@synopackageland/cli 0.31.0 → 0.32.1

package/README.md

@@ -29,6 +29,14 @@ synopkgland status --host my-nas --json
 `deploy --dry-run` prints the deployment plan without connecting to a NAS. You can also install
 the SPK with Package Center's Manual Install.
 
+When packaging someone else's open-source App, name its original project/team
+(or owner display name, then login) as maintainer and yourself as distributor.
+Use `init --upstream-fork --upstream <repo-url> --publisher <name> --publisher-url <url>`;
+`--upstream-maintainer` records a verified project/team name. Publisher defaults
+come from `SYNOPKGLAND_PUBLISHER` / `SYNOPKGLAND_PUBLISHER_URL`. Offline lookups
+leave TODOs; `check --json` reports attribution warnings without failing.
+See the [upstream scaffold and release checklist](skills/reference/upstream-fork.md).
+
 ## Templates
 
 | Template | Use it for | Manifest |
@@ -62,12 +70,12 @@ alongside npm lockfiles. Do not disable checksum verification for public SDK
 packages. Private mirrors can use explicitly configured Go authentication and
 checksum settings; a failed fetch reports `SDK_DOWNLOAD_FAILED`.
 
-CLI-only patch releases can differ from the SDK patch. Compose import and SDK defaults
+CLI-only releases can differ from the SDK patch. Compose import and SDK defaults
 read the SDK pin from the installed templates; explicit App SDK declarations take precedence.
 
 `init` and `add` read their templates from the locally installed
-`@synopackageland/templates`. CLI 0.31.0 depends on `~0.31.0`: npm installation or
-update can select the latest templates patch in the 0.29 minor line. Templates
+`@synopackageland/templates`. CLI 0.32.1 depends on `~0.31.0`: npm installation or
+update can select the latest templates patch in the 0.31 minor line. Templates
 patches need only a templates release; update the npm installation to receive them.
 The CLI never fetches templates at runtime, so offline use works after installation;
 commit a lockfile and use `npm ci` to reproduce a chosen dependency tree.

package/dist/cli.js

@@ -1,3 +1,4 @@
+import { upstreamRepository, upstreamMaintainer } from './upstream-attribution.js';
 import { Command, CommanderError } from "commander";
 import { existsSync, readFileSync, renameSync, statSync } from "node:fs";
 import { createHash } from "node:crypto";
@@ -324,6 +325,8 @@ export async function runCli(argv) {
             throw failure(validation.errors[0].code, formatErrors(validation.errors), validation.errors[0].suggestion);
         const standalone = standaloneRoot(rootOf(command));
         if (standalone) {
+            if (validation.warnings?.length)
+                console.error(formatErrors(validation.warnings));
             const loaded = isNativeLayout(standalone)
                 ? loadNativeLayout(standalone)
                 : loadStandaloneManifest(standalone);
@@ -348,6 +351,7 @@ export async function runCli(argv) {
                 : undefined;
             emit("check", {
                 package: loaded.manifest.package,
+                warnings: validation.warnings ?? [],
                 ...("installSettings" in loaded.manifest && loaded.manifest.installSettings ? { installSettings: loaded.manifest.installSettings } : {}),
                 ...("identityGateway" in loaded.manifest && gatewayAdmissionReport(loaded.manifest.identityGateway, loaded.manifest.entry) ? { identityGateway: gatewayAdmissionReport(loaded.manifest.identityGateway, loaded.manifest.entry) } : {}),
                 capabilities: "capabilities" in loaded.manifest
@@ -442,6 +446,10 @@ export async function runCli(argv) {
         .option("--package <id>", "INFO.package (defaults to the directory name)")
         .option("--name <display>", "Display name")
         .option("--upstream-image <repository>", "compose fork: official image repository; upgrade pins its matching tag and index digest")
+        .option("--upstream <url>", "Original upstream repository URL (defaults to the upstream Git remote)")
+        .option("--upstream-maintainer <name>", "Verified original project/team name; otherwise resolve the GitHub owner")
+        .option("--publisher <name>", "Your distributor name (or SYNOPKGLAND_PUBLISHER)")
+        .option("--publisher-url <url>", "Your distributor URL (or SYNOPKGLAND_PUBLISHER_URL)")
         .option("--upstream-fork", "Create only synology/ inside an upstream source fork (compose or native-go)")
         .option("--health-path <path>", "compose: actual readiness endpoint; redirects are not followed")
         .option("--health-status <status>", "compose: expected 2xx readiness status (no default)", Number)
@@ -455,7 +463,7 @@ export async function runCli(argv) {
         .option("--min-dsm <version>", `Minimum DSM version (native templates and binary default to ${DEFAULT_MIN_DSM}, compose to ${CONTAINER_MIN_DSM})`)
         .argument("[dir]", "Target directory", ".")
         .addHelpText("after", "\nNative projects: native-go, native-python, native-node, native-rust and binary use dsm-package.yaml schema 2.\nCompose projects: compose uses dsm-package.yaml schema 2; --from imports compose.yaml.\nQuick start: synopkgland init -t native-go --with files,jobs,login my-app\n  cd my-app && synopkgland build\n")
-        .action((dir, options, command) => {
+        .action(async (dir, options, command) => {
         if (command.parent?.opts().project)
             throw failure("CLI_OPTION_INVALID", "--project does not apply to init.");
         if (!options.template)
@@ -463,7 +471,16 @@ export async function runCli(argv) {
         if (!isTemplateName(options.template))
             throw failure("INIT_TEMPLATE_UNKNOWN", `Unknown template: ${options.template}`);
         const targetDir = resolve(dir);
+        const upstream = options.upstreamFork ? upstreamRepository(targetDir, options.upstream) : undefined;
+        if (options.upstream && !upstream)
+            throw failure("INIT_UPSTREAM_INVALID", "Supply an HTTPS repository URL without credentials");
+        if (!options.upstreamFork && (options.upstream || options.upstreamMaintainer || options.publisher || options.publisherUrl))
+            throw failure("INIT_OPTIONS_UNSUPPORTED", "Attribution options require --upstream-fork");
         initFromTemplate(options.template, targetDir, {
+            upstream,
+            upstreamMaintainer: options.upstreamMaintainer ?? (options.upstreamFork ? await upstreamMaintainer(upstream) : undefined),
+            publisher: options.publisher ?? process.env.SYNOPKGLAND_PUBLISHER,
+            publisherUrl: options.publisherUrl ?? process.env.SYNOPKGLAND_PUBLISHER_URL,
             upstreamFork: options.upstreamFork,
             upstreamImage: options.upstreamImage,
             healthPath: options.healthPath,

package/dist/error-registry.js

@@ -1,6 +1,9 @@
 import { COMPOSE_ERRORS } from "./standalone/compose-errors.js";
 export const ERROR_REGISTRY = {
     ...COMPOSE_ERRORS,
+    INIT_UPSTREAM_INVALID: { code: "INIT_UPSTREAM_INVALID", description: "The upstream repository URL is invalid.", suggestion: "Supply --upstream with an HTTPS repository URL without credentials." },
+    INIT_PUBLISHER_INVALID: { code: "INIT_PUBLISHER_INVALID", description: "The attribution name or publisher URL is invalid.", suggestion: "Use plain single-line project/publisher names and an http(s) publisher URL without credentials." },
+    UPSTREAM_ATTRIBUTION: { code: "UPSTREAM_ATTRIBUTION", description: "Upstream App attribution is incomplete or names the distributor as maintainer.", suggestion: "Name the original project/team or owner as maintainer; set metadata.maintainer_url to the upstream repository and metadata.distributor/distributor_url to your publisher; resolve TODOs before release." },
     INSTALL_SETTINGS_INVALID: { "code": "INSTALL_SETTINGS_INVALID", "description": "The installation setting declaration is invalid.", "suggestion": "Declare 1–32 lowercase identifier keys in install.settings, each with type https-origin, a plain label and an explicit boolean required; omit defaults and values." },
     SDK_INSTALL_SETTINGS_UNSUPPORTED: { "code": "SDK_INSTALL_SETTINGS_UNSUPPORTED", "description": "The selected SDK does not provide native installation settings.", "suggestion": "Pin SDK 0.24.0 or a matching supported release with installsettings/cmd/control, then rebuild with the matching CLI." },
     SDK_INSTALL_SETTINGS_BUILD_FAILED: { "code": "SDK_INSTALL_SETTINGS_BUILD_FAILED", "description": "The SDK installation settings controller could not be built.", "suggestion": "Install the pinned Go toolchain, inspect the compiler diagnostics and rebuild with a complete matching SDK release." },

package/dist/init-upstream.d.ts

@@ -1,6 +1,10 @@
 export interface ForkRecipeOptions {
     upstreamImage?: string;
     from?: string;
+    upstream?: string;
+    upstreamMaintainer?: string;
+    publisher?: string;
+    publisherUrl?: string;
 }
 export declare function validateForkRecipe(template: 'compose' | 'native-go', options: ForkRecipeOptions): void;
 /** CLI-owned packaging recipe; upstream files and history stay untouched. */

package/dist/init-upstream.js

@@ -3,8 +3,17 @@ import { join } from 'node:path';
 import { fileURLToPath } from 'node:url';
 import { parseDocument } from 'yaml';
 import { API_PERMISSIONS_FILE } from './standalone/api-permissions.js';
+import { safeMetadataUrl, upstreamMetadata } from './package-metadata.js';
 import { parseImageReference } from './images/pin.js';
 export function validateForkRecipe(template, options) {
+    if (options.upstream && (!safeMetadataUrl(options.upstream) || !options.upstream.startsWith("https:")))
+        throw new Error('[INIT_UPSTREAM_INVALID] Supply an HTTPS upstream repository URL without credentials.');
+    if (options.publisherUrl && !safeMetadataUrl(options.publisherUrl))
+        throw new Error('[INIT_PUBLISHER_INVALID] Supply an http(s) publisher URL without credentials.');
+    for (const value of [options.publisher, options.upstreamMaintainer]) {
+        if (value !== undefined && (!value.trim() || /[\x00-\x1f\x7f"\\]/.test(value) || value.length > 80))
+            throw new Error('[INIT_PUBLISHER_INVALID] Attribution names must be plain, non-empty single-line text of at most 80 characters.');
+    }
     if (template === 'native-go' && options.upstreamImage)
         throw new Error('[INIT_OPTIONS_UNSUPPORTED] Native forks stage official release binaries or use a source build hook; image options apply only to compose.');
     if (template !== 'compose')
@@ -28,6 +37,14 @@ export function writeForkScaffold(packaging, template, options) {
         ? { kind: 'official-image', repository: options.upstreamImage, service, imageTag: 'tag' }
         : { kind: 'native-source' };
     writeFileSync(join(packaging, 'upstream-recipe.json'), JSON.stringify(recipe, null, 2) + '\n');
+    doc.set('maintainer', options.upstreamMaintainer ?? 'TODO: original upstream project or owner');
+    doc.setIn(['metadata', 'distributor'], options.publisher ?? 'TODO: your publisher name');
+    if (options.upstream) {
+        doc.setIn(['metadata', 'upstream'], upstreamMetadata(options.upstream));
+        doc.setIn(['metadata', 'maintainer_url'], options.upstream);
+    }
+    if (options.publisherUrl)
+        doc.setIn(['metadata', 'distributor_url'], options.publisherUrl);
     doc.set('entry', 'admin-only');
     doc.delete('ctl');
     if (official) {
@@ -53,6 +70,8 @@ export function writeForkScaffold(packaging, template, options) {
     const guidance = `
 ## Integrating an existing open-source App
 
+If you package someone else's open-source project, set maintainer to the original project/owner (prefer the project's own team/org name, else the owner's display name, else login), metadata.maintainer_url to the upstream repo, and yourself as metadata.distributor/metadata.distributor_url. Resolve all attribution TODOs before release; run check and review its warnings. Only your own Apps use your publisher as maintainer.
+
 Keep the upstream fork/history and remote upstream. All wrapper-owned files belong in synology/; never edit upstream files or treat the App as an SDK component. Read synopkgland skill show upstream-fork.
 
 Leave ctl absent from the manifest by default. Ask whether the user wants AI control; add ctl only when explicitly requested. If requested, read synopkgland skill show ctl and produce ctl-plan covering existing UI actions and public API endpoints, including common reads and writes. Status-only commands do not meet completion. Wrap existing native APIs without changing upstream code or inventing features. Long operations must return through existing asynchronous APIs without waiting for completion; report synchronous-only long APIs as blockers for discussion.

package/dist/init.d.ts

@@ -18,6 +18,10 @@ export interface InitOptions {
     from?: string;
     upstreamFork?: boolean;
     upstreamImage?: string;
+    upstream?: string;
+    upstreamMaintainer?: string;
+    publisher?: string;
+    publisherUrl?: string;
     healthPath?: string;
     healthStatus?: number;
     /** native-go: `install.sharedFolder` (select from the NAS, or create one). key defaults to "shared", permission to "rw". */

package/dist/package-metadata.d.ts

@@ -1,5 +1,12 @@
 /** Plain text, or a map from a BCP-47 tag (en, zh-TW, ...) to plain text. */
 export type LocalizedText = string | Record<string, string>;
+export interface UpstreamMetadata {
+    name: string;
+    url: string;
+    license?: string;
+}
+/** Normalize the URL shorthand to the catalog's existing structured contract. */
+export declare function upstreamMetadata(raw: unknown): UpstreamMetadata;
 export interface PackageMetadata {
     long_description?: LocalizedText;
     changelog?: LocalizedText;
@@ -7,6 +14,7 @@ export interface PackageMetadata {
     support_email?: string;
     homepage?: string;
     source_url?: string;
+    upstream?: UpstreamMetadata;
     issues_url?: string;
     license?: string;
     maintainer_url?: string;

package/dist/package-metadata.js

@@ -1,3 +1,26 @@
+/** Normalize the URL shorthand to the catalog's existing structured contract. */
+export function upstreamMetadata(raw) {
+    const value = typeof raw === "string" ? { name: upstreamName(raw), url: raw } : raw;
+    if (!value || typeof value !== "object" || Array.isArray(value))
+        throw new Error("invalid upstream");
+    const v = value;
+    const text = (t) => typeof t === "string" && !!t.trim() && t.length <= 80 && !/[\x00-\x1f\x7f]/.test(t);
+    if (Object.keys(v).some(k => !["name", "url", "license"].includes(k)) ||
+        !text(v.name) || !safeMetadataUrl(v.url) || !v.url.startsWith("https:") ||
+        (v.license !== undefined && !text(v.license)))
+        throw new Error("invalid upstream");
+    return value;
+}
+function upstreamName(url) {
+    try {
+        const u = new URL(url);
+        const name = decodeURIComponent(u.pathname.split("/").filter(Boolean).at(-1) ?? u.hostname).replace(/\.git$/, "");
+        return name.trim() && name.length <= 80 && !/[\x00-\x1f\x7f]/.test(name) ? name : "TODO: original upstream project";
+    }
+    catch {
+        return "TODO: original upstream project";
+    }
+}
 export function safeMetadataUrl(value, mail = false) {
     if (typeof value !== "string" || value.length > 2048)
         return false;
@@ -27,6 +50,7 @@ export function validateMetadata(raw) {
         "support_email",
         "homepage",
         "source_url",
+        "upstream",
         "issues_url",
         "license",
         "maintainer_url",
@@ -39,6 +63,10 @@ export function validateMetadata(raw) {
     for (const [k, v] of Object.entries(raw)) {
         if (!allowed.includes(k))
             throw new Error("unknown metadata");
+        if (k === "upstream") {
+            upstreamMetadata(v);
+            continue;
+        }
         if (k === "screenshots") {
             if (!Array.isArray(v) ||
                 v.length > MAX_SCREENSHOTS ||
@@ -66,6 +94,7 @@ export function validateMetadata(raw) {
         if ([
             "homepage",
             "source_url",
+            "upstream",
             "issues_url",
             "maintainer_url",
             "distributor_url",
@@ -77,7 +106,7 @@ export function validateMetadata(raw) {
     }
     if (JSON.stringify(raw).length > 32000)
         throw new Error("metadata too large");
-    return raw;
+    return { ...raw, ...("upstream" in raw ? { upstream: upstreamMetadata(raw.upstream) } : {}) };
 }
 export function metadataInfoFields(metadata) {
     if (!metadata)

package/dist/upstream-attribution.d.ts

@@ -0,0 +1,7 @@
+import type { ValidationError } from './types.js';
+/** A repository URL is provenance, never a credential-bearing transport URL. */
+export declare function upstreamRepository(root: string, explicit?: string): string | undefined;
+/** Best effort, bounded and public: offline/rate-limited lookups retain an explicit TODO. */
+export declare function upstreamMaintainer(url?: string, fetcher?: typeof fetch): Promise<string | undefined>;
+/** Advice only: attribution never changes manifest validity or the command exit status. */
+export declare function upstreamAttributionWarnings(root: string): ValidationError[];

package/dist/upstream-attribution.js

@@ -0,0 +1,57 @@
+import { existsSync, readFileSync } from 'node:fs';
+import { basename, join } from 'node:path';
+import { spawnSync } from 'node:child_process';
+import { parse } from 'yaml';
+import { safeMetadataUrl } from './package-metadata.js';
+/** A repository URL is provenance, never a credential-bearing transport URL. */
+export function upstreamRepository(root, explicit) {
+    const raw = explicit ?? spawnSync('git', ['remote', 'get-url', 'upstream'], {
+        cwd: root, encoding: 'utf8', timeout: 1000,
+    }).stdout?.trim();
+    if (!raw)
+        return undefined;
+    const url = raw.replace(/^git@github\.com:/, 'https://github.com/').replace(/\.git$/, '');
+    return safeMetadataUrl(url) && url.startsWith("https:") ? url : undefined;
+}
+/** Best effort, bounded and public: offline/rate-limited lookups retain an explicit TODO. */
+export async function upstreamMaintainer(url, fetcher = fetch) {
+    if (!url)
+        return undefined;
+    const match = /^https:\/\/github\.com\/([\w-]+)\/[^/?#]+\/?$/.exec(url);
+    if (!match)
+        return undefined;
+    try {
+        const response = await fetcher(`https://api.github.com/users/${match[1]}`, {
+            headers: { Accept: 'application/vnd.github+json' }, signal: AbortSignal.timeout(3000),
+        });
+        if (!response.ok)
+            return undefined;
+        const owner = await response.json();
+        const name = typeof owner.name === 'string' && owner.name.trim() ? owner.name.trim() : owner.login;
+        return typeof name === 'string' && name.length <= 80 && !/[\x00-\x1f\x7f"\\]/.test(name) ? name : undefined;
+    }
+    catch {
+        return undefined;
+    }
+}
+/** Advice only: attribution never changes manifest validity or the command exit status. */
+export function upstreamAttributionWarnings(root) {
+    const raw = parse(readFileSync(join(root, 'dsm-package.yaml'), 'utf8'));
+    const m = raw?.metadata ?? {};
+    const fork = existsSync(join(root, 'upstream-recipe.json')) ||
+        (basename(root) === 'synology' && existsSync(join(root, 'upgrade.sh')));
+    if (!m.upstream && !fork)
+        return [];
+    const todo = (v) => typeof v !== 'string' || !v.trim() || /^TODO\b/i.test(v.trim());
+    if (!todo(raw.maintainer) && !todo(m.distributor) &&
+        raw.maintainer.trim().toLowerCase() !== m.distributor.trim().toLowerCase() &&
+        !todo(m.maintainer_url) && !todo(m.distributor_url) &&
+        !(typeof m.upstream === "object" && m.upstream && todo(m.upstream.name)))
+        return [];
+    return [{
+            code: 'UPSTREAM_ATTRIBUTION', severity: 'warning',
+            span: { file: 'dsm-package.yaml', line: 1, column: 1 },
+            message: 'Upstream App attribution is incomplete or names the distributor as maintainer',
+            suggestion: "Set maintainer to the original project/team, else the owner's display name or login; set metadata.maintainer_url to the upstream repository and metadata.distributor/distributor_url to your publisher. Resolve attribution TODOs before release",
+        }];
+}

package/dist/validate.js

@@ -1,3 +1,4 @@
+import { upstreamAttributionWarnings } from './upstream-attribution.js';
 import { existsSync } from "node:fs";
 import { join } from "node:path";
 import { getErrorCode } from "./error-registry.js";
@@ -36,6 +37,6 @@ export function validateProject(project, _options = {}) {
                     "Correct the schema-2 declaration; see the SDK Compose support matrix.",
             })),
         }
-        : { ok: true, errors: [] };
+        : { ok: true, errors: [], warnings: upstreamAttributionWarnings(project.root) };
 }
 export { findProjectRoot } from "./discovery.js";

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@synopackageland/cli",
-  "version": "0.31.0",
+  "version": "0.32.1",
   "description": "Syno Package Land Developer Kit CLI",
   "type": "module",
   "bin": {

package/schema/package-metadata.schema.json

@@ -96,6 +96,40 @@
         "pattern": "^https://",
         "maxLength": 2048
       }
+    },
+    "upstream": {
+      "oneOf": [
+        {
+          "type": "string",
+          "maxLength": 2048,
+          "pattern": "^https://"
+        },
+        {
+          "type": "object",
+          "additionalProperties": false,
+          "required": [
+            "name",
+            "url"
+          ],
+          "properties": {
+            "name": {
+              "type": "string",
+              "minLength": 1,
+              "maxLength": 80
+            },
+            "url": {
+              "type": "string",
+              "maxLength": 2048,
+              "pattern": "^https://"
+            },
+            "license": {
+              "type": "string",
+              "minLength": 1,
+              "maxLength": 80
+            }
+          }
+        }
+      ]
     }
   }
 }

package/schema/synology-app.schema.json

@@ -188,6 +188,40 @@
       "type": "object",
       "additionalProperties": false,
       "properties": {
+        "upstream": {
+          "oneOf": [
+            {
+              "type": "string",
+              "maxLength": 2048,
+              "pattern": "^https://"
+            },
+            {
+              "type": "object",
+              "additionalProperties": false,
+              "required": [
+                "name",
+                "url"
+              ],
+              "properties": {
+                "name": {
+                  "type": "string",
+                  "minLength": 1,
+                  "maxLength": 80
+                },
+                "url": {
+                  "type": "string",
+                  "maxLength": 2048,
+                  "pattern": "^https://"
+                },
+                "license": {
+                  "type": "string",
+                  "minLength": 1,
+                  "maxLength": 80
+                }
+              }
+            }
+          ]
+        },
         "changelog": {
           "oneOf": [
             {

package/skills/SKILL.md

@@ -5,7 +5,7 @@ description: Initialize, extend, check, build, inspect, and deploy Synology appl
 
 # Independent Synology SPKs
 
-CLI 0.27.x installs templates through `~0.27.0`. A templates patch needs only a
+CLI 0.32.1 installs templates through `~0.31.0`. A templates patch needs only a
 templates release; npm install/update selects a patch in that minor line. The CLI
 uses the locally installed templates and reads their SDK pin for defaults; it
 never downloads templates at runtime. Preserve the lockfile and use `npm ci` for
@@ -22,6 +22,14 @@ Use this guide to initialize, build and inspect own applications or upstream OSS
 
 For an existing open-source App, first read [reference/upstream-fork.md](reference/upstream-fork.md): upstream fork/history + untouched upstream files + all packaging in `synology/`, official container images pinned by tag/index digest, native official release binaries pinned by SHA-256 or a source build hook, and a single tag-merge upgrade command. Use `init --upstream-fork`; never rewrite the App as a component. Integrated upstream Apps require direct DSM administrator entry without a separate App password or an OIDC/SSO server: supported trusted headers first, disabling native login second; the shipped OpenList pattern uses the existing SDK 0.17.3 token adapter (`mode: token`, `access: dsm-admins`, `entry: admin-only`) with server-side Authorization injection. All DSM admins share one upstream admin; token reset requires package restart; WebDAV retains its native credentials.
 
+**If you package someone else's open-source project, set `maintainer` to the
+original project/owner (prefer the project's own team/org name, else the owner's
+display name, else login), `metadata.maintainer_url` to the upstream repository,
+and yourself as `metadata.distributor` / `metadata.distributor_url`.** Only your
+own Apps use your publisher as maintainer. Pass upstream and publisher attribution
+to `init --upstream-fork`; resolve TODOs and review `check` warnings before release.
+See the scaffold steps and release checklist in [reference/upstream-fork.md](reference/upstream-fork.md).
+
 For upstream OSS packaging, leave `ctl` absent from the manifest by default. Ask whether the user wants AI control; implement it only when explicitly requested. Read [reference/ctl.md](reference/ctl.md) for the required `ctl-plan`, UI/API coverage checklist and asynchronous-operation rules. Own Apps retain the native template's ctl defaults, with commands covering their main features; status-only coverage is incomplete.
 
 Start with `synopkgland init -t native-go`, `synopkgland init -t binary`, or `synopkgland init -t compose`. Read reference/create.md or reference/wrap.md, then reference/deploy.md. Native CGI session checks belong to the package. For wrapping upstream OSS with DSM accounts, read [reference/identity-gateway.md](reference/identity-gateway.md) first. For all Compose work, read [reference/compose.md](reference/compose.md): schema-2 upstream files, generated override, SDK planner, fixed package identity and current DSM blockers. Containers do not inherit a signed-in user's File Station ACL. Existing Shared Folder mounts are blocked until official protected ACL/project control is verified.

package/skills/reference/compose.md

@@ -247,7 +247,7 @@ declared availability readiness, LAN isolation/egress, protected grant lifecycle
 ACLs, two-user visibility and clean install/upgrade/reboot/stop/uninstall before
 calling the package supported on a NAS. No NAS is accessed by the build gate.
 
-The unified Compose contract uses SDK 0.27.x with CLI 0.27.x and locally installed templates from `~0.27.0`. Templates patches can ship independently; npm install/update resolves them, and SDK defaults come from the installed templates. SDK minor upgrades do not require a CLI release when they declare supported executor manifest format 1; the resolved SDK owns the release mapping and verified payload digests. The CLI does not fetch templates at runtime. The legacy packaging route and bridge publish mode are removed.
+The unified Compose contract uses SDK defaults from locally installed templates `~0.31.0` with CLI 0.32.1. Templates patches can ship independently; npm install/update resolves them, and SDK defaults come from the installed templates. SDK minor upgrades do not require a CLI release when they declare supported executor manifest format 1; the resolved SDK owns the release mapping and verified payload digests. The CLI does not fetch templates at runtime. The legacy packaging route and bridge publish mode are removed.
 
 Primary override files, and each included override set, must share a directory. Cross-directory override bases are rejected before loader I/O. Included implicit .env files are confined, inventoried and preserved; symlinks are rejected.
 

package/skills/reference/upstream-fork.md

@@ -11,6 +11,31 @@ under `synology/`, such as DSM install wizards and gateway pages; leave upstream
 UI/locale strings and release notes unchanged, and exclude upstream source from
 any future punctuation checker.
 
+## Maintainer and distributor
+
+If you package someone else's open-source project, set `maintainer` to the original
+project/owner (prefer the project's own team/org name, else the owner's display
+name, else login), `metadata.maintainer_url` to the upstream repository, and
+**yourself** as `metadata.distributor` / `metadata.distributor_url`. Only your own
+Apps use your publisher as maintainer. Syno Package Land is the distributor only
+when it distributes the App; this rule applies to every third-party developer.
+
+Pass `--upstream <repo-url>` (or retain the `upstream` Git remote), your verified
+`--upstream-maintainer <project-team>` when known, and `--publisher <name>` /
+`--publisher-url <url>` to `init --upstream-fork`. Publisher defaults come from
+`SYNOPKGLAND_PUBLISHER` / `SYNOPKGLAND_PUBLISHER_URL`. The CLI tries the public
+GitHub owner profile with a bounded lookup, using its display name then login.
+Offline or unsupported hosts leave an explicit maintainer TODO. Missing publisher
+configuration leaves a distributor TODO. Resolve these manually before release.
+`metadata.upstream: {name, url}` records the original project name and HTTPS repository;
+URL shorthand is normalized to that object in SPK metadata; `check` warns, without failing, for
+missing attribution or a maintainer that equals the distributor. The fork layout
+also enables this warning without `metadata.upstream`.
+
+These metadata fields become standard SPK INFO fields; upstream source stays
+unchanged. Catalog attribution may change before rebuilding; installed INFO
+changes only after an SPK upgrade.
+
 ## Decide whether to expose AI control
 
 Ask whether the user needs AI control unless they have already explicitly requested it.
@@ -37,11 +62,12 @@ git clone <your-fork-url> app
 cd app
 git remote add upstream <upstream-url>
 synopkgland init -t compose --upstream-fork --package MyApp \
-  --upstream-image owner/app --health-path /actual-readiness --health-status 200 .
+  --upstream https://github.com/owner/app --publisher "Your team" \
+  --publisher-url https://example.com --upstream-image owner/app --health-path /actual-readiness --health-status 200 .
 ```
 
 Replace `owner/app` with the verified official repository. `init` does not guess
-its publisher or make network requests. Configure `synology/upstream-recipe.json`:
+the official image publisher. Only attribution uses a best-effort GitHub profile lookup. Configure `synology/upstream-recipe.json`:
 `repository`, the actual Compose `service`, and `imageTag: tag` (exact upstream
 tag) or `version` (strip the leading `v` only if the official image uses that
 spelling). Adjust the App's port, storage and DSM login adapter before committing.
@@ -78,7 +104,9 @@ workaround with the framework ownership mechanism once available and verified.
 ## Native: official release binaries or a source build hook
 
 ```sh
-synopkgland init -t native-go --ui plain --upstream-fork --package MyApp .
+synopkgland init -t native-go --ui plain --upstream-fork --package MyApp \
+  --upstream https://github.com/owner/app --publisher "Your team" \
+  --publisher-url https://example.com .
 ```
 
 Native Apps can stage official release binaries pinned by **SHA-256**, or compile
@@ -180,3 +208,11 @@ returns 503 even when the gateway is down. Availability is not identity attestat
 Declare only Container Manager-capable `arches`/INFO platforms; exclude unsupported
 NAS architectures and review models in each family. Actual missing-package wizard
 behavior and DSM's dependency not-ready behavior remain device acceptance items.
+
+## Release checklist
+
+- Verify the original project/team or owner is the maintainer, its repository is
+  `metadata.maintainer_url` / `metadata.upstream`, and your publisher is the distributor
+- Resolve attribution TODOs and review all `check --json` warnings
+- Inspect the built SPK INFO attribution, preserve notices/source correspondence,
+  and verify the selected upstream release before publishing