@synopackageland/cli 0.14.1 → 0.15.1

package/CHANGELOG.md

@@ -1,5 +1,24 @@
 # Changelog
 
+## 0.15.1 (2026-10-18)
+
+- Require explicit `DSM_E2E_SSH` for e2e tunnels and use `dsm` as the default saved-profile target; set `DSM_E2E_TARGET` to reuse an earlier target name. Anonymize internal NAS fixtures and documentation.
+- Pin templates and SDK fixtures/examples to 0.15.1. Add the 0.15.1 executor/lifecycle digest entry and retain the published 0.15.0 pins unchanged.
+- Cover package-named control.sh refusal logs and rejected `.executor` / `.policy.json` staging cleanup.
+- Executor task definitions change: Apps rebuilt with SDK 0.15.1 require one administrator reapproval after upgrade.
+
+繁中摘要：e2e tunnel 必須明確設定 `DSM_E2E_SSH`，profile 預設 target 改為 `dsm`（沿用舊 profile 時設定 `DSM_E2E_TARGET`）；清理內部 NAS 範例資訊。templates／SDK pins 同步 0.15.1；新增同版三架構 executor／lifecycle digest，保留 0.15.0 pins。驗證 control.sh 拒絕 log 的套件名與 runtime copies 清除。**task 定義改變：App 使用新 SDK 重建升級後，管理員需重新核准一次。**
+
+## 0.15.0 (2026-10-18)
+
+- Add `synopkgland ctl` host/session management, authenticated API v1 discovery, explicit command trust, typed invocation and fixed job/pagination/NDJSON/upload flows. Commands keep App backend authorization; writes require confirmation.
+- Document resource/verb naming recommendations without a verb allowlist or effect inference; explicit effects remain mandatory and binding checks remain unchanged.
+- Redact standard JSON Schema writeOnly values in dry-run/confirmation plans, schema errors, results, list/help and caches, including nested arrays/objects and multi-host output; keep outgoing requests unchanged.
+- Pin templates and released executor digests to 0.15.0, retaining the same-minor digest selection rule.
+- Breaking: remove the legacy Compose route and bridge publish mode. Migrate to schema 2 `dsm-package.yaml` with ordered `compose.files`, `compose.web` container port/health and `identity_gateway.sdk: 0.15.0`; remove old `integration.compose`/`integration.identity_gateway`. `web.host_port` is accepted but ignored. Build/check/inspect share the SDK planner. Rebuild with templates/SDK 0.15.0 and verify install/upgrade; historical `.sc` cleanup requires separate authorization. Changing subnet candidate requires a clean installation, not an automatic network migration.
+
+繁中摘要：新增 writeOnly 敏感值遮罩（巢狀、陣列、多主機、計畫、錯誤及快取），實際請求保持原值。新增 `synopkgland ctl`，從已安裝 App 的 authenticated「Syno Package Land API 描述」v1 發現並執行明確 commands，支援多主機與固定任務流程。**不相容變更**：移除舊 Compose 打包路線及 publish 模式；改用 schema 2 `compose`／`identity_gateway`，固定 SDK／templates 0.15.0 並重建驗證。gateway 直接連固定 bridge IP 的 container port；`web.host_port` 僅解析相容、會忽略，歷史 `.sc` 與既有子網不自動清除或遷移。
+
 ## 0.14.1
 
 - DSM 會改寫 standalone URL，因此沒有 SDK class 的 schema 1 web launcher 使用 url；schema 2 identity_gateway + compose 與原生 new-page 使用 standalone。兩條 Compose 路線共用預設解析。
@@ -319,7 +338,7 @@ before its timeout.
 - The window approval of an upgrade (outdated tasks) makes 11 scheduler calls
   instead of 12: the outdated boot task is deleted by the approval's own first
   EventScheduler get, made moments before the password, instead of a second
-  get (2.9 s on vt-nas in t-0484). The control task is still read again by id
+  get (2.9 s on the test NAS in t-0484). The control task is still read again by id
   before its delete (spec/scheduler/v1). A fresh approval stays at 8.
   繁中：升級核准的排程呼叫由 12 降為 11（boot 任務不再於刪除前重讀）。
 - A scope approval reads the executor's selection back every second at most

package/README.md

@@ -36,7 +36,7 @@ the SPK with Package Center's Manual Install.
 | `native-go` | A Go backend with a Vue UI (or `--ui plain`) | `dsm-package.yaml` |
 | `native-python`, `native-node`, `native-rust` | The `native-go` App with a Python, Node.js (TypeScript) or Rust backend | `dsm-package.yaml` |
 | `binary` | A static Linux program you build yourself | `dsm-package.yaml` |
-| `compose` | An existing Docker Compose app (`--from compose.yaml`) | `synology-app.yaml` |
+| `compose` | Unchanged upstream Compose, generated override and SDK planner | `dsm-package.yaml` |
 
 Existing native products with their own payload layout use `backend: {kind: native}` in
 `dsm-package.yaml`.
@@ -150,12 +150,17 @@ await dismissNotifications(); // when a card shows later
 ```
 
 `runWithTunnel` (the `tunnel --` command) opens an SSH tunnel to the NAS
-(`DSM_E2E_SSH`, default `root@vt-nas.syno`) on a free loopback port and runs the
+(`DSM_E2E_SSH`, required, e.g. `admin@nas.example`) on a free loopback port and runs the
 command with `DSM_E2E_URL` set. It masks DSM's session cookies (`id`, `did`,
 `_SSID`), `X-SYNO-TOKEN`, `SynoToken` and `_sid` as `***` in the command's
 output and in the files under `DSM_E2E_OUTPUT_DIR` (default `.e2e`), and makes
 that directory private (700, files 600); saved sessions keep their cookies.
-Accounts come from mode 600 files named by `DSM_E2E_ACCOUNT_<USER>`.
+Set `DSM_E2E_SSH` to your NAS SSH destination in the environment or a local
+untracked `.env`; an unset or blank value fails before SSH or the command starts.
+`nas.example` is a fixture hostname; replace it with your own host. Accounts come
+from mode 600 files named by `DSM_E2E_ACCOUNT_<USER>`. Saved profiles use
+`DSM_E2E_TARGET` (default `dsm`) and the user as their names; set the target to
+an existing profile's target name to keep reusing it.
 `signIn` and `openDesktop` also register those values as e2e secrets in the
 test's worker, so e2e masks them in its own report. A test that forwards
 requests with `context.route` and `route.fetch` should end with
@@ -234,18 +239,28 @@ A full page does not need Application Portal. Omit `portal` unless an alias is
 explicitly wanted; only that opt-in adds `defaultAlias`, login styling, Portal
 panels and capabilities. No Portal is a healthy default for inspect/info/doctor.
 
-Web service Apps declare `integration.web.launch`; its built-in default is `new-page`.
-Native SDK Apps default to `dsm-window`; non-UI-SDK native frontends must
-explicitly set `ui.launch: new-page`. Headless Compose Apps have no launcher.
-The new-page main menu uses `type: "url"` with an explicit `url` at the existing trusted entry: the authenticated
-gateway, or a Web Station alias only with explicit `access: public`. DSM rewrites standalone URLs to a launchApp shell, which needs an AppInstance
-and AppWindow JS class. A schema-1 web service has no such class, so it uses url.
-The schema-2 identity_gateway + compose SDK wrapper has the class and uses standalone.
-Authenticated web Apps do not create a Web Station alias or Application Portal.
-`dsm-window` remains an explicit web launch option with its URL launcher.
-
-Schema 2 `dsm-package.yaml` with `identity_gateway` and `compose` is also a web
-service: omitted `ui.launch` resolves to `new-page`, without Application Portal.
-Both Compose routes share `contract/app-launch.ts` for defaults and launcher types.
-An explicit `ui.launch` overrides this default. Native SDK Apps without a web
-service keep `dsm-window` when `ui.launch` is absent.
+Compose uses schema-2 `dsm-package.yaml` and `ui.launch`; the default is new-page.
+Classless gateways use type url via the shared contract/app-launch resolver;
+AppWindow wrappers use standalone. Headless projects have no launcher.
+
+See [Compose](skills/reference/compose.md) for multiple upstream files,
+generated override/worker artifacts, image proofs and the support matrix.
+Containers use a fixed package identity and do not inherit a signed-in user's
+File Station ACL. Shared Folder intent requires admin confirmation after
+installation; official protected ACL/project control and bridge readback remain
+blocked. No SSO Server or wrapper container is added. Linux tests do not prove
+DSM readiness; inspect lists explicit acceptance blockers.
+
+## Control installed Apps
+
+Use `synopkgland ctl host add nas --url https://nas.example:5001 --username alice`
+to register and authenticate a NAS in OS secure storage. `ctl host list --json`
+checks sessions; `ctl list --host nas --json` discovers all approved task-level
+commands and their schemas. Run the listed alias/command with typed flags,
+`--help` and `--dry-run`; writes require `--yes`. There is no mutable current
+context. Use `--host a,b` or `--all-hosts` for bounded parallel operations.
+
+Read `synopkgland skill show ctl` for the AI workflow, batch discovery approval,
+cache refresh, host removal/revocation and explicit `ctl.commands` authoring.
+API descriptions are private SPK files named `synopkgland-api.json`, served
+only by the authenticated fixed `synopkgland.describe` CGI operation.

package/dist/build-spk/generator.d.ts

@@ -1,6 +1,6 @@
 import type { ProjectRoot } from "../discovery.js";
+import type { NativeArchFamily } from "./dsm-arch.js";
 import type { CommandRunner } from "../standalone/build.js";
-import { type NativeArchFamily } from "./dsm-arch.js";
 export interface BuildSpkOptions {
     project: ProjectRoot;
     outputPath?: string;
@@ -19,7 +19,8 @@ export interface BuildSpkResult {
     outputPath?: string;
     errors: string[];
 }
-export declare function buildSpk(options: BuildSpkOptions): Promise<BuildSpkResult>;
+/** Legacy project detection supplies a migration error, never a second builder. */
+export declare function buildSpk(_options: BuildSpkOptions): Promise<BuildSpkResult>;
 export declare function walkFiles(root: string, prefix?: string): string[];
 export declare function digestSpkPayload(spkPath: string): Promise<string>;
 export declare function extractSpk(spkPath: string, targetDir: string): Promise<void>;