@synopackageland/cli 0.32.0 → 0.33.0

package/dist/ctl/transfers.d.ts

@@ -1,3 +1,4 @@
+import { type HostTls } from './tls.js';
 import { type DsmSession } from './transport.js';
 export declare function localFile(file: unknown): {
     file: string;
@@ -11,4 +12,5 @@ export declare function transferRequest(session: DsmSession, path: string, metho
     };
     ca?: string;
     timeoutMs?: number;
+    trust?: HostTls;
 }): Promise<any>;

package/dist/ctl/transfers.js

@@ -1,3 +1,4 @@
+import { pinnedAgent, networkError, timeoutError } from './tls.js';
 import { createReadStream, statSync } from 'node:fs';
 import http from 'node:http';
 import https from 'node:https';
@@ -26,7 +27,7 @@ export async function transferRequest(session, path, method, params, options = {
     const raw = file ? undefined : Buffer.from(JSON.stringify({ method, params }));
     return new Promise((resolve, reject) => {
         const headers = { 'content-type': file ? 'application/octet-stream' : 'application/json', cookie: session.cookie, 'X-SYNO-TOKEN': session.token, origin: session.origin, 'content-length': String(file?.size ?? raw.length) };
-        const req = (url.protocol === 'https:' ? https : http).request(url, { method: 'POST', headers, timeout: options.timeoutMs ?? CTL_TIMEOUT_MS, ...(options.ca ? { ca: options.ca } : {}) }, res => {
+        const req = (url.protocol === 'https:' ? https : http).request(url, { method: 'POST', headers, timeout: options.timeoutMs ?? CTL_TIMEOUT_MS, ...(options.ca ? { ca: options.ca } : {}), ...(url.protocol === 'https:' && options.trust?.fingerprint ? { agent: pinnedAgent(session.origin, options.trust, options.timeoutMs ?? CTL_TIMEOUT_MS) } : {}) }, res => {
             const expected = file ? 'application/json' : 'application/x-ndjson';
             if (res.statusCode !== 200 || !res.headers['content-type']?.includes(expected)) {
                 res.resume();
@@ -61,10 +62,10 @@ export async function transferRequest(session, path, method, params, options = {
                 reject(new CtlError('CTL_TRANSFER_FAILED', 'Invalid or failed transfer response.', 'Inspect the App result; do not retry writes blindly.', 5));
             } });
         });
-        const wallTimer = setTimeout(() => req.destroy(), options.timeoutMs ?? CTL_TIMEOUT_MS);
+        const wallTimer = setTimeout(() => req.destroy(timeoutError()), options.timeoutMs ?? CTL_TIMEOUT_MS);
         req.once('close', () => clearTimeout(wallTimer));
-        req.on('timeout', () => req.destroy());
-        req.on('error', () => reject(new CtlError('CTL_NETWORK', 'Transfer interrupted; completion may be uncertain.', 'Check App state before retrying.', 6)));
+        req.on('timeout', () => req.destroy(timeoutError()));
+        req.on('error', e => reject(networkError(e)));
         if (file) {
             const source = createReadStream(file.file);
             source.on('error', () => req.destroy());

package/dist/ctl/transport.d.ts

@@ -1,3 +1,4 @@
+import { type HostTls } from './tls.js';
 export declare const CTL_TIMEOUT_MS = 62000;
 export declare const APP_COOKIE: unique symbol;
 export interface DsmSession {
@@ -9,4 +10,5 @@ export interface DsmSession {
 }
 export type JsonRequest = (path: string, body: URLSearchParams | Record<string, unknown>, session?: DsmSession) => Promise<any>;
 export declare function canonicalOrigin(input: string, tunnel?: boolean): string;
-export declare function createRequest(origin: string, timeoutMs?: number | (() => number), ca?: string): JsonRequest;
+export declare function createRequest(origin: string, timeoutMs?: number | (() => number), ca?: string, trust?: HostTls): JsonRequest;
+export declare function sessionFetch(url: string, init: RequestInit, session: DsmSession, ca?: string, trust?: HostTls): Promise<Response>;

package/dist/ctl/transport.js

@@ -1,3 +1,4 @@
+import { pinnedAgent, networkError, timeoutError } from './tls.js';
 import { strictJson } from './json.js';
 import http from 'node:http';
 import https from 'node:https';
@@ -10,13 +11,13 @@ export function canonicalOrigin(input, tunnel = false) {
         url = new URL(input);
     }
     catch {
-        throw new CtlError('CTL_URL_INVALID', 'A NAS origin URL is required.', 'run: synopkgland ctl host add <name> --url https://<nas>:5001');
+        throw new CtlError('CTL_URL_INVALID', 'A NAS origin URL is required.', 'run: synopkgland host add <name> --url https://<nas>:5001');
     }
     if (url.username || url.password || url.search || url.hash || url.pathname !== '/' || !(url.protocol === 'https:' || (tunnel && url.protocol === 'http:' && ['127.0.0.1', '[::1]'].includes(url.hostname))))
-        throw new CtlError('CTL_URL_INVALID', 'Use HTTPS, or explicit --ssh-tunnel for a loopback HTTP tunnel.', 'run: synopkgland ctl host add <name> --url https://<nas>:5001');
+        throw new CtlError('CTL_URL_INVALID', 'Use HTTPS, or explicit --ssh-tunnel for a loopback HTTP tunnel.', 'run: synopkgland host add <name> --url https://<nas>:5001');
     return url.origin;
 }
-export function createRequest(origin, timeoutMs = CTL_TIMEOUT_MS, ca) {
+export function createRequest(origin, timeoutMs = CTL_TIMEOUT_MS, ca, trust) {
     return async (path, body, session) => {
         if (!path.startsWith('/') || path.startsWith('//') || path.includes('?') || path.includes('#') || path.includes('\\') || path.includes('%') || path.split('/').some(p => p === '.' || p === '..'))
             throw new CtlError('CTL_PATH_INVALID', 'Unsafe request path.', 'run: synopkgland ctl list --refresh');
@@ -25,7 +26,7 @@ export function createRequest(origin, timeoutMs = CTL_TIMEOUT_MS, ca) {
             throw new CtlError('CTL_NETWORK', 'Request budget exhausted before dispatch.', 'Check App state before retrying writes.', 6);
         const url = new URL(path, origin);
         if (url.origin !== origin || (session && session.origin !== origin))
-            throw new CtlError('CTL_ORIGIN_MISMATCH', 'Credentials cannot cross NAS origins.', 'run: synopkgland ctl host list', 4);
+            throw new CtlError('CTL_ORIGIN_MISMATCH', 'Credentials cannot cross NAS origins.', 'run: synopkgland host list', 4);
         const form = body instanceof URLSearchParams;
         const payload = Buffer.from(form ? body.toString() : JSON.stringify(body));
         if (payload.length > 1048576)
@@ -36,7 +37,7 @@ export function createRequest(origin, timeoutMs = CTL_TIMEOUT_MS, ca) {
                 headers.cookie = session.cookie;
                 headers['X-SYNO-TOKEN'] = session.token;
             }
-            const req = (url.protocol === 'https:' ? https : http).request(url, { method: 'POST', headers, timeout: remaining, ...(ca ? { ca } : {}) }, res => {
+            const req = (url.protocol === 'https:' ? https : http).request(url, { method: 'POST', headers, timeout: remaining, ...(ca ? { ca } : {}), ...(url.protocol === 'https:' && trust?.fingerprint ? { agent: pinnedAgent(origin, trust, remaining) } : {}) }, res => {
                 if (!res.statusCode || res.statusCode < 200 || res.statusCode >= 300) {
                     res.resume();
                     reject(new CtlError('CTL_HTTP_ERROR', `HTTP ${res.statusCode}; redirects are never followed.`, 'Check the NAS URL and connection.', 6));
@@ -73,11 +74,40 @@ export function createRequest(origin, timeoutMs = CTL_TIMEOUT_MS, ca) {
                     }
                 });
             });
-            const wallTimer = setTimeout(() => req.destroy(), remaining);
+            const wallTimer = setTimeout(() => req.destroy(timeoutError()), remaining);
             req.once('close', () => clearTimeout(wallTimer));
-            req.on('timeout', () => req.destroy());
-            req.on('error', () => reject(new CtlError('CTL_NETWORK', 'NAS request failed or timed out.', 'Check the NAS connection and trusted CA; requests are not replayed.', 6)));
+            req.on('timeout', () => req.destroy(timeoutError()));
+            req.on('error', error => reject(networkError(error)));
             req.end(payload);
         });
     };
 }
+export async function sessionFetch(url, init, session, ca, trust) {
+    if (new URL(url).origin !== session.origin)
+        throw new CtlError('CTL_ORIGIN_MISMATCH', 'Credentials cannot cross NAS origins', 'Check the registered NAS origin', 4);
+    const headers = new Headers(init.headers);
+    headers.set('cookie', session.cookie);
+    headers.set('X-SYNO-TOKEN', session.token);
+    const request = new Request(url, { ...init, headers }), bytes = init.body ? Buffer.from(await request.arrayBuffer()) : undefined;
+    return new Promise((resolve, reject) => {
+        const target = new URL(url);
+        const req = (target.protocol === 'https:' ? https : http).request(target, { method: request.method, headers: Object.fromEntries(request.headers), ca, timeout: 62000, ...(trust?.fingerprint && target.protocol === 'https:' ? { agent: pinnedAgent(target.origin, trust, 62000) } : {}) }, res => {
+            const chunks = [];
+            let length = 0;
+            res.on('data', c => { length += c.length; if (length > 16 * 1024 * 1024)
+                res.destroy(new CtlError('CTL_RESPONSE_TOO_LARGE', 'DSM response exceeds 16 MiB', 'Use a narrower operation', 5));
+            else
+                chunks.push(c); });
+            res.on('error', () => reject(new CtlError('DSM_NETWORK', 'DSM response interrupted', 'Check the NAS connection', 6)));
+            res.on('end', () => { const headers = new Headers(); for (const [k, v] of Object.entries(res.headers))
+                for (const x of Array.isArray(v) ? v : [v])
+                    if (x !== undefined)
+                        headers.append(k, x); resolve(new Response(Buffer.concat(chunks), { status: res.statusCode, headers })); });
+        });
+        const timer = setTimeout(() => req.destroy(timeoutError()), 62000);
+        req.once('close', () => clearTimeout(timer));
+        req.on('timeout', () => req.destroy(timeoutError()));
+        req.on('error', e => reject(networkError(e)));
+        req.end(bytes);
+    });
+}

package/dist/error-registry.js

@@ -1,7 +1,15 @@
 import { COMPOSE_ERRORS } from "./standalone/compose-errors.js";
 export const ERROR_REGISTRY = {
     ...COMPOSE_ERRORS,
-    INIT_UPSTREAM_INVALID: { code: "INIT_UPSTREAM_INVALID", description: "The upstream repository URL is invalid.", suggestion: "Supply --upstream with an http(s) repository URL without credentials." },
+    HOST_CERT_CHANGED: { "code": "HOST_CERT_CHANGED", "description": "The NAS certificate differs from its pinned SHA-256", "suggestion": "Verify old/new fingerprints, then run synopkgland host trust <name>" },
+    HOST_TLS_UNTRUSTED: { "code": "HOST_TLS_UNTRUSTED", "description": "The NAS TLS certificate is not trusted", "suggestion": "Use host login for first-use pinning, a trusted --ca file, or an expected --fingerprint" },
+    HOST_DNS_FAILED: { "code": "HOST_DNS_FAILED", "description": "The NAS hostname could not be resolved", "suggestion": "Check the registered hostname and DNS" },
+    HOST_CONNECTION_REFUSED: { "code": "HOST_CONNECTION_REFUSED", "description": "The NAS refused the connection", "suggestion": "Check the DSM port and NAS availability" },
+    HOST_TIMEOUT: { "code": "HOST_TIMEOUT", "description": "The NAS request timed out", "suggestion": "Check connection and firewall; inspect state before retrying writes" },
+    CTL_HOST_REQUIRED: { "code": "CTL_HOST_REQUIRED", "description": "Select a registered NAS host", "suggestion": "Run synopkgland host add, select --host, or set host default" },
+    CTL_NOT_AUTHENTICATED: { "code": "CTL_NOT_AUTHENTICATED", "description": "The DSM session is absent or expired", "suggestion": "Run synopkgland host login <name>" },
+    NAS_ADMIN_REQUIRED: { "code": "NAS_ADMIN_REQUIRED", "description": "Package installation and removal require an administrator", "suggestion": "Register and log in with a DSM administrator account" },
+    INIT_UPSTREAM_INVALID: { code: "INIT_UPSTREAM_INVALID", description: "The upstream repository URL is invalid.", suggestion: "Supply --upstream with an HTTPS repository URL without credentials." },
     INIT_PUBLISHER_INVALID: { code: "INIT_PUBLISHER_INVALID", description: "The attribution name or publisher URL is invalid.", suggestion: "Use plain single-line project/publisher names and an http(s) publisher URL without credentials." },
     UPSTREAM_ATTRIBUTION: { code: "UPSTREAM_ATTRIBUTION", description: "Upstream App attribution is incomplete or names the distributor as maintainer.", suggestion: "Name the original project/team or owner as maintainer; set metadata.maintainer_url to the upstream repository and metadata.distributor/distributor_url to your publisher; resolve TODOs before release." },
     INSTALL_SETTINGS_INVALID: { "code": "INSTALL_SETTINGS_INVALID", "description": "The installation setting declaration is invalid.", "suggestion": "Declare 1–32 lowercase identifier keys in install.settings, each with type https-origin, a plain label and an explicit boolean required; omit defaults and values." },
@@ -725,16 +733,6 @@ export const ERROR_REGISTRY = {
             description: "Writing a single file needs an architecture.",
             suggestion: "Combine -o with a single --arch, or use --out-dir.",
         },
-        HOST_REQUIRED: {
-            code: "HOST_REQUIRED",
-            description: "No NAS was specified.",
-            suggestion: "Use --host <profile>; for a local deploy check use --dry-run.",
-        },
-        NAS_CREDENTIALS_MISSING: {
-            code: "NAS_CREDENTIALS_MISSING",
-            description: "NAS credentials were not found.",
-            suggestion: "Set a synoagentcli profile or DSM_URL/DSM_PASSWORD.",
-        },
         NATIVE_LAYOUT_SCRIPT_NOT_EXECUTABLE: {
             code: "NATIVE_LAYOUT_SCRIPT_NOT_EXECUTABLE",
             description: "A scripts/ lifecycle script in the native layout metadata is not executable (inspect's SPK_SCRIPT_NOT_EXECUTABLE).",

package/dist/host/catalog-install.d.ts

@@ -10,15 +10,6 @@ interface CatalogPackageEntry {
     breakpkgs?: unknown;
     replacepkgs?: unknown;
 }
-export interface CatalogInstallOptions {
-    dsmOrigin: string;
-    cookieHeader: string;
-    packageId: string;
-    profileName?: string;
-    expectedVersion?: string;
-    packageSourceOrigin?: string;
-    extraValues?: Record<string, string>;
-}
 export interface InstalledPackageState {
     installed: boolean;
     version?: string;
@@ -75,5 +66,4 @@ export interface LocalSpkInstallOptions {
     extraValues?: Record<string, string>;
 }
 export declare function installPackageFromLocalSpk(options: LocalSpkInstallOptions): Promise<void>;
-export declare function installPackageFromCatalog(options: CatalogInstallOptions): Promise<void>;
 export {};

package/dist/host/catalog-install.js

@@ -1,5 +1,5 @@
+import { CtlError } from '../ctl/errors.js';
 import { readFileSync } from "node:fs";
-import { spawnSync } from "node:child_process";
 import { dsmFetch } from "./dsm-http.js";
 import { assertDsmCompoundResponse } from "./dsm-compound.js";
 function normalizeDeppkgs(deppkgs) {
@@ -31,81 +31,11 @@ async function dsmWebApi(dsmOrigin, cookieHeader, params, options = {}) {
     if (!body.success &&
         !options.allowFailure &&
         !(errorCode && options.allowErrorCodes?.includes(errorCode))) {
-        throw new Error(`DSM ${params.api}/${params.method} failed: ${JSON.stringify(body.error ?? body)}`);
+        throw new Error(`DSM ${params.api}/${params.method} failed: ${Number(body.error?.code) || "invalid response"}`);
     }
     return body;
 }
-async function fetchCatalogEntry(options) {
-    const sid = extractSid(options.cookieHeader);
-    const list = await dsmWebApi(options.dsmOrigin, options.cookieHeader, {
-        api: "SYNO.Core.Package.Server",
-        version: "2",
-        method: "list",
-        blforcereload: "true",
-        blloadothers: "true",
-        _sid: sid,
-    });
-    const data = list.data;
-    const entries = [...(data.packages ?? []), ...(data.beta_packages ?? [])];
-    const entry = entries.find((item) => item.package === options.packageId);
-    if (!entry) {
-        throw new Error(`Package ${options.packageId} not found in Package Source catalog`);
-    }
-    return entry;
-}
-async function fetchCatalogEntryFromOrigin(origin, packageId) {
-    const catalogUrl = `${origin.replace(/\/$/, "")}/?arch=noarch&build=69057&major=7`;
-    try {
-        const response = await dsmFetch(catalogUrl);
-        if (!response.ok) {
-            return undefined;
-        }
-        const data = (await response.json());
-        const entries = [...(data.packages ?? []), ...(data.beta_packages ?? [])];
-        return entries.find((item) => item.package === packageId);
-    }
-    catch {
-        return undefined;
-    }
-}
-async function waitForCatalogEntry(options, expectedVersion) {
-    const deadline = Date.now() + 5 * 60 * 1000;
-    let lastVersion;
-    while (Date.now() < deadline) {
-        const originEntry = options.packageSourceOrigin
-            ? await fetchCatalogEntryFromOrigin(options.packageSourceOrigin, options.packageId)
-            : undefined;
-        const entry = originEntry ?? await fetchCatalogEntry(options);
-        lastVersion = entry.version;
-        if (entry.version === expectedVersion) {
-            return entry;
-        }
-        await new Promise((resolve) => setTimeout(resolve, 5000));
-    }
-    throw new Error(`Package ${options.packageId} catalog shows ${lastVersion ?? "unknown"}; expected ${expectedVersion}`);
-}
-function readInstalledPackageState(packageId, profileName) {
-    const args = ["dsm", "package-center", "get", packageId];
-    if (profileName) {
-        args.push("--host", profileName);
-    }
-    const result = spawnSync("synoagentcli", args, { encoding: "utf8" });
-    if (result.status !== 0) {
-        return undefined;
-    }
-    try {
-        const parsed = JSON.parse(result.stdout);
-        return packageStateFromRecord(parsed.data);
-    }
-    catch {
-        return undefined;
-    }
-}
-function record(value) {
-    return value && typeof value === "object" && !Array.isArray(value)
-        ? value
-        : {};
-}
+function record(value) { return value && typeof value === 'object' && !Array.isArray(value) ? value : {}; }
 function stringValue(...values) {
     return values.find((value) => typeof value === "string" && value.length > 0);
 }
@@ -191,19 +121,17 @@ export async function fetchInstalledPackageState(dsmOrigin, cookieHeader, packag
         });
         return packageStateFromListPayload(body, packageId);
     }
-    catch {
+    catch (error) {
+        if (error instanceof CtlError)
+            throw error;
         return undefined;
     }
 }
-function isPackageInstalled(packageId, profileName) {
-    const state = readInstalledPackageState(packageId, profileName);
-    return state?.installed === true;
-}
 function installStatusIsBroken(status) {
     if (!status) {
         return false;
     }
-    return /(broken|error|fail|installing|150)/i.test(status);
+    return /(broken|error|fail|150)/i.test(status);
 }
 export async function waitForInstalledVersion(readState, options) {
     const deadline = Date.now() + (options.deadlineMs ?? 15 * 60 * 1000);
@@ -213,7 +141,7 @@ export async function waitForInstalledVersion(readState, options) {
         if (state?.installed && installStatusIsBroken(state.status)) {
             throw new Error(`Package ${options.packageId} install did not complete (Package Center status ${state.status}). Check synopkg postinst / webservice acquire.`);
         }
-        if (state?.installed) {
+        if (state?.installed && !/installing|upgrading/i.test(state.status ?? "")) {
             if (!options.expectedVersion || state.version === options.expectedVersion) {
                 return;
             }
@@ -262,14 +190,19 @@ export async function uninstallPackageFromDsm(options) {
     try {
         const sid = extractSid(options.cookieHeader);
         const readState = () => fetchInstalledPackageState(options.dsmOrigin, options.cookieHeader, options.packageId);
-        await dsmWebApi(options.dsmOrigin, options.cookieHeader, {
-            api: "SYNO.Core.Package.Control",
-            version: "1",
-            method: "stop",
-            id: jsonApiParam(options.packageId),
-            _sid: sid,
-        });
-        await waitForPackageStopped(readState, options);
+        const before = await readState();
+        if (!before)
+            throw new Error("Cannot verify package state before removal");
+        if (!packageStatusIsStopped(before)) {
+            await dsmWebApi(options.dsmOrigin, options.cookieHeader, {
+                api: "SYNO.Core.Package.Control",
+                version: "1",
+                method: "stop",
+                id: jsonApiParam(options.packageId),
+                _sid: sid,
+            });
+            await waitForPackageStopped(readState, options);
+        }
         await dsmWebApi(options.dsmOrigin, options.cookieHeader, {
             api: "SYNO.Core.Package.Uninstallation",
             version: "1",
@@ -379,14 +312,14 @@ async function uploadLocalSpk(options, sid) {
     });
     const body = (await uploadResponse.json());
     if (!body.success || !body.data?.id || !body.data.task_id) {
-        throw new Error(`DSM SYNO.Core.Package.Installation/upload failed: ${JSON.stringify(body.error ?? body)}`);
+        throw new Error(`DSM SYNO.Core.Package.Installation/upload failed: ${Number(body.error?.code) || "invalid response"}`);
     }
     return { id: body.data.id, taskId: body.data.task_id };
 }
 export async function installPackageFromLocalSpk(options) {
     const sid = extractSid(options.cookieHeader);
     const dsmState = await fetchInstalledPackageState(options.dsmOrigin, options.cookieHeader, options.packageId);
-    const installed = dsmState?.installed === true || isPackageInstalled(options.packageId, options.profileName);
+    const installed = dsmState?.installed === true;
     const uploaded = await uploadLocalSpk(options, sid);
     const compound = JSON.stringify(catalogCompoundSteps(uploaded, { version: options.version, size: readFileSync(options.spkPath).byteLength }, { blupgrade: installed, extraValues: options.extraValues }));
     const compoundResponse = await dsmWebApi(options.dsmOrigin, options.cookieHeader, {
@@ -399,54 +332,5 @@ export async function installPackageFromLocalSpk(options) {
         _sid: sid,
     }, { allowFailure: true });
     assertDsmCompoundResponse(compoundResponse);
-    await waitForInstalledVersion(async () => (await fetchInstalledPackageState(options.dsmOrigin, options.cookieHeader, options.packageId)) ??
-        readInstalledPackageState(options.packageId, options.profileName), { packageId: options.packageId, expectedVersion: options.version });
-}
-async function uploadCatalogSpk(options, entry, sid) {
-    const response = await dsmFetch(entry.link);
-    if (!response.ok) {
-        throw new Error(`Failed to download catalog SPK for ${entry.package}: HTTP ${response.status}`);
-    }
-    const bytes = Buffer.from(await response.arrayBuffer());
-    const form = new FormData();
-    form.append("api", "SYNO.Core.Package.Installation");
-    form.append("method", "upload");
-    form.append("version", "1");
-    form.append("_sid", sid);
-    form.append("file", new Blob([bytes]), `${entry.package}.spk`);
-    const uploadResponse = await dsmFetch(`${options.dsmOrigin}/webapi/entry.cgi`, {
-        method: "POST",
-        headers: { cookie: options.cookieHeader },
-        body: form,
-    });
-    const body = (await uploadResponse.json());
-    if (!body.success || !body.data?.id || !body.data.task_id) {
-        throw new Error(`DSM SYNO.Core.Package.Installation/upload failed: ${JSON.stringify(body.error ?? body)}`);
-    }
-    return { id: body.data.id, taskId: body.data.task_id };
-}
-async function installCatalogViaUpload(options, entry, sid, installed) {
-    const uploaded = await uploadCatalogSpk(options, entry, sid);
-    const compound = JSON.stringify(catalogCompoundSteps(uploaded, entry, { blupgrade: installed, extraValues: options.extraValues }));
-    const compoundResponse = await dsmWebApi(options.dsmOrigin, options.cookieHeader, {
-        api: "SYNO.Entry.Request",
-        version: "1",
-        method: "request",
-        stop_when_error: "true",
-        mode: jsonApiParam("sequential"),
-        compound,
-        _sid: sid,
-    }, { allowFailure: true });
-    assertDsmCompoundResponse(compoundResponse);
-}
-export async function installPackageFromCatalog(options) {
-    const entry = options.expectedVersion
-        ? await waitForCatalogEntry(options, options.expectedVersion)
-        : await fetchCatalogEntry(options);
-    const sid = extractSid(options.cookieHeader);
-    const dsmState = await fetchInstalledPackageState(options.dsmOrigin, options.cookieHeader, options.packageId);
-    const installed = dsmState?.installed === true || isPackageInstalled(options.packageId, options.profileName);
-    await installCatalogViaUpload(options, entry, sid, installed);
-    await waitForInstalledVersion(async () => (await fetchInstalledPackageState(options.dsmOrigin, options.cookieHeader, options.packageId)) ??
-        readInstalledPackageState(options.packageId, options.profileName), { packageId: options.packageId, expectedVersion: entry.version });
+    await waitForInstalledVersion(async () => await fetchInstalledPackageState(options.dsmOrigin, options.cookieHeader, options.packageId), { packageId: options.packageId, expectedVersion: options.version });
 }

package/dist/host/connection.d.ts

@@ -0,0 +1,9 @@
+import { type DsmSession, type JsonRequest } from "../ctl/transport.js";
+export interface NasConnection {
+    name: string;
+    session: DsmSession;
+    request: JsonRequest;
+    call: (api: string, method: string, version: number, params?: Record<string, string>) => Promise<any>;
+}
+export declare function connectNas(name?: string): Promise<NasConnection>;
+export declare function requireAdministrator(nas: NasConnection): Promise<void>;

package/dist/host/connection.js

@@ -0,0 +1,49 @@
+import { CtlError } from "../ctl/errors.js";
+import { createRequest, } from "../ctl/transport.js";
+import { resolveHostCredentials } from "./credentials.js";
+import { registerDsmSession } from "./dsm-http.js";
+export async function connectNas(name) {
+    const credentials = resolveHostCredentials(name);
+    const session = await credentials.loadSession();
+    registerDsmSession(session, credentials.hostName, credentials.ca, credentials.fingerprint);
+    const request = createRequest(session.origin, 62000, credentials.ca, {
+        fingerprint: credentials.fingerprint,
+        name: credentials.hostName,
+    });
+    return {
+        name: credentials.hostName,
+        session,
+        request,
+        call: async (api, method, version, params = {}) => {
+            const body = await request("/webapi/entry.cgi", new URLSearchParams({
+                api,
+                method,
+                version: String(version),
+                ...params,
+            }), session);
+            const code = Number(body?.error?.code);
+            if (body?.success !== true)
+                throw new CtlError([106, 107, 119].includes(code)
+                    ? "CTL_NOT_AUTHENTICATED"
+                    : code === 105
+                        ? "NAS_ADMIN_REQUIRED"
+                        : "DSM_API_FAILED", `DSM ${api}/${method} failed (${code || "invalid response"})`, [106, 107, 119].includes(code)
+                    ? `run: synopkgland host login ${credentials.hostName}`
+                    : code === 105
+                        ? "Log in with a DSM administrator account"
+                        : "Check DSM permissions and Package Center", 2);
+            return body.data;
+        },
+    };
+}
+export async function requireAdministrator(nas) {
+    const data = await nas.call("SYNO.Core.Group.Member", "list", 1, {
+        group: "administrators",
+        offset: "0",
+        limit: "-1",
+    });
+    const members = data?.users;
+    if (!Array.isArray(members) ||
+        !members.some((u) => u.name === nas.session.username))
+        throw new CtlError("NAS_ADMIN_REQUIRED", "Package installation and removal require a DSM administrator account", "Register and log in with a DSM administrator account", 4);
+}

package/dist/host/credentials.d.ts

@@ -1,2 +1,4 @@
+import { CtlStore } from "../ctl/store.js";
 import type { HostCredentials } from "./types.js";
-export declare function resolveHostCredentials(hostName?: string): HostCredentials | null;
+/** Host metadata is public; session carriers are loaded only from secure storage. */
+export declare function resolveHostCredentials(name?: string, store?: CtlStore): HostCredentials | null;

package/dist/host/credentials.js

@@ -1,67 +1,32 @@
 import { readFileSync } from "node:fs";
-import { homedir } from "node:os";
-import { join } from "node:path";
-function findProfile(settings, input) {
-    if (!input) {
-        return settings.hosts?.[settings.defaultHost ?? "default"];
-    }
-    // 1. Direct match by profile name
-    if (settings.hosts?.[input]) {
-        return settings.hosts[input];
-    }
-    // 2. Match by URL hostname or exact URL
-    for (const profile of Object.values(settings.hosts ?? {})) {
-        if (profile?.url) {
-            try {
-                const u = new URL(profile.url);
-                if (u.hostname === input ||
-                    profile.url === input ||
-                    profile.url.replace(/\/$/, "") === input.replace(/\/$/, "")) {
-                    return profile;
-                }
-            }
-            catch {
-                // ignore invalid URL
-            }
-        }
-    }
-    return undefined;
-}
-export function resolveHostCredentials(hostName) {
-    const settingsPath = join(homedir(), ".synoagentcli", "setting.json");
-    let settings;
-    try {
-        settings = JSON.parse(readFileSync(settingsPath, "utf8"));
-    }
-    catch {
-        return fromEnv(hostName);
-    }
-    const profile = findProfile(settings, hostName);
-    const username = profile?.username ?? profile?.auth?.username;
-    const password = profile?.password ?? profile?.auth?.password;
-    if (profile?.url && username && password) {
+import { CtlStore } from "../ctl/store.js";
+import { canonicalOrigin } from "../ctl/transport.js";
+import { loginDsm } from "../ctl/dsm-auth.js";
+/** Host metadata is public; session carriers are loaded only from secure storage. */
+export function resolveHostCredentials(name, store = new CtlStore()) {
+    if (!name &&
+        !store.list().length &&
+        process.env.DSM_URL &&
+        process.env.DSM_USERNAME &&
+        process.env.DSM_PASSWORD) {
+        const origin = canonicalOrigin(process.env.DSM_URL);
         return {
-            dsmOrigin: profile.url,
-            username,
-            password,
+            dsmOrigin: origin,
+            username: process.env.DSM_USERNAME,
+            hostName: "env",
+            loadSession: () => loginDsm(origin, process.env.DSM_USERNAME, process.env.DSM_PASSWORD, {
+                remember: false,
+                otp: async () => process.env.DSM_OTP ?? "",
+            }),
         };
     }
-    if (profile?.url) {
-        return fromEnv(profile.url);
-    }
-    return fromEnv(hostName);
-}
-function fromEnv(urlOverride) {
-    let dsmOrigin = process.env.DSM_URL;
-    if (urlOverride) {
-        dsmOrigin = urlOverride.startsWith("http://") || urlOverride.startsWith("https://")
-            ? urlOverride
-            : `https://${urlOverride}:5001`;
-    }
-    const password = process.env.DSM_PASSWORD;
-    const username = process.env.DSM_USERNAME ?? "admin";
-    if (!dsmOrigin || !password) {
-        return null;
-    }
-    return { dsmOrigin, username, password };
+    const host = store.select(name);
+    return {
+        dsmOrigin: host.origin,
+        username: host.username,
+        hostName: host.name,
+        fingerprint: host.fingerprint,
+        ca: host.ca ? readFileSync(host.ca, "utf8") : undefined,
+        loadSession: () => store.session(host),
+    };
 }

package/dist/host/dsm-client.d.ts

@@ -5,17 +5,15 @@ export interface CreateNasHostOptions {
     credentials?: HostCredentials;
 }
 export declare function createNasHost(options?: CreateNasHostOptions): NasHost | null;
-declare function synoagentcli(args: string[], profileName?: string): {
-    status: number | null;
-    stdout: string;
-    stderr: string;
-};
 /**
  * DSM's User Home read reports the selected volume, not the final share path.
  * Keep the projection strict: an unexpected response must not become a host
  * bind to an arbitrary path.
  */
-export declare function homesPathFromDsmUserHomeRead(result: Pick<ReturnType<typeof synoagentcli>, "status" | "stdout">): string | undefined;
+export declare function homesPathFromDsmUserHomeRead(result: {
+    status: number | null;
+    stdout: string;
+}): string | undefined;
 /**
  * DSM reports the CPU vendor, not the ISA. Every x86_64 platform Synology
  * ships is Intel or AMD; the aarch64 ones are Realtek (rtd1296, rtd1619b) and
@@ -26,4 +24,3 @@ export declare function homesPathFromDsmUserHomeRead(result: Pick<ReturnType<typ
  * unusable SPK.
  */
 export declare function archFamilyForCpuVendor(vendor: string | undefined): NativeArchFamily | undefined;
-export {};