@synopackageland/cli 0.3.7 → 0.3.8

package/dist/build-spk/generator.js

@@ -185,6 +185,7 @@ export async function buildSpk(options) {
             const resourceProjectDir = join(staging, "package", "compose");
             mkdirSync(resourceProjectDir, { recursive: true });
             const dsmUserParam = collectInstallParameters(contract).find((p) => p.param.type === "dsm_user");
+            let composeContent;
             if (dsmUserParam || rwEligibility?.headless === true || hasOidcCompat(contract)) {
                 const rawYaml = readFileSync(options.project.composePath, "utf8");
                 const doc = parseDocument(rawYaml);
@@ -222,16 +223,17 @@ export async function buildSpk(options) {
                 if (rwEligibility?.headless === true) {
                     injectHeadlessProbeVolume(doc);
                 }
-                let composeContent = doc.toString();
+                composeContent = doc.toString();
                 if (dsmUserParam) {
                     const escaped = `\\$\\{${dsmUserParam.name}_UID\\}:\\$\\{${dsmUserParam.name}_GID\\}`;
                     composeContent = composeContent.replace(new RegExp(`^([ \\t]*)user:\\s*"${escaped}"`, "gm"), `$1user: "\${${dsmUserParam.name}_UID}:\${${dsmUserParam.name}_GID}"\n$1# synopkgland:group_add ${dsmUserParam.name}`);
                 }
-                writeFileSync(join(resourceProjectDir, "docker-compose.yml"), composeContent, "utf8");
             }
             else {
-                copyFileSync(options.project.composePath, join(resourceProjectDir, "docker-compose.yml"));
+                composeContent = readFileSync(options.project.composePath, "utf8");
             }
+            composeContent = injectPosixAllSharesMarkers(composeContent, contract);
+            writeFileSync(join(resourceProjectDir, "docker-compose.yml"), composeContent, "utf8");
             chmodSync(join(resourceProjectDir, "docker-compose.yml"), FILE_MODE);
             if (rwEligibility?.headless === true) {
                 const probePayloadDir = join(resourceProjectDir, ".synopkgland");
@@ -354,6 +356,7 @@ function renderPrivilege() {
 }
 const SHARED_FOLDER_MOUNT_CONSENT = "此 App 會用你在這台 NAS 選的資料夾；整顆應用都看得到。Shared Folder Mount 是整個 App Instance 的 container access：能打開這個 App 的使用者，容器裡的程式都看得到該 Share，即使該使用者在 File Station 看不到。這不是逐使用者 DSM ACL。要依登入者權限讀寫 NAS 檔案，必須另外核准廣域 files.* 並走 File Gateway。";
 const HOMES_MOUNT_CONSENT = "此 App 會使用這台 NAS 已啟用的 User Home；整顆應用的容器都看得到，容器路徑由 Compose 決定。這不是逐使用者 DSM ACL；要依登入者權限讀寫 NAS 檔案，必須另外核准廣域 files.* 並走 File Gateway。";
+const POSIX_ALL_SHARES_MAX_WARNING = "掛載這台 NAS 目前列出的每一個共用資料夾。容器內可讀（或讀寫，依 Compose 模式）所有這些資料夾的檔案。安裝後新建的共用資料夾不會自動加入。由管理員決定是否安裝。";
 const DSM_USER_RUN_AS_CONSENT = "寫進 Share 的新檔在 File Station 顯示為你選的那位 DSM 使用者。點開此 App 的人共用這個磁碟身分，不是逐登入 ACL。";
 const DSM_USER_UPGRADE_CONSENT = "升級時更換 Container Run-as 不會 chown Share 上的舊檔；只有升級後寫入的新檔才會使用新的磁碟身分。";
 const SHARED_FOLDER_RW_UPGRADE_CONSENT = "此版本把 Share 掛載改為讀寫；容器可讀取並寫入你選的 Share，不再是唯讀。";
@@ -451,6 +454,29 @@ function injectHeadlessProbeVolume(doc) {
     }
     doc.setIn(["services", serviceName, "volumes"], volumes);
 }
+function injectPosixAllSharesMarkers(composeContent, contract) {
+    const names = collectInstallParameters(contract)
+        .filter(({ param }) => param.type === "posix_all_shares")
+        .map(({ name }) => name);
+    if (names.length === 0) {
+        return composeContent;
+    }
+    const declared = new Set(names);
+    const lines = composeContent.split("\n");
+    const output = [];
+    for (const line of lines) {
+        const match = line.match(/^(\s*)-\s*["']?\$\{([A-Za-z_][A-Za-z0-9_]*)\}:/);
+        const name = match?.[2];
+        if (match && name && declared.has(name)) {
+            const marker = `# synopkgland:posix_all_shares ${name}`;
+            if (output.at(-1)?.trim() !== marker) {
+                output.push(`${match[1]}${marker}`);
+            }
+        }
+        output.push(line);
+    }
+    return output.join("\n");
+}
 const PRIVILEGE_MAX_WARNING = "此 App 的容器有高權限，接近這台 NAS 的 root、幾乎整台機器。是否安裝由你這位管理員決定。";
 function renderInstallWizard(contract, compose) {
     const items = [];
@@ -557,6 +583,39 @@ function renderInstallWizard(contract, compose) {
             });
             continue;
         }
+        if (param.type === "posix_all_shares") {
+            items.push({
+                type: "textblock",
+                desc: POSIX_ALL_SHARES_MAX_WARNING,
+            });
+            items.push({
+                type: "combobox",
+                multiSelect: true,
+                desc: `POSIX all shares: ${name}`,
+                subitems: [{
+                        key: name,
+                        desc: name,
+                        displayField: "name",
+                        valueField: "name",
+                        multiSelect: true,
+                        editable: false,
+                        forceSelection: true,
+                        autoSelect: false,
+                        mode: "remote",
+                        api_store: {
+                            api: "SYNO.Core.Share",
+                            method: "list",
+                            version: 1,
+                            baseParams: { limit: -1, offset: 0 },
+                            root: "shares",
+                            idProperty: "name",
+                            fields: ["name"],
+                        },
+                        validator: { allowBlank: false },
+                    }],
+            });
+            continue;
+        }
         if (param.type === "dsm_user") {
             items.push({
                 type: "combobox",
@@ -654,6 +713,7 @@ function renderDynamicPreinstMaterializer(contract) {
     const allParams = collectInstallParameters(contract);
     const scalarParams = allParams.filter(({ param }) => param.type === "string" || param.type === "boolean");
     const sharedFolderParams = allParams.filter(({ param }) => param.type === "shared_folder");
+    const posixAllSharesParams = allParams.filter(({ param }) => param.type === "posix_all_shares");
     const dsmUserParam = allParams.find(({ param }) => param.type === "dsm_user");
     const lines = [
         "#!/bin/sh",
@@ -716,9 +776,12 @@ function renderDynamicPreinstMaterializer(contract) {
         "  esac",
         "}",
     ];
-    if (sharedFolderParams.length > 0) {
+    if (sharedFolderParams.length > 0 || posixAllSharesParams.length > 0) {
         lines.push("resolve_shared_folder() {", "  share_name=\"$1\"", "  case \"$share_name\" in", "    */*|*..*) die \"invalid share name $share_name\" ;;", "    '') die \"share name is empty\" ;;", "  esac", "  mounts_file=\"${D54_MOUNTS_FILE:-/proc/mounts}\"", "  if [ ! -r \"$mounts_file\" ] && [ -r \"/etc/mtab\" ]; then", "    mounts_file=\"/etc/mtab\"", "  fi", "  if [ ! -r \"$mounts_file\" ]; then", "    die \"cannot read mount points from $mounts_file\"", "  fi", "  vols=\"$(awk '$2 ~ /^\\/volume[0-9]+$/ {print $2}' \"$mounts_file\" | sort -u)\"", '  if [ -z "$vols" ]; then', "    vols=\"$(awk '{print $2}' \"$mounts_file\" | sort -u)\"", "  fi", "  matched=\"\"", "  count=0", "  for v in $vols; do", "    if [ -d \"$v/$share_name\" ]; then", "      matched=\"$v/$share_name\"", "      count=$((count + 1))", "    fi", "  done", "  if [ \"$count\" -eq 0 ]; then", "    die \"share $share_name not found on any volume\"", "  elif [ \"$count\" -gt 1 ]; then", "    die \"share $share_name matched multiple volumes\"", "  fi", "  printf '%s' \"$matched\"", "}");
     }
+    if (posixAllSharesParams.length > 0) {
+        lines.push("normalize_posix_all_shares() {", "  value=\"$1\"", "  case \"$value\" in", "    \\[*\\]) value=\"$(printf '%s' \"$value\" | sed 's/^[[:space:]]*\\[//; s/\\][[:space:]]*$//; s/\"//g')\" ;;", "  esac", "  printf '%s' \"$value\" | awk -F, '{ for (i = 1; i <= NF; i++) { gsub(/^[ \\t]+|[ \\t]+$/, \"\", $i); if ($i != \"\") print $i } }'", "}", "resolve_posix_all_shares() {", "  raw_list=\"$1\"", "  normalized=\"$(normalize_posix_all_shares \"$raw_list\")\"", "  [ -n \"$normalized\" ] || die \"POSIX_ALL_SHARES_EMPTY\"", "  names=\"\"", "  paths=\"\"", "  count=0", "  while IFS= read -r share_name; do", "    case \"$share_name\" in", "      */*|*..*|@*|'') die \"invalid Share name $share_name\" ;;", "      *[[:cntrl:]]*) die \"invalid Share name $share_name\" ;;", "    esac", "    share_path=\"$(resolve_shared_folder \"$share_name\")\"", "    names=\"${names}${names:+,}${share_name}\"", "    paths=\"${paths}${paths:+,}${share_path}\"", "    count=$((count + 1))", "  done <<EOF", "$normalized", "EOF", "  [ \"$count\" -gt 0 ] || die \"POSIX_ALL_SHARES_EMPTY\"", "  printf '%s\\n%s\\n%s' \"$names\" \"$paths\" \"$count\"", "}", "rewrite_posix_all_shares() {", "  p_name=\"$1\"", "  share_names=\"$2\"", "  share_paths=\"$3\"", "  compose_file=\"$4\"", "  [ -f \"$compose_file\" ] || die \"compose file missing at $compose_file\"", "  [ ! -L \"$compose_file\" ] || die \"compose file is a symlink\"", "  tmp_compose=\"$(mktemp \"${compose_file}.tmp.XXXXXX\")\"", "  awk -v param=\"$p_name\" -v share_names=\"$share_names\" -v share_paths=\"$share_paths\" '", "    BEGIN {", "      name_count = split(share_names, names, \",\")", "      path_count = split(share_paths, paths, \",\")", "      marker = \"# synopkgland:posix_all_shares \" param", "      pending = 0", "      single_quote = sprintf(\"%c\", 39)", "    }", "    {", "      if (index($0, marker) > 0 && $0 ~ /^[ \\t]*# synopkgland:posix_all_shares /) {", "        print $0", "        pending = 1", "        next", "      }", "      if (!pending) { print $0; next }", "      pending = 0", "      line = $0", "      indent = line", "      sub(/[^ \\t].*$/, \"\", indent)", "      entry = line", "      sub(/^[ \\t]*-[ \\t]*/, \"\", entry)", "      if (entry ~ /^\".*\"$/) entry = substr(entry, 2, length(entry) - 2)", "      if (length(entry) >= 2 && substr(entry, 1, 1) == single_quote && substr(entry, length(entry), 1) == single_quote) entry = substr(entry, 2, length(entry) - 2)", "      split(entry, fields, \":\")", "      if (fields[1] != \"${\" param \"}\" || fields[2] == \"\") { print $0; next }", "      mode = \"\"", "      if (length(fields) >= 3) mode = \":\" fields[3]", "      for (i = 1; i <= name_count && i <= path_count; i++) {", "        print indent \"- \" paths[i] \":\" fields[2] \"/\" names[i] mode", "      }", "    }", "  ' \"$compose_file\" > \"$tmp_compose\" || die \"failed to expand POSIX all-shares in $compose_file\"", "  mv \"$tmp_compose\" \"$compose_file\" || die \"failed to replace $compose_file\"", "}");
+    }
     if (dsmUserParam) {
         lines.push("resolve_dsm_user() {", "  user_name=\"$1\"", "  case \"$user_name\" in", "    */*|*..*|*[[:cntrl:]]*) die \"invalid user name $user_name\" ;;", "    '') die \"user name is empty\" ;;", "  esac", "  u_uid=\"$(id -u -- \"$user_name\" 2>/dev/null || true)\"", "  case \"$u_uid\" in", "    ''|*[!0-9]*) die \"resolved uid for $user_name is not a valid integer\" ;;", "    0) die \"resolved uid for $user_name cannot be 0 (root)\" ;;", "  esac", "  u_gid=\"$(id -g -- \"$user_name\" 2>/dev/null || true)\"", "  case \"$u_gid\" in", "    ''|*[!0-9]*) die \"resolved gid for $user_name is not a valid integer\" ;;", "  esac", "  # id -G returns all group ids including primary", "  raw_groups=\"$(id -G -- \"$user_name\" 2>/dev/null || true)\"", "  # filter out primary gid, deduplicate, keep numeric only", "  supp_groups=\"\"", "  for g in $raw_groups; do", "    case \"$g\" in", "      ''|*[!0-9]*) continue ;;", "    esac", "    if [ \"$g\" != \"$u_gid\" ]; then", "      already=0", "      for sg in $supp_groups; do", "        if [ \"$sg\" = \"$g\" ]; then", "          already=1", "          break", "        fi", "      done", "      if [ \"$already\" -eq 0 ]; then", "        supp_groups=\"${supp_groups}${supp_groups:+ }$g\"", "      fi", "    fi", "  done", "  printf '%s %s %s' \"$u_uid\" \"$u_gid\" \"$supp_groups\"", "}", "rewrite_group_add() {", "  p_name=\"$1\"", "  g_list=\"$2\"", "  compose_file=\"$3\"", "  [ -f \"$compose_file\" ] || die \"compose file missing at $compose_file\"", "  [ ! -L \"$compose_file\" ] || die \"compose file is a symlink\"", "  tmp_compose=\"$(mktemp \"${compose_file}.tmp.XXXXXX\")\"", "  awk -v param=\"$p_name\" -v g_list=\"$g_list\" '", "    BEGIN {", "      n = split(g_list, g_arr, \" \")", "    }", "    {", "      regex = \"^[ \\t]*# synopkgland:group_add \" param \"$\"", "      if ($0 ~ regex) {", "        match($0, /^[ \\t]*/)", "        indent = substr($0, RSTART, RLENGTH)", "        if (n > 0) {", "          print indent \"group_add:\"", "          for (i = 1; i <= n; i++) {", "            print indent \"  - ${\" param \"_GROUP_\" i \"}\"", "          }", "        }", "      } else {", "        print $0", "      }", "    }", "  ' \"$compose_file\" > \"$tmp_compose\" || die \"failed to rewrite group_add in $compose_file\"", "  mv \"$tmp_compose\" \"$compose_file\" || die \"failed to replace $compose_file\"", "}");
     }
@@ -752,6 +815,16 @@ function renderDynamicPreinstMaterializer(contract) {
         lines.push(`  if [ "\${${name}+x}" = x ]; then`, `    ${rawVar}="\${${name}}"`, '  elif [ "$STATUS" = "UPGRADE" ] && [ -f "$CANONICAL_ENV" ] && [ ! -L "$CANONICAL_ENV" ] && ' +
             `${rawVar}="$(read_env_value "$CANONICAL_ENV" "${name}")"; then`, "    :", "  else", `    die "missing required shared folder parameter ${name}"`, "  fi", `  case "$${rawVar}" in`, "    /*) " + pathVar + "=\"$" + rawVar + "\" ;;", "    *) " + pathVar + "=\"$(resolve_shared_folder \"$" + rawVar + "\")\" ;;", "  esac");
     }
+    const posixVars = [];
+    for (const { name } of posixAllSharesParams) {
+        const rawVar = "D54_RAW_POSIX_" + name;
+        const namesVar = "D54_POSIX_NAMES_" + name;
+        const pathsVar = "D54_POSIX_PATHS_" + name;
+        const countVar = "D54_POSIX_COUNT_" + name;
+        posixVars.push({ name, namesVar, pathsVar, countVar });
+        lines.push(`  if [ "\${${name}+x}" = x ]; then`, `    ${rawVar}="\${${name}}"`, '  elif [ "$STATUS" = "UPGRADE" ] && [ -f "$CANONICAL_ENV" ] && [ ! -L "$CANONICAL_ENV" ] && ' +
+            `${rawVar}="$(read_env_value "$CANONICAL_ENV" "${name}")"; then`, "    :", "  else", `    die "missing required POSIX all-shares parameter ${name}"`, "  fi", `  posix_info="$(resolve_posix_all_shares "$${rawVar}")"`, `  ${namesVar}="$(printf '%s\\n' "$posix_info" | sed -n '1p')"`, `  ${pathsVar}="$(printf '%s\\n' "$posix_info" | sed -n '2p')"`, `  ${countVar}="$(printf '%s\\n' "$posix_info" | sed -n '3p')"`, `  rewrite_posix_all_shares "${name}" "$${namesVar}" "$${pathsVar}" "$PROJECT/docker-compose.yml"`);
+    }
     if (dsmUserParam) {
         const name = dsmUserParam.name;
         const rawUserVar = "D54_RAW_USER_" + name;
@@ -770,6 +843,9 @@ function renderDynamicPreinstMaterializer(contract) {
     for (const { name, pathVar } of shareVars) {
         lines.push(`  append_env "${name}" "$${pathVar}" "string"`);
     }
+    for (const { name, namesVar, countVar } of posixVars) {
+        lines.push(`  append_env "${name}" "$${namesVar}" "string"`, `  append_env "${name}_COUNT" "$${countVar}" "string"`);
+    }
     if (dsmUserParam) {
         const name = dsmUserParam.name;
         const rawUserVar = "D54_RAW_USER_" + name;

package/dist/compose/analyze.d.ts

@@ -57,6 +57,7 @@ export declare function validateComposeNumericCommandArgs(compose: ComposeDocume
 export interface HostBindContext {
     sharedFolderParams: ReadonlySet<string>;
     homesParams?: ReadonlySet<string>;
+    posixAllSharesParams?: ReadonlySet<string>;
     installParamNames: ReadonlySet<string>;
 }
 export declare function collectVolumeSourceInterpolations(compose: ComposeDocument): Set<string>;

package/dist/compose/analyze.js

@@ -190,6 +190,7 @@ const HEADLESS_PACKAGE_ONLY_PARAMETER_TYPES = new Set([
     "boolean",
     "shared_folder",
     "dsm_user",
+    "posix_all_shares",
 ]);
 /**
  * Chooses the local route D0 can safely emit. The first dynamic slice is
@@ -252,10 +253,14 @@ function collectRouteRejectErrors(contract, parsed, composeFile) {
     const installParams = collectInstallParameters(contract);
     const sharedFolderParams = new Set(installParams.filter(({ param }) => param.type === "shared_folder").map(({ name }) => name));
     const homesParams = new Set(installParams.filter(({ param }) => param.type === "homes").map(({ name }) => name));
+    const posixAllSharesParams = new Set(installParams
+        .filter(({ param }) => param.type === "posix_all_shares")
+        .map(({ name }) => name));
     const installParamNames = new Set(installParams.map(({ name }) => name));
     errors.push(...validateComposeHostBinds(compose, composeFile, {
         sharedFolderParams,
         homesParams,
+        posixAllSharesParams,
         installParamNames,
     }));
     return dedupeValidationErrors(errors);
@@ -296,7 +301,8 @@ function collectDynamicRouteError(contract, parsed, composeFile) {
         (param.type === "string" ||
             param.type === "boolean" ||
             param.type === "shared_folder" ||
-            param.type === "dsm_user"))
+            param.type === "dsm_user" ||
+            param.type === "posix_all_shares"))
         .map(({ name }) => name));
     const dsmUserParam = params.find(({ param }) => param.type === "dsm_user");
     const dsmUserDerivedNames = dsmUserParam
@@ -310,7 +316,8 @@ function collectDynamicRouteError(contract, parsed, composeFile) {
         (param.type !== "string" &&
             param.type !== "boolean" &&
             param.type !== "shared_folder" &&
-            param.type !== "dsm_user"));
+            param.type !== "dsm_user" &&
+            param.type !== "posix_all_shares"));
     const brokerOidcInterpolationNames = hasBrokerManagedOidc(contract)
         ? BROKER_OIDC_INTERPOLATION_VARS
         : [];
@@ -726,7 +733,8 @@ function classifyVolumeSource(compose, mount, namedVolumes, context, composeFile
         }
         if (PLATFORM_BIND_VARS.has(varName) ||
             context.sharedFolderParams.has(varName) ||
-            context.homesParams?.has(varName)) {
+            context.homesParams?.has(varName) ||
+            context.posixAllSharesParams?.has(varName)) {
             return null;
         }
         if (context.installParamNames.has(varName)) {

package/dist/contract/posix-all-shares.js

@@ -39,12 +39,12 @@ export function validatePosixAllSharesSources(compose, composeFile, declaredPara
             const path = `services.${serviceName}.volumes.${index}`;
             if (declaredParameters.has(name)) {
                 if (suffix !== "") {
-                    errors.push(makeError("COMPOSE_POSIX_ALL_SHARES_SUFFIX_FORBIDDEN", composeSpan(composeFile, 1, 1, path), `POSIX all-shares 參數「${name}」只能作為完整 volume source，不能附加子路徑。`, `請將 ${source} 改成 \${${name}}，並保留 Compose 的 container target；Share 名稱由 Broker 在安裝時展開。`));
+                    errors.push(makeError("COMPOSE_POSIX_ALL_SHARES_SUFFIX_FORBIDDEN", composeSpan(composeFile, 1, 1, path), `POSIX all-shares 參數「${name}」只能作為完整 volume source，不能附加子路徑。`, `請將 ${source} 改成 \${${name}}，並保留 Compose 的 container target；Share 名稱由 package-only preinst 在安裝時展開。`));
                 }
                 continue;
             }
             if (RESERVED_MARKER_NAMES.has(name)) {
-                errors.push(makeError("COMPOSE_POSIX_ALL_SHARES_UNDECLARED", composeSpan(composeFile, 1, 1, path), `Compose 使用了未宣告的 POSIX all-shares marker「${name}」。`, `請在 synology-app.yaml 宣告 install.${name}.type: ${POSIX_ALL_SHARES_TYPE}，並讓 Broker 以 DSM API 列出安裝當下的 Share。`));
+                errors.push(makeError("COMPOSE_POSIX_ALL_SHARES_UNDECLARED", composeSpan(composeFile, 1, 1, path), `Compose 使用了未宣告的 POSIX all-shares marker「${name}」。`, `請在 synology-app.yaml 宣告 install.${name}.type: ${POSIX_ALL_SHARES_TYPE}，並讓 wizard／CLI 取得安裝當下的 Share 清單。`));
             }
         }
     }

package/dist/contract/schema-validate.js

@@ -30,7 +30,7 @@ function mapSchemaError(error, contractFile, parsed) {
 }
 export function validateContractSchema(parsed, contractFile) {
     const validate = getValidator();
-    const data = schemaCompatibleContract(parsed.doc.toJSON());
+    const data = parsed.doc.toJSON();
     const valid = validate(data);
     if (valid) {
         return [];
@@ -48,28 +48,3 @@ export function validateContractSchema(parsed, contractFile) {
     }
     return result;
 }
-/**
- * Keep the published v1 schema's historical enum stable for older tooling,
- * while allowing the P4 contract extension to be validated by the same v1
- * object shape. The semantic validator and Broker retain the raw type.
- */
-function schemaCompatibleContract(value) {
-    if (!value || typeof value !== "object" || Array.isArray(value)) {
-        return value;
-    }
-    const contract = value;
-    const install = contract.install;
-    if (!install || typeof install !== "object" || Array.isArray(install)) {
-        return value;
-    }
-    for (const parameter of Object.values(install)) {
-        if (!parameter || typeof parameter !== "object" || Array.isArray(parameter)) {
-            continue;
-        }
-        const record = parameter;
-        if (record.type === "posix_all_shares") {
-            record.type = "homes";
-        }
-    }
-    return value;
-}

package/dist/contract/validate.js

@@ -51,16 +51,6 @@ export function validateContract(parsed, contractFile) {
     errors.push(...validateInstallParameters(parsed, contractFile));
     errors.push(...validatePosixAllShares(parsed, contractFile));
     errors.push(...validateWebLaunch(parsed, contractFile));
-    // The P4 worker cannot edit the shared host-bind analyzer. Its existing
-    // platform-resolved `homes` slot has the same analyzer semantics (declared
-    // interpolation is an allowed source and must be used). This normalization
-    // is local to the validation object; Broker and SPK generation read the raw
-    // YAML again and retain the actual posix_all_shares type.
-    for (const parameter of Object.values(contract.install ?? {})) {
-        if (parameter && isPosixAllSharesType(parameter.type)) {
-            parameter.type = "homes";
-        }
-    }
     return errors;
 }
 function validatePosixAllShares(parsed, contractFile) {

package/dist/deploy/deploy.js

@@ -13,6 +13,7 @@ import { homesParameterNames, resolveHomesExtraValues } from "./homes-values.js"
 import { resolveInstallParameterExtraValues } from "./param-values.js";
 import { CURATED_BUILD_OFFSET } from "@synopackageland/package-source/index-manifest";
 const CURATED_DEPLOY_REFUSED_MESSAGE = "此 NAS 已持有 Curated App Package Attestation。請改用 --dev，或使用 --replace-curated 明確降級。";
+const POSIX_ALL_SHARES_LOOKUP_FAILED = "DEPLOY_POSIX_ALL_SHARES_LOOKUP_FAILED";
 function brokerCapabilitiesFromContract(project) {
     const contract = loadContract(project.contractPath).contract;
     const capabilities = ["identity"];
@@ -67,9 +68,34 @@ export async function deployProject(options) {
         return { ok: false, code: "CURATED_DEPLOY_REFUSED", message: CURATED_DEPLOY_REFUSED_MESSAGE };
     }
     const contract = loadContract(options.project.contractPath).contract;
+    const paramValues = { ...(options.paramValues ?? {}) };
+    const posixAllSharesNames = Object.entries(contract.install ?? {})
+        .filter(([, parameter]) => parameter?.type === "posix_all_shares")
+        .map(([name]) => name);
+    for (const name of posixAllSharesNames) {
+        if (Object.prototype.hasOwnProperty.call(paramValues, name)) {
+            continue;
+        }
+        let shareNames;
+        try {
+            shareNames = await options.host.listShareNames?.();
+        }
+        catch {
+            shareNames = undefined;
+        }
+        const names = (shareNames ?? []).map((value) => value.trim()).filter(Boolean);
+        if (names.length === 0) {
+            return {
+                ok: false,
+                code: POSIX_ALL_SHARES_LOOKUP_FAILED,
+                message: `無法用管理員 session 列出這台 NAS 的 Shared Folder，無法填入 POSIX all-shares 參數「${name}」。`,
+            };
+        }
+        paramValues[name] = names.join(",");
+    }
     const paramResolved = resolveInstallParameterExtraValues({
         contract,
-        provided: options.paramValues,
+        provided: paramValues,
     });
     if (!paramResolved.ok) {
         return { ok: false, code: paramResolved.code, message: paramResolved.message };

package/dist/deploy/param-values.js

@@ -1,4 +1,5 @@
 import { collectInstallParameters, stringViolations } from "../contract/load.js";
+import { isPosixAllSharesType } from "../contract/posix-all-shares.js";
 /**
  * Validate the local, non-secret values accepted by `deploy --param`.
  *
@@ -30,7 +31,7 @@ export function resolveInstallParameterExtraValues(input) {
             extraValues[name] = raw;
             continue;
         }
-        if (param.type !== "string") {
+        if (param.type !== "string" && !isPosixAllSharesType(param.type)) {
             return {
                 ok: false,
                 code: "DEPLOY_PARAM_TYPE_INVALID",

package/dist/error-registry.js

@@ -83,7 +83,7 @@ export const ERROR_REGISTRY = {
     CONTRACT_POSIX_ALL_SHARES_VALUE_FORBIDDEN: {
         code: "CONTRACT_POSIX_ALL_SHARES_VALUE_FORBIDDEN",
         description: "POSIX all-shares 參數不得在契約中指定 default 或 NAS 實體路徑。",
-        suggestion: "請只宣告 type: posix_all_shares，讓 Broker 在安裝時用 DSM API 建立 Share snapshot。",
+        suggestion: "請只宣告 type: posix_all_shares，讓 wizard／CLI 在安裝時取得當下的 Share snapshot。",
     },
     DSM_USER_REQUIRED: {
         code: "DSM_USER_REQUIRED",
@@ -149,12 +149,12 @@ export const ERROR_REGISTRY = {
     COMPOSE_POSIX_ALL_SHARES_UNDECLARED: {
         code: "COMPOSE_POSIX_ALL_SHARES_UNDECLARED",
         description: "Compose 使用了未宣告的 POSIX all-shares marker。",
-        suggestion: "請宣告 type: posix_all_shares，讓 Broker 透過 DSM API 建立安裝當下的 Share snapshot。",
+        suggestion: "請宣告 type: posix_all_shares，讓 package-only wizard／CLI 取得安裝當下的 Share snapshot。",
     },
     COMPOSE_POSIX_ALL_SHARES_SUFFIX_FORBIDDEN: {
         code: "COMPOSE_POSIX_ALL_SHARES_SUFFIX_FORBIDDEN",
         description: "POSIX all-shares marker 不得附加 Share 子路徑。",
-        suggestion: "請只使用完整的 ${ALL_SHARES} source；每個 Share 的 container target 由 Broker 展開。",
+        suggestion: "請只使用完整的 ${ALL_SHARES} source；每個 Share 的 container target 由 package-only preinst 展開。",
     },
     COMPOSE_HOST_BIND_FORBIDDEN: {
         code: "COMPOSE_HOST_BIND_FORBIDDEN",
@@ -529,6 +529,11 @@ export const ERROR_REGISTRY = {
         description: "deploy --param 的值不符合契約宣告的 string 或 boolean 型別。",
         suggestion: "string 請傳非空字串；boolean 請只傳 true 或 false。",
     },
+    DEPLOY_POSIX_ALL_SHARES_LOOKUP_FAILED: {
+        code: "DEPLOY_POSIX_ALL_SHARES_LOOKUP_FAILED",
+        description: "無法以管理員 session 列出部署當下的 Shared Folder 清單。",
+        suggestion: "請確認 DSM 管理員 session 可呼叫 SYNO.Core.Share list，或用 --param NAME=... 明確提供清單。",
+    },
     DSM_DEPENDENCY_CONFLICT: {
         code: "DSM_DEPENDENCY_CONFLICT",
         description: "DSM 複合安裝請求因執行中的依賴套件而拒絕。",

package/dist/host/dsm-client.js

@@ -4,7 +4,7 @@ import { tmpdir } from "node:os";
 import { join } from "node:path";
 import { IDENTITY_CGI_PATH } from "./broker-paths.js";
 import { packageSourceOrigin } from "../deploy/catalog-publish.js";
-import { lookupSharePathWithSynoagentcli } from "./share-lookup.js";
+import { listShareNamesWithSynoagentcli, lookupSharePathWithSynoagentcli } from "./share-lookup.js";
 import { dsmFetch } from "./dsm-http.js";
 import { installPackageFromCatalog, installPackageFromLocalSpk, uninstallPackageFromDsm, fetchInstalledPackageState, packageStateFromRecord, } from "./catalog-install.js";
 import { resolveHostCredentials } from "./credentials.js";
@@ -231,6 +231,9 @@ function createDsmNasHost(credentials, profileName) {
         async resolveSharePath(logicalName) {
             return lookupSharePathWithSynoagentcli(logicalName, profileName);
         },
+        async listShareNames() {
+            return listShareNamesWithSynoagentcli(profileName);
+        },
         async resolveHomesPath() {
             try {
                 const result = synoagentcli(["dsm", "control-panel", "user-group", "advanced", "get", "--section", "home"], profileName);

package/dist/host/fake-nas.d.ts

@@ -4,6 +4,7 @@ export interface FakeNasHostOptions {
     dsmOrigin?: string;
     homesPath?: string;
     installationId?: string;
+    shareNames?: string[];
     shares?: Record<string, string>;
     installedEnv?: Record<string, Record<string, string>>;
     diagnostics?: {

package/dist/host/fake-nas.js

@@ -8,6 +8,11 @@ export function createFakeNasHost(options = {}) {
     const installed = new Set();
     const openUrls = new Map();
     const shares = { ...(options.shares ?? {}) };
+    const shareNames = options.shareNames
+        ? [...options.shareNames]
+        : Object.keys(shares).length > 0
+            ? Object.keys(shares)
+            : ["docker", "home", "photo"];
     const installedEnv = Object.fromEntries(Object.entries(options.installedEnv ?? {}).map(([packageId, env]) => [packageId, { ...env }]));
     const host = {
         dsmOrigin,
@@ -24,6 +29,9 @@ export function createFakeNasHost(options = {}) {
         async resolveSharePath(logicalName) {
             return shares[logicalName];
         },
+        async listShareNames() {
+            return [...shareNames];
+        },
         async resolveHomesPath() {
             return options.homesPath;
         },

package/dist/host/share-lookup.d.ts

@@ -1,3 +1,5 @@
 export declare function shareRealPathFromEntry(entry: Record<string, unknown>, logicalName: string): string | undefined;
 export declare function findShareRealPath(payload: unknown, logicalName: string): string | undefined;
+export declare function findShareNames(payload: unknown): string[];
 export declare function lookupSharePathWithSynoagentcli(logicalName: string, profileName?: string): string | undefined;
+export declare function listShareNamesWithSynoagentcli(profileName?: string): string[];

package/dist/host/share-lookup.js

@@ -59,6 +59,16 @@ export function findShareRealPath(payload, logicalName) {
     }
     return undefined;
 }
+export function findShareNames(payload) {
+    const names = new Set();
+    for (const record of collectRecords(payload)) {
+        const name = record.name ?? record.share_name;
+        if (typeof name === "string" && name.trim() !== "") {
+            names.add(name.trim());
+        }
+    }
+    return [...names];
+}
 function synoagentcli(args, profileName) {
     const fullArgs = [...args];
     if (profileName) {
@@ -142,3 +152,10 @@ export function lookupSharePathWithSynoagentcli(logicalName, profileName) {
     }
     return lookupSharePathWithDsmHttp(logicalName, profileName);
 }
+export function listShareNamesWithSynoagentcli(profileName) {
+    const list = synoagentcli(["dsm", "control-panel", "shared-folder", "list"], profileName);
+    if (list.status !== 0) {
+        return [];
+    }
+    return findShareNames(parseJson(list.stdout));
+}

package/dist/host/types.d.ts

@@ -76,6 +76,8 @@ export interface NasHost {
      * caller refuses instead of guessing.
      */
     getArchFamily?(): Promise<"x86_64" | "aarch64" | undefined>;
+    /** List the current logical Shared Folder names using an administrator session. */
+    listShareNames?(): Promise<string[]>;
     resolveSharePath?(logicalName: string): Promise<string | undefined>;
     /** Resolve the NAS-specific user-home root when DSM User Home is enabled. */
     resolveHomesPath?(): Promise<string | undefined>;

package/dist/validate.js

@@ -68,10 +68,14 @@ export function validateProject(project, options = {}) {
     const installParams = collectInstallParameters(parsed.contract);
     const sharedFolderParams = new Set(installParams.filter(({ param }) => param.type === "shared_folder").map(({ name }) => name));
     const homesParams = new Set(installParams.filter(({ param }) => param.type === "homes").map(({ name }) => name));
+    const posixAllSharesParams = new Set(installParams
+        .filter(({ param }) => param.type === "posix_all_shares")
+        .map(({ name }) => name));
     const installParamNames = new Set(installParams.map(({ name }) => name));
     errors.push(...validateComposeHostBinds(parsedCompose.compose, composeFile, {
         sharedFolderParams,
         homesParams,
+        posixAllSharesParams,
         installParamNames,
     }));
     if (typeof parsed.contract.adminport === "number") {
@@ -105,13 +109,14 @@ export function validateProject(project, options = {}) {
         ? { ...item, severity: (profile === "listing" ? "error" : "warning") }
         : item));
     for (const { name, param } of installParams) {
-        const referenced = param.type === "shared_folder" || param.type === "homes"
+        const referenced = param.type === "shared_folder" || param.type === "homes" || param.type === "posix_all_shares"
             ? volumeSourceVars.has(name)
             : interpolations.has(name);
         if ((param.type === "string" ||
             param.type === "boolean" ||
             param.type === "shared_folder" ||
-            param.type === "homes") &&
+            param.type === "homes" ||
+            param.type === "posix_all_shares") &&
             !referenced) {
             errors.push({
                 code: "INSTALL_PARAMETER_UNREFERENCED",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@synopackageland/cli",
-  "version": "0.3.7",
+  "version": "0.3.8",
   "description": "Syno Package Land Developer Kit CLI",
   "type": "module",
   "bin": {

package/schema/synology-app.schema.json

@@ -59,7 +59,7 @@
         "properties": {
           "type": {
             "type": "string",
-            "enum": ["string", "boolean", "secret", "shared_folder", "dsm_user", "homes"]
+            "enum": ["string", "boolean", "secret", "shared_folder", "dsm_user", "homes", "posix_all_shares"]
           },
           "default": {},
           "generate": {

package/skills/reference/create.md

@@ -38,6 +38,10 @@ ports:
 
 包現成 Compose 時，先用 `inspect` 看原本的 volume mapping。容器路徑跟 Compose／映像的 upstream target 走，不要為了套平台範例改成 `/data`；只把 host source 換成 `${PARAM}`。原有的 upstream named volume 要保留在頂層 `volumes:`。需要既有 Share 時宣告 `install.<PARAM>.type: shared_folder`，管理員在安裝時選這台 NAS 的 Share。
 
+### `posix_all_shares`
+
+當 App 必須在安裝當下掛載這台 NAS 目前列出的每一個共用資料夾時，宣告 `install.<NAME>.type: posix_all_shares`，並把 `${NAME}` 作為完整 Compose volume source，例如 `${NAME}:/shares:ro`。Package Center wizard 會以 `SYNO.Core.Share.list` 的 multi-select 讓管理員再次確認；這是最大警告：容器可讀（或依 Compose 模式讀寫）所有列出的 Share，安裝後新建的共用資料夾不會自動加入，由管理員決定是否安裝。不要在契約或 Compose 寫 `/volume*`、domain、實體 path；`CLI deploy` 未給 `--param NAME=...` 時會用管理員 session 重新列出當下的 Share，preinst 只解析清單，不掃描檔案系統。
+
 ## 路線判準：零設定（Static Zero-Config）vs Dynamic vs Broker
 
 Syno Package Land 在打包 Compose App 時，依契約與 Compose 內容自動分類為不同路線：