@synopackageland/cli 0.3.10 → 0.4.0

package/dist/templates/native-go-vue/frontend/package.json

@@ -0,0 +1,6 @@
+{
+  "name": "native-dsm-vue-app", "private": true, "type": "module",
+  "scripts": {"build": "vue-tsc --noEmit && vite build", "test": "vitest run"},
+  "dependencies": {"@synopackageland/ui": "0.4.0", "vue": "3.5.43"},
+  "devDependencies": {"@vitejs/plugin-vue": "6.0.9", "vite": "7.3.6", "typescript": "5.9.3", "vue-tsc": "3.3.11", "vitest": "3.2.4", "jsdom": "26.1.0"}
+}

package/dist/templates/native-go-vue/frontend/src/App.vue

@@ -0,0 +1,132 @@
+<script setup lang="ts">
+import {computed, onMounted, onUnmounted, ref} from 'vue'
+import {AppRoot, Button, Callout, Dialog, SettingsSection, Textarea} from '@synopackageland/ui'
+import {stateCopy, type AppStatus, type Context, type Status} from './context'
+const props = defineProps<{ctx: Context}>()
+const app = ref<AppStatus>()
+const status = ref<Status>()
+const busy = ref(false)
+const error = ref('')
+const notice = ref('')
+const disableOpen = ref(false)
+const id = ref('')
+const text = ref('')
+const identity = ref('')
+let disposed = false
+const refreshing = ref(false)
+let appCookie = ''
+const configured = computed(() => status.value?.reason !== "not-requested")
+const details = computed(() => status.value ? stateCopy[status.value.state] : undefined)
+function message(e: unknown) {
+ const code = (e as {code?: string})?.code || 'request_failed'
+ return ({session_required:'Your DSM session expired. Sign in again.',access_denied:'This sample belongs to another account.',integration_unavailable:'Integration is unavailable. Ask an administrator to activate or recover it.',personal_unavailable:'Sample storage is unavailable. Ask an administrator to check package data.',root_conflict:'A conflicting scheduler task exists. Ask an administrator to review it.',root_verify_failed:'Scheduler verification failed. Refresh and review the task.',root_run_failed:'The approved operation failed. Review integration status and cleanup.'} as Record<string,string>)[code] || `Request failed (${code}). Refresh and try again.`
+}
+async function refresh() {
+ if(disposed || refreshing.value) return
+ refreshing.value = true; error.value = ''
+ try {
+  const [a,s] = await Promise.all([props.ctx.call<AppStatus>('app.status'),props.ctx.call<Status>('integration.status')])
+  if(disposed) return
+  app.value = a; status.value = s
+  if(s.state !== 'ready') {id.value='';text.value='';return}
+  // Plain --ui vue has no personal routes; not-enabled status hides this.
+  const list = await props.ctx.call<{items:Array<{id:string;name:string}>}>('personal.list')
+  if(disposed) return
+  id.value = list.items[0]?.id || ''
+  if(id.value) {
+   const note = await props.ctx.call<{text:string}>('personal.read',{id:id.value})
+   if(!disposed) text.value = note.text
+  }
+ } catch(e) {if(!disposed) {error.value = message(e);status.value=undefined;id.value='';text.value=''}} finally {refreshing.value=false}
+}
+async function action(op: string) {
+ if(busy.value || refreshing.value || disposed) return
+ busy.value=true;error.value='';notice.value=''
+ try {
+  if(!props.ctx.root) throw {code:'unsupported'}
+  const approved = await props.ctx.root.authorize(op)
+  if(disposed) return
+  if(approved !== 'ready') {notice.value='Approval cancelled. No operation was run.';return}
+  await props.ctx.root.run(op)
+  if(disposed) return
+  notice.value='Operation completed. Integration status was checked again.'
+  await refresh()
+ } catch(e) {if(!disposed) {await refresh();if(!disposed) error.value=message(e)}}
+ finally {if(!disposed) busy.value=false}
+}
+async function save() {
+ if(busy.value || refreshing.value || !id.value || disposed) return
+ busy.value=true;error.value='';notice.value=''
+ try {await props.ctx.call('personal.write',{id:id.value,text:text.value});if(!disposed) notice.value='Your sample note was saved.'}
+ catch(e) {if(!disposed) error.value=message(e)} finally {if(!disposed) busy.value=false}
+}
+async function login() {
+ if(busy.value || refreshing.value || disposed) return
+ busy.value=true;error.value=''
+ try {
+  const result=await props.ctx.call<{cookie:string;user:string}>('identity.login')
+  if(!disposed){appCookie=result.cookie;identity.value=`App session for ${result.user}`}
+ } catch(e) {if(!disposed) error.value=message(e)} finally {if(!disposed) busy.value=false}
+}
+async function checkIdentity() {
+ if(busy.value || refreshing.value || disposed) return
+ busy.value=true;error.value=''
+ try {const result=await props.ctx.call<{user:string}>('identity.current',{cookie:appCookie});if(!disposed) identity.value=`App session for ${result.user}`}
+ catch(e) {if(!disposed) {appCookie='';identity.value='';error.value=message(e)}} finally {if(!disposed) busy.value=false}
+}
+const hasIdentity = ref(false)
+onMounted(async()=>{
+ props.ctx.reopen(()=>{if(!disposed) void refresh()})
+ await refresh()
+ if(disposed || !app.value) return
+ try {const result = await props.ctx.call<{mode:string}>('identity.status');if(!disposed) hasIdentity.value = result.mode==='better-auth'} catch { /* Optional route absent in Go-only. */ }
+})
+onUnmounted(()=>{disposed=true;appCookie='';text.value='';id.value=''})
+</script>
+
+<template>
+ <AppRoot modal-scope="app" style="height: 100%">
+  <main class="integration-app" :aria-busy="busy || refreshing" aria-label="Package settings">
+   <header class="integration-heading">
+    <div><h1>{{ app?.package || 'Package settings' }}</h1><p v-if="app">{{ app.user }} · {{ app.version }}</p></div>
+    <Button variant="secondary" :disabled="busy || refreshing" @click="error=''; refresh()">Refresh</Button>
+   </header>
+   <p v-if="refreshing" role="status">Refreshing status…</p>
+   <p v-else-if="busy" role="status">Completing operation…</p>
+   <Callout v-if="error" tone="danger" title="Action required"><span role="alert">{{ error }}</span></Callout>
+   <p v-if="notice" class="integration-notice" role="status">{{ notice }}</p>
+   <SettingsSection title="DSM integration" :collapsible="false">
+    <div v-if="status && details" :data-integration-state="status.state" class="integration-status" role="status">
+     <h2>{{ details.label }}</h2><p>{{ details.description }}</p>
+     <p v-if="status.cleanup === 'required'">Cleanup is required. Ask an administrator to run teardown or disable.</p>
+     <dl><dt>Package running</dt><dd>{{ status.packageRunning }}</dd><dt>Scheduler</dt><dd>{{ status.scheduler }}</dd></dl>
+    </div>
+    <p v-else-if="error" role="status">Status could not be loaded. Refresh to try again.</p>
+    <p v-else role="status">Loading integration status…</p>
+    <div v-if="app?.admin && ctx.root && configured" class="integration-actions">
+     <Button variant="primary" :disabled="busy || refreshing" @click="action('helper_enable')">Approve and activate</Button>
+     <Button variant="secondary" :disabled="busy || refreshing" @click="action('helper_recover')">Recover</Button>
+     <Button variant="secondary" :disabled="busy || refreshing" @click="action('helper_teardown')">Teardown</Button>
+     <Button variant="secondary" :disabled="busy || refreshing" @click="disableOpen=true">Disable</Button>
+    </div>
+    <Callout v-if="app && !app.admin && status?.state !== 'ready'" title="Administrator action needed">Ask a DSM administrator to open this package's settings. Your login cannot approve root operations.</Callout>
+   </SettingsSection>
+   <SettingsSection v-if="status?.state === 'ready'" title="My sample data" :collapsible="false">
+    <p class="integration-help">This synthetic note belongs to your DSM account and is stored in package data.</p>
+    <p v-if="refreshing" role="status">Loading your sample data…</p>
+    <Callout v-else-if="!id" title="No sample data">Refresh to request your sample data again.</Callout>
+    <label v-if="id" class="integration-field"><span>My sample note</span><Textarea v-model="text" aria-label="My sample note" :disabled="busy || refreshing" /></label>
+    <Button v-if="id" variant="primary" :disabled="busy || refreshing" @click="save">Save my note</Button>
+   </SettingsSection>
+   <SettingsSection v-if="hasIdentity" title="Optional app identity" :collapsible="false">
+    <p class="integration-help">Your DSM login is checked again for every app session request.</p>
+    <div class="integration-actions"><Button variant="primary" :disabled="busy || refreshing" @click="login">Create app session</Button><Button variant="secondary" :disabled="busy || refreshing || !identity" @click="checkIdentity">Check app session</Button></div>
+    <p v-if="identity" role="status">{{ identity }}</p>
+   </SettingsSection>
+   <Dialog v-model:open="disableOpen" title="Disable integration?" description="New integration requests will be refused before helper cleanup begins.">
+    <p>Your sample data and historical root output are retained. A failed cleanup remains visible.</p>
+    <template #footer><Button variant="secondary" @click="disableOpen=false">Cancel</Button><Button variant="danger" :disabled="busy || refreshing" @click="disableOpen=false; action('helper_disable')">Confirm disable</Button></template>
+   </Dialog>
+  </main>
+ </AppRoot>
+</template>

package/dist/templates/native-go-vue/frontend/src/context.ts

@@ -0,0 +1,17 @@
+export type IntegrationState = 'not-enabled' | 'ready' | 'needs-approval' | 'incompatible' | 'stopped' | 'failed'
+export interface Status {state: IntegrationState; reason?: string; cleanup?: string; packageRunning: string; scheduler: string}
+export interface Context {
+ call<T = unknown>(method: string, params?: Record<string, unknown>): Promise<T>
+ reopen(fn: () => void): void
+ locale: string
+ root?: {state(op: string): Promise<string>; authorize(op: string): Promise<string>; run(op: string): Promise<unknown>; remove(op: string): Promise<string>}
+}
+export interface AppStatus {package: string; version: string; user: string; admin: boolean}
+export const stateCopy: Record<IntegrationState, {label: string; description: string}> = {
+ 'not-enabled': {label: 'Not enabled', description: 'An administrator can enable integration for this package.'},
+ ready: {label: 'Ready', description: 'The helper passed a fresh trusted health check.'},
+ 'needs-approval': {label: 'Approval required', description: 'Ask an administrator to approve and activate integration.'},
+ incompatible: {label: 'Incompatible', description: 'Inventory or trust checks failed. Ask an administrator to review this package.'},
+ stopped: {label: 'Stopped', description: 'An administrator must recover integration after start or reboot.'},
+ failed: {label: 'Failed', description: 'Integration could not finish. Review cleanup status before retrying.'},
+}

package/dist/templates/native-go-vue/frontend/src/main.ts

@@ -0,0 +1,26 @@
+import {createApp} from 'vue'
+import App from './App.vue'
+import type {Context} from './context'
+import '@synopackageland/ui/themes/dsm7-embedded.css'
+import './style.css'
+
+let mountSequence = 0
+export function mount(root: HTMLElement, ctx: Context) {
+ const app = createApp(App, {ctx})
+ // Include the generated package ID, an instance counter and randomness even
+ // across separately loaded bundles. getRandomValues also works on DSM HTTP.
+ app.config.idPrefix = `__PACKAGE__-${++mountSequence}-${crypto.getRandomValues(new Uint32Array(4)).join('-')}`
+ const hadRootClass = root.classList.contains('dsmapp-vue-root')
+ root.classList.add('dsmapp-vue-root')
+ app.mount(root)
+ return {unmount() {app.unmount(); if(!hadRootClass) root.classList.remove('dsmapp-vue-root')}}
+}
+// Register with the existing per-package DSM window loader. Never share a
+// singleton app or user/session state between different mount calls.
+const script = document.currentScript as HTMLScriptElement | null
+const packageID = script?.getAttribute('data-package')
+const host = window as unknown as {DsmPackageApps: Record<string, {mount: typeof mount}>}
+if (packageID) {
+ host.DsmPackageApps = host.DsmPackageApps || {}
+ host.DsmPackageApps[packageID] = {mount}
+}

package/dist/templates/native-go-vue/frontend/src/style.css

@@ -0,0 +1,14 @@
+.dsmapp-vue-root {height: 100%; min-height: 0; width: 100%; overflow: hidden;}
+[data-ui-app] .integration-app {padding: var(--ui-space-5, 20px); max-width: 72ch; color: var(--ui-text); font-family: var(--ui-font-sans); font-size: 13px; line-height: 1.5;}
+[data-ui-app] .integration-heading {display: flex; align-items: center; justify-content: space-between; gap: 16px; margin-bottom: 20px;}
+[data-ui-app] .integration-heading h1 {font-size: 20px; font-weight: 600; margin: 0;}
+[data-ui-app] .integration-heading p {color: var(--ui-text); margin: 4px 0 0;}
+[data-ui-app] .integration-app section {margin-top: 24px;}
+[data-ui-app] .integration-status h2 {font-size: 15px; font-weight: 600; margin: 0;}
+[data-ui-app] .integration-status p {margin: 6px 0;}
+[data-ui-app] .integration-status dl {display: grid; grid-template-columns: max-content 1fr; gap: 4px 16px; margin: 12px 0;}
+[data-ui-app] .integration-status dt, [data-ui-app] .integration-help {color: var(--ui-text);}
+[data-ui-app] .integration-status dd {margin: 0;}
+[data-ui-app] .integration-actions {display: flex; flex-wrap: wrap; gap: 8px; margin-top: 16px;}
+[data-ui-app] .integration-field {display: grid; gap: 6px; margin: 12px 0;}
+[data-ui-app] .integration-notice {color: var(--ui-text);}

package/dist/templates/native-go-vue/frontend/test/apps.test.ts

@@ -0,0 +1,148 @@
+// @vitest-environment jsdom
+import {expect, test, vi} from 'vitest'
+import {nextTick} from 'vue'
+import {mount} from '../src/main'
+import type {Context, IntegrationState} from '../src/context'
+
+function fixture(id: string, admin: boolean, state: IntegrationState = 'ready') {
+ const reopen: Array<() => void> = []
+ const call = vi.fn(async (method: string) => {
+  if(method === 'app.status') return {package: id, version:'0.1.0-0001',user:admin?'admin':'normal1',admin}
+  if(method === 'integration.status') return {state,reason:'fixture',packageRunning:'unknown',scheduler:'not-probed'}
+  if(method === 'personal.list') return {items:[{id:`${id}-private`,name:'My sample note'}]}
+  if(method === 'personal.read') return {id:`${id}-private`,text:`Private ${id}`}
+  throw {code:'unknown_method'}
+ })
+ const ctx = {call,reopen:(fn:()=>void)=>reopen.push(fn),locale:'en',root:{state:vi.fn(async()=> 'missing'),authorize:vi.fn(async()=> 'ready'),run:vi.fn(async()=>{}),remove:vi.fn(async()=> 'missing')}} as Context
+ const root=document.createElement('div');document.body.append(root)
+ const app=mount(root,ctx)
+ return {root,app,ctx,call,reopen}
+}
+async function settle(){for(let i=0;i<12;i++){await Promise.resolve();await nextTick()}await new Promise(resolve=>setTimeout(resolve,25))}
+function click(root:HTMLElement,text:string){const node=[...root.querySelectorAll('button')].find(node=>node.textContent?.trim()===text);expect(node, text).toBeTruthy();node!.click()}
+
+test('six states and ordinary-user errors give actionable status without approval controls',async()=>{
+ for(const state of ['not-enabled','ready','needs-approval','incompatible','stopped','failed'] as IntegrationState[]){
+  const f=fixture('Ordinary',false,state);await settle()
+  expect(f.root.querySelector('[data-integration-state]')?.getAttribute('data-integration-state')).toBe(state)
+  expect(f.root.textContent).not.toContain('Approve and activate')
+  f.app.unmount();f.root.remove()
+ }
+})
+test('approval cancellation never runs the root task and all fixed controls recheck status',async()=>{
+ const f=fixture('Admin',true,'needs-approval');await settle()
+ f.ctx.root!.authorize=vi.fn(async()=> 'cancelled')
+ click(f.root,'Approve and activate');await settle()
+ expect(f.ctx.root!.run).not.toHaveBeenCalled()
+ expect(f.root.textContent).toContain('Approval cancelled')
+ f.ctx.root!.authorize=vi.fn(async()=> 'ready')
+ click(f.root,'Approve and activate');await settle()
+ expect(f.ctx.root!.run).toHaveBeenCalledWith('helper_enable')
+ for(const [label,op] of [['Recover','helper_recover'],['Teardown','helper_teardown']] as const){click(f.root,label);await settle();expect(f.ctx.root!.run).toHaveBeenCalledWith(op)}
+ click(f.root,'Disable');await settle();click(f.root,'Confirm disable');await settle();expect(f.ctx.root!.run).toHaveBeenCalledWith('helper_disable')
+ f.app.unmount();f.root.remove()
+})
+test('two generated package IDs keep mounts, reopen events, overlays and unmount independent',async()=>{
+ const a=fixture('M1bAlpha',true),b=fixture('M1bBeta',true);await settle()
+ expect(a.root.textContent).toContain('M1bAlpha');expect(a.root.textContent).not.toContain('M1bBeta')
+ expect(b.root.textContent).toContain('M1bBeta')
+ click(a.root,'Disable');await settle()
+ expect(a.root.querySelector('[role="dialog"]')).toBeTruthy()
+ expect(b.root.querySelector('[role="dialog"]')).toBeNull()
+ const ac=a.call.mock.calls.length,bc=b.call.mock.calls.length
+ a.reopen.forEach(fn=>fn());await settle();expect(a.call.mock.calls.length).toBeGreaterThan(ac);expect(b.call.mock.calls.length).toBe(bc)
+ a.app.unmount();await settle();expect(a.root.childElementCount).toBe(0)
+ const count=a.call.mock.calls.length;a.reopen.forEach(fn=>fn());await settle();expect(a.call.mock.calls.length).toBe(count)
+ b.reopen.forEach(fn=>fn());await settle();expect(b.call.mock.calls.length).toBeGreaterThan(bc)
+ b.app.unmount();a.root.remove();b.root.remove()
+})
+
+test('first-load errors replace loading text with an explicit retry state',async()=>{
+ const root=document.createElement('div');document.body.append(root)
+ const ctx={locale:'en',reopen(){},call:vi.fn(async()=>{throw {code:'auth_unavailable'}})} as Context
+ const app=mount(root,ctx);await settle()
+ expect(root.textContent).toContain('Status could not be loaded')
+ expect(root.textContent).not.toContain('Loading integration status')
+ app.unmount();root.remove()
+})
+test('a ready integration with no sample handle shows an explicit empty state',async()=>{
+ const f=fixture('Empty',false)
+ f.call.mockImplementation(async(method:string)=> {
+  if(method==='app.status')return {package:'Empty',version:'0.1.0',user:'normal1',admin:false}
+  if(method==='integration.status')return {state:'ready',packageRunning:'unknown',scheduler:'not-probed'}
+  if(method==='personal.list')return {items:[]}
+  throw {code:'unknown_method'}
+ })
+ f.reopen.forEach(fn=>fn());await settle()
+ // Reopen once after the initial in-flight refresh has finished.
+ f.reopen.forEach(fn=>fn());await settle()
+ expect(f.root.textContent).toContain('No sample data')
+ f.app.unmount();f.root.remove()
+})
+
+test('root failure diagnostics survive the required post-failure status refresh',async()=>{
+ const f=fixture('RootFailure',true,'needs-approval');await settle()
+ f.ctx.root!.run=vi.fn(async()=>{throw {code:'root_run_failed'}})
+ click(f.root,'Approve and activate');await settle()
+ expect(f.root.textContent).toContain('The approved operation failed')
+ expect(f.call.mock.calls.filter(args=>args[0]==='integration.status').length).toBeGreaterThan(1)
+ f.app.unmount();f.root.remove()
+})
+
+test('a local modal leaves the other mount interactive and preserves host styles',async()=>{
+ const a=fixture('M1bAlpha',true),b=fixture('M1bBeta',true)
+ const body=document.body.getAttribute('style'),html=document.documentElement.getAttribute('style')
+ try {
+  await settle();click(a.root,'Disable');await settle()
+  const dialog=a.root.querySelector('[role="dialog"]')!
+  expect(dialog).toBeTruthy()
+  expect(dialog.hasAttribute('aria-modal')).toBe(false)
+  expect(b.root.querySelector('.integration-app')!.closest('[inert], [aria-hidden="true"]')).toBeNull()
+  expect(getComputedStyle(b.root).pointerEvents).not.toBe('none')
+  expect(document.body.getAttribute('style')).toBe(body)
+  expect(document.documentElement.getAttribute('style')).toBe(html)
+  const before=b.call.mock.calls.length
+  click(b.root,'Refresh');await settle()
+  expect(b.call.mock.calls.length).toBeGreaterThan(before)
+  click(b.root,'Disable');await settle()
+  expect(a.root.querySelector('[role="dialog"]')).toBeTruthy()
+  expect(b.root.querySelector('[role="dialog"]')).toBeTruthy()
+  click(a.root,'Cancel');await settle()
+  expect(a.root.querySelector('[role="dialog"]')).toBeNull()
+  expect(b.root.querySelector('[role="dialog"]')).toBeTruthy()
+  expect(a.root.querySelector('.integration-app')!.closest('[inert], [aria-hidden="true"]')).toBeNull()
+ } finally {
+  a.app.unmount();b.app.unmount();a.root.remove();b.root.remove();await settle()
+ }
+ expect(document.body.getAttribute('style')).toBe(body)
+ expect(document.documentElement.getAttribute('style')).toBe(html)
+})
+
+test('repeated mounts of the same package use unique, package-prefixed ARIA references',async()=>{
+ const a=fixture('SamePackage',true),b=fixture('SamePackage',true)
+ try {
+  await settle();click(a.root,'Disable');click(b.root,'Disable');await settle()
+  const ids=[...document.querySelectorAll('[id]')].map(node=>node.id).filter(Boolean)
+  expect(new Set(ids).size).toBe(ids.length)
+  for(const f of [a,b]) {
+   const dialog=f.root.querySelector('[role="dialog"]')!
+   for(const attr of ['aria-labelledby','aria-describedby']) {
+    const id=dialog.getAttribute(attr)!
+    // CLI substitutes the package ID in this template before building.
+    expect(id).toContain('__PACKAGE__-')
+    expect(f.root.querySelector(`[id="${id}"]`)).toBeTruthy()
+   }
+  }
+ } finally {a.app.unmount();b.app.unmount();a.root.remove();b.root.remove();await settle()}
+})
+
+test('unmount releases its sizing class and preserves an existing host class',async()=>{
+ const f=fixture('Sizing',false)
+ expect(f.root.classList.contains('dsmapp-vue-root')).toBe(true)
+ f.app.unmount()
+ expect(f.root.classList.contains('dsmapp-vue-root')).toBe(false)
+ f.root.classList.add('dsmapp-vue-root')
+ const app=mount(f.root,f.ctx);await settle();app.unmount()
+ expect(f.root.classList.contains('dsmapp-vue-root')).toBe(true)
+ f.root.remove()
+})

package/dist/templates/native-go-vue/frontend/tsconfig.json

@@ -0,0 +1 @@
+{"compilerOptions":{"target":"ES2022","module":"ESNext","moduleResolution":"Bundler","strict":true,"lib":["ES2022","DOM"],"skipLibCheck":true,"types":["vite/client"]},"include":["src/**/*.ts","src/**/*.vue","vite.config.ts"]}

package/dist/templates/native-go-vue/frontend/vite.config.ts

@@ -0,0 +1,8 @@
+import { defineConfig } from 'vite'
+import vue from '@vitejs/plugin-vue'
+export default defineConfig({
+  plugins: [vue()],
+  // Library mode must replace Vue dependency env guards for the DSM browser.
+  define: {'process.env.NODE_ENV': JSON.stringify('production')},
+  build: {lib: {entry: 'src/main.ts', formats: ['iife'], name: 'DsmVueApp', fileName: () => 'app.js'}, cssCodeSplit: false, rollupOptions: {output: {assetFileNames: 'app.[ext]'}}},
+})

package/dist/templates/native-go-vue/gitignore

@@ -0,0 +1,2 @@
+dist/
+node_modules/

package/dist/types.d.ts

@@ -56,4 +56,4 @@ export interface ComposeDocument {
     secrets?: Record<string, unknown>;
     [key: string]: unknown;
 }
-export type TemplateName = "hello-web" | "hello-web-page" | "hello-files" | "compose-import" | "native";
+export type TemplateName = "hello-web" | "hello-web-page" | "hello-files" | "compose-import" | "binary" | "native-go";

package/dist/validate.js

@@ -1,7 +1,9 @@
 import { existsSync } from "node:fs";
 import { join } from "node:path";
-import { collectInstallParameters, loadContract } from "./contract/load.js";
+import { contractSpan, makeError } from "./errors.js";
+import { collectInstallParameters, getValuePosition, loadContract } from "./contract/load.js";
 import { validateContract } from "./contract/validate.js";
+import { findListingUnsupportedInstallTypes } from "./contract/unsupported-types.js";
 import { collectComposeInterpolations, collectVolumeSourceInterpolations, loadCompose, validateAdminPortMapping, validateComposeHostBinds, validateComposeNumericCommandArgs, validateComposeRunAs, validateComposeSecurity, } from "./compose/analyze.js";
 import { loadNative } from "./native/load.js";
 import { validateNative } from "./native/validate.js";
@@ -16,6 +18,14 @@ export function validateProject(project, options = {}) {
     const nativeFile = NATIVE_FILENAME;
     const parsed = loadContract(project.contractPath);
     errors.push(...validateContract(parsed, contractFile));
+    if (profile === "listing") {
+        for (const { name, type, code } of findListingUnsupportedInstallTypes(parsed.contract)) {
+            const pos = getValuePosition(parsed.doc, ["install", name, "type"]) ??
+                getValuePosition(parsed.doc, ["install", name]) ??
+                { line: 1, column: 1 };
+            errors.push(makeError(code, contractSpan(contractFile, pos.line, pos.column, `install.${name}.type`), `Install Parameter「${name}」的 type: ${type} 只能由 synopkgland deploy 在管理員 session 取得安裝當下的 Share 清單快照；Package Center／Package Source listing 不支援。`, "請使用 synopkgland deploy --host <name>，由管理員 session 在安裝時取得 Share 清單快照；此型別不能透過 Package Center 或 Package Source listing 上架。"));
+        }
+    }
     const hasCompose = existsSync(project.composePath);
     const nativePath = project.nativePath ?? join(project.root, NATIVE_FILENAME);
     const hasNative = existsSync(nativePath);
@@ -130,12 +140,6 @@ export function validateProject(project, options = {}) {
                 suggestion: `請在 compose.yaml 以 \${${name}} 引用此參數。`,
             });
         }
-        if (param.type === "dsm_user") {
-            // In dynamic route, dsm_user is automatically injected into Compose by generator.
-            // If a Compose manually writes user, COMPOSE_USER_CONFLICTS_DSM_USER is emitted.
-            // Referenced for error-registry emitter compatibility.
-            const _unused = "INSTALL_DSM_USER_UNREFERENCED";
-        }
     }
     const warnings = errors.filter((item) => item.severity === "warning");
     const hardErrors = errors.filter((item) => item.severity !== "warning");

package/package.json

@@ -1,11 +1,10 @@
 {
   "name": "@synopackageland/cli",
-  "version": "0.3.10",
+  "version": "0.4.0",
   "description": "Syno Package Land Developer Kit CLI",
   "type": "module",
   "bin": {
-    "synopkgland": "./dist/bin.js",
-    "synopkgland-release": "./dist/release-bin.js"
+    "synopkgland": "./dist/bin.js"
   },
   "files": [
     "dist",
@@ -14,16 +13,13 @@
     "skills"
   ],
   "scripts": {
-    "build": "tsc && node scripts/copy-templates.mjs",
+    "build": "rm -rf dist && tsc && node scripts/copy-templates.mjs",
     "test": "npm run build && node --import tsx --test test/**/*.test.ts",
     "prepublishOnly": "npm run build"
   },
   "dependencies": {
-    "@synopackageland/dev-sdk": "^0.2.0",
-    "@synopackageland/package-source": "^0.2.1",
     "ajv": "^8.17.1",
     "commander": "^13.1.0",
-    "jose": "^6.0.10",
     "tar": "^7.4.3",
     "yaml": "^2.7.0"
   },

package/schema/synology-app.schema.json

@@ -59,14 +59,24 @@
         "properties": {
           "type": {
             "type": "string",
-            "enum": ["string", "boolean", "secret", "shared_folder", "dsm_user", "homes", "posix_all_shares"]
+            "enum": [
+              "string",
+              "boolean",
+              "secret",
+              "shared_folder",
+              "dsm_user",
+              "homes",
+              "posix_all_shares"
+            ]
           },
           "default": {},
           "generate": {
             "type": "boolean"
           }
         },
-        "required": ["type"]
+        "required": [
+          "type"
+        ]
       }
     },
     "integration": {
@@ -77,7 +87,10 @@
           "properties": {
             "launch": {
               "type": "string",
-              "enum": ["dsm-window", "new-page"],
+              "enum": [
+                "dsm-window",
+                "new-page"
+              ],
               "description": "Web App Launch Mode. dsm-window opens a DSM Application Window at the Trusted App Entry; new-page uses Package Center Open. Omit for dsm-window. Headless apps omit this field."
             },
             "cookies": {
@@ -89,47 +102,33 @@
             }
           },
           "additionalProperties": true
-        },
-        "identity": {
-          "type": "object",
-          "additionalProperties": false,
-          "required": ["mode"],
-          "properties": {
-            "mode": {
-              "type": "string",
-              "enum": ["broker-managed"],
-              "description": "v1 identity mode. SDK Apps omit oidc_compat; wrap-existing may add it."
-            },
-            "oidc_compat": {
-              "type": "object",
-              "additionalProperties": false,
-              "required": ["redirect_path"],
-              "properties": {
-                "redirect_path": {
-                  "type": "string",
-                  "pattern": "^/(?!/)(?!.*\\.\\.)[^\\s?#:]*$",
-                  "description": "App-owned OIDC callback path. No scheme, host, query, or '..'."
-                }
-              }
-            }
-          }
         }
       },
-      "additionalProperties": true
-    },
-    "permissions": {
-      "type": "object"
+      "additionalProperties": false
     },
+    "permissions": false,
     "privilege": {
       "type": "object",
       "additionalProperties": false,
       "properties": {
-        "privileged": { "type": "boolean" },
-        "host_network": { "type": "boolean" },
-        "host_pid": { "type": "boolean" },
-        "host_ipc": { "type": "boolean" },
-        "devices": { "type": "boolean" },
-        "cap_add": { "type": "boolean" }
+        "privileged": {
+          "type": "boolean"
+        },
+        "host_network": {
+          "type": "boolean"
+        },
+        "host_pid": {
+          "type": "boolean"
+        },
+        "host_ipc": {
+          "type": "boolean"
+        },
+        "devices": {
+          "type": "boolean"
+        },
+        "cap_add": {
+          "type": "boolean"
+        }
       }
     }
   },

package/skills/SKILL.md

@@ -1,51 +1,7 @@
----
-name: synopkgland
-description: Agent Authoring for Syno Package Land — create, validate, and Inner Loop deploy a Personal App to the author's NAS with synopkgland CLI. Load when the user wants to build a DSM app from a brief, scaffold from templates, validate App Contract + Compose, deploy with Local Attestation, or diagnose analyzer/deploy/readiness failures. Not for Curated publish, SSH to NAS, or inventing platform fields.
-version: 0.1.0
----
+# Independent Synology SPKs
 
-Syno Package Land Skill Pack（與 `@synopackageland/cli` 同版本、同 repo，不另發 npm）。
+Use this guide to initialize, build and inspect own applications or upstream OSS as independent packages. 禁止發明已完成的登入橋接、逐使用者檔案 ACL 或新身分平台。
 
-## 載入方式
+Start with `synopkgland init -t native-go`, `synopkgland init --binary`, or `synopkgland init -t compose-import`. Read reference/create.md or reference/wrap.md, then reference/deploy.md. Native CGI session checks belong to the package. Container authentication belongs to upstream; fixed service credentials govern mounted data access.
 
-1. 執行 `synopkgland skill path`，得到 Skill Pack 根目錄。
-2. **永遠先讀**本檔 `SKILL.md`。
-3. 依任務載入 `reference/*.md`（見下表）。不要一次讀完全部。
-
-| 階段 | 檔案 | 何時 |
-| --- | --- | --- |
-| 建立 | `reference/create.md` | 從零或一句話需求 |
-| 封裝 | `reference/wrap.md` | 已有 `compose.yaml` 或要補契約 |
-| 身分 | `reference/identity.md` | 需要 DSM 登入／Open |
-| 檔案 | `reference/files.md` | 需要 NAS 檔案 |
-| 部署 | `reference/deploy.md` | 要 `deploy` 到 NAS |
-| 排查 | `reference/diagnose.md` | `validate`／`deploy`／Open 失敗 |
-
-也可用 `synopkgland skill list`、`synopkgland skill show <id>` 在終端機檢視。
-
-## 權威邊界（必守）
-
-- **權威**：`synology-app.yaml` schema（`packages/app-cli/schema/synology-app.schema.json`）、`synopkgland validate`／analyzer 錯誤碼、repo 測試。Skill 只是操作介面。
-- **禁止發明欄位**：不得新增 schema 沒有的 top-level 或 `install` 型別；不得自創第二套 Compose／SPK DSL。不確定時先 `synopkgland inspect` 或讀模板，再 `validate`。
-- **禁止洩漏 secret**：不得把 DSM 密碼、signing key、API token 寫進 Git、`compose.yaml` environment、`.env` commit、或對話紀錄。NAS 憑證用 synoagentcli profile 或本機環境變數，由 CLI 讀取。
-- **不要讀 ADR** 當預設步驟；需要決策時 skill 才指向規格。
-- **不要宣稱** 15 分鐘黃金路徑已通過、公開 SDK 已 freeze、或 `inner-loop` 全綠。
-
-## 典型流程
-
-```text
-一句話需求
-  → reference/create.md（選模板、最少問題）
-  → synopkgland init -t hello-web|hello-web-page|hello-files|compose-import
-  → synopkgland dev（本機 mock）
-  → synopkgland validate
-  → synopkgland test
-  → reference/deploy.md → synopkgland deploy --host <nas>
-  → synopkgland info --host <nas>；DSM Open
-```
-
-失敗時載入 `reference/diagnose.md`；依錯誤碼修契約或 Compose，**不要猜**。
-
-## CLI 專案根
-
-`synopkgland` 從 cwd 向上找 `synology-app.yaml`，或 `--project <dir>`。v1 不做 monorepo workspace 協定。載入 `.env` 亦從 cwd 向上找，在非專案目錄執行指令時應配合 `--project`（來源：docs/impl/STATUS.md 關鍵教訓 15）。
+Never install, uninstall, publish or modify NAS data without task authorization. Prefer validate, inspect and deploy --dry-run for reviewable artifacts.