@synopackageland/templates 0.26.4 → 0.27.0

package/README.md

@@ -22,8 +22,8 @@ daemon:
     window_seconds: 300
 ```
 
-Templates 0.26.4 pin SDK 0.26.0, including the default controller SDK for
-binary/Node daemons. Use CLI 0.26.0 or later. Go Apps select
+Templates 0.27.0 inherit UI 0.14.9 from 0.26.5 and pin SDK 0.27.0 in native and Compose projects.
+Use CLI 0.27.0 or later. Go Apps select
 their controller from their Go SDK requirement; an identity gateway selects it
 from `identity_gateway.sdk`. The CLI rejects older selected versions, even for
 an explicit `mode: off`, rather than dropping the declaration. A local SDK source
@@ -39,7 +39,7 @@ for declaration bounds, SDK selection, build/inspect checks and diagnostics.
 
 An opt-in [Shared Folder permission example](examples/shared-folder-permission/README.md)
 shows the Go status-handler registration and a Vue notice for startup checks and
-storage failures. It uses the same SDK 0.26.0 release pinned by the default scaffolds.
+storage failures. It uses the same SDK 0.27.0 release pinned by the default scaffolds.
 
 An opt-in [native UI plus DSM console example](examples/dual-entry-console/README.md)
 shows the `console` declaration for an App that wraps a web service behind the
@@ -79,14 +79,22 @@ calls each one from the generated script of the same name (`synopkgland skill sh
 The placeholders `__PACKAGE__` (also the Go module path), `__DISPLAY_NAME__` and
 `__BACKGROUND_ENABLED__` are substituted by `init`.
 
-`backend/go.mod` requires `github.com/synopackageland/syno-pkg-land-sdk v0.26.0`; that line is
+`backend/go.mod` requires `github.com/synopackageland/syno-pkg-land-sdk v0.27.0`; that line is
 the single source of the SDK version and `frontend/package.json` pins
 `@synopackageland/sdk` to the same version. Python and Node.js name it in
 `backend.sdk`, Rust in the `syno-pkg-land-app` tag of `backend/Cargo.toml`
-(and `Cargo.lock`); all of them pin 0.26.0. The Vue frontend pins
-`@synopackageland/ui` 0.14.8. SDK 0.26.0 accepts UI `>=0.10.1 <0.15.0`,
+(and `Cargo.lock`); all of them pin 0.27.0. The Vue frontend pins
+`@synopackageland/ui` 0.14.9. SDK 0.27.0 accepts UI `>=0.10.1 <0.15.0`,
 so no UI peer override is needed. Tests use jsdom 30 for UI floating-layer styles.
 
+SDK 0.27.0 moves interactive NAS file operations to same-origin browser calls.
+The unused server-only `bg.browse` and file-import scaffold now return
+`unsupported`; custom file handlers need the SDK's
+[session transport migration](https://github.com/synopackageland/syno-pkg-land-sdk/blob/v0.27.0/docs/dsm-session-transport.md).
+Protected executor scaffolds need a released CLI with SDK 0.27.0 executor/lifecycle
+digests; CLI 0.26.0 does not include them and refuses those builds. Rebuilt protected
+executors follow normal administrator approval. No NAS acceptance is claimed.
+
 UI and i18n text, including the DSM glossary, omit terminal sentence periods.
 Keep punctuation between sentences and intentional loading ellipses.
 
@@ -206,3 +214,13 @@ the single-call path. Each batch result is handled separately; the shell stays
 visible while reads run. The backend permissions remain authoritative.
 
 Native Node Apps use the official [`Node.js_v22`](https://www.synology.com/en-us/dsm/packages/Node.js_v22) package. The official release history lists DSM 7 series; installation also depends on the model and DSM version supported by Package Center. This dependency does not certify all DSM 7 releases or install Node.js on unsupported models.
+
+### Temporarily disabled NAS hashing example
+
+SDK 0.27.0 no longer relays browser DSM sessions from a backend. This release
+explicitly disables the template NAS file hashing example: Go production
+`bg.browse`/`bg.jobs.submit` and bridge `hash.submit` return `unsupported` before
+reading a file or creating a job. The Vue background example page displays an
+unavailable notice. Existing job list/status/pause/resume/cancel/schedule APIs
+and workers remain available for App-owned input; no SDK API or special option
+is introduced. A safe browser-owned input flow is follow-up work.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@synopackageland/templates",
-  "version": "0.26.4",
+  "version": "0.27.0",
   "description": "Project templates for synopkgland init: native-go, native-python, native-node and native-rust (plain or Vue, with jobs, delegate and root-ops overlays), binary and compose.",
   "license": "MIT",
   "repository": {

package/templates/_shared/AGENTS.md

@@ -110,6 +110,10 @@ may redistribute; never copy Synology's.
 
 ## Background jobs (`jobs`)
 
+The NAS hashing example is temporarily disabled pending browser-owned input
+migration. Do not use backend DSM session replay or `files.read` to restore it.
+Existing workers and job-control APIs remain available for App-owned input.
+
 The worker runs the App's Work for one claimed job at a time, as the package
 account. The Work receives the job's Task: it reads the private input copy,
 reports progress (`done`/`total`, `bytes`/`totalBytes`, `item`) and saves a
@@ -265,8 +269,7 @@ sweep forward the cancel instead of admitting it.
 The SDK runtime is the CGI: it checks the DSM session, the entry gate and
 permissions.json, then runs the App once per call, as the package account, and
 answers the browser itself for every refusal. The App only registers methods
-and asks the runtime for services with `ctx.runtime(op, params)`: `files.read`
-(the caller's file, `files: session`), `bg.submit`/`bg.get`/`bg.cancel` (the
+and asks the runtime for services with `ctx.runtime(op, params)`: `bg.submit`/`bg.get`/`bg.cancel` (the
 caller's jobs, `jobs: true`, whose worker hashes each job's input), `root.run`
 (`rootOps`), `delegate.move_from_staging` (`delegate`) and `portal.status`. A
 service refusal is a code the browser may see; pass it on. The admin guard

package/templates/compose/dsm-package.yaml

@@ -14,7 +14,7 @@ compose:
   web: {service: web, port: 8080, health: {path: /, status: 200}}
   network: {egress: isolated}
 identity_gateway:
-  sdk: 0.26.0
+  sdk: 0.27.0
   mode: none
   listen: {http: 28000}
 # Web Apps default to new-page through the shared app-launch resolver.

package/templates/native-go/README.md

@@ -399,3 +399,7 @@ SDK's `docs/shared-folder.md` for the whole flow.
 | Target CPUs | x86_64 and aarch64 DSM models (one SPK each). armv7 (DSM 7.2+ platforms `alpine`, `alpine4k`, `armada38x`, `monaco`) is opt-in: add it to `arches`; it covers the Go CGI (plain or Vue UI), jobs, daemon, root-ops and delegate. armv7 jobs, daemon and executor (root-ops, delegate) are built and checked locally but have not been verified on a NAS |
 | DSM | 7.1 or later declared (`os_min_ver`, change it with `init --min-dsm` or `build --min-dsm`). Installed and tested on DSM 7.4 and 7.3.2 (x86_64). armv7 was installed and tested on DSM 7.1.1 (`alpine4k`, Linux 3.10, where the bridge runs from the package tmp fallback) with administrator, AppPriv and unauthenticated requests; `armada38x` and `monaco` have not been run on a NAS. No x86_64 Linux 3.10 model has been tested. aarch64 SPKs are built the same way but have not been run on a NAS. |
 | Not supported | armv7 platforms only DSM 7.0/7.1 ship (`armada370`, `armada375`, `armadaxp`, `comcerto2k`); DSM 6, running anything as root without an administrator's approval |
+
+The NAS file hashing example is temporarily disabled pending browser-owned
+input migration. NAS import submission returns `unsupported` without reading a
+file or creating a job; existing worker and job-control APIs remain available.

package/templates/native-go/backend/THIRD_PARTY_NOTICES.txt

@@ -1,6 +1,6 @@
 Native Go package build dependencies
 
-github.com/synopackageland/syno-pkg-land-sdk v0.26.0 (MIT)
+github.com/synopackageland/syno-pkg-land-sdk v0.27.0 (MIT)
 
 Copyright (c) 2026 synopkgland
 

package/templates/native-go/backend/go.mod

@@ -4,6 +4,6 @@ go 1.25.0
 
 toolchain go1.26.10
 
-require github.com/synopackageland/syno-pkg-land-sdk v0.26.0
+require github.com/synopackageland/syno-pkg-land-sdk v0.27.0
 
 require golang.org/x/sys v0.44.0 // indirect

package/templates/native-go/backend/go.sum

@@ -1,4 +1,4 @@
-github.com/synopackageland/syno-pkg-land-sdk v0.26.0 h1:74lMYZURXwF2ffMRhG+T8u1XF8HsR04+NFjweRuKFw8=
-github.com/synopackageland/syno-pkg-land-sdk v0.26.0/go.mod h1:8GwREGbczc8mAk4Gv8FUHaukXXCUstjzkovQrNV59Cc=
+github.com/synopackageland/syno-pkg-land-sdk v0.27.0 h1:DyMQUEf6mIzEW2afdfGjWh5FM1R6qM6YW2LFD7/yZeI=
+github.com/synopackageland/syno-pkg-land-sdk v0.27.0/go.mod h1:8GwREGbczc8mAk4Gv8FUHaukXXCUstjzkovQrNV59Cc=
 golang.org/x/sys v0.44.0 h1:ildZl3J4uzeKP07r2F++Op7E9B29JRUy+a27EibtBTQ=
 golang.org/x/sys v0.44.0/go.mod h1:4GL1E5IUh+htKOUEOaiffhrAeqysfVGipDYzABqnCmw=

package/templates/native-go/backend/internal/app/background.go

@@ -42,10 +42,11 @@ type backgroundAPI struct {
 }
 
 // BackgroundRoutes is the production assembly of the opt-in background jobs
-// API. `synopkgland init --with jobs` wires it in through background.go's
+// API. The NAS hashing example is disabled until browser-owned input is wired.
+// Existing job control routes remain available. `synopkgland init --with jobs` wires it in through background.go's
 // replacement of background_none.go; nothing else references it.
 func BackgroundRoutes(dataDir string) []api.Route {
-	return newBackgroundRoutes(background.NewRequestStore(filepath.Join(dataDir, "background")), filestation.Local(dataDir))
+	return newBackgroundRoutes(background.NewRequestStore(filepath.Join(dataDir, "background")), nil)
 }
 
 // Every request authenticates against DSM afresh. Owner routes are available
@@ -129,6 +130,9 @@ func (b backgroundAPI) browse(ctx context.Context, c api.Caller, r *http.Request
 	if in.Offset < 0 {
 		return nil, api.BadRequest("offset must not be negative")
 	}
+	if b.files == nil {
+		return nil, &api.Error{Code: "unsupported", Message: "The NAS file hashing example is disabled pending browser input migration. Existing job control APIs remain available."}
+	}
 	return b.files.Browse(ctx, c, r, in.Folder, in.Offset)
 }
 
@@ -148,6 +152,9 @@ func (b backgroundAPI) submit(ctx context.Context, c api.Caller, r *http.Request
 	if !access.Owner.Valid() {
 		return nil, &api.Error{Code: "identity_unavailable", Message: "DSM user UID could not be resolved"}
 	}
+	if b.files == nil {
+		return nil, &api.Error{Code: "unsupported", Message: "The NAS file hashing example is disabled pending browser input migration. Existing job control APIs remain available."}
+	}
 	data, err := b.files.ReadFile(ctx, c, r, in.Folder, in.Relative)
 	if err != nil {
 		return nil, err

package/templates/native-go/backend/internal/app/background_test.go

@@ -6,6 +6,7 @@ import (
 	"fmt"
 	"net/http"
 	"net/http/httptest"
+	"os"
 	"path/filepath"
 	"strings"
 	"testing"
@@ -136,12 +137,14 @@ func TestBackgroundStatusReportsLimitsAndWorker(t *testing.T) {
 	if limits["maxInputBytes"].(float64) != 512*1024 || limits["maxQueued"].(float64) != 16 || limits["maxTotalBytes"].(float64) != 16<<20 || limits["jobTimeoutSeconds"].(float64) != 60 {
 		t.Fatalf("limits: %v", limits)
 	}
-	if err := e.store.Heartbeat(context.Background(), background.WorkerInfo{PID: 9, UID: 255853, Username: "pkg"}); err != nil {
+	info := background.WorkerInfo{PID: os.Getpid(), UID: os.Getuid(), Username: "pkg"}
+	if err := e.store.Heartbeat(context.Background(), info); err != nil {
 		t.Fatal(err)
 	}
+	t.Cleanup(func() { e.store.ClearHeartbeat(info) })
 	_, out = e.call(alice, "bg.status", `{}`)
 	w := data(out)["worker"].(map[string]any)
-	if w["alive"] != true || w["uid"].(float64) != 255853 {
+	if w["alive"] != true || w["uid"].(float64) != float64(info.UID) || w["pid"].(float64) != float64(info.PID) {
 		t.Fatalf("worker: %v", w)
 	}
 }

package/templates/native-go-delegate/backend/internal/app/delegate.go

@@ -4,7 +4,6 @@ import (
 	"github.com/synopackageland/syno-pkg-land-sdk/api"
 	"github.com/synopackageland/syno-pkg-land-sdk/background"
 	"github.com/synopackageland/syno-pkg-land-sdk/delegate"
-	"github.com/synopackageland/syno-pkg-land-sdk/filestation"
 	"path/filepath"
 )
 
@@ -16,10 +15,5 @@ func DelegateRoutes(cfg Config, scope string) []api.Route {
 	if err == nil {
 		service.Destinations, service.Operations, service.Lifetime = settings.Destinations, settings.Operations, settings.Lifetime
 	}
-	if cfg.SessionFiles != nil {
-		service.SessionFiles = cfg.SessionFiles
-	} else {
-		service.SessionFiles = filestation.Local(cfg.DataDir)
-	}
 	return service.Routes()
 }

package/templates/native-go-delegate/frontend/test/capability-panels.test.ts

@@ -38,22 +38,34 @@ test('the capability surface uses an explicit long-running facade without legacy
 test('the default surface binds the real routes and the session-only picker',async()=>{
  const grant={id:'g1',key:'save',path:'/home',username:'alice',lifetime:'until-revoked'}
  let selected=false
+ const fetch=vi.fn(async(url:string,init?:RequestInit)=>{
+  expect(url).toBe('/webapi/entry.cgi')
+  const body=init?.body as URLSearchParams
+  expect(body.get('api')).toBe('SYNO.FileStation.List')
+  expect(body.get('method')).toBe('list_share')
+  expect(body.get('SynoToken')).toBe('fixture-token')
+  expect(init?.credentials).toBe('same-origin')
+  return new Response(JSON.stringify({success:true,data:{shares:[{name:'home',path:'/home',isdir:true}],offset:0,total:1}}))
+ })
+ vi.stubGlobal('fetch',fetch);cleanup.push(()=>vi.unstubAllGlobals())
  const call=vi.fn(async(method:string,params?:unknown)=>{
+  if(method==='nas.session.status')return {mode:'browser-session'}
   if(method==='delegate.status')return {state:'ready',disabled:false,lifetime:'until-revoked',destinations:['save']}
   if(method==='delegate.destination')return {key:'save',selection:{scope:'home',root:'/home',generation:0},destination:selected?grant:null,status:selected?'active':'missing'}
   if(method==='delegate.list')return {delegations:selected?[{delegation_id:'g1',destination:'save',path:'/home',subject:{username:'alice'},lifetime:'until-revoked',revoked:false}]:[]}
   if(method==='delegate.operations.list')return {operations:[]}
-  if(method==='bg.browse')return {shares:[{name:'home',path:'/home',isdir:true}],offset:0,total:1}
   if(method==='delegate.select_destination'){selected=true;return grant}
   if(method==='delegate.example.export')return {delegation_id:'g1',job_id:(params as {job_id:string}).job_id}
   throw {code:'unexpected'}
  })
- const root=render({call,locale:'en'});await settle()
+ const root=render({call,locale:'en',files:{token:()=> 'fixture-token'}});await settle()
  button(root,'Choose folder').click();await settle()
  // The SDK picker selects a folder with a row click.
  const row=root.querySelector<HTMLElement>('tr[data-row-key="/home"]')!;expect(row).toBeTruthy();row.dispatchEvent(new MouseEvent('click',{bubbles:true}));await settle()
  button(root,'Confirm selection').click();await settle()
  expect(call).toHaveBeenCalledWith('delegate.select_destination',{key:'save',path:'/home'})
+ expect(fetch).toHaveBeenCalledTimes(1)
+ expect(call).not.toHaveBeenCalledWith('bg.browse',expect.anything())
  // The SDK hides the sample save unless an App opts in; the template opts in with sample-save.
  button(root,'Save example file').click();await settle()
  expect(call).toHaveBeenCalledWith('delegate.example.export',expect.objectContaining({key:'save'}))

package/templates/native-go-jobs/backend/internal/app/background_routes_test.go

@@ -16,7 +16,7 @@ import (
 
 func init() {
 	// The generic route tests need valid params for every background route.
-	// The fixture has no DSM cookie; import is refused before reading a file.
+	// The SDK refuses retired backend session relays before reading a file.
 	// No jobs or schedules exist in its fresh data directory.
 	const id = `{"id":"missing"}`
 	sampleParams["bg.jobs.purge"] = `{"owner":{"user":"missing","uid":"9999"}}`
@@ -38,8 +38,8 @@ func init() {
 	sampleParams["bg.jobs.pause"] = id
 	sampleParams["bg.jobs.resume"] = id
 	sampleParams["bg.jobs.result"] = id
-	sampleOutcome["bg.browse"] = "session_required"
-	sampleOutcome["bg.jobs.submit"] = "session_required"
+	sampleOutcome["bg.browse"] = "unsupported"
+	sampleOutcome["bg.jobs.submit"] = "unsupported"
 	sampleOutcome["bg.jobs.get"] = "not_found"
 	sampleOutcome["bg.jobs.cancel"] = "not_found"
 	sampleOutcome["bg.jobs.pause"] = "not_found"
@@ -90,3 +90,17 @@ func TestBackgroundRequestSubmitBusyAndProductionConstruction(t *testing.T) {
 		t.Fatal(w.Body.String())
 	}
 }
+
+func TestProductionNASHashExampleRefusesWithoutCreatingJobs(t *testing.T) {
+	cfg := testConfig(t)
+	for _, method := range []string{"bg.browse", "bg.jobs.submit"} {
+		code, _ := call(t, cfg, alice, method, sampleParams[method])
+		if code != "unsupported" {
+			t.Fatalf("%s: %s", method, code)
+		}
+	}
+	jobs, err := background.NewStore(filepath.Join(cfg.DataDir, "background")).List(context.Background())
+	if err != nil || len(jobs) != 0 {
+		t.Fatalf("disabled example created jobs: %v %v", jobs, err)
+	}
+}

package/templates/native-go-jobs/frontend/test/background-page.test.ts

@@ -4,8 +4,8 @@ import {nextTick} from 'vue'
 import {mount} from '../src/main'
 import {dsmWindow} from './context'
 async function settle(){for(let i=0;i<20;i++){await Promise.resolve();await nextTick()}}
-// The CLI turns the background page on for jobs (and delegate) projects only.
-test('a jobs project mounts the background panel for the signed-in user',async()=>{
+// The file-import example is explicitly unavailable until browser input is migrated.
+test('a jobs project explains the disabled example without submitting or reading files',async()=>{
  const call=vi.fn(async(method:string)=>{
   if(method==='app.status')return {package:'Jobs',version:'1',user:'alice',admin:false}
   throw {code:'unknown_method'}
@@ -14,46 +14,8 @@ test('a jobs project mounts the background panel for the signed-in user',async()
  const app=mount(root,dsmWindow({call}))
  try{
   await settle()
-  expect(call.mock.calls.some(([method])=>method.startsWith('bg.'))).toBe(true)
-  expect(root.querySelector('[data-page="background"]')).not.toBeNull()
- }finally{app.unmount();root.remove()}
-})
-test('the background panel pauses a running job and resumes a paused one',async()=>{
- const submitter={user:'alice',uid:'1024'}
- const jobs=[{id:'run',name:'a.bin',state:'running',submitter},{id:'held',name:'b.bin',state:'paused',pauseReason:'user',submitter}]
- const call=vi.fn(async(method:string):Promise<unknown>=>{
-  if(method==='app.status')return {package:'Jobs',version:'1',user:'alice',admin:false}
-  if(method==='bg.status')return {owner:submitter,admin:false,revision:1,worker:{username:'pkg',alive:true},limits:{maxInputBytes:1024,maxQueued:8,maxOwnerPending:4,maxOwnerBytes:4096,jobTimeoutSeconds:60}}
-  if(method==='bg.jobs.list')return {jobs}
-  if(method==='bg.schedules.list')return {schedules:[]}
-  return {}
- })
- const root=document.createElement('div');document.body.append(root)
- const app=mount(root,dsmWindow({call}))
- const button=(id:string,label:string)=>Array.from(root.querySelectorAll(`[data-job-id="${id}"] button`)).find(b=>b.textContent===label) as HTMLButtonElement|undefined
- try{
-  await settle()
-  button('run','Pause')!.click();await settle()
-  expect(call).toHaveBeenCalledWith('bg.jobs.pause',{id:'run'})
-  button('held','Resume')!.click();await settle()
-  expect(call).toHaveBeenCalledWith('bg.jobs.resume',{id:'held'})
- }finally{app.unmount();root.remove()}
-})
-test('the header Refresh reloads the background panel',async()=>{
- const call=vi.fn(async(method:string):Promise<unknown>=>{
-  if(method==='app.status')return {package:'Jobs',version:'1',user:'alice',admin:false}
-  if(method==='bg.status')return {owner:{user:'alice',uid:'1024'},admin:false,revision:1,worker:{username:'pkg',alive:true},limits:{maxInputBytes:1024,maxQueued:8,maxOwnerPending:4,maxOwnerBytes:4096,jobTimeoutSeconds:60}}
-  if(method==='bg.jobs.list')return {jobs:[]}
-  if(method==='bg.schedules.list')return {schedules:[]}
-  return {}
- })
- const root=document.createElement('div');document.body.append(root)
- const app=mount(root,dsmWindow({call}))
- const reads=()=>call.mock.calls.filter(([method])=>method==='bg.jobs.list').length
- try{
-  await settle();const before=reads()
-  // The header button comes first; the panels below may have their own.
-  ;(Array.from(root.querySelectorAll('button')).find(b=>b.textContent==='Refresh') as HTMLButtonElement).click();await settle()
-  expect(reads()).toBeGreaterThan(before)
+  expect(root.querySelector('[data-background-example-disabled]')?.textContent).toContain('disabled')
+  expect(root.querySelector('[data-background-panel]')).toBeNull()
+  expect(call.mock.calls.some(([method])=>method.startsWith('bg.'))).toBe(false)
  }finally{app.unmount();root.remove()}
 })

package/templates/native-go-vue/frontend/package-lock.json

@@ -7,8 +7,8 @@
       "name": "native-dsm-vue-app",
       "dependencies": {
         "@lucide/vue": "1.48.0",
-        "@synopackageland/sdk": "0.26.0",
-        "@synopackageland/ui": "0.14.8",
+        "@synopackageland/sdk": "0.27.0",
+        "@synopackageland/ui": "0.14.9",
         "vue": "3.5.43"
       },
       "devDependencies": {
@@ -1152,9 +1152,9 @@
       }
     },
     "node_modules/@synopackageland/sdk": {
-      "version": "0.26.0",
-      "resolved": "https://registry.npmjs.org/@synopackageland/sdk/-/sdk-0.26.0.tgz",
-      "integrity": "sha512-f6nKQzA+Bn+ilHAtJdoksPg/t3beA0Nxo1tOvFrTIqSuzB8CeMCQ5zZ263NigFvV3yDYwM9T4AD4C0Iw/LXf5Q==",
+      "version": "0.27.0",
+      "resolved": "https://registry.npmjs.org/@synopackageland/sdk/-/sdk-0.27.0.tgz",
+      "integrity": "sha512-KIFeYhzmiH0QFAD8SutTvSXCiynx/D84ydOROGPS9B5VcHkLU8uqtD9Mwac9G0UY7mPITioGJuJGXpGytFPCVg==",
       "license": "MIT",
       "peerDependencies": {
         "@lucide/vue": "^1.48.0",
@@ -1171,9 +1171,9 @@
       }
     },
     "node_modules/@synopackageland/ui": {
-      "version": "0.14.8",
-      "resolved": "https://registry.npmjs.org/@synopackageland/ui/-/ui-0.14.8.tgz",
-      "integrity": "sha512-PcSAUSHdlM8ZCiRS9i6xRvT/BoBV5oYAM1DTFTUDyohgeNwnMqENaVuhv8uvpGRGXncoXB1K1B7nZBAyQTopnQ==",
+      "version": "0.14.9",
+      "resolved": "https://registry.npmjs.org/@synopackageland/ui/-/ui-0.14.9.tgz",
+      "integrity": "sha512-Vr925mORKVuWJH/EaEvaSUF4nxsHP0SWUYwwMjM009MFw+UHaABoEtasAliCDsnI7CnlggLcexO3ad5slm9IVw==",
       "license": "MIT",
       "dependencies": {
         "@internationalized/date": "3.12.4",

package/templates/native-go-vue/frontend/package.json

@@ -8,8 +8,8 @@
   },
   "dependencies": {
     "@lucide/vue": "1.48.0",
-    "@synopackageland/sdk": "0.26.0",
-    "@synopackageland/ui": "0.14.8",
+    "@synopackageland/sdk": "0.27.0",
+    "@synopackageland/ui": "0.14.9",
     "vue": "3.5.43"
   },
   "devDependencies": {

package/templates/native-go-vue/frontend/src/App.vue

@@ -2,7 +2,7 @@
 import {computed, onMounted, onUnmounted, ref, watch} from 'vue'
 import {Button, Callout, Form, FormActions, FormItem, KeyValueRow, SettingsSection, Textarea} from '@synopackageland/ui'
 import {bridgeErrorCopy, sharedFolderAccessFor, type AppStatus, type Context, type ShellPage} from '@synopackageland/sdk'
-import {AppShell, BackgroundPanel, FilesPage, LoginPage, PortalSettings, SharedFolderSettings, createSession, shellPages} from '@synopackageland/sdk/vue'
+import {AppShell, FilesPage, LoginPage, PortalSettings, SharedFolderSettings, createSession, shellPages} from '@synopackageland/sdk/vue'
 import {appCopy} from './i18n'
 import CapabilityPanels from './CapabilityPanels.vue'
 import ExecutorGate, {holdsPages} from './ExecutorGate.vue'
@@ -66,11 +66,10 @@ async function refresh() {
 }
 // The header Refresh also reloads the panels below and reads the portal again.
 const panels = ref<{refresh(): unknown}>()
-const background = ref<{refresh(): unknown}>()
 const portalReads = ref(0)
 const portalKey = computed(() => `${app.value?.user}:${portalReads.value}`)
 function refreshAll() {
- void refresh(); void panels.value?.refresh(); void background.value?.refresh(); portalReads.value++
+ void refresh(); void panels.value?.refresh(); portalReads.value++
 }
 async function save() {
  if(disposed || busy.value) return
@@ -122,7 +121,7 @@ onUnmounted(()=>{disposed=true;unsubscribe?.();login.dispose();text.value=''})
    <CapabilityPanels v-if="app" ref="panels" :key="app.user" :ctx="ctx" :admin="app.admin" />
    <FilesPage v-if="page==='status'" :ctx="ctx" />
    <div data-page="background" v-show="page==='background'">
-    <BackgroundPanel v-if="backgroundEnabled && app" ref="background" :key="app.user" :ctx="ctx" />
+    <Callout v-if="backgroundEnabled && app" tone="warning" data-background-example-disabled>{{ copy.backgroundExampleUnavailable }}</Callout>
    </div>
   </div>
   </ExecutorGate>

package/templates/native-go-vue/frontend/src/i18n/de.json

@@ -17,5 +17,6 @@
   },
   "packageName": "Paketname",
   "user": "Benutzer",
-  "version": "Version"
+  "version": "Version",
+  "backgroundExampleUnavailable": "Das NAS-Datei-Hash-Beispiel ist bis zur Umstellung auf Browser-Eingaben deaktiviert. Bestehende APIs zur Auftragssteuerung bleiben verfügbar"
 }

package/templates/native-go-vue/frontend/src/i18n/en.json

@@ -17,5 +17,6 @@
   },
   "packageName": "Package name",
   "user": "User",
-  "version": "Version"
+  "version": "Version",
+  "backgroundExampleUnavailable": "The NAS file hashing example is disabled pending browser input migration. Existing job control APIs remain available"
 }

package/templates/native-go-vue/frontend/src/i18n/es.json

@@ -17,5 +17,6 @@
   },
   "packageName": "Nombre del paquete",
   "user": "Usuario",
-  "version": "Versión"
+  "version": "Versión",
+  "backgroundExampleUnavailable": "El ejemplo de hash de archivos NAS está desactivado hasta migrar la entrada al navegador. Las API de control de trabajos siguen disponibles"
 }

package/templates/native-go-vue/frontend/src/i18n/fr.json

@@ -17,5 +17,6 @@
   },
   "packageName": "Nom du paquet",
   "user": "Utilisateur",
-  "version": "Version"
+  "version": "Version",
+  "backgroundExampleUnavailable": "L’exemple de hachage de fichiers NAS est désactivé en attendant la migration des entrées du navigateur. Les API de contrôle des tâches restent disponibles"
 }

package/templates/native-go-vue/frontend/src/i18n/it.json

@@ -17,5 +17,6 @@
   },
   "packageName": "Nome pacchetto",
   "user": "Utente",
-  "version": "Versione"
+  "version": "Versione",
+  "backgroundExampleUnavailable": "L’esempio di hashing dei file NAS è disabilitato in attesa della migrazione dell’input dal browser. Le API di controllo dei processi restano disponibili"
 }

package/templates/native-go-vue/frontend/src/i18n/ja.json

@@ -17,5 +17,6 @@
   },
   "packageName": "パッケージ名",
   "user": "ユーザー",
-  "version": "バージョン"
+  "version": "バージョン",
+  "backgroundExampleUnavailable": "NAS ファイルのハッシュ例はブラウザー入力への移行まで無効です。既存のジョブ制御 API は利用できます"
 }

package/templates/native-go-vue/frontend/src/i18n/ko.json

@@ -17,5 +17,6 @@
   },
   "packageName": "패키지 이름",
   "user": "사용자",
-  "version": "버전"
+  "version": "버전",
+  "backgroundExampleUnavailable": "브라우저 입력 전환이 완료될 때까지 NAS 파일 해시 예제를 사용할 수 없습니다. 기존 작업 제어 API는 계속 사용할 수 있습니다"
 }

package/templates/native-go-vue/frontend/src/i18n/zh-CN.json

@@ -17,5 +17,6 @@
   },
   "packageName": "套件名称",
   "user": "用户帐号",
-  "version": "版本"
+  "version": "版本",
+  "backgroundExampleUnavailable": "本版本暂停 NAS 文件哈希示例，待浏览器输入流程完成后恢复。现有任务控制 API 仍可使用"
 }

package/templates/native-go-vue/frontend/src/i18n/zh-TW.json

@@ -17,5 +17,6 @@
   },
   "packageName": "套件名稱",
   "user": "使用者帳號",
-  "version": "版本"
+  "version": "版本",
+  "backgroundExampleUnavailable": "本版本暫停 NAS 檔案雜湊範例，待瀏覽器輸入流程完成後恢復。既有工作控制 API 仍可使用"
 }

package/templates/native-node/README.md

@@ -111,7 +111,7 @@ rebuilding the SPK.
 
 | `--with` | Methods | Runtime services |
 | --- | --- | --- |
-| `jobs` | `hash.submit`, `hash.get`, `hash.cancel` | `files.read` with the caller's session, `bg.submit`, `bg.get`, `bg.cancel` |
+| `jobs` | `hash.submit`, `hash.get`, `hash.cancel` | `hash.submit` is disabled pending browser input migration; `bg.get` and `bg.cancel` remain available |
 | `root-ops` | `whoami.run` | `root.run` of `root/whoami.sh`, once an administrator approves the executor |
 | `delegate` | `report.save` | `delegate.move_from_staging` into a folder the caller chose |
 
@@ -158,3 +158,7 @@ ticks **Also delete the app data listed above** in the uninstall wizard.
 | Build hosts | macOS, Linux |
 | Target CPUs | x86_64 and aarch64 DSM models (one SPK each); armv7 is opt-in in `arches`, built but not NAS-verified |
 | DSM | 7.1 or later declared (`os_min_ver`) |
+
+The NAS file hashing example is temporarily disabled pending browser-owned
+input migration. NAS import submission returns `unsupported` without reading a
+file or creating a job; existing worker and job-control APIs remain available.

package/templates/native-node/dsm-package.yaml

@@ -49,7 +49,7 @@ backend:
   runtime: node
   dir: backend/app
   entry: main.js
-  sdk: 0.26.0
+  sdk: 0.27.0
   node: { package: Node.js_v22 }
 
 ui:

package/templates/native-node-jobs/backend/src/jobs.ts

@@ -1,38 +1,17 @@
-// Background jobs: hash a NAS file the caller may read.
-//
-// The SDK's worker runs each job as the package account: it hashes the job's
-// input (SHA-256) and keeps the result for the job's owner, the caller. The
-// runtime serves files.read with the caller's DSM session and bg.* for the
-// caller's own jobs only.
-import { copyFileSync, mkdirSync, unlinkSync } from 'node:fs'
-import { randomUUID } from 'node:crypto'
-import { basename, join } from 'node:path'
+// The NAS hashing example is disabled until browser-owned input is wired.
+// Keep caller-bound job controls; never relay a browser session from the backend.
 import { AppError, type App, type Context } from '@synopackageland/app'
 import { strings } from './params.js'
 import type { Config } from './routes.js'
 import { service } from './service.js'
 
-/** A job's input is at most 512 KiB, copied into the job when it is submitted. */
-const MAX_INPUT = 512 * 1024
-
 export function register(app: App, cfg: Config): void {
   app.method('hash.submit', (ctx, params) => submit(cfg, ctx, params))
   app.method('hash.get', (ctx, params) => service(ctx, 'bg.get', strings(params, 'id')))
   app.method('hash.cancel', (ctx, params) => service(ctx, 'bg.cancel', strings(params, 'id')))
 }
 
-async function submit(cfg: Config, ctx: Context, params: unknown) {
-  const { key, path } = strings(params, 'key', 'path')
-  const read = await service<{ path: string; size: number }>(ctx, 'files.read', { path })
-  if (read.size > MAX_INPUT) throw new AppError('limit_exceeded', 'The file is larger than allowed.')
-  // bg.submit takes its input from the data directory; the call's spool is elsewhere.
-  const inputs = join(cfg.dataDir, 'hash-inputs')
-  mkdirSync(inputs, { recursive: true, mode: 0o700 })
-  const input = join(inputs, randomUUID())
-  copyFileSync(read.path, input)
-  try {
-    return await service(ctx, 'bg.submit', { key, name: basename(path), input })
-  } finally {
-    unlinkSync(input)
-  }
+async function submit(_cfg: Config, _ctx: Context, params: unknown) {
+  strings(params, 'key', 'path')
+  throw new AppError('unsupported', "The NAS file hashing example is disabled pending browser input migration. Existing job control APIs remain available.")
 }

package/templates/native-node-jobs/backend/test/jobs.test.ts

@@ -1,60 +1,26 @@
 import assert from 'node:assert/strict'
-import { existsSync, mkdirSync, mkdtempSync, readFileSync, rmSync, writeFileSync } from 'node:fs'
+import { mkdirSync, mkdtempSync, readdirSync, rmSync } from 'node:fs'
 import { tmpdir } from 'node:os'
-import { join, sep } from 'node:path'
+import { join } from 'node:path'
 import { afterEach, beforeEach, test } from 'node:test'
 import { build, type Config } from '../src/routes.js'
-import { Refusal, call } from './support.js'
+import { call } from './support.js'
 
 const JOB = { job: { id: 'j1', state: 'queued' }, duplicate: false }
 let root: string
 let cfg: Config
-let submitted: Record<string, unknown>[]
 
 beforeEach(() => {
   root = mkdtempSync(join(tmpdir(), 'app-'))
   cfg = { packageId: 'ExampleApp', dataDir: join(root, 'var'), packagesRoot: join(root, 'packages') }
   mkdirSync(cfg.dataDir)
-  submitted = []
 })
 afterEach(() => rmSync(root, { recursive: true, force: true }))
 
-function spool(content: Buffer) {
-  const path = join(root, 'spool')
-  writeFileSync(path, content)
-  return { path, size: content.length }
-}
-
-// The runtime reads the input file while it answers bg.submit.
-function submit(params: unknown) {
-  const p = params as { input: string }
-  submitted.push({ ...p, content: readFileSync(p.input, 'utf8') })
-  return JOB
-}
-
-test('hash.submit hashes a copy of the caller\'s file', async () => {
-  const services = { 'files.read': () => spool(Buffer.from('hello')), 'bg.submit': submit }
-  const reply = await call(build(cfg), 'hash.submit', { key: 'k1', path: '/home/report.txt' }, { services })
-  assert.deepEqual(reply.data, JOB)
-  assert.deepEqual(reply.services.map(([op]) => op), ['files.read', 'bg.submit'])
-  assert.deepEqual(reply.services[0]![1], { path: '/home/report.txt' })
-  const [job] = submitted as [{ key: string; name: string; content: string; input: string }]
-  assert.deepEqual([job.key, job.name, job.content], ['k1', 'report.txt', 'hello'])
-  assert.ok(job.input.startsWith(cfg.dataDir + sep), job.input)
-  assert.equal(existsSync(job.input), false, 'the copy is removed once submitted')
-})
-
-test('hash.submit refuses a file over the job input limit', async () => {
-  const services = { 'files.read': () => spool(Buffer.alloc(512 * 1024 + 1)), 'bg.submit': submit }
-  const reply = await call(build(cfg), 'hash.submit', { key: 'k1', path: '/home/big.bin' }, { services })
-  assert.equal(reply.error?.code, 'limit_exceeded')
-  assert.deepEqual(submitted, [])
-})
-
-test('hash.submit passes on the runtime\'s refusal', async () => {
-  const services = { 'files.read': () => { throw new Refusal('read_failed', 'Unable to read the file.') } }
-  const reply = await call(build(cfg), 'hash.submit', { key: 'k1', path: '/home/a' }, { services })
-  assert.equal(reply.error?.code, 'read_failed')
+test('the NAS hash example refuses without services or persistent writes', async () => {
+  const reply = await call(build(cfg), 'hash.submit', { key: 'k1', path: '/home/report.txt' })
+  assert.deepEqual([reply.error?.code, reply.services], ['unsupported', []])
+  assert.deepEqual(readdirSync(cfg.dataDir), [])
 })
 
 test('hash.submit refuses invalid params before any service', async () => {

package/templates/native-python/README.md

@@ -108,7 +108,7 @@ rebuilding the SPK.
 
 | `--with` | Methods | Runtime services |
 | --- | --- | --- |
-| `jobs` | `hash.submit`, `hash.get`, `hash.cancel` | `files.read` with the caller's session, `bg.submit`, `bg.get`, `bg.cancel` |
+| `jobs` | `hash.submit`, `hash.get`, `hash.cancel` | `hash.submit` is disabled pending browser input migration; `bg.get` and `bg.cancel` remain available |
 | `root-ops` | `whoami.run` | `root.run` of `root/whoami.sh`, once an administrator approves the executor |
 | `delegate` | `report.save` | `delegate.move_from_staging` into a folder the caller chose |
 
@@ -155,3 +155,7 @@ ticks **Also delete the app data listed above** in the uninstall wizard.
 | Build hosts | macOS, Linux |
 | Target CPUs | x86_64 and aarch64 DSM models (one SPK each); armv7 is opt-in in `arches`, built but not NAS-verified |
 | DSM | 7.1 or later declared (`os_min_ver`) |
+
+The NAS file hashing example is temporarily disabled pending browser-owned
+input migration. NAS import submission returns `unsupported` without reading a
+file or creating a job; existing worker and job-control APIs remain available.

package/templates/native-python/dsm-package.yaml

@@ -47,7 +47,7 @@ backend:
   runtime: python
   dir: backend/app
   entry: main.py
-  sdk: 0.26.0
+  sdk: 0.27.0
 
 ui:
   # Non-UI-SDK frontends open a full page; Portal is a separate opt-in.

package/templates/native-python-jobs/backend/app/jobs.py

@@ -1,22 +1,10 @@
-"""Background jobs: hash a NAS file the caller may read.
+"""The NAS hashing example is disabled until browser-owned input is wired.
 
-The SDK's worker runs each job as the package account: it hashes the job's
-input (SHA-256) and keeps the result for the job's owner, the caller. The
-runtime serves files.read with the caller's DSM session and bg.* for the
-caller's own jobs only.
+Caller-bound job controls remain available; no backend session replay is used.
 """
-
-import os
-import shutil
-import tempfile
-
 from synopkgland_app import Error
-
 from params import fields
 
-# A job's input is at most 512 KiB, copied into the job when it is submitted.
-MAX_INPUT = 512 * 1024
-
 
 def register(app, cfg):
     app.method("hash.submit")(lambda ctx, params: submit(cfg, ctx, params))
@@ -25,16 +13,5 @@ def register(app, cfg):
 
 
 def submit(cfg, ctx, params):
-    p = fields(params, key=str, path=str)
-    read = ctx.runtime("files.read", {"path": p["path"]})
-    if read["size"] > MAX_INPUT:
-        raise Error("limit_exceeded", "The file is larger than allowed.")
-    # bg.submit takes its input from the data directory; the call's spool is elsewhere.
-    inputs = os.path.join(cfg.data_dir, "hash-inputs")
-    os.makedirs(inputs, mode=0o700, exist_ok=True)
-    with open(read["path"], "rb") as source, tempfile.NamedTemporaryFile(dir=inputs, delete=False) as copy:
-        shutil.copyfileobj(source, copy)
-    try:
-        return ctx.runtime("bg.submit", {"key": p["key"], "name": os.path.basename(p["path"]), "input": copy.name})
-    finally:
-        os.unlink(copy.name)
+    fields(params, key=str, path=str)
+    raise Error("unsupported", "The NAS file hashing example is disabled pending browser input migration. Existing job control APIs remain available.")

package/templates/native-python-jobs/backend/tests/test_jobs.py

@@ -2,7 +2,7 @@ import os
 import tempfile
 import unittest
 
-from support import Error, call
+from support import call
 
 import routes
 
@@ -16,43 +16,11 @@ class JobsTest(unittest.TestCase):
         self.data = os.path.join(self.dir.name, "var")
         os.mkdir(self.data)
         self.app = routes.build(routes.Config("ExampleApp", self.data))
-        self.submitted = []
 
-    def spool(self, content):
-        path = os.path.join(self.dir.name, "spool")
-        with open(path, "wb") as f:
-            f.write(content)
-        return {"path": path, "size": len(content)}
-
-    def submit(self, params):
-        # The runtime reads the input file while it answers bg.submit.
-        with open(params["input"], "rb") as f:
-            self.submitted.append(dict(params, content=f.read()))
-        return JOB
-
-    def test_submit_hashes_a_copy_of_the_callers_file(self):
-        services = {"files.read": lambda p: self.spool(b"hello"), "bg.submit": self.submit}
-        reply = call(self.app, "hash.submit", {"key": "k1", "path": "/home/report.txt"}, services=services)
-        self.assertEqual(reply.data, JOB)
-        self.assertEqual([op for op, _ in reply.services], ["files.read", "bg.submit"])
-        self.assertEqual(reply.services[0][1], {"path": "/home/report.txt"})
-        [submitted] = self.submitted
-        self.assertEqual((submitted["key"], submitted["name"], submitted["content"]), ("k1", "report.txt", b"hello"))
-        self.assertTrue(submitted["input"].startswith(self.data + os.sep))
-        self.assertFalse(os.path.exists(submitted["input"]), "the copy is removed once submitted")
-
-    def test_submit_refuses_a_file_over_the_job_input_limit(self):
-        services = {"files.read": lambda p: self.spool(b"x" * (512 * 1024 + 1)), "bg.submit": self.submit}
-        reply = call(self.app, "hash.submit", {"key": "k1", "path": "/home/big.bin"}, services=services)
-        self.assertEqual(reply.error["code"], "limit_exceeded")
-        self.assertEqual(self.submitted, [])
-
-    def test_submit_passes_on_the_runtimes_refusal(self):
-        def unreadable(params):
-            raise Error("read_failed", "Unable to read the file.")
-
-        reply = call(self.app, "hash.submit", {"key": "k1", "path": "/home/a"}, services={"files.read": unreadable})
-        self.assertEqual(reply.error["code"], "read_failed")
+    def test_nas_hash_example_refuses_without_services_or_writes(self):
+        reply = call(self.app, "hash.submit", {"key": "k1", "path": "/home/report.txt"})
+        self.assertEqual((reply.error["code"], reply.services), ("unsupported", []))
+        self.assertEqual(os.listdir(self.data), [])
 
     def test_submit_refuses_invalid_params_before_any_service(self):
         for params in [None, {"key": "k1"}, {"key": 1, "path": "/home/a"}, {"key": "k1", "path": "/home/a", "x": 1}]:

package/templates/native-rust/README.md

@@ -117,7 +117,7 @@ rebuilding the SPK.
 
 | `--with` | Methods | Runtime services |
 | --- | --- | --- |
-| `jobs` | `hash.submit`, `hash.get`, `hash.cancel` | `files.read` with the caller's session, `bg.submit`, `bg.get`, `bg.cancel` |
+| `jobs` | `hash.submit`, `hash.get`, `hash.cancel` | `hash.submit` is disabled pending browser input migration; `bg.get` and `bg.cancel` remain available |
 | `root-ops` | `whoami.run` | `root.run` of `root/whoami.sh`, once an administrator approves the executor |
 | `delegate` | `report.save` | `delegate.move_from_staging` into a folder the caller chose |
 
@@ -164,3 +164,7 @@ ticks **Also delete the app data listed above** in the uninstall wizard.
 | Build hosts | macOS, Linux |
 | Target CPUs | x86_64 and aarch64 DSM models (one SPK each); armv7 is opt-in in `arches`, built but not NAS-verified |
 | DSM | 7.1 or later declared (`os_min_ver`) |
+
+The NAS file hashing example is temporarily disabled pending browser-owned
+input migration. NAS import submission returns `unsupported` without reading a
+file or creating a job; existing worker and job-control APIs remain available.

package/templates/native-rust/backend/Cargo.lock

@@ -104,8 +104,8 @@ dependencies = [
 
 [[package]]
 name = "syno-pkg-land-app"
-version = "0.26.0"
-source = "git+https://github.com/synopackageland/syno-pkg-land-sdk?tag=v0.26.0#ff3b079cf034e12ce69e936e4fefb010cd010b3d"
+version = "0.27.0"
+source = "git+https://github.com/synopackageland/syno-pkg-land-sdk?tag=v0.27.0#a10253ad1c94b647f4b626d9b99591b5dc2571a1"
 dependencies = [
  "libc",
  "serde",

package/templates/native-rust/backend/Cargo.toml

@@ -9,7 +9,7 @@ libc = "0.2"
 serde = { version = "1", features = ["derive"] }
 serde_json = "1"
 # The SDK version is the tag; `synopkgland check` reads it from Cargo.lock.
-syno-pkg-land-app = { git = "https://github.com/synopackageland/syno-pkg-land-sdk", tag = "v0.26.0" }
+syno-pkg-land-app = { git = "https://github.com/synopackageland/syno-pkg-land-sdk", tag = "v0.27.0" }
 
 [profile.release]
 # A handler panic becomes an "internal" reply; abort would end the App without one.

package/templates/native-rust-jobs/backend/src/jobs.rs

@@ -1,90 +1,38 @@
-//! Background jobs: hash a NAS file the caller may read.
-//!
-//! The SDK's worker runs each job as the package account: it hashes the job's
-//! input (SHA-256) and keeps the result for the job's owner, the caller. The
-//! runtime serves files.read with the caller's DSM session and bg.* for the
-//! caller's own jobs only.
-
-use crate::routes::{Config, internal};
+//! NAS hashing is disabled until browser-owned input is wired; job controls remain.
+use crate::routes::Config;
 use serde::Deserialize;
 use serde_json::{Value, json};
-use std::os::unix::fs::DirBuilderExt;
-use std::path::{Path, PathBuf};
 use syno_pkg_land_app::{App, Context, Error, Params};
 
-/// A job's input is at most 512 KiB, copied into the job when it is submitted.
-const MAX_INPUT: u64 = 512 * 1024;
-
 #[derive(Deserialize)]
 #[serde(deny_unknown_fields)]
 struct Submit {
     key: String,
     path: String,
 }
-
 #[derive(Deserialize)]
 #[serde(deny_unknown_fields)]
 struct JobId {
     id: String,
 }
 
-#[derive(Deserialize)]
-struct Read {
-    path: PathBuf,
-    size: u64,
-}
-
-pub fn register(app: &mut App, cfg: &Config) {
-    let cfg = cfg.clone();
-    app.method("hash.submit", move |ctx, params| submit(&cfg, ctx, params));
+pub fn register(app: &mut App, _cfg: &Config) {
+    app.method("hash.submit", |_ctx, params| -> Result<Value, Error> {
+  let Submit { key, path } = params.decode()?;
+  let _ = (key, path);
+  Err(Error::new("unsupported", "The NAS file hashing example is disabled pending browser input migration. Existing job control APIs remain available."))
+ });
     app.method("hash.get", |ctx, params| job(ctx, "bg.get", params));
     app.method("hash.cancel", |ctx, params| job(ctx, "bg.cancel", params));
 }
-
 fn job(ctx: &Context, op: &str, params: &Params) -> Result<Value, Error> {
     let JobId { id } = params.decode()?;
     ctx.runtime(op, &json!({"id": id}))
 }
-
-fn submit(cfg: &Config, ctx: &Context, params: &Params) -> Result<Value, Error> {
-    let p: Submit = params.decode()?;
-    let read: Read = ctx.runtime("files.read", &json!({"path": p.path}))?;
-    if read.size > MAX_INPUT {
-        return Err(Error::new(
-            "limit_exceeded",
-            "The file is larger than allowed.",
-        ));
-    }
-    // bg.submit takes its input from the data directory; the call's spool is elsewhere.
-    let inputs = cfg.data_dir.join("hash-inputs");
-    std::fs::DirBuilder::new()
-        .recursive(true)
-        .mode(0o700)
-        .create(&inputs)
-        .map_err(internal)?;
-    let copy = inputs.join(&ctx.request_id);
-    std::fs::copy(&read.path, &copy).map_err(internal)?;
-    let name = Path::new(&p.path)
-        .file_name()
-        .map_or(String::new(), |n| n.to_string_lossy().into_owned());
-    let submitted = ctx.runtime(
-        "bg.submit",
-        &json!({"key": p.key, "name": name, "input": copy}),
-    );
-    let _ = std::fs::remove_file(&copy);
-    submitted
-}
-
 #[cfg(test)]
 mod tests {
     use super::*;
     use crate::test_support::{Services, TempDir, call};
-    use serde_json::{Value, json};
-    use std::sync::{Arc, Mutex};
-
-    /// What bg.submit was asked: its params and the input it read.
-    type Submitted = Arc<Mutex<Vec<(Value, Vec<u8>)>>>;
-
     fn setup() -> (TempDir, Config) {
         let dir = TempDir::new();
         let cfg = Config {
@@ -100,94 +48,19 @@ mod tests {
         json!({"job": {"id": "j1", "state": "queued"}, "duplicate": false})
     }
 
-    /// files.read answers a spool file with content; bg.submit records its params and the input it read.
-    fn services(dir: &TempDir, content: Vec<u8>, submitted: &Submitted) -> Services {
-        let spool = dir.path().join("spool");
-        std::fs::write(&spool, &content).unwrap();
-        let read = json!({"path": spool, "size": content.len()});
-        let submitted = submitted.clone();
-        [
-            (
-                "files.read",
-                Box::new(move |_: &Value| Ok(read.clone())) as _,
-            ),
-            (
-                "bg.submit",
-                Box::new(move |p: &Value| {
-                    // The runtime reads the input file while it answers bg.submit.
-                    let input = std::fs::read(p["input"].as_str().unwrap()).unwrap();
-                    submitted.lock().unwrap().push((p.clone(), input));
-                    Ok(job())
-                }) as _,
-            ),
-        ]
-        .into()
-    }
-
-    #[test]
-    fn submit_hashes_a_copy_of_the_callers_file() {
-        let (dir, cfg) = setup();
-        let submitted = Arc::new(Mutex::new(Vec::new()));
-        let services = services(&dir, b"hello".to_vec(), &submitted);
-        let reply = call(
-            crate::routes::build(cfg.clone()),
-            "hash.submit",
-            json!({"key": "k1", "path": "/home/report.txt"}),
-            "alice",
-            &services,
-        );
-        assert_eq!(reply.data, job());
-        let ops: Vec<_> = reply.services.iter().map(|(op, _)| op.as_str()).collect();
-        assert_eq!(ops, ["files.read", "bg.submit"]);
-        assert_eq!(reply.services[0].1, json!({"path": "/home/report.txt"}));
-        let submitted = submitted.lock().unwrap();
-        let (params, content) = &submitted[0];
-        assert_eq!(
-            (&params["key"], &params["name"], content.as_slice()),
-            (&json!("k1"), &json!("report.txt"), b"hello".as_slice())
-        );
-        let input = params["input"].as_str().unwrap();
-        assert!(input.starts_with(cfg.data_dir.to_str().unwrap()), "{input}");
-        assert!(
-            !std::path::Path::new(input).exists(),
-            "the copy is removed once submitted"
-        );
-    }
-
     #[test]
-    fn submit_refuses_a_file_over_the_job_input_limit() {
-        let (dir, cfg) = setup();
-        let submitted = Arc::new(Mutex::new(Vec::new()));
-        let services = services(&dir, vec![0; MAX_INPUT as usize + 1], &submitted);
-        let reply = call(
-            crate::routes::build(cfg),
-            "hash.submit",
-            json!({"key": "k1", "path": "/home/big.bin"}),
-            "alice",
-            &services,
-        );
-        assert_eq!(reply.code(), "limit_exceeded");
-        assert!(submitted.lock().unwrap().is_empty());
-    }
-
-    #[test]
-    fn submit_passes_on_the_runtimes_refusal() {
+    fn nas_hash_example_refuses_without_services_or_writes() {
         let (_dir, cfg) = setup();
-        let services: Services = [(
-            "files.read",
-            Box::new(|_: &Value| Err(Error::new("read_failed", "Unable to read the file."))) as _,
-        )]
-        .into();
         let reply = call(
-            crate::routes::build(cfg),
+            crate::routes::build(cfg.clone()),
             "hash.submit",
-            json!({"key": "k1", "path": "/home/a"}),
+            json!({"key":"k1","path":"/home/report.txt"}),
             "alice",
-            &services,
+            &Services::new(),
         );
-        assert_eq!(reply.code(), "read_failed");
+        assert_eq!((reply.code(), reply.services.len()), ("unsupported", 0));
+        assert_eq!(std::fs::read_dir(&cfg.data_dir).unwrap().count(), 0);
     }
-
     #[test]
     fn submit_refuses_invalid_params_before_any_service() {
         let (_dir, cfg) = setup();