@synopackageland/cli 0.26.0 → 0.27.0

package/CHANGELOG.md

@@ -1,5 +1,11 @@
 # Changelog
 
+## 0.27.0 (2026-10-23)
+
+- Depend on templates `~0.27.0` with SDK/App 0.27.0 and UI 0.14.9. Templates patches can ship independently and resolve during npm installation/update; runtime uses the installed templates without network fetching. SDK minor upgrades still require a CLI release for executor mappings/digests and `SDK_UNSUPPORTED` checks. New scaffolds use browser same-origin DSM file operations and the idle-storage fixes.
+- Resolve SDK 0.27.0 to the new executor/v0.27.0 and ship all six verified executor/lifecycle digests. Preserve the previous 0.26.0 inventory and exact-version refusal for unrecorded patches. Protected Apps must rebuild and follow normal administrator approval.
+- Keep Go 1.26.10 and the existing runtime/toolchain requirements. Rust crate publication and NAS/App upgrade certification are outside this release.
+
 ## 0.26.0 (2026-10-22)
 
 - Support SDK/App 0.26.x and pin templates 0.26.0, retaining UI 0.14.3 and executor/v0.24.0 with unchanged protected payload digests.

package/README.md

@@ -64,8 +64,18 @@ a failed fetch reports `SDK_DOWNLOAD_FAILED`.
 CLI-only patch releases can differ from the SDK patch. Compose import and SDK defaults
 read the SDK pin from the installed templates; explicit App SDK declarations take precedence.
 
-`init` and `add` read their templates from `@synopackageland/templates`, an exact-pinned
-dependency. For development against local checkouts, set `SYNOPKGLAND_TEMPLATES_DIR` to a
+`init` and `add` read their templates from the locally installed
+`@synopackageland/templates`. CLI 0.27.0 depends on `~0.27.0`: npm installation or
+update can select the latest templates patch in the 0.27 minor line. Templates
+patches need only a templates release; update the npm installation to receive them.
+The CLI never fetches templates at runtime, so offline use works after installation;
+commit a lockfile and use `npm ci` to reproduce a chosen dependency tree.
+The templates' SDK pin must stay in the CLI-supported minor line. An SDK minor
+upgrade still needs a CLI release for its executor mapping/digests and
+`SDK_UNSUPPORTED` checks. Runtime SDK defaults continue to come from the actual
+installed templates, independently of the CLI patch version.
+
+For development against local checkouts, set `SYNOPKGLAND_TEMPLATES_DIR` to a
 templates checkout and `SYNOPKGLAND_SDK_DIR` to an SDK checkout; SPKs built with
 `SYNOPKGLAND_SDK_DIR` warn `EXECUTOR_DIGEST_UNVERIFIED` and must not be published. A Vue project
 packs the local SDK into its frontend (`npm install --install-links`) without building it: run
@@ -81,7 +91,7 @@ This compares `OFF_GLOSSARY` and the Italian sentence rule, including regex sour
 flags. It supports declaration-only rules with read-only use in `glossaryProblems`;
 post-declaration mutations, aliases and other unsupported rule uses fail the check instead of
 comparing a partial snapshot. The command also fails on drift or missing source. It needs a checkout because templates
-0.15.1 does not publish `scripts/test/i18n.test.mjs`. The npm gate runs this check when
+does not publish `scripts/test/i18n.test.mjs`. The npm gate runs this check when
 `SYNOPKGLAND_TEMPLATES_DIR` is set; otherwise it explicitly reports that the drift check was skipped.
 
 ## Capabilities

package/dist/runtime/executor-digests.json

@@ -9,5 +9,16 @@
             "armv7": "6d25fc972eba12e3ac68f8b6a95a45e9e5706ebe19ffc1ff774fc318acbeb90f"
         },
         "goToolchain": "go1.26.10"
+    },
+    "0.27.0": {
+        "x86_64": "35f760533c133f7ed99d62c11dc4696d06a56fd2d125d53291aa21743d8327cc",
+        "aarch64": "04dff10b52ca4c54e3e6a825c27bac876f296031d8f572f667e6902e18464e31",
+        "armv7": "8789b2663b683ae0a5a457b41ccfcff4d54be4c98dcd3af338622051ad24f943",
+        "lifecycle": {
+            "x86_64": "c6fbb377ecd5ec7ee5b96439f22091d9fa5965dfd616d510ca9445722f436721",
+            "aarch64": "a9ca1750d4d5cff4727dc29789e6eaf0a365cb0e674f1bb796971d82f2d4fa27",
+            "armv7": "6d25fc972eba12e3ac68f8b6a95a45e9e5706ebe19ffc1ff774fc318acbeb90f"
+        },
+        "goToolchain": "go1.26.10"
     }
 }

package/dist/runtime/sdk-source.js

@@ -75,8 +75,8 @@ function goMod(backendDir) {
         return '';
     }
 }
-/** SDK releases that reuse an immutable executor release with identical payload bytes. */
-const EXECUTOR_RELEASES = { '0.21.0': '0.20.0', '0.21.1': '0.20.0', '0.22.0': '0.20.0', '0.23.0': '0.20.0', '0.23.1': '0.20.0', '0.23.2': '0.20.0', '0.24.1': '0.24.0', '0.25.0': '0.24.0', '0.26.0': '0.24.0' };
+/** Explicit executor release pins; older SDK versions can reuse an immutable release with identical payload bytes. */
+const EXECUTOR_RELEASES = { '0.21.0': '0.20.0', '0.21.1': '0.20.0', '0.22.0': '0.20.0', '0.23.0': '0.20.0', '0.23.1': '0.20.0', '0.23.2': '0.20.0', '0.24.1': '0.24.0', '0.25.0': '0.24.0', '0.26.0': '0.24.0', '0.27.0': '0.27.0' };
 /**
  * The module directories of one SDK version. SYNOPKGLAND_SDK_DIR names a
  * local sdk checkout (development and gates only); otherwise modules come from

package/dist/template-paths.d.ts

@@ -1,5 +1,5 @@
 /**
- * The scaffold templates come from the exactly pinned @synopackageland/templates
+ * The scaffold templates come from the locally installed @synopackageland/templates
  * package; SYNOPKGLAND_TEMPLATES_DIR points at a templates checkout instead.
  */
 export declare function templatesRoot(env?: NodeJS.ProcessEnv, from?: string): string;

package/dist/template-paths.js

@@ -2,7 +2,7 @@ import { createRequire } from "node:module";
 import { dirname, join } from "node:path";
 import { sdkRequirement } from "./runtime/sdk-source.js";
 /**
- * The scaffold templates come from the exactly pinned @synopackageland/templates
+ * The scaffold templates come from the locally installed @synopackageland/templates
  * package; SYNOPKGLAND_TEMPLATES_DIR points at a templates checkout instead.
  */
 export function templatesRoot(env = process.env, from = import.meta.url) {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@synopackageland/cli",
-  "version": "0.26.0",
+  "version": "0.27.0",
   "description": "Syno Package Land Developer Kit CLI",
   "type": "module",
   "bin": {
@@ -27,7 +27,7 @@
   },
   "dependencies": {
     "@napi-rs/keyring": "^2.1.1",
-    "@synopackageland/templates": "0.26.0",
+    "@synopackageland/templates": "~0.27.0",
     "ajv": "^8.17.1",
     "commander": "^13.1.0",
     "json-canonicalize": "^3.0.1",

package/skills/SKILL.md

@@ -5,6 +5,14 @@ description: Initialize, extend, check, build, inspect, and deploy Synology appl
 
 # Independent Synology SPKs
 
+CLI 0.27.x installs templates through `~0.27.0`. A templates patch needs only a
+templates release; npm install/update selects a patch in that minor line. The CLI
+uses the locally installed templates and reads their SDK pin for defaults; it
+never downloads templates at runtime. Preserve the lockfile and use `npm ci` for
+reproducible offline-ready installations. An SDK minor upgrade still requires a
+CLI release with executor mappings/digests and `SDK_UNSUPPORTED` validation; a
+templates patch must keep its SDK pin in the CLI-supported minor line.
+
 Before releasing an executor App, read [reference/approval-upgrades.md](reference/approval-upgrades.md). Run build/inspect with the previous released SPK as `--baseline` and include the approval difference in release notes. Without a comparable baseline, retention is unknown.
 
 Use this guide to initialize, build and inspect own applications or upstream OSS as independent packages. 依已實作能力區分 DSM session 檔案、私有 jobs 與 App 登入；delegate 已實作並隨 CLI 提供固定操作的離線委託（預設 `files.moveFromStaging`）；共用 delegate／rootOps executor 的完整裝置生命週期驗收仍待完成，不得宣稱已通過；支援邊界依 delegate guide／support matrix，禁止發明新的身分平台。
@@ -25,6 +33,8 @@ Read [reference/lifecycle.md](reference/lifecycle.md) before editing `dsm-script
 
 Read [reference/ui-vue.md](reference/ui-vue.md) when editing Vue components in the native-go Vue template; use the installed SDK contracts, keep DSM embedding boundaries, and verify the actual app.
 
+Buttons follow DSM's policy ([reference/ui-vue.md](reference/ui-vue.md#buttons), the UI package's `docs/button-policy.md`): only the bar that closes a dialog, wizard or form draws capsules, with Cancel/Reset first and one primary (or one danger to confirm a deletion) last; toolbar, page, section and row actions are grey tool buttons, Delete included; links go to `Link`. Choose the variant, never the shape.
+
 Read [reference/ui-json.md](reference/ui-json.md) when generating or editing JSON UI; discover the installed catalog, validate the spec, then render and fix layout issues.
 
 ## UI copywriting

package/skills/reference/compose.md

@@ -232,7 +232,7 @@ declared availability readiness, LAN isolation/egress, protected grant lifecycle
 ACLs, two-user visibility and clean install/upgrade/reboot/stop/uninstall before
 calling the package supported on a NAS. No NAS is accessed by the build gate.
 
-The unified Compose contract uses SDK 0.17.3 and templates 0.17.5 with CLI 0.17.3. Use the published, matching versions together; the legacy packaging route and bridge publish mode are removed.
+The unified Compose contract uses SDK 0.27.x with CLI 0.27.x and locally installed templates from `~0.27.0`. Templates patches can ship independently; npm install/update resolves them, and SDK defaults come from the installed templates. SDK minor upgrades still require a CLI release with executor mappings/digests and `SDK_UNSUPPORTED` checks. The CLI does not fetch templates at runtime. The legacy packaging route and bridge publish mode are removed.
 
 Primary override files, and each included override set, must share a directory. Cross-directory override bases are rejected before loader I/O. Included implicit .env files are confined, inventoried and preserved; symlinks are rejected.
 

package/skills/reference/ui-vue.md

@@ -61,6 +61,31 @@ Reuse the embedded theme's typography, spacing and public controls. Preserve
 loading, empty, error, disabled and permission states. Backend policies and DSM
 checks decide authority; component visibility cannot grant access.
 
+## Buttons
+
+Follow DSM's button policy, in the installed
+`node_modules/@synopackageland/ui/docs/button-policy.md`. Choose only the
+`variant`; the container chooses the shape, so do not set `kind="action"`.
+
+| Place | Use |
+| --- | --- |
+| Dialog, Sheet, Wizard footer; `FormActions`, `AppActionBar`, `Footbar`, Panel `#fbar` | capsule: Cancel or Reset `secondary`, then one `primary` last |
+| Confirming a deletion | Dialog footer: Cancel, then one `danger` last |
+| Toolbar, PageHeader, section or card body and `#footer`, beside a field | grey tool `Button` (Delete too) |
+| List or grid row | `IconButton` with a `label` |
+| Help, docs, external pages | `Link`, not a button |
+
+- A capsule only ends something: it closes a dialog, applies a form or moves a
+  wizard. Disable this connection, Open or Check again stay tool buttons, even
+  in a `SettingsSection` `#footer`; put a section's Save / Cancel in `FormActions`.
+- One main action per footer, placed last. Inside a page, `primary` only for
+  the one step that unblocks it (Sign in), at most one per section.
+- Keep the default size; neighbouring buttons share one size. One refresh per
+  page, in the PageHeader.
+- In development the UI warns in the console about a capsule outside a footer,
+  two main actions in a footer, or a main action that is not last. Clear these
+  warnings before handing over the app.
+
 ## Start fast
 
 Every api.cgi call pays DSM's session check (about 60–240 ms on a NAS), so