@synopackageland/cli 0.32.1 → 0.33.1

package/CHANGELOG.md

@@ -1,9 +1,9 @@
 # Changelog
 
-## 0.32.1 (2026-10-27)
+## 0.33.1 (2026-10-27)
 
-- Attribute upstream Apps to their original project/team or owner and the packaging publisher as distributor, with generic skill guidance and a release checklist
-- Prefill upstream-fork attribution from the upstream repository and publisher options or environment configuration; use a bounded public GitHub owner lookup and explicit TODOs offline
-- Warn when upstream attribution is incomplete or the maintainer equals the distributor; warnings appear in check JSON and keep exit status successful
-- Keep templates 0.31.x and its SDK defaults; CLI minor releases can ship independently of templates
-- Write upstream provenance as the catalog-compatible `{name, url, license?}` object; normalize HTTPS URL shorthand when building SPKs
+- Use one NAS connection path for host login, secure session storage, TLS and every DSM request, including package commands, deployment, ctl transfers and e2e login helpers
+- Accept self-signed, untrusted CA, hostname-mismatched and expired NAS certificates by default
+- Record each leaf SHA-256 for display; warn once and update it when a certificate changes, then continue
+- Add opt-in --strict-tls for host profiles and individual commands; --ca also verifies CA trust, hostname, validity and recorded certificates
+- Keep passwords on the exact connection whose certificate was inspected, without changing global TLS settings

package/README.md

@@ -346,16 +346,26 @@ DSM readiness; inspect lists explicit acceptance blockers.
 
 ## Control installed Apps
 
-Use `synopkgland ctl host add nas --url https://nas.example:5001 --username alice`
+Use `synopkgland host add nas --url https://nas.example:5001 --username alice`
 to register and authenticate a NAS in OS secure storage. A bare host name uses
 `https://<host>:5001`; provide a full URL for a different scheme or port.
 The CLI loads only `DSM_*` and `SYNOPKGLAND_*` variables from `.env`; set other
-process variables in the shell. `ctl host list --json`
+process variables in the shell. `host list --json`
 checks sessions; `ctl list --host nas --json` discovers all approved task-level
 commands and their schemas. Run the listed alias/command with typed flags,
 `--help` and `--dry-run`; writes require `--yes`. There is no mutable current
 context. Use `--host a,b` or `--all-hosts` for bounded parallel operations.
 
+NAS HTTPS accepts self-signed, untrusted CA, wrong-name and expired certificates
+by default on every CLI path. The CLI records the leaf SHA-256 for display; a
+changed leaf warns once on stderr, updates that value and continues.
+`host add --strict-tls` stores verification in the profile. `--strict-tls` or
+`--ca <file>` on any NAS command opts into CA, hostname, validity and recorded
+certificate checks. Strict failures use `HOST_TLS_UNTRUSTED` or `HOST_CERT_CHANGED`;
+`host trust <name>` can explicitly update the recorded fingerprint. Passwords
+are sent only over a connection whose certificate was inspected. Public package
+feeds and SPK downloads retain normal HTTPS verification.
+
 `ctl` preserves these process exit codes, including with `--json`:
 
 | Exit code | Meaning and examples |
@@ -382,7 +392,7 @@ not become process exit codes 4 or 5. Attempting to execute an excluded App with
 `--refresh` instead returns `ok:false`, `CTL_APP_UNKNOWN` and exit 3 because the
 App is absent from discovery results; no business operation runs.
 
-`ctl host list/show` can also succeed while reporting `authenticated:false` and
+`host list/show` can also succeed while reporting `authenticated:false` and
 exit 0. Check discovery `apps`/`diagnostics` and session fields as well as the exit
 code when deciding whether an App is ready.
 `ctl --timeout <seconds>` applies to discovery, JSON calls, polling and transfer

package/dist/cli.js

@@ -1,3 +1,4 @@
+import { nasFlags, withNasOptions } from './nas/options.js';
 import { upstreamRepository, upstreamMaintainer } from './upstream-attribution.js';
 import { Command, CommanderError } from "commander";
 import { existsSync, readFileSync, renameSync, statSync } from "node:fs";
@@ -289,6 +290,15 @@ async function containerBuild(project, arches, options) {
 }
 /** Resolves after dispatch; commands may set process.exitCode. Rejections are failures. */
 export async function runCli(argv) {
+    const { args, options } = nasFlags(argv, argv[2] !== "ctl");
+    return withNasOptions(options, () => runCliWithin(args));
+}
+async function runCliWithin(argv) {
+    if (argv[2] === "host") {
+        const { runCtl } = await import("./ctl/cli.js");
+        await runCtl(["host", ...argv.slice(3)]);
+        return;
+    }
     if (argv[2] === "ctl") {
         const { runCtl } = await import("./ctl/cli.js");
         await runCtl(argv.slice(3));
@@ -302,16 +312,28 @@ export async function runCli(argv) {
         .name("synopkgland")
         .description("Syno Package Land Developer Kit CLI")
         .option("--project <dir>", "App project root")
+        .option("--strict-tls", "Verify NAS CA, hostname, validity and recorded certificate")
+        .option("--ca <file>", "Verify NAS HTTPS with a PEM CA file")
         .exitOverride();
     const rootOf = (command) => resolve(process.cwd(), command.parent?.opts().project ?? ".");
-    const hostOf = (host) => {
-        if (!host)
-            throw failure("HOST_REQUIRED", "--host is required.", "Set a synoagentcli profile, then use --host <name>.");
-        const nas = createNasHost({ host });
-        if (!nas)
-            throw failure("NAS_CREDENTIALS_MISSING", "NAS credentials were not found.", "Set a synoagentcli profile or DSM_URL/DSM_PASSWORD.");
-        return nas;
-    };
+    const hostOf = (host) => createNasHost({ host });
+    program.command("host").description("Shared NAS login and host management (host --help)");
+    program.command("install <package-or-spk>")
+        .description("Install a store package or a local SPK")
+        .option("--host <name>", "Registered NAS host")
+        .option("--source <url>", "HTTPS package source")
+        .option("--param <NAME=value>", "Install wizard value", (v, p) => collectKv(v, p, "--param"))
+        .option("--yes", "Confirm installation")
+        .option("--dry-run", "Print the installation plan without writing to DSM")
+        .option("--json", "Print a single JSON object")
+        .action(async (spec, options) => { const { installPackage } = await import('./host/package-commands.js'); const result = await installPackage(spec, options); emit('install', result, JSON.stringify(result, null, 2)); });
+    program.command("uninstall <package-id>")
+        .description("Remove an installed package")
+        .option("--host <name>", "Registered NAS host")
+        .option("--yes", "Confirm removal")
+        .option("--dry-run", "Print the removal plan without writing to DSM")
+        .option("--json", "Print a single JSON object")
+        .action(async (id, options) => { const { uninstallPackage } = await import('./host/package-commands.js'); const result = await uninstallPackage(id, options); emit('uninstall', result, JSON.stringify(result, null, 2)); });
     program.command("ctl").description("Control registered NAS Apps using described AI commands (ctl --help)");
     program
         .command("check")
@@ -608,12 +630,18 @@ export async function runCli(argv) {
         emit("deploy", result, `Deployed ${result.packageId}${result.openUrl ? "\nOpen URL: " + result.openUrl : ""}`);
     });
     program
-        .command("status")
+        .command("status [package-id]")
         .description("DSM package status, Open URL and capability readiness")
         .option("--json", "Print a single JSON object")
         .option("--host <name>", "NAS profile")
         .option("--dev", "Development Package Identity")
-        .action(async (options, command) => {
+        .action(async (id, options, command) => {
+        if (id) {
+            const { packageStatus } = await import('./host/package-commands.js');
+            const result = await packageStatus(id, options.host);
+            emit('status', result, JSON.stringify(result, null, 2));
+            return;
+        }
         const host = hostOf(options.host);
         const root = rootOf(command);
         const standalone = standaloneRoot(root);
@@ -629,7 +657,7 @@ export async function runCli(argv) {
     program
         .command("logs")
         .description("Status diagnosis: DSM package status and masked diagnostics; does not stream application logs")
-        .requiredOption("--host <name>", "NAS profile")
+        .option("--host <name>", "Registered NAS host")
         .option("--dev", "Development Package Identity")
         .action(async (options, command) => {
         const host = hostOf(options.host);

package/dist/ctl/cli.d.ts

@@ -4,6 +4,7 @@ import type { Descriptor } from './descriptor.js';
 export interface CtlIO {
     store?: CtlStore;
     out?: (line: string) => void;
+    err?: (line: string) => void;
     isTTY?: boolean;
     prompt?: (message: string, secret?: boolean) => Promise<string>;
     requestFor?: (host: Host) => JsonRequest;

package/dist/ctl/cli.js

@@ -1,5 +1,6 @@
+import { nasFlags, withNasOptions, nasOptions } from '../nas/options.js';
+import { probeCertificate, normalizeFingerprint } from './tls.js';
 import { readBounded } from './json.js';
-import { readFileSync } from 'node:fs';
 import { createInterface } from 'node:readline/promises';
 import { Writable } from 'node:stream';
 import { CtlError, errorData, ctlError } from './errors.js';
@@ -9,7 +10,7 @@ import { selectHosts, selectApp, selectOperation, flagName, RESERVED_FLAGS } fro
 import { canonicalOrigin, CTL_TIMEOUT_MS, createRequest } from './transport.js';
 import { loginDsm, logoutDsm } from './dsm-auth.js';
 import { publicOperation } from './redaction.js';
-const USAGE = 'synopkgland ctl host add|list|show|login|logout|remove|revoke; ctl list [--host a,b|--all-hosts] [--app pkg] [--refresh]; ctl <alias|package> <command...> [typed flags|--input file|-] [--dry-run] [--yes]';
+const USAGE = 'synopkgland host add|list|show|login|logout|remove|revoke|default|trust; ctl list [--host a,b|--all-hosts] [--app pkg] [--refresh]; ctl <alias|package> <command...> [typed flags|--input file|-] [--dry-run] [--yes]; NAS HTTPS accepts any certificate by default; --strict-tls or --ca <file> opts into verification';
 async function prompt(message, secret = false) {
     if (!process.stdin.isTTY)
         throw new CtlError('CTL_INTERACTION_REQUIRED', 'Interactive input required.', 'Use --username and --password-stdin for host authentication.', 2);
@@ -60,6 +61,16 @@ function example(host, app, op) {
 }
 export function listView(host, apps) { return apps.map(app => ({ host, package: app.payload.package, aliases: app.payload.aliases, protocolVersion: app.version, developedBy: app.payload.provenance.developedBy, provenance: 'self-declared', hash: app.sha256, commands: Object.entries(app.payload.commands).map(([id, original]) => { const op = publicOperation(original); return { id, ...op, parameters: op.paramsSchema ?? 'Undescribed parameters; use --input', examples: example(host, app, op) }; }) })); }
 export async function runCtl(argv, io = {}) {
+    try {
+        const { args, options } = nasFlags(argv);
+        return await withNasOptions({ ...options, warn: io.err ?? console.error }, () => runCtlWithin(args, io));
+    }
+    catch (error) {
+        (io.out ?? console.log)(JSON.stringify({ ok: false, error: errorData(error) }));
+        process.exitCode = ctlError(error).exitCode;
+    }
+}
+async function runCtlWithin(argv, io = {}) {
     const args = [...argv], store = io.store ?? new CtlStore(), out = io.out ?? console.log, tty = io.isTTY ?? !!process.stdout.isTTY, ask = io.prompt ?? prompt;
     let json = argv.includes('--json') || !tty;
     const emit = (value) => out(json ? JSON.stringify(value) : JSON.stringify(value, null, 2));
@@ -79,7 +90,7 @@ export async function runCtl(argv, io = {}) {
         if (args[0] === 'host') {
             const action = args[1], name = args[2];
             if (help || !action) {
-                emit({ ok: true, data: { usage: USAGE, actions: ['add', 'list', 'show', 'login', 'logout', 'remove', 'revoke'] } });
+                emit({ ok: true, data: { usage: USAGE, actions: ['add', 'list', 'show', 'login', 'logout', 'remove', 'revoke', 'default', 'trust'] } });
                 return;
             }
             if (action === 'list') {
@@ -88,31 +99,54 @@ export async function runCtl(argv, io = {}) {
                 return;
             }
             if (!name)
-                throw new CtlError('CTL_ARGUMENT_INVALID', 'Host name is required.', 'run: synopkgland ctl host list');
+                throw new CtlError('CTL_ARGUMENT_INVALID', 'Host name is required.', 'run: synopkgland host list');
+            if (action === 'default') {
+                store.setDefault(name);
+                emit({ ok: true, data: { defaultHost: name } });
+                return;
+            }
             if (action === 'add' || action === 'login') {
                 const remaining = args.slice(3);
-                const url = take(remaining, '--url', true), usernameOption = take(remaining, '--username', true), passwordStdin = !!take(remaining, '--password-stdin'), tunnel = !!take(remaining, '--ssh-tunnel'), noRemember = !!take(remaining, '--no-remember-device'), ca = take(remaining, '--ca', true);
+                const url = take(remaining, '--url', true), usernameOption = take(remaining, '--username', true), passwordStdin = !!take(remaining, '--password-stdin'), tunnel = !!take(remaining, '--ssh-tunnel'), noRemember = !!take(remaining, '--no-remember-device'), ca = take(remaining, '--ca', true), fingerprint = take(remaining, '--fingerprint', true);
+                if ((ca || nasOptions().ca) && fingerprint)
+                    throw new CtlError('CTL_ARGUMENT_INVALID', 'Use --ca or --fingerprint', 'Choose one certificate trust policy');
                 if (remaining.length)
-                    throw new CtlError('CTL_ARGUMENT_INVALID', 'Unknown host options.', 'run: synopkgland ctl host --help', 3, remaining);
+                    throw new CtlError('CTL_ARGUMENT_INVALID', 'Unknown host options.', 'run: synopkgland host --help', 3);
                 if (action === 'add' && store.list().some(h => h.name === name))
-                    throw new CtlError('CTL_HOST_EXISTS', `Host ${name} already registered.`, `run: synopkgland ctl host login ${name}`);
+                    throw new CtlError('CTL_HOST_EXISTS', `Host ${name} already registered.`, `run: synopkgland host login ${name}`);
                 if (action === 'login' && (url || usernameOption || tunnel || ca))
-                    throw new CtlError('CTL_ARGUMENT_INVALID', 'Login uses the registered URL/account; add a separately named host to change them.', `run: synopkgland ctl host show ${name}`);
+                    throw new CtlError('CTL_ARGUMENT_INVALID', 'Login uses the registered URL/account; add a separately named host to change them.', `run: synopkgland host show ${name}`);
                 const old = action === 'login' ? store.get(name) : undefined;
                 if (action === 'add' && !url)
-                    throw new CtlError('CTL_URL_REQUIRED', '--url is required.', `run: synopkgland ctl host add ${name} --url https://${name}:5001`);
-                const host = old ?? { name, origin: canonicalOrigin(url, tunnel), username: usernameOption ?? await ask('DSM account: '), approved: {}, ...(tunnel ? { tunnel: true } : {}), ...(ca ? { ca } : {}) };
+                    throw new CtlError('CTL_URL_REQUIRED', '--url is required.', `run: synopkgland host add ${name} --url https://${name}:5001`);
+                const host = old ?? { name, origin: canonicalOrigin(url, tunnel), username: usernameOption ?? process.env.DSM_USERNAME ?? await ask('DSM account: '), approved: {}, ...(tunnel ? { tunnel: true } : {}), ...(nasOptions().ca ? { ca: nasOptions().ca } : {}), ...(nasOptions().strictTls ? { strictTls: true } : {}) };
+                if (fingerprint)
+                    normalizeFingerprint(fingerprint);
+                if (!io.requestFor) {
+                    const prior = host.fingerprint;
+                    const checked = await probeCertificate(host.origin, { ...store.trust(host), expectedFingerprint: fingerprint, timeoutMs });
+                    if (checked.leafFingerprint) {
+                        host.fingerprint = checked.leafFingerprint;
+                        store.save(host);
+                        if (!prior && !checked.trusted)
+                            (io.err ?? console.error)(`Trusting the NAS certificate ${checked.leafFingerprint.slice(0, 16)} (not verified by a trusted CA)`);
+                    }
+                }
+                else if (fingerprint)
+                    host.fingerprint = normalizeFingerprint(fingerprint);
                 const previous = old ? await store.credentials.get(store.key(host)) : null;
-                const secret = passwordStdin ? readBounded(0, 4096).replace(/[\r\n]+$/, '') : await ask('User password: ', true);
-                const session = await loginDsm(host.origin, host.username, secret, { remember: !noRemember, deviceId: previous?.deviceId, otp: () => ask('DSM OTP: ', true), request: io.requestFor?.(host) ?? createRequest(host.origin, timeoutMs, host.ca ? readFileSync(host.ca, 'utf8') : undefined), ca: host.ca ? readFileSync(host.ca, 'utf8') : undefined });
+                const secret = process.env.DSM_PASSWORD ?? (passwordStdin ? readBounded(0, 4096).replace(/[\r\n]+$/, '') : await ask('User password: ', true));
+                const session = await loginDsm(host.origin, host.username, secret, { remember: !noRemember, deviceId: previous?.deviceId, otp: () => process.env.DSM_OTP ? Promise.resolve(process.env.DSM_OTP) : ask('DSM OTP: ', true), request: io.requestFor?.(host) ?? createRequest(host.origin, timeoutMs, undefined, { ...store.trust(host), expectedFingerprint: fingerprint }) });
                 try {
-                    if (old)
+                    if (old || host.fingerprint) {
                         await store.credentials.set(store.key(host), session);
+                        store.save(host);
+                    }
                     else
                         await store.add(host, session);
                 }
                 catch (e) {
-                    await logoutDsm(session, io.requestFor?.(host) ?? createRequest(host.origin, timeoutMs)).catch(() => { });
+                    await logoutDsm(session, io.requestFor?.(host) ?? createRequest(host.origin, timeoutMs, undefined, store.trust(host))).catch(() => { });
                     throw e;
                 }
                 host.lastUsed = new Date().toISOString();
@@ -121,25 +155,42 @@ export async function runCtl(argv, io = {}) {
                 return;
             }
             const host = store.get(name);
+            if (action === 'trust') {
+                if (host.ca)
+                    throw new CtlError('HOST_CA_CONFIGURED', 'This host uses a configured CA', 'Update the trusted CA file instead of replacing it with a leaf pin', 3);
+                if (!host.origin.startsWith('https:'))
+                    throw new CtlError('HOST_TLS_REQUIRED', 'Certificate trust requires HTTPS', 'Use an HTTPS host registration', 3);
+                const checked = await probeCertificate(host.origin, { expectedFingerprint: take(args, '--fingerprint', true), name });
+                // Get the leaf even when system-trusted, to make an explicit re-pin stable.
+                const current = checked.leafFingerprint;
+                if (!current)
+                    throw new CtlError('HOST_TLS_SYSTEM_TRUSTED', 'This NAS certificate is trusted by the system', 'Remove the old pin only after verifying the NAS certificate with --fingerprint', 3);
+                if (!yes && (!tty || !/^y(es)?$/i.test(await ask(`Trust NAS certificate SHA-256 ${current} (previous ${host.fingerprint ?? 'none'})? [y/N] `))))
+                    throw new CtlError('HOST_TRUST_CONFIRM_REQUIRED', 'Certificate replacement requires confirmation', `Verify the certificate, then run: synopkgland host trust ${name}`, 7);
+                host.fingerprint = current;
+                store.save(host);
+                emit({ ok: true, data: { name, fingerprint: current } });
+                return;
+            }
             if (action === 'show') {
                 emit({ ok: true, data: { ...host, authenticated: await client(host).valid() } });
                 return;
             }
             if (action === 'revoke') {
                 if (!args[3])
-                    throw new CtlError('CTL_ARGUMENT_INVALID', 'Package ID is required.', `run: synopkgland ctl host show ${name}`);
+                    throw new CtlError('CTL_ARGUMENT_INVALID', 'Package ID is required.', `run: synopkgland host show ${name}`);
                 emit({ ok: true, data: store.revoke(name, args[3]) });
                 return;
             }
             if (action === 'logout' || action === 'remove') {
                 if (action === 'remove' && !yes && (!tty || !/^y(es)?$/i.test(await ask(`Remove all local data for ${name}? [y/N] `))))
-                    throw new CtlError('CTL_CONFIRM_REQUIRED', 'Host removal requires --yes.', `run: synopkgland ctl host remove ${name} --yes`, 7);
+                    throw new CtlError('CTL_CONFIRM_REQUIRED', 'Host removal requires --yes.', `run: synopkgland host remove ${name} --yes`, 7);
                 const session = await store.credentials.get(store.key(host));
                 let loggedOut = false;
                 let logoutError;
                 if (session?.cookie) {
                     try {
-                        await logoutDsm(session, io.requestFor?.(host) ?? createRequest(host.origin, timeoutMs, host.ca ? readFileSync(host.ca, 'utf8') : undefined));
+                        await logoutDsm(session, io.requestFor?.(host) ?? createRequest(host.origin, timeoutMs, undefined, store.trust(host)));
                         loggedOut = true;
                     }
                     catch (error) {
@@ -151,15 +202,16 @@ export async function runCtl(argv, io = {}) {
                     return;
                 }
                 if (logoutError)
-                    throw new CtlError('CTL_LOGOUT_FAILED', 'DSM logout was not confirmed; local session retained for retry.', `run: synopkgland ctl host logout ${name}`, 6);
+                    throw new CtlError('CTL_LOGOUT_FAILED', 'DSM logout was not confirmed; local session retained for retry.', `run: synopkgland host logout ${name}`, 6);
                 if (session)
                     await store.credentials.set(store.key(host), { ...session, cookie: '', token: '' });
                 emit({ ok: true, data: { name, loggedOut, registrationRetained: true } });
                 return;
             }
-            throw new CtlError('CTL_COMMAND_UNKNOWN', `Unknown host action ${action}.`, 'run: synopkgland ctl host --help', 3, ['add', 'list', 'show', 'login', 'logout', 'remove', 'revoke']);
+            throw new CtlError('CTL_COMMAND_UNKNOWN', `Unknown host action ${action}.`, 'run: synopkgland host --help', 3, ['add', 'list', 'show', 'login', 'logout', 'remove', 'revoke', 'default', 'trust']);
         }
-        const names = selectHosts(store.list().map(h => h.name), hostOption, allHosts);
+        const targets = store.targets();
+        const names = selectHosts(targets.map(h => h.name), hostOption ?? (allHosts ? undefined : store.defaultName()), allHosts);
         const inputAt = args.indexOf('--input');
         let commonInput;
         if (inputAt >= 0 && args[inputAt + 1] === '-') {
@@ -172,7 +224,7 @@ export async function runCtl(argv, io = {}) {
         }
         const results = await boundedMap(names, 4, async (name) => {
             try {
-                const host = store.get(name), ctl = client(host);
+                const host = targets.find(host => host.name === name), ctl = client(host);
                 if (args[0] === 'list') {
                     if (args.length !== 1)
                         throw new CtlError('CTL_ARGUMENT_INVALID', 'Unexpected list arguments.', `run: synopkgland ctl list --host ${name}`);

package/dist/ctl/dsm-auth.d.ts

@@ -1,10 +1 @@
-import { type DsmSession, type JsonRequest } from './transport.js';
-export interface LoginOptions {
-    remember?: boolean;
-    deviceId?: string;
-    otp: () => Promise<string>;
-    request?: JsonRequest;
-    ca?: string;
-}
-export declare function loginDsm(origin: string, username: string, password: string, options: LoginOptions): Promise<DsmSession>;
-export declare function logoutDsm(session: DsmSession, request?: JsonRequest): Promise<void>;
+export * from "../nas/auth.js";

package/dist/ctl/dsm-auth.js

@@ -1,30 +1,2 @@
-import { CtlError } from './errors.js';
-import { createRequest } from './transport.js';
-export async function loginDsm(origin, username, password, options) {
-    const request = options.request ?? createRequest(origin, 30000, options.ca);
-    const form = new URLSearchParams({ api: 'SYNO.API.Auth', version: '7', method: 'login', account: username, passwd: password, session: 'DSM', format: 'cookie', enable_syno_token: 'yes', enable_device_token: options.remember === false ? 'no' : 'yes', device_name: 'synopkgland', device_id: options.deviceId ?? '' });
-    let result = await request('/webapi/entry.cgi', form);
-    if (result?.error?.code === 402) {
-        form.delete('session');
-        result = await request('/webapi/entry.cgi', form);
-    }
-    if (result?.error?.code === 403) {
-        const otp = await options.otp();
-        if (!/^\d{6}$/.test(otp))
-            throw new CtlError('CTL_OTP_INVALID', 'OTP must be six digits.', 'run: synopkgland ctl host login <name>', 2);
-        form.set('otp_code', otp);
-        result = await request('/webapi/entry.cgi', form);
-    }
-    if (result?.success !== true || typeof result.data?.sid !== 'string' || !result.data.sid || typeof result.data.synotoken !== 'string' || !result.data.synotoken)
-        throw new CtlError('CTL_AUTH_FAILED', `DSM login failed (${Number(result?.error?.code) || 'invalid response'}).`, 'run: synopkgland ctl host login <name>', 2);
-    if (/[;\r\n\x00]/.test(result.data.sid) || /[\r\n\x00]/.test(result.data.synotoken) || result.data.sid.length > 4096 || result.data.synotoken.length > 4096)
-        throw new CtlError('CTL_AUTH_FAILED', 'DSM returned invalid session carriers.', 'Check the DSM endpoint.', 2);
-    const returnedDevice = result.data.device_id || result.data.did || options.deviceId;
-    const deviceId = options.remember === false ? undefined : typeof returnedDevice === 'string' && returnedDevice.length <= 4096 && !/[\r\n\x00]/.test(returnedDevice) ? returnedDevice : undefined;
-    return { origin, username, cookie: `id=${result.data.sid}`, token: result.data.synotoken, ...(deviceId ? { deviceId } : {}) };
-}
-export async function logoutDsm(session, request = createRequest(session.origin)) {
-    const body = await request('/webapi/entry.cgi', new URLSearchParams({ api: 'SYNO.API.Auth', version: '7', method: 'logout', SynoToken: session.token }), session);
-    if (body?.success !== true)
-        throw new CtlError('CTL_LOGOUT_FAILED', 'DSM did not confirm logout.', 'Retry logout or revoke the NAS session.', 2);
-}
+// Compatibility export; NAS connection implementation lives in one module.
+export * from "../nas/auth.js";

package/dist/ctl/errors.js

@@ -28,5 +28,5 @@ export function choose(value, allowed, what) {
         row = next;
     } return row[b.length]; };
     const nearest = [...allowed].sort((a, b) => distance(value.toLowerCase(), a.toLowerCase()) - distance(value.toLowerCase(), b.toLowerCase()))[0];
-    throw new CtlError(`CTL_${what.toUpperCase()}_UNKNOWN`, `Unknown ${what}: ${value}.${nearest ? ` Did you mean ${nearest}?` : ''}`, nearest ? `run: synopkgland ctl ${what === 'host' ? `host show ${nearest}` : 'list --json'}` : 'run: synopkgland ctl host add <name> --url https://<nas>:5001', 3, allowed);
+    throw new CtlError(`CTL_${what.toUpperCase()}_UNKNOWN`, `Unknown ${what}: ${value}.${nearest ? ` Did you mean ${nearest}?` : ''}`, nearest ? `run: synopkgland ctl ${what === 'host' ? `host show ${nearest}` : 'list --json'}` : 'run: synopkgland host add <name> --url https://<nas>:5001', 3, allowed);
 }

package/dist/ctl/input.js

@@ -4,9 +4,9 @@ import { CtlError, choose } from './errors.js';
 import { redactValue } from './redaction.js';
 export function selectHosts(names, selected, all = false) {
     if (selected && all)
-        throw new CtlError('CTL_ARGUMENT_INVALID', 'Use --host or --all-hosts, not both.', 'run: synopkgland ctl host list');
+        throw new CtlError('CTL_ARGUMENT_INVALID', 'Use --host or --all-hosts, not both.', 'run: synopkgland host list');
     if (!names.length)
-        throw new CtlError('CTL_NOT_AUTHENTICATED', 'No hosts registered.', 'run: synopkgland ctl host add <name> --url https://<nas>:5001', 2);
+        throw new CtlError('CTL_NOT_AUTHENTICATED', 'No hosts registered.', 'run: synopkgland host add <name> --url https://<nas>:5001', 2);
     if (all)
         return names;
     if (!selected) {
@@ -34,7 +34,7 @@ export function selectOperation(app, path) {
         return { id: found[0], operation: found[1] };
     return choose(path.join(' '), Object.values(app.payload.commands).map(op => op.cli.join(' ')), 'command');
 }
-export const RESERVED_FLAGS = new Set(['host', 'all-hosts', 'json', 'app', 'refresh', 'yes', 'dry-run', 'approve-installed', 'help', 'input', 'wait', 'no-wait', 'timeout']);
+export const RESERVED_FLAGS = new Set(['ca', 'strict-tls', 'host', 'all-hosts', 'json', 'app', 'refresh', 'yes', 'dry-run', 'approve-installed', 'help', 'input', 'wait', 'no-wait', 'timeout']);
 export function flagName(key) { return key.replace(/[A-Z]/g, c => '-' + c.toLowerCase()).replaceAll('_', '-'); }
 export function operationInput(op, args, stdin, helpHint) {
     const fail = (message, allowed) => { throw new CtlError('CTL_PARAMS_INVALID', message, helpHint ?? ('run: synopkgland ctl <package> ' + op.cli.join(' ') + ' --help'), 3, allowed); };

package/dist/ctl/service.js

@@ -1,4 +1,3 @@
-import { readFileSync } from 'node:fs';
 import { CtlError, errorData, choose } from './errors.js';
 import { APP_COOKIE, CTL_TIMEOUT_MS, createRequest } from './transport.js';
 import { DESCRIPTION_METHOD, validateDescriptor, ajv } from './descriptor.js';
@@ -17,7 +16,7 @@ export class CtlClient {
     constructor(store, host, request, timeoutMs = CTL_TIMEOUT_MS) {
         this.store = store;
         this.host = host;
-        this.request = request ?? createRequest(host.origin, () => this.remaining(timeoutMs), host.ca ? readFileSync(host.ca, 'utf8') : undefined);
+        this.request = request ?? createRequest(host.origin, () => this.remaining(timeoutMs), undefined, store.trust(host));
     }
     until;
     remaining(fallback) { return this.until === undefined ? fallback : Math.max(0, this.until - performance.now()); }
@@ -25,14 +24,16 @@ export class CtlClient {
         await this.inventory(await this.store.session(this.host));
         return true;
     }
-    catch {
+    catch (error) {
+        if (error instanceof CtlError && error.code.startsWith('HOST_'))
+            throw error;
         return false;
     } }
     async inventory(session) {
         const response = await this.request('/webapi/entry.cgi', new URLSearchParams({ api: 'SYNO.Core.Package', version: '2', method: 'list', additional: '["status"]', SynoToken: session.token }), session);
         if (response?.success !== true) {
             const code = Number(response?.error?.code);
-            throw new CtlError([106, 107, 119].includes(code) ? 'CTL_NOT_AUTHENTICATED' : 'CTL_INVENTORY_DENIED', `DSM Package list failed (${code}).`, `run: synopkgland ctl host login ${this.host.name}`, [106, 107, 119].includes(code) ? 2 : 4);
+            throw new CtlError([106, 107, 119].includes(code) ? 'CTL_NOT_AUTHENTICATED' : 'CTL_INVENTORY_DENIED', `DSM Package list failed (${code}).`, `run: synopkgland host login ${this.host.name}`, [106, 107, 119].includes(code) ? 2 : 4);
         }
         const entries = response.data?.packages;
         if (!Array.isArray(entries) || response.data.total !== entries.length || entries.length > 4096)
@@ -134,7 +135,7 @@ export class CtlClient {
                 const boot = await this.request(app.payload.transport.path, { method: 'identity.session', params: { bootstrap: true } }, session);
                 // The transport adapter adds only validated, path-scoped App cookies for this call.
                 if (boot?.success !== true)
-                    throw new CtlError('CTL_APP_SESSION', 'App session bootstrap failed; HTTPS is required.', `run: synopkgland ctl host show ${this.host.name}`, 5);
+                    throw new CtlError('CTL_APP_SESSION', 'App session bootstrap failed; HTTPS is required.', `run: synopkgland host show ${this.host.name}`, 5);
                 appSession = this.appCookieSession(session, boot);
             }
             try {
@@ -148,10 +149,9 @@ export class CtlClient {
                     }
                     return response.data;
                 };
-                const ca = this.host.ca ? readFileSync(this.host.ca, 'utf8') : undefined;
                 const result = await runFlow(operation.flow, params, invoke, { wait: options.wait, timeoutMs: this.remaining(options.timeoutMs ?? CTL_TIMEOUT_MS),
-                    ndjson: (method, input) => transferRequest(appSession, app.payload.transport.path, method, input, { ca, timeoutMs: this.remaining(options.timeoutMs ?? CTL_TIMEOUT_MS) }),
-                    upload: (method, input, flow) => transferRequest(appSession, app.payload.transport.path, method, {}, { ca, timeoutMs: this.remaining(options.timeoutMs ?? CTL_TIMEOUT_MS), file: { path: String(input[flow.fileParam]), parent: String(input[flow.parentParam]), name: String(input[flow.nameParam]) } }) });
+                    ndjson: (method, input) => transferRequest(appSession, app.payload.transport.path, method, input, { trust: this.store.trust(this.host), timeoutMs: this.remaining(options.timeoutMs ?? CTL_TIMEOUT_MS) }),
+                    upload: (method, input, flow) => transferRequest(appSession, app.payload.transport.path, method, {}, { trust: this.store.trust(this.host), timeoutMs: this.remaining(options.timeoutMs ?? CTL_TIMEOUT_MS), file: { path: String(input[flow.fileParam]), parent: String(input[flow.parentParam]), name: String(input[flow.nameParam]) } }) });
                 if (operation.resultSchema && !ajv.validate(operation.resultSchema, result))
                     throw new CtlError('CTL_RESPONSE_INVALID', 'Result does not match command schema.', 'Check the App version.', 5);
                 return output.clean(result, operation.resultSchema);

package/dist/ctl/store.d.ts

@@ -1,51 +1 @@
-import type { DsmSession } from './transport.js';
-export interface Approval {
-    version: string;
-    hash?: string;
-}
-export interface Host {
-    name: string;
-    origin: string;
-    username: string;
-    tunnel?: boolean;
-    ca?: string;
-    lastUsed?: string;
-    approved: Record<string, Approval>;
-}
-export interface CredentialStore {
-    get(key: string): Promise<DsmSession | null>;
-    set(key: string, value: DsmSession): Promise<void>;
-    delete(key: string): Promise<void>;
-}
-export declare class OsCredentialStore implements CredentialStore {
-    private entry;
-    get(key: string): Promise<DsmSession | null>;
-    set(key: string, value: DsmSession): Promise<void>;
-    delete(key: string): Promise<void>;
-}
-export declare class CtlStore {
-    root: string;
-    credentials: CredentialStore;
-    constructor(root?: string, credentials?: CredentialStore);
-    private safe;
-    private file;
-    key(host: Host): string;
-    list(): Host[];
-    get(name: string): Host;
-    save(host: Host): void;
-    add(host: Host, session: DsmSession): Promise<void>;
-    session(host: Host): Promise<DsmSession>;
-    cacheRoot(host: Host): string;
-    cacheFile(host: Host, pkg: string, version: string): string;
-    cache(host: Host, pkg: string, version: string): any | null;
-    putCache(host: Host, pkg: string, version: string, description: any): void;
-    putFailure(host: Host, pkg: string, version: string, failure: unknown): void;
-    revoke(name: string, pkg: string): {
-        revoked: string;
-        cacheCleared: boolean;
-    };
-    remove(name: string): Promise<{
-        removed: string;
-        deleted: string[];
-    }>;
-}
+export * from "../nas/store.js";

package/dist/ctl/store.js

@@ -1,93 +1,2 @@
-import { mkdirSync, readFileSync, writeFileSync, renameSync, readdirSync, rmSync, existsSync, chmodSync } from 'node:fs';
-import { homedir } from 'node:os';
-import { join } from 'node:path';
-import { randomUUID, createHash } from 'node:crypto';
-import { CtlError, choose } from './errors.js';
-import { publicDescriptor } from './redaction.js';
-export class OsCredentialStore {
-    async entry(key) { try {
-        const { AsyncEntry } = await import('@napi-rs/keyring');
-        return new AsyncEntry('synopkgland.ctl', key, { linux: { store: 'secret-service' } });
-    }
-    catch {
-        throw new CtlError('CTL_CREDENTIAL_STORE', 'OS secure credential store unavailable.', 'Unlock the OS credential store and retry.', 2);
-    } }
-    async get(key) { try {
-        const raw = await (await this.entry(key)).getPassword();
-        return raw ? JSON.parse(raw) : null;
-    }
-    catch (e) {
-        if (e instanceof CtlError)
-            throw e;
-        throw new CtlError('CTL_CREDENTIAL_STORE', 'Cannot read OS credentials.', 'Unlock the OS credential store and retry.', 2);
-    } }
-    async set(key, value) { try {
-        await (await this.entry(key)).setPassword(JSON.stringify(value));
-    }
-    catch {
-        throw new CtlError('CTL_CREDENTIAL_STORE', 'Cannot save session in OS secure storage.', 'Unlock the OS credential store and retry.', 2);
-    } }
-    async delete(key) { try {
-        await (await this.entry(key)).deleteCredential();
-    }
-    catch {
-        throw new CtlError('CTL_CREDENTIAL_STORE', 'Cannot remove OS credentials.', 'Unlock the OS credential store and retry removal.', 2);
-    } }
-}
-export class CtlStore {
-    root;
-    credentials;
-    constructor(root = process.env.SYNOPKGLAND_CTL_DIR ?? join(homedir(), '.synopkgland', 'ctl'), credentials = new OsCredentialStore()) {
-        this.root = root;
-        this.credentials = credentials;
-    }
-    safe(name) { if (!/^[a-zA-Z0-9][a-zA-Z0-9._-]{0,63}$/.test(name))
-        throw new CtlError('CTL_HOST_INVALID', 'Invalid host name.', 'Use letters, digits, dots, dashes or underscores.'); return name; }
-    file(name) { return join(this.root, 'hosts', this.safe(name) + '.json'); }
-    key(host) { return createHash('sha256').update(host.name + '\0' + host.origin + '\0' + host.username).digest('hex'); }
-    list() { const dir = join(this.root, 'hosts'); if (!existsSync(dir))
-        return []; return readdirSync(dir).filter(n => n.endsWith('.json')).map(n => JSON.parse(readFileSync(join(dir, n), 'utf8'))).sort((a, b) => a.name.localeCompare(b.name)); }
-    get(name) { this.safe(name); const host = this.list().find(h => h.name === name); if (!host)
-        return choose(name, this.list().map(h => h.name), 'host'); return host; }
-    save(host) { const file = this.file(host.name); mkdirSync(join(this.root, 'hosts'), { recursive: true, mode: 0o700 }); const temp = file + '.' + randomUUID(); writeFileSync(temp, JSON.stringify(host), { mode: 0o600 }); renameSync(temp, file); chmodSync(file, 0o600); }
-    async add(host, session) { if (this.list().some(h => h.name === host.name))
-        throw new CtlError('CTL_HOST_EXISTS', 'Host name already registered.', `run: synopkgland ctl host login ${host.name}`); await this.credentials.set(this.key(host), session); try {
-        this.save(host);
-    }
-    catch (e) {
-        await this.credentials.delete(this.key(host));
-        throw e;
-    } }
-    async session(host) { const session = await this.credentials.get(this.key(host)); if (!session?.cookie || !session.token)
-        throw new CtlError('CTL_NOT_AUTHENTICATED', `Host ${host.name} is not logged in.`, `run: synopkgland ctl host login ${host.name}`, 2); if (session.origin !== host.origin || session.username !== host.username)
-        throw new CtlError('CTL_CREDENTIAL_MISMATCH', 'Stored credentials do not match host.', 'Run ctl host login again.', 2); return session; }
-    cacheRoot(host) { return join(this.root, 'cache', this.key(host)); }
-    cacheFile(host, pkg, version) { return join(this.cacheRoot(host), createHash('sha256').update(pkg + '\0' + version).digest('hex') + '.json'); }
-    cache(host, pkg, version) {
-        try {
-            const entry = JSON.parse(readFileSync(this.cacheFile(host, pkg, version), 'utf8'));
-            if (entry.description && !entry.redacted) {
-                const safe = publicDescriptor(entry.description);
-                if (JSON.stringify(safe) !== JSON.stringify(entry.description)) {
-                    this.putCache(host, pkg, version, entry.description);
-                    return { ...entry, description: safe, redacted: true };
-                }
-            }
-            return entry;
-        }
-        catch {
-            return null;
-        }
-    }
-    putCache(host, pkg, version, description) {
-        const safe = publicDescriptor(description);
-        const redacted = JSON.stringify(safe) !== JSON.stringify(description);
-        mkdirSync(this.cacheRoot(host), { recursive: true, mode: 0o700 });
-        const file = this.cacheFile(host, pkg, version), tmp = file + '.' + randomUUID();
-        writeFileSync(tmp, JSON.stringify({ hash: description.sha256, description: safe, ...(redacted ? { redacted: true } : {}) }), { mode: 0o600 });
-        renameSync(tmp, file);
-    }
-    putFailure(host, pkg, version, failure) { mkdirSync(this.cacheRoot(host), { recursive: true, mode: 0o700 }); const file = this.cacheFile(host, pkg, version), tmp = file + '.' + randomUUID(); writeFileSync(tmp, JSON.stringify({ failure }), { mode: 0o600 }); renameSync(tmp, file); }
-    revoke(name, pkg) { const host = this.get(name); delete host.approved[pkg]; this.save(host); rmSync(this.cacheRoot(host), { recursive: true, force: true }); return { revoked: pkg, cacheCleared: true }; }
-    async remove(name) { const host = this.get(name); await this.credentials.delete(this.key(host)); rmSync(this.cacheRoot(host), { recursive: true, force: true }); rmSync(this.file(name)); return { removed: name, deleted: ['session', 'SynoToken', 'device token', 'App approvals', 'hash pins', 'list cache', 'host registration'] }; }
-}
+// Compatibility export; NAS connection implementation lives in one module.
+export * from "../nas/store.js";