@synopackageland/cli 0.26.0 → 0.27.1

package/CHANGELOG.md

@@ -1,5 +1,15 @@
 # Changelog
 
+## 0.27.1 (2026-10-23)
+
+- Read executor release mappings, toolchain and six payload pins from SDK executor manifest format 1. Accept compatible SDK minors independently of CLI versions; keep the frozen 0.26.0/0.27.0 fallback. Remove the CLI digest-recording script.
+
+## 0.27.0 (2026-10-23)
+
+- Depend on templates `~0.27.0` with SDK/App 0.27.0 and UI 0.14.9. Templates patches can ship independently and resolve during npm installation/update; runtime uses the installed templates without network fetching. SDK minor upgrades still require a CLI release for executor mappings/digests and `SDK_UNSUPPORTED` checks. New scaffolds use browser same-origin DSM file operations and the idle-storage fixes.
+- Resolve SDK 0.27.0 to the new executor/v0.27.0 and ship all six verified executor/lifecycle digests. Preserve the previous 0.26.0 inventory and exact-version refusal for unrecorded patches. Protected Apps must rebuild and follow normal administrator approval.
+- Keep Go 1.26.10 and the existing runtime/toolchain requirements. Rust crate publication and NAS/App upgrade certification are outside this release.
+
 ## 0.26.0 (2026-10-22)
 
 - Support SDK/App 0.26.x and pin templates 0.26.0, retaining UI 0.14.3 and executor/v0.24.0 with unchanged protected payload digests.

package/README.md

@@ -52,20 +52,35 @@ The CLI packages, deploys and checks. The app-side code is the SDK
 `github.com/synopackageland/syno-pkg-land-sdk` and the npm package `@synopackageland/sdk` (Vue components at
 `@synopackageland/sdk/vue`). The `require github.com/synopackageland/syno-pkg-land-sdk` line in
 `backend/go.mod` is the app's only SDK version; `build` compiles the executor of that version
-and checks it against the digests shipped in this CLI. A CLI builds the SDK releases of its own minor version
-(CLI X.Y.z builds SDK X.Y.*) that its digest table records; `EXECUTOR_DIGEST_MISMATCH` names the ones it knows.
+and checks both payloads against the resolved SDK's `executor-manifest.json`.
+The manifest declares format 1, the exact executor release, its Go toolchain and
+six SHA-256 digests. SDK minor versions are independent of CLI minor versions.
 
-The SDK repositories are private. The CLI adds `github.com/synopackageland/*` to its Go
-children's `GOPRIVATE`, `GONOPROXY` and `GONOSUMDB`, preserving existing environment and
-`go env -w` settings. Give git a credential that can read
-`https://github.com/synopackageland/syno-pkg-land-sdk` (check with `git ls-remote`);
-a failed fetch reports `SDK_DOWNLOAD_FAILED`.
+SDK module downloads preserve normal Go checksum verification and the user's Go
+settings; Go Apps also check their existing `backend/go.sum`. Commit that file
+alongside npm lockfiles. Do not disable checksum verification for public SDK
+packages. Private mirrors can use explicitly configured Go authentication and
+checksum settings; a failed fetch reports `SDK_DOWNLOAD_FAILED`.
 
 CLI-only patch releases can differ from the SDK patch. Compose import and SDK defaults
 read the SDK pin from the installed templates; explicit App SDK declarations take precedence.
 
-`init` and `add` read their templates from `@synopackageland/templates`, an exact-pinned
-dependency. For development against local checkouts, set `SYNOPKGLAND_TEMPLATES_DIR` to a
+`init` and `add` read their templates from the locally installed
+`@synopackageland/templates`. CLI 0.27.1 depends on `~0.27.0`: npm installation or
+update can select the latest templates patch in the 0.27 minor line. Templates
+patches need only a templates release; update the npm installation to receive them.
+The CLI never fetches templates at runtime, so offline use works after installation;
+commit a lockfile and use `npm ci` to reproduce a chosen dependency tree.
+The CLI accepts SDK executor manifest format 1 across SDK minor versions. The
+exact SDK Go module sum anchors the build manifest; npm integrity anchors the
+identical manifest in `@synopackageland/sdk/executor-manifest.json`. No manifest
+is fetched at NAS runtime. Missing, malformed or unsupported new manifests fail
+closed. SDK 0.26.0 and 0.27.0 retain the CLI's frozen legacy inventory.
+SDK defaults continue to come from the actual installed templates. An SDK minor
+release no longer requires a CLI release; new CLI capabilities or a new manifest
+format can still require one.
+
+For development against local checkouts, set `SYNOPKGLAND_TEMPLATES_DIR` to a
 templates checkout and `SYNOPKGLAND_SDK_DIR` to an SDK checkout; SPKs built with
 `SYNOPKGLAND_SDK_DIR` warn `EXECUTOR_DIGEST_UNVERIFIED` and must not be published. A Vue project
 packs the local SDK into its frontend (`npm install --install-links`) without building it: run
@@ -81,7 +96,7 @@ This compares `OFF_GLOSSARY` and the Italian sentence rule, including regex sour
 flags. It supports declaration-only rules with read-only use in `glossaryProblems`;
 post-declaration mutations, aliases and other unsupported rule uses fail the check instead of
 comparing a partial snapshot. The command also fails on drift or missing source. It needs a checkout because templates
-0.15.1 does not publish `scripts/test/i18n.test.mjs`. The npm gate runs this check when
+does not publish `scripts/test/i18n.test.mjs`. The npm gate runs this check when
 `SYNOPKGLAND_TEMPLATES_DIR` is set; otherwise it explicitly reports that the drift check was skipped.
 
 ## Capabilities

package/dist/error-registry.js

@@ -909,8 +909,13 @@ export const ERROR_REGISTRY = {
         },
         SDK_UNSUPPORTED: {
             code: "SDK_UNSUPPORTED",
-            description: "The SDK the backend requires (backend/go.mod or backend/Cargo.lock) is not on this CLI's minor line.",
-            suggestion: "Use a CLI on the same minor as the SDK, or raise the SDK to a version line the CLI supports (listed in the message).",
+            description: "The SDK has an unsupported executor manifest format or lacks a known legacy inventory.",
+            suggestion: "Use an SDK with executor manifest format 1, or update the CLI when a new manifest format is needed.",
+        },
+        SDK_MANIFEST_INVALID: {
+            code: "SDK_MANIFEST_INVALID",
+            description: "The resolved SDK executor manifest has invalid versions, toolchain or payload digests.",
+            suggestion: "Reinstall the exact locked SDK package and verify its integrity; do not replace its manifest with runtime data.",
         },
         SDK_DIR_NOT_READY: {
             code: "SDK_DIR_NOT_READY",

package/dist/runtime/executor-build.js

@@ -1,7 +1,7 @@
 import { goChildEnv } from "./go-env.js";
 import { mkdirSync, readFileSync } from 'node:fs';
 import { join } from 'node:path';
-import { PINNED_GO_HINT, pinnedGoBuildEnv, pinnedGoProblem } from '../build-spk/go-toolchain.js';
+import { PINNED_GO_TOOLCHAIN, pinnedGoBuildEnv, goBinaryVersion } from '../build-spk/go-toolchain.js';
 import { sdkBackend } from '../standalone/manifest.js';
 import { StandaloneBuildError } from '../standalone/spk.js';
 import { checkCgiBinary } from '../standalone/binary.js';
@@ -11,7 +11,7 @@ import { copyModule, verifyExecutorDigests } from './executor-source.js';
 import { requiredSdk } from './sdk-source.js';
 import { rootProgramsUnsupported } from './root-programs.js';
 import { executorPolicyProblem } from './executor-policy-check.js';
-/** CLI-owned build flags; the release digest table is computed the same way, so they must not change within an SDK minor. */
+/** Manifest format 1's reproducible build flags; changing them requires a new format. */
 const GO_BUILD = ['build', '-trimpath', '-buildvcs=false', '-ldflags', '-s -w -buildid=', '-o'];
 function failure(error) {
     const message = error.message;
@@ -32,6 +32,8 @@ export async function buildExecutor(m, arch, work, run, options = {}) {
     catch (error) {
         throw failure(error);
     }
+    const toolchain = sdk.manifest?.executorDigests.goToolchain ?? PINNED_GO_TOOLCHAIN;
+    const toolchainHint = `These executor binaries need ${toolchain}; install it on PATH or allow Go to download that exact toolchain.`;
     const dir = join(work, `executor-${arch}`);
     mkdirSync(dir);
     const source = join(dir, 'source');
@@ -42,22 +44,24 @@ export async function buildExecutor(m, arch, work, run, options = {}) {
         throw new StandaloneBuildError('EXECUTOR_BUILD_FAILED', `Executor sources of SDK ${sdk.version} are missing: ${error.message}`);
     }
     const binary = join(dir, 'executor');
-    const result = await run('go', [...GO_BUILD, binary, '.'], { cwd: source, env: goChildEnv({ ...process.env, ...pinnedGoBuildEnv(arch) }) });
+    const result = await run('go', [...GO_BUILD, binary, '.'], { cwd: source, env: goChildEnv({ ...process.env, ...pinnedGoBuildEnv(arch), GOTOOLCHAIN: toolchain }) });
     if (result.missing || result.status !== 0)
-        throw new StandaloneBuildError('EXECUTOR_BUILD_FAILED', `Executor build failed (${arch}). ${PINNED_GO_HINT}\n${result.stderr}`);
+        throw new StandaloneBuildError('EXECUTOR_BUILD_FAILED', `Executor build failed (${arch}). ${toolchainHint}\n${result.stderr}`);
     const problem = checkCgiBinary(work, binary, arch);
     if (problem)
         throw new StandaloneBuildError(problem.code, problem.message);
     const lifecycleBinary = join(dir, 'lifecycle');
-    const lifecycleResult = await run('go', [...GO_BUILD, lifecycleBinary, './cmd/lifecycle'], { cwd: source, env: goChildEnv({ ...process.env, ...pinnedGoBuildEnv(arch) }) });
+    const lifecycleResult = await run('go', [...GO_BUILD, lifecycleBinary, './cmd/lifecycle'], { cwd: source, env: goChildEnv({ ...process.env, ...pinnedGoBuildEnv(arch), GOTOOLCHAIN: toolchain }) });
     if (lifecycleResult.missing || lifecycleResult.status !== 0)
-        throw new StandaloneBuildError('EXECUTOR_BUILD_FAILED', `Lifecycle helper build failed (${arch}). ${PINNED_GO_HINT}\n${lifecycleResult.stderr}`);
+        throw new StandaloneBuildError('EXECUTOR_BUILD_FAILED', `Lifecycle helper build failed (${arch}). ${toolchainHint}\n${lifecycleResult.stderr}`);
     const lifecycleProblem = checkCgiBinary(work, lifecycleBinary, arch);
     if (lifecycleProblem)
         throw new StandaloneBuildError(lifecycleProblem.code, lifecycleProblem.message);
-    const toolchainProblem = pinnedGoProblem(binary) ?? pinnedGoProblem(lifecycleBinary);
-    if (toolchainProblem)
-        throw new StandaloneBuildError('EXECUTOR_BUILD_FAILED', toolchainProblem);
+    for (const file of [binary, lifecycleBinary]) {
+        const actual = goBinaryVersion(file);
+        if (actual !== toolchain)
+            throw new StandaloneBuildError('EXECUTOR_BUILD_FAILED', `${file} was built by ${actual ?? 'an unknown Go release'}, not ${toolchain}.`);
+    }
     const executorDigest = sha256(readFileSync(binary));
     let warnings;
     try {
@@ -79,7 +83,7 @@ export async function buildExecutor(m, arch, work, run, options = {}) {
     const policyText = executorPolicyText(policy);
     let refused;
     try {
-        refused = executorPolicyProblem(source, sdk.version, m.package, policyText, options.env);
+        refused = executorPolicyProblem(source, sdk.version, m.package, policyText, options.env, toolchain);
     }
     catch (error) {
         throw failure(error);

package/dist/runtime/executor-digests.json

@@ -9,5 +9,16 @@
             "armv7": "6d25fc972eba12e3ac68f8b6a95a45e9e5706ebe19ffc1ff774fc318acbeb90f"
         },
         "goToolchain": "go1.26.10"
+    },
+    "0.27.0": {
+        "x86_64": "35f760533c133f7ed99d62c11dc4696d06a56fd2d125d53291aa21743d8327cc",
+        "aarch64": "04dff10b52ca4c54e3e6a825c27bac876f296031d8f572f667e6902e18464e31",
+        "armv7": "8789b2663b683ae0a5a457b41ccfcff4d54be4c98dcd3af338622051ad24f943",
+        "lifecycle": {
+            "x86_64": "c6fbb377ecd5ec7ee5b96439f22091d9fa5965dfd616d510ca9445722f436721",
+            "aarch64": "a9ca1750d4d5cff4727dc29789e6eaf0a365cb0e674f1bb796971d82f2d4fa27",
+            "armv7": "6d25fc972eba12e3ac68f8b6a95a45e9e5706ebe19ffc1ff774fc318acbeb90f"
+        },
+        "goToolchain": "go1.26.10"
     }
 }

package/dist/runtime/executor-policy-check.d.ts

@@ -4,9 +4,9 @@ import { type StandaloneManifest } from '../standalone/manifest.js';
  * undefined when it accepts it. The executor is
  * built for this host from executorDir, so its own rules decide, not a copy in the CLI.
  */
-export declare function executorPolicyRefusal(executorDir: string, pkg: string, policyText: string, env?: NodeJS.ProcessEnv): string | undefined;
+export declare function executorPolicyRefusal(executorDir: string, pkg: string, policyText: string, env?: NodeJS.ProcessEnv, toolchain?: string): string | undefined;
 /** The EXECUTOR_POLICY_REJECTED message for a policy the SDK executor refuses; undefined when it accepts it. */
-export declare function executorPolicyProblem(executorDir: string, sdkVersion: string, pkg: string, policyText: string, env?: NodeJS.ProcessEnv): string | undefined;
+export declare function executorPolicyProblem(executorDir: string, sdkVersion: string, pkg: string, policyText: string, env?: NodeJS.ProcessEnv, toolchain?: string): string | undefined;
 /** The policy of each architecture `check` would build, checked by the App's SDK executor; Apps without executor need none. */
 export declare function manifestPolicyProblem(m: StandaloneManifest, env?: NodeJS.ProcessEnv): {
     code: string;

package/dist/runtime/executor-policy-check.js

@@ -3,7 +3,7 @@ import { spawnSync } from 'node:child_process';
 import { mkdtempSync, rmSync } from 'node:fs';
 import { tmpdir } from 'node:os';
 import { join } from 'node:path';
-import { PINNED_GO_HINT, PINNED_GO_TOOLCHAIN } from '../build-spk/go-toolchain.js';
+import { PINNED_GO_TOOLCHAIN } from '../build-spk/go-toolchain.js';
 import { sdkBackend } from '../standalone/manifest.js';
 import { executorPolicy, executorPolicyText } from './executor-policy.js';
 import { requiredSdk } from './sdk-source.js';
@@ -14,14 +14,14 @@ const CHECK_POLICY = 'check-policy';
  * undefined when it accepts it. The executor is
  * built for this host from executorDir, so its own rules decide, not a copy in the CLI.
  */
-export function executorPolicyRefusal(executorDir, pkg, policyText, env = process.env) {
+export function executorPolicyRefusal(executorDir, pkg, policyText, env = process.env, toolchain = PINNED_GO_TOOLCHAIN) {
     const dir = mkdtempSync(join(tmpdir(), 'synopkgland-check-policy-'));
     try {
         const binary = join(dir, 'executor');
         const { GOOS: _os, GOARCH: _arch, ...host } = env;
-        const build = spawnSync('go', ['build', '-o', binary, '.'], { cwd: executorDir, env: goChildEnv({ ...host, GOTOOLCHAIN: PINNED_GO_TOOLCHAIN, GOFLAGS: '', GOWORK: 'off', CGO_ENABLED: '0' }), encoding: 'utf8' });
+        const build = spawnSync('go', ['build', '-o', binary, '.'], { cwd: executorDir, env: goChildEnv({ ...host, GOTOOLCHAIN: toolchain, GOFLAGS: '', GOWORK: 'off', CGO_ENABLED: '0' }), encoding: 'utf8' });
         if (build.error || build.status !== 0)
-            throw new Error(`[EXECUTOR_BUILD_FAILED] Building the SDK executor for this host to check the policy failed. ${PINNED_GO_HINT}\n${build.stderr || build.error?.message}`);
+            throw new Error(`[EXECUTOR_BUILD_FAILED] Building the SDK executor for this host to check the policy failed. This SDK's executor needs ${toolchain}.\n${build.stderr || build.error?.message}`);
         const result = spawnSync(binary, [CHECK_POLICY, '--package', pkg], { input: policyText, encoding: 'utf8' });
         if (result.status === 0)
             return undefined;
@@ -43,13 +43,13 @@ const POLICY_FIX = [
     [/policy entry/, 'fix entry in dsm-package.yaml'],
 ];
 /** The EXECUTOR_POLICY_REJECTED message for a policy the SDK executor refuses; undefined when it accepts it. */
-export function executorPolicyProblem(executorDir, sdkVersion, pkg, policyText, env = process.env) {
-    const reason = executorPolicyRefusal(executorDir, pkg, policyText, env);
+export function executorPolicyProblem(executorDir, sdkVersion, pkg, policyText, env = process.env, toolchain = PINNED_GO_TOOLCHAIN) {
+    const reason = executorPolicyRefusal(executorDir, pkg, policyText, env, toolchain);
     if (!reason)
         return undefined;
     const fix = POLICY_FIX.find(([pattern]) => pattern.test(reason))?.[1] ?? 'fix the declaration in dsm-package.yaml';
     return `The executor of SDK ${sdkVersion} refuses this App's policy (executor: ${reason}), so the NAS would refuse it at approval: ${fix}.`
-        + ' If dsm-package.yaml already matches the manifest reference, this CLI and the SDK disagree: use the SDK version this CLI release names.';
+        + ' If dsm-package.yaml already matches the manifest reference, check the SDK manifest contract and the CLI capability support.';
 }
 /** The policy of each architecture `check` would build, checked by the App's SDK executor; Apps without executor need none. */
 export function manifestPolicyProblem(m, env = process.env) {
@@ -58,7 +58,7 @@ export function manifestPolicyProblem(m, env = process.env) {
     try {
         const sdk = requiredSdk(sdkBackend(m), env);
         for (const text of new Set(m.arches.map(arch => executorPolicyText(executorPolicy(m, arch))))) {
-            const message = executorPolicyProblem(sdk.executorDir, sdk.version, m.package, text, env);
+            const message = executorPolicyProblem(sdk.executorDir, sdk.version, m.package, text, env, sdk.manifest?.executorDigests.goToolchain);
             if (message)
                 return { code: 'EXECUTOR_POLICY_REJECTED', message };
         }

package/dist/runtime/executor-source.d.ts

@@ -1,21 +1,17 @@
 import type { NativeArchFamily } from '../build-spk/dsm-arch.js';
 import type { SdkSource } from './sdk-source.js';
-type ArchDigests = Record<NativeArchFamily, string>;
+import { type ExecutorDigests } from './sdk-executor-manifest.js';
 /** Released SDK versions: the sha256 of the executor and lifecycle helper built from them, per architecture. */
-export type ExecutorDigestTable = Record<string, ArchDigests & {
-    lifecycle: ArchDigests;
-    goToolchain: string;
-}>;
+export type ExecutorDigestTable = Record<string, ExecutorDigests>;
 export declare const SHIPPED_EXECUTOR_DIGESTS: ExecutorDigestTable;
 /** Copy a module directory (the module cache is read-only) so the build owns a writable tree. */
 export declare function copyModule(source: string, target: string): void;
 /**
  * A released SDK's executor is only shipped when its bytes equal the digest
- * table; a local SDK checkout (SYNOPKGLAND_SDK_DIR) is built unverified.
+ * manifest (or frozen legacy table); a local SDK checkout is built unverified.
  * Returns the warnings to show.
  */
 export declare function verifyExecutorDigests(sdk: SdkSource, arch: NativeArchFamily, built: {
     executor: string;
     lifecycle: string;
 }, table?: ExecutorDigestTable): string[];
-export {};

package/dist/runtime/executor-source.js

@@ -1,6 +1,7 @@
 import { chmodSync, cpSync, lstatSync, readdirSync } from 'node:fs';
 import { join } from 'node:path';
 import EXECUTOR_DIGESTS from './executor-digests.json' with { type: 'json' };
+import { readExecutorManifest, predatesExecutorManifest } from './sdk-executor-manifest.js';
 export const SHIPPED_EXECUTOR_DIGESTS = EXECUTOR_DIGESTS;
 /** Copy a module directory (the module cache is read-only) so the build owns a writable tree. */
 export function copyModule(source, target) {
@@ -18,13 +19,14 @@ export function copyModule(source, target) {
 }
 /**
  * A released SDK's executor is only shipped when its bytes equal the digest
- * table; a local SDK checkout (SYNOPKGLAND_SDK_DIR) is built unverified.
+ * manifest (or frozen legacy table); a local SDK checkout is built unverified.
  * Returns the warnings to show.
  */
 export function verifyExecutorDigests(sdk, arch, built, table = SHIPPED_EXECUTOR_DIGESTS) {
     if (sdk.local)
         return [`[EXECUTOR_DIGEST_UNVERIFIED] executor built from the local SDK checkout SYNOPKGLAND_SDK_DIR (${arch}, sha256 ${built.executor}); the digest table was not checked. Do not publish this SPK.`];
-    const expected = table[sdk.version];
+    const manifest = sdk.manifest ?? readExecutorManifest(sdk.goDir, sdk.version);
+    const expected = manifest?.executorDigests ?? (predatesExecutorManifest(sdk.version) ? table[sdk.version] : undefined);
     if (!expected)
         throw new Error(`[EXECUTOR_DIGEST_MISMATCH] This CLI has no recorded executor digest for SDK ${sdk.version}; it knows ${Object.keys(table).join(', ') || 'no released SDK'}.`);
     if (expected[arch] !== built.executor)

package/dist/runtime/sdk-executor-manifest.d.ts

@@ -0,0 +1,16 @@
+import type { NativeArchFamily } from '../build-spk/dsm-arch.js';
+export type ArchDigests = Record<NativeArchFamily, string>;
+export type ExecutorDigests = ArchDigests & {
+    lifecycle: ArchDigests;
+    goToolchain: string;
+};
+export interface ExecutorManifest {
+    formatVersion: 1;
+    sdkVersion: string;
+    executorVersion: string;
+    executorDigests: ExecutorDigests;
+}
+/** Read only the resolved, integrity-protected SDK module, never a remote manifest. */
+export declare function readExecutorManifest(goDir: string, version: string): ExecutorManifest | undefined;
+/** Only SDKs released before the manifest contract can use the frozen inventory. */
+export declare function predatesExecutorManifest(version: string): boolean;

package/dist/runtime/sdk-executor-manifest.js

@@ -0,0 +1,45 @@
+import { readFileSync } from 'node:fs';
+import { join } from 'node:path';
+const versionPattern = /^(0|[1-9]\d*)\.(0|[1-9]\d*)\.(0|[1-9]\d*)$/;
+/** Read only the resolved, integrity-protected SDK module, never a remote manifest. */
+export function readExecutorManifest(goDir, version) {
+    let text;
+    try {
+        text = readFileSync(join(goDir, 'executor-manifest.json'), 'utf8');
+    }
+    catch (error) {
+        if (error.code === 'ENOENT')
+            return undefined;
+        throw error;
+    }
+    const invalid = () => { throw new Error(`[SDK_MANIFEST_INVALID] SDK ${version} has an invalid executor-manifest.json; reinstall the exact locked SDK package.`); };
+    let m;
+    try {
+        m = JSON.parse(text);
+    }
+    catch {
+        return invalid();
+    }
+    if (!m || typeof m !== 'object' || !Number.isInteger(m.formatVersion))
+        return invalid();
+    if (m.formatVersion !== 1)
+        throw new Error(`[SDK_UNSUPPORTED] SDK ${version} declares executor manifest format ${m.formatVersion}; this CLI understands format 1. Update the CLI to support that format.`);
+    if (m.sdkVersion !== version || !versionPattern.test(m.sdkVersion) || typeof m.executorVersion !== 'string' || !versionPattern.test(m.executorVersion))
+        return invalid();
+    const d = m.executorDigests;
+    if (!d || typeof d.goToolchain !== 'string' || !/^go1\.\d+\.\d+$/.test(d.goToolchain))
+        return invalid();
+    for (const hashes of [d, d.lifecycle])
+        for (const arch of ['x86_64', 'aarch64', 'armv7']) {
+            if (!hashes || typeof hashes[arch] !== 'string' || !/^[a-f0-9]{64}$/.test(hashes[arch]))
+                return invalid();
+        }
+    return m;
+}
+/** Only SDKs released before the manifest contract can use the frozen inventory. */
+export function predatesExecutorManifest(version) {
+    if (!versionPattern.test(version))
+        return false;
+    const [major, minor, patch] = version.split('.').map(Number);
+    return major === 0 && (minor < 27 || (minor === 27 && patch === 0));
+}

package/dist/runtime/sdk-source.d.ts

@@ -1,4 +1,5 @@
 export { goPrivateCovers } from './go-env.js';
+import { type ExecutorManifest } from './sdk-executor-manifest.js';
 export declare const SDK_PACKAGE = "@synopackageland/sdk";
 export declare const SDK_MODULE = "github.com/synopackageland/syno-pkg-land-sdk";
 export declare const EXECUTOR_MODULE = "github.com/synopackageland/syno-pkg-land-sdk/executor";
@@ -19,6 +20,7 @@ export interface SdkSource {
     goDir: string;
     executorDir: string;
     local: boolean;
+    manifest?: ExecutorManifest;
 }
 /** How each backend declares the SDK. */
 export declare const SDK_DEPENDENCY: Record<SdkBackend['kind'], string>;
@@ -41,7 +43,7 @@ export declare function goModulePath(backendDir: string): string | undefined;
  */
 export declare function sdkSource(version: string, env?: NodeJS.ProcessEnv, download?: (spec: string) => string): SdkSource;
 /** The module cache directory of module@version; the cache is read-only, so builds copy it first. */
-export declare function goModDownload(spec: string, env?: NodeJS.ProcessEnv): string;
+export declare function goModDownload(spec: string, env?: NodeJS.ProcessEnv, moduleDir?: string): string;
 /** The SDK an App builds its executor with; delegate and rootOps cannot build without one. */
 export declare function requiredSdk(backend: SdkBackend, env?: NodeJS.ProcessEnv, download?: (spec: string) => string): SdkSource;
 /** Go children fetch the private SDK directly; failed fetches need git credentials. */

package/dist/runtime/sdk-source.js

@@ -1,9 +1,9 @@
 import { spawnSync } from 'node:child_process';
-import { goChildEnv } from './go-env.js';
 export { goPrivateCovers } from './go-env.js';
 import { readFileSync } from 'node:fs';
 import { tmpdir } from 'node:os';
 import { join } from 'node:path';
+import { readExecutorManifest, predatesExecutorManifest } from './sdk-executor-manifest.js';
 export const SDK_PACKAGE = '@synopackageland/sdk';
 export const SDK_MODULE = 'github.com/synopackageland/syno-pkg-land-sdk';
 export const EXECUTOR_MODULE = `${SDK_MODULE}/executor`;
@@ -75,8 +75,8 @@ function goMod(backendDir) {
         return '';
     }
 }
-/** SDK releases that reuse an immutable executor release with identical payload bytes. */
-const EXECUTOR_RELEASES = { '0.21.0': '0.20.0', '0.21.1': '0.20.0', '0.22.0': '0.20.0', '0.23.0': '0.20.0', '0.23.1': '0.20.0', '0.23.2': '0.20.0', '0.24.1': '0.24.0', '0.25.0': '0.24.0', '0.26.0': '0.24.0' };
+/** Explicit executor release pins; older SDK versions can reuse an immutable release with identical payload bytes. */
+const EXECUTOR_RELEASES = { '0.21.0': '0.20.0', '0.21.1': '0.20.0', '0.22.0': '0.20.0', '0.23.0': '0.20.0', '0.23.1': '0.20.0', '0.23.2': '0.20.0', '0.24.1': '0.24.0', '0.25.0': '0.24.0', '0.26.0': '0.24.0', '0.27.0': '0.27.0' };
 /**
  * The module directories of one SDK version. SYNOPKGLAND_SDK_DIR names a
  * local sdk checkout (development and gates only); otherwise modules come from
@@ -86,16 +86,23 @@ export function sdkSource(version, env = process.env, download = (spec) => goMod
     const dir = env.SYNOPKGLAND_SDK_DIR;
     if (dir)
         return { version, goDir: dir, executorDir: join(dir, 'executor'), local: true };
-    return { version, goDir: download(`${SDK_MODULE}@v${version}`), executorDir: download(`${EXECUTOR_MODULE}@v${EXECUTOR_RELEASES[version] ?? version}`), local: false };
+    const goDir = download(`${SDK_MODULE}@v${version}`);
+    const manifest = readExecutorManifest(goDir, version);
+    if (!manifest && !predatesExecutorManifest(version))
+        throw new Error(`[SDK_UNSUPPORTED] SDK ${version} is missing executor-manifest.json; install a released SDK with manifest format 1.`);
+    return { version, goDir, executorDir: download(`${EXECUTOR_MODULE}@v${manifest?.executorVersion ?? EXECUTOR_RELEASES[version] ?? version}`), local: false, ...(manifest ? { manifest } : {}) };
 }
 const downloaded = new Map();
 /** The module cache directory of module@version; the cache is read-only, so builds copy it first. */
-export function goModDownload(spec, env = process.env) {
-    const key = [spec, env.GOPROXY, env.GOMODCACHE, env.GOPATH].join('\0');
+export function goModDownload(spec, env = process.env, moduleDir = tmpdir()) {
+    const key = [spec, moduleDir, env.GOPROXY, env.GOMODCACHE, env.GOPATH, env.GOSUMDB, env.GONOSUMDB, env.GOPRIVATE].join('\0');
     const cached = downloaded.get(key);
     if (cached)
         return cached;
-    const result = spawnSync('go', ['mod', 'download', '-json', spec], { cwd: tmpdir(), env: goChildEnv({ ...env, GOWORK: 'off', GOFLAGS: '' }), encoding: 'utf8' });
+    // Public SDK manifests rely on Go module sums. Do not add the namespace to
+    // GOPRIVATE/GONOSUMDB as other legacy build children do. For Go Apps the
+    // command also checks the App's existing go.sum in its own module directory.
+    const result = spawnSync('go', ['mod', 'download', '-json', spec], { cwd: moduleDir, env: { ...env, GOWORK: 'off', GOFLAGS: '' }, encoding: 'utf8' });
     let info = {};
     try {
         info = JSON.parse(result.stdout);
@@ -104,6 +111,8 @@ export function goModDownload(spec, env = process.env) {
     if (result.error || result.status !== 0 || !info.Dir) {
         throw new Error(`[SDK_DOWNLOAD_FAILED] go mod download ${spec} failed: ${info.Error ?? result.stderr ?? result.error?.message}${privateSdkHint()}`);
     }
+    if (readExecutorManifest(info.Dir, spec.split('@v')[1] ?? '') && (typeof info.Sum !== 'string' || !/^h1:[A-Za-z0-9+/]{43}=$/.test(info.Sum)))
+        throw new Error(`[SDK_MANIFEST_INVALID] SDK module ${spec} has no verified Go module sum.`);
     downloaded.set(key, info.Dir);
     return info.Dir;
 }
@@ -112,7 +121,7 @@ export function requiredSdk(backend, env = process.env, download) {
     const version = appSdkVersion(backend);
     if (!version)
         throw new Error(`[SDK_REQUIRED] capabilities.delegate and rootOps need the SDK: ${SDK_DEPENDENCY[backend.kind]}`);
-    return download ? sdkSource(version, env, download) : sdkSource(version, env);
+    return sdkSource(version, env, download ?? (spec => goModDownload(spec, env, backend.kind === 'go' ? backend.dir : undefined)));
 }
 /** Go children fetch the private SDK directly; failed fetches need git credentials. */
 export function privateSdkHint() {

package/dist/standalone/sdk-check.d.ts

@@ -5,7 +5,7 @@ export interface SdkProblem {
 }
 /**
  * The backend's dependency files name the App's SDK version; the frontend
- * package and this CLI must agree with it. `needsSdk`: the App declares
+ * must agree, and the CLI must understand its manifest. `needsSdk`: the App declares
  * delegate or rootOps.
  */
-export declare function sdkProblems(backend: SdkBackend, frontendDir: string | undefined, needsSdk: boolean, cliVersion?: string): SdkProblem[];
+export declare function sdkProblems(backend: SdkBackend, frontendDir: string | undefined, needsSdk: boolean, cliVersion?: string, env?: NodeJS.ProcessEnv, download?: (spec: string) => string): SdkProblem[];

package/dist/standalone/sdk-check.js

@@ -1,16 +1,17 @@
 import { readFileSync } from "node:fs";
 import { join, resolve } from "node:path";
 import { CLI_VERSION } from "../cli-version.js";
-import { appSdkVersion, SDK_DEPENDENCY, SDK_FLOOR, SDK_PACKAGE, sdkBelowFloor } from "../runtime/sdk-source.js";
-const minorLine = (version) => version.split(".").slice(0, 2).join(".");
+import { appSdkVersion, SDK_DEPENDENCY, SDK_FLOOR, SDK_PACKAGE, sdkBelowFloor, sdkSource, goModDownload } from "../runtime/sdk-source.js";
+import { predatesExecutorManifest } from '../runtime/sdk-executor-manifest.js';
+import { SHIPPED_EXECUTOR_DIGESTS } from '../runtime/executor-source.js';
 /** The file that names each backend kind's SDK version. */
 const SDK_VERSION_FILE = { go: "backend/go.mod", rust: "Cargo.lock", python: "backend.sdk", node: "backend.sdk" };
 /**
  * The backend's dependency files name the App's SDK version; the frontend
- * package and this CLI must agree with it. `needsSdk`: the App declares
+ * must agree, and the CLI must understand its manifest. `needsSdk`: the App declares
  * delegate or rootOps.
  */
-export function sdkProblems(backend, frontendDir, needsSdk, cliVersion = CLI_VERSION) {
+export function sdkProblems(backend, frontendDir, needsSdk, cliVersion = CLI_VERSION, env = process.env, download) {
     let version;
     try {
         version = appSdkVersion(backend);
@@ -22,16 +23,29 @@ export function sdkProblems(backend, frontendDir, needsSdk, cliVersion = CLI_VER
         throw error;
     }
     if (!version) {
-        return needsSdk ? [{ code: "SDK_REQUIRED", message: `Python, Node and Rust Apps, plus capabilities.delegate and rootOps, need the SDK (${minorLine(cliVersion)}.x): ${SDK_DEPENDENCY[backend.kind]}` }] : [];
+        return needsSdk ? [{ code: "SDK_REQUIRED", message: `Python, Node and Rust Apps, plus capabilities.delegate and rootOps, need the SDK: ${SDK_DEPENDENCY[backend.kind]}` }] : [];
     }
     const file = SDK_VERSION_FILE[backend.kind];
     const problems = [];
-    if (minorLine(version) !== minorLine(cliVersion)) {
-        problems.push({ code: "SDK_UNSUPPORTED", message: `${file} requires SDK ${version}; CLI ${cliVersion} supports only SDK ${minorLine(cliVersion)}.x. Use the matching CLI, or raise the SDK to ${minorLine(cliVersion)}.x.` });
-    }
-    else if (sdkBelowFloor(version)) {
+    if (sdkBelowFloor(version)) {
         problems.push({ code: "SDK_UNSUPPORTED", message: `${file} requires SDK ${version}; CLI ${cliVersion} supports SDK ${SDK_FLOOR} or later. Raise the SDK to ${SDK_FLOOR} or later.` });
     }
+    else if (predatesExecutorManifest(version)) {
+        if (!SHIPPED_EXECUTOR_DIGESTS[version])
+            problems.push({ code: 'SDK_UNSUPPORTED', message: `${file} requires SDK ${version}; this pre-manifest SDK has no pinned executor inventory. Use SDK 0.26.0, 0.27.0, or a release with executor manifest format 1.` });
+    }
+    else {
+        try {
+            sdkSource(version, env, download ?? (spec => goModDownload(spec, env, backend.kind === 'go' ? backend.dir : undefined)));
+        }
+        catch (error) {
+            const message = error.message;
+            const tagged = /^\[([A-Z_]+)\] ([\s\S]*)$/.exec(message);
+            if (!tagged)
+                throw error;
+            problems.push({ code: tagged[1], message: tagged[2] });
+        }
+    }
     const frontend = frontendDir === undefined ? undefined : frontendSdkVersion(frontendDir);
     if (frontend && frontend.version !== version) {
         problems.push({ code: "SDK_VERSION_MISMATCH", message: `frontend/package.json has ${SDK_PACKAGE} ${frontend.spec} (${frontend.version ?? "version unreadable"}), while ${file} requires ${version}; the two must match.` });

package/dist/template-paths.d.ts

@@ -1,5 +1,5 @@
 /**
- * The scaffold templates come from the exactly pinned @synopackageland/templates
+ * The scaffold templates come from the locally installed @synopackageland/templates
  * package; SYNOPKGLAND_TEMPLATES_DIR points at a templates checkout instead.
  */
 export declare function templatesRoot(env?: NodeJS.ProcessEnv, from?: string): string;

package/dist/template-paths.js

@@ -2,7 +2,7 @@ import { createRequire } from "node:module";
 import { dirname, join } from "node:path";
 import { sdkRequirement } from "./runtime/sdk-source.js";
 /**
- * The scaffold templates come from the exactly pinned @synopackageland/templates
+ * The scaffold templates come from the locally installed @synopackageland/templates
  * package; SYNOPKGLAND_TEMPLATES_DIR points at a templates checkout instead.
  */
 export function templatesRoot(env = process.env, from = import.meta.url) {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@synopackageland/cli",
-  "version": "0.26.0",
+  "version": "0.27.1",
   "description": "Syno Package Land Developer Kit CLI",
   "type": "module",
   "bin": {
@@ -20,14 +20,14 @@
     "build": "rm -rf dist && tsc",
     "test": "npm run build && node --import tsx --test --test-concurrency=${SYNOPKGLAND_GATE_JOBS:-3} test/*.test.ts test/ctl/*.test.ts",
     "test:glossary": "node --test scripts/test/glossary-drift.test.mjs",
-    "test:scripts": "node --test scripts/test/gate.test.mjs scripts/test/release.test.mjs scripts/test/pack-docker.test.mjs scripts/test/npm-pack.test.mjs scripts/test/executor-bump.test.mjs scripts/test/smoke-exports.test.mjs scripts/test/executor-digests.test.mjs scripts/test/parallel.test.mjs scripts/test/scaffold-matrix.test.mjs scripts/test/frontend-deps.test.mjs scripts/test/docker-gate.test.mjs scripts/test/gate-plan.test.mjs scripts/test/gates.test.mjs",
+    "test:scripts": "node --test scripts/test/gate.test.mjs scripts/test/release.test.mjs scripts/test/pack-docker.test.mjs scripts/test/npm-pack.test.mjs scripts/test/executor-bump.test.mjs scripts/test/smoke-exports.test.mjs scripts/test/parallel.test.mjs scripts/test/scaffold-matrix.test.mjs scripts/test/frontend-deps.test.mjs scripts/test/docker-gate.test.mjs scripts/test/gate-plan.test.mjs scripts/test/gates.test.mjs",
     "gates": "bash scripts/ci/gates.sh",
     "gates:fast": "bash scripts/ci/gates.sh --fast",
     "prepublishOnly": "npm run build"
   },
   "dependencies": {
     "@napi-rs/keyring": "^2.1.1",
-    "@synopackageland/templates": "0.26.0",
+    "@synopackageland/templates": "~0.27.0",
     "ajv": "^8.17.1",
     "commander": "^13.1.0",
     "json-canonicalize": "^3.0.1",

package/skills/SKILL.md

@@ -5,6 +5,17 @@ description: Initialize, extend, check, build, inspect, and deploy Synology appl
 
 # Independent Synology SPKs
 
+CLI 0.27.x installs templates through `~0.27.0`. A templates patch needs only a
+templates release; npm install/update selects a patch in that minor line. The CLI
+uses the locally installed templates and reads their SDK pin for defaults; it
+never downloads templates at runtime. Preserve the lockfile and use `npm ci` for
+reproducible offline-ready installations. SDK minor releases are independent of
+the CLI: executor manifest format 1 in the resolved SDK pins the executor release,
+Go toolchain and six payload digests. Preserve npm integrity and Go module sums.
+The CLI verifies bytes before packaging and never fetches a manifest at NAS runtime.
+Unsupported formats require a CLI update; invalid manifests fail closed. Existing
+SDK 0.26.0/0.27.0 use the frozen legacy inventory.
+
 Before releasing an executor App, read [reference/approval-upgrades.md](reference/approval-upgrades.md). Run build/inspect with the previous released SPK as `--baseline` and include the approval difference in release notes. Without a comparable baseline, retention is unknown.
 
 Use this guide to initialize, build and inspect own applications or upstream OSS as independent packages. 依已實作能力區分 DSM session 檔案、私有 jobs 與 App 登入；delegate 已實作並隨 CLI 提供固定操作的離線委託（預設 `files.moveFromStaging`）；共用 delegate／rootOps executor 的完整裝置生命週期驗收仍待完成，不得宣稱已通過；支援邊界依 delegate guide／support matrix，禁止發明新的身分平台。
@@ -25,6 +36,8 @@ Read [reference/lifecycle.md](reference/lifecycle.md) before editing `dsm-script
 
 Read [reference/ui-vue.md](reference/ui-vue.md) when editing Vue components in the native-go Vue template; use the installed SDK contracts, keep DSM embedding boundaries, and verify the actual app.
 
+Buttons follow DSM's policy ([reference/ui-vue.md](reference/ui-vue.md#buttons), the UI package's `docs/button-policy.md`): only the bar that closes a dialog, wizard or form draws capsules, with Cancel/Reset first and one primary (or one danger to confirm a deletion) last; toolbar, page, section and row actions are grey tool buttons, Delete included; links go to `Link`. Choose the variant, never the shape.
+
 Read [reference/ui-json.md](reference/ui-json.md) when generating or editing JSON UI; discover the installed catalog, validate the spec, then render and fix layout issues.
 
 ## UI copywriting

package/skills/reference/compose.md

@@ -232,7 +232,7 @@ declared availability readiness, LAN isolation/egress, protected grant lifecycle
 ACLs, two-user visibility and clean install/upgrade/reboot/stop/uninstall before
 calling the package supported on a NAS. No NAS is accessed by the build gate.
 
-The unified Compose contract uses SDK 0.17.3 and templates 0.17.5 with CLI 0.17.3. Use the published, matching versions together; the legacy packaging route and bridge publish mode are removed.
+The unified Compose contract uses SDK 0.27.x with CLI 0.27.x and locally installed templates from `~0.27.0`. Templates patches can ship independently; npm install/update resolves them, and SDK defaults come from the installed templates. SDK minor upgrades do not require a CLI release when they declare supported executor manifest format 1; the resolved SDK owns the release mapping and verified payload digests. The CLI does not fetch templates at runtime. The legacy packaging route and bridge publish mode are removed.
 
 Primary override files, and each included override set, must share a directory. Cross-directory override bases are rejected before loader I/O. Included implicit .env files are confined, inventoried and preserved; symlinks are rejected.
 

package/skills/reference/ui-vue.md

@@ -61,6 +61,31 @@ Reuse the embedded theme's typography, spacing and public controls. Preserve
 loading, empty, error, disabled and permission states. Backend policies and DSM
 checks decide authority; component visibility cannot grant access.
 
+## Buttons
+
+Follow DSM's button policy, in the installed
+`node_modules/@synopackageland/ui/docs/button-policy.md`. Choose only the
+`variant`; the container chooses the shape, so do not set `kind="action"`.
+
+| Place | Use |
+| --- | --- |
+| Dialog, Sheet, Wizard footer; `FormActions`, `AppActionBar`, `Footbar`, Panel `#fbar` | capsule: Cancel or Reset `secondary`, then one `primary` last |
+| Confirming a deletion | Dialog footer: Cancel, then one `danger` last |
+| Toolbar, PageHeader, section or card body and `#footer`, beside a field | grey tool `Button` (Delete too) |
+| List or grid row | `IconButton` with a `label` |
+| Help, docs, external pages | `Link`, not a button |
+
+- A capsule only ends something: it closes a dialog, applies a form or moves a
+  wizard. Disable this connection, Open or Check again stay tool buttons, even
+  in a `SettingsSection` `#footer`; put a section's Save / Cancel in `FormActions`.
+- One main action per footer, placed last. Inside a page, `primary` only for
+  the one step that unblocks it (Sign in), at most one per section.
+- Keep the default size; neighbouring buttons share one size. One refresh per
+  page, in the PageHeader.
+- In development the UI warns in the console about a capsule outside a footer,
+  two main actions in a footer, or a main action that is not last. Clear these
+  warnings before handing over the app.
+
 ## Start fast
 
 Every api.cgi call pays DSM's session check (about 60–240 ms on a NAS), so