@synopackageland/templates 0.26.5 → 0.27.0

package/README.md

@@ -22,8 +22,8 @@ daemon:
     window_seconds: 300
 ```
 
-Templates 0.26.5 pin SDK 0.27.0 in native and Compose projects.
-Daemon restart declarations need CLI 0.26.0 or later. Go Apps select
+Templates 0.27.0 inherit UI 0.14.9 from 0.26.5 and pin SDK 0.27.0 in native and Compose projects.
+Use CLI 0.27.0 or later. Go Apps select
 their controller from their Go SDK requirement; an identity gateway selects it
 from `identity_gateway.sdk`. The CLI rejects older selected versions, even for
 an explicit `mode: off`, rather than dropping the declaration. A local SDK source
@@ -214,3 +214,13 @@ the single-call path. Each batch result is handled separately; the shell stays
 visible while reads run. The backend permissions remain authoritative.
 
 Native Node Apps use the official [`Node.js_v22`](https://www.synology.com/en-us/dsm/packages/Node.js_v22) package. The official release history lists DSM 7 series; installation also depends on the model and DSM version supported by Package Center. This dependency does not certify all DSM 7 releases or install Node.js on unsupported models.
+
+### Temporarily disabled NAS hashing example
+
+SDK 0.27.0 no longer relays browser DSM sessions from a backend. This release
+explicitly disables the template NAS file hashing example: Go production
+`bg.browse`/`bg.jobs.submit` and bridge `hash.submit` return `unsupported` before
+reading a file or creating a job. The Vue background example page displays an
+unavailable notice. Existing job list/status/pause/resume/cancel/schedule APIs
+and workers remain available for App-owned input; no SDK API or special option
+is introduced. A safe browser-owned input flow is follow-up work.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@synopackageland/templates",
-  "version": "0.26.5",
+  "version": "0.27.0",
   "description": "Project templates for synopkgland init: native-go, native-python, native-node and native-rust (plain or Vue, with jobs, delegate and root-ops overlays), binary and compose.",
   "license": "MIT",
   "repository": {

package/templates/_shared/AGENTS.md

@@ -110,6 +110,10 @@ may redistribute; never copy Synology's.
 
 ## Background jobs (`jobs`)
 
+The NAS hashing example is temporarily disabled pending browser-owned input
+migration. Do not use backend DSM session replay or `files.read` to restore it.
+Existing workers and job-control APIs remain available for App-owned input.
+
 The worker runs the App's Work for one claimed job at a time, as the package
 account. The Work receives the job's Task: it reads the private input copy,
 reports progress (`done`/`total`, `bytes`/`totalBytes`, `item`) and saves a
@@ -265,8 +269,7 @@ sweep forward the cancel instead of admitting it.
 The SDK runtime is the CGI: it checks the DSM session, the entry gate and
 permissions.json, then runs the App once per call, as the package account, and
 answers the browser itself for every refusal. The App only registers methods
-and asks the runtime for services with `ctx.runtime(op, params)`: `files.read`
-(the caller's file, `files: session`), `bg.submit`/`bg.get`/`bg.cancel` (the
+and asks the runtime for services with `ctx.runtime(op, params)`: `bg.submit`/`bg.get`/`bg.cancel` (the
 caller's jobs, `jobs: true`, whose worker hashes each job's input), `root.run`
 (`rootOps`), `delegate.move_from_staging` (`delegate`) and `portal.status`. A
 service refusal is a code the browser may see; pass it on. The admin guard

package/templates/native-go/README.md

@@ -399,3 +399,7 @@ SDK's `docs/shared-folder.md` for the whole flow.
 | Target CPUs | x86_64 and aarch64 DSM models (one SPK each). armv7 (DSM 7.2+ platforms `alpine`, `alpine4k`, `armada38x`, `monaco`) is opt-in: add it to `arches`; it covers the Go CGI (plain or Vue UI), jobs, daemon, root-ops and delegate. armv7 jobs, daemon and executor (root-ops, delegate) are built and checked locally but have not been verified on a NAS |
 | DSM | 7.1 or later declared (`os_min_ver`, change it with `init --min-dsm` or `build --min-dsm`). Installed and tested on DSM 7.4 and 7.3.2 (x86_64). armv7 was installed and tested on DSM 7.1.1 (`alpine4k`, Linux 3.10, where the bridge runs from the package tmp fallback) with administrator, AppPriv and unauthenticated requests; `armada38x` and `monaco` have not been run on a NAS. No x86_64 Linux 3.10 model has been tested. aarch64 SPKs are built the same way but have not been run on a NAS. |
 | Not supported | armv7 platforms only DSM 7.0/7.1 ship (`armada370`, `armada375`, `armadaxp`, `comcerto2k`); DSM 6, running anything as root without an administrator's approval |
+
+The NAS file hashing example is temporarily disabled pending browser-owned
+input migration. NAS import submission returns `unsupported` without reading a
+file or creating a job; existing worker and job-control APIs remain available.

package/templates/native-go/backend/internal/app/background.go

@@ -42,10 +42,11 @@ type backgroundAPI struct {
 }
 
 // BackgroundRoutes is the production assembly of the opt-in background jobs
-// API. `synopkgland init --with jobs` wires it in through background.go's
+// API. The NAS hashing example is disabled until browser-owned input is wired.
+// Existing job control routes remain available. `synopkgland init --with jobs` wires it in through background.go's
 // replacement of background_none.go; nothing else references it.
 func BackgroundRoutes(dataDir string) []api.Route {
-	return newBackgroundRoutes(background.NewRequestStore(filepath.Join(dataDir, "background")), filestation.Local(dataDir))
+	return newBackgroundRoutes(background.NewRequestStore(filepath.Join(dataDir, "background")), nil)
 }
 
 // Every request authenticates against DSM afresh. Owner routes are available
@@ -129,6 +130,9 @@ func (b backgroundAPI) browse(ctx context.Context, c api.Caller, r *http.Request
 	if in.Offset < 0 {
 		return nil, api.BadRequest("offset must not be negative")
 	}
+	if b.files == nil {
+		return nil, &api.Error{Code: "unsupported", Message: "The NAS file hashing example is disabled pending browser input migration. Existing job control APIs remain available."}
+	}
 	return b.files.Browse(ctx, c, r, in.Folder, in.Offset)
 }
 
@@ -148,6 +152,9 @@ func (b backgroundAPI) submit(ctx context.Context, c api.Caller, r *http.Request
 	if !access.Owner.Valid() {
 		return nil, &api.Error{Code: "identity_unavailable", Message: "DSM user UID could not be resolved"}
 	}
+	if b.files == nil {
+		return nil, &api.Error{Code: "unsupported", Message: "The NAS file hashing example is disabled pending browser input migration. Existing job control APIs remain available."}
+	}
 	data, err := b.files.ReadFile(ctx, c, r, in.Folder, in.Relative)
 	if err != nil {
 		return nil, err

package/templates/native-go-delegate/backend/internal/app/delegate.go

@@ -4,7 +4,6 @@ import (
 	"github.com/synopackageland/syno-pkg-land-sdk/api"
 	"github.com/synopackageland/syno-pkg-land-sdk/background"
 	"github.com/synopackageland/syno-pkg-land-sdk/delegate"
-	"github.com/synopackageland/syno-pkg-land-sdk/filestation"
 	"path/filepath"
 )
 
@@ -16,10 +15,5 @@ func DelegateRoutes(cfg Config, scope string) []api.Route {
 	if err == nil {
 		service.Destinations, service.Operations, service.Lifetime = settings.Destinations, settings.Operations, settings.Lifetime
 	}
-	if cfg.SessionFiles != nil {
-		service.SessionFiles = cfg.SessionFiles
-	} else {
-		service.SessionFiles = filestation.Local(cfg.DataDir)
-	}
 	return service.Routes()
 }

package/templates/native-go-jobs/backend/internal/app/background_routes_test.go

@@ -90,3 +90,17 @@ func TestBackgroundRequestSubmitBusyAndProductionConstruction(t *testing.T) {
 		t.Fatal(w.Body.String())
 	}
 }
+
+func TestProductionNASHashExampleRefusesWithoutCreatingJobs(t *testing.T) {
+	cfg := testConfig(t)
+	for _, method := range []string{"bg.browse", "bg.jobs.submit"} {
+		code, _ := call(t, cfg, alice, method, sampleParams[method])
+		if code != "unsupported" {
+			t.Fatalf("%s: %s", method, code)
+		}
+	}
+	jobs, err := background.NewStore(filepath.Join(cfg.DataDir, "background")).List(context.Background())
+	if err != nil || len(jobs) != 0 {
+		t.Fatalf("disabled example created jobs: %v %v", jobs, err)
+	}
+}

package/templates/native-go-jobs/frontend/test/background-page.test.ts

@@ -4,8 +4,8 @@ import {nextTick} from 'vue'
 import {mount} from '../src/main'
 import {dsmWindow} from './context'
 async function settle(){for(let i=0;i<20;i++){await Promise.resolve();await nextTick()}}
-// The CLI turns the background page on for jobs (and delegate) projects only.
-test('a jobs project mounts the background panel for the signed-in user',async()=>{
+// The file-import example is explicitly unavailable until browser input is migrated.
+test('a jobs project explains the disabled example without submitting or reading files',async()=>{
  const call=vi.fn(async(method:string)=>{
   if(method==='app.status')return {package:'Jobs',version:'1',user:'alice',admin:false}
   throw {code:'unknown_method'}
@@ -14,46 +14,8 @@ test('a jobs project mounts the background panel for the signed-in user',async()
  const app=mount(root,dsmWindow({call}))
  try{
   await settle()
-  expect(call.mock.calls.some(([method])=>method.startsWith('bg.'))).toBe(true)
-  expect(root.querySelector('[data-page="background"]')).not.toBeNull()
- }finally{app.unmount();root.remove()}
-})
-test('the background panel pauses a running job and resumes a paused one',async()=>{
- const submitter={user:'alice',uid:'1024'}
- const jobs=[{id:'run',name:'a.bin',state:'running',submitter},{id:'held',name:'b.bin',state:'paused',pauseReason:'user',submitter}]
- const call=vi.fn(async(method:string):Promise<unknown>=>{
-  if(method==='app.status')return {package:'Jobs',version:'1',user:'alice',admin:false}
-  if(method==='bg.status')return {owner:submitter,admin:false,revision:1,worker:{username:'pkg',alive:true},limits:{maxInputBytes:1024,maxQueued:8,maxOwnerPending:4,maxOwnerBytes:4096,jobTimeoutSeconds:60}}
-  if(method==='bg.jobs.list')return {jobs}
-  if(method==='bg.schedules.list')return {schedules:[]}
-  return {}
- })
- const root=document.createElement('div');document.body.append(root)
- const app=mount(root,dsmWindow({call}))
- const button=(id:string,label:string)=>Array.from(root.querySelectorAll(`[data-job-id="${id}"] button`)).find(b=>b.textContent===label) as HTMLButtonElement|undefined
- try{
-  await settle()
-  button('run','Pause')!.click();await settle()
-  expect(call).toHaveBeenCalledWith('bg.jobs.pause',{id:'run'})
-  button('held','Resume')!.click();await settle()
-  expect(call).toHaveBeenCalledWith('bg.jobs.resume',{id:'held'})
- }finally{app.unmount();root.remove()}
-})
-test('the header Refresh reloads the background panel',async()=>{
- const call=vi.fn(async(method:string):Promise<unknown>=>{
-  if(method==='app.status')return {package:'Jobs',version:'1',user:'alice',admin:false}
-  if(method==='bg.status')return {owner:{user:'alice',uid:'1024'},admin:false,revision:1,worker:{username:'pkg',alive:true},limits:{maxInputBytes:1024,maxQueued:8,maxOwnerPending:4,maxOwnerBytes:4096,jobTimeoutSeconds:60}}
-  if(method==='bg.jobs.list')return {jobs:[]}
-  if(method==='bg.schedules.list')return {schedules:[]}
-  return {}
- })
- const root=document.createElement('div');document.body.append(root)
- const app=mount(root,dsmWindow({call}))
- const reads=()=>call.mock.calls.filter(([method])=>method==='bg.jobs.list').length
- try{
-  await settle();const before=reads()
-  // The header button comes first; the panels below may have their own.
-  ;(Array.from(root.querySelectorAll('button')).find(b=>b.textContent==='Refresh') as HTMLButtonElement).click();await settle()
-  expect(reads()).toBeGreaterThan(before)
+  expect(root.querySelector('[data-background-example-disabled]')?.textContent).toContain('disabled')
+  expect(root.querySelector('[data-background-panel]')).toBeNull()
+  expect(call.mock.calls.some(([method])=>method.startsWith('bg.'))).toBe(false)
  }finally{app.unmount();root.remove()}
 })

package/templates/native-go-vue/frontend/src/App.vue

@@ -2,7 +2,7 @@
 import {computed, onMounted, onUnmounted, ref, watch} from 'vue'
 import {Button, Callout, Form, FormActions, FormItem, KeyValueRow, SettingsSection, Textarea} from '@synopackageland/ui'
 import {bridgeErrorCopy, sharedFolderAccessFor, type AppStatus, type Context, type ShellPage} from '@synopackageland/sdk'
-import {AppShell, BackgroundPanel, FilesPage, LoginPage, PortalSettings, SharedFolderSettings, createSession, shellPages} from '@synopackageland/sdk/vue'
+import {AppShell, FilesPage, LoginPage, PortalSettings, SharedFolderSettings, createSession, shellPages} from '@synopackageland/sdk/vue'
 import {appCopy} from './i18n'
 import CapabilityPanels from './CapabilityPanels.vue'
 import ExecutorGate, {holdsPages} from './ExecutorGate.vue'
@@ -66,11 +66,10 @@ async function refresh() {
 }
 // The header Refresh also reloads the panels below and reads the portal again.
 const panels = ref<{refresh(): unknown}>()
-const background = ref<{refresh(): unknown}>()
 const portalReads = ref(0)
 const portalKey = computed(() => `${app.value?.user}:${portalReads.value}`)
 function refreshAll() {
- void refresh(); void panels.value?.refresh(); void background.value?.refresh(); portalReads.value++
+ void refresh(); void panels.value?.refresh(); portalReads.value++
 }
 async function save() {
  if(disposed || busy.value) return
@@ -122,7 +121,7 @@ onUnmounted(()=>{disposed=true;unsubscribe?.();login.dispose();text.value=''})
    <CapabilityPanels v-if="app" ref="panels" :key="app.user" :ctx="ctx" :admin="app.admin" />
    <FilesPage v-if="page==='status'" :ctx="ctx" />
    <div data-page="background" v-show="page==='background'">
-    <BackgroundPanel v-if="backgroundEnabled && app" ref="background" :key="app.user" :ctx="ctx" />
+    <Callout v-if="backgroundEnabled && app" tone="warning" data-background-example-disabled>{{ copy.backgroundExampleUnavailable }}</Callout>
    </div>
   </div>
   </ExecutorGate>

package/templates/native-go-vue/frontend/src/i18n/de.json

@@ -17,5 +17,6 @@
   },
   "packageName": "Paketname",
   "user": "Benutzer",
-  "version": "Version"
+  "version": "Version",
+  "backgroundExampleUnavailable": "Das NAS-Datei-Hash-Beispiel ist bis zur Umstellung auf Browser-Eingaben deaktiviert. Bestehende APIs zur Auftragssteuerung bleiben verfügbar"
 }

package/templates/native-go-vue/frontend/src/i18n/en.json

@@ -17,5 +17,6 @@
   },
   "packageName": "Package name",
   "user": "User",
-  "version": "Version"
+  "version": "Version",
+  "backgroundExampleUnavailable": "The NAS file hashing example is disabled pending browser input migration. Existing job control APIs remain available"
 }

package/templates/native-go-vue/frontend/src/i18n/es.json

@@ -17,5 +17,6 @@
   },
   "packageName": "Nombre del paquete",
   "user": "Usuario",
-  "version": "Versión"
+  "version": "Versión",
+  "backgroundExampleUnavailable": "El ejemplo de hash de archivos NAS está desactivado hasta migrar la entrada al navegador. Las API de control de trabajos siguen disponibles"
 }

package/templates/native-go-vue/frontend/src/i18n/fr.json

@@ -17,5 +17,6 @@
   },
   "packageName": "Nom du paquet",
   "user": "Utilisateur",
-  "version": "Version"
+  "version": "Version",
+  "backgroundExampleUnavailable": "L’exemple de hachage de fichiers NAS est désactivé en attendant la migration des entrées du navigateur. Les API de contrôle des tâches restent disponibles"
 }

package/templates/native-go-vue/frontend/src/i18n/it.json

@@ -17,5 +17,6 @@
   },
   "packageName": "Nome pacchetto",
   "user": "Utente",
-  "version": "Versione"
+  "version": "Versione",
+  "backgroundExampleUnavailable": "L’esempio di hashing dei file NAS è disabilitato in attesa della migrazione dell’input dal browser. Le API di controllo dei processi restano disponibili"
 }

package/templates/native-go-vue/frontend/src/i18n/ja.json

@@ -17,5 +17,6 @@
   },
   "packageName": "パッケージ名",
   "user": "ユーザー",
-  "version": "バージョン"
+  "version": "バージョン",
+  "backgroundExampleUnavailable": "NAS ファイルのハッシュ例はブラウザー入力への移行まで無効です。既存のジョブ制御 API は利用できます"
 }

package/templates/native-go-vue/frontend/src/i18n/ko.json

@@ -17,5 +17,6 @@
   },
   "packageName": "패키지 이름",
   "user": "사용자",
-  "version": "버전"
+  "version": "버전",
+  "backgroundExampleUnavailable": "브라우저 입력 전환이 완료될 때까지 NAS 파일 해시 예제를 사용할 수 없습니다. 기존 작업 제어 API는 계속 사용할 수 있습니다"
 }

package/templates/native-go-vue/frontend/src/i18n/zh-CN.json

@@ -17,5 +17,6 @@
   },
   "packageName": "套件名称",
   "user": "用户帐号",
-  "version": "版本"
+  "version": "版本",
+  "backgroundExampleUnavailable": "本版本暂停 NAS 文件哈希示例，待浏览器输入流程完成后恢复。现有任务控制 API 仍可使用"
 }

package/templates/native-go-vue/frontend/src/i18n/zh-TW.json

@@ -17,5 +17,6 @@
   },
   "packageName": "套件名稱",
   "user": "使用者帳號",
-  "version": "版本"
+  "version": "版本",
+  "backgroundExampleUnavailable": "本版本暫停 NAS 檔案雜湊範例，待瀏覽器輸入流程完成後恢復。既有工作控制 API 仍可使用"
 }

package/templates/native-node/README.md

@@ -111,7 +111,7 @@ rebuilding the SPK.
 
 | `--with` | Methods | Runtime services |
 | --- | --- | --- |
-| `jobs` | `hash.submit`, `hash.get`, `hash.cancel` | `files.read` with the caller's session, `bg.submit`, `bg.get`, `bg.cancel` |
+| `jobs` | `hash.submit`, `hash.get`, `hash.cancel` | `hash.submit` is disabled pending browser input migration; `bg.get` and `bg.cancel` remain available |
 | `root-ops` | `whoami.run` | `root.run` of `root/whoami.sh`, once an administrator approves the executor |
 | `delegate` | `report.save` | `delegate.move_from_staging` into a folder the caller chose |
 
@@ -158,3 +158,7 @@ ticks **Also delete the app data listed above** in the uninstall wizard.
 | Build hosts | macOS, Linux |
 | Target CPUs | x86_64 and aarch64 DSM models (one SPK each); armv7 is opt-in in `arches`, built but not NAS-verified |
 | DSM | 7.1 or later declared (`os_min_ver`) |
+
+The NAS file hashing example is temporarily disabled pending browser-owned
+input migration. NAS import submission returns `unsupported` without reading a
+file or creating a job; existing worker and job-control APIs remain available.

package/templates/native-node-jobs/backend/src/jobs.ts

@@ -1,38 +1,17 @@
-// Background jobs: hash a NAS file the caller may read.
-//
-// The SDK's worker runs each job as the package account: it hashes the job's
-// input (SHA-256) and keeps the result for the job's owner, the caller. The
-// runtime serves files.read with the caller's DSM session and bg.* for the
-// caller's own jobs only.
-import { copyFileSync, mkdirSync, unlinkSync } from 'node:fs'
-import { randomUUID } from 'node:crypto'
-import { basename, join } from 'node:path'
+// The NAS hashing example is disabled until browser-owned input is wired.
+// Keep caller-bound job controls; never relay a browser session from the backend.
 import { AppError, type App, type Context } from '@synopackageland/app'
 import { strings } from './params.js'
 import type { Config } from './routes.js'
 import { service } from './service.js'
 
-/** A job's input is at most 512 KiB, copied into the job when it is submitted. */
-const MAX_INPUT = 512 * 1024
-
 export function register(app: App, cfg: Config): void {
   app.method('hash.submit', (ctx, params) => submit(cfg, ctx, params))
   app.method('hash.get', (ctx, params) => service(ctx, 'bg.get', strings(params, 'id')))
   app.method('hash.cancel', (ctx, params) => service(ctx, 'bg.cancel', strings(params, 'id')))
 }
 
-async function submit(cfg: Config, ctx: Context, params: unknown) {
-  const { key, path } = strings(params, 'key', 'path')
-  const read = await service<{ path: string; size: number }>(ctx, 'files.read', { path })
-  if (read.size > MAX_INPUT) throw new AppError('limit_exceeded', 'The file is larger than allowed.')
-  // bg.submit takes its input from the data directory; the call's spool is elsewhere.
-  const inputs = join(cfg.dataDir, 'hash-inputs')
-  mkdirSync(inputs, { recursive: true, mode: 0o700 })
-  const input = join(inputs, randomUUID())
-  copyFileSync(read.path, input)
-  try {
-    return await service(ctx, 'bg.submit', { key, name: basename(path), input })
-  } finally {
-    unlinkSync(input)
-  }
+async function submit(_cfg: Config, _ctx: Context, params: unknown) {
+  strings(params, 'key', 'path')
+  throw new AppError('unsupported', "The NAS file hashing example is disabled pending browser input migration. Existing job control APIs remain available.")
 }

package/templates/native-node-jobs/backend/test/jobs.test.ts

@@ -1,60 +1,26 @@
 import assert from 'node:assert/strict'
-import { existsSync, mkdirSync, mkdtempSync, readFileSync, rmSync, writeFileSync } from 'node:fs'
+import { mkdirSync, mkdtempSync, readdirSync, rmSync } from 'node:fs'
 import { tmpdir } from 'node:os'
-import { join, sep } from 'node:path'
+import { join } from 'node:path'
 import { afterEach, beforeEach, test } from 'node:test'
 import { build, type Config } from '../src/routes.js'
-import { Refusal, call } from './support.js'
+import { call } from './support.js'
 
 const JOB = { job: { id: 'j1', state: 'queued' }, duplicate: false }
 let root: string
 let cfg: Config
-let submitted: Record<string, unknown>[]
 
 beforeEach(() => {
   root = mkdtempSync(join(tmpdir(), 'app-'))
   cfg = { packageId: 'ExampleApp', dataDir: join(root, 'var'), packagesRoot: join(root, 'packages') }
   mkdirSync(cfg.dataDir)
-  submitted = []
 })
 afterEach(() => rmSync(root, { recursive: true, force: true }))
 
-function spool(content: Buffer) {
-  const path = join(root, 'spool')
-  writeFileSync(path, content)
-  return { path, size: content.length }
-}
-
-// The runtime reads the input file while it answers bg.submit.
-function submit(params: unknown) {
-  const p = params as { input: string }
-  submitted.push({ ...p, content: readFileSync(p.input, 'utf8') })
-  return JOB
-}
-
-test('hash.submit hashes a copy of the caller\'s file', async () => {
-  const services = { 'files.read': () => spool(Buffer.from('hello')), 'bg.submit': submit }
-  const reply = await call(build(cfg), 'hash.submit', { key: 'k1', path: '/home/report.txt' }, { services })
-  assert.deepEqual(reply.data, JOB)
-  assert.deepEqual(reply.services.map(([op]) => op), ['files.read', 'bg.submit'])
-  assert.deepEqual(reply.services[0]![1], { path: '/home/report.txt' })
-  const [job] = submitted as [{ key: string; name: string; content: string; input: string }]
-  assert.deepEqual([job.key, job.name, job.content], ['k1', 'report.txt', 'hello'])
-  assert.ok(job.input.startsWith(cfg.dataDir + sep), job.input)
-  assert.equal(existsSync(job.input), false, 'the copy is removed once submitted')
-})
-
-test('hash.submit refuses a file over the job input limit', async () => {
-  const services = { 'files.read': () => spool(Buffer.alloc(512 * 1024 + 1)), 'bg.submit': submit }
-  const reply = await call(build(cfg), 'hash.submit', { key: 'k1', path: '/home/big.bin' }, { services })
-  assert.equal(reply.error?.code, 'limit_exceeded')
-  assert.deepEqual(submitted, [])
-})
-
-test('hash.submit passes on the runtime\'s refusal', async () => {
-  const services = { 'files.read': () => { throw new Refusal('read_failed', 'Unable to read the file.') } }
-  const reply = await call(build(cfg), 'hash.submit', { key: 'k1', path: '/home/a' }, { services })
-  assert.equal(reply.error?.code, 'read_failed')
+test('the NAS hash example refuses without services or persistent writes', async () => {
+  const reply = await call(build(cfg), 'hash.submit', { key: 'k1', path: '/home/report.txt' })
+  assert.deepEqual([reply.error?.code, reply.services], ['unsupported', []])
+  assert.deepEqual(readdirSync(cfg.dataDir), [])
 })
 
 test('hash.submit refuses invalid params before any service', async () => {

package/templates/native-python/README.md

@@ -108,7 +108,7 @@ rebuilding the SPK.
 
 | `--with` | Methods | Runtime services |
 | --- | --- | --- |
-| `jobs` | `hash.submit`, `hash.get`, `hash.cancel` | `files.read` with the caller's session, `bg.submit`, `bg.get`, `bg.cancel` |
+| `jobs` | `hash.submit`, `hash.get`, `hash.cancel` | `hash.submit` is disabled pending browser input migration; `bg.get` and `bg.cancel` remain available |
 | `root-ops` | `whoami.run` | `root.run` of `root/whoami.sh`, once an administrator approves the executor |
 | `delegate` | `report.save` | `delegate.move_from_staging` into a folder the caller chose |
 
@@ -155,3 +155,7 @@ ticks **Also delete the app data listed above** in the uninstall wizard.
 | Build hosts | macOS, Linux |
 | Target CPUs | x86_64 and aarch64 DSM models (one SPK each); armv7 is opt-in in `arches`, built but not NAS-verified |
 | DSM | 7.1 or later declared (`os_min_ver`) |
+
+The NAS file hashing example is temporarily disabled pending browser-owned
+input migration. NAS import submission returns `unsupported` without reading a
+file or creating a job; existing worker and job-control APIs remain available.

package/templates/native-python-jobs/backend/app/jobs.py

@@ -1,22 +1,10 @@
-"""Background jobs: hash a NAS file the caller may read.
+"""The NAS hashing example is disabled until browser-owned input is wired.
 
-The SDK's worker runs each job as the package account: it hashes the job's
-input (SHA-256) and keeps the result for the job's owner, the caller. The
-runtime serves files.read with the caller's DSM session and bg.* for the
-caller's own jobs only.
+Caller-bound job controls remain available; no backend session replay is used.
 """
-
-import os
-import shutil
-import tempfile
-
 from synopkgland_app import Error
-
 from params import fields
 
-# A job's input is at most 512 KiB, copied into the job when it is submitted.
-MAX_INPUT = 512 * 1024
-
 
 def register(app, cfg):
     app.method("hash.submit")(lambda ctx, params: submit(cfg, ctx, params))
@@ -25,16 +13,5 @@ def register(app, cfg):
 
 
 def submit(cfg, ctx, params):
-    p = fields(params, key=str, path=str)
-    read = ctx.runtime("files.read", {"path": p["path"]})
-    if read["size"] > MAX_INPUT:
-        raise Error("limit_exceeded", "The file is larger than allowed.")
-    # bg.submit takes its input from the data directory; the call's spool is elsewhere.
-    inputs = os.path.join(cfg.data_dir, "hash-inputs")
-    os.makedirs(inputs, mode=0o700, exist_ok=True)
-    with open(read["path"], "rb") as source, tempfile.NamedTemporaryFile(dir=inputs, delete=False) as copy:
-        shutil.copyfileobj(source, copy)
-    try:
-        return ctx.runtime("bg.submit", {"key": p["key"], "name": os.path.basename(p["path"]), "input": copy.name})
-    finally:
-        os.unlink(copy.name)
+    fields(params, key=str, path=str)
+    raise Error("unsupported", "The NAS file hashing example is disabled pending browser input migration. Existing job control APIs remain available.")

package/templates/native-python-jobs/backend/tests/test_jobs.py

@@ -2,7 +2,7 @@ import os
 import tempfile
 import unittest
 
-from support import Error, call
+from support import call
 
 import routes
 
@@ -16,43 +16,11 @@ class JobsTest(unittest.TestCase):
         self.data = os.path.join(self.dir.name, "var")
         os.mkdir(self.data)
         self.app = routes.build(routes.Config("ExampleApp", self.data))
-        self.submitted = []
 
-    def spool(self, content):
-        path = os.path.join(self.dir.name, "spool")
-        with open(path, "wb") as f:
-            f.write(content)
-        return {"path": path, "size": len(content)}
-
-    def submit(self, params):
-        # The runtime reads the input file while it answers bg.submit.
-        with open(params["input"], "rb") as f:
-            self.submitted.append(dict(params, content=f.read()))
-        return JOB
-
-    def test_submit_hashes_a_copy_of_the_callers_file(self):
-        services = {"files.read": lambda p: self.spool(b"hello"), "bg.submit": self.submit}
-        reply = call(self.app, "hash.submit", {"key": "k1", "path": "/home/report.txt"}, services=services)
-        self.assertEqual(reply.data, JOB)
-        self.assertEqual([op for op, _ in reply.services], ["files.read", "bg.submit"])
-        self.assertEqual(reply.services[0][1], {"path": "/home/report.txt"})
-        [submitted] = self.submitted
-        self.assertEqual((submitted["key"], submitted["name"], submitted["content"]), ("k1", "report.txt", b"hello"))
-        self.assertTrue(submitted["input"].startswith(self.data + os.sep))
-        self.assertFalse(os.path.exists(submitted["input"]), "the copy is removed once submitted")
-
-    def test_submit_refuses_a_file_over_the_job_input_limit(self):
-        services = {"files.read": lambda p: self.spool(b"x" * (512 * 1024 + 1)), "bg.submit": self.submit}
-        reply = call(self.app, "hash.submit", {"key": "k1", "path": "/home/big.bin"}, services=services)
-        self.assertEqual(reply.error["code"], "limit_exceeded")
-        self.assertEqual(self.submitted, [])
-
-    def test_submit_passes_on_the_runtimes_refusal(self):
-        def unreadable(params):
-            raise Error("read_failed", "Unable to read the file.")
-
-        reply = call(self.app, "hash.submit", {"key": "k1", "path": "/home/a"}, services={"files.read": unreadable})
-        self.assertEqual(reply.error["code"], "read_failed")
+    def test_nas_hash_example_refuses_without_services_or_writes(self):
+        reply = call(self.app, "hash.submit", {"key": "k1", "path": "/home/report.txt"})
+        self.assertEqual((reply.error["code"], reply.services), ("unsupported", []))
+        self.assertEqual(os.listdir(self.data), [])
 
     def test_submit_refuses_invalid_params_before_any_service(self):
         for params in [None, {"key": "k1"}, {"key": 1, "path": "/home/a"}, {"key": "k1", "path": "/home/a", "x": 1}]:

package/templates/native-rust/README.md

@@ -117,7 +117,7 @@ rebuilding the SPK.
 
 | `--with` | Methods | Runtime services |
 | --- | --- | --- |
-| `jobs` | `hash.submit`, `hash.get`, `hash.cancel` | `files.read` with the caller's session, `bg.submit`, `bg.get`, `bg.cancel` |
+| `jobs` | `hash.submit`, `hash.get`, `hash.cancel` | `hash.submit` is disabled pending browser input migration; `bg.get` and `bg.cancel` remain available |
 | `root-ops` | `whoami.run` | `root.run` of `root/whoami.sh`, once an administrator approves the executor |
 | `delegate` | `report.save` | `delegate.move_from_staging` into a folder the caller chose |
 
@@ -164,3 +164,7 @@ ticks **Also delete the app data listed above** in the uninstall wizard.
 | Build hosts | macOS, Linux |
 | Target CPUs | x86_64 and aarch64 DSM models (one SPK each); armv7 is opt-in in `arches`, built but not NAS-verified |
 | DSM | 7.1 or later declared (`os_min_ver`) |
+
+The NAS file hashing example is temporarily disabled pending browser-owned
+input migration. NAS import submission returns `unsupported` without reading a
+file or creating a job; existing worker and job-control APIs remain available.

package/templates/native-rust-jobs/backend/src/jobs.rs

@@ -1,90 +1,38 @@
-//! Background jobs: hash a NAS file the caller may read.
-//!
-//! The SDK's worker runs each job as the package account: it hashes the job's
-//! input (SHA-256) and keeps the result for the job's owner, the caller. The
-//! runtime serves files.read with the caller's DSM session and bg.* for the
-//! caller's own jobs only.
-
-use crate::routes::{Config, internal};
+//! NAS hashing is disabled until browser-owned input is wired; job controls remain.
+use crate::routes::Config;
 use serde::Deserialize;
 use serde_json::{Value, json};
-use std::os::unix::fs::DirBuilderExt;
-use std::path::{Path, PathBuf};
 use syno_pkg_land_app::{App, Context, Error, Params};
 
-/// A job's input is at most 512 KiB, copied into the job when it is submitted.
-const MAX_INPUT: u64 = 512 * 1024;
-
 #[derive(Deserialize)]
 #[serde(deny_unknown_fields)]
 struct Submit {
     key: String,
     path: String,
 }
-
 #[derive(Deserialize)]
 #[serde(deny_unknown_fields)]
 struct JobId {
     id: String,
 }
 
-#[derive(Deserialize)]
-struct Read {
-    path: PathBuf,
-    size: u64,
-}
-
-pub fn register(app: &mut App, cfg: &Config) {
-    let cfg = cfg.clone();
-    app.method("hash.submit", move |ctx, params| submit(&cfg, ctx, params));
+pub fn register(app: &mut App, _cfg: &Config) {
+    app.method("hash.submit", |_ctx, params| -> Result<Value, Error> {
+  let Submit { key, path } = params.decode()?;
+  let _ = (key, path);
+  Err(Error::new("unsupported", "The NAS file hashing example is disabled pending browser input migration. Existing job control APIs remain available."))
+ });
     app.method("hash.get", |ctx, params| job(ctx, "bg.get", params));
     app.method("hash.cancel", |ctx, params| job(ctx, "bg.cancel", params));
 }
-
 fn job(ctx: &Context, op: &str, params: &Params) -> Result<Value, Error> {
     let JobId { id } = params.decode()?;
     ctx.runtime(op, &json!({"id": id}))
 }
-
-fn submit(cfg: &Config, ctx: &Context, params: &Params) -> Result<Value, Error> {
-    let p: Submit = params.decode()?;
-    let read: Read = ctx.runtime("files.read", &json!({"path": p.path}))?;
-    if read.size > MAX_INPUT {
-        return Err(Error::new(
-            "limit_exceeded",
-            "The file is larger than allowed.",
-        ));
-    }
-    // bg.submit takes its input from the data directory; the call's spool is elsewhere.
-    let inputs = cfg.data_dir.join("hash-inputs");
-    std::fs::DirBuilder::new()
-        .recursive(true)
-        .mode(0o700)
-        .create(&inputs)
-        .map_err(internal)?;
-    let copy = inputs.join(&ctx.request_id);
-    std::fs::copy(&read.path, &copy).map_err(internal)?;
-    let name = Path::new(&p.path)
-        .file_name()
-        .map_or(String::new(), |n| n.to_string_lossy().into_owned());
-    let submitted = ctx.runtime(
-        "bg.submit",
-        &json!({"key": p.key, "name": name, "input": copy}),
-    );
-    let _ = std::fs::remove_file(&copy);
-    submitted
-}
-
 #[cfg(test)]
 mod tests {
     use super::*;
     use crate::test_support::{Services, TempDir, call};
-    use serde_json::{Value, json};
-    use std::sync::{Arc, Mutex};
-
-    /// What bg.submit was asked: its params and the input it read.
-    type Submitted = Arc<Mutex<Vec<(Value, Vec<u8>)>>>;
-
     fn setup() -> (TempDir, Config) {
         let dir = TempDir::new();
         let cfg = Config {
@@ -100,94 +48,19 @@ mod tests {
         json!({"job": {"id": "j1", "state": "queued"}, "duplicate": false})
     }
 
-    /// files.read answers a spool file with content; bg.submit records its params and the input it read.
-    fn services(dir: &TempDir, content: Vec<u8>, submitted: &Submitted) -> Services {
-        let spool = dir.path().join("spool");
-        std::fs::write(&spool, &content).unwrap();
-        let read = json!({"path": spool, "size": content.len()});
-        let submitted = submitted.clone();
-        [
-            (
-                "files.read",
-                Box::new(move |_: &Value| Ok(read.clone())) as _,
-            ),
-            (
-                "bg.submit",
-                Box::new(move |p: &Value| {
-                    // The runtime reads the input file while it answers bg.submit.
-                    let input = std::fs::read(p["input"].as_str().unwrap()).unwrap();
-                    submitted.lock().unwrap().push((p.clone(), input));
-                    Ok(job())
-                }) as _,
-            ),
-        ]
-        .into()
-    }
-
-    #[test]
-    fn submit_hashes_a_copy_of_the_callers_file() {
-        let (dir, cfg) = setup();
-        let submitted = Arc::new(Mutex::new(Vec::new()));
-        let services = services(&dir, b"hello".to_vec(), &submitted);
-        let reply = call(
-            crate::routes::build(cfg.clone()),
-            "hash.submit",
-            json!({"key": "k1", "path": "/home/report.txt"}),
-            "alice",
-            &services,
-        );
-        assert_eq!(reply.data, job());
-        let ops: Vec<_> = reply.services.iter().map(|(op, _)| op.as_str()).collect();
-        assert_eq!(ops, ["files.read", "bg.submit"]);
-        assert_eq!(reply.services[0].1, json!({"path": "/home/report.txt"}));
-        let submitted = submitted.lock().unwrap();
-        let (params, content) = &submitted[0];
-        assert_eq!(
-            (&params["key"], &params["name"], content.as_slice()),
-            (&json!("k1"), &json!("report.txt"), b"hello".as_slice())
-        );
-        let input = params["input"].as_str().unwrap();
-        assert!(input.starts_with(cfg.data_dir.to_str().unwrap()), "{input}");
-        assert!(
-            !std::path::Path::new(input).exists(),
-            "the copy is removed once submitted"
-        );
-    }
-
     #[test]
-    fn submit_refuses_a_file_over_the_job_input_limit() {
-        let (dir, cfg) = setup();
-        let submitted = Arc::new(Mutex::new(Vec::new()));
-        let services = services(&dir, vec![0; MAX_INPUT as usize + 1], &submitted);
-        let reply = call(
-            crate::routes::build(cfg),
-            "hash.submit",
-            json!({"key": "k1", "path": "/home/big.bin"}),
-            "alice",
-            &services,
-        );
-        assert_eq!(reply.code(), "limit_exceeded");
-        assert!(submitted.lock().unwrap().is_empty());
-    }
-
-    #[test]
-    fn submit_passes_on_the_runtimes_refusal() {
+    fn nas_hash_example_refuses_without_services_or_writes() {
         let (_dir, cfg) = setup();
-        let services: Services = [(
-            "files.read",
-            Box::new(|_: &Value| Err(Error::new("read_failed", "Unable to read the file."))) as _,
-        )]
-        .into();
         let reply = call(
-            crate::routes::build(cfg),
+            crate::routes::build(cfg.clone()),
             "hash.submit",
-            json!({"key": "k1", "path": "/home/a"}),
+            json!({"key":"k1","path":"/home/report.txt"}),
             "alice",
-            &services,
+            &Services::new(),
         );
-        assert_eq!(reply.code(), "read_failed");
+        assert_eq!((reply.code(), reply.services.len()), ("unsupported", 0));
+        assert_eq!(std::fs::read_dir(&cfg.data_dir).unwrap().count(), 0);
     }
-
     #[test]
     fn submit_refuses_invalid_params_before_any_service() {
         let (_dir, cfg) = setup();