@synopackageland/templates 0.27.0 → 0.27.1

package/README.md

@@ -49,7 +49,7 @@ identity gateway and keeps its own settings in an administrator-only DSM window.
 | --- | --- |
 | `native-go` | Base: `dsm-package.yaml`, Go module (`backend/cmd/{app,background-worker}`, `backend/internal/app`, `backend/internal/api/permissions.json`), plain `ui/`, i18n |
 | `native-go-vue` | Vue shell in `frontend/` (`App.vue`, `main.ts`, app i18n, `CapabilityPanels.vue`, `ExecutorGate.vue`) |
-| `native-go-jobs` | Background job routes in `internal/app` and their page test |
+| `native-go-jobs` | Background job routes in `internal/app` and a shell lifecycle test |
 | `native-go-delegate` | Delegate routes, the delegate background worker, the delegate `CapabilityPanels.vue` |
 | `native-go-root-ops` | The SDK's executor routes and `root.run` in `internal/app`, an example `root/whoami.sh`, and the Vue `ExecutorGate.vue` that holds the pages until the executor is approved |
 | `native-python` | Base: `dsm-package.yaml` (`backend.runtime: python`), the App in `backend/app` (`routes.py`, stub capability modules, `permissions.json`), unittest tests |
@@ -88,12 +88,10 @@ the single source of the SDK version and `frontend/package.json` pins
 so no UI peer override is needed. Tests use jsdom 30 for UI floating-layer styles.
 
 SDK 0.27.0 moves interactive NAS file operations to same-origin browser calls.
-The unused server-only `bg.browse` and file-import scaffold now return
-`unsupported`; custom file handlers need the SDK's
+Custom file handlers use the SDK's
 [session transport migration](https://github.com/synopackageland/syno-pkg-land-sdk/blob/v0.27.0/docs/dsm-session-transport.md).
-Protected executor scaffolds need a released CLI with SDK 0.27.0 executor/lifecycle
-digests; CLI 0.26.0 does not include them and refuses those builds. Rebuilt protected
-executors follow normal administrator approval. No NAS acceptance is claimed.
+Use CLI 0.27.0 for the matching SDK 0.27.0 executor/lifecycle digests. Rebuilt
+protected executors follow normal administrator approval. No NAS acceptance is claimed.
 
 UI and i18n text, including the DSM glossary, omit terminal sentence periods.
 Keep punctuation between sentences and intentional loading ellipses.
@@ -215,12 +213,17 @@ visible while reads run. The backend permissions remain authoritative.
 
 Native Node Apps use the official [`Node.js_v22`](https://www.synology.com/en-us/dsm/packages/Node.js_v22) package. The official release history lists DSM 7 series; installation also depends on the model and DSM version supported by Package Center. This dependency does not certify all DSM 7 releases or install Node.js on unsupported models.
 
-### Temporarily disabled NAS hashing example
+### Background jobs
 
-SDK 0.27.0 no longer relays browser DSM sessions from a backend. This release
-explicitly disables the template NAS file hashing example: Go production
-`bg.browse`/`bg.jobs.submit` and bridge `hash.submit` return `unsupported` before
-reading a file or creating a job. The Vue background example page displays an
-unavailable notice. Existing job list/status/pause/resume/cancel/schedule APIs
-and workers remain available for App-owned input; no SDK API or special option
-is introduced. A safe browser-owned input flow is follow-up work.
+The jobs overlays submit files the App's own producer has already imported into
+its private data directory. Submit `{key, name, input}` through `bg.jobs.submit`
+(Go) or `hash.submit` (Python, Node.js and Rust); `input` is the absolute path of
+that App-owned file. The Go handler and the bridge runtime confine reads to the
+App data directory and keep the SDK's bounded private-copy input contract.
+There is no NAS browse/import example or automatic file submission in either UI shell.
+
+Keep the job controls and package-account workers for progress, cancellation and
+pause/resume. Existing Go schedule routes reprocess retained, successful job
+copies with explicit consent; they do not read a fresh source file on each run.
+The bridge examples expose submission, lookup and cancellation through
+`bg.submit`, `bg.get` and `bg.cancel`; the SDK's existing service surface is unchanged.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@synopackageland/templates",
-  "version": "0.27.0",
+  "version": "0.27.1",
   "description": "Project templates for synopkgland init: native-go, native-python, native-node and native-rust (plain or Vue, with jobs, delegate and root-ops overlays), binary and compose.",
   "license": "MIT",
   "repository": {

package/templates/_shared/AGENTS.md

@@ -110,9 +110,11 @@ may redistribute; never copy Synology's.
 
 ## Background jobs (`jobs`)
 
-The NAS hashing example is temporarily disabled pending browser-owned input
-migration. Do not use backend DSM session replay or `files.read` to restore it.
-Existing workers and job-control APIs remain available for App-owned input.
+Submit only files the App's own producer has already imported into its private
+data directory, with `{key, name, input}`. The existing worker processes a
+bounded private copy. Schedules reprocess that retained copy with explicit
+consent; they never reread a source file. Keep submission, progress and
+cancellation on the existing SDK contracts.
 
 The worker runs the App's Work for one claimed job at a time, as the package
 account. The Work receives the job's Task: it reads the private input copy,

package/templates/native-go/README.md

@@ -400,6 +400,13 @@ SDK's `docs/shared-folder.md` for the whole flow.
 | DSM | 7.1 or later declared (`os_min_ver`, change it with `init --min-dsm` or `build --min-dsm`). Installed and tested on DSM 7.4 and 7.3.2 (x86_64). armv7 was installed and tested on DSM 7.1.1 (`alpine4k`, Linux 3.10, where the bridge runs from the package tmp fallback) with administrator, AppPriv and unauthenticated requests; `armada38x` and `monaco` have not been run on a NAS. No x86_64 Linux 3.10 model has been tested. aarch64 SPKs are built the same way but have not been run on a NAS. |
 | Not supported | armv7 platforms only DSM 7.0/7.1 ship (`armada370`, `armada375`, `armadaxp`, `comcerto2k`); DSM 6, running anything as root without an administrator's approval |
 
-The NAS file hashing example is temporarily disabled pending browser-owned
-input migration. NAS import submission returns `unsupported` without reading a
-file or creating a job; existing worker and job-control APIs remain available.
+## Background job input
+
+Jobs process an existing file imported by the App's producer into its private
+data directory. The submission params are `{key, name, input}`: an idempotency
+key, a display name and an absolute path inside that directory. The SDK keeps a
+bounded private copy for the worker; no browser session or NAS picker is used.
+Submit with `bg.jobs.submit`; use `bg.jobs.get` for progress and
+`bg.jobs.cancel` to cancel. Pause/resume and existing schedule routes continue
+to operate on retained imported copies. Schedules require explicit consent and
+reprocess the fixed private copy, without rereading the source file.

package/templates/native-go/backend/internal/app/background.go

@@ -4,16 +4,17 @@ import (
 	"context"
 	"encoding/json"
 	"errors"
+	"io"
 	"log"
 	"net/http"
+	"os"
 	"os/user"
-	"path"
 	"path/filepath"
+	"syscall"
 	"time"
 
 	"github.com/synopackageland/syno-pkg-land-sdk/api"
 	"github.com/synopackageland/syno-pkg-land-sdk/background"
-	"github.com/synopackageland/syno-pkg-land-sdk/filestation"
 )
 
 // workerFresh is how recent the worker heartbeat must be to count as running.
@@ -31,28 +32,20 @@ func osLookupUID(name string) string {
 	return u.Uid
 }
 
-type backgroundFiles interface {
-	Browse(ctx context.Context, c api.Caller, r *http.Request, folder string, offset int) (filestation.Page, error)
-	ReadFile(ctx context.Context, c api.Caller, r *http.Request, folder, rel string) ([]byte, error)
-}
-
 type backgroundAPI struct {
-	store *background.Store
-	files backgroundFiles
+	store   *background.Store
+	dataDir string
 }
 
-// BackgroundRoutes is the production assembly of the opt-in background jobs
-// API. The NAS hashing example is disabled until browser-owned input is wired.
-// Existing job control routes remain available. `synopkgland init --with jobs` wires it in through background.go's
-// replacement of background_none.go; nothing else references it.
+// BackgroundRoutes serves job controls for App-owned imported input.
 func BackgroundRoutes(dataDir string) []api.Route {
-	return newBackgroundRoutes(background.NewRequestStore(filepath.Join(dataDir, "background")), nil)
+	return newBackgroundRoutes(background.NewRequestStore(filepath.Join(dataDir, "background")), dataDir)
 }
 
 // Every request authenticates against DSM afresh. Owner routes are available
 // to signed-in users; schedule reapproval and owner cleanup are admin-only.
-func newBackgroundRoutes(store *background.Store, files backgroundFiles) []api.Route {
-	b := backgroundAPI{store: store, files: files}
+func newBackgroundRoutes(store *background.Store, dataDir string) []api.Route {
+	b := backgroundAPI{store: store, dataDir: dataDir}
 	return []api.Route{
 		api.HandleRequest("bg.status", b.owner(b.status)),
 		api.HandleRequest("bg.schedules.list", b.owner(b.schedules)),
@@ -61,7 +54,6 @@ func newBackgroundRoutes(store *background.Store, files backgroundFiles) []api.R
 		api.HandleRequest("bg.schedules.delete", b.owner(b.deleteSchedule)),
 		api.HandleRequest("bg.schedules.enable", b.admin(b.enableSchedule)),
 		api.HandleRequest("bg.jobs.purge", b.admin(b.purge)),
-		api.HandleRequest("bg.browse", b.owner(b.browse)),
 		api.HandleRequest("bg.jobs.submit", b.owner(b.submit)),
 		api.HandleRequest("bg.jobs.list", b.owner(b.list)),
 		api.HandleRequest("bg.jobs.get", b.owner(b.get)),
@@ -116,51 +108,28 @@ func workerAlive(w background.WorkerInfo, now time.Time) bool {
 	return now.Sub(w.At) <= workerFresh
 }
 
-// browse lists what the caller's own File Station session can see, so
-// the panel can pick a file instead of typing a path. It grants nothing:
-// submit still reads through the same session.
-func (b backgroundAPI) browse(ctx context.Context, c api.Caller, r *http.Request, params json.RawMessage) (any, error) {
-	var in struct {
-		Folder string `json:"folder"`
-		Offset int    `json:"offset"`
-	}
-	if err := decodeParams(params, &in); err != nil {
-		return nil, err
-	}
-	if in.Offset < 0 {
-		return nil, api.BadRequest("offset must not be negative")
-	}
-	if b.files == nil {
-		return nil, &api.Error{Code: "unsupported", Message: "The NAS file hashing example is disabled pending browser input migration. Existing job control APIs remain available."}
-	}
-	return b.files.Browse(ctx, c, r, in.Folder, in.Offset)
-}
-
-func (b backgroundAPI) submit(ctx context.Context, c api.Caller, r *http.Request, params json.RawMessage) (any, error) {
+func (b backgroundAPI) submit(ctx context.Context, _ api.Caller, _ *http.Request, params json.RawMessage) (any, error) {
 	var in struct {
-		Key      string `json:"key"`
-		Folder   string `json:"folder"`
-		Relative string `json:"relative"`
+		Key   string `json:"key"`
+		Name  string `json:"name"`
+		Input string `json:"input"`
 	}
 	if err := decodeParams(params, &in); err != nil {
 		return nil, err
 	}
-	if in.Key == "" || in.Folder == "" || in.Relative == "" {
-		return nil, api.BadRequest("key, folder and relative are required")
+	if in.Key == "" || in.Name == "" || in.Input == "" {
+		return nil, api.BadRequest("key, name and input are required")
 	}
 	access := accessFrom(ctx)
 	if !access.Owner.Valid() {
 		return nil, &api.Error{Code: "identity_unavailable", Message: "DSM user UID could not be resolved"}
 	}
-	if b.files == nil {
-		return nil, &api.Error{Code: "unsupported", Message: "The NAS file hashing example is disabled pending browser input migration. Existing job control APIs remain available."}
-	}
-	data, err := b.files.ReadFile(ctx, c, r, in.Folder, in.Relative)
+	data, err := b.readInput(in.Input)
 	if err != nil {
 		return nil, err
 	}
 	job, duplicate, err := b.store.Submit(ctx, background.SubmitRequest{
-		Key: in.Key, Name: path.Base(in.Relative), Data: data, Submitter: access.Owner,
+		Key: in.Key, Name: in.Name, Data: data, Submitter: access.Owner,
 	})
 	if err != nil {
 		return nil, backgroundError(err)
@@ -168,6 +137,41 @@ func (b backgroundAPI) submit(ctx context.Context, c api.Caller, r *http.Request
 	return map[string]any{"job": job, "duplicate": duplicate}, nil
 }
 
+// readInput accepts only an existing regular file inside the App data directory.
+// The App's producer imports it first; jobs and schedules retain a private copy.
+func (b backgroundAPI) readInput(input string) ([]byte, error) {
+	bad := api.BadRequest("input must be a regular file in the App data directory")
+	rel, err := filepath.Rel(b.dataDir, input)
+	if err != nil || !filepath.IsAbs(input) || !filepath.IsLocal(rel) {
+		return nil, bad
+	}
+	root, err := os.OpenRoot(b.dataDir)
+	if err != nil {
+		return nil, bad
+	}
+	defer root.Close()
+	f, err := root.OpenFile(rel, os.O_RDONLY|syscall.O_NONBLOCK, 0)
+	if err != nil {
+		return nil, bad
+	}
+	defer f.Close()
+	info, err := f.Stat()
+	if err != nil || !info.Mode().IsRegular() {
+		return nil, bad
+	}
+	if info.Size() > background.MaxInputBytes {
+		return nil, backgroundError(background.ErrTooLarge)
+	}
+	data, err := io.ReadAll(io.LimitReader(f, background.MaxInputBytes+1))
+	if err != nil {
+		return nil, bad
+	}
+	if len(data) > background.MaxInputBytes {
+		return nil, backgroundError(background.ErrTooLarge)
+	}
+	return data, nil
+}
+
 func (b backgroundAPI) list(ctx context.Context, _ api.Caller, _ *http.Request, params json.RawMessage) (any, error) {
 	if err := decodeParams(params, &struct{}{}); err != nil {
 		return nil, err

package/templates/native-go/backend/internal/app/background_owner_test.go

@@ -28,7 +28,7 @@ var carol = stubAuth{identity: api.Identity{User: "carol"}}
 
 func ownerSubmit(t *testing.T, e *bgEnv, a api.Authenticator, key string) string {
 	t.Helper()
-	code, out := e.call(a, "bg.jobs.submit", `{"key":"`+key+`","folder":"/share","relative":"a.txt"}`)
+	code, out := e.call(a, "bg.jobs.submit", e.submitParams(key))
 	if code != "" {
 		t.Fatalf("submit %s: %s %v", key, code, out)
 	}
@@ -103,7 +103,7 @@ func TestBackgroundPersonalQuotaAndAdminPurge(t *testing.T) {
 	}
 	ownerSubmit(t, e, bob, "one")
 	ownerSubmit(t, e, bob, "two")
-	if code, _ := e.call(bob, "bg.jobs.submit", `{"key":"three","folder":"/share","relative":"a.txt"}`); code != "owner-queue-full" {
+	if code, _ := e.call(bob, "bg.jobs.submit", e.submitParams("three")); code != "owner-queue-full" {
 		t.Fatal(code)
 	}
 	ownerSubmit(t, e, carol, "one")

package/templates/native-go/backend/internal/app/background_schedule_test.go

@@ -55,8 +55,4 @@ func TestBackgroundScheduleRoutesConsentOwnerAndAdmin(t *testing.T) {
 	if code, _ := e.call(bob, "bg.schedules.delete", fmt.Sprintf(`{"id":%q}`, sid)); code != "" {
 		t.Fatal(code)
 	}
-	// No scheduling route calls File Station, uses a root grant or stores a session.
-	if e.files.calls != 1 {
-		t.Fatalf("schedule read File Station %d", e.files.calls)
-	}
 }

package/templates/native-go/backend/internal/app/background_test.go

@@ -14,50 +14,30 @@ import (
 
 	"github.com/synopackageland/syno-pkg-land-sdk/api"
 	"github.com/synopackageland/syno-pkg-land-sdk/background"
-	"github.com/synopackageland/syno-pkg-land-sdk/filestation"
 )
 
-type fakeFiles struct {
-	data   []byte
-	err    error
-	calls  int
-	folder string
-	rel    string
-	offset int
-	page   filestation.Page
-}
-
-func (f *fakeFiles) Browse(_ context.Context, _ api.Caller, _ *http.Request, folder string, offset int) (filestation.Page, error) {
-	f.calls++
-	f.folder, f.offset = folder, offset
-	return f.page, f.err
-}
-
-func (f *fakeFiles) ReadFile(_ context.Context, _ api.Caller, _ *http.Request, folder, rel string) ([]byte, error) {
-	f.calls++
-	f.folder, f.rel = folder, rel
-	return f.data, f.err
-}
-
 type bgEnv struct {
-	t     *testing.T
-	store *background.Store
-	files *fakeFiles
-	srv   map[string]*api.Server
+	t       *testing.T
+	store   *background.Store
+	dataDir string
+	srv     map[string]*api.Server
 }
 
 func newBgEnv(t *testing.T) *bgEnv {
 	lookupSubmitterUID = func(string) string { return "1024" }
 	t.Cleanup(func() { lookupSubmitterUID = osLookupUID })
-	store := background.NewStore(filepath.Join(t.TempDir(), "background"))
-	files := &fakeFiles{data: []byte("hello")}
-	return &bgEnv{t: t, store: store, files: files, srv: map[string]*api.Server{}}
+	dir := t.TempDir()
+	store := background.NewStore(filepath.Join(dir, "background"))
+	if err := os.WriteFile(filepath.Join(dir, "input.txt"), []byte("hello"), 0600); err != nil {
+		t.Fatal(err)
+	}
+	return &bgEnv{t: t, store: store, dataDir: dir, srv: map[string]*api.Server{}}
 }
 
 func (e *bgEnv) call(auth api.Authenticator, method, params string) (string, map[string]any) {
 	e.t.Helper()
 	// SDK policy provides owner routes immediately.
-	routes := newBackgroundRoutes(e.store, e.files)
+	routes := newBackgroundRoutes(e.store, e.dataDir)
 	srv, err := api.NewServerWithPermissions(auth, []byte(`{"schema":1,"default":"administrators","methods":{}}`), routes...)
 	if err != nil {
 		e.t.Fatal(err)
@@ -88,8 +68,7 @@ var bgSample = map[string]string{
 	"bg.schedules.enable":  `{"id":"missing","consent":true}`,
 	"bg.status":            `{}`,
 	"bg.jobs.purge":        `{"owner":{"user":"bob","uid":"1025"}}`,
-	"bg.browse":            `{"folder":"/share","offset":0}`,
-	"bg.jobs.submit":       `{"key":"k1","folder":"/share","relative":"a.txt"}`,
+	"bg.jobs.submit":       `{"key":"k1","name":"a.txt","input":"/missing"}`,
 	"bg.jobs.list":         `{}`,
 	"bg.jobs.get":          `{"id":"` + strings.Repeat("a", 32) + `"}`,
 	"bg.jobs.cancel":       `{"id":"` + strings.Repeat("a", 32) + `"}`,
@@ -100,7 +79,7 @@ var bgSample = map[string]string{
 
 func TestBackgroundSDKPoliciesAuthenticateEveryRoute(t *testing.T) {
 	e := newBgEnv(t)
-	routes := newBackgroundRoutes(e.store, e.files)
+	routes := newBackgroundRoutes(e.store, e.dataDir)
 	if len(routes) != len(bgSample) {
 		t.Fatalf("%d routes, %d samples", len(routes), len(bgSample))
 	}
@@ -149,55 +128,73 @@ func TestBackgroundStatusReportsLimitsAndWorker(t *testing.T) {
 	}
 }
 
-func TestBackgroundSubmitAvailableOnFreshStore(t *testing.T) {
-	e := newBgEnv(t)
-	code, _ := e.call(alice, "bg.jobs.submit", bgSample["bg.jobs.submit"])
-	if code != "" || e.files.calls != 1 {
-		t.Fatalf("%q, NAS reads %d", code, e.files.calls)
+func (e *bgEnv) submitParams(key string) string {
+	p, err := json.Marshal(map[string]string{"key": key, "name": "a.txt", "input": filepath.Join(e.dataDir, "input.txt")})
+	if err != nil {
+		e.t.Fatal(err)
 	}
+	return string(p)
 }
 
-func TestBackgroundSubmitImportsSelectedFileAndIsIdempotent(t *testing.T) {
+func TestBackgroundSubmitImportsAppInputAndIsIdempotent(t *testing.T) {
 	e := newBgEnv(t)
-	params := `{"key":"k1","folder":"/share","relative":"docs/a.txt"}`
+	params := e.submitParams("k1")
 	code, out := e.call(alice, "bg.jobs.submit", params)
-	job := data(out)["job"].(map[string]any)
-	if code != "" || job["state"] != "queued" || job["name"] != "a.txt" || data(out)["duplicate"] != false {
+	if code != "" {
 		t.Fatalf("%s %v", code, out)
 	}
-	if e.files.folder != "/share" || e.files.rel != "docs/a.txt" {
-		t.Fatalf("adapter saw %q %q", e.files.folder, e.files.rel)
+	job := data(out)["job"].(map[string]any)
+	if job["state"] != "queued" || job["name"] != "a.txt" || data(out)["duplicate"] != false {
+		t.Fatal(out)
 	}
 	submitter := job["submitter"].(map[string]any)
 	if submitter["user"] != "alice" || submitter["uid"] != "1024" {
-		t.Fatalf("submitter: %v", submitter)
+		t.Fatal(submitter)
 	}
 	_, again := e.call(alice, "bg.jobs.submit", params)
 	if data(again)["duplicate"] != true || data(again)["job"].(map[string]any)["id"] != job["id"] {
-		t.Fatalf("duplicate: %v", again)
+		t.Fatal(again)
+	}
+	if err := os.WriteFile(filepath.Join(e.dataDir, "input.txt"), []byte("other"), 0600); err != nil {
+		t.Fatal(err)
 	}
-	e.files.data = []byte("other")
 	if code, _ := e.call(alice, "bg.jobs.submit", params); code != "conflict" {
-		t.Fatalf("same key with different bytes: %q", code)
+		t.Fatalf("different bytes: %q", code)
 	}
 }
 
-func TestBackgroundSubmitPassesAdapterRefusalsThrough(t *testing.T) {
+func TestBackgroundSubmitRejectsExternalAndOversizedInput(t *testing.T) {
 	e := newBgEnv(t)
-	e.files.err = &api.Error{Code: "limit-exceeded", Message: "x"}
-	if code, _ := e.call(alice, "bg.jobs.submit", bgSample["bg.jobs.submit"]); code != "limit-exceeded" {
-		t.Fatalf("%q", code)
+	outside := filepath.Join(t.TempDir(), "outside")
+	if err := os.WriteFile(outside, []byte("private"), 0600); err != nil {
+		t.Fatal(err)
 	}
-	if jobs, _ := e.store.List(context.Background()); len(jobs) != 0 {
-		t.Fatal("a failed import must never enter the queue")
+	if err := os.Symlink(outside, filepath.Join(e.dataDir, "escape")); err != nil {
+		t.Fatal(err)
+	}
+	for _, input := range []string{outside, "input.txt", filepath.Join(e.dataDir, "escape"), e.dataDir} {
+		p, _ := json.Marshal(map[string]string{"key": "bad", "name": "a.txt", "input": input})
+		if code, _ := e.call(alice, "bg.jobs.submit", string(p)); code != "bad_request" {
+			t.Fatalf("%s: %s", input, code)
+		}
+	}
+	if err := os.WriteFile(filepath.Join(e.dataDir, "input.txt"), make([]byte, background.MaxInputBytes+1), 0600); err != nil {
+		t.Fatal(err)
+	}
+	if code, _ := e.call(alice, "bg.jobs.submit", e.submitParams("big")); code != "limit-exceeded" {
+		t.Fatal(code)
+	}
+	jobs, err := e.store.List(context.Background())
+	if err != nil || len(jobs) != 0 {
+		t.Fatalf("invalid input queued: %v %v", jobs, err)
 	}
 }
 
 func TestBackgroundSubmitValidatesParams(t *testing.T) {
 	e := newBgEnv(t)
 	for _, p := range []string{
-		`{}`, `{"key":"k","folder":"/share","relative":"a","extra":1}`, `{"key":"bad key","folder":"/share","relative":"a"}`,
-		`{"key":"k","folder":"/share","relative":""}`,
+		`{}`, `{"key":"k","name":"a","input":"/a","extra":1}`, e.submitParams("bad key"),
+		`{"key":"k","name":"a","input":""}`,
 	} {
 		if code, _ := e.call(alice, "bg.jobs.submit", p); code != "bad_request" {
 			t.Errorf("%s: %q", p, code)
@@ -210,19 +207,19 @@ func TestBackgroundQueueFullAndQuotaErrorsHaveStableCodes(t *testing.T) {
 	for i := 0; i < background.MaxQueued; i++ {
 		lookupSubmitterUID = func(string) string { return fmt.Sprint(1024 + i/2) }
 		key := "k" + string(rune('a'+i))
-		if code, _ := e.call(alice, "bg.jobs.submit", `{"key":"`+key+`","folder":"/share","relative":"a.txt"}`); code != "" {
+		if code, _ := e.call(alice, "bg.jobs.submit", e.submitParams(key)); code != "" {
 			t.Fatalf("%d: %q", i, code)
 		}
 	}
 	lookupSubmitterUID = func(string) string { return "9999" }
-	if code, _ := e.call(alice, "bg.jobs.submit", `{"key":"more","folder":"/share","relative":"a.txt"}`); code != "queue-full" {
+	if code, _ := e.call(alice, "bg.jobs.submit", e.submitParams("more")); code != "queue-full" {
 		t.Fatalf("%q", code)
 	}
 }
 
 func TestBackgroundListGetCancelAndResult(t *testing.T) {
 	e := newBgEnv(t)
-	_, out := e.call(alice, "bg.jobs.submit", `{"key":"k1","folder":"/share","relative":"a.txt"}`)
+	_, out := e.call(alice, "bg.jobs.submit", e.submitParams("k1"))
 	id := data(out)["job"].(map[string]any)["id"].(string)
 	idp := `{"id":"` + id + `"}`
 
@@ -260,7 +257,7 @@ func TestBackgroundListGetCancelAndResult(t *testing.T) {
 
 func TestBackgroundCancelQueuedJob(t *testing.T) {
 	e := newBgEnv(t)
-	_, out := e.call(alice, "bg.jobs.submit", `{"key":"k1","folder":"/share","relative":"a.txt"}`)
+	_, out := e.call(alice, "bg.jobs.submit", e.submitParams("k1"))
 	id := data(out)["job"].(map[string]any)["id"].(string)
 	code, out := e.call(alice, "bg.jobs.cancel", `{"id":"`+id+`"}`)
 	if code != "" || data(out)["job"].(map[string]any)["state"] != "canceled" {
@@ -270,7 +267,7 @@ func TestBackgroundCancelQueuedJob(t *testing.T) {
 
 func TestBackgroundPauseAndResumeQueuedJob(t *testing.T) {
 	e := newBgEnv(t)
-	_, out := e.call(alice, "bg.jobs.submit", `{"key":"k1","folder":"/share","relative":"a.txt"}`)
+	_, out := e.call(alice, "bg.jobs.submit", e.submitParams("k1"))
 	idp := `{"id":"` + data(out)["job"].(map[string]any)["id"].(string) + `"}`
 	for method, state := range map[string]string{"bg.jobs.pause": "paused", "bg.jobs.resume": "queued"} {
 		if code, out := e.call(alice, method, idp); code != "" || data(out)["job"].(map[string]any)["state"] != state {
@@ -296,48 +293,6 @@ func TestBackgroundWorkerAliveExpires(t *testing.T) {
 	}
 }
 
-func TestBackgroundBrowseListsThroughTheCallersSession(t *testing.T) {
-	e := newBgEnv(t)
-	e.files.page = filestation.Page{Files: []filestation.Entry{{Name: "a.txt", Path: "/share/a.txt"}}, Total: 1}
-	code, out := e.call(alice, "bg.browse", `{"folder":"/share","offset":100}`)
-	if code != "" {
-		t.Fatalf("%s %v", code, out)
-	}
-	if e.files.folder != "/share" || e.files.offset != 100 {
-		t.Fatalf("browsed %q at %d", e.files.folder, e.files.offset)
-	}
-	files := data(out)["files"].([]any)
-	if len(files) != 1 || files[0].(map[string]any)["path"] != "/share/a.txt" {
-		t.Fatalf("page %v", out)
-	}
-}
-
-func TestBackgroundBrowseWithoutFolderListsTheShares(t *testing.T) {
-	e := newBgEnv(t)
-	if code, out := e.call(alice, "bg.browse", `{}`); code != "" {
-		t.Fatalf("%s %v", code, out)
-	}
-	if e.files.folder != "" || e.files.offset != 0 {
-		t.Fatalf("browsed %q at %d", e.files.folder, e.files.offset)
-	}
-}
-
-func TestBackgroundBrowseValidatesParamsAndPassesRefusalsThrough(t *testing.T) {
-	e := newBgEnv(t)
-	for _, params := range []string{`{"offset":-1}`, `{"folder":"/share","extra":1}`, `{"offset":"1"}`} {
-		if code, _ := e.call(alice, "bg.browse", params); code != "bad_request" {
-			t.Errorf("%s: %q", params, code)
-		}
-	}
-	if e.files.calls != 0 {
-		t.Fatal("invalid params must not reach the NAS")
-	}
-	e.files.err = &api.Error{Code: "denied", Message: "no"}
-	if code, _ := e.call(alice, "bg.browse", `{"folder":"/share"}`); code != "denied" {
-		t.Fatalf("got %q", code)
-	}
-}
-
 func TestBackgroundListWithoutJobsIsAnEmptyArray(t *testing.T) {
 	e := newBgEnv(t)
 	_, out := e.call(alice, "bg.jobs.list", `{}`)

package/templates/native-go-jobs/backend/internal/app/background_routes_test.go

@@ -16,7 +16,6 @@ import (
 
 func init() {
 	// The generic route tests need valid params for every background route.
-	// The SDK refuses retired backend session relays before reading a file.
 	// No jobs or schedules exist in its fresh data directory.
 	const id = `{"id":"missing"}`
 	sampleParams["bg.jobs.purge"] = `{"owner":{"user":"missing","uid":"9999"}}`
@@ -30,16 +29,14 @@ func init() {
 	sampleOutcome["bg.schedules.delete"] = "not_found"
 	sampleOutcome["bg.schedules.enable"] = "not_found"
 	sampleParams["bg.status"] = `{}`
-	sampleParams["bg.browse"] = `{}`
-	sampleParams["bg.jobs.submit"] = `{"key":"k1","folder":"/share","relative":"a.bin"}`
+	sampleParams["bg.jobs.submit"] = `{"key":"k1","name":"a.bin","input":"/missing"}`
 	sampleParams["bg.jobs.list"] = `{}`
 	sampleParams["bg.jobs.get"] = id
 	sampleParams["bg.jobs.cancel"] = id
 	sampleParams["bg.jobs.pause"] = id
 	sampleParams["bg.jobs.resume"] = id
 	sampleParams["bg.jobs.result"] = id
-	sampleOutcome["bg.browse"] = "unsupported"
-	sampleOutcome["bg.jobs.submit"] = "unsupported"
+	sampleOutcome["bg.jobs.submit"] = "bad_request"
 	sampleOutcome["bg.jobs.get"] = "not_found"
 	sampleOutcome["bg.jobs.cancel"] = "not_found"
 	sampleOutcome["bg.jobs.pause"] = "not_found"
@@ -72,7 +69,7 @@ func TestBackgroundRequestSubmitBusyAndProductionConstruction(t *testing.T) {
 	}
 	defer syscall.Flock(int(f.Fd()), syscall.LOCK_UN)
 	start := time.Now()
-	code, out := e.call(alice, "bg.jobs.submit", bgSample["bg.jobs.submit"])
+	code, out := e.call(alice, "bg.jobs.submit", e.submitParams("k1"))
 	if code != "jobs_busy" || time.Since(start) > background.RequestLockTimeout+time.Second {
 		t.Fatalf("busy submit: %s %+v", code, out)
 	}
@@ -90,17 +87,3 @@ func TestBackgroundRequestSubmitBusyAndProductionConstruction(t *testing.T) {
 		t.Fatal(w.Body.String())
 	}
 }
-
-func TestProductionNASHashExampleRefusesWithoutCreatingJobs(t *testing.T) {
-	cfg := testConfig(t)
-	for _, method := range []string{"bg.browse", "bg.jobs.submit"} {
-		code, _ := call(t, cfg, alice, method, sampleParams[method])
-		if code != "unsupported" {
-			t.Fatalf("%s: %s", method, code)
-		}
-	}
-	jobs, err := background.NewStore(filepath.Join(cfg.DataDir, "background")).List(context.Background())
-	if err != nil || len(jobs) != 0 {
-		t.Fatalf("disabled example created jobs: %v %v", jobs, err)
-	}
-}

package/templates/native-go-jobs/frontend/test/{background-page.test.ts → background-shell.test.ts}

@@ -4,8 +4,7 @@ import {nextTick} from 'vue'
 import {mount} from '../src/main'
 import {dsmWindow} from './context'
 async function settle(){for(let i=0;i<20;i++){await Promise.resolve();await nextTick()}}
-// The file-import example is explicitly unavailable until browser input is migrated.
-test('a jobs project explains the disabled example without submitting or reading files',async()=>{
+test('a jobs project opens its shell without starting a job',async()=>{
  const call=vi.fn(async(method:string)=>{
   if(method==='app.status')return {package:'Jobs',version:'1',user:'alice',admin:false}
   throw {code:'unknown_method'}
@@ -14,8 +13,7 @@ test('a jobs project explains the disabled example without submitting or reading
  const app=mount(root,dsmWindow({call}))
  try{
   await settle()
-  expect(root.querySelector('[data-background-example-disabled]')?.textContent).toContain('disabled')
-  expect(root.querySelector('[data-background-panel]')).toBeNull()
+  expect(root.querySelector('[data-app-status]')).not.toBeNull()
   expect(call.mock.calls.some(([method])=>method.startsWith('bg.'))).toBe(false)
  }finally{app.unmount();root.remove()}
 })

package/templates/native-go-vue/frontend/DESIGN.md

@@ -43,16 +43,13 @@ Refresh and save expose busy state and localized errors. Reopen refreshes status
 Each mount owns its state; unmount unsubscribes from host events and ignores late
 responses. Backend route policies decide access.
 
-### Opt-in background schedules (S1-a)
+### Background jobs
 
-The `native-go-jobs` overlay extends this **Operate** surface within the inherited `AppRoot`, embedded theme, `SettingsSection`, Button and Callout system. It introduces no new palette or global tokens.
-
-- **Private-copy consent:** “Schedule this copy” is available for the signed-in owner's retained, successful, unscheduled job copy. “Private copy: {name}” identifies the input; “Repeat every” offers “Hour”, “Day” and “Week”. “Create schedule” stays disabled until the user checks “I agree to keep and reprocess this fixed copy as the package user. No new source files or personal ACLs are read.” The help explains the eight-schedule limit and that missed runs are recorded, never replayed.
-- **Ownership and recovery:** preserve user-and-UID owner isolation. Administrator rows expose “Owner: {user} (UID {uid})”. A worker change shows “The worker revision changed. An administrator must review and explicitly enable this schedule.” Only administrators, while background mode is on, see “Enable schedule”. Its confirmation names the exact private copy: “Enable the schedule for {name} with the current worker revision? I agree to reprocess this fixed copy. Past runs will not be replayed.” Actions are “Confirm enable” and “Cancel”.
-- **Layout:** schedule name/state, owner, next run, missed runs and warnings stack above a grouped, wrapping action row. Long names and copy wrap within the available width. Keep the inherited vertical scrolling at the minimum window size; do not squeeze schedules into one viewport. The labeled select and consent checkbox retain visible keyboard focus using existing theme tokens.
-- **Errors and cleanup:** danger alerts map known error codes to localized safe copy, with a localized fallback rather than raw server text. The catalogs cover nine locales. Preserve per-mount disposal: stop polling, dispose the picker, revoke result download URLs and prevent pending responses from restoring disposed state. Deletion confirmation explains that queued jobs cancel, running jobs drain and finished results remain.
-
-This layout is checked against the template's local component fixtures at the desktop size and at the DSM minimum window size, including the states and recovery copy above. That validates the component contract only; visual acceptance on a specific DSM release is the App developer's own check.
+Job producers import their own input into the App data directory. The backend
+keeps submission, progress, cancellation and private-copy scheduling contracts;
+the shell does not pick or import NAS files. App-specific job controls can use
+the installed SDK and UI components. Keep explicit consent for schedules and
+user-and-UID ownership isolation, and stop polling on unmount.
 
 ## Do's and Don'ts
 

package/templates/native-go-vue/frontend/src/App.vue

@@ -121,7 +121,6 @@ onUnmounted(()=>{disposed=true;unsubscribe?.();login.dispose();text.value=''})
    <CapabilityPanels v-if="app" ref="panels" :key="app.user" :ctx="ctx" :admin="app.admin" />
    <FilesPage v-if="page==='status'" :ctx="ctx" />
    <div data-page="background" v-show="page==='background'">
-    <Callout v-if="backgroundEnabled && app" tone="warning" data-background-example-disabled>{{ copy.backgroundExampleUnavailable }}</Callout>
    </div>
   </div>
   </ExecutorGate>

package/templates/native-go-vue/frontend/src/i18n/de.json

@@ -17,6 +17,5 @@
   },
   "packageName": "Paketname",
   "user": "Benutzer",
-  "version": "Version",
-  "backgroundExampleUnavailable": "Das NAS-Datei-Hash-Beispiel ist bis zur Umstellung auf Browser-Eingaben deaktiviert. Bestehende APIs zur Auftragssteuerung bleiben verfügbar"
+  "version": "Version"
 }

package/templates/native-go-vue/frontend/src/i18n/en.json

@@ -17,6 +17,5 @@
   },
   "packageName": "Package name",
   "user": "User",
-  "version": "Version",
-  "backgroundExampleUnavailable": "The NAS file hashing example is disabled pending browser input migration. Existing job control APIs remain available"
+  "version": "Version"
 }

package/templates/native-go-vue/frontend/src/i18n/es.json

@@ -17,6 +17,5 @@
   },
   "packageName": "Nombre del paquete",
   "user": "Usuario",
-  "version": "Versión",
-  "backgroundExampleUnavailable": "El ejemplo de hash de archivos NAS está desactivado hasta migrar la entrada al navegador. Las API de control de trabajos siguen disponibles"
+  "version": "Versión"
 }

package/templates/native-go-vue/frontend/src/i18n/fr.json

@@ -17,6 +17,5 @@
   },
   "packageName": "Nom du paquet",
   "user": "Utilisateur",
-  "version": "Version",
-  "backgroundExampleUnavailable": "L’exemple de hachage de fichiers NAS est désactivé en attendant la migration des entrées du navigateur. Les API de contrôle des tâches restent disponibles"
+  "version": "Version"
 }

package/templates/native-go-vue/frontend/src/i18n/it.json

@@ -17,6 +17,5 @@
   },
   "packageName": "Nome pacchetto",
   "user": "Utente",
-  "version": "Versione",
-  "backgroundExampleUnavailable": "L’esempio di hashing dei file NAS è disabilitato in attesa della migrazione dell’input dal browser. Le API di controllo dei processi restano disponibili"
+  "version": "Versione"
 }

package/templates/native-go-vue/frontend/src/i18n/ja.json

@@ -17,6 +17,5 @@
   },
   "packageName": "パッケージ名",
   "user": "ユーザー",
-  "version": "バージョン",
-  "backgroundExampleUnavailable": "NAS ファイルのハッシュ例はブラウザー入力への移行まで無効です。既存のジョブ制御 API は利用できます"
+  "version": "バージョン"
 }

package/templates/native-go-vue/frontend/src/i18n/ko.json

@@ -17,6 +17,5 @@
   },
   "packageName": "패키지 이름",
   "user": "사용자",
-  "version": "버전",
-  "backgroundExampleUnavailable": "브라우저 입력 전환이 완료될 때까지 NAS 파일 해시 예제를 사용할 수 없습니다. 기존 작업 제어 API는 계속 사용할 수 있습니다"
+  "version": "버전"
 }

package/templates/native-go-vue/frontend/src/i18n/zh-CN.json

@@ -17,6 +17,5 @@
   },
   "packageName": "套件名称",
   "user": "用户帐号",
-  "version": "版本",
-  "backgroundExampleUnavailable": "本版本暂停 NAS 文件哈希示例，待浏览器输入流程完成后恢复。现有任务控制 API 仍可使用"
+  "version": "版本"
 }

package/templates/native-go-vue/frontend/src/i18n/zh-TW.json

@@ -17,6 +17,5 @@
   },
   "packageName": "套件名稱",
   "user": "使用者帳號",
-  "version": "版本",
-  "backgroundExampleUnavailable": "本版本暫停 NAS 檔案雜湊範例，待瀏覽器輸入流程完成後恢復。既有工作控制 API 仍可使用"
+  "version": "版本"
 }

package/templates/native-node/README.md

@@ -111,7 +111,7 @@ rebuilding the SPK.
 
 | `--with` | Methods | Runtime services |
 | --- | --- | --- |
-| `jobs` | `hash.submit`, `hash.get`, `hash.cancel` | `hash.submit` is disabled pending browser input migration; `bg.get` and `bg.cancel` remain available |
+| `jobs` | `hash.submit`, `hash.get`, `hash.cancel` | Submit an App-owned imported file with `{key, name, input}` via `bg.submit`; look up or cancel the caller's job via `bg.get` / `bg.cancel` |
 | `root-ops` | `whoami.run` | `root.run` of `root/whoami.sh`, once an administrator approves the executor |
 | `delegate` | `report.save` | `delegate.move_from_staging` into a folder the caller chose |
 
@@ -159,6 +159,12 @@ ticks **Also delete the app data listed above** in the uninstall wizard.
 | Target CPUs | x86_64 and aarch64 DSM models (one SPK each); armv7 is opt-in in `arches`, built but not NAS-verified |
 | DSM | 7.1 or later declared (`os_min_ver`) |
 
-The NAS file hashing example is temporarily disabled pending browser-owned
-input migration. NAS import submission returns `unsupported` without reading a
-file or creating a job; existing worker and job-control APIs remain available.
+## Background job input
+
+Jobs process an existing file imported by the App's producer into its private
+data directory. The submission params are `{key, name, input}`: an idempotency
+key, a display name and an absolute path inside that directory. The SDK keeps a
+bounded private copy for the worker; no browser session or NAS picker is used.
+Submit with `hash.submit`; use `hash.get` for progress and `hash.cancel` to
+cancel. These handlers call the existing `bg.submit`, `bg.get` and `bg.cancel`
+services; the runtime checks the input path and binds ownership to the caller.

package/templates/native-node-jobs/backend/src/jobs.ts

@@ -1,17 +1,11 @@
-// The NAS hashing example is disabled until browser-owned input is wired.
-// Keep caller-bound job controls; never relay a browser session from the backend.
-import { AppError, type App, type Context } from '@synopackageland/app'
+// Background jobs over files already imported into the App data directory.
+import type { App } from '@synopackageland/app'
 import { strings } from './params.js'
 import type { Config } from './routes.js'
 import { service } from './service.js'
 
-export function register(app: App, cfg: Config): void {
-  app.method('hash.submit', (ctx, params) => submit(cfg, ctx, params))
+export function register(app: App, _cfg: Config): void {
+  app.method('hash.submit', (ctx, params) => service(ctx, 'bg.submit', strings(params, 'key', 'name', 'input')))
   app.method('hash.get', (ctx, params) => service(ctx, 'bg.get', strings(params, 'id')))
   app.method('hash.cancel', (ctx, params) => service(ctx, 'bg.cancel', strings(params, 'id')))
 }
-
-async function submit(_cfg: Config, _ctx: Context, params: unknown) {
-  strings(params, 'key', 'path')
-  throw new AppError('unsupported', "The NAS file hashing example is disabled pending browser input migration. Existing job control APIs remain available.")
-}

package/templates/native-node-jobs/backend/test/jobs.test.ts

@@ -17,14 +17,15 @@ beforeEach(() => {
 })
 afterEach(() => rmSync(root, { recursive: true, force: true }))
 
-test('the NAS hash example refuses without services or persistent writes', async () => {
-  const reply = await call(build(cfg), 'hash.submit', { key: 'k1', path: '/home/report.txt' })
-  assert.deepEqual([reply.error?.code, reply.services], ['unsupported', []])
+test('hash.submit passes imported input to the runtime', async () => {
+  const params = { key: 'k1', name: 'report.txt', input: join(cfg.dataDir, 'report.txt') }
+  const reply = await call(build(cfg), 'hash.submit', params, { services: { 'bg.submit': () => JOB } })
+  assert.deepEqual([reply.data, reply.services], [JOB, [['bg.submit', params]]])
   assert.deepEqual(readdirSync(cfg.dataDir), [])
 })
 
 test('hash.submit refuses invalid params before any service', async () => {
-  for (const params of [null, { key: 'k1' }, { key: 1, path: '/home/a' }, { key: 'k1', path: '/home/a', x: 1 }]) {
+  for (const params of [null, { key: 'k1' }, { key: 1, name: 'a', input: '/app/a' }, { key: 'k1', name: 'a', input: '/app/a', x: 1 }]) {
     const reply = await call(build(cfg), 'hash.submit', params)
     assert.deepEqual([reply.error?.code, reply.services], ['bad_request', []], JSON.stringify(params))
   }

package/templates/native-python/README.md

@@ -108,7 +108,7 @@ rebuilding the SPK.
 
 | `--with` | Methods | Runtime services |
 | --- | --- | --- |
-| `jobs` | `hash.submit`, `hash.get`, `hash.cancel` | `hash.submit` is disabled pending browser input migration; `bg.get` and `bg.cancel` remain available |
+| `jobs` | `hash.submit`, `hash.get`, `hash.cancel` | Submit an App-owned imported file with `{key, name, input}` via `bg.submit`; look up or cancel the caller's job via `bg.get` / `bg.cancel` |
 | `root-ops` | `whoami.run` | `root.run` of `root/whoami.sh`, once an administrator approves the executor |
 | `delegate` | `report.save` | `delegate.move_from_staging` into a folder the caller chose |
 
@@ -156,6 +156,12 @@ ticks **Also delete the app data listed above** in the uninstall wizard.
 | Target CPUs | x86_64 and aarch64 DSM models (one SPK each); armv7 is opt-in in `arches`, built but not NAS-verified |
 | DSM | 7.1 or later declared (`os_min_ver`) |
 
-The NAS file hashing example is temporarily disabled pending browser-owned
-input migration. NAS import submission returns `unsupported` without reading a
-file or creating a job; existing worker and job-control APIs remain available.
+## Background job input
+
+Jobs process an existing file imported by the App's producer into its private
+data directory. The submission params are `{key, name, input}`: an idempotency
+key, a display name and an absolute path inside that directory. The SDK keeps a
+bounded private copy for the worker; no browser session or NAS picker is used.
+Submit with `hash.submit`; use `hash.get` for progress and `hash.cancel` to
+cancel. These handlers call the existing `bg.submit`, `bg.get` and `bg.cancel`
+services; the runtime checks the input path and binds ownership to the caller.

package/templates/native-python-jobs/backend/app/jobs.py

@@ -1,17 +1,8 @@
-"""The NAS hashing example is disabled until browser-owned input is wired.
-
-Caller-bound job controls remain available; no backend session replay is used.
-"""
-from synopkgland_app import Error
+"""Background jobs over files already imported into the App data directory."""
 from params import fields
 
 
 def register(app, cfg):
-    app.method("hash.submit")(lambda ctx, params: submit(cfg, ctx, params))
+    app.method("hash.submit")(lambda ctx, params: ctx.runtime("bg.submit", fields(params, key=str, name=str, input=str)))
     app.method("hash.get")(lambda ctx, params: ctx.runtime("bg.get", fields(params, id=str)))
     app.method("hash.cancel")(lambda ctx, params: ctx.runtime("bg.cancel", fields(params, id=str)))
-
-
-def submit(cfg, ctx, params):
-    fields(params, key=str, path=str)
-    raise Error("unsupported", "The NAS file hashing example is disabled pending browser input migration. Existing job control APIs remain available.")

package/templates/native-python-jobs/backend/tests/test_jobs.py

@@ -17,13 +17,14 @@ class JobsTest(unittest.TestCase):
         os.mkdir(self.data)
         self.app = routes.build(routes.Config("ExampleApp", self.data))
 
-    def test_nas_hash_example_refuses_without_services_or_writes(self):
-        reply = call(self.app, "hash.submit", {"key": "k1", "path": "/home/report.txt"})
-        self.assertEqual((reply.error["code"], reply.services), ("unsupported", []))
+    def test_submit_passes_imported_input_to_the_runtime(self):
+        params = {"key": "k1", "name": "report.txt", "input": os.path.join(self.data, "report.txt")}
+        reply = call(self.app, "hash.submit", params, services={"bg.submit": lambda p: JOB})
+        self.assertEqual((reply.data, reply.services), (JOB, [("bg.submit", params)]))
         self.assertEqual(os.listdir(self.data), [])
 
     def test_submit_refuses_invalid_params_before_any_service(self):
-        for params in [None, {"key": "k1"}, {"key": 1, "path": "/home/a"}, {"key": "k1", "path": "/home/a", "x": 1}]:
+        for params in [None, {"key": "k1"}, {"key": 1, "name": "a", "input": "/app/a"}, {"key": "k1", "name": "a", "input": "/app/a", "x": 1}]:
             with self.subTest(params=params):
                 reply = call(self.app, "hash.submit", params)
                 self.assertEqual((reply.error["code"], reply.services), ("bad_request", []))

package/templates/native-rust/README.md

@@ -117,7 +117,7 @@ rebuilding the SPK.
 
 | `--with` | Methods | Runtime services |
 | --- | --- | --- |
-| `jobs` | `hash.submit`, `hash.get`, `hash.cancel` | `hash.submit` is disabled pending browser input migration; `bg.get` and `bg.cancel` remain available |
+| `jobs` | `hash.submit`, `hash.get`, `hash.cancel` | Submit an App-owned imported file with `{key, name, input}` via `bg.submit`; look up or cancel the caller's job via `bg.get` / `bg.cancel` |
 | `root-ops` | `whoami.run` | `root.run` of `root/whoami.sh`, once an administrator approves the executor |
 | `delegate` | `report.save` | `delegate.move_from_staging` into a folder the caller chose |
 
@@ -165,6 +165,12 @@ ticks **Also delete the app data listed above** in the uninstall wizard.
 | Target CPUs | x86_64 and aarch64 DSM models (one SPK each); armv7 is opt-in in `arches`, built but not NAS-verified |
 | DSM | 7.1 or later declared (`os_min_ver`) |
 
-The NAS file hashing example is temporarily disabled pending browser-owned
-input migration. NAS import submission returns `unsupported` without reading a
-file or creating a job; existing worker and job-control APIs remain available.
+## Background job input
+
+Jobs process an existing file imported by the App's producer into its private
+data directory. The submission params are `{key, name, input}`: an idempotency
+key, a display name and an absolute path inside that directory. The SDK keeps a
+bounded private copy for the worker; no browser session or NAS picker is used.
+Submit with `hash.submit`; use `hash.get` for progress and `hash.cancel` to
+cancel. These handlers call the existing `bg.submit`, `bg.get` and `bg.cancel`
+services; the runtime checks the input path and binds ownership to the caller.

package/templates/native-rust-jobs/backend/src/jobs.rs

@@ -1,4 +1,4 @@
-//! NAS hashing is disabled until browser-owned input is wired; job controls remain.
+//! Background jobs over files already imported into the App data directory.
 use crate::routes::Config;
 use serde::Deserialize;
 use serde_json::{Value, json};
@@ -8,7 +8,8 @@ use syno_pkg_land_app::{App, Context, Error, Params};
 #[serde(deny_unknown_fields)]
 struct Submit {
     key: String,
-    path: String,
+    name: String,
+    input: String,
 }
 #[derive(Deserialize)]
 #[serde(deny_unknown_fields)]
@@ -17,11 +18,13 @@ struct JobId {
 }
 
 pub fn register(app: &mut App, _cfg: &Config) {
-    app.method("hash.submit", |_ctx, params| -> Result<Value, Error> {
-  let Submit { key, path } = params.decode()?;
-  let _ = (key, path);
-  Err(Error::new("unsupported", "The NAS file hashing example is disabled pending browser input migration. Existing job control APIs remain available."))
- });
+    app.method("hash.submit", |ctx, params| -> Result<Value, Error> {
+        let Submit { key, name, input } = params.decode()?;
+        ctx.runtime(
+            "bg.submit",
+            &json!({"key": key, "name": name, "input": input}),
+        )
+    });
     app.method("hash.get", |ctx, params| job(ctx, "bg.get", params));
     app.method("hash.cancel", |ctx, params| job(ctx, "bg.cancel", params));
 }
@@ -49,17 +52,20 @@ mod tests {
     }
 
     #[test]
-    fn nas_hash_example_refuses_without_services_or_writes() {
+    fn submit_passes_imported_input_to_the_runtime() {
         let (_dir, cfg) = setup();
+        let params =
+            json!({"key":"k1","name":"report.txt","input":cfg.data_dir.join("report.txt")});
+        let services: Services = [("bg.submit", Box::new(|_: &Value| Ok(job())) as _)].into();
         let reply = call(
-            crate::routes::build(cfg.clone()),
+            crate::routes::build(cfg),
             "hash.submit",
-            json!({"key":"k1","path":"/home/report.txt"}),
+            params.clone(),
             "alice",
-            &Services::new(),
+            &services,
         );
-        assert_eq!((reply.code(), reply.services.len()), ("unsupported", 0));
-        assert_eq!(std::fs::read_dir(&cfg.data_dir).unwrap().count(), 0);
+        assert_eq!(reply.data, job());
+        assert_eq!(reply.services, vec![("bg.submit".to_string(), params)]);
     }
     #[test]
     fn submit_refuses_invalid_params_before_any_service() {
@@ -67,8 +73,8 @@ mod tests {
         for params in [
             Value::Null,
             json!({"key": "k1"}),
-            json!({"key": 1, "path": "/home/a"}),
-            json!({"key": "k1", "path": "/home/a", "x": 1}),
+            json!({"key": 1, "name": "a", "input": "/app/a"}),
+            json!({"key": "k1", "name": "a", "input": "/app/a", "x": 1}),
         ] {
             let reply = call(
                 crate::routes::build(cfg.clone()),