@synopackageland/cli 0.30.0 → 0.32.0

package/README.md

@@ -29,6 +29,14 @@ synopkgland status --host my-nas --json
 `deploy --dry-run` prints the deployment plan without connecting to a NAS. You can also install
 the SPK with Package Center's Manual Install.
 
+When packaging someone else's open-source App, name its original project/team
+(or owner display name, then login) as maintainer and yourself as distributor.
+Use `init --upstream-fork --upstream <repo-url> --publisher <name> --publisher-url <url>`;
+`--upstream-maintainer` records a verified project/team name. Publisher defaults
+come from `SYNOPKGLAND_PUBLISHER` / `SYNOPKGLAND_PUBLISHER_URL`. Offline lookups
+leave TODOs; `check --json` reports attribution warnings without failing.
+See the [upstream scaffold and release checklist](skills/reference/upstream-fork.md).
+
 ## Templates
 
 | Template | Use it for | Manifest |
@@ -62,12 +70,12 @@ alongside npm lockfiles. Do not disable checksum verification for public SDK
 packages. Private mirrors can use explicitly configured Go authentication and
 checksum settings; a failed fetch reports `SDK_DOWNLOAD_FAILED`.
 
-CLI-only patch releases can differ from the SDK patch. Compose import and SDK defaults
+CLI-only releases can differ from the SDK patch. Compose import and SDK defaults
 read the SDK pin from the installed templates; explicit App SDK declarations take precedence.
 
 `init` and `add` read their templates from the locally installed
-`@synopackageland/templates`. CLI 0.30.0 depends on `~0.30.0`: npm installation or
-update can select the latest templates patch in the 0.29 minor line. Templates
+`@synopackageland/templates`. CLI 0.32.0 depends on `~0.31.0`: npm installation or
+update can select the latest templates patch in the 0.31 minor line. Templates
 patches need only a templates release; update the npm installation to receive them.
 The CLI never fetches templates at runtime, so offline use works after installation;
 commit a lockfile and use `npm ci` to reproduce a chosen dependency tree.
@@ -339,7 +347,10 @@ DSM readiness; inspect lists explicit acceptance blockers.
 ## Control installed Apps
 
 Use `synopkgland ctl host add nas --url https://nas.example:5001 --username alice`
-to register and authenticate a NAS in OS secure storage. `ctl host list --json`
+to register and authenticate a NAS in OS secure storage. A bare host name uses
+`https://<host>:5001`; provide a full URL for a different scheme or port.
+The CLI loads only `DSM_*` and `SYNOPKGLAND_*` variables from `.env`; set other
+process variables in the shell. `ctl host list --json`
 checks sessions; `ctl list --host nas --json` discovers all approved task-level
 commands and their schemas. Run the listed alias/command with typed flags,
 `--help` and `--dry-run`; writes require `--yes`. There is no mutable current

package/dist/bin.js

@@ -1,10 +1,11 @@
 #!/usr/bin/env node
 import { loadDotEnv } from "./load-env.js";
 import { runCli } from "./cli.js";
+import { terminalSafe } from "./terminal-text.js";
 loadDotEnv();
 // Package deployment is explicit; this CLI does not publish releases.
 // Successful completion leaves Node's default 0 or the command's exitCode intact.
 runCli(process.argv).catch((error) => {
-    console.error(error instanceof Error ? error.message : String(error));
+    console.error(terminalSafe(error instanceof Error ? error.message : String(error)));
     process.exit(1);
 });

package/dist/cli.js

@@ -1,3 +1,4 @@
+import { upstreamRepository, upstreamMaintainer } from './upstream-attribution.js';
 import { Command, CommanderError } from "commander";
 import { existsSync, readFileSync, renameSync, statSync } from "node:fs";
 import { createHash } from "node:crypto";
@@ -36,6 +37,7 @@ import { checkJobs, commitOutputs, forEachArch, } from "./standalone/arch-jobs.j
 import { checkReproducible } from "./reproducible.js";
 import { spkApprovalDiff, formatApprovalDiff } from "./runtime/approval-diff.js";
 import { inspectAnySpk } from "./spk/inspect.js";
+import { terminalSafe } from "./terminal-text.js";
 function failure(code, message, hint = "Fix the configuration and retry; use --help to see command usage.") {
     return Object.assign(new Error(codedMessage(code, message)), { code, hint });
 }
@@ -295,7 +297,7 @@ export async function runCli(argv) {
     const json = argv.includes("--json");
     const stdout = console.log.bind(console);
     const progress = console.log;
-    const emit = (command, data, text) => json ? stdout(JSON.stringify({ ok: true, command, data })) : stdout(text);
+    const emit = (command, data, text) => json ? stdout(JSON.stringify({ ok: true, command, data })) : stdout(terminalSafe(text));
     const program = new Command()
         .name("synopkgland")
         .description("Syno Package Land Developer Kit CLI")
@@ -323,6 +325,8 @@ export async function runCli(argv) {
             throw failure(validation.errors[0].code, formatErrors(validation.errors), validation.errors[0].suggestion);
         const standalone = standaloneRoot(rootOf(command));
         if (standalone) {
+            if (validation.warnings?.length)
+                console.error(formatErrors(validation.warnings));
             const loaded = isNativeLayout(standalone)
                 ? loadNativeLayout(standalone)
                 : loadStandaloneManifest(standalone);
@@ -347,6 +351,7 @@ export async function runCli(argv) {
                 : undefined;
             emit("check", {
                 package: loaded.manifest.package,
+                warnings: validation.warnings ?? [],
                 ...("installSettings" in loaded.manifest && loaded.manifest.installSettings ? { installSettings: loaded.manifest.installSettings } : {}),
                 ...("identityGateway" in loaded.manifest && gatewayAdmissionReport(loaded.manifest.identityGateway, loaded.manifest.entry) ? { identityGateway: gatewayAdmissionReport(loaded.manifest.identityGateway, loaded.manifest.entry) } : {}),
                 capabilities: "capabilities" in loaded.manifest
@@ -441,6 +446,10 @@ export async function runCli(argv) {
         .option("--package <id>", "INFO.package (defaults to the directory name)")
         .option("--name <display>", "Display name")
         .option("--upstream-image <repository>", "compose fork: official image repository; upgrade pins its matching tag and index digest")
+        .option("--upstream <url>", "Original upstream repository URL (defaults to the upstream Git remote)")
+        .option("--upstream-maintainer <name>", "Verified original project/team name; otherwise resolve the GitHub owner")
+        .option("--publisher <name>", "Your distributor name (or SYNOPKGLAND_PUBLISHER)")
+        .option("--publisher-url <url>", "Your distributor URL (or SYNOPKGLAND_PUBLISHER_URL)")
         .option("--upstream-fork", "Create only synology/ inside an upstream source fork (compose or native-go)")
         .option("--health-path <path>", "compose: actual readiness endpoint; redirects are not followed")
         .option("--health-status <status>", "compose: expected 2xx readiness status (no default)", Number)
@@ -454,7 +463,7 @@ export async function runCli(argv) {
         .option("--min-dsm <version>", `Minimum DSM version (native templates and binary default to ${DEFAULT_MIN_DSM}, compose to ${CONTAINER_MIN_DSM})`)
         .argument("[dir]", "Target directory", ".")
         .addHelpText("after", "\nNative projects: native-go, native-python, native-node, native-rust and binary use dsm-package.yaml schema 2.\nCompose projects: compose uses dsm-package.yaml schema 2; --from imports compose.yaml.\nQuick start: synopkgland init -t native-go --with files,jobs,login my-app\n  cd my-app && synopkgland build\n")
-        .action((dir, options, command) => {
+        .action(async (dir, options, command) => {
         if (command.parent?.opts().project)
             throw failure("CLI_OPTION_INVALID", "--project does not apply to init.");
         if (!options.template)
@@ -462,7 +471,16 @@ export async function runCli(argv) {
         if (!isTemplateName(options.template))
             throw failure("INIT_TEMPLATE_UNKNOWN", `Unknown template: ${options.template}`);
         const targetDir = resolve(dir);
+        const upstream = options.upstreamFork ? upstreamRepository(targetDir, options.upstream) : undefined;
+        if (options.upstream && !upstream)
+            throw failure("INIT_UPSTREAM_INVALID", "Supply an http(s) repository URL without credentials");
+        if (!options.upstreamFork && (options.upstream || options.upstreamMaintainer || options.publisher || options.publisherUrl))
+            throw failure("INIT_OPTIONS_UNSUPPORTED", "Attribution options require --upstream-fork");
         initFromTemplate(options.template, targetDir, {
+            upstream,
+            upstreamMaintainer: options.upstreamMaintainer ?? (options.upstreamFork ? await upstreamMaintainer(upstream) : undefined),
+            publisher: options.publisher ?? process.env.SYNOPKGLAND_PUBLISHER,
+            publisherUrl: options.publisherUrl ?? process.env.SYNOPKGLAND_PUBLISHER_URL,
             upstreamFork: options.upstreamFork,
             upstreamImage: options.upstreamImage,
             healthPath: options.healthPath,

package/dist/ctl/cli.js

@@ -52,7 +52,7 @@ function q(value) { return "'" + value.replaceAll("'", "'\\''") + "'"; }
 function example(host, app, op) {
     const base = `synopkgland ctl ${app.payload.aliases[0] ?? app.payload.package.id} ${op.cli.join(' ')} --host ${host}`;
     return (op.examples?.length ? op.examples : [{}]).map(params => {
-        const simple = op.paramsSchema && Object.entries(params).every(([key, value]) => ['string', 'number', 'boolean'].includes(typeof value) && !RESERVED_FLAGS.has(flagName(key)) && op.paramsSchema?.properties?.[key]);
+        const simple = op.paramsSchema && Object.entries(params).every(([key, value]) => ['string', 'number', 'boolean'].includes(typeof value) && /^[A-Za-z][A-Za-z0-9_]*$/.test(key) && !RESERVED_FLAGS.has(flagName(key)) && op.paramsSchema?.properties?.[key]);
         if (simple)
             return base + Object.entries(params).map(([key, value]) => ' --' + flagName(key) + ' ' + q(String(value))).join('') + (op.effect === 'read' ? '' : ' --yes');
         return `printf '%s' ${q(JSON.stringify(params))} | ${base} --input -` + (op.effect === 'read' ? '' : ' --yes');

package/dist/ctl/json.js

@@ -1,9 +1,43 @@
 import { openSync, closeSync, readSync } from 'node:fs';
-import { parseDocument } from 'yaml';
+/** Linear duplicate-key scan over text that JSON.parse already accepted (yaml's uniqueKeys check is quadratic). */
+function hasDuplicateKeys(text) {
+    const stack = [];
+    let expectKey = false;
+    for (let i = 0; i < text.length; i++) {
+        const c = text[i];
+        if (c === '"') {
+            let j = i + 1;
+            while (text[j] !== '"')
+                j += text[j] === '\\' ? 2 : 1;
+            const top = stack[stack.length - 1];
+            if (top && expectKey) {
+                const key = JSON.parse(text.slice(i, j + 1));
+                if (top.has(key))
+                    return true;
+                top.add(key);
+                expectKey = false;
+            }
+            i = j;
+        }
+        else if (c === '{') {
+            stack.push(new Set());
+            expectKey = true;
+        }
+        else if (c === '[') {
+            stack.push(null);
+        }
+        else if (c === '}' || c === ']') {
+            stack.pop();
+        }
+        else if (c === ',' && stack[stack.length - 1])
+            expectKey = true;
+    }
+    return false;
+}
 export function strictJson(raw) {
     const text = typeof raw === 'string' ? raw : new TextDecoder('utf-8', { fatal: true }).decode(raw);
     const value = JSON.parse(text);
-    if (parseDocument(text, { uniqueKeys: true }).errors.length)
+    if (hasDuplicateKeys(text))
         throw Error('Duplicate JSON properties');
     const check = (v, depth) => { if (depth > 32)
         throw Error('JSON too deep'); if (typeof v === 'number' && !Number.isFinite(v))

package/dist/ctl/service.js

@@ -37,7 +37,7 @@ export class CtlClient {
         const entries = response.data?.packages;
         if (!Array.isArray(entries) || response.data.total !== entries.length || entries.length > 4096)
             throw new CtlError('CTL_INVENTORY_INVALID', 'Incomplete installed-package inventory.', 'Check the DSM version and permissions.', 5);
-        return entries.map((p) => { if (typeof p.id !== 'string' || !/^[A-Za-z][A-Za-z0-9_.+-]{0,127}$/.test(p.id) || typeof p.version !== 'string')
+        return entries.map((p) => { if (typeof p.id !== 'string' || !/^[A-Za-z][A-Za-z0-9_.+-]{0,127}$/.test(p.id) || typeof p.version !== 'string' || !/^[A-Za-z0-9][A-Za-z0-9._+~-]{0,63}$/.test(p.version))
             throw new CtlError('CTL_INVENTORY_INVALID', 'Invalid package identity.', 'Check the DSM response.', 5); return { id: p.id, version: p.version, state: p.additional?.status }; });
     }
     async discover(options = {}) {

package/dist/error-registry.js

@@ -1,6 +1,9 @@
 import { COMPOSE_ERRORS } from "./standalone/compose-errors.js";
 export const ERROR_REGISTRY = {
     ...COMPOSE_ERRORS,
+    INIT_UPSTREAM_INVALID: { code: "INIT_UPSTREAM_INVALID", description: "The upstream repository URL is invalid.", suggestion: "Supply --upstream with an http(s) repository URL without credentials." },
+    INIT_PUBLISHER_INVALID: { code: "INIT_PUBLISHER_INVALID", description: "The attribution name or publisher URL is invalid.", suggestion: "Use plain single-line project/publisher names and an http(s) publisher URL without credentials." },
+    UPSTREAM_ATTRIBUTION: { code: "UPSTREAM_ATTRIBUTION", description: "Upstream App attribution is incomplete or names the distributor as maintainer.", suggestion: "Name the original project/team or owner as maintainer; set metadata.maintainer_url to the upstream repository and metadata.distributor/distributor_url to your publisher; resolve TODOs before release." },
     INSTALL_SETTINGS_INVALID: { "code": "INSTALL_SETTINGS_INVALID", "description": "The installation setting declaration is invalid.", "suggestion": "Declare 1–32 lowercase identifier keys in install.settings, each with type https-origin, a plain label and an explicit boolean required; omit defaults and values." },
     SDK_INSTALL_SETTINGS_UNSUPPORTED: { "code": "SDK_INSTALL_SETTINGS_UNSUPPORTED", "description": "The selected SDK does not provide native installation settings.", "suggestion": "Pin SDK 0.24.0 or a matching supported release with installsettings/cmd/control, then rebuild with the matching CLI." },
     SDK_INSTALL_SETTINGS_BUILD_FAILED: { "code": "SDK_INSTALL_SETTINGS_BUILD_FAILED", "description": "The SDK installation settings controller could not be built.", "suggestion": "Install the pinned Go toolchain, inspect the compiler diagnostics and rebuild with a complete matching SDK release." },

package/dist/host/credentials.js

@@ -56,7 +56,7 @@ function fromEnv(urlOverride) {
     if (urlOverride) {
         dsmOrigin = urlOverride.startsWith("http://") || urlOverride.startsWith("https://")
             ? urlOverride
-            : `http://${urlOverride}:5000`;
+            : `https://${urlOverride}:5001`;
     }
     const password = process.env.DSM_PASSWORD;
     const username = process.env.DSM_USERNAME ?? "admin";

package/dist/host/dsm-http.js

@@ -52,30 +52,44 @@ export async function dsmFetch(url, init = {}) {
         return curlFetch(url, init);
     }
 }
+function curlConfigString(value) {
+    const escapes = { "\\": "\\\\", '"': '\\"', "\t": "\\t", "\n": "\\n", "\r": "\\r", "\v": "\\v" };
+    return `"${value.replace(/[\\"\t\n\r\v]/g, (c) => escapes[c])}"`;
+}
 async function curlFetch(url, init) {
     const staging = mkdtempSync(join(tmpdir(), "synopkgland-dsm-http-"));
     const headerFile = join(staging, "headers");
     const bodyFile = join(staging, "body");
     try {
-        const args = ["-sS", "-D", headerFile, "-o", bodyFile, "-w", "%{http_code}", "-X", init.method ?? "GET"];
+        const configFile = join(staging, "config");
+        const args = ["-sS", "-D", headerFile, "-o", bodyFile, "-w", "%{http_code}", "-X", init.method ?? "GET", "-K", configFile];
+        // Headers and form text go through a private config file, not argv, and
+        // form text is sent literally (curl -F would read "@file" and "<file").
+        const config = [];
         const headers = headerRecord(init.headers);
         for (const [name, value] of Object.entries(headers)) {
             if (name.toLowerCase() === "content-type" && init.body instanceof FormData) {
                 continue;
             }
-            args.push("-H", `${name}: ${value}`);
+            if (/[\r\n\0]/.test(name + value)) {
+                throw new Error(`Invalid header value: ${name}`);
+            }
+            config.push(`header = ${curlConfigString(`${name}: ${value}`)}`);
         }
         let stdin;
         if (init.body instanceof FormData) {
             for (const [name, value] of init.body.entries()) {
                 if (typeof value === "string") {
-                    args.push("-F", `${name}=${value}`);
+                    if (/[=\0]/.test(name) || value.includes("\0")) {
+                        throw new Error(`Invalid form field: ${name}`);
+                    }
+                    config.push(`form-string = ${curlConfigString(`${name}=${value}`)}`);
                     continue;
                 }
                 const filename = "name" in value && typeof value.name === "string" ? value.name : "upload.bin";
                 const partPath = join(staging, filename);
                 writeFileSync(partPath, Buffer.from(await value.arrayBuffer()));
-                args.push("-F", `${name}=@${partPath};filename=${filename}`);
+                config.push(`form = ${curlConfigString(`${name}=@${partPath};filename=${filename}`)}`);
             }
         }
         else if (typeof init.body === "string") {
@@ -86,6 +100,7 @@ async function curlFetch(url, init) {
             stdin = Buffer.from(await new Response(init.body).arrayBuffer());
             args.push("--data-binary", "@-");
         }
+        writeFileSync(configFile, config.map((line) => line + "\n").join(""), { mode: 0o600 });
         args.push(url);
         const result = spawnSync("curl", args, { encoding: "utf8", input: stdin });
         if (result.status !== 0) {

package/dist/init-upstream.d.ts

@@ -1,6 +1,10 @@
 export interface ForkRecipeOptions {
     upstreamImage?: string;
     from?: string;
+    upstream?: string;
+    upstreamMaintainer?: string;
+    publisher?: string;
+    publisherUrl?: string;
 }
 export declare function validateForkRecipe(template: 'compose' | 'native-go', options: ForkRecipeOptions): void;
 /** CLI-owned packaging recipe; upstream files and history stay untouched. */

package/dist/init-upstream.js

@@ -3,8 +3,17 @@ import { join } from 'node:path';
 import { fileURLToPath } from 'node:url';
 import { parseDocument } from 'yaml';
 import { API_PERMISSIONS_FILE } from './standalone/api-permissions.js';
+import { safeMetadataUrl } from './package-metadata.js';
 import { parseImageReference } from './images/pin.js';
 export function validateForkRecipe(template, options) {
+    if (options.upstream && !safeMetadataUrl(options.upstream))
+        throw new Error('[INIT_UPSTREAM_INVALID] Supply an http(s) upstream repository URL without credentials.');
+    if (options.publisherUrl && !safeMetadataUrl(options.publisherUrl))
+        throw new Error('[INIT_PUBLISHER_INVALID] Supply an http(s) publisher URL without credentials.');
+    for (const value of [options.publisher, options.upstreamMaintainer]) {
+        if (value !== undefined && (!value.trim() || /[\x00-\x1f\x7f"\\]/.test(value) || value.length > 200))
+            throw new Error('[INIT_PUBLISHER_INVALID] Attribution names must be plain, non-empty single-line text.');
+    }
     if (template === 'native-go' && options.upstreamImage)
         throw new Error('[INIT_OPTIONS_UNSUPPORTED] Native forks stage official release binaries or use a source build hook; image options apply only to compose.');
     if (template !== 'compose')
@@ -28,6 +37,14 @@ export function writeForkScaffold(packaging, template, options) {
         ? { kind: 'official-image', repository: options.upstreamImage, service, imageTag: 'tag' }
         : { kind: 'native-source' };
     writeFileSync(join(packaging, 'upstream-recipe.json'), JSON.stringify(recipe, null, 2) + '\n');
+    doc.set('maintainer', options.upstreamMaintainer ?? 'TODO: original upstream project or owner');
+    doc.setIn(['metadata', 'distributor'], options.publisher ?? 'TODO: your publisher name');
+    if (options.upstream) {
+        doc.setIn(['metadata', 'upstream'], options.upstream);
+        doc.setIn(['metadata', 'maintainer_url'], options.upstream);
+    }
+    if (options.publisherUrl)
+        doc.setIn(['metadata', 'distributor_url'], options.publisherUrl);
     doc.set('entry', 'admin-only');
     doc.delete('ctl');
     if (official) {
@@ -53,6 +70,8 @@ export function writeForkScaffold(packaging, template, options) {
     const guidance = `
 ## Integrating an existing open-source App
 
+If you package someone else's open-source project, set maintainer to the original project/owner (prefer the project's own team/org name, else the owner's display name, else login), metadata.maintainer_url to the upstream repo, and yourself as metadata.distributor/metadata.distributor_url. Resolve all attribution TODOs before release; run check and review its warnings. Only your own Apps use your publisher as maintainer.
+
 Keep the upstream fork/history and remote upstream. All wrapper-owned files belong in synology/; never edit upstream files or treat the App as an SDK component. Read synopkgland skill show upstream-fork.
 
 Leave ctl absent from the manifest by default. Ask whether the user wants AI control; add ctl only when explicitly requested. If requested, read synopkgland skill show ctl and produce ctl-plan covering existing UI actions and public API endpoints, including common reads and writes. Status-only commands do not meet completion. Wrap existing native APIs without changing upstream code or inventing features. Long operations must return through existing asynchronous APIs without waiting for completion; report synchronous-only long APIs as blockers for discussion.

package/dist/init.d.ts

@@ -18,6 +18,10 @@ export interface InitOptions {
     from?: string;
     upstreamFork?: boolean;
     upstreamImage?: string;
+    upstream?: string;
+    upstreamMaintainer?: string;
+    publisher?: string;
+    publisherUrl?: string;
     healthPath?: string;
     healthStatus?: number;
     /** native-go: `install.sharedFolder` (select from the NAS, or create one). key defaults to "shared", permission to "rw". */

package/dist/load-env.js

@@ -1,5 +1,8 @@
 import { existsSync, readFileSync } from "node:fs";
 import { dirname, join, resolve } from "node:path";
+// A project .env may only supply the CLI's own settings, never variables that
+// change how child tools (go, docker, curl, tar) run.
+const DOTENV_KEY = /^(?:DSM|SYNOPKGLAND)_[A-Z0-9_]+$/;
 export function loadDotEnv(fromDir = process.cwd()) {
     let current = resolve(fromDir);
     while (true) {
@@ -16,7 +19,7 @@ export function loadDotEnv(fromDir = process.cwd()) {
                 }
                 const key = trimmed.slice(0, eq).trim();
                 const value = trimmed.slice(eq + 1).trim();
-                if (process.env[key] === undefined) {
+                if (DOTENV_KEY.test(key) && process.env[key] === undefined) {
                     process.env[key] = value;
                 }
             }

package/dist/package-metadata.d.ts

@@ -7,6 +7,7 @@ export interface PackageMetadata {
     support_email?: string;
     homepage?: string;
     source_url?: string;
+    upstream?: string;
     issues_url?: string;
     license?: string;
     maintainer_url?: string;

package/dist/package-metadata.js

@@ -27,6 +27,7 @@ export function validateMetadata(raw) {
         "support_email",
         "homepage",
         "source_url",
+        "upstream",
         "issues_url",
         "license",
         "maintainer_url",
@@ -66,6 +67,7 @@ export function validateMetadata(raw) {
         if ([
             "homepage",
             "source_url",
+            "upstream",
             "issues_url",
             "maintainer_url",
             "distributor_url",

package/dist/standalone/inspect-spk.js

@@ -1037,6 +1037,11 @@ function readInfo(path, findings, kind, compose = false, daemonNode) {
             findings.push(`INFO is missing ${key}`);
         }
     }
+    // Every SDK build writes this package grammar; inspect renders paths and
+    // configs from it, so anything else is not an SDK-built package.
+    if (info.package && !/^[A-Za-z][A-Za-z0-9]{1,63}$/.test(info.package)) {
+        findings.push("INFO package is not a valid SDK package id");
+    }
     if (kind !== "container" &&
         (info.thirdparty !== "yes" || info.dsmuidir !== "ui")) {
         findings.push('INFO must have thirdparty="yes" and dsmuidir="ui" for DSM to serve /webman/3rdparty/<package>/');

package/dist/standalone/spk.js

@@ -6,9 +6,9 @@ import { resolvedSdkLaunch } from "../contract/app-launch.js";
 import { gatewayAdmissionPolicy } from "./identity-gateway.js";
 import { metadataInfoFields } from "../package-metadata.js";
 import { createHash } from "node:crypto";
-import { chmodSync, copyFileSync, existsSync, lstatSync, mkdirSync, mkdtempSync, readdirSync, readFileSync, rmSync, writeFileSync, } from "node:fs";
+import { chmodSync, copyFileSync, existsSync, lstatSync, mkdirSync, mkdtempSync, readdirSync, readFileSync, rmSync, writeFileSync, realpathSync, } from "node:fs";
 import { tmpdir } from "node:os";
-import { dirname, join } from "node:path";
+import { dirname, join, sep } from "node:path";
 import { infoArchValue } from "../build-spk/dsm-arch.js";
 import { packageIcons, writeDsmWindowIcons, writePackageCenterIcons, } from "../build-spk/dsm-icons.js";
 import { renderNativePrivilege } from "../build-spk/native-lifecycle.js";
@@ -78,7 +78,7 @@ export async function assembleStandaloneSpk(options) {
         const uiRoot = join(staging, "package", "ui");
         const appDir = join(uiRoot, "app");
         if (hasSdkWindow(manifest))
-            copyUiTree(manifest.ui.dir, appDir);
+            copyUiTree(manifest.ui.dir, appDir, manifest.root);
         else
             mkdirSync(appDir, { recursive: true });
         const assetVersion = digestTree(appDir).slice(0, 12);
@@ -386,12 +386,17 @@ export function renderInfo(manifest, arch, checksum, executorDigest) {
         fields.push(['startstop_restart_services', 'nginx.service']);
     return portalInfoFields(fields, Boolean(manifest.portal) || nginx).map(([key, value]) => `${key}=${quote(value)}\n`).join("");
 }
-function copyUiTree(source, target) {
+function copyUiTree(source, target, root) {
     for (const entry of ["app.js", "app.css"]) {
         if (!existsSync(join(source, entry))) {
             throw new StandaloneBuildError("STANDALONE_UI_ENTRY_MISSING", `The UI directory is missing ${entry}: ${source}`);
         }
     }
+    const real = realpathSync(source);
+    const realRoot = realpathSync(root);
+    if (real !== realRoot && !real.startsWith(realRoot + sep)) {
+        throw new StandaloneBuildError("STANDALONE_UI_SYMLINK", `The UI directory must resolve inside the project: ${source}`);
+    }
     let total = 0;
     const walk = (from, to) => {
         mkdirSync(to, { recursive: true });

package/dist/terminal-text.d.ts

@@ -0,0 +1 @@
+export declare function terminalSafe(text: string): string;

package/dist/terminal-text.js

@@ -0,0 +1,5 @@
+// Package-supplied strings (INFO fields, file names, DSM data) reach human
+// output; show control characters as escapes so they cannot drive the terminal.
+export function terminalSafe(text) {
+    return text.replace(/[\u0000-\u0008\u000b-\u001f\u007f-\u009f]/g, (c) => `\\x${c.charCodeAt(0).toString(16).padStart(2, "0")}`);
+}

package/dist/upstream-attribution.d.ts

@@ -0,0 +1,7 @@
+import type { ValidationError } from './types.js';
+/** A repository URL is provenance, never a credential-bearing transport URL. */
+export declare function upstreamRepository(root: string, explicit?: string): string | undefined;
+/** Best effort, bounded and public: offline/rate-limited lookups retain an explicit TODO. */
+export declare function upstreamMaintainer(url?: string, fetcher?: typeof fetch): Promise<string | undefined>;
+/** Advice only: attribution never changes manifest validity or the command exit status. */
+export declare function upstreamAttributionWarnings(root: string): ValidationError[];

package/dist/upstream-attribution.js

@@ -0,0 +1,56 @@
+import { existsSync, readFileSync } from 'node:fs';
+import { basename, join } from 'node:path';
+import { spawnSync } from 'node:child_process';
+import { parse } from 'yaml';
+import { safeMetadataUrl } from './package-metadata.js';
+/** A repository URL is provenance, never a credential-bearing transport URL. */
+export function upstreamRepository(root, explicit) {
+    const raw = explicit ?? spawnSync('git', ['remote', 'get-url', 'upstream'], {
+        cwd: root, encoding: 'utf8', timeout: 1000,
+    }).stdout?.trim();
+    if (!raw)
+        return undefined;
+    const url = raw.replace(/^git@github\.com:/, 'https://github.com/').replace(/\.git$/, '');
+    return safeMetadataUrl(url) ? url : undefined;
+}
+/** Best effort, bounded and public: offline/rate-limited lookups retain an explicit TODO. */
+export async function upstreamMaintainer(url, fetcher = fetch) {
+    if (!url)
+        return undefined;
+    const match = /^https:\/\/github\.com\/([\w-]+)\/[^/?#]+\/?$/.exec(url);
+    if (!match)
+        return undefined;
+    try {
+        const response = await fetcher(`https://api.github.com/users/${match[1]}`, {
+            headers: { Accept: 'application/vnd.github+json' }, signal: AbortSignal.timeout(3000),
+        });
+        if (!response.ok)
+            return undefined;
+        const owner = await response.json();
+        const name = typeof owner.name === 'string' && owner.name.trim() ? owner.name.trim() : owner.login;
+        return typeof name === 'string' && name.length <= 200 && !/[\x00-\x1f\x7f"\\]/.test(name) ? name : undefined;
+    }
+    catch {
+        return undefined;
+    }
+}
+/** Advice only: attribution never changes manifest validity or the command exit status. */
+export function upstreamAttributionWarnings(root) {
+    const raw = parse(readFileSync(join(root, 'dsm-package.yaml'), 'utf8'));
+    const m = raw?.metadata ?? {};
+    const fork = existsSync(join(root, 'upstream-recipe.json')) ||
+        (basename(root) === 'synology' && existsSync(join(root, 'upgrade.sh')));
+    if (!m.upstream && !fork)
+        return [];
+    const todo = (v) => typeof v !== 'string' || !v.trim() || /^TODO\b/i.test(v.trim());
+    if (!todo(raw.maintainer) && !todo(m.distributor) &&
+        raw.maintainer.trim().toLowerCase() !== m.distributor.trim().toLowerCase() &&
+        !todo(m.maintainer_url) && !todo(m.distributor_url))
+        return [];
+    return [{
+            code: 'UPSTREAM_ATTRIBUTION', severity: 'warning',
+            span: { file: 'dsm-package.yaml', line: 1, column: 1 },
+            message: 'Upstream App attribution is incomplete or names the distributor as maintainer',
+            suggestion: "Set maintainer to the original project/team, else the owner's display name or login; set metadata.maintainer_url to the upstream repository and metadata.distributor/distributor_url to your publisher. Resolve attribution TODOs before release",
+        }];
+}

package/dist/validate.js

@@ -1,3 +1,4 @@
+import { upstreamAttributionWarnings } from './upstream-attribution.js';
 import { existsSync } from "node:fs";
 import { join } from "node:path";
 import { getErrorCode } from "./error-registry.js";
@@ -36,6 +37,6 @@ export function validateProject(project, _options = {}) {
                     "Correct the schema-2 declaration; see the SDK Compose support matrix.",
             })),
         }
-        : { ok: true, errors: [] };
+        : { ok: true, errors: [], warnings: upstreamAttributionWarnings(project.root) };
 }
 export { findProjectRoot } from "./discovery.js";

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@synopackageland/cli",
-  "version": "0.30.0",
+  "version": "0.32.0",
   "description": "Syno Package Land Developer Kit CLI",
   "type": "module",
   "bin": {
@@ -27,7 +27,7 @@
   },
   "dependencies": {
     "@napi-rs/keyring": "^2.1.1",
-    "@synopackageland/templates": "~0.30.0",
+    "@synopackageland/templates": "~0.31.0",
     "ajv": "^8.17.1",
     "commander": "^13.1.0",
     "json-canonicalize": "^3.0.1",

package/schema/package-metadata.schema.json

@@ -96,6 +96,11 @@
         "pattern": "^https://",
         "maxLength": 2048
       }
+    },
+    "upstream": {
+      "type": "string",
+      "maxLength": 2048,
+      "pattern": "^https?://"
     }
   }
 }

package/schema/synology-app.schema.json

@@ -188,6 +188,11 @@
       "type": "object",
       "additionalProperties": false,
       "properties": {
+        "upstream": {
+          "type": "string",
+          "maxLength": 2048,
+          "pattern": "^https?://"
+        },
         "changelog": {
           "oneOf": [
             {

package/skills/SKILL.md

@@ -5,7 +5,7 @@ description: Initialize, extend, check, build, inspect, and deploy Synology appl
 
 # Independent Synology SPKs
 
-CLI 0.27.x installs templates through `~0.27.0`. A templates patch needs only a
+CLI 0.32.0 installs templates through `~0.31.0`. A templates patch needs only a
 templates release; npm install/update selects a patch in that minor line. The CLI
 uses the locally installed templates and reads their SDK pin for defaults; it
 never downloads templates at runtime. Preserve the lockfile and use `npm ci` for
@@ -22,6 +22,14 @@ Use this guide to initialize, build and inspect own applications or upstream OSS
 
 For an existing open-source App, first read [reference/upstream-fork.md](reference/upstream-fork.md): upstream fork/history + untouched upstream files + all packaging in `synology/`, official container images pinned by tag/index digest, native official release binaries pinned by SHA-256 or a source build hook, and a single tag-merge upgrade command. Use `init --upstream-fork`; never rewrite the App as a component. Integrated upstream Apps require direct DSM administrator entry without a separate App password or an OIDC/SSO server: supported trusted headers first, disabling native login second; the shipped OpenList pattern uses the existing SDK 0.17.3 token adapter (`mode: token`, `access: dsm-admins`, `entry: admin-only`) with server-side Authorization injection. All DSM admins share one upstream admin; token reset requires package restart; WebDAV retains its native credentials.
 
+**If you package someone else's open-source project, set `maintainer` to the
+original project/owner (prefer the project's own team/org name, else the owner's
+display name, else login), `metadata.maintainer_url` to the upstream repository,
+and yourself as `metadata.distributor` / `metadata.distributor_url`.** Only your
+own Apps use your publisher as maintainer. Pass upstream and publisher attribution
+to `init --upstream-fork`; resolve TODOs and review `check` warnings before release.
+See the scaffold steps and release checklist in [reference/upstream-fork.md](reference/upstream-fork.md).
+
 For upstream OSS packaging, leave `ctl` absent from the manifest by default. Ask whether the user wants AI control; implement it only when explicitly requested. Read [reference/ctl.md](reference/ctl.md) for the required `ctl-plan`, UI/API coverage checklist and asynchronous-operation rules. Own Apps retain the native template's ctl defaults, with commands covering their main features; status-only coverage is incomplete.
 
 Start with `synopkgland init -t native-go`, `synopkgland init -t binary`, or `synopkgland init -t compose`. Read reference/create.md or reference/wrap.md, then reference/deploy.md. Native CGI session checks belong to the package. For wrapping upstream OSS with DSM accounts, read [reference/identity-gateway.md](reference/identity-gateway.md) first. For all Compose work, read [reference/compose.md](reference/compose.md): schema-2 upstream files, generated override, SDK planner, fixed package identity and current DSM blockers. Containers do not inherit a signed-in user's File Station ACL. Existing Shared Folder mounts are blocked until official protected ACL/project control is verified.

package/skills/reference/compose.md

@@ -247,7 +247,7 @@ declared availability readiness, LAN isolation/egress, protected grant lifecycle
 ACLs, two-user visibility and clean install/upgrade/reboot/stop/uninstall before
 calling the package supported on a NAS. No NAS is accessed by the build gate.
 
-The unified Compose contract uses SDK 0.27.x with CLI 0.27.x and locally installed templates from `~0.27.0`. Templates patches can ship independently; npm install/update resolves them, and SDK defaults come from the installed templates. SDK minor upgrades do not require a CLI release when they declare supported executor manifest format 1; the resolved SDK owns the release mapping and verified payload digests. The CLI does not fetch templates at runtime. The legacy packaging route and bridge publish mode are removed.
+The unified Compose contract uses SDK defaults from locally installed templates `~0.31.0` with CLI 0.32.0. Templates patches can ship independently; npm install/update resolves them, and SDK defaults come from the installed templates. SDK minor upgrades do not require a CLI release when they declare supported executor manifest format 1; the resolved SDK owns the release mapping and verified payload digests. The CLI does not fetch templates at runtime. The legacy packaging route and bridge publish mode are removed.
 
 Primary override files, and each included override set, must share a directory. Cross-directory override bases are rejected before loader I/O. Included implicit .env files are confined, inventoried and preserved; symlinks are rejected.