@synopackageland/cli 0.32.1 → 0.33.1

package/dist/ctl/tls.d.ts

@@ -0,0 +1 @@
+export * from "../nas/tls.js";

package/dist/ctl/tls.js

@@ -0,0 +1,2 @@
+// Compatibility export; NAS connection implementation lives in one module.
+export * from "../nas/tls.js";

package/dist/ctl/transfers.d.ts

@@ -1,14 +1 @@
-import { type DsmSession } from './transport.js';
-export declare function localFile(file: unknown): {
-    file: string;
-    size: number;
-};
-export declare function transferRequest(session: DsmSession, path: string, method: string, params: Record<string, unknown>, options?: {
-    file?: {
-        path: string;
-        parent: string;
-        name: string;
-    };
-    ca?: string;
-    timeoutMs?: number;
-}): Promise<any>;
+export * from "../nas/transfers.js";

package/dist/ctl/transfers.js

@@ -1,77 +1,2 @@
-import { createReadStream, statSync } from 'node:fs';
-import http from 'node:http';
-import https from 'node:https';
-import { CtlError } from './errors.js';
-import { CTL_TIMEOUT_MS } from './transport.js';
-export function localFile(file) { if (typeof file !== 'string' || !file)
-    throw new CtlError('CTL_INPUT_FILE', 'A local filename is required.', 'Use --file <path>.'); try {
-    const stat = statSync(file);
-    if (!stat.isFile() || stat.size > 16 * 1024 ** 3)
-        throw Error();
-    return { file, size: stat.size };
-}
-catch {
-    throw new CtlError('CTL_INPUT_FILE', 'Upload must be a readable regular file of at most 16 GiB.', 'Check --file <path>.');
-} }
-export async function transferRequest(session, path, method, params, options = {}) {
-    if (!/^\/webman\/3rdparty\/[A-Za-z][A-Za-z0-9_.+-]*\/cgi\/api\.cgi$/.test(path) || !/^([a-z][a-z0-9_]*\.)+[a-z][a-z0-9_]*$/.test(method))
-        throw new CtlError('CTL_PATH_INVALID', 'Invalid transfer binding.', 'Refresh the API description.', 4);
-    if (options.timeoutMs !== undefined && options.timeoutMs <= 0)
-        throw new CtlError('CTL_NETWORK', 'Transfer budget exhausted before dispatch.', 'Check App state before retrying writes.', 6);
-    const url = new URL(path, session.origin);
-    const file = options.file ? localFile(options.file.path) : undefined;
-    if (options.file) {
-        url.search = new URLSearchParams({ method, parent: options.file.parent, name: options.file.name }).toString();
-    }
-    const raw = file ? undefined : Buffer.from(JSON.stringify({ method, params }));
-    return new Promise((resolve, reject) => {
-        const headers = { 'content-type': file ? 'application/octet-stream' : 'application/json', cookie: session.cookie, 'X-SYNO-TOKEN': session.token, origin: session.origin, 'content-length': String(file?.size ?? raw.length) };
-        const req = (url.protocol === 'https:' ? https : http).request(url, { method: 'POST', headers, timeout: options.timeoutMs ?? CTL_TIMEOUT_MS, ...(options.ca ? { ca: options.ca } : {}) }, res => {
-            const expected = file ? 'application/json' : 'application/x-ndjson';
-            if (res.statusCode !== 200 || !res.headers['content-type']?.includes(expected)) {
-                res.resume();
-                reject(new CtlError('CTL_TRANSFER_FAILED', 'Unexpected transfer response; redirects are refused.', 'Check App transfer support.', 5));
-                return;
-            }
-            const chunks = [];
-            let total = 0;
-            res.on('data', (chunk) => { total += chunk.length; if (total > (file ? 1048576 : 8 * 1048576)) {
-                req.destroy();
-                reject(new CtlError('CTL_FLOW_LIMIT', 'Transfer result exceeds collection limit.', 'Narrow the query.', 5));
-            }
-            else
-                chunks.push(chunk); });
-            res.on('error', () => reject(new CtlError('CTL_NETWORK', 'Transfer response interrupted.', 'Check state before retrying writes.', 6)));
-            res.on('end', () => { try {
-                const text = Buffer.concat(chunks).toString('utf8');
-                if (file) {
-                    const body = JSON.parse(text);
-                    if (body.success !== true)
-                        throw Error();
-                    resolve(body.data);
-                }
-                else {
-                    const lines = text.split('\n').filter(l => l.trim());
-                    if (lines.length > 10000)
-                        throw Error();
-                    resolve({ items: lines.map(line => JSON.parse(line)) });
-                }
-            }
-            catch {
-                reject(new CtlError('CTL_TRANSFER_FAILED', 'Invalid or failed transfer response.', 'Inspect the App result; do not retry writes blindly.', 5));
-            } });
-        });
-        const wallTimer = setTimeout(() => req.destroy(), options.timeoutMs ?? CTL_TIMEOUT_MS);
-        req.once('close', () => clearTimeout(wallTimer));
-        req.on('timeout', () => req.destroy());
-        req.on('error', () => reject(new CtlError('CTL_NETWORK', 'Transfer interrupted; completion may be uncertain.', 'Check App state before retrying.', 6)));
-        if (file) {
-            const source = createReadStream(file.file);
-            source.on('error', () => req.destroy());
-            req.on('close', () => source.destroy());
-            source.pipe(req);
-        }
-        else
-            req.end(raw);
-    });
-}
+// Compatibility export; NAS connection implementation lives in one module.
+export * from "../nas/transfers.js";

package/dist/ctl/transport.d.ts

@@ -1,12 +1 @@
-export declare const CTL_TIMEOUT_MS = 62000;
-export declare const APP_COOKIE: unique symbol;
-export interface DsmSession {
-    origin: string;
-    username: string;
-    cookie: string;
-    token: string;
-    deviceId?: string;
-}
-export type JsonRequest = (path: string, body: URLSearchParams | Record<string, unknown>, session?: DsmSession) => Promise<any>;
-export declare function canonicalOrigin(input: string, tunnel?: boolean): string;
-export declare function createRequest(origin: string, timeoutMs?: number | (() => number), ca?: string): JsonRequest;
+export * from "../nas/transport.js";

package/dist/ctl/transport.js

@@ -1,83 +1,2 @@
-import { strictJson } from './json.js';
-import http from 'node:http';
-import https from 'node:https';
-import { CtlError } from './errors.js';
-export const CTL_TIMEOUT_MS = 62000;
-export const APP_COOKIE = Symbol("ctlAppCookie");
-export function canonicalOrigin(input, tunnel = false) {
-    let url;
-    try {
-        url = new URL(input);
-    }
-    catch {
-        throw new CtlError('CTL_URL_INVALID', 'A NAS origin URL is required.', 'run: synopkgland ctl host add <name> --url https://<nas>:5001');
-    }
-    if (url.username || url.password || url.search || url.hash || url.pathname !== '/' || !(url.protocol === 'https:' || (tunnel && url.protocol === 'http:' && ['127.0.0.1', '[::1]'].includes(url.hostname))))
-        throw new CtlError('CTL_URL_INVALID', 'Use HTTPS, or explicit --ssh-tunnel for a loopback HTTP tunnel.', 'run: synopkgland ctl host add <name> --url https://<nas>:5001');
-    return url.origin;
-}
-export function createRequest(origin, timeoutMs = CTL_TIMEOUT_MS, ca) {
-    return async (path, body, session) => {
-        if (!path.startsWith('/') || path.startsWith('//') || path.includes('?') || path.includes('#') || path.includes('\\') || path.includes('%') || path.split('/').some(p => p === '.' || p === '..'))
-            throw new CtlError('CTL_PATH_INVALID', 'Unsafe request path.', 'run: synopkgland ctl list --refresh');
-        const remaining = typeof timeoutMs === 'function' ? timeoutMs() : timeoutMs;
-        if (remaining <= 0)
-            throw new CtlError('CTL_NETWORK', 'Request budget exhausted before dispatch.', 'Check App state before retrying writes.', 6);
-        const url = new URL(path, origin);
-        if (url.origin !== origin || (session && session.origin !== origin))
-            throw new CtlError('CTL_ORIGIN_MISMATCH', 'Credentials cannot cross NAS origins.', 'run: synopkgland ctl host list', 4);
-        const form = body instanceof URLSearchParams;
-        const payload = Buffer.from(form ? body.toString() : JSON.stringify(body));
-        if (payload.length > 1048576)
-            throw new CtlError('CTL_INPUT_TOO_LARGE', 'Request exceeds 1 MiB.', 'Reduce the input.');
-        return new Promise((resolve, reject) => {
-            const headers = { 'content-type': form ? 'application/x-www-form-urlencoded' : 'application/json', accept: 'application/json', 'content-length': String(payload.length), origin };
-            if (session) {
-                headers.cookie = session.cookie;
-                headers['X-SYNO-TOKEN'] = session.token;
-            }
-            const req = (url.protocol === 'https:' ? https : http).request(url, { method: 'POST', headers, timeout: remaining, ...(ca ? { ca } : {}) }, res => {
-                if (!res.statusCode || res.statusCode < 200 || res.statusCode >= 300) {
-                    res.resume();
-                    reject(new CtlError('CTL_HTTP_ERROR', `HTTP ${res.statusCode}; redirects are never followed.`, 'Check the NAS URL and connection.', 6));
-                    return;
-                }
-                if (!res.headers['content-type']?.includes('application/json')) {
-                    res.resume();
-                    reject(new CtlError('CTL_RESPONSE_INVALID', 'NAS returned non-JSON data.', 'Check the endpoint and installed package.', 5));
-                    return;
-                }
-                const chunks = [];
-                let length = 0;
-                res.on('data', (c) => { length += c.length; if (length > 1048576) {
-                    res.destroy();
-                    reject(new CtlError('CTL_RESPONSE_TOO_LARGE', 'Response exceeds 1 MiB.', 'Use a smaller operation.', 5));
-                }
-                else
-                    chunks.push(c); });
-                res.on('error', () => reject(new CtlError('CTL_NETWORK', 'Response interrupted.', 'Check the NAS connection; state-changing requests are not replayed.', 6)));
-                res.on('end', () => {
-                    try {
-                        const body = strictJson(Buffer.concat(chunks));
-                        if (!form && body?.success === true && body.data && path.startsWith('/webman/3rdparty/') && url.protocol === 'https:') {
-                            const cookies = (res.headers['set-cookie'] ?? []).filter(line => /;\s*Secure(?:;|$)/i.test(line) && /;\s*HttpOnly(?:;|$)/i.test(line) && !/;\s*Domain=/i.test(line));
-                            const own = path.slice(0, path.lastIndexOf('/cgi/')) + '/';
-                            const valid = cookies.filter(line => { const match = /;\s*Path=([^;]+)/i.exec(line); return match?.[1] === own; }).map(line => line.split(';')[0]).filter(pair => !pair.startsWith('id='));
-                            if (valid.length)
-                                Object.defineProperty(body, APP_COOKIE, { value: valid.join('; '), enumerable: false });
-                        }
-                        resolve(body);
-                    }
-                    catch {
-                        reject(new CtlError('CTL_RESPONSE_INVALID', 'Invalid JSON response.', 'Check the installed package.', 5));
-                    }
-                });
-            });
-            const wallTimer = setTimeout(() => req.destroy(), remaining);
-            req.once('close', () => clearTimeout(wallTimer));
-            req.on('timeout', () => req.destroy());
-            req.on('error', () => reject(new CtlError('CTL_NETWORK', 'NAS request failed or timed out.', 'Check the NAS connection and trusted CA; requests are not replayed.', 6)));
-            req.end(payload);
-        });
-    };
-}
+// Compatibility export; NAS connection implementation lives in one module.
+export * from "../nas/transport.js";

package/dist/e2e/dsm.d.ts

@@ -129,10 +129,10 @@ export declare function dismissNotifications(page?: Page, env?: Env): Promise<nu
 /**
  * Whether the signed-in desktop's session is usable: it holds a SynoToken
  * (a restored `stay_login` cookie alone yields none, and the app's CGIs then
- * answer 119) and DSM's login.cgi, asked from the page, still accepts the
+ * answer 119) and DSM's login.cgi, asked through the shared NAS transport, still accepts the
  * session. Any failure to ask counts as not live.
  */
-export declare function dsmSessionLive(page: Pick<SessionPage, "evaluate">): Promise<boolean>;
+export declare function dsmSessionLive(page: Pick<SessionPage, "evaluate">, check?: (token: string) => Promise<boolean>, env?: Env): Promise<boolean>;
 /**
  * `app.open(path)`, once more after net::ERR_ABORTED: about one first
  * navigation in ten was aborted as DSM's desktop navigated on its own, and the

package/dist/e2e/dsm.js

@@ -1,5 +1,5 @@
 // DSM helpers for package e2e suites on upstream `e2e` + `@e2e-dev/web`.
-// One self-contained file: a package may copy it verbatim to tests/e2e/support/dsm.ts.
+// Import through @synopackageland/cli/e2e to share the CLI NAS connection path.
 // It signs in once per run (a saved, private profile is restored when still valid),
 // opens DSM app windows and Application Portal pages (accepting their native
 // dialogs when given the `browser` fixture), dismisses DSM notifications,
@@ -9,6 +9,9 @@
 // e2e output, which is made private (directories 700, files 600).
 //
 //   node tests/e2e/support/dsm.ts tunnel -- npx e2e run
+import { loginDsm } from "../nas/auth.js";
+import { sessionFetch } from "../nas/transport.js";
+import { canonicalOrigin } from "../nas/transport.js";
 import { spawn } from "node:child_process";
 import { randomUUID } from "node:crypto";
 import { chmodSync, mkdirSync, readdirSync, readFileSync, renameSync, statSync, writeFileSync } from "node:fs";
@@ -389,16 +392,25 @@ export async function dismissNotifications(page = dsmPage(), env = process.env)
 /**
  * Whether the signed-in desktop's session is usable: it holds a SynoToken
  * (a restored `stay_login` cookie alone yields none, and the app's CGIs then
- * answer 119) and DSM's login.cgi, asked from the page, still accepts the
+ * answer 119) and DSM's login.cgi, asked through the shared NAS transport, still accepts the
  * session. Any failure to ask counts as not live.
  */
-export async function dsmSessionLive(page) {
-    const state = await page.evaluate(async () => {
-        const token = window.SYNO?.SDS?.Session?.SynoToken;
-        const reply = await fetch("/webman/login.cgi", { credentials: "same-origin" }).then(response => response.json());
-        return { token: typeof token === "string" && token !== "", success: reply?.success === true };
-    }).catch(() => undefined);
-    return !!state?.token && state.success;
+export async function dsmSessionLive(page, check, env = process.env) {
+    const token = await page.evaluate(() => window.SYNO?.SDS?.Session?.SynoToken).catch(() => undefined);
+    if (typeof token !== 'string' || !token)
+        return false;
+    try {
+        if (check)
+            return await check(token);
+        const state = await surface().context().storageState();
+        const cookie = state.cookies.filter(c => sessionCookieNames.includes(c.name)).map(c => `${c.name}=${c.value}`).join('; ');
+        const origin = canonicalOrigin(dsmUrl(env), true);
+        const response = await sessionFetch(origin + '/webman/login.cgi', {}, { origin, username: 'e2e', cookie, token });
+        return (await response.json())?.success === true;
+    }
+    catch {
+        return false;
+    }
 }
 function accountFile(user, env) {
     const key = `DSM_E2E_ACCOUNT_${user.toUpperCase().replace(/[^A-Z0-9]/g, "_")}`;
@@ -447,8 +459,8 @@ export async function openUntilLoaded(app, path, { timeoutMs = 30_000, pauseMs =
         }
     }
 }
-async function restoredSessionLive(page) {
-    return await desktopOrLogin(page) === "desktop" && await dsmSessionLive(page);
+async function restoredSessionLive(page, env) {
+    return await desktopOrLogin(page) === "desktop" && await dsmSessionLive(page, undefined, env);
 }
 /**
  * Restores the saved profile of `user`; signs in with the account file only
@@ -466,18 +478,22 @@ export async function signIn(app, user = "admin", env = process.env) {
     await openPath(app, "/");
     const page = dsmPage();
     let outcome = "restored";
-    if (!profile || !await restoredSessionLive(page)) {
+    if (!profile || !await restoredSessionLive(page, env)) {
         // A refused session still shows the desktop; dropping its cookies shows the login form.
         if (profile) {
             await context.clearCookies();
             await openUntilLoaded(app, "/");
         }
         const account = readAccount(accountFile(user, env), user);
-        await page.locator(loginSelector).fill(account.username);
-        await page.keyboard.press("Enter");
-        const password = page.locator('input[type="password"]:visible');
-        await password.fill(account.password);
-        await password.press("Enter");
+        const session = await loginDsm(canonicalOrigin(url, true), account.username, account.password, {
+            remember: false, otp: async () => env.DSM_OTP ?? '',
+        });
+        const state = await context.storageState();
+        await context.setStorageState({ ...state, cookies: [...state.cookies, {
+                    name: 'id', value: session.cookie.slice(3), domain: new URL(url).hostname, path: '/',
+                    httpOnly: true, secure: new URL(url).protocol === 'https:', sameSite: 'Lax', expires: -1,
+                }] });
+        await openUntilLoaded(app, '/');
         outcome = "signed-in";
     }
     await waitForDesktop(page);

package/dist/error-registry.js

@@ -1,6 +1,14 @@
 import { COMPOSE_ERRORS } from "./standalone/compose-errors.js";
 export const ERROR_REGISTRY = {
     ...COMPOSE_ERRORS,
+    HOST_CERT_CHANGED: { "code": "HOST_CERT_CHANGED", "description": "Strict TLS: the NAS certificate differs from the recorded SHA-256", "suggestion": "Verify old/new fingerprints, then run synopkgland host trust <name>" },
+    HOST_TLS_UNTRUSTED: { "code": "HOST_TLS_UNTRUSTED", "description": "Strict TLS: the NAS certificate failed CA, hostname or validity verification", "suggestion": "Check the CA file, NAS hostname and certificate validity, or omit strict TLS" },
+    HOST_DNS_FAILED: { "code": "HOST_DNS_FAILED", "description": "The NAS hostname could not be resolved", "suggestion": "Check the registered hostname and DNS" },
+    HOST_CONNECTION_REFUSED: { "code": "HOST_CONNECTION_REFUSED", "description": "The NAS refused the connection", "suggestion": "Check the DSM port and NAS availability" },
+    HOST_TIMEOUT: { "code": "HOST_TIMEOUT", "description": "The NAS request timed out", "suggestion": "Check connection and firewall; inspect state before retrying writes" },
+    CTL_HOST_REQUIRED: { "code": "CTL_HOST_REQUIRED", "description": "Select a registered NAS host", "suggestion": "Run synopkgland host add, select --host, or set host default" },
+    CTL_NOT_AUTHENTICATED: { "code": "CTL_NOT_AUTHENTICATED", "description": "The DSM session is absent or expired", "suggestion": "Run synopkgland host login <name>" },
+    NAS_ADMIN_REQUIRED: { "code": "NAS_ADMIN_REQUIRED", "description": "Package installation and removal require an administrator", "suggestion": "Register and log in with a DSM administrator account" },
     INIT_UPSTREAM_INVALID: { code: "INIT_UPSTREAM_INVALID", description: "The upstream repository URL is invalid.", suggestion: "Supply --upstream with an HTTPS repository URL without credentials." },
     INIT_PUBLISHER_INVALID: { code: "INIT_PUBLISHER_INVALID", description: "The attribution name or publisher URL is invalid.", suggestion: "Use plain single-line project/publisher names and an http(s) publisher URL without credentials." },
     UPSTREAM_ATTRIBUTION: { code: "UPSTREAM_ATTRIBUTION", description: "Upstream App attribution is incomplete or names the distributor as maintainer.", suggestion: "Name the original project/team or owner as maintainer; set metadata.maintainer_url to the upstream repository and metadata.distributor/distributor_url to your publisher; resolve TODOs before release." },
@@ -725,16 +733,6 @@ export const ERROR_REGISTRY = {
             description: "Writing a single file needs an architecture.",
             suggestion: "Combine -o with a single --arch, or use --out-dir.",
         },
-        HOST_REQUIRED: {
-            code: "HOST_REQUIRED",
-            description: "No NAS was specified.",
-            suggestion: "Use --host <profile>; for a local deploy check use --dry-run.",
-        },
-        NAS_CREDENTIALS_MISSING: {
-            code: "NAS_CREDENTIALS_MISSING",
-            description: "NAS credentials were not found.",
-            suggestion: "Set a synoagentcli profile or DSM_URL/DSM_PASSWORD.",
-        },
         NATIVE_LAYOUT_SCRIPT_NOT_EXECUTABLE: {
             code: "NATIVE_LAYOUT_SCRIPT_NOT_EXECUTABLE",
             description: "A scripts/ lifecycle script in the native layout metadata is not executable (inspect's SPK_SCRIPT_NOT_EXECUTABLE).",
@@ -1002,8 +1000,8 @@ export const ERROR_REGISTRY = {
         },
         DSM_TLS_UNTRUSTED: {
             code: "DSM_TLS_UNTRUSTED",
-            description: "The DSM TLS certificate is not trusted by this computer (self-signed, expired or a name mismatch).",
-            suggestion: "Export the NAS certificate or its CA as PEM and run with NODE_EXTRA_CA_CERTS=<file>; or give DSM a trusted certificate whose name matches the host profile. Do not disable certificate verification.",
+            description: "Strict TLS: the DSM certificate failed CA, hostname or validity verification",
+            suggestion: "Check the --ca PEM file, NAS hostname and certificate validity; NAS certificates are accepted by default without --strict-tls or --ca",
         },
         STANDALONE_ICON_INVALID: {
             code: "STANDALONE_ICON_INVALID",

package/dist/host/catalog-install.d.ts

@@ -10,15 +10,6 @@ interface CatalogPackageEntry {
     breakpkgs?: unknown;
     replacepkgs?: unknown;
 }
-export interface CatalogInstallOptions {
-    dsmOrigin: string;
-    cookieHeader: string;
-    packageId: string;
-    profileName?: string;
-    expectedVersion?: string;
-    packageSourceOrigin?: string;
-    extraValues?: Record<string, string>;
-}
 export interface InstalledPackageState {
     installed: boolean;
     version?: string;
@@ -75,5 +66,4 @@ export interface LocalSpkInstallOptions {
     extraValues?: Record<string, string>;
 }
 export declare function installPackageFromLocalSpk(options: LocalSpkInstallOptions): Promise<void>;
-export declare function installPackageFromCatalog(options: CatalogInstallOptions): Promise<void>;
 export {};

package/dist/host/catalog-install.js

@@ -1,5 +1,5 @@
+import { CtlError } from '../ctl/errors.js';
 import { readFileSync } from "node:fs";
-import { spawnSync } from "node:child_process";
 import { dsmFetch } from "./dsm-http.js";
 import { assertDsmCompoundResponse } from "./dsm-compound.js";
 function normalizeDeppkgs(deppkgs) {
@@ -31,81 +31,11 @@ async function dsmWebApi(dsmOrigin, cookieHeader, params, options = {}) {
     if (!body.success &&
         !options.allowFailure &&
         !(errorCode && options.allowErrorCodes?.includes(errorCode))) {
-        throw new Error(`DSM ${params.api}/${params.method} failed: ${JSON.stringify(body.error ?? body)}`);
+        throw new Error(`DSM ${params.api}/${params.method} failed: ${Number(body.error?.code) || "invalid response"}`);
     }
     return body;
 }
-async function fetchCatalogEntry(options) {
-    const sid = extractSid(options.cookieHeader);
-    const list = await dsmWebApi(options.dsmOrigin, options.cookieHeader, {
-        api: "SYNO.Core.Package.Server",
-        version: "2",
-        method: "list",
-        blforcereload: "true",
-        blloadothers: "true",
-        _sid: sid,
-    });
-    const data = list.data;
-    const entries = [...(data.packages ?? []), ...(data.beta_packages ?? [])];
-    const entry = entries.find((item) => item.package === options.packageId);
-    if (!entry) {
-        throw new Error(`Package ${options.packageId} not found in Package Source catalog`);
-    }
-    return entry;
-}
-async function fetchCatalogEntryFromOrigin(origin, packageId) {
-    const catalogUrl = `${origin.replace(/\/$/, "")}/?arch=noarch&build=69057&major=7`;
-    try {
-        const response = await dsmFetch(catalogUrl);
-        if (!response.ok) {
-            return undefined;
-        }
-        const data = (await response.json());
-        const entries = [...(data.packages ?? []), ...(data.beta_packages ?? [])];
-        return entries.find((item) => item.package === packageId);
-    }
-    catch {
-        return undefined;
-    }
-}
-async function waitForCatalogEntry(options, expectedVersion) {
-    const deadline = Date.now() + 5 * 60 * 1000;
-    let lastVersion;
-    while (Date.now() < deadline) {
-        const originEntry = options.packageSourceOrigin
-            ? await fetchCatalogEntryFromOrigin(options.packageSourceOrigin, options.packageId)
-            : undefined;
-        const entry = originEntry ?? await fetchCatalogEntry(options);
-        lastVersion = entry.version;
-        if (entry.version === expectedVersion) {
-            return entry;
-        }
-        await new Promise((resolve) => setTimeout(resolve, 5000));
-    }
-    throw new Error(`Package ${options.packageId} catalog shows ${lastVersion ?? "unknown"}; expected ${expectedVersion}`);
-}
-function readInstalledPackageState(packageId, profileName) {
-    const args = ["dsm", "package-center", "get", packageId];
-    if (profileName) {
-        args.push("--host", profileName);
-    }
-    const result = spawnSync("synoagentcli", args, { encoding: "utf8" });
-    if (result.status !== 0) {
-        return undefined;
-    }
-    try {
-        const parsed = JSON.parse(result.stdout);
-        return packageStateFromRecord(parsed.data);
-    }
-    catch {
-        return undefined;
-    }
-}
-function record(value) {
-    return value && typeof value === "object" && !Array.isArray(value)
-        ? value
-        : {};
-}
+function record(value) { return value && typeof value === 'object' && !Array.isArray(value) ? value : {}; }
 function stringValue(...values) {
     return values.find((value) => typeof value === "string" && value.length > 0);
 }
@@ -191,19 +121,17 @@ export async function fetchInstalledPackageState(dsmOrigin, cookieHeader, packag
         });
         return packageStateFromListPayload(body, packageId);
     }
-    catch {
+    catch (error) {
+        if (error instanceof CtlError)
+            throw error;
         return undefined;
     }
 }
-function isPackageInstalled(packageId, profileName) {
-    const state = readInstalledPackageState(packageId, profileName);
-    return state?.installed === true;
-}
 function installStatusIsBroken(status) {
     if (!status) {
         return false;
     }
-    return /(broken|error|fail|installing|150)/i.test(status);
+    return /(broken|error|fail|150)/i.test(status);
 }
 export async function waitForInstalledVersion(readState, options) {
     const deadline = Date.now() + (options.deadlineMs ?? 15 * 60 * 1000);
@@ -213,7 +141,7 @@ export async function waitForInstalledVersion(readState, options) {
         if (state?.installed && installStatusIsBroken(state.status)) {
             throw new Error(`Package ${options.packageId} install did not complete (Package Center status ${state.status}). Check synopkg postinst / webservice acquire.`);
         }
-        if (state?.installed) {
+        if (state?.installed && !/installing|upgrading/i.test(state.status ?? "")) {
             if (!options.expectedVersion || state.version === options.expectedVersion) {
                 return;
             }
@@ -262,14 +190,19 @@ export async function uninstallPackageFromDsm(options) {
     try {
         const sid = extractSid(options.cookieHeader);
         const readState = () => fetchInstalledPackageState(options.dsmOrigin, options.cookieHeader, options.packageId);
-        await dsmWebApi(options.dsmOrigin, options.cookieHeader, {
-            api: "SYNO.Core.Package.Control",
-            version: "1",
-            method: "stop",
-            id: jsonApiParam(options.packageId),
-            _sid: sid,
-        });
-        await waitForPackageStopped(readState, options);
+        const before = await readState();
+        if (!before)
+            throw new Error("Cannot verify package state before removal");
+        if (!packageStatusIsStopped(before)) {
+            await dsmWebApi(options.dsmOrigin, options.cookieHeader, {
+                api: "SYNO.Core.Package.Control",
+                version: "1",
+                method: "stop",
+                id: jsonApiParam(options.packageId),
+                _sid: sid,
+            });
+            await waitForPackageStopped(readState, options);
+        }
         await dsmWebApi(options.dsmOrigin, options.cookieHeader, {
             api: "SYNO.Core.Package.Uninstallation",
             version: "1",
@@ -379,14 +312,14 @@ async function uploadLocalSpk(options, sid) {
     });
     const body = (await uploadResponse.json());
     if (!body.success || !body.data?.id || !body.data.task_id) {
-        throw new Error(`DSM SYNO.Core.Package.Installation/upload failed: ${JSON.stringify(body.error ?? body)}`);
+        throw new Error(`DSM SYNO.Core.Package.Installation/upload failed: ${Number(body.error?.code) || "invalid response"}`);
     }
     return { id: body.data.id, taskId: body.data.task_id };
 }
 export async function installPackageFromLocalSpk(options) {
     const sid = extractSid(options.cookieHeader);
     const dsmState = await fetchInstalledPackageState(options.dsmOrigin, options.cookieHeader, options.packageId);
-    const installed = dsmState?.installed === true || isPackageInstalled(options.packageId, options.profileName);
+    const installed = dsmState?.installed === true;
     const uploaded = await uploadLocalSpk(options, sid);
     const compound = JSON.stringify(catalogCompoundSteps(uploaded, { version: options.version, size: readFileSync(options.spkPath).byteLength }, { blupgrade: installed, extraValues: options.extraValues }));
     const compoundResponse = await dsmWebApi(options.dsmOrigin, options.cookieHeader, {
@@ -399,54 +332,5 @@ export async function installPackageFromLocalSpk(options) {
         _sid: sid,
     }, { allowFailure: true });
     assertDsmCompoundResponse(compoundResponse);
-    await waitForInstalledVersion(async () => (await fetchInstalledPackageState(options.dsmOrigin, options.cookieHeader, options.packageId)) ??
-        readInstalledPackageState(options.packageId, options.profileName), { packageId: options.packageId, expectedVersion: options.version });
-}
-async function uploadCatalogSpk(options, entry, sid) {
-    const response = await dsmFetch(entry.link);
-    if (!response.ok) {
-        throw new Error(`Failed to download catalog SPK for ${entry.package}: HTTP ${response.status}`);
-    }
-    const bytes = Buffer.from(await response.arrayBuffer());
-    const form = new FormData();
-    form.append("api", "SYNO.Core.Package.Installation");
-    form.append("method", "upload");
-    form.append("version", "1");
-    form.append("_sid", sid);
-    form.append("file", new Blob([bytes]), `${entry.package}.spk`);
-    const uploadResponse = await dsmFetch(`${options.dsmOrigin}/webapi/entry.cgi`, {
-        method: "POST",
-        headers: { cookie: options.cookieHeader },
-        body: form,
-    });
-    const body = (await uploadResponse.json());
-    if (!body.success || !body.data?.id || !body.data.task_id) {
-        throw new Error(`DSM SYNO.Core.Package.Installation/upload failed: ${JSON.stringify(body.error ?? body)}`);
-    }
-    return { id: body.data.id, taskId: body.data.task_id };
-}
-async function installCatalogViaUpload(options, entry, sid, installed) {
-    const uploaded = await uploadCatalogSpk(options, entry, sid);
-    const compound = JSON.stringify(catalogCompoundSteps(uploaded, entry, { blupgrade: installed, extraValues: options.extraValues }));
-    const compoundResponse = await dsmWebApi(options.dsmOrigin, options.cookieHeader, {
-        api: "SYNO.Entry.Request",
-        version: "1",
-        method: "request",
-        stop_when_error: "true",
-        mode: jsonApiParam("sequential"),
-        compound,
-        _sid: sid,
-    }, { allowFailure: true });
-    assertDsmCompoundResponse(compoundResponse);
-}
-export async function installPackageFromCatalog(options) {
-    const entry = options.expectedVersion
-        ? await waitForCatalogEntry(options, options.expectedVersion)
-        : await fetchCatalogEntry(options);
-    const sid = extractSid(options.cookieHeader);
-    const dsmState = await fetchInstalledPackageState(options.dsmOrigin, options.cookieHeader, options.packageId);
-    const installed = dsmState?.installed === true || isPackageInstalled(options.packageId, options.profileName);
-    await installCatalogViaUpload(options, entry, sid, installed);
-    await waitForInstalledVersion(async () => (await fetchInstalledPackageState(options.dsmOrigin, options.cookieHeader, options.packageId)) ??
-        readInstalledPackageState(options.packageId, options.profileName), { packageId: options.packageId, expectedVersion: entry.version });
+    await waitForInstalledVersion(async () => await fetchInstalledPackageState(options.dsmOrigin, options.cookieHeader, options.packageId), { packageId: options.packageId, expectedVersion: options.version });
 }

package/dist/host/connection.d.ts

@@ -0,0 +1 @@
+export * from "../nas/connection.js";

package/dist/host/connection.js

@@ -0,0 +1,2 @@
+// Compatibility export; NAS connection implementation lives in one module.
+export * from "../nas/connection.js";

package/dist/host/credentials.d.ts

@@ -1,2 +1 @@
-import type { HostCredentials } from "./types.js";
-export declare function resolveHostCredentials(hostName?: string): HostCredentials | null;
+export * from "../nas/credentials.js";