@synopackageland/cli 0.27.1 → 0.28.0

package/CHANGELOG.md

@@ -1,5 +1,12 @@
 # Changelog
 
+## 0.28.0 (2026-10-24)
+
+- Depend on templates `~0.28.0` with SDK/App 0.28.0 and UI 0.14.10. SDK 0.28.0 reuses executor/v0.27.0 through executor manifest format 1; no executor digests change.
+- Default the Compose startup budget to 900 seconds and document slow-NAS readiness; the SDK owns health timing and the Starting status. No per-App option is added.
+- Keep UI CGI scripts executable in built SPKs, and let external OIDC resume tokens reach only the fixed DSM CGI.
+- The release gate checks SDK 0.27.1+ executor builds against the SDK executor manifest instead of requiring a frozen legacy table entry.
+
 ## 0.27.1 (2026-10-23)
 
 - Read executor release mappings, toolchain and six payload pins from SDK executor manifest format 1. Accept compatible SDK minors independently of CLI versions; keep the frozen 0.26.0/0.27.0 fallback. Remove the CLI digest-recording script.

package/README.md

@@ -66,8 +66,8 @@ CLI-only patch releases can differ from the SDK patch. Compose import and SDK de
 read the SDK pin from the installed templates; explicit App SDK declarations take precedence.
 
 `init` and `add` read their templates from the locally installed
-`@synopackageland/templates`. CLI 0.27.1 depends on `~0.27.0`: npm installation or
-update can select the latest templates patch in the 0.27 minor line. Templates
+`@synopackageland/templates`. CLI 0.28.0 depends on `~0.28.0`: npm installation or
+update can select the latest templates patch in the 0.28 minor line. Templates
 patches need only a templates release; update the npm installation to receive them.
 The CLI never fetches templates at runtime, so offline use works after installation;
 commit a lockfile and use `npm ci` to reproduce a chosen dependency tree.

package/dist/standalone/compose-errors.js

@@ -13,7 +13,7 @@ export const COMPOSE_ERRORS = {
     COMPOSE_STARTUP_INVALID: {
         code: "COMPOSE_STARTUP_INVALID",
         description: "The container startup budget is invalid.",
-        suggestion: "Set compose.startup_timeout_seconds to an integer from 2 to 900 seconds; the default is 120. Read the same SYNOPKGLAND_STARTUP_BUDGET_SECONDS in the App bootstrap adapter.",
+        suggestion: "Set compose.startup_timeout_seconds to an integer from 2 to 900 seconds; the default is 900, which a loaded HDD NAS may need. Read the same SYNOPKGLAND_STARTUP_BUDGET_SECONDS in the App bootstrap adapter.",
     },
     COMPOSE_STARTUP_TIMEOUT: {
         code: "COMPOSE_STARTUP_TIMEOUT",
@@ -82,8 +82,8 @@ export const COMPOSE_ERRORS = {
     },
     COMPOSE_HEALTH_NOT_READY: {
         code: "COMPOSE_HEALTH_NOT_READY",
-        description: "The App health endpoint did not return the expected status.",
-        suggestion: "Check the declared App health path/status and upstream health; redirects are not followed.",
+        description: "The App health endpoint did not return the expected status within the startup budget.",
+        suggestion: "Check the declared App health path/status and upstream health; redirects are not followed. daemon/daemon.log records how long the App stayed unavailable. Keep the default startup budget on slow NAS devices.",
     },
     COMPOSE_REQUEST_INVALID: {
         code: "COMPOSE_REQUEST_INVALID",

package/dist/standalone/compose.js

@@ -77,7 +77,7 @@ export function readComposeApp(value, root, arches, fail, context = {}) {
     if (value.startup_timeout_seconds !== undefined &&
         (!Number.isInteger(value.startup_timeout_seconds) ||
             value.startup_timeout_seconds < 2 || value.startup_timeout_seconds > 900))
-        return invalid("compose.startup_timeout_seconds must be an integer from 2 to 900 seconds (default 120).", "COMPOSE_STARTUP_INVALID");
+        return invalid("compose.startup_timeout_seconds must be an integer from 2 to 900 seconds (default 900).", "COMPOSE_STARTUP_INVALID");
     let hostUdp;
     if (value.host_udp !== undefined) {
         const ports = new Set();
@@ -178,7 +178,7 @@ export function composeDaemon(m) {
         args: ["run"],
         targets: m.compose.targets,
         env: {},
-        timeouts: { stop: 30, status: 5, uninstall: 60, ...m.lifecycleTimeouts, start: m.compose.plan.startup_timeout_seconds ?? m.lifecycleTimeouts?.start ?? 120 },
+        timeouts: { stop: 30, status: 5, uninstall: 60, ...m.lifecycleTimeouts, start: m.compose.plan.startup_timeout_seconds ?? m.lifecycleTimeouts?.start ?? 900 },
     };
 }
 export function composeNetwork(m) {

package/dist/standalone/oidc-resume.d.ts

@@ -1,2 +1,2 @@
-/** No caller-provided URL reaches location: only a transaction and a declared port. */
+/** Only the fixed DSM CGI receives a resume token; external origins are resolved by the SDK. */
 export declare function oidcResumeRuntime(pkg: string, ports: number[]): string;

package/dist/standalone/oidc-resume.js

@@ -1,4 +1,4 @@
-/** No caller-provided URL reaches location: only a transaction and a declared port. */
+/** Only the fixed DSM CGI receives a resume token; external origins are resolved by the SDK. */
 export function oidcResumeRuntime(pkg, ports) {
     return `(function(param) {
   if (typeof param === 'string') {
@@ -14,13 +14,18 @@ export function oidcResumeRuntime(pkg, ports) {
   }
   if (!param || typeof param !== 'object' || Array.isArray(param)) return false;
   var value = param && param.ssoResume;
-  if (typeof value !== 'string') return false;
+  if (typeof value !== 'string' || /\\s/.test(value)) return false;
+  var external = /^[A-Za-z0-9_-]{1,128}:x[01]:[0-9]{1,19}\\.[0-9]{1,19}$/.test(value);
   var parts = /^([A-Za-z0-9_-]{1,128}):([0-9]{1,5})$/.exec(value);
-  if (!parts || ${JSON.stringify(ports)}.indexOf(Number(parts[2])) < 0) return false;
+  if (!external && (!parts || ${JSON.stringify(ports)}.indexOf(Number(parts[2])) < 0)) return false;
   var target = new URL(${JSON.stringify(`/webman/3rdparty/${pkg}/sso/authorize.cgi`)},location.origin);
-  var app = new URL(location.origin); app.port = parts[2]; app.pathname = '/_sso/dsm-return';
-  target.searchParams.set('return',app.href);
-  target.searchParams.set('txn',parts[1]);
+  if (external) {
+    target.searchParams.set('resume',value);
+  } else {
+    var app = new URL(location.origin); app.port = parts[2]; app.pathname = '/_sso/dsm-return';
+    target.searchParams.set('return',app.href);
+    target.searchParams.set('txn',parts[1]);
+  }
   target.searchParams.set('login_attempt','1');
   location.replace(target.href);
   return true;

package/dist/standalone/spk.js

@@ -410,7 +410,7 @@ function copyUiTree(source, target) {
                     throw new StandaloneBuildError("STANDALONE_UI_TOO_LARGE", "The UI directory exceeds 64 MiB.");
                 }
                 copyFileSync(src, join(to, name));
-                chmodSync(join(to, name), FILE_MODE);
+                chmodSync(join(to, name), name.endsWith(".cgi") ? EXEC_MODE : FILE_MODE);
             }
             else {
                 throw new StandaloneBuildError("STANDALONE_UI_SPECIAL_FILE", `The UI directory may contain only regular files and directories: ${src}`);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@synopackageland/cli",
-  "version": "0.27.1",
+  "version": "0.28.0",
   "description": "Syno Package Land Developer Kit CLI",
   "type": "module",
   "bin": {
@@ -27,7 +27,7 @@
   },
   "dependencies": {
     "@napi-rs/keyring": "^2.1.1",
-    "@synopackageland/templates": "~0.27.0",
+    "@synopackageland/templates": "~0.28.0",
     "ajv": "^8.17.1",
     "commander": "^13.1.0",
     "json-canonicalize": "^3.0.1",

package/skills/reference/compose.md

@@ -37,14 +37,21 @@ scripts run as the package account; containers are managed by Container Manager.
 
 ## Startup budget
 
-Set `compose.startup_timeout_seconds: 600` for a slow cold start or migration.
-Omitting it uses 120 seconds; only integers from 2 through 900 are accepted.
+Omit `compose.startup_timeout_seconds`: the default of 900 seconds lets a loaded
+HDD NAS with 2 GB RAM start the App. Declare a shorter value only with device
+evidence; only integers from 2 through 900 are accepted.
 Lock waiting, status, readiness, stability and handoff share that deadline; there
 is no extra fixed handoff allowance. The cap is a policy bound, not a measured
 DSM lifecycle limit. `daemon: {timeouts: {stop: 120, status: 15, uninstall: 300}}`
 configures the other lifecycle phases without declaring a daemon payload.
-A transient health failure closes new ingress while the running App gets one
-operation-budget recovery window; authority or generation failures stop at once.
+One readiness probe may take 30 seconds. A health failure after startup closes
+new ingress and the gateway shows a localized, self-refreshing starting page
+(`app_starting` for API clients) while DSM status stays running; the App gets
+the startup budget to recover before its gateway stops. Authority or generation
+failures stop at once. The SDK raises stricter Compose healthcheck timing to
+timeout 30s, retries 3 and start_period equal to the startup budget; declare the
+health command only, without timing or short in-command limits such as
+`curl --max-time 2`.
 Use a matching SDK that implements the field and rebuild the App; older planners
 are rejected for explicit budgets. The SDK plan drives generated daemon start
 and supplies every container with `SYNOPKGLAND_STARTUP_BUDGET_SECONDS`, overriding
@@ -93,7 +100,7 @@ a build operator trust decision. `check`/`inspect` remain offline.
 
 | Feature | Current behavior |
 | --- | --- |
-| Files in one directory, profiles, anchors, depends_on, healthcheck | Reference-loader semantics retained; DSM worker compatibility needs device acceptance |
+| Files in one directory, profiles, anchors, depends_on, healthcheck | Reference-loader semantics retained; healthcheck timing receives the SDK slow-NAS floor; DSM worker compatibility needs device acceptance |
 | Named local volumes | Stable package namespace, retained across recreation; inspect inventory |
 | Private bind data | DSM build rejects COMPOSE_PRIVATE_BIND_TIMING_UNSUPPORTED: clean-install preinst precedes pkgvar creation, while worker acquire precedes postinst; no root initialization or automatic volume conversion |
 | Image VOLUME | Build inventories verified image config and assigns a stable named volume |

package/skills/reference/lifecycle.md

@@ -115,7 +115,7 @@ Use existing `daemon.timeouts` for start/stop/status/uninstall (defaults
 30/30/5/60 seconds). Start/stop/uninstall accept 2–3600 seconds and status accepts
 1–3600. A `daemon` containing only `timeouts` declares budgets without an
 executable, including background and Compose Apps; Compose start still uses
-`compose.startup_timeout_seconds` (120, 2–900). Background user-manager recovery
+`compose.startup_timeout_seconds` (900, 2–900). Background user-manager recovery
 uses the start allowance and its generated package user unit uses the stop
 allowance with `KillMode=control-group`.