@synopackageland/templates 0.15.2 → 0.17.0

package/README.md

@@ -38,12 +38,12 @@ calls each one from the generated script of the same name (`synopkgland skill sh
 The placeholders `__PACKAGE__` (also the Go module path), `__DISPLAY_NAME__` and
 `__BACKGROUND_ENABLED__` are substituted by `init`.
 
-`backend/go.mod` requires `github.com/synopackageland/syno-pkg-land-sdk v0.15.2`; that line is
+`backend/go.mod` requires `github.com/synopackageland/syno-pkg-land-sdk v0.17.0`; that line is
 the single source of the SDK version and `frontend/package.json` pins
 `@synopackageland/sdk` to the same version. Python and Node.js name it in
 `backend.sdk`, Rust in the `syno-pkg-land-app` tag of `backend/Cargo.toml`
-(and `Cargo.lock`); all of them pin 0.15.2. The Vue frontend pins
-`@synopackageland/ui` 0.12.0. SDK 0.15.2 accepts UI `>=0.10.1 <0.13.0`,
+(and `Cargo.lock`); all of them pin 0.17.0. The Vue frontend pins
+`@synopackageland/ui` 0.12.0. SDK 0.17.0 accepts UI `>=0.10.1 <0.13.0`,
 so no UI peer override is needed. Tests use jsdom 30 for UI floating-layer styles.
 
 ## Notice writer
@@ -149,3 +149,9 @@ The CLI preserves upstream bytes and the SDK planner generates an override and o
 ## AI commands
 
 All four native templates explicitly declare status and greeting commands in `ctl.commands`. Build packages a private `synopkgland-api.json`; only the authenticated SDK description endpoint returns it. Internal routes are not automatically commands. Read `synopkgland skill show ctl` before adding command schemas or workflow bindings.
+
+The Vue scaffold batches independent startup status/greeting reads when the
+window already identifies an administrator and supplies `ctx.batch`. Rebuild
+with the current CLI and SDK to get that client. Older generated contexts keep
+the single-call path. Each batch result is handled separately; the shell stays
+visible while reads run. The backend permissions remain authoritative.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@synopackageland/templates",
-  "version": "0.15.2",
+  "version": "0.17.0",
   "description": "Project templates for synopkgland init: native-go, native-python, native-node and native-rust (plain or Vue, with jobs, delegate and root-ops overlays), binary and compose.",
   "license": "MIT",
   "repository": {"type": "git", "url": "git+https://github.com/synopackageland/syno-pkg-land-templates.git"},

package/templates/_shared/AGENTS.md

@@ -62,26 +62,30 @@ call `greeting.set`.
 
 ## DSM Application Portal (`portal`)
 
-Only an App with the root executor (`rootOps` or `delegate`) may declare a
-portal: its uninstall then reloads nginx so the alias stops answering, which a
-no-privilege App cannot do without root. `synopkgland add portal` (with
-`root-ops` or `delegate` in the same call or already declared; or `portal: {}` /
-`portal: {alias: my-app}` in dsm-package.yaml) registers
-`https://<nas>/<alias>/`, which opens the app after DSM sign-in. Compose Apps
-cannot declare a portal. Read `synopkgland skill show portal` before changing it.
-The install wizard only proposes the alias; an administrator activates it from
-the app's portal panel (`ctx.portal`, DSM's own `SYNO.Core.AppPortal` in the
-admin's session) or Control Panel > Login Portal > Applications. Ordinary users
-get the link from the backend's read-only `portal.status`, else "ask an
-administrator". Never write `AppPortal.json` or `@appconf/<package>`, never add
-a backend route that sets the alias, and never relay QuickConnect responses or
-build QuickConnect links. A portal needs os_min_ver 7.1-42661 or later, and
-`add portal` raises a lower one. Below DSM 7.2 the executor registers the
-entry: there is no alias wizard step, and an administrator enables the entry
-from the portal panel (`ctx.portal.register()`), which the executor's approved
-`portal.register` operation carries out. From 7.2 the SPK registers it as a
-DSM resource. Beyond that, support is detected (SYNO.API.Info), not
-version-gated.
+From DSM 7.2-64570, Apps can declare `portal` without an executor. DSM's
+web-config resource registers the entry, and INFO
+`instuninst_restart_services="nginx.service"` asks DSM to reload nginx after
+install, upgrade and uninstall. The reload is asynchronous; package hooks stay
+unprivileged and never reload nginx themselves. Schema-2 Compose/gateway Apps
+may also use a top-level `portal`; legacy `integration.web.portal` is unsupported.
+
+`synopkgland add portal` adds `portal: {}` (or set
+`portal: {alias: my-app}` in dsm-package.yaml). Without an executor, set
+`os_min_ver` to 7.2-64570 or later before adding Portal; the command refuses a
+lower target and never raises it silently. With an executor, a portal needs
+`os_min_ver` 7.1-42661 or later. Below DSM 7.2 the executor registers the entry:
+DSM 7.1 rejects the unsigned web-config worker, there is no alias wizard step,
+and an administrator enables it through `ctx.portal.register()` after executor
+approval. From DSM 7.2, the SPK registers it as a DSM resource.
+
+Read `synopkgland skill show portal` before changing it. The install wizard only
+proposes the alias; an administrator activates it in the App's portal panel
+(`ctx.portal`, DSM's own `SYNO.Core.AppPortal` in the admin session) or Control
+Panel > Login Portal > Applications. Other signed-in users get the link from
+read-only `portal.status`, else "ask an administrator". Never write
+`AppPortal.json` or `@appconf/<package>`, never add a backend route that sets
+the alias, and never relay QuickConnect responses or build QuickConnect links.
+Beyond the packaging floor, support is detected with SYNO.API.Info.
 
 ### Login page look (`login_style`)
 
@@ -234,8 +238,9 @@ sweep forward the cancel instead of admitting it.
   repeats the original request on repeated IDs. Review it in the SDK's delegate
   package to adapt a real producer; show Saved only from a protected committed
   receipt.
-- Wizard support is measured on vt-nas DSM 7.4 via a session-only SSH local
-  forward. This is not proof of other DSM releases or full writer/reboot behavior.
+- Verify the wizard on your own DSM release over an SSH local forward. The
+  template ships the wizard contract; it is not proof of every DSM release or of
+  full writer/reboot behavior.
 
 ## Go backend
 

package/templates/compose/dsm-package.yaml

@@ -14,7 +14,7 @@ compose:
   web: {service: web, port: 8080, health: {path: /, status: 200}}
   network: {egress: isolated}
 identity_gateway:
-  sdk: 0.15.2
+  sdk: 0.17.0
   mode: none
   listen: {http: 28000}
 # Web Apps default to new-page through the shared app-launch resolver.

package/templates/native-go/README.md

@@ -297,23 +297,21 @@ refusal for unknown methods.
 
 ## DSM Application Portal link
 
-Only an App with the root executor (`rootOps` or `delegate`) can declare a
-portal; `synopkgland add root-ops portal` declares both. Uninstall then
-removes the App's Application Privileges rules and reloads nginx once DSM has
-removed the alias, so it stops answering. `synopkgland add portal` adds
-`portal: {}` to dsm-package.yaml so
-`https://<nas>/<alias>/` opens this app right after DSM sign-in. The install
-wizard proposes the alias (the package name in lowercase by default); an
-administrator turns it on from the app's portal panel or Control Panel >
-Login Portal > Applications. Ordinary users then see the link; until then
-they see "ask an administrator". DSM owns the setting: the backend's
-`portal.status` only reads it, and nothing in the package may write it. See
-`synopkgland skill show portal`.
-
-A portal needs DSM 7.3.2-86009 or later, so `add portal` raises a lower
-`os_min_ver` and build refuses one below it. DSM 7.1.1 rejects an unsigned
-package that registers a portal (Package Center error 320); 7.3.2 and 7.4
-install it; 7.2 is untested. To keep supporting older DSM, remove `portal:`.
+From DSM 7.2-64570, an App can declare `portal` without an executor. Set
+`os_min_ver` to that floor or later before `synopkgland add portal`; the command
+refuses a lower no-privilege target instead of silently raising it. The command
+adds `portal: {}` so `https://<nas>/<alias>/` opens the App after DSM sign-in.
+The install wizard proposes the alias; an administrator applies it in the App
+panel or Control Panel > Login Portal > Applications. Other users see the link
+or "ask an administrator". DSM owns the setting; `portal.status` only reads it.
+
+Every Portal SPK asks DSM to reload nginx through INFO
+`instuninst_restart_services="nginx.service"` after install, upgrade and
+uninstall. The reload is asynchronous; package hooks stay unprivileged.
+DSM 7.1-42661 still needs an approved executor to register the entry, since its
+web-config worker rejects unsigned packages. For that route, declare an
+executor capability, for example `synopkgland add root-ops portal`. See
+`synopkgland skill show portal` before changing Portal settings.
 
 The build also gives the portal a login page look: a neutral default
 wallpaper (its thumbnail is what Control Panel > Login Portal > Applications
@@ -378,6 +376,21 @@ account or other packages. An upgrade never deletes anything. Do not write your
 `synopkgland inspect` flags a deleting script that lacks the upgrade guard
 or deletes outside the package's own folders.
 
+## Shared Folder access
+
+A `install.sharedFolder` in `dsm-package.yaml` lets the administrator pick a folder in the
+install wizard, but DSM does not give the package account access to a picked folder. The
+backend reports the real state: the `sharedfolder.status` operation (administrators only
+unless you change `permissions.json`) returns each folder with what the App needs, what the
+package account has (`none`, `read`, `write`) and a `state` (`ready`, `pending`, `missing`,
+`ambiguous`). `cfg.SharedFolderPath(key)` returns the path or an error that names the
+Control Panel step instead of failing on a file read. Keep `SharedFolderRequired` in
+`cmd/app/main.go` equal to the permission in `dsm-package.yaml`. Set `StorageAdapter` to
+apply a changed path (a re-picked folder, a moved volume) once; it runs only after access is
+granted. The Vue template shows the `SharedFolderSettings` section, which offers
+**Grant access** to an administrator and otherwise explains the Control Panel steps. See the
+SDK's `docs/shared-folder.md` for the whole flow.
+
 ## Support matrix
 
 | | Status |

package/templates/native-go/backend/THIRD_PARTY_NOTICES.txt

@@ -1,6 +1,6 @@
 Native Go package build dependencies
 
-github.com/synopackageland/syno-pkg-land-sdk v0.15.2 (MIT)
+github.com/synopackageland/syno-pkg-land-sdk v0.17.0 (MIT)
 
 Copyright (c) 2026 synopkgland
 

package/templates/native-go/backend/cmd/app/main.go

@@ -20,6 +20,7 @@ import (
 	"github.com/synopackageland/syno-pkg-land-sdk/dsm"
 	"github.com/synopackageland/syno-pkg-land-sdk/filestation"
 	standaloneidentity "github.com/synopackageland/syno-pkg-land-sdk/identity"
+	"github.com/synopackageland/syno-pkg-land-sdk/sharedfolder"
 
 	appapi "__PACKAGE__/internal/api"
 	"__PACKAGE__/internal/app"
@@ -100,6 +101,9 @@ func main() {
 		DataDir:        "/var/packages/" + packageID + "/var",
 		Portal:         portal != "",
 		PortalExecutor: portal == "executor",
+		// install.sharedFolder in dsm-package.yaml: `synopkgland init --shared-folder`
+		// writes key "shared" with permission rw. Keep this equal to it.
+		SharedFolderRequired: map[string]sharedfolder.Access{"shared": sharedfolder.Write},
 	}
 	if _, err := app.ParseDelegateConfig(cfg); err != nil {
 		log.Fatal(err)

package/templates/native-go/backend/go.mod

@@ -4,6 +4,6 @@ go 1.25.0
 
 toolchain go1.26.9
 
-require github.com/synopackageland/syno-pkg-land-sdk v0.15.2
+require github.com/synopackageland/syno-pkg-land-sdk v0.17.0
 
 require golang.org/x/sys v0.44.0 // indirect

package/templates/native-go/backend/go.sum

@@ -1,4 +1,4 @@
-github.com/synopackageland/syno-pkg-land-sdk v0.15.2 h1:IeIe7pb9MnFBYKj/m5AtjCch+vgdDc7VbzQMBVSxM3A=
-github.com/synopackageland/syno-pkg-land-sdk v0.15.2/go.mod h1:msR4MhJQnVZ8NKLb0E/1K79ldZUvcOJmWhKq+gPEa+4=
+github.com/synopackageland/syno-pkg-land-sdk v0.17.0 h1:DaYDHCDlukkXtTm+3m26p7pU86r298MTasKDrV/tRl4=
+github.com/synopackageland/syno-pkg-land-sdk v0.17.0/go.mod h1:vixf5Lo4PssQDGU5zam0Mb5sFu9wPUP4Ck36BMAVbNc=
 golang.org/x/sys v0.44.0 h1:ildZl3J4uzeKP07r2F++Op7E9B29JRUy+a27EibtBTQ=
 golang.org/x/sys v0.44.0/go.mod h1:4GL1E5IUh+htKOUEOaiffhrAeqysfVGipDYzABqnCmw=

package/templates/native-go/backend/internal/app/routes.go

@@ -20,6 +20,7 @@ import (
 
 	"github.com/synopackageland/syno-pkg-land-sdk/api"
 	"github.com/synopackageland/syno-pkg-land-sdk/filestation"
+	"github.com/synopackageland/syno-pkg-land-sdk/sharedfolder"
 )
 
 // Config is fixed at build time and startup, never taken from a request.
@@ -37,6 +38,14 @@ type Config struct {
 	DataDir string
 	// VolumeRoot is where /volumeN lives; empty means "/". Tests set it.
 	VolumeRoot string
+	// SharedFolderRequired is the access each Shared Folder key needs. Keep it
+	// equal to install.sharedFolder.permission in dsm-package.yaml: ro is
+	// sharedfolder.Read, rw is sharedfolder.Write.
+	SharedFolderRequired map[string]sharedfolder.Access
+	// StorageAdapter, when set, hands a Shared Folder's path to the App's own
+	// storage settings (a Local storage, a library root): the first time the
+	// folder is ready, and again whenever its path changes. Make it idempotent.
+	StorageAdapter func(ctx context.Context, key, path string) error
 	// Portal serves portal.status; PortalExecutor adds the executor's entry
 	// below DSM 7.2. PortalConfig overrides DSM's saved AppPortal.json path in
 	// tests.
@@ -49,6 +58,7 @@ func Routes(cfg Config) []api.Route {
 	routes := cfg.delegateRoutes()
 	routes = append(routes, []api.Route{
 		api.Handle("app.status", cfg.status),
+		api.Handle("sharedfolder.status", cfg.sharedFolderStatus),
 		api.Handle("greeting.get", cfg.getGreeting),
 		api.Handle("greeting.set", cfg.setGreeting),
 	}...)
@@ -59,7 +69,7 @@ func Routes(cfg Config) []api.Route {
 }
 
 func (cfg Config) status(_ context.Context, caller api.Caller, _ json.RawMessage) (any, error) {
-	return cfg.withSharedFolders(map[string]any{
+	return map[string]any{
 		"package":    cfg.PackageID,
 		"version":    cfg.Version,
 		"user":       caller.User(),
@@ -68,7 +78,7 @@ func (cfg Config) status(_ context.Context, caller api.Caller, _ json.RawMessage
 		"go_version": runtime.Version(),
 		"platform":   runtime.GOOS + "/" + runtime.GOARCH,
 		"time":       time.Now().UTC().Format(time.RFC3339),
-	}), nil
+	}, nil
 }
 
 type greeting struct {

package/templates/native-go/backend/internal/app/routes_test.go

@@ -107,9 +107,10 @@ var (
 var sampleOutcome = map[string]string{}
 
 var sampleParams = map[string]string{
-	"app.status":   `{}`,
-	"greeting.get": `{}`,
-	"greeting.set": `{"text":"Hi"}`,
+	"app.status":          `{}`,
+	"sharedfolder.status": `{}`,
+	"greeting.get":        `{}`,
+	"greeting.set":        `{"text":"Hi"}`,
 }
 
 func TestEveryRouteHasSampleParamsAndNoneIsPublic(t *testing.T) {

package/templates/native-go/backend/internal/app/shared_folder.go

@@ -1,144 +1,54 @@
 package app
 
 import (
+	"context"
 	"encoding/json"
-	"errors"
-	"fmt"
-	"io/fs"
-	"os"
-	"path/filepath"
-	"sort"
-	"strings"
-	"syscall"
-)
-
-// The install wizard stores the chosen Shared Folder's *name* in
-// <DataDir>/config.json (see dsm-package.yaml install.sharedFolder). The path
-// is resolved on every call, so a Shared Folder moved to another volume keeps
-// working. config.json is written by the package's postinst/postupgrade, not
-// by the app.
 
-var (
-	ErrSharedFolderNotFound  = errors.New("shared folder not found on any volume")
-	ErrSharedFolderAmbiguous = errors.New("shared folder name matches more than one volume")
+	"github.com/synopackageland/syno-pkg-land-sdk/api"
+	"github.com/synopackageland/syno-pkg-land-sdk/sharedfolder"
 )
 
-// SharedFolder says where one configured Shared Folder is right now and what
-// the package account may do there.
-type SharedFolder struct {
-	Key      string `json:"key"`
-	Name     string `json:"name"`
-	Path     string `json:"path,omitempty"`
-	Exists   bool   `json:"exists"`
-	Readable bool   `json:"readable"`
-	Writable bool   `json:"writable"`
-	Error    string `json:"error,omitempty"`
-}
-
-func validShareName(name string) bool {
-	return name != "" && !strings.ContainsAny(name, "/\\\x00") && !strings.Contains(name, "..") &&
-		!strings.HasPrefix(name, "@") && !strings.HasPrefix(name, ".")
-}
-
-// ReadSharedFolders returns the Shared Folder names the installer stored, by
-// key. A package without config.json has none.
-func ReadSharedFolders(dataDir string) (map[string]string, error) {
-	data, err := os.ReadFile(filepath.Join(dataDir, "config.json"))
-	if errors.Is(err, fs.ErrNotExist) {
-		return nil, nil
-	}
-	if err != nil {
-		return nil, err
-	}
-	var cfg struct {
-		Schema        int               `json:"schema"`
-		SharedFolders map[string]string `json:"shared_folders"`
-	}
-	if err := json.Unmarshal(data, &cfg); err != nil {
-		return nil, fmt.Errorf("config.json: %w", err)
-	}
-	if cfg.Schema != 1 {
-		return nil, fmt.Errorf("config.json: unsupported schema %d", cfg.Schema)
-	}
-	for key, name := range cfg.SharedFolders {
-		if !validShareName(name) {
-			return nil, fmt.Errorf("config.json: invalid shared folder name for %q", key)
-		}
-	}
-	return cfg.SharedFolders, nil
-}
-
-// ResolveSharedFolder finds /volumeN/<name> under root ("/" on a NAS).
-func ResolveSharedFolder(root, name string) (string, error) {
-	if !validShareName(name) {
-		return "", fmt.Errorf("invalid shared folder name %q", name)
-	}
-	volumes, err := filepath.Glob(filepath.Join(root, "volume[0-9]*"))
-	if err != nil {
-		return "", err
-	}
-	var found []string
-	for _, volume := range volumes {
-		path := filepath.Join(volume, name)
-		if info, err := os.Stat(path); err == nil && info.IsDir() {
-			found = append(found, path)
-		}
-	}
-	switch len(found) {
-	case 0:
-		return "", ErrSharedFolderNotFound
-	case 1:
-		return found[0], nil
-	}
-	return "", ErrSharedFolderAmbiguous
+// The install wizard stores the chosen Shared Folder's *name* in
+// <DataDir>/config.json (see dsm-package.yaml install.sharedFolder). DSM does
+// not give the package account access to a folder chosen at install time: an
+// administrator grants it in Control Panel (or with one click in the settings
+// page). The SDK's sharedfolder package measures what the account may do, so
+// this route, the settings page and any daemon read one state.
+
+// sharedFolders is the SDK's view of this package's Shared Folders.
+func (cfg Config) sharedFolders() sharedfolder.Config {
+	return sharedfolder.Config{DataDir: cfg.DataDir, Root: cfg.VolumeRoot, Required: cfg.SharedFolderRequired}
 }
 
-const (
-	accessRead  = 0x4 // R_OK
-	accessWrite = 0x2 // W_OK
-	accessExec  = 0x1 // X_OK
-)
-
-// SharedFolders reports every configured Shared Folder, sorted by key. The
-// error is a corrupt config.json.
-func (cfg Config) SharedFolders() ([]SharedFolder, error) {
-	names, err := ReadSharedFolders(cfg.DataDir)
+// sharedFolderStatus answers the settings page: each folder, what the package
+// account has and what the App declared it needs, and whether an
+// administrator still has to grant. Administrators only, as the default
+// permissions say; list the method in internal/api/permissions.json to let
+// every DSM user read it.
+func (cfg Config) sharedFolderStatus(ctx context.Context, _ api.Caller, _ json.RawMessage) (any, error) {
+	status, err := cfg.sharedFolders().Status()
 	if err != nil {
 		return nil, err
 	}
-	root := cfg.VolumeRoot
-	if root == "" {
-		root = "/"
-	}
-	keys := make([]string, 0, len(names))
-	for key := range names {
-		keys = append(keys, key)
-	}
-	sort.Strings(keys)
-	folders := make([]SharedFolder, 0, len(keys))
-	for _, key := range keys {
-		folder := SharedFolder{Key: key, Name: names[key]}
-		path, err := ResolveSharedFolder(root, folder.Name)
-		if err != nil {
-			folder.Error = err.Error()
-		} else {
-			folder.Path, folder.Exists = path, true
-			folder.Readable = syscall.Access(path, accessRead|accessExec) == nil
-			folder.Writable = syscall.Access(path, accessWrite|accessExec) == nil
+	// The App's own storage follows a changed path (another folder chosen,
+	// the share moved to another volume) here, the first time anything reads it.
+	if cfg.StorageAdapter != nil {
+		for _, folder := range status.Folders {
+			if folder.State == sharedfolder.Ready {
+				if _, err := cfg.sharedFolders().Sync(folder.Key, func(path string) error {
+					return cfg.StorageAdapter(ctx, folder.Key, path)
+				}); err != nil {
+					return nil, sharedfolder.APIError(err)
+				}
+			}
 		}
-		folders = append(folders, folder)
 	}
-	return folders, nil
+	return status, nil
 }
 
-// withSharedFolders adds the configured Shared Folders to an app.status
-// answer; a package that configures none is answered exactly as before.
-func (cfg Config) withSharedFolders(status map[string]any) map[string]any {
-	folders, err := cfg.SharedFolders()
-	if err != nil {
-		status["shared_folders_error"] = err.Error()
-	} else if len(folders) > 0 {
-		status["shared_folders"] = folders
-	}
-	return status
+// SharedFolderPath is what a daemon calls before it touches the folder: the
+// path once the account has the declared access, otherwise an error naming
+// what to grant, never a failed file read.
+func (cfg Config) SharedFolderPath(key string) (string, error) {
+	return cfg.sharedFolders().Require(key)
 }

package/templates/native-go/backend/internal/app/shared_folder_test.go

@@ -1,10 +1,13 @@
 package app
 
 import (
+	"context"
 	"errors"
 	"os"
 	"path/filepath"
 	"testing"
+
+	"github.com/synopackageland/syno-pkg-land-sdk/sharedfolder"
 )
 
 func writeConfig(t *testing.T, dir, body string) {
@@ -14,145 +17,129 @@ func writeConfig(t *testing.T, dir, body string) {
 	}
 }
 
-func TestReadSharedFoldersWithoutConfigIsEmpty(t *testing.T) {
-	got, err := ReadSharedFolders(t.TempDir())
-	if err != nil || len(got) != 0 {
-		t.Fatalf("got %v %v", got, err)
+// sharedFixture has /volume1/Photos with the mode, chosen for key "media".
+func sharedFixture(t *testing.T, mode os.FileMode) Config {
+	t.Helper()
+	cfg := testConfig(t)
+	cfg.VolumeRoot = t.TempDir()
+	dir := filepath.Join(cfg.VolumeRoot, "volume1", "Photos")
+	if err := os.MkdirAll(dir, 0o755); err != nil {
+		t.Fatal(err)
 	}
+	if err := os.Chmod(dir, mode); err != nil {
+		t.Fatal(err)
+	}
+	t.Cleanup(func() { os.Chmod(dir, 0o755) })
+	writeConfig(t, cfg.DataDir, `{"schema":1,"shared_folders":{"media":"Photos"}}`)
+	cfg.SharedFolderRequired = map[string]sharedfolder.Access{"media": sharedfolder.Write}
+	return cfg
 }
 
-func TestReadSharedFoldersReturnsNamesByKey(t *testing.T) {
-	dir := t.TempDir()
-	writeConfig(t, dir, `{"schema":1,"shared_folders":{"media":"Family Photos"}}`)
-	got, err := ReadSharedFolders(dir)
-	if err != nil || got["media"] != "Family Photos" || len(got) != 1 {
-		t.Fatalf("got %v %v", got, err)
+func skipRoot(t *testing.T) {
+	t.Helper()
+	if os.Geteuid() == 0 {
+		t.Skip("root ignores directory modes")
 	}
 }
 
-func TestReadSharedFoldersRefusesUnknownSchemaAndBadNames(t *testing.T) {
-	for _, body := range []string{
-		`{"schema":2,"shared_folders":{"media":"x"}}`,
-		`{"schema":1,"shared_folders":{"media":"a/b"}}`,
-		`{"schema":1,"shared_folders":{"media":".."}}`,
-		`{"schema":1,"shared_folders":{"media":"@appdata"}}`,
-		`{"schema":1,"shared_folders":{"media":""}}`,
-		`not json`,
-	} {
-		dir := t.TempDir()
-		writeConfig(t, dir, body)
-		if _, err := ReadSharedFolders(dir); err == nil {
-			t.Errorf("%s: want an error", body)
-		}
+func TestSharedFolderStatusIsEmptyWithoutAFolder(t *testing.T) {
+	code, out := call(t, testConfig(t), alice, "sharedfolder.status", `{}`)
+	if code != "" || len(out["data"].(map[string]any)["folders"].([]any)) != 0 {
+		t.Fatalf("%q %v", code, out)
 	}
 }
 
-func TestResolveSharedFolderFindsTheNameOnItsVolume(t *testing.T) {
-	root := t.TempDir()
-	for _, d := range []string{"volume1/other", "volume2/Photos", "volume2/@appdata"} {
-		if err := os.MkdirAll(filepath.Join(root, d), 0o755); err != nil {
-			t.Fatal(err)
+func TestSharedFolderStatusReportsGrantedAndPending(t *testing.T) {
+	skipRoot(t)
+	for _, c := range []struct {
+		mode  os.FileMode
+		state string
+	}{{0o755, "ready"}, {0o555, "pending"}} {
+		cfg := sharedFixture(t, c.mode)
+		code, out := call(t, cfg, alice, "sharedfolder.status", `{}`)
+		if code != "" {
+			t.Fatalf("%q %v", code, out)
+		}
+		row := out["data"].(map[string]any)["folders"].([]any)[0].(map[string]any)
+		if row["state"] != c.state || row["required"] != "write" || row["name"] != "Photos" || row["path"] != filepath.Join(cfg.VolumeRoot, "volume1", "Photos") {
+			t.Fatalf("mode %o: %v", c.mode, row)
 		}
-	}
-	got, err := ResolveSharedFolder(root, "Photos")
-	if err != nil || got != filepath.Join(root, "volume2", "Photos") {
-		t.Fatalf("got %q %v", got, err)
 	}
 }
 
-func TestResolveSharedFolderFollowsAMovedShare(t *testing.T) {
-	root := t.TempDir()
-	os.MkdirAll(filepath.Join(root, "volume1", "Photos"), 0o755)
-	first, _ := ResolveSharedFolder(root, "Photos")
-	os.Rename(filepath.Join(root, "volume1", "Photos"), filepath.Join(root, "Photos.tmp"))
-	os.MkdirAll(filepath.Join(root, "volume2"), 0o755)
-	os.Rename(filepath.Join(root, "Photos.tmp"), filepath.Join(root, "volume2", "Photos"))
-	second, err := ResolveSharedFolder(root, "Photos")
-	if err != nil || first == second || second != filepath.Join(root, "volume2", "Photos") {
-		t.Fatalf("%q -> %q %v", first, second, err)
+func TestSharedFolderStatusIsAdministratorOnlyByDefault(t *testing.T) {
+	cfg := sharedFixture(t, 0o755)
+	if code, _ := call(t, cfg, bob, "sharedfolder.status", `{}`); code == "" {
+		t.Fatal("a non-administrator read the status")
 	}
 }
 
-func TestResolveSharedFolderErrors(t *testing.T) {
-	root := t.TempDir()
-	if _, err := ResolveSharedFolder(root, "Missing"); !errors.Is(err, ErrSharedFolderNotFound) {
-		t.Fatalf("missing: %v", err)
-	}
-	os.MkdirAll(filepath.Join(root, "volume1", "Dup"), 0o755)
-	os.MkdirAll(filepath.Join(root, "volume2", "Dup"), 0o755)
-	if _, err := ResolveSharedFolder(root, "Dup"); !errors.Is(err, ErrSharedFolderAmbiguous) {
-		t.Fatalf("ambiguous: %v", err)
-	}
-	for _, bad := range []string{"", "..", "a/b", "@appdata", ".x"} {
-		if _, err := ResolveSharedFolder(root, bad); err == nil {
-			t.Errorf("%q: want an error", bad)
-		}
+func TestAppStatusNoLongerCarriesSharedFolders(t *testing.T) {
+	cfg := sharedFixture(t, 0o755)
+	_, out := call(t, cfg, alice, "app.status", `{}`)
+	data := out["data"].(map[string]any)
+	if _, present := data["shared_folders"]; present {
+		t.Fatalf("app.status: %v", data)
 	}
 }
 
-func TestResolveSharedFolderIgnoresAFileOfThatName(t *testing.T) {
-	root := t.TempDir()
-	os.MkdirAll(filepath.Join(root, "volume1"), 0o755)
-	os.WriteFile(filepath.Join(root, "volume1", "Notes"), nil, 0o644)
-	if _, err := ResolveSharedFolder(root, "Notes"); !errors.Is(err, ErrSharedFolderNotFound) {
-		t.Fatalf("got %v", err)
+func TestSharedFolderStatusFailsOnACorruptConfig(t *testing.T) {
+	cfg := testConfig(t)
+	writeConfig(t, cfg.DataDir, `not json`)
+	if code, _ := call(t, cfg, alice, "sharedfolder.status", `{}`); code != "internal" {
+		t.Fatalf("code %q", code)
 	}
 }
 
-func TestStatusOmitsSharedFoldersWhenNoneConfigured(t *testing.T) {
-	_, out := call(t, testConfig(t), alice, "app.status", `{}`)
-	if _, present := out["data"].(map[string]any)["shared_folders"]; present {
-		t.Fatalf("unexpected shared_folders: %v", out)
+func TestStorageAdapterFollowsTheChosenFolderAndAMovedShare(t *testing.T) {
+	skipRoot(t)
+	cfg := sharedFixture(t, 0o755)
+	var applied []string
+	cfg.StorageAdapter = func(_ context.Context, key, path string) error {
+		applied = append(applied, key+"="+path)
+		return nil
+	}
+	first := filepath.Join(cfg.VolumeRoot, "volume1", "Photos")
+	for i := 0; i < 2; i++ {
+		if code, _ := call(t, cfg, alice, "sharedfolder.status", `{}`); code != "" {
+			t.Fatal(code)
+		}
 	}
-}
-
-func TestStatusReportsEachConfiguredSharedFolder(t *testing.T) {
-	cfg := testConfig(t)
-	cfg.VolumeRoot = t.TempDir()
-	os.MkdirAll(filepath.Join(cfg.VolumeRoot, "volume1", "Photos"), 0o755)
-	writeConfig(t, cfg.DataDir, `{"schema":1,"shared_folders":{"media":"Photos","gone":"Missing"}}`)
-	_, out := call(t, cfg, alice, "app.status", `{}`)
-	rows := out["data"].(map[string]any)["shared_folders"].([]any)
-	if len(rows) != 2 {
-		t.Fatalf("rows: %v", rows)
+	if len(applied) != 1 || applied[0] != "media="+first {
+		t.Fatalf("first reads apply once: %v", applied)
 	}
-	byKey := map[string]map[string]any{}
-	for _, r := range rows {
-		m := r.(map[string]any)
-		byKey[m["key"].(string)] = m
+	second := filepath.Join(cfg.VolumeRoot, "volume2", "Photos")
+	if err := os.MkdirAll(filepath.Dir(second), 0o755); err != nil {
+		t.Fatal(err)
+	}
+	if err := os.Rename(first, second); err != nil {
+		t.Fatal(err)
 	}
-	media, gone := byKey["media"], byKey["gone"]
-	if media["name"] != "Photos" || media["exists"] != true || media["readable"] != true || media["writable"] != true || media["path"] != filepath.Join(cfg.VolumeRoot, "volume1", "Photos") {
-		t.Fatalf("media: %v", media)
+	if code, _ := call(t, cfg, alice, "sharedfolder.status", `{}`); code != "" {
+		t.Fatal(code)
 	}
-	if gone["exists"] != false || gone["readable"] != false || gone["writable"] != false || gone["error"] == nil || gone["path"] != nil {
-		t.Fatalf("gone: %v", gone)
+	if len(applied) != 2 || applied[1] != "media="+second {
+		t.Fatalf("a moved share applies the new path: %v", applied)
 	}
 }
 
-func TestStatusReportsAFolderThePackageAccountCannotWrite(t *testing.T) {
-	if os.Geteuid() == 0 {
-		t.Skip("root ignores directory modes")
-	}
-	cfg := testConfig(t)
-	cfg.VolumeRoot = t.TempDir()
-	dir := filepath.Join(cfg.VolumeRoot, "volume1", "Locked")
-	os.MkdirAll(dir, 0o755)
-	os.Chmod(dir, 0o555)
-	t.Cleanup(func() { os.Chmod(dir, 0o755) })
-	writeConfig(t, cfg.DataDir, `{"schema":1,"shared_folders":{"media":"Locked"}}`)
-	_, out := call(t, cfg, alice, "app.status", `{}`)
-	row := out["data"].(map[string]any)["shared_folders"].([]any)[0].(map[string]any)
-	if row["exists"] != true || row["readable"] != true || row["writable"] != false {
-		t.Fatalf("row: %v", row)
+func TestStorageAdapterWaitsForThePermission(t *testing.T) {
+	skipRoot(t)
+	cfg := sharedFixture(t, 0o555)
+	called := false
+	cfg.StorageAdapter = func(context.Context, string, string) error { called = true; return nil }
+	if code, _ := call(t, cfg, alice, "sharedfolder.status", `{}`); code != "" || called {
+		t.Fatalf("pending folder: code %q called %v", code, called)
 	}
 }
 
-func TestStatusReportsACorruptConfigWithoutFailing(t *testing.T) {
-	cfg := testConfig(t)
-	writeConfig(t, cfg.DataDir, `not json`)
-	code, out := call(t, cfg, alice, "app.status", `{}`)
-	if code != "" || out["data"].(map[string]any)["shared_folders_error"] == nil {
-		t.Fatalf("%q %v", code, out)
+func TestSharedFolderPathNamesWhatToGrant(t *testing.T) {
+	skipRoot(t)
+	_, err := sharedFixture(t, 0o555).SharedFolderPath("media")
+	if !errors.Is(err, sharedfolder.ErrPermissionPending) {
+		t.Fatalf("got %v", err)
+	}
+	if path, err := sharedFixture(t, 0o755).SharedFolderPath("media"); err != nil || path == "" {
+		t.Fatalf("%q %v", path, err)
 	}
 }

package/templates/native-go-delegate/frontend/test/capability-panels.test.ts

@@ -17,7 +17,7 @@ function render(ctx:unknown){
 }
 function button(root:HTMLElement,label:string){const b=[...root.querySelectorAll('button')].find(n=>n.textContent?.trim()===label);expect(b,label).toBeTruthy();return b!}
 test('the capability surface uses an explicit long-running facade without legacy calls',async()=>{
- const grant={id:'mine',key:'save',path:'/home/Exports',username:'normal1',lifetime:'until-revoked' as const}
+ const grant={id:'mine',key:'save',path:'/home/Exports',username:'alice',lifetime:'until-revoked' as const}
  const sdk={
   destination:vi.fn(async(key:string)=>({key,selection:{scope:'home',root:'/home',generation:0},destination:grant,status:'active' as const})),
   exportExample:vi.fn(async({job_id}:{key:string;job_id:string})=>({delegation_id:'mine',job_id})),
@@ -36,12 +36,12 @@ test('the capability surface uses an explicit long-running facade without legacy
  expect(call).not.toHaveBeenCalled()
 })
 test('the default surface binds the real routes and the session-only picker',async()=>{
- const grant={id:'g1',key:'save',path:'/home',username:'normal1',lifetime:'until-revoked'}
+ const grant={id:'g1',key:'save',path:'/home',username:'alice',lifetime:'until-revoked'}
  let selected=false
  const call=vi.fn(async(method:string,params?:unknown)=>{
   if(method==='delegate.status')return {state:'ready',disabled:false,lifetime:'until-revoked',destinations:['save']}
   if(method==='delegate.destination')return {key:'save',selection:{scope:'home',root:'/home',generation:0},destination:selected?grant:null,status:selected?'active':'missing'}
-  if(method==='delegate.list')return {delegations:selected?[{delegation_id:'g1',destination:'save',path:'/home',subject:{username:'normal1'},lifetime:'until-revoked',revoked:false}]:[]}
+  if(method==='delegate.list')return {delegations:selected?[{delegation_id:'g1',destination:'save',path:'/home',subject:{username:'alice'},lifetime:'until-revoked',revoked:false}]:[]}
   if(method==='delegate.operations.list')return {operations:[]}
   if(method==='bg.browse')return {shares:[{name:'home',path:'/home',isdir:true}],offset:0,total:1}
   if(method==='delegate.select_destination'){selected=true;return grant}

package/templates/native-go-root-ops/backend/internal/app/executor_test.go

@@ -176,7 +176,7 @@ func TestTheExecutorClientWaitsTheSDKsTimeout(t *testing.T) {
 
 // The executor client is the SDK's delegate.Local: it reads the package's
 // lifecycle mailbox, so a stopped or starting package answers APP_STOPPED or
-// APP_STARTING instead of EXECUTOR_UNAVAILABLE (t-0513).
+// APP_STARTING instead of EXECUTOR_UNAVAILABLE.
 func TestTheExecutorClientReadsThePackagesLifecycleMailbox(t *testing.T) {
 	cfg := testConfig(t)
 	if got, want := cfg.executor().Mailbox, "/var/packages/"+cfg.PackageID+"/var/executor"; got != want {

package/templates/native-go-vue/frontend/DESIGN.md

@@ -52,7 +52,7 @@ The `native-go-jobs` overlay extends this **Operate** surface within the inherit
 - **Layout:** schedule name/state, owner, next run, missed runs and warnings stack above a grouped, wrapping action row. Long names and copy wrap within the available width. Keep the inherited vertical scrolling at the minimum window size; do not squeeze schedules into one viewport. The labeled select and consent checkbox retain visible keyboard focus using existing theme tokens.
 - **Errors and cleanup:** danger alerts map known error codes to localized safe copy, with a localized fallback rather than raw server text. The catalogs cover nine locales. Preserve per-mount disposal: stop polling, dispose the picker, revoke result download URLs and prevent pending responses from restoring disposed state. Deletion confirmation explains that queued jobs cancel, running jobs drain and finished results remain.
 
-Evidence: `.herdr-project/syno-package-land-sdk-t-0129/library/ui-desktop.png` and `ui-minimum.png` are local component-fixture captures. The finish review disposition is **ship**, with all three material findings resolved. A fresh `normal1` NAS browser readback passed before the final UI adjustments; these captures validate the final adjustments locally and do not establish final DSM visual acceptance.
+This layout is checked against the template's local component fixtures at the desktop size and at the DSM minimum window size, including the states and recovery copy above. That validates the component contract only; visual acceptance on a specific DSM release is the App developer's own check.
 
 ## Do's and Don'ts
 

package/templates/native-go-vue/frontend/package-lock.json

@@ -7,8 +7,8 @@
       "name": "native-dsm-vue-app",
       "dependencies": {
         "@lucide/vue": "1.48.0",
-        "@synopackageland/sdk": "0.15.2",
-        "@synopackageland/ui": "0.12.0",
+        "@synopackageland/sdk": "0.17.0",
+        "@synopackageland/ui": "0.12.1",
         "vue": "3.5.43"
       },
       "devDependencies": {
@@ -1152,9 +1152,9 @@
       }
     },
     "node_modules/@synopackageland/sdk": {
-      "version": "0.15.2",
-      "resolved": "https://registry.npmjs.org/@synopackageland/sdk/-/sdk-0.15.2.tgz",
-      "integrity": "sha512-am3V3HcYj00wj0Zs1XXDU6aNMh6KlXTkwqklIoIaCd7QxozDec53Nyj6jBRD/nkB7m7MDHQp+4habkRtrEF5sw==",
+      "version": "0.17.0",
+      "resolved": "https://registry.npmjs.org/@synopackageland/sdk/-/sdk-0.17.0.tgz",
+      "integrity": "sha512-3h7PjF55kJjKDJHZE9tbR0UxOgmxfGEnY9eKkpKPStdy8OiTOGjOlB298+YvJtkRBLiOZ13En10sa/ADbU9DnA==",
       "license": "MIT",
       "peerDependencies": {
         "@lucide/vue": "^1.48.0",
@@ -1171,9 +1171,9 @@
       }
     },
     "node_modules/@synopackageland/ui": {
-      "version": "0.12.0",
-      "resolved": "https://registry.npmjs.org/@synopackageland/ui/-/ui-0.12.0.tgz",
-      "integrity": "sha512-LGdkmceKcybJj4kvbwBZk5vewKepDi4vyGohkittpucnfOM9EOlCWkaWfWoZZ5MD0LQlwZf2ueydcrEOLq3R/A==",
+      "version": "0.12.1",
+      "resolved": "https://registry.npmjs.org/@synopackageland/ui/-/ui-0.12.1.tgz",
+      "integrity": "sha512-nyHKefcyKWiaXpjsjFfxrgsH4RSDHgO71bOV8uGRf89Ch2kDapNTfv42RtR2idIfNTt7A3/gKw8eUlyRn9VJDQ==",
       "license": "MIT",
       "dependencies": {
         "@internationalized/date": "3.12.4",

package/templates/native-go-vue/frontend/package.json

@@ -8,8 +8,8 @@
   },
   "dependencies": {
     "@lucide/vue": "1.48.0",
-    "@synopackageland/sdk": "0.15.2",
-    "@synopackageland/ui": "0.12.0",
+    "@synopackageland/sdk": "0.17.0",
+    "@synopackageland/ui": "0.12.1",
     "vue": "3.5.43"
   },
   "devDependencies": {

package/templates/native-go-vue/frontend/src/App.vue

@@ -1,8 +1,8 @@
 <script setup lang="ts">
 import {computed, onMounted, onUnmounted, ref, watch} from 'vue'
 import {Button, Callout, Form, FormActions, FormItem, KeyValueRow, SettingsSection, Textarea} from '@synopackageland/ui'
-import {bridgeErrorCopy, type AppStatus, type Context, type ShellPage} from '@synopackageland/sdk'
-import {AppShell, BackgroundPanel, FilesPage, LoginPage, PortalSettings, createSession, shellPages} from '@synopackageland/sdk/vue'
+import {bridgeErrorCopy, sharedFolderAccessFor, type AppStatus, type Context, type ShellPage} from '@synopackageland/sdk'
+import {AppShell, BackgroundPanel, FilesPage, LoginPage, PortalSettings, SharedFolderSettings, createSession, shellPages} from '@synopackageland/sdk/vue'
 import {appCopy} from './i18n'
 import CapabilityPanels from './CapabilityPanels.vue'
 import ExecutorGate, {holdsPages} from './ExecutorGate.vue'
@@ -10,6 +10,9 @@ const props = defineProps<{ctx: Context}>()
 const login = createSession(props.ctx)
 // Pages ExecutorGate holds need no notice above them that repeats its approval.
 const shellCtx = holdsPages ? {...props.ctx, executor: undefined} : props.ctx
+// Per-folder Shared Folder access for the package account; the section stays hidden unless
+// the install wizard stored a folder and the status can be read (administrators only).
+const sharedFolders = sharedFolderAccessFor(props.ctx)
 const copy = computed(() => appCopy(props.ctx.locale))
 const app = ref<AppStatus>()
 const busy = ref(false)
@@ -40,10 +43,24 @@ async function refresh() {
  const early = !login.ready.value
  const call: typeof login.call = early ? (method, params) => props.ctx.call(method, params) : login.call
  busy.value = true; error.value = ''
+ // An administrator DSM names up front has the greeting read beside the status.
+ const startupBatch = props.ctx.user?.isAdmin === true ? props.ctx.batch : undefined
+ const read = !startupBatch && props.ctx.user?.isAdmin ? call<{text:string}>('greeting.get') : undefined
+ read?.catch(() => {})
  try {
-  const a = await call<AppStatus>('app.status')
-  if(!disposed) app.value = a
-  if(a.admin) {const greeting = await call<{text:string}>('greeting.get'); if(!disposed) text.value = greeting.text}
+  if(startupBatch) {
+   const batch = early ? startupBatch : login.batch
+   const results = await batch([{method:'app.status'},{method:'greeting.get'}])
+   const status = results[0]!, greeting = results[1]!
+   if(!status.success) throw status.error
+   if(!disposed) app.value = status.data as AppStatus
+   if(!greeting.success) throw greeting.error
+   if(!disposed) text.value = (greeting.data as {text:string}).text
+  } else {
+   const a = await call<AppStatus>('app.status')
+   if(!disposed) app.value = a
+   if(a.admin) {const greeting = await (read ?? call<{text:string}>('greeting.get')); if(!disposed) text.value = greeting.text}
+  }
  } catch(e) {if(!disposed && !(early && login.enabled.value)) error.value = message(e)}
  finally {if(!disposed) {busy.value=false; if(again) {again=false; void refresh()}}}
 }
@@ -95,6 +112,7 @@ onUnmounted(()=>{disposed=true;unsubscribe?.();login.dispose();text.value=''})
      <p v-else-if="error" role="status">{{ copy.statusError }}</p>
     </SettingsSection>
     <PortalSettings v-if="ctx.portal && app" :key="portalKey" :portal="ctx.portal" />
+    <SharedFolderSettings v-if="app?.admin" :key="portalKey" :shared="sharedFolders" :locale="ctx.locale" />
     <SettingsSection v-if="app?.admin" :title="copy.greeting" :collapsible="false">
      <Form direction="vertical" @submit.prevent="save"><FormItem :label="copy.greeting"><Textarea v-model="text" :disabled="busy" /></FormItem>
       <FormActions><Button variant="primary" :disabled="busy || !text.trim()" @click="save">{{ copy.save }}</Button></FormActions>

package/templates/native-go-vue/frontend/test/apps.test.ts

@@ -88,6 +88,19 @@ test('the app renders and loads status while the session check is still pending'
   expect([...root.querySelectorAll('[data-app-status] [data-app-value]')].map(node=>node.textContent)).toEqual(['Eager','admin','1'])
  }finally{app.unmount();root.remove()}
 })
+test('an administrator DSM names up front has the greeting read beside the status',async()=>{
+ const call=vi.fn(async(method:string)=>{
+  if(method==='app.status')return new Promise(()=>{})
+  if(method==='greeting.get')return {text:'Hello Early'}
+  throw {code:'unknown_method'}
+ })
+ const root=document.createElement('div');document.body.append(root)
+ const app=mount(root,dsmWindow({call,user:{name:'admin',isAdmin:true}}))
+ try{
+  await settle()
+  expect(call.mock.calls.map(([method])=>method)).toContain('greeting.get')
+ }finally{app.unmount();root.remove()}
+})
 test('a status request that raced the session check is retried once the session is confirmed',async()=>{
  let session=false,rejectEarly:(e:unknown)=>void=()=>{}
  const call=vi.fn(async(method:string)=>{
@@ -219,3 +232,36 @@ test('a needed sign-in takes the shell page in place of the App pages, inside th
   expect(form!.closest('[data-ui-app]')).not.toBeNull()
  }finally{app.unmount();root.remove()}
 })
+test('an administrator sees a pending Shared Folder with the grant step; a plain app shows no section',async()=>{
+ const plain=fixture('NoShare')
+ const folder={key:'shared',name:'Media',exists:true,required:'write',granted:'read',state:'pending'}
+ const call=vi.fn(async(method:string)=>{
+  if(method==='app.status')return {package:'Share',version:'1',user:'admin',admin:true}
+  if(method==='greeting.get')return {text:'Hi'}
+  if(method==='sharedfolder.status')return {account:'Share',folders:[folder]}
+  throw {code:'unknown_method'}
+ })
+ const ctx=dsmWindow({call,user:{name:'admin',isAdmin:true}})
+ const root=document.createElement('div');document.body.append(root)
+ const app=mount(root,ctx)
+ try{
+  await settle()
+  expect(plain.root.textContent).not.toContain('Shared Folders')
+  expect(root.querySelector('[data-shared-folder-state="pending"]')).not.toBeNull()
+  expect(root.textContent).toContain('System internal user')
+  expect(root.textContent).toContain('Ask an administrator')
+ }finally{app.unmount();root.remove();plain.close()}
+})
+
+test('batches startup reads for a known administrator', async () => {
+ const calls: string[]=[]
+ const batch=vi.fn(async () => [{success:true as const,data:{package:'Batch',version:'1',user:'admin',admin:true}},{success:true as const,data:{text:'Hello Batch'}}])
+ const ctx=dsmWindow({user:{name:'admin',isAdmin:true},batch:batch as NonNullable<Context['batch']>,call:async <T,>(method:string)=>{calls.push(method);if(method==='identity.status')return {enabled:false} as T;throw {code:'unknown_method'}}})
+ const root=document.createElement('div');document.body.append(root)
+ const app=mount(root,ctx)
+ await settle()
+ expect(batch).toHaveBeenCalledWith([{method:'app.status'},{method:'greeting.get'}])
+ expect(calls).not.toContain('app.status');expect(calls).not.toContain('greeting.get')
+ expect((root.querySelector('textarea') as HTMLTextAreaElement).value).toBe('Hello Batch')
+ app.unmount();root.remove()
+})

package/templates/native-node/dsm-package.yaml

@@ -49,7 +49,7 @@ backend:
   runtime: node
   dir: backend/app
   entry: main.js
-  sdk: 0.15.2
+  sdk: 0.17.0
   node: { package: Node.js_v20 }
 
 ui:

package/templates/native-python/dsm-package.yaml

@@ -47,7 +47,7 @@ backend:
   runtime: python
   dir: backend/app
   entry: main.py
-  sdk: 0.15.2
+  sdk: 0.17.0
 
 ui:
   # Non-UI-SDK frontends open a full page; Portal is a separate opt-in.

package/templates/native-rust/backend/Cargo.lock

@@ -104,8 +104,8 @@ dependencies = [
 
 [[package]]
 name = "syno-pkg-land-app"
-version = "0.15.2"
-source = "git+https://github.com/synopackageland/syno-pkg-land-sdk?tag=v0.15.2#be41eaef61f2a4e67b77902efd5d86abfc38cd63"
+version = "0.17.0"
+source = "git+https://github.com/synopackageland/syno-pkg-land-sdk?tag=v0.17.0#91fa899beec935af9668a04c24ccd64b0d03b00b"
 dependencies = [
  "libc",
  "serde",

package/templates/native-rust/backend/Cargo.toml

@@ -9,7 +9,7 @@ libc = "0.2"
 serde = { version = "1", features = ["derive"] }
 serde_json = "1"
 # The SDK version is the tag; `synopkgland check` reads it from Cargo.lock.
-syno-pkg-land-app = { git = "https://github.com/synopackageland/syno-pkg-land-sdk", tag = "v0.15.2" }
+syno-pkg-land-app = { git = "https://github.com/synopackageland/syno-pkg-land-sdk", tag = "v0.17.0" }
 
 [profile.release]
 # A handler panic becomes an "internal" reply; abort would end the App without one.