@synopackageland/cli 0.3.10 → 0.4.1

package/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 synopkgland
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

package/README.md

@@ -1,13 +1,61 @@
-# @synopackageland/cli
+# Syno Package Land CLI
 
-Syno Package Land Developer Kit CLI (`synopkgland`).
+Generate independent Synology packages. Run `synopkgland init --help` for templates.
 
-```bash
-# from repository root
-npm install
-npm run build
-npx synopkgland validate --project packages/app-cli/templates/hello-web
-npx synopkgland init -t hello-web ./my-app
+```sh
+synopkgland init -t native-go --package MyApp ./my-app
+synopkgland init -t native-go --package AdminApp --privilege root ./admin-app
+synopkgland init --binary ./service
+synopkgland init -t compose-import ./upstream-app
+synopkgland --project ./my-app validate
+synopkgland --project ./my-app build-spk --arch x86_64
+synopkgland inspect --spk ./my-app/dist/MyApp-0.1.0-0001-x86_64.spk
+synopkgland --project ./my-app deploy --dry-run --arch x86_64
+# Explicit installation, only when intended:
+synopkgland --project ./my-app deploy --host my-nas --arch x86_64
 ```
 
-Day-to-day is `synopkgland init`. GitHub template mirrors (not product repos): [`synopkgland-hello-web`](https://github.com/synopackageland/synopkgland-hello-web) (`dsm-window`) and [`synopkgland-hello-web-page`](https://github.com/synopackageland/synopkgland-hello-web-page) (`new-page`). Curated Packaging Definitions go to [`synopkgland-community-apps`](https://github.com/synopackageland/synopkgland-community-apps).
+Native-go requires Go 1.24+; binary consumes checked prebuilt archives; container SPKs use DSM resource workers. Root operations require per-operation DSM approval. Remove root tasks before uninstall; changed task text needs fresh approval.
+
+For native-go integration, `--ui vue --integration go --integration-protocol 2
+--data-access relaxed` selects the S1R build policy (`integration.dataAccess`).
+Default data access remains unavailable. Mode is pinned in helper/CGI inventory
+and requires rebuild and new root approval when changed. Missing certified DSM
+adapters still refuse NAS access; this setting does not open write gates.
+Recreated accounts with the same UID and username may retain grants; a change to
+either invalidates all grants for that identity and requires new authorization.
+
+For containers, `--share MEDIA_SHARE=photos`, `--run-as RUN_AS=alice` and `--param APP_MODE=prod` supply declared values. Keep upstream target paths. Fixed service credentials govern mount access, while each upstream app owns user login and authorization.
+
+`dev` and `test` run local Compose. `info` and `log` read DSM package state/status; status output is not application log streaming. `skill path/list/show` exposes the bundled authoring guidance. `--dev` is available for container/binary development package identities. There is no release or public-submit command; deploy never publishes.
+
+See the repository's docs/independent-packages.md for supported parameters, lifecycle and limitations.
+## Licensing
+
+The CLI and original templates are MIT licensed, Copyright (c) 2026 synopkgland.
+Third-party components retain their own terms.
+Generated projects keep these template terms in `LICENSES/TEMPLATE.txt`.
+`init` does not create an app-level `LICENSE` or select a license for your work:
+choose your own terms and copyright holder in the project root `LICENSE`.
+Retain the template and dependency notices when distributing derived code.
+
+SPKs place legal material under the installed payload's `LICENSES/` directory:
+`TEMPLATE.txt`, optional developer `APP.txt`, Go's `GO-LICENSE`/`GO-PATENTS`,
+`GO-THIRD_PARTY_NOTICES.txt`, optional `HELPER-THIRD_PARTY_NOTICES.txt`, and
+`ui/` or `better-auth/` notice trees. The helper also retains its existing
+`integration/THIRD_PARTY_NOTICES.txt` location for compatibility.
+
+Vue and Better Auth builds generate full notices plus `inventory.json` from
+the installed, locked production dependency tree (a conservative superset of
+bundled code). Missing text or a version mismatch fails the build. Run `npm ci`
+in the generated frontend/Node directories before building. For
+`@better-auth/utils` 0.4.2 and 0.5.0, which omit license text in their npm
+archives, the tool retains the upstream project's subsequently added MIT
+license, with its pinned source commit and exact npm integrity recorded in
+`notice-overrides/index.json`. Unknown missing licenses require a new review;
+the tool never manufactures a license from a package's SPDX field.
+
+Keep `backend/THIRD_PARTY_NOTICES.txt` current if you change Go modules.
+The supplied notice inventory covers the pinned template dependencies and Go
+runtime; arbitrary developer binaries, Go module additions, container images,
+custom UI bundles and upstream applications need their own notice inventory.

package/dist/bin.js

@@ -2,8 +2,7 @@
 import { loadDotEnv } from "./load-env.js";
 import { runCli } from "./cli.js";
 loadDotEnv();
-// Release authority lives in the separate `synopkgland-release` binary, so the
-// developer-facing tool has no publish surface at all.
+// Package deployment is explicit; this CLI does not publish releases.
 runCli(process.argv).then(() => 0).then((status) => {
     process.exitCode = status;
 }).catch((error) => {

package/dist/build-spk/generator.d.ts

@@ -1,6 +1,5 @@
 import type { ProjectRoot } from "../discovery.js";
 import { type NativeArchFamily } from "./dsm-arch.js";
-export declare const EMBEDDED_ATTESTATION_RELATIVE_PATH = ".synopkgland/attestation.jwt";
 export interface BuildSpkOptions {
     project: ProjectRoot;
     outputPath?: string;
@@ -9,8 +8,6 @@ export interface BuildSpkOptions {
     displayname?: string;
     /** Overrides contract version before INFO is rendered (e.g. `1.0.0-0002`). */
     spkVersion?: string;
-    /** v2 Curated App Package Attestation to place in the App Bundle. */
-    embeddedAttestationToken?: string;
 }
 export interface BuildSpkResult {
     ok: boolean;