@synopackageland/cli 0.33.0 → 0.33.1

package/dist/ctl/transfers.js

@@ -1,78 +1,2 @@
-import { pinnedAgent, networkError, timeoutError } from './tls.js';
-import { createReadStream, statSync } from 'node:fs';
-import http from 'node:http';
-import https from 'node:https';
-import { CtlError } from './errors.js';
-import { CTL_TIMEOUT_MS } from './transport.js';
-export function localFile(file) { if (typeof file !== 'string' || !file)
-    throw new CtlError('CTL_INPUT_FILE', 'A local filename is required.', 'Use --file <path>.'); try {
-    const stat = statSync(file);
-    if (!stat.isFile() || stat.size > 16 * 1024 ** 3)
-        throw Error();
-    return { file, size: stat.size };
-}
-catch {
-    throw new CtlError('CTL_INPUT_FILE', 'Upload must be a readable regular file of at most 16 GiB.', 'Check --file <path>.');
-} }
-export async function transferRequest(session, path, method, params, options = {}) {
-    if (!/^\/webman\/3rdparty\/[A-Za-z][A-Za-z0-9_.+-]*\/cgi\/api\.cgi$/.test(path) || !/^([a-z][a-z0-9_]*\.)+[a-z][a-z0-9_]*$/.test(method))
-        throw new CtlError('CTL_PATH_INVALID', 'Invalid transfer binding.', 'Refresh the API description.', 4);
-    if (options.timeoutMs !== undefined && options.timeoutMs <= 0)
-        throw new CtlError('CTL_NETWORK', 'Transfer budget exhausted before dispatch.', 'Check App state before retrying writes.', 6);
-    const url = new URL(path, session.origin);
-    const file = options.file ? localFile(options.file.path) : undefined;
-    if (options.file) {
-        url.search = new URLSearchParams({ method, parent: options.file.parent, name: options.file.name }).toString();
-    }
-    const raw = file ? undefined : Buffer.from(JSON.stringify({ method, params }));
-    return new Promise((resolve, reject) => {
-        const headers = { 'content-type': file ? 'application/octet-stream' : 'application/json', cookie: session.cookie, 'X-SYNO-TOKEN': session.token, origin: session.origin, 'content-length': String(file?.size ?? raw.length) };
-        const req = (url.protocol === 'https:' ? https : http).request(url, { method: 'POST', headers, timeout: options.timeoutMs ?? CTL_TIMEOUT_MS, ...(options.ca ? { ca: options.ca } : {}), ...(url.protocol === 'https:' && options.trust?.fingerprint ? { agent: pinnedAgent(session.origin, options.trust, options.timeoutMs ?? CTL_TIMEOUT_MS) } : {}) }, res => {
-            const expected = file ? 'application/json' : 'application/x-ndjson';
-            if (res.statusCode !== 200 || !res.headers['content-type']?.includes(expected)) {
-                res.resume();
-                reject(new CtlError('CTL_TRANSFER_FAILED', 'Unexpected transfer response; redirects are refused.', 'Check App transfer support.', 5));
-                return;
-            }
-            const chunks = [];
-            let total = 0;
-            res.on('data', (chunk) => { total += chunk.length; if (total > (file ? 1048576 : 8 * 1048576)) {
-                req.destroy();
-                reject(new CtlError('CTL_FLOW_LIMIT', 'Transfer result exceeds collection limit.', 'Narrow the query.', 5));
-            }
-            else
-                chunks.push(chunk); });
-            res.on('error', () => reject(new CtlError('CTL_NETWORK', 'Transfer response interrupted.', 'Check state before retrying writes.', 6)));
-            res.on('end', () => { try {
-                const text = Buffer.concat(chunks).toString('utf8');
-                if (file) {
-                    const body = JSON.parse(text);
-                    if (body.success !== true)
-                        throw Error();
-                    resolve(body.data);
-                }
-                else {
-                    const lines = text.split('\n').filter(l => l.trim());
-                    if (lines.length > 10000)
-                        throw Error();
-                    resolve({ items: lines.map(line => JSON.parse(line)) });
-                }
-            }
-            catch {
-                reject(new CtlError('CTL_TRANSFER_FAILED', 'Invalid or failed transfer response.', 'Inspect the App result; do not retry writes blindly.', 5));
-            } });
-        });
-        const wallTimer = setTimeout(() => req.destroy(timeoutError()), options.timeoutMs ?? CTL_TIMEOUT_MS);
-        req.once('close', () => clearTimeout(wallTimer));
-        req.on('timeout', () => req.destroy(timeoutError()));
-        req.on('error', e => reject(networkError(e)));
-        if (file) {
-            const source = createReadStream(file.file);
-            source.on('error', () => req.destroy());
-            req.on('close', () => source.destroy());
-            source.pipe(req);
-        }
-        else
-            req.end(raw);
-    });
-}
+// Compatibility export; NAS connection implementation lives in one module.
+export * from "../nas/transfers.js";

package/dist/ctl/transport.d.ts

@@ -1,14 +1 @@
-import { type HostTls } from './tls.js';
-export declare const CTL_TIMEOUT_MS = 62000;
-export declare const APP_COOKIE: unique symbol;
-export interface DsmSession {
-    origin: string;
-    username: string;
-    cookie: string;
-    token: string;
-    deviceId?: string;
-}
-export type JsonRequest = (path: string, body: URLSearchParams | Record<string, unknown>, session?: DsmSession) => Promise<any>;
-export declare function canonicalOrigin(input: string, tunnel?: boolean): string;
-export declare function createRequest(origin: string, timeoutMs?: number | (() => number), ca?: string, trust?: HostTls): JsonRequest;
-export declare function sessionFetch(url: string, init: RequestInit, session: DsmSession, ca?: string, trust?: HostTls): Promise<Response>;
+export * from "../nas/transport.js";

package/dist/ctl/transport.js

@@ -1,113 +1,2 @@
-import { pinnedAgent, networkError, timeoutError } from './tls.js';
-import { strictJson } from './json.js';
-import http from 'node:http';
-import https from 'node:https';
-import { CtlError } from './errors.js';
-export const CTL_TIMEOUT_MS = 62000;
-export const APP_COOKIE = Symbol("ctlAppCookie");
-export function canonicalOrigin(input, tunnel = false) {
-    let url;
-    try {
-        url = new URL(input);
-    }
-    catch {
-        throw new CtlError('CTL_URL_INVALID', 'A NAS origin URL is required.', 'run: synopkgland host add <name> --url https://<nas>:5001');
-    }
-    if (url.username || url.password || url.search || url.hash || url.pathname !== '/' || !(url.protocol === 'https:' || (tunnel && url.protocol === 'http:' && ['127.0.0.1', '[::1]'].includes(url.hostname))))
-        throw new CtlError('CTL_URL_INVALID', 'Use HTTPS, or explicit --ssh-tunnel for a loopback HTTP tunnel.', 'run: synopkgland host add <name> --url https://<nas>:5001');
-    return url.origin;
-}
-export function createRequest(origin, timeoutMs = CTL_TIMEOUT_MS, ca, trust) {
-    return async (path, body, session) => {
-        if (!path.startsWith('/') || path.startsWith('//') || path.includes('?') || path.includes('#') || path.includes('\\') || path.includes('%') || path.split('/').some(p => p === '.' || p === '..'))
-            throw new CtlError('CTL_PATH_INVALID', 'Unsafe request path.', 'run: synopkgland ctl list --refresh');
-        const remaining = typeof timeoutMs === 'function' ? timeoutMs() : timeoutMs;
-        if (remaining <= 0)
-            throw new CtlError('CTL_NETWORK', 'Request budget exhausted before dispatch.', 'Check App state before retrying writes.', 6);
-        const url = new URL(path, origin);
-        if (url.origin !== origin || (session && session.origin !== origin))
-            throw new CtlError('CTL_ORIGIN_MISMATCH', 'Credentials cannot cross NAS origins.', 'run: synopkgland host list', 4);
-        const form = body instanceof URLSearchParams;
-        const payload = Buffer.from(form ? body.toString() : JSON.stringify(body));
-        if (payload.length > 1048576)
-            throw new CtlError('CTL_INPUT_TOO_LARGE', 'Request exceeds 1 MiB.', 'Reduce the input.');
-        return new Promise((resolve, reject) => {
-            const headers = { 'content-type': form ? 'application/x-www-form-urlencoded' : 'application/json', accept: 'application/json', 'content-length': String(payload.length), origin };
-            if (session) {
-                headers.cookie = session.cookie;
-                headers['X-SYNO-TOKEN'] = session.token;
-            }
-            const req = (url.protocol === 'https:' ? https : http).request(url, { method: 'POST', headers, timeout: remaining, ...(ca ? { ca } : {}), ...(url.protocol === 'https:' && trust?.fingerprint ? { agent: pinnedAgent(origin, trust, remaining) } : {}) }, res => {
-                if (!res.statusCode || res.statusCode < 200 || res.statusCode >= 300) {
-                    res.resume();
-                    reject(new CtlError('CTL_HTTP_ERROR', `HTTP ${res.statusCode}; redirects are never followed.`, 'Check the NAS URL and connection.', 6));
-                    return;
-                }
-                if (!res.headers['content-type']?.includes('application/json')) {
-                    res.resume();
-                    reject(new CtlError('CTL_RESPONSE_INVALID', 'NAS returned non-JSON data.', 'Check the endpoint and installed package.', 5));
-                    return;
-                }
-                const chunks = [];
-                let length = 0;
-                res.on('data', (c) => { length += c.length; if (length > 1048576) {
-                    res.destroy();
-                    reject(new CtlError('CTL_RESPONSE_TOO_LARGE', 'Response exceeds 1 MiB.', 'Use a smaller operation.', 5));
-                }
-                else
-                    chunks.push(c); });
-                res.on('error', () => reject(new CtlError('CTL_NETWORK', 'Response interrupted.', 'Check the NAS connection; state-changing requests are not replayed.', 6)));
-                res.on('end', () => {
-                    try {
-                        const body = strictJson(Buffer.concat(chunks));
-                        if (!form && body?.success === true && body.data && path.startsWith('/webman/3rdparty/') && url.protocol === 'https:') {
-                            const cookies = (res.headers['set-cookie'] ?? []).filter(line => /;\s*Secure(?:;|$)/i.test(line) && /;\s*HttpOnly(?:;|$)/i.test(line) && !/;\s*Domain=/i.test(line));
-                            const own = path.slice(0, path.lastIndexOf('/cgi/')) + '/';
-                            const valid = cookies.filter(line => { const match = /;\s*Path=([^;]+)/i.exec(line); return match?.[1] === own; }).map(line => line.split(';')[0]).filter(pair => !pair.startsWith('id='));
-                            if (valid.length)
-                                Object.defineProperty(body, APP_COOKIE, { value: valid.join('; '), enumerable: false });
-                        }
-                        resolve(body);
-                    }
-                    catch {
-                        reject(new CtlError('CTL_RESPONSE_INVALID', 'Invalid JSON response.', 'Check the installed package.', 5));
-                    }
-                });
-            });
-            const wallTimer = setTimeout(() => req.destroy(timeoutError()), remaining);
-            req.once('close', () => clearTimeout(wallTimer));
-            req.on('timeout', () => req.destroy(timeoutError()));
-            req.on('error', error => reject(networkError(error)));
-            req.end(payload);
-        });
-    };
-}
-export async function sessionFetch(url, init, session, ca, trust) {
-    if (new URL(url).origin !== session.origin)
-        throw new CtlError('CTL_ORIGIN_MISMATCH', 'Credentials cannot cross NAS origins', 'Check the registered NAS origin', 4);
-    const headers = new Headers(init.headers);
-    headers.set('cookie', session.cookie);
-    headers.set('X-SYNO-TOKEN', session.token);
-    const request = new Request(url, { ...init, headers }), bytes = init.body ? Buffer.from(await request.arrayBuffer()) : undefined;
-    return new Promise((resolve, reject) => {
-        const target = new URL(url);
-        const req = (target.protocol === 'https:' ? https : http).request(target, { method: request.method, headers: Object.fromEntries(request.headers), ca, timeout: 62000, ...(trust?.fingerprint && target.protocol === 'https:' ? { agent: pinnedAgent(target.origin, trust, 62000) } : {}) }, res => {
-            const chunks = [];
-            let length = 0;
-            res.on('data', c => { length += c.length; if (length > 16 * 1024 * 1024)
-                res.destroy(new CtlError('CTL_RESPONSE_TOO_LARGE', 'DSM response exceeds 16 MiB', 'Use a narrower operation', 5));
-            else
-                chunks.push(c); });
-            res.on('error', () => reject(new CtlError('DSM_NETWORK', 'DSM response interrupted', 'Check the NAS connection', 6)));
-            res.on('end', () => { const headers = new Headers(); for (const [k, v] of Object.entries(res.headers))
-                for (const x of Array.isArray(v) ? v : [v])
-                    if (x !== undefined)
-                        headers.append(k, x); resolve(new Response(Buffer.concat(chunks), { status: res.statusCode, headers })); });
-        });
-        const timer = setTimeout(() => req.destroy(timeoutError()), 62000);
-        req.once('close', () => clearTimeout(timer));
-        req.on('timeout', () => req.destroy(timeoutError()));
-        req.on('error', e => reject(networkError(e)));
-        req.end(bytes);
-    });
-}
+// Compatibility export; NAS connection implementation lives in one module.
+export * from "../nas/transport.js";

package/dist/e2e/dsm.d.ts

@@ -129,10 +129,10 @@ export declare function dismissNotifications(page?: Page, env?: Env): Promise<nu
 /**
  * Whether the signed-in desktop's session is usable: it holds a SynoToken
  * (a restored `stay_login` cookie alone yields none, and the app's CGIs then
- * answer 119) and DSM's login.cgi, asked from the page, still accepts the
+ * answer 119) and DSM's login.cgi, asked through the shared NAS transport, still accepts the
  * session. Any failure to ask counts as not live.
  */
-export declare function dsmSessionLive(page: Pick<SessionPage, "evaluate">): Promise<boolean>;
+export declare function dsmSessionLive(page: Pick<SessionPage, "evaluate">, check?: (token: string) => Promise<boolean>, env?: Env): Promise<boolean>;
 /**
  * `app.open(path)`, once more after net::ERR_ABORTED: about one first
  * navigation in ten was aborted as DSM's desktop navigated on its own, and the

package/dist/e2e/dsm.js

@@ -1,5 +1,5 @@
 // DSM helpers for package e2e suites on upstream `e2e` + `@e2e-dev/web`.
-// One self-contained file: a package may copy it verbatim to tests/e2e/support/dsm.ts.
+// Import through @synopackageland/cli/e2e to share the CLI NAS connection path.
 // It signs in once per run (a saved, private profile is restored when still valid),
 // opens DSM app windows and Application Portal pages (accepting their native
 // dialogs when given the `browser` fixture), dismisses DSM notifications,
@@ -9,6 +9,9 @@
 // e2e output, which is made private (directories 700, files 600).
 //
 //   node tests/e2e/support/dsm.ts tunnel -- npx e2e run
+import { loginDsm } from "../nas/auth.js";
+import { sessionFetch } from "../nas/transport.js";
+import { canonicalOrigin } from "../nas/transport.js";
 import { spawn } from "node:child_process";
 import { randomUUID } from "node:crypto";
 import { chmodSync, mkdirSync, readdirSync, readFileSync, renameSync, statSync, writeFileSync } from "node:fs";
@@ -389,16 +392,25 @@ export async function dismissNotifications(page = dsmPage(), env = process.env)
 /**
  * Whether the signed-in desktop's session is usable: it holds a SynoToken
  * (a restored `stay_login` cookie alone yields none, and the app's CGIs then
- * answer 119) and DSM's login.cgi, asked from the page, still accepts the
+ * answer 119) and DSM's login.cgi, asked through the shared NAS transport, still accepts the
  * session. Any failure to ask counts as not live.
  */
-export async function dsmSessionLive(page) {
-    const state = await page.evaluate(async () => {
-        const token = window.SYNO?.SDS?.Session?.SynoToken;
-        const reply = await fetch("/webman/login.cgi", { credentials: "same-origin" }).then(response => response.json());
-        return { token: typeof token === "string" && token !== "", success: reply?.success === true };
-    }).catch(() => undefined);
-    return !!state?.token && state.success;
+export async function dsmSessionLive(page, check, env = process.env) {
+    const token = await page.evaluate(() => window.SYNO?.SDS?.Session?.SynoToken).catch(() => undefined);
+    if (typeof token !== 'string' || !token)
+        return false;
+    try {
+        if (check)
+            return await check(token);
+        const state = await surface().context().storageState();
+        const cookie = state.cookies.filter(c => sessionCookieNames.includes(c.name)).map(c => `${c.name}=${c.value}`).join('; ');
+        const origin = canonicalOrigin(dsmUrl(env), true);
+        const response = await sessionFetch(origin + '/webman/login.cgi', {}, { origin, username: 'e2e', cookie, token });
+        return (await response.json())?.success === true;
+    }
+    catch {
+        return false;
+    }
 }
 function accountFile(user, env) {
     const key = `DSM_E2E_ACCOUNT_${user.toUpperCase().replace(/[^A-Z0-9]/g, "_")}`;
@@ -447,8 +459,8 @@ export async function openUntilLoaded(app, path, { timeoutMs = 30_000, pauseMs =
         }
     }
 }
-async function restoredSessionLive(page) {
-    return await desktopOrLogin(page) === "desktop" && await dsmSessionLive(page);
+async function restoredSessionLive(page, env) {
+    return await desktopOrLogin(page) === "desktop" && await dsmSessionLive(page, undefined, env);
 }
 /**
  * Restores the saved profile of `user`; signs in with the account file only
@@ -466,18 +478,22 @@ export async function signIn(app, user = "admin", env = process.env) {
     await openPath(app, "/");
     const page = dsmPage();
     let outcome = "restored";
-    if (!profile || !await restoredSessionLive(page)) {
+    if (!profile || !await restoredSessionLive(page, env)) {
         // A refused session still shows the desktop; dropping its cookies shows the login form.
         if (profile) {
             await context.clearCookies();
             await openUntilLoaded(app, "/");
         }
         const account = readAccount(accountFile(user, env), user);
-        await page.locator(loginSelector).fill(account.username);
-        await page.keyboard.press("Enter");
-        const password = page.locator('input[type="password"]:visible');
-        await password.fill(account.password);
-        await password.press("Enter");
+        const session = await loginDsm(canonicalOrigin(url, true), account.username, account.password, {
+            remember: false, otp: async () => env.DSM_OTP ?? '',
+        });
+        const state = await context.storageState();
+        await context.setStorageState({ ...state, cookies: [...state.cookies, {
+                    name: 'id', value: session.cookie.slice(3), domain: new URL(url).hostname, path: '/',
+                    httpOnly: true, secure: new URL(url).protocol === 'https:', sameSite: 'Lax', expires: -1,
+                }] });
+        await openUntilLoaded(app, '/');
         outcome = "signed-in";
     }
     await waitForDesktop(page);

package/dist/error-registry.js

@@ -1,8 +1,8 @@
 import { COMPOSE_ERRORS } from "./standalone/compose-errors.js";
 export const ERROR_REGISTRY = {
     ...COMPOSE_ERRORS,
-    HOST_CERT_CHANGED: { "code": "HOST_CERT_CHANGED", "description": "The NAS certificate differs from its pinned SHA-256", "suggestion": "Verify old/new fingerprints, then run synopkgland host trust <name>" },
-    HOST_TLS_UNTRUSTED: { "code": "HOST_TLS_UNTRUSTED", "description": "The NAS TLS certificate is not trusted", "suggestion": "Use host login for first-use pinning, a trusted --ca file, or an expected --fingerprint" },
+    HOST_CERT_CHANGED: { "code": "HOST_CERT_CHANGED", "description": "Strict TLS: the NAS certificate differs from the recorded SHA-256", "suggestion": "Verify old/new fingerprints, then run synopkgland host trust <name>" },
+    HOST_TLS_UNTRUSTED: { "code": "HOST_TLS_UNTRUSTED", "description": "Strict TLS: the NAS certificate failed CA, hostname or validity verification", "suggestion": "Check the CA file, NAS hostname and certificate validity, or omit strict TLS" },
     HOST_DNS_FAILED: { "code": "HOST_DNS_FAILED", "description": "The NAS hostname could not be resolved", "suggestion": "Check the registered hostname and DNS" },
     HOST_CONNECTION_REFUSED: { "code": "HOST_CONNECTION_REFUSED", "description": "The NAS refused the connection", "suggestion": "Check the DSM port and NAS availability" },
     HOST_TIMEOUT: { "code": "HOST_TIMEOUT", "description": "The NAS request timed out", "suggestion": "Check connection and firewall; inspect state before retrying writes" },
@@ -1000,8 +1000,8 @@ export const ERROR_REGISTRY = {
         },
         DSM_TLS_UNTRUSTED: {
             code: "DSM_TLS_UNTRUSTED",
-            description: "The DSM TLS certificate is not trusted by this computer (self-signed, expired or a name mismatch).",
-            suggestion: "Export the NAS certificate or its CA as PEM and run with NODE_EXTRA_CA_CERTS=<file>; or give DSM a trusted certificate whose name matches the host profile. Do not disable certificate verification.",
+            description: "Strict TLS: the DSM certificate failed CA, hostname or validity verification",
+            suggestion: "Check the --ca PEM file, NAS hostname and certificate validity; NAS certificates are accepted by default without --strict-tls or --ca",
         },
         STANDALONE_ICON_INVALID: {
             code: "STANDALONE_ICON_INVALID",

package/dist/host/connection.d.ts

@@ -1,9 +1 @@
-import { type DsmSession, type JsonRequest } from "../ctl/transport.js";
-export interface NasConnection {
-    name: string;
-    session: DsmSession;
-    request: JsonRequest;
-    call: (api: string, method: string, version: number, params?: Record<string, string>) => Promise<any>;
-}
-export declare function connectNas(name?: string): Promise<NasConnection>;
-export declare function requireAdministrator(nas: NasConnection): Promise<void>;
+export * from "../nas/connection.js";

package/dist/host/connection.js

@@ -1,49 +1,2 @@
-import { CtlError } from "../ctl/errors.js";
-import { createRequest, } from "../ctl/transport.js";
-import { resolveHostCredentials } from "./credentials.js";
-import { registerDsmSession } from "./dsm-http.js";
-export async function connectNas(name) {
-    const credentials = resolveHostCredentials(name);
-    const session = await credentials.loadSession();
-    registerDsmSession(session, credentials.hostName, credentials.ca, credentials.fingerprint);
-    const request = createRequest(session.origin, 62000, credentials.ca, {
-        fingerprint: credentials.fingerprint,
-        name: credentials.hostName,
-    });
-    return {
-        name: credentials.hostName,
-        session,
-        request,
-        call: async (api, method, version, params = {}) => {
-            const body = await request("/webapi/entry.cgi", new URLSearchParams({
-                api,
-                method,
-                version: String(version),
-                ...params,
-            }), session);
-            const code = Number(body?.error?.code);
-            if (body?.success !== true)
-                throw new CtlError([106, 107, 119].includes(code)
-                    ? "CTL_NOT_AUTHENTICATED"
-                    : code === 105
-                        ? "NAS_ADMIN_REQUIRED"
-                        : "DSM_API_FAILED", `DSM ${api}/${method} failed (${code || "invalid response"})`, [106, 107, 119].includes(code)
-                    ? `run: synopkgland host login ${credentials.hostName}`
-                    : code === 105
-                        ? "Log in with a DSM administrator account"
-                        : "Check DSM permissions and Package Center", 2);
-            return body.data;
-        },
-    };
-}
-export async function requireAdministrator(nas) {
-    const data = await nas.call("SYNO.Core.Group.Member", "list", 1, {
-        group: "administrators",
-        offset: "0",
-        limit: "-1",
-    });
-    const members = data?.users;
-    if (!Array.isArray(members) ||
-        !members.some((u) => u.name === nas.session.username))
-        throw new CtlError("NAS_ADMIN_REQUIRED", "Package installation and removal require a DSM administrator account", "Register and log in with a DSM administrator account", 4);
-}
+// Compatibility export; NAS connection implementation lives in one module.
+export * from "../nas/connection.js";

package/dist/host/credentials.d.ts

@@ -1,4 +1 @@
-import { CtlStore } from "../ctl/store.js";
-import type { HostCredentials } from "./types.js";
-/** Host metadata is public; session carriers are loaded only from secure storage. */
-export declare function resolveHostCredentials(name?: string, store?: CtlStore): HostCredentials | null;
+export * from "../nas/credentials.js";

package/dist/host/credentials.js

@@ -1,32 +1,2 @@
-import { readFileSync } from "node:fs";
-import { CtlStore } from "../ctl/store.js";
-import { canonicalOrigin } from "../ctl/transport.js";
-import { loginDsm } from "../ctl/dsm-auth.js";
-/** Host metadata is public; session carriers are loaded only from secure storage. */
-export function resolveHostCredentials(name, store = new CtlStore()) {
-    if (!name &&
-        !store.list().length &&
-        process.env.DSM_URL &&
-        process.env.DSM_USERNAME &&
-        process.env.DSM_PASSWORD) {
-        const origin = canonicalOrigin(process.env.DSM_URL);
-        return {
-            dsmOrigin: origin,
-            username: process.env.DSM_USERNAME,
-            hostName: "env",
-            loadSession: () => loginDsm(origin, process.env.DSM_USERNAME, process.env.DSM_PASSWORD, {
-                remember: false,
-                otp: async () => process.env.DSM_OTP ?? "",
-            }),
-        };
-    }
-    const host = store.select(name);
-    return {
-        dsmOrigin: host.origin,
-        username: host.username,
-        hostName: host.name,
-        fingerprint: host.fingerprint,
-        ca: host.ca ? readFileSync(host.ca, "utf8") : undefined,
-        loadSession: () => store.session(host),
-    };
-}
+// Compatibility export; NAS connection implementation lives in one module.
+export * from "../nas/credentials.js";

package/dist/host/dsm-client.js

@@ -1,8 +1,9 @@
+import { sessionForCredentials } from "../nas/credentials.js";
 import { CtlError } from '../ctl/errors.js';
 import { listShareNames, lookupSharePath, } from "./share-lookup.js";
 import { createDsmApiCall, fetchSharePermissions, fetchUserGroups, } from "./share-permission-lookup.js";
 import { fetchPortInfo } from "./port-info-lookup.js";
-import { dsmFetch, registerDsmSession } from "./dsm-http.js";
+import { dsmFetch } from "./dsm-http.js";
 import { versionUnsupported } from "../runtime/dsm-version.js";
 import { fetchDsmPortProfileInventory } from "./dsm-port-profile.js";
 import { installPackageFromLocalSpk, fetchInstalledPackageState, } from "./catalog-install.js";
@@ -56,34 +57,10 @@ function createDsmNasHost(credentials, profileName) {
     const dsmOrigin = credentials.dsmOrigin.replace(/\/$/, "");
     let cookieHeader = credentials.cookieHeader;
     const ensureLogin = async () => {
-        if (credentials.loadSession && !cookieHeader) {
-            const session = await credentials.loadSession();
+        if (!cookieHeader) {
+            const session = await sessionForCredentials(credentials);
             cookieHeader = session.cookie;
-            registerDsmSession(session, credentials.hostName ?? profileName ?? 'env', credentials.ca, credentials.fingerprint);
         }
-        if (cookieHeader) {
-            return;
-        }
-        const query = new URLSearchParams({
-            api: "SYNO.API.Auth",
-            version: "3",
-            method: "login",
-            account: credentials.username,
-            passwd: credentials.password ?? "",
-            session: "FileStation",
-            format: "cookie",
-        });
-        const response = await dsmFetch(`${dsmOrigin}/webapi/entry.cgi`, {
-            method: "POST",
-            headers: { "content-type": "application/x-www-form-urlencoded" },
-            body: query,
-        });
-        const login = (await response.json());
-        if (!response.ok || login.success !== true)
-            throw new Error("DSM login failed");
-        cookieHeader = setCookiePairs(response.headers).join("; ");
-        if (!cookieHeader)
-            throw new Error("DSM login returned no session cookie");
     };
     /**
      * One read-only call of the App's own CGI as the administrator. identity:

package/dist/host/dsm-http.d.ts

@@ -1,3 +1 @@
-import { type DsmSession } from '../ctl/transport.js';
-export declare function registerDsmSession(session: DsmSession, name: string, ca?: string, fingerprint?: string): void;
-export declare function dsmFetch(url: string, init?: RequestInit): Promise<Response>;
+export { dsmFetch, registerDsmSession } from '../nas/http.js';