@synopackageland/cli 0.12.0 → 0.12.1

package/CHANGELOG.md

@@ -1,5 +1,12 @@
 # Changelog
 
+## 0.12.1 (2026-10-16)
+
+- Preserve optional `raw_max_bytes` in WebAPI profiles and administrator policy digests. Reject invalid limits and require raw-capable SDK 0.12.1; zero/omitted profiles stay JSON-only. Generated approval details receive the byte limit.
+- Pin the SDK 0.12.1 three-architecture executor and lifecycle digests. Templates remain 0.12.0; no template change is needed for an optional consumer-declared profile.
+
+繁中摘要：WebAPI profile 支援 raw_max_bytes 明確啟用原始回應與大小上限；驗證及核准 digest 保留此設定，需搭配 SDK 0.12.1。更新 executor digest，templates 維持 0.12.0。
+
 ## 0.12.0 (2026-10-16)
 
 - Generated Apps use templates 0.12.0, SDK 0.12.0 and UI 0.10.1. Vue pages and sections stack at the UI section gap, and SDK dialogs size to their content.

package/README.md

@@ -204,3 +204,15 @@ normal executor approval digest; a profile change needs administrator approval.
 Users grant the named profile separately. The permanent denylist, current-user
 permission checks, bounded JSON and uncertain-outcome rules are in the SDK's
 executor/README.md. Binary downloads require later SDK support.
+
+## Raw WebAPI profiles
+
+SDK 0.12.1 add opt-in raw responses. In `capabilities.webapi.<profile>`,
+set `raw_max_bytes: 26214400` for a 25 MiB MIME limit and explicitly allow
+`SYNO.MailClient.Message.get_original` v10. Omitting the limit preserves JSON-only
+profiles. Changing it changes the approved policy and requires fresh user consent.
+Call `webapi.call` with `response_type: "raw"`; Go Apps use
+`JobContext.WebAPI().CallRaw`. Small bodies use base64; large bodies use the
+package's private executor-staging folder with size/SHA-256 and immediate cleanup.
+Do not use Attachment.download or follow X-Accel-Redirect. See the SDK raw response
+contract for the complete transport and CGI validation rules.

package/dist/init.js

@@ -305,8 +305,17 @@ function assertLocalSdkReady(sdkDir, vue) {
  */
 function useLocalSdk(targetDir, sdkDir) {
     const goMod = join(targetDir, "backend/go.mod");
-    if (existsSync(goMod))
-        writeFileSync(goMod, `${readFileSync(goMod, "utf8")}\nreplace ${SDK_MODULE} => ${sdkDir}\n`);
+    if (existsSync(goMod)) {
+        let text = readFileSync(goMod, "utf8");
+        const sdkPackage = join(sdkDir, "ts/package.json");
+        if (existsSync(sdkPackage)) {
+            const version = JSON.parse(readFileSync(sdkPackage, "utf8")).version;
+            if (typeof version !== "string" || !/^\d+\.\d+\.\d+$/.test(version))
+                throw new Error('[SDK_DIR_NOT_READY] Local SDK package version must be X.Y.Z.');
+            text = text.replace(/(github\.com\/synopackageland\/syno-pkg-land-sdk v)\d+\.\d+\.\d+\b/g, `$1${version}`);
+        }
+        writeFileSync(goMod, `${text}\nreplace ${SDK_MODULE} => ${sdkDir}\n`);
+    }
     const frontend = join(targetDir, "frontend/package.json");
     if (!existsSync(frontend))
         return;

package/dist/runtime/executor-digests.json

@@ -9,5 +9,16 @@
             "armv7": "cafc97c89f5645c14a8cf31d6d9f258394ed6f2d086478a7aebd04d57c274b4e"
         },
         "goToolchain": "go1.26.9"
+    },
+    "0.12.1": {
+        "x86_64": "efe409287770f6b70e7f8465e8767eeb2413b9ab8775020cf4dffb1555d7bf1f",
+        "aarch64": "d68c9889ed2391e918b9c278679ea0a01cd04425528c11090700a3b6341fc543",
+        "armv7": "9149a05efb9f2d7d86a400707099b3d657382b1c0dbad6588be8c500e90445cc",
+        "lifecycle": {
+            "x86_64": "d65500c4f04713a32b45d360059281391acfa5e00ee24895fdd2de7b82735372",
+            "aarch64": "94f6cd119186ff482b8aea56541dd1f9d53c147566bc1efdca6f5a1c86198331",
+            "armv7": "cafc97c89f5645c14a8cf31d6d9f258394ed6f2d086478a7aebd04d57c274b4e"
+        },
+        "goToolchain": "go1.26.9"
     }
 }

package/dist/runtime/webapi-profile.d.ts

@@ -1,7 +1,8 @@
-/** JSON WebAPI profiles, independently enforced again by the pinned executor. */
+/** WebAPI profiles, independently enforced again by the pinned executor. */
 export interface WebAPIProfile {
     purpose: string;
     apis: Record<string, Record<string, number[]>>;
+    raw_max_bytes?: number;
 }
 export type WebAPIProfiles = Record<string, WebAPIProfile>;
 export declare function validWebAPIProfiles(value: unknown): value is WebAPIProfiles;

package/dist/runtime/webapi-profile.js

@@ -6,7 +6,9 @@ export function validWebAPIProfiles(value) {
         return false;
     let total = 0;
     for (const [name, p] of Object.entries(value)) {
-        if (!/^[a-z][a-z0-9_-]{0,63}$/.test(name) || name === 'home' || !record(p) || Object.keys(p).some(k => !['purpose', 'apis'].includes(k)) || typeof p.purpose !== 'string' || !p.purpose.trim() || Buffer.byteLength(p.purpose) > 1024 || /[\x00-\x1f\x7f]/.test(p.purpose) || !record(p.apis) || !Object.keys(p.apis).length)
+        if (!/^[a-z][a-z0-9_-]{0,63}$/.test(name) || name === 'home' || !record(p) || Object.keys(p).some(k => !['purpose', 'apis', 'raw_max_bytes'].includes(k)) || typeof p.purpose !== 'string' || !p.purpose.trim() || Buffer.byteLength(p.purpose) > 1024 || /[\x00-\x1f\x7f]/.test(p.purpose) || !record(p.apis) || !Object.keys(p.apis).length)
+            return false;
+        if (p.raw_max_bytes !== undefined && (!Number.isSafeInteger(p.raw_max_bytes) || Number(p.raw_max_bytes) < 0 || Number(p.raw_max_bytes) > 67108864))
             return false;
         for (const [api, methods] of Object.entries(p.apis)) {
             if (!/^SYNO\.[A-Za-z][A-Za-z0-9]*(\.[A-Za-z][A-Za-z0-9]*)*$/.test(api) || api.toLowerCase().split('.').slice(1).some(x => blocked.has(x)) || !record(methods) || !Object.keys(methods).length)
@@ -23,5 +25,5 @@ export function validWebAPIProfiles(value) {
     return true;
 }
 export function sortedWebAPIProfiles(profiles) {
-    return Object.fromEntries(Object.entries(profiles).sort(([a], [b]) => a < b ? -1 : 1).map(([name, p]) => [name, { purpose: p.purpose, apis: Object.fromEntries(Object.entries(p.apis).sort(([a], [b]) => a < b ? -1 : 1).map(([api, methods]) => [api, Object.fromEntries(Object.entries(methods).sort(([a], [b]) => a < b ? -1 : 1).map(([m, versions]) => [m, [...versions].sort((a, b) => a - b)]))])) }]));
+    return Object.fromEntries(Object.entries(profiles).sort(([a], [b]) => a < b ? -1 : 1).map(([name, p]) => [name, { purpose: p.purpose, apis: Object.fromEntries(Object.entries(p.apis).sort(([a], [b]) => a < b ? -1 : 1).map(([api, methods]) => [api, Object.fromEntries(Object.entries(methods).sort(([a], [b]) => a < b ? -1 : 1).map(([m, versions]) => [m, [...versions].sort((a, b) => a - b)]))])), ...(p.raw_max_bytes ? { raw_max_bytes: p.raw_max_bytes } : {}) }]));
 }

package/dist/standalone/manifest.js

@@ -217,6 +217,10 @@ function readManifest(raw, c) {
         const sdk = sdkVersionOrUndefined(backend);
         if (!sdk || Number(sdk.split('.')[0]) === 0 && Number(sdk.split('.')[1]) < 11)
             c.fail("SDK_UNSUPPORTED", "capabilities.webapi requires SDK 0.11.0 or later; update backend and frontend together.");
+        const raw = Object.values(capabilities.webapi).some(profile => (profile.raw_max_bytes ?? 0) > 0);
+        const [major, minor, patch] = (sdk ?? '0.0.0').split('.').map(Number);
+        if (raw && (!sdk || major === 0 && (minor < 12 || minor === 12 && patch < 1)))
+            c.fail("SDK_UNSUPPORTED", "Raw WebAPI profiles require SDK 0.12.1 or later; update backend and frontend together.");
     }
     const uninstall = readUninstall(raw.uninstall, { rootOps: capabilities.rootOps === true, ops: rootOps, en: i18n?.catalogs?.en }, e => c.fail(e.code, e.message));
     const appScripts = readAppScripts(c.root, e => c.fail(e.code, e.message));

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@synopackageland/cli",
-  "version": "0.12.0",
+  "version": "0.12.1",
   "description": "Syno Package Land Developer Kit CLI",
   "type": "module",
   "bin": {