@synopackageland/cli 0.32.1 → 0.33.1

package/dist/host/credentials.js

@@ -1,67 +1,2 @@
-import { readFileSync } from "node:fs";
-import { homedir } from "node:os";
-import { join } from "node:path";
-function findProfile(settings, input) {
-    if (!input) {
-        return settings.hosts?.[settings.defaultHost ?? "default"];
-    }
-    // 1. Direct match by profile name
-    if (settings.hosts?.[input]) {
-        return settings.hosts[input];
-    }
-    // 2. Match by URL hostname or exact URL
-    for (const profile of Object.values(settings.hosts ?? {})) {
-        if (profile?.url) {
-            try {
-                const u = new URL(profile.url);
-                if (u.hostname === input ||
-                    profile.url === input ||
-                    profile.url.replace(/\/$/, "") === input.replace(/\/$/, "")) {
-                    return profile;
-                }
-            }
-            catch {
-                // ignore invalid URL
-            }
-        }
-    }
-    return undefined;
-}
-export function resolveHostCredentials(hostName) {
-    const settingsPath = join(homedir(), ".synoagentcli", "setting.json");
-    let settings;
-    try {
-        settings = JSON.parse(readFileSync(settingsPath, "utf8"));
-    }
-    catch {
-        return fromEnv(hostName);
-    }
-    const profile = findProfile(settings, hostName);
-    const username = profile?.username ?? profile?.auth?.username;
-    const password = profile?.password ?? profile?.auth?.password;
-    if (profile?.url && username && password) {
-        return {
-            dsmOrigin: profile.url,
-            username,
-            password,
-        };
-    }
-    if (profile?.url) {
-        return fromEnv(profile.url);
-    }
-    return fromEnv(hostName);
-}
-function fromEnv(urlOverride) {
-    let dsmOrigin = process.env.DSM_URL;
-    if (urlOverride) {
-        dsmOrigin = urlOverride.startsWith("http://") || urlOverride.startsWith("https://")
-            ? urlOverride
-            : `https://${urlOverride}:5001`;
-    }
-    const password = process.env.DSM_PASSWORD;
-    const username = process.env.DSM_USERNAME ?? "admin";
-    if (!dsmOrigin || !password) {
-        return null;
-    }
-    return { dsmOrigin, username, password };
-}
+// Compatibility export; NAS connection implementation lives in one module.
+export * from "../nas/credentials.js";

package/dist/host/dsm-client.d.ts

@@ -5,17 +5,15 @@ export interface CreateNasHostOptions {
     credentials?: HostCredentials;
 }
 export declare function createNasHost(options?: CreateNasHostOptions): NasHost | null;
-declare function synoagentcli(args: string[], profileName?: string): {
-    status: number | null;
-    stdout: string;
-    stderr: string;
-};
 /**
  * DSM's User Home read reports the selected volume, not the final share path.
  * Keep the projection strict: an unexpected response must not become a host
  * bind to an arbitrary path.
  */
-export declare function homesPathFromDsmUserHomeRead(result: Pick<ReturnType<typeof synoagentcli>, "status" | "stdout">): string | undefined;
+export declare function homesPathFromDsmUserHomeRead(result: {
+    status: number | null;
+    stdout: string;
+}): string | undefined;
 /**
  * DSM reports the CPU vendor, not the ISA. Every x86_64 platform Synology
  * ships is Intel or AMD; the aarch64 ones are Realtek (rtd1296, rtd1619b) and
@@ -26,4 +24,3 @@ export declare function homesPathFromDsmUserHomeRead(result: Pick<ReturnType<typ
  * unusable SPK.
  */
 export declare function archFamilyForCpuVendor(vendor: string | undefined): NativeArchFamily | undefined;
-export {};

package/dist/host/dsm-client.js

@@ -1,11 +1,12 @@
-import { spawnSync } from "node:child_process";
-import { listShareNamesWithSynoagentcli, lookupSharePathWithSynoagentcli, } from "./share-lookup.js";
-import { createSynoagentcliApiCall, fetchSharePermissions, fetchUserGroups, } from "./share-permission-lookup.js";
+import { sessionForCredentials } from "../nas/credentials.js";
+import { CtlError } from '../ctl/errors.js';
+import { listShareNames, lookupSharePath, } from "./share-lookup.js";
+import { createDsmApiCall, fetchSharePermissions, fetchUserGroups, } from "./share-permission-lookup.js";
 import { fetchPortInfo } from "./port-info-lookup.js";
 import { dsmFetch } from "./dsm-http.js";
 import { versionUnsupported } from "../runtime/dsm-version.js";
 import { fetchDsmPortProfileInventory } from "./dsm-port-profile.js";
-import { installPackageFromLocalSpk, fetchInstalledPackageState, packageStateFromRecord, } from "./catalog-install.js";
+import { installPackageFromLocalSpk, fetchInstalledPackageState, } from "./catalog-install.js";
 import { resolveHostCredentials } from "./credentials.js";
 export function createNasHost(options = {}) {
     const credentials = options.credentials ?? resolveHostCredentials(options.host);
@@ -14,18 +15,6 @@ export function createNasHost(options = {}) {
     }
     return createDsmNasHost(credentials, options.host);
 }
-function synoagentcli(args, profileName) {
-    const fullArgs = [...args];
-    if (profileName) {
-        fullArgs.push("--host", profileName);
-    }
-    const result = spawnSync("synoagentcli", fullArgs, { encoding: "utf8" });
-    return {
-        status: result.status,
-        stdout: result.stdout ?? "",
-        stderr: result.stderr ?? "",
-    };
-}
 /**
  * DSM's User Home read reports the selected volume, not the final share path.
  * Keep the projection strict: an unexpected response must not become a host
@@ -68,29 +57,10 @@ function createDsmNasHost(credentials, profileName) {
     const dsmOrigin = credentials.dsmOrigin.replace(/\/$/, "");
     let cookieHeader = credentials.cookieHeader;
     const ensureLogin = async () => {
-        if (cookieHeader) {
-            return;
+        if (!cookieHeader) {
+            const session = await sessionForCredentials(credentials);
+            cookieHeader = session.cookie;
         }
-        const query = new URLSearchParams({
-            api: "SYNO.API.Auth",
-            version: "3",
-            method: "login",
-            account: credentials.username,
-            passwd: credentials.password,
-            session: "FileStation",
-            format: "cookie",
-        });
-        const response = await dsmFetch(`${dsmOrigin}/webapi/entry.cgi`, {
-            method: "POST",
-            headers: { "content-type": "application/x-www-form-urlencoded" },
-            body: query,
-        });
-        const login = (await response.json());
-        if (!response.ok || login.success !== true)
-            throw new Error("DSM login failed");
-        cookieHeader = setCookiePairs(response.headers).join("; ");
-        if (!cookieHeader)
-            throw new Error("DSM login returned no session cookie");
     };
     /**
      * One read-only call of the App's own CGI as the administrator. identity:
@@ -129,10 +99,21 @@ function createDsmNasHost(credentials, profileName) {
             await appCall("identity.logout", appCookie).catch(() => undefined);
         }
     };
+    const call = async (api, method, version, params = {}) => {
+        await ensureLogin();
+        const response = await dsmFetch(`${dsmOrigin}/webapi/entry.cgi`, { method: 'POST', headers: { cookie: cookieHeader ?? '', 'content-type': 'application/x-www-form-urlencoded' }, body: new URLSearchParams({ api, method, version: String(version), ...params }) });
+        const body = await response.json();
+        if (body?.success !== true)
+            throw Object.assign(new Error(`DSM ${api}/${method} failed (${Number(body?.error?.code) || 'invalid response'})`), { code: body?.error?.code });
+        return body;
+    };
     return {
         dsmOrigin,
         async installFromLocalSpk(input) {
             await ensureLogin();
+            const members = await call('SYNO.Core.Group.Member', 'list', 1, { group: 'administrators', offset: '0', limit: '-1' });
+            if (!Array.isArray(members.data?.users) || !members.data.users.some((u) => u.name === credentials.username))
+                throw new CtlError('NAS_ADMIN_REQUIRED', 'Package installation requires a DSM administrator account', 'Log in with a DSM administrator account', 4);
             await installPackageFromLocalSpk({
                 dsmOrigin,
                 cookieHeader: cookieHeader ?? "",
@@ -154,7 +135,9 @@ function createDsmNasHost(credentials, profileName) {
                     return { ready: false, executor_digest: "", policy_digest: "", error: read.error };
                 return explain(read.data);
             }
-            catch {
+            catch (error) {
+                if (error instanceof CtlError)
+                    throw error;
                 return undefined;
             }
         },
@@ -163,7 +146,9 @@ function createDsmNasHost(credentials, profileName) {
                 const read = await readApp(packageIdentity, "portal.status");
                 return read && "data" in read ? read.data : undefined;
             }
-            catch {
+            catch (error) {
+                if (error instanceof CtlError)
+                    throw error;
                 return undefined;
             }
         },
@@ -218,110 +203,57 @@ function createDsmNasHost(credentials, profileName) {
             const response = await dsmFetch(`${dsmOrigin}/webapi/entry.cgi?api=SYNO.Core.System&version=1&method=info`, { headers: { cookie: cookieHeader ?? "" } });
             const body = (await response.json());
             if (body.success !== true) {
+                if (Number(body.error?.code) === 105)
+                    throw new CtlError('NAS_ADMIN_REQUIRED', 'NAS deployment requires a DSM administrator account', 'Log in with a DSM administrator account', 4);
                 return undefined;
             }
             return archFamilyForCpuVendor(body.data?.cpu_vendor);
         },
         async resolveSharePath(logicalName) {
-            return lookupSharePathWithSynoagentcli(logicalName, profileName);
+            return lookupSharePath(logicalName, call);
         },
         async listShareNames() {
-            return listShareNamesWithSynoagentcli(profileName);
+            return listShareNames(call);
         },
         async listSharePermissions(logicalName) {
-            return fetchSharePermissions(logicalName, createSynoagentcliApiCall(profileName));
+            return fetchSharePermissions(logicalName, createDsmApiCall(call));
         },
         async listUserGroups(userName) {
-            return fetchUserGroups(userName, createSynoagentcliApiCall(profileName));
+            return fetchUserGroups(userName, createDsmApiCall(call));
         },
         async listPortInfo() {
             try {
                 await ensureLogin();
                 return fetchPortInfo(dsmOrigin, cookieHeader ?? "");
             }
-            catch {
+            catch (error) {
+                if (error instanceof CtlError)
+                    throw error;
                 return undefined;
             }
         },
         async resolveHomesPath() {
-            try {
-                const result = synoagentcli([
-                    "dsm",
-                    "control-panel",
-                    "user-group",
-                    "advanced",
-                    "get",
-                    "--section",
-                    "home",
-                ], profileName);
-                return homesPathFromDsmUserHomeRead(result);
-            }
-            catch {
-                return undefined;
-            }
+            const body = await call('SYNO.Core.User.Home', 'get', 1);
+            return homesPathFromDsmUserHomeRead({ status: 0, stdout: JSON.stringify(body) });
         },
         async getInstalledPackageState(packageIdentity) {
             await ensureLogin();
-            const viaDsm = await fetchInstalledPackageState(dsmOrigin, cookieHeader ?? "", packageIdentity);
-            if (viaDsm) {
-                return viaDsm;
-            }
-            const result = synoagentcli(["dsm", "package-center", "get", packageIdentity], profileName);
-            if (result.status !== 0) {
-                return undefined;
-            }
-            try {
-                const parsed = JSON.parse(result.stdout);
-                return packageStateFromRecord(parsed.data);
-            }
-            catch {
-                return undefined;
-            }
-        },
-        async getInstalledPackageVersion(packageIdentity) {
-            await ensureLogin();
-            const viaDsm = await fetchInstalledPackageState(dsmOrigin, cookieHeader ?? "", packageIdentity);
-            if (viaDsm?.version) {
-                return viaDsm.version;
-            }
-            const result = synoagentcli(["dsm", "package-center", "get", packageIdentity], profileName);
-            if (result.status !== 0) {
-                return undefined;
-            }
-            try {
-                const parsed = JSON.parse(result.stdout);
-                return parsed.data?.version;
-            }
-            catch {
-                return undefined;
-            }
-        },
-        async isPackageInstalled(packageIdentity) {
-            await ensureLogin();
-            const viaDsm = await fetchInstalledPackageState(dsmOrigin, cookieHeader ?? "", packageIdentity);
-            if (viaDsm) {
-                return viaDsm.installed;
-            }
-            const result = synoagentcli(["dsm", "package-center", "get", packageIdentity], profileName);
-            return result.status === 0;
+            return fetchInstalledPackageState(dsmOrigin, cookieHeader ?? '', packageIdentity);
         },
+        async getInstalledPackageVersion(packageIdentity) { return (await this.getInstalledPackageState(packageIdentity))?.version; },
+        async isPackageInstalled(packageIdentity) { return (await this.getInstalledPackageState(packageIdentity))?.installed === true; },
         async fetchContainerLogs(packageIdentity) {
-            const result = synoagentcli(["dsm", "package-center", "status", packageIdentity], profileName);
-            if (result.status !== 0) {
-                return [];
-            }
-            return result.stdout
-                .split("\n")
-                .map((line) => line.trim())
-                .filter(Boolean)
-                .map((line) => `[status] ${line}`);
+            const state = await this.getInstalledPackageState(packageIdentity);
+            return state?.installed ? [`[status] ${state.status ?? 'unknown'} ${state.version ?? ''}`] : [];
         },
         async getDsmPortProfileInventory() {
             try {
                 await ensureLogin();
                 return await fetchDsmPortProfileInventory(dsmOrigin, cookieHeader ?? "");
             }
-            catch {
+            catch (error) {
+                if (error instanceof CtlError)
+                    throw error;
                 return undefined;
             }
         },

package/dist/host/dsm-http.d.ts

@@ -1 +1 @@
-export declare function dsmFetch(url: string, init?: RequestInit): Promise<Response>;
+export { dsmFetch, registerDsmSession } from '../nas/http.js';

package/dist/host/dsm-http.js

@@ -1,124 +1,2 @@
-import { spawnSync } from "node:child_process";
-import { mkdtempSync, readFileSync, rmSync, writeFileSync } from "node:fs";
-import { tmpdir } from "node:os";
-import { join } from "node:path";
-function errorCode(error) {
-    return error.cause?.code
-        ?? error.code;
-}
-function isHostUnreachable(error) {
-    const code = errorCode(error);
-    return code === "EHOSTUNREACH" || code === "ENETUNREACH";
-}
-const UNTRUSTED_CERTIFICATE = new Set([
-    "DEPTH_ZERO_SELF_SIGNED_CERT",
-    "SELF_SIGNED_CERT_IN_CHAIN",
-    "UNABLE_TO_VERIFY_LEAF_SIGNATURE",
-    "UNABLE_TO_GET_ISSUER_CERT_LOCALLY",
-    "CERT_HAS_EXPIRED",
-    "ERR_TLS_CERT_ALTNAME_INVALID",
-]);
-/** Node reports an untrusted certificate only as "fetch failed"; say what to do. Verification stays on. */
-function untrustedCertificate(url, code) {
-    const origin = new URL(url).origin;
-    return Object.assign(new Error(`DSM at ${origin} presented a TLS certificate this computer does not trust (${code}). ` +
-        `Export the NAS certificate or its CA as PEM and run with NODE_EXTRA_CA_CERTS=<that file>, ` +
-        `or give DSM a certificate whose name matches the host profile. Certificate checks stay on.`), { code: "DSM_TLS_UNTRUSTED" });
-}
-function headerRecord(headers) {
-    if (!headers) {
-        return {};
-    }
-    if (headers instanceof Headers) {
-        return Object.fromEntries(headers.entries());
-    }
-    if (Array.isArray(headers)) {
-        return Object.fromEntries(headers);
-    }
-    return { ...headers };
-}
-export async function dsmFetch(url, init = {}) {
-    try {
-        return await fetch(url, init);
-    }
-    catch (error) {
-        const code = errorCode(error);
-        if (code && UNTRUSTED_CERTIFICATE.has(code)) {
-            throw untrustedCertificate(url, code);
-        }
-        if (!isHostUnreachable(error)) {
-            throw error;
-        }
-        return curlFetch(url, init);
-    }
-}
-function curlConfigString(value) {
-    const escapes = { "\\": "\\\\", '"': '\\"', "\t": "\\t", "\n": "\\n", "\r": "\\r", "\v": "\\v" };
-    return `"${value.replace(/[\\"\t\n\r\v]/g, (c) => escapes[c])}"`;
-}
-async function curlFetch(url, init) {
-    const staging = mkdtempSync(join(tmpdir(), "synopkgland-dsm-http-"));
-    const headerFile = join(staging, "headers");
-    const bodyFile = join(staging, "body");
-    try {
-        const configFile = join(staging, "config");
-        const args = ["-sS", "-D", headerFile, "-o", bodyFile, "-w", "%{http_code}", "-X", init.method ?? "GET", "-K", configFile];
-        // Headers and form text go through a private config file, not argv, and
-        // form text is sent literally (curl -F would read "@file" and "<file").
-        const config = [];
-        const headers = headerRecord(init.headers);
-        for (const [name, value] of Object.entries(headers)) {
-            if (name.toLowerCase() === "content-type" && init.body instanceof FormData) {
-                continue;
-            }
-            if (/[\r\n\0]/.test(name + value)) {
-                throw new Error(`Invalid header value: ${name}`);
-            }
-            config.push(`header = ${curlConfigString(`${name}: ${value}`)}`);
-        }
-        let stdin;
-        if (init.body instanceof FormData) {
-            for (const [name, value] of init.body.entries()) {
-                if (typeof value === "string") {
-                    if (/[=\0]/.test(name) || value.includes("\0")) {
-                        throw new Error(`Invalid form field: ${name}`);
-                    }
-                    config.push(`form-string = ${curlConfigString(`${name}=${value}`)}`);
-                    continue;
-                }
-                const filename = "name" in value && typeof value.name === "string" ? value.name : "upload.bin";
-                const partPath = join(staging, filename);
-                writeFileSync(partPath, Buffer.from(await value.arrayBuffer()));
-                config.push(`form = ${curlConfigString(`${name}=@${partPath};filename=${filename}`)}`);
-            }
-        }
-        else if (typeof init.body === "string") {
-            stdin = Buffer.from(init.body);
-            args.push("--data-binary", "@-");
-        }
-        else if (init.body) {
-            stdin = Buffer.from(await new Response(init.body).arrayBuffer());
-            args.push("--data-binary", "@-");
-        }
-        writeFileSync(configFile, config.map((line) => line + "\n").join(""), { mode: 0o600 });
-        args.push(url);
-        const result = spawnSync("curl", args, { encoding: "utf8", input: stdin });
-        if (result.status !== 0) {
-            throw new Error(result.stderr || `curl exit ${result.status}`);
-        }
-        const status = Number((result.stdout ?? "").trim().slice(-3));
-        const rawHeaders = readFileSync(headerFile, "utf8");
-        const body = readFileSync(bodyFile);
-        const responseHeaders = new Headers();
-        for (const line of rawHeaders.split(/\r?\n/)) {
-            const idx = line.indexOf(":");
-            if (idx > 0) {
-                responseHeaders.append(line.slice(0, idx).trim(), line.slice(idx + 1).trim());
-            }
-        }
-        return new Response(body, { status: Number.isInteger(status) ? status : 502, headers: responseHeaders });
-    }
-    finally {
-        rmSync(staging, { recursive: true, force: true });
-    }
-}
+// Compatibility export; every DSM request uses the shared NAS connection module.
+export { dsmFetch, registerDsmSession } from '../nas/http.js';

package/dist/host/dsm-port-profile.js

@@ -1,3 +1,4 @@
+import { CtlError } from '../ctl/errors.js';
 import { basename } from "node:path";
 import { composeProjectName } from "../build-spk/resource-worker.js";
 import { dsmFetch } from "./dsm-http.js";
@@ -169,7 +170,9 @@ async function fetchJson(dsmOrigin, cookieHeader, params) {
     try {
         return await response.json();
     }
-    catch {
+    catch (error) {
+        if (error instanceof CtlError)
+            throw error;
         return undefined;
     }
 }
@@ -200,7 +203,9 @@ export async function fetchDsmPortProfileInventory(dsmOrigin, cookieHeader) {
         });
         return dsmPortProfileInventoryFromPayloads(portInfoPayload, packageListPayload);
     }
-    catch {
+    catch (error) {
+        if (error instanceof CtlError)
+            throw error;
         return undefined;
     }
 }

package/dist/host/install-plan.d.ts

@@ -0,0 +1,32 @@
+export interface NasTarget {
+    arch: string;
+    version: string;
+    build: number;
+    major: number;
+    minor: number;
+}
+export interface StoreEntry {
+    package: string;
+    version: string;
+    link: string;
+    size: number;
+    md5?: string;
+    sha256?: string;
+    arch?: string | string[];
+    os_min_ver?: string;
+    os_max_ver?: string;
+    deppkgs?: unknown;
+}
+export declare function compareVersions(a: string, b: string): number;
+export declare function archMatches(value: string | string[] | undefined, arch: string): boolean;
+export declare function assertCompatible(info: Record<string, string>, target: NasTarget): void;
+export declare function sourceUrl(source: string, target: NasTarget): URL;
+export declare function selectEntry(entries: StoreEntry[], id: string, version: string | undefined, target: NasTarget): StoreEntry;
+export interface Dependency {
+    id: string;
+    constraints: Record<string, string>;
+}
+export declare function dependencies(value: unknown): Dependency[];
+export declare function satisfies(version: string, dependency: Dependency): boolean;
+export declare function resolveInstallPlan(root: StoreEntry, entries: StoreEntry[], target: NasTarget, installed: Map<string, string>): StoreEntry[];
+export declare function verifyPins(bytes: Buffer, entry: Pick<StoreEntry, "size" | "md5" | "sha256">): void;