: `ctx.fullPage` tells the app to lay out full-page
+ * (and add a device-width viewport), and `ctx.appIcon` is the package icon a
+ * full-page shell shows beside the name, where a DSM window has a title bar.
  */
-export declare function renderWindowScript(manifest: StandaloneManifest, assetVersion: string): string;
+export declare function renderWindowScript(manifest: StandaloneManifest, assetVersion: string, icons?: PackageIcons): string;

package/dist/standalone/dsm-window.js

@@ -6,8 +6,13 @@ import { permitsOrdinaryUsers } from "./api-permissions.js";
 import { PORTAL_RUNTIME } from "./portal-window.js";
 import { portalByExecutor } from "../build-spk/dsm-version.js";
 import { uiTitleFields } from "../build-spk/ui-texts.js";
+import { packageIcons, windowIconFile, windowIconTemplate } from "../build-spk/dsm-icons.js";
+import { DEFAULT_WINDOW, FULL_PAGE_MIN_WIDTH } from "./window-size.js";
+import { requestTimeoutSeconds } from "./request-timeout.js";
 /** Same path the generated wrapper POSTs to, and the payload location of the CGI. */
 export const CGI_PAYLOAD_PATH = "ui/cgi/api.cgi";
+/** The SDK's clientTimeout(requestTimeout) waits this much past the backend deadline. */
+const CLIENT_TIMEOUT_MARGIN = 2000;
 export function cgiUrl(packageId) {
     return `/webman/3rdparty/${packageId}/cgi/api.cgi`;
 }
@@ -68,7 +73,8 @@ export function appTitle(manifest) {
     return { displayname: manifest.displayname, description: manifest.description, info: manifest.i18n?.info };
 }
 /** `ui/config`: registers the DSM main-menu app and its window class. */
-export function renderUiConfig(manifest) {
+export function renderUiConfig(manifest, icons = packageIcons(manifest.icon)) {
+    const icon = windowIconTemplate(icons);
     const ns = `SYNO.SDS.${manifest.package}`;
     const titleFields = uiTitleFields(appTitle(manifest));
     return `${JSON.stringify({
@@ -76,7 +82,7 @@ export function renderUiConfig(manifest) {
             [`${ns}.Instance`]: {
                 type: "app",
                 ...titleFields,
-                icon: "images/app_{0}.png",
+                icon,
                 appWindow: `${ns}.MainWindow`,
                 allowMultiInstance: false,
                 ...launcherAccess(manifest),
@@ -86,7 +92,7 @@ export function renderUiConfig(manifest) {
                 type: "lib",
                 title: titleFields.title,
                 texts: titleFields.texts,
-                icon: "images/app_{0}.png",
+                icon,
                 depend: [],
             },
         },
@@ -94,37 +100,68 @@ export function renderUiConfig(manifest) {
 }
 /**
  * The DSM AppWindow that hosts the project's UI. It loads app/app.js and
- * app/app.css once, then calls the app's mount(root, ctx). `ctx.call` is the
- * only transport: same-origin POST with DSM's session cookie and SynoToken.
+ * app/app.css once, then calls the app's mount(root, ctx). `ctx.call(method,
+ * params, {signal})` is the only transport: same-origin POST with DSM's session
+ * cookie and SynoToken, given up past `ctx.requestTimeout` like the SDK's.
  * `ctx.t` / `ctx.locale` translate with the catalogs embedded at build time.
- * `assetVersion` busts browser caches when the UI changes.
+ * `assetVersion` busts browser caches when the UI changes. A Portal/standalone
+ * launch owns the whole page: `ctx.fullPage` tells the app to lay out full-page
+ * (and add a device-width viewport), and `ctx.appIcon` is the package icon a
+ * full-page shell shows beside the name, where a DSM window has a title bar.
  */
-export function renderWindowScript(manifest, assetVersion) {
+export function renderWindowScript(manifest, assetVersion, icons = packageIcons(manifest.icon)) {
     const pkg = manifest.package;
     const ns = `SYNO.SDS.${pkg}`;
     const p = JSON.stringify(pkg);
     const root = manifest.executor ? renderRootParts(ns, manifest) : undefined;
+    const size = manifest.ui.window ?? DEFAULT_WINDOW;
+    const requestTimeout = requestTimeoutSeconds(manifest.backend) * 1000;
     return `/* Generated by synopkgland build. Edit your UI in the project's ui folder. */
 Ext.ns(${JSON.stringify(ns)});
 
-${ns}.call = function (method, params) {
+// The SDK's clientTimeout: past the backend's request deadline
+// (ctx.requestTimeout, from backend.timeout_seconds), so its request_timeout
+// reply arrives first. options.signal aborts the fetch, for a page the user leaves.
+${ns}.call = function (method, params, options, requestTimeout) {
+  var signal = options && options.signal;
+  var canceled = { code: "request_canceled", message: "The request was canceled" };
+  if (signal && signal.aborted) {
+    return Promise.reject(canceled);
+  }
   var headers = { "Content-Type": "application/json" };
   var token = SYNO.SDS.Session && SYNO.SDS.Session.SynoToken;
   if (token) {
     headers["X-SYNO-TOKEN"] = token;
   }
+  var controller = new AbortController();
+  var failure = null;
+  var stop = function (error) {
+    failure = failure || error;
+    controller.abort();
+  };
+  var leave = function () { stop(canceled); };
+  var timer = setTimeout(function () {
+    stop({ code: "request_timeout", message: "The NAS did not answer in time" });
+  }, (requestTimeout || ${requestTimeout}) + ${CLIENT_TIMEOUT_MARGIN});
+  if (signal) signal.addEventListener("abort", leave);
+  var done = function () {
+    clearTimeout(timer);
+    if (signal) signal.removeEventListener("abort", leave);
+  };
   return fetch(${JSON.stringify(cgiUrl(pkg))}, {
     method: "POST",
     credentials: "same-origin",
     headers: headers,
-    body: JSON.stringify({ method: method, params: params || {} })
+    body: JSON.stringify({ method: method, params: params || {} }),
+    signal: controller.signal
   }).then(function (response) {
     return response.json().catch(function () {
       return { success: false, error: { code: "bad_response", message: "HTTP " + response.status } };
     });
   }, function () {
-    return { success: false, error: { code: "network", message: "The NAS did not answer" } };
+    return { success: false, error: failure || { code: "network", message: "The NAS did not answer" } };
   }).then(function (body) {
+    done();
     if (body && body.success === true) {
       return body.data;
     }
@@ -173,6 +210,13 @@ ${root ? root.definitions : ""}${manifest.portal ? renderPortalDefinition(ns) :
   document.head.appendChild(js);
 };
 
+// A Portal/standalone launch is the whole page, on a phone as well: no desktop
+// minimum width, and the app lays itself out full-page.
+${ns}.fullPage = function () {
+  try { return typeof _S === "function" && _S("standalone") === true; } catch (error) { return false; }
+};
+${ns}.appIcon = ${JSON.stringify(`webman/3rdparty/${pkg}/${windowIconFile(icons, 64)}`)};
+
 // DSM reopens a window at the size it was last left at, even one saved on a
 // larger screen, and only moves a window that does not fit: keep it inside.
 ${ns}.fitDesktop = function (size) {
@@ -191,7 +235,7 @@ Ext.define(${JSON.stringify(`${ns}.MainWindow`)}, {
   extend: "SYNO.SDS.AppWindow",
   constructor: function (config) {
     this.callParent([${ns}.fitDesktop(Ext.apply({
-      width: 960, height: 640, minWidth: 700, minHeight: 420, layout: "fit",
+      width: ${size.width}, height: ${size.height}, minWidth: ${ns}.fullPage() ? ${FULL_PAGE_MIN_WIDTH} : ${size.minWidth}, minHeight: ${size.minHeight}, layout: "fit",
       ${root ? root.html : `html: '<div class="dsmapp-root" style="height:100%"></div>'`}
     }, config))]);
   },
@@ -212,6 +256,8 @@ Ext.define(${JSON.stringify(`${ns}.MainWindow`)}, {
     me.reopenHandlers = me.reopenEvents.handlers;
     var lang = "enu";
     try { if (typeof _S === "function") lang = _S("lang"); } catch (error) {}
+    var ctx = { requestTimeout: ${requestTimeout} };
+    var call = function (method, params, options) { return ${ns}.call(method, params, options, ctx.requestTimeout); };
 ${root ? root.mount : ""}    ${ns}.loadApp(function (app) {
       if (me.mountToken !== mountToken) return;
       me.mountPending = false;
@@ -221,18 +267,20 @@ ${root ? root.mount : ""}    ${ns}.loadApp(function (app) {
         me.hostAccess = ${ns}.createHost({ appWindow: me, locale: i18n.locale });
         root.lang = i18n.locale;
         try {
-          me.mounted = app.mount(root, {
+          me.mounted = app.mount(root, Ext.apply(ctx, {
           displayName: ${JSON.stringify(manifest.displayname)},
-          call: ${ns}.call,
+          call: call,
           files: {endpoint: ${JSON.stringify(cgiUrl(pkg))}, token: function () { return SYNO.SDS.Session && SYNO.SDS.Session.SynoToken; }},
           reopen: me.reopenEvents.subscribe,
           user: ${ns}.sessionUser(),${manifest.portal ? `\n          portal: ${renderPortalAccess(ns, manifest)},` : ""}
           host: me.hostAccess,
           appWindow: me,
+          fullPage: ${ns}.fullPage(),
+          appIcon: ${ns}.appIcon,
           lang: lang,
           locale: i18n.locale,
           t: i18n.t${root ? `,\n          executor: access` : ""}
-          }) || {};
+          })) || {};
         } catch (error) {
           me.hostAccess.dispose();
           me.hostAccess = null;
@@ -283,7 +331,7 @@ function renderPortalAccess(ns, manifest) {
             defaultAlias: ${JSON.stringify(manifest.portal.alias)},${portalByExecutor(manifest.os_min_ver) ? "\n            entry: true," : ""}
             isAdmin: function () { return ${ns}.sessionUser().isAdmin; },
             send: ${ns}.webApi(me),
-            call: ${ns}.call,
+            call: call,
             launch: function (app, params) { SYNO.SDS.AppLaunch(app, params); },
             location: window.location,
             locale: ${ns}.createI18n(lang, ${JSON.stringify(Object.fromEntries(Object.keys(DSM_LANGS).map((locale) => [locale, {}])))}).locale
@@ -315,6 +363,9 @@ const ROOT_PANEL_CSS = [
     ".dsmapp-rootpanel-actions button{margin-right:8px;padding:4px 14px}",
     ".dsmapp-rootpanel-primary{background:#057feb;color:#fff;border:1px solid #057feb;border-radius:3px}",
     ".dsmapp-rootpanel-hint{color:#526070;font-size:12px}.dsmapp-rootpanel [hidden]{display:none}",
+    // The panels keep their height; the App root fills the rest of the window body, as without root operations.
+    ".dsmapp-rootwindow{display:flex;flex-direction:column;height:100%}",
+    ".dsmapp-rootwindow>.dsmapp-rootpanels{flex:none}.dsmapp-rootwindow>.dsmapp-root{flex:1 1 0;min-height:0}",
 ].join("");
 /**
  * A Vue app approves in the SDK's ExecutorSettings, which also carries an
@@ -326,7 +377,7 @@ function settingsOnlyApproval(manifest) {
 /**
  * The capabilities.rootOps: true additions to the window: the exact tasks and panel
  * text, the access runtime wired to DSM's own password confirmation and the
- * AppWindow's WebAPI channel, and the panel above the app.
+ * AppWindow's WebAPI channel, and the panel above the app, which fills the rest.
  */
 function renderRootParts(ns, manifest) {
     return {
@@ -346,7 +397,7 @@ ${PASSWORD_CONFIRM}
 
 `,
         html: `autoScroll: true,
-      html: '<style>${ROOT_PANEL_CSS}</style><div class="dsmapp-rootpanels"></div><div class="dsmapp-root"></div>'`,
+      html: '<style>${ROOT_PANEL_CSS}</style><div class="dsmapp-rootwindow"><div class="dsmapp-rootpanels"></div><div class="dsmapp-root"></div></div>'`,
         mount: `    var session = function () {
       var current = SYNO.SDS.Session || {};
       return { name: current.user, admin: current.is_admin === true };
@@ -357,7 +408,7 @@ ${PASSWORD_CONFIRM}
       user: session,
       send: ${ns}.webApi(me),
       confirmPassword: ${ns}.createPasswordConfirm(me),
-      call: ${ns}.call,
+      call: call,
       wait: function (ms) { return new Promise(function (resolve) { setTimeout(resolve, ms); }); }
     });
 ${settingsOnlyApproval(manifest) ? "" : `    var panels = me.body && me.body.dom.querySelector(".dsmapp-rootpanels");

package/dist/standalone/i18n.js

@@ -23,15 +23,15 @@ export function readInfoTranslations(value, check) {
         return {};
     }
     if (!isRecord(value)) {
-        return check.invalid("必須以語言為 key，例如 zh-TW: { displayname, description }。");
+        return check.invalid("It must be keyed by language, for example zh-TW: { displayname, description }.");
     }
     const info = {};
     for (const [locale, text] of Object.entries(value)) {
         if (!isLocale(locale) || locale === "en") {
-            return check.invalid(`的「${locale}」不是支援的翻譯語言；英文寫在頂層 displayname / description。`);
+            return check.invalid(`"${locale}" is not a supported translation language; English goes in the top-level displayname / description.`);
         }
         if (!isRecord(text) || Object.keys(text).some((key) => !INFO_TEXT_FIELDS.has(key))) {
-            return check.invalid(`.${locale} 只接受 displayname 與 description。`);
+            return check.invalid(`.${locale} accepts only displayname and description.`);
         }
         const entry = {};
         for (const field of INFO_TEXT_FIELDS) {
@@ -66,14 +66,14 @@ function readCatalog(file, locale) {
         raw = JSON.parse(readFileSync(file, "utf8"));
     }
     catch (error) {
-        return invalid(`不是合法的 JSON：${String(error)}`);
+        return invalid(`is not valid JSON: ${String(error)}`);
     }
     if (!isRecord(raw)) {
-        return invalid("必須是 { \"key\": \"text\" } 的 JSON 物件。");
+        return invalid("It must be a { \"key\": \"text\" } JSON object.");
     }
     for (const [key, text] of Object.entries(raw)) {
         if (!MESSAGE_KEY.test(key) || typeof text !== "string") {
-            return invalid(`的「${key}」必須是點分隔的 key（例如 greeting.save）對應一段文字。`);
+            return invalid(`"${key}" must be a dot-separated key (for example greeting.save) mapped to a text.`);
         }
     }
     return { catalog: raw };
@@ -88,7 +88,7 @@ export function loadCatalogs(dir) {
         if (!isLocale(locale)) {
             errors.push({
                 code: "STANDALONE_I18N_LOCALE_UNSUPPORTED",
-                message: `${name}：只支援 ${LOCALES.join(", ")}；其他 DSM 語言會顯示英文。`,
+                message: `${name}: only ${LOCALES.join(", ")} are supported; every other DSM language shows English.`,
             });
             continue;
         }
@@ -103,7 +103,7 @@ export function loadCatalogs(dir) {
     const en = catalogs.en;
     if (!en) {
         if (!errors.some((e) => e.code === "STANDALONE_I18N_CATALOG_INVALID")) {
-            errors.push({ code: "STANDALONE_I18N_MESSAGES_MISSING", message: `${dir} 缺少 en.json（所有語言的後備文字）。` });
+            errors.push({ code: "STANDALONE_I18N_MESSAGES_MISSING", message: `${dir} is missing en.json (the fallback text for every language).` });
         }
         return { ok: false, errors };
     }
@@ -117,30 +117,30 @@ function compareWithEnglish(locale, catalog, en) {
     const extra = Object.keys(catalog).filter((key) => !(key in en));
     if (missing.length > 0 || extra.length > 0) {
         const parts = [
-            missing.length > 0 ? `缺少 ${missing.join(", ")}` : "",
-            extra.length > 0 ? `多出 ${extra.join(", ")}` : "",
+            missing.length > 0 ? `missing ${missing.join(", ")}` : "",
+            extra.length > 0 ? `extra ${extra.join(", ")}` : "",
         ].filter(Boolean);
-        return [{ code: "STANDALONE_I18N_KEYS_MISMATCH", message: `${locale}.json 與 en.json 的 key 不同：${parts.join("；")}。` }];
+        return [{ code: "STANDALONE_I18N_KEYS_MISMATCH", message: `${locale}.json keys differ from en.json: ${parts.join("; ")}.` }];
     }
     const drifted = Object.keys(en).filter((key) => placeholders(catalog[key]) !== placeholders(en[key]));
     return drifted.length === 0
         ? []
         : [{
                 code: "STANDALONE_I18N_PLACEHOLDER_MISMATCH",
-                message: `${locale}.json 的 ${drifted.join(", ")} 與 en.json 的 {placeholder} 不一致。`,
+                message: `${locale}.json has ${drifted.join(", ")} with placeholders that differ from en.json.`,
             }];
 }
 function readGlossary(file) {
-    const invalid = (why) => ({ code: "STANDALONE_I18N_GLOSSARY_INVALID", message: `${file}：${why}` });
+    const invalid = (why) => ({ code: "STANDALONE_I18N_GLOSSARY_INVALID", message: `${file}: ${why}` });
     let raw;
     try {
         raw = JSON.parse(readFileSync(file, "utf8"));
     }
     catch (error) {
-        return invalid(`不是合法的 JSON：${String(error)}`);
+        return invalid(`is not valid JSON: ${String(error)}`);
     }
     if (!isRecord(raw) || !Array.isArray(raw.terms)) {
-        return invalid("必須是 { \"terms\": [...] }。");
+        return invalid("It must be { \"terms\": [...] }.");
     }
     const terms = [];
     for (const term of raw.terms) {
@@ -150,7 +150,7 @@ function readGlossary(file) {
             && Object.entries(term.text).every(([locale, text]) => isLocale(locale) && typeof text === "string" && text !== "")
             && (term.keys === undefined || (Array.isArray(term.keys) && term.keys.every((key) => typeof key === "string")));
         if (!ok) {
-            return invalid(`term ${isRecord(term) ? JSON.stringify(term.id) : "?"} 需要 id、以支援語言為 key 的 text，以及選填的 keys 清單。`);
+            return invalid(`term ${isRecord(term) ? JSON.stringify(term.id) : "?"} needs id, text keyed by a supported language, and an optional keys list.`);
         }
         terms.push({ id: term.id, text: term.text, keys: term.keys ?? [] });
     }
@@ -173,7 +173,7 @@ export function checkGlossary(file, catalogs) {
     for (const term of terms) {
         for (const key of term.keys) {
             if (!(key in catalogs.en)) {
-                errors.push({ code: "STANDALONE_I18N_GLOSSARY_INVALID", message: `glossary term ${term.id} 指向不存在的 key ${key}。` });
+                errors.push({ code: "STANDALONE_I18N_GLOSSARY_INVALID", message: `glossary term ${term.id} points at a key that does not exist: ${key}.` });
                 continue;
             }
             for (const [locale, catalog] of Object.entries(catalogs)) {
@@ -181,7 +181,7 @@ export function checkGlossary(file, catalogs) {
                 if (official !== undefined && !containsTerm(catalog[key], official, locale)) {
                     errors.push({
                         code: "STANDALONE_I18N_GLOSSARY_MISMATCH",
-                        message: `${locale}.json 的 ${key}「${catalog[key]}」沒有使用 Synology 用語「${official}」（glossary term ${term.id}）。`,
+                        message: `${locale}.json ${key} "${catalog[key]}" does not use the Synology term "${official}" (glossary term ${term.id}).`,
                     });
                 }
             }

package/dist/standalone/inspect-bridge.d.ts

@@ -0,0 +1,31 @@
+type Payload = Array<{
+    path: string;
+    mode: string;
+}>;
+export interface BridgeJson {
+    runtime?: string;
+    entry?: string;
+    methods?: string[];
+    node?: {
+        package?: string;
+    };
+    capabilities?: {
+        root?: boolean;
+        delegate?: {
+            executor_digest?: string;
+            policy_digest?: string;
+        };
+    };
+}
+/**
+ * A Python, Node or Rust App: the runtime CGI binds bridge.json and
+ * permissions.json by digest, the App lives in target/app (never under ui/),
+ * and its entry, SDK and dependencies are in the package.
+ */
+export declare function checkBridgeApp(dir: string, backend: string, info: Record<string, string>, payload: Payload, findings: string[]): Promise<BridgeJson | undefined>;
+/** root and delegate reach the package's executor; delegate pins the one this SPK ships. */
+export declare function checkBridgeExecutor(bridge: BridgeJson, executor: {
+    executorDigest: string;
+    policyDigest: string;
+} | undefined, findings: string[]): void;
+export {};