@synopackageland/cli 0.33.0 → 0.33.2

package/CHANGELOG.md

@@ -1,10 +1,6 @@
 # Changelog
 
-## 0.33.0 (2026-10-27)
+## 0.33.2 (2026-10-28)
 
-- Share one secure NAS login across host, ctl, deploy, install, uninstall, status and logs
-- Install or upgrade store packages and local SPKs with dependency plans, compatibility checks and pinned download verification
-- Preview package changes with --dry-run, confirm with --yes and query installed packages without a project directory
-- Trust default NAS certificates on first use, pin the leaf SHA-256 before sending credentials and reject changed certificates until explicitly trusted
-- Distinguish certificate, DNS, connection refusal and timeout errors; support private CAs and expected certificate fingerprints
-- Document interactive and environment-only automation login without saving passwords
+- Load the installed app when a DSM window opens after a package upgrade without a page reload; the loader previously reused the app module the previous build left in the page
+- Give DSM windows and full pages `ctx.uiUpdate.check()`, which reports when the installed package has replaced the UI the page loaded, so the SDK's AppShell can offer a reload after an upgrade

package/README.md

@@ -282,8 +282,10 @@ for every other frontend. Plain/binary scaffolds explicitly choose new-page; Vue
 native `ui.launch` resolves to `dsm-window`; the CLI does not guess a frontend's
 framework from its build command. `new-page` registers DSM `type: "standalone"`,
 so the main menu and Package Center open a full page on the DSM origin.
-`ctx.fullPage`, `ctx.appIcon`, session/SynoToken, launch parameters and entry
-permissions use the same wrapper in both modes. The wrapper sets the standalone
+`ctx.fullPage`, `ctx.appIcon`, `ctx.uiUpdate`, session/SynoToken, launch parameters and entry
+permissions use the same wrapper in both modes. `ctx.uiUpdate.check()` reports when
+a package upgrade replaced the UI the page loaded; SDK 0.31.5+ AppShell then shows
+a one-line reload notice. The wrapper sets the standalone
 page title, favicon and device-width viewport. It retains ExtJS; `pureEnv` is
 not appropriate, and alternate Portal ports are not needed (`allowAltPort` is omitted).
 
@@ -356,6 +358,16 @@ commands and their schemas. Run the listed alias/command with typed flags,
 `--help` and `--dry-run`; writes require `--yes`. There is no mutable current
 context. Use `--host a,b` or `--all-hosts` for bounded parallel operations.
 
+NAS HTTPS accepts self-signed, untrusted CA, wrong-name and expired certificates
+by default on every CLI path. The CLI records the leaf SHA-256 for display; a
+changed leaf warns once on stderr, updates that value and continues.
+`host add --strict-tls` stores verification in the profile. `--strict-tls` or
+`--ca <file>` on any NAS command opts into CA, hostname, validity and recorded
+certificate checks. Strict failures use `HOST_TLS_UNTRUSTED` or `HOST_CERT_CHANGED`;
+`host trust <name>` can explicitly update the recorded fingerprint. Passwords
+are sent only over a connection whose certificate was inspected. Public package
+feeds and SPK downloads retain normal HTTPS verification.
+
 `ctl` preserves these process exit codes, including with `--json`:
 
 | Exit code | Meaning and examples |

package/dist/cli.js

@@ -1,3 +1,4 @@
+import { nasFlags, withNasOptions } from './nas/options.js';
 import { upstreamRepository, upstreamMaintainer } from './upstream-attribution.js';
 import { Command, CommanderError } from "commander";
 import { existsSync, readFileSync, renameSync, statSync } from "node:fs";
@@ -289,6 +290,10 @@ async function containerBuild(project, arches, options) {
 }
 /** Resolves after dispatch; commands may set process.exitCode. Rejections are failures. */
 export async function runCli(argv) {
+    const { args, options } = nasFlags(argv, argv[2] !== "ctl");
+    return withNasOptions(options, () => runCliWithin(args));
+}
+async function runCliWithin(argv) {
     if (argv[2] === "host") {
         const { runCtl } = await import("./ctl/cli.js");
         await runCtl(["host", ...argv.slice(3)]);
@@ -307,6 +312,8 @@ export async function runCli(argv) {
         .name("synopkgland")
         .description("Syno Package Land Developer Kit CLI")
         .option("--project <dir>", "App project root")
+        .option("--strict-tls", "Verify NAS CA, hostname, validity and recorded certificate")
+        .option("--ca <file>", "Verify NAS HTTPS with a PEM CA file")
         .exitOverride();
     const rootOf = (command) => resolve(process.cwd(), command.parent?.opts().project ?? ".");
     const hostOf = (host) => createNasHost({ host });

package/dist/ctl/cli.js

@@ -1,6 +1,6 @@
+import { nasFlags, withNasOptions, nasOptions } from '../nas/options.js';
 import { probeCertificate, normalizeFingerprint } from './tls.js';
 import { readBounded } from './json.js';
-import { readFileSync } from 'node:fs';
 import { createInterface } from 'node:readline/promises';
 import { Writable } from 'node:stream';
 import { CtlError, errorData, ctlError } from './errors.js';
@@ -10,7 +10,7 @@ import { selectHosts, selectApp, selectOperation, flagName, RESERVED_FLAGS } fro
 import { canonicalOrigin, CTL_TIMEOUT_MS, createRequest } from './transport.js';
 import { loginDsm, logoutDsm } from './dsm-auth.js';
 import { publicOperation } from './redaction.js';
-const USAGE = 'synopkgland host add|list|show|login|logout|remove|revoke|default|trust; ctl list [--host a,b|--all-hosts] [--app pkg] [--refresh]; ctl <alias|package> <command...> [typed flags|--input file|-] [--dry-run] [--yes]';
+const USAGE = 'synopkgland host add|list|show|login|logout|remove|revoke|default|trust; ctl list [--host a,b|--all-hosts] [--app pkg] [--refresh]; ctl <alias|package> <command...> [typed flags|--input file|-] [--dry-run] [--yes]; NAS HTTPS accepts any certificate by default; --strict-tls or --ca <file> opts into verification';
 async function prompt(message, secret = false) {
     if (!process.stdin.isTTY)
         throw new CtlError('CTL_INTERACTION_REQUIRED', 'Interactive input required.', 'Use --username and --password-stdin for host authentication.', 2);
@@ -61,6 +61,16 @@ function example(host, app, op) {
 }
 export function listView(host, apps) { return apps.map(app => ({ host, package: app.payload.package, aliases: app.payload.aliases, protocolVersion: app.version, developedBy: app.payload.provenance.developedBy, provenance: 'self-declared', hash: app.sha256, commands: Object.entries(app.payload.commands).map(([id, original]) => { const op = publicOperation(original); return { id, ...op, parameters: op.paramsSchema ?? 'Undescribed parameters; use --input', examples: example(host, app, op) }; }) })); }
 export async function runCtl(argv, io = {}) {
+    try {
+        const { args, options } = nasFlags(argv);
+        return await withNasOptions({ ...options, warn: io.err ?? console.error }, () => runCtlWithin(args, io));
+    }
+    catch (error) {
+        (io.out ?? console.log)(JSON.stringify({ ok: false, error: errorData(error) }));
+        process.exitCode = ctlError(error).exitCode;
+    }
+}
+async function runCtlWithin(argv, io = {}) {
     const args = [...argv], store = io.store ?? new CtlStore(), out = io.out ?? console.log, tty = io.isTTY ?? !!process.stdout.isTTY, ask = io.prompt ?? prompt;
     let json = argv.includes('--json') || !tty;
     const emit = (value) => out(json ? JSON.stringify(value) : JSON.stringify(value, null, 2));
@@ -98,7 +108,7 @@ export async function runCtl(argv, io = {}) {
             if (action === 'add' || action === 'login') {
                 const remaining = args.slice(3);
                 const url = take(remaining, '--url', true), usernameOption = take(remaining, '--username', true), passwordStdin = !!take(remaining, '--password-stdin'), tunnel = !!take(remaining, '--ssh-tunnel'), noRemember = !!take(remaining, '--no-remember-device'), ca = take(remaining, '--ca', true), fingerprint = take(remaining, '--fingerprint', true);
-                if (ca && fingerprint)
+                if ((ca || nasOptions().ca) && fingerprint)
                     throw new CtlError('CTL_ARGUMENT_INVALID', 'Use --ca or --fingerprint', 'Choose one certificate trust policy');
                 if (remaining.length)
                     throw new CtlError('CTL_ARGUMENT_INVALID', 'Unknown host options.', 'run: synopkgland host --help', 3);
@@ -109,25 +119,24 @@ export async function runCtl(argv, io = {}) {
                 const old = action === 'login' ? store.get(name) : undefined;
                 if (action === 'add' && !url)
                     throw new CtlError('CTL_URL_REQUIRED', '--url is required.', `run: synopkgland host add ${name} --url https://${name}:5001`);
-                const host = old ?? { name, origin: canonicalOrigin(url, tunnel), username: usernameOption ?? process.env.DSM_USERNAME ?? await ask('DSM account: '), approved: {}, ...(tunnel ? { tunnel: true } : {}), ...(ca ? { ca } : {}) };
+                const host = old ?? { name, origin: canonicalOrigin(url, tunnel), username: usernameOption ?? process.env.DSM_USERNAME ?? await ask('DSM account: '), approved: {}, ...(tunnel ? { tunnel: true } : {}), ...(nasOptions().ca ? { ca: nasOptions().ca } : {}), ...(nasOptions().strictTls ? { strictTls: true } : {}) };
                 if (fingerprint)
                     normalizeFingerprint(fingerprint);
-                if (old?.fingerprint && fingerprint && normalizeFingerprint(fingerprint) !== old.fingerprint)
-                    throw new CtlError('HOST_CERT_CHANGED', 'Login cannot replace a certificate pin', `run: synopkgland host trust ${name}`, 6);
                 if (!io.requestFor) {
-                    const checked = await probeCertificate(host.origin, { name, ca: host.ca ? readFileSync(host.ca, 'utf8') : undefined, fingerprint: host.fingerprint ?? fingerprint, timeoutMs });
-                    if (checked.fingerprint && !host.fingerprint) {
-                        host.fingerprint = checked.fingerprint;
+                    const prior = host.fingerprint;
+                    const checked = await probeCertificate(host.origin, { ...store.trust(host), expectedFingerprint: fingerprint, timeoutMs });
+                    if (checked.leafFingerprint) {
+                        host.fingerprint = checked.leafFingerprint;
                         store.save(host);
-                        if (!checked.trusted)
-                            (io.err ?? console.error)(`Trusting the NAS certificate ${checked.fingerprint.slice(0, 16)} (self-signed)`);
+                        if (!prior && !checked.trusted)
+                            (io.err ?? console.error)(`Trusting the NAS certificate ${checked.leafFingerprint.slice(0, 16)} (not verified by a trusted CA)`);
                     }
                 }
                 else if (fingerprint)
                     host.fingerprint = normalizeFingerprint(fingerprint);
                 const previous = old ? await store.credentials.get(store.key(host)) : null;
                 const secret = process.env.DSM_PASSWORD ?? (passwordStdin ? readBounded(0, 4096).replace(/[\r\n]+$/, '') : await ask('User password: ', true));
-                const session = await loginDsm(host.origin, host.username, secret, { remember: !noRemember, deviceId: previous?.deviceId, otp: () => process.env.DSM_OTP ? Promise.resolve(process.env.DSM_OTP) : ask('DSM OTP: ', true), request: io.requestFor?.(host) ?? createRequest(host.origin, timeoutMs, host.ca ? readFileSync(host.ca, 'utf8') : undefined, { fingerprint: host.fingerprint, name: host.name }), ca: host.ca ? readFileSync(host.ca, 'utf8') : undefined });
+                const session = await loginDsm(host.origin, host.username, secret, { remember: !noRemember, deviceId: previous?.deviceId, otp: () => process.env.DSM_OTP ? Promise.resolve(process.env.DSM_OTP) : ask('DSM OTP: ', true), request: io.requestFor?.(host) ?? createRequest(host.origin, timeoutMs, undefined, { ...store.trust(host), expectedFingerprint: fingerprint }) });
                 try {
                     if (old || host.fingerprint) {
                         await store.credentials.set(store.key(host), session);
@@ -137,7 +146,7 @@ export async function runCtl(argv, io = {}) {
                         await store.add(host, session);
                 }
                 catch (e) {
-                    await logoutDsm(session, io.requestFor?.(host) ?? createRequest(host.origin, timeoutMs, host.ca ? readFileSync(host.ca, 'utf8') : undefined, { fingerprint: host.fingerprint, name: host.name })).catch(() => { });
+                    await logoutDsm(session, io.requestFor?.(host) ?? createRequest(host.origin, timeoutMs, undefined, store.trust(host))).catch(() => { });
                     throw e;
                 }
                 host.lastUsed = new Date().toISOString();
@@ -151,7 +160,7 @@ export async function runCtl(argv, io = {}) {
                     throw new CtlError('HOST_CA_CONFIGURED', 'This host uses a configured CA', 'Update the trusted CA file instead of replacing it with a leaf pin', 3);
                 if (!host.origin.startsWith('https:'))
                     throw new CtlError('HOST_TLS_REQUIRED', 'Certificate trust requires HTTPS', 'Use an HTTPS host registration', 3);
-                const checked = await probeCertificate(host.origin, { fingerprint: take(args, '--fingerprint', true), name });
+                const checked = await probeCertificate(host.origin, { expectedFingerprint: take(args, '--fingerprint', true), name });
                 // Get the leaf even when system-trusted, to make an explicit re-pin stable.
                 const current = checked.leafFingerprint;
                 if (!current)
@@ -181,7 +190,7 @@ export async function runCtl(argv, io = {}) {
                 let logoutError;
                 if (session?.cookie) {
                     try {
-                        await logoutDsm(session, io.requestFor?.(host) ?? createRequest(host.origin, timeoutMs, host.ca ? readFileSync(host.ca, 'utf8') : undefined, { fingerprint: host.fingerprint, name: host.name }));
+                        await logoutDsm(session, io.requestFor?.(host) ?? createRequest(host.origin, timeoutMs, undefined, store.trust(host)));
                         loggedOut = true;
                     }
                     catch (error) {
@@ -201,7 +210,8 @@ export async function runCtl(argv, io = {}) {
             }
             throw new CtlError('CTL_COMMAND_UNKNOWN', `Unknown host action ${action}.`, 'run: synopkgland host --help', 3, ['add', 'list', 'show', 'login', 'logout', 'remove', 'revoke', 'default', 'trust']);
         }
-        const names = selectHosts(store.list().map(h => h.name), hostOption ?? (allHosts ? undefined : store.defaultName()), allHosts);
+        const targets = store.targets();
+        const names = selectHosts(targets.map(h => h.name), hostOption ?? (allHosts ? undefined : store.defaultName()), allHosts);
         const inputAt = args.indexOf('--input');
         let commonInput;
         if (inputAt >= 0 && args[inputAt + 1] === '-') {
@@ -214,7 +224,7 @@ export async function runCtl(argv, io = {}) {
         }
         const results = await boundedMap(names, 4, async (name) => {
             try {
-                const host = store.get(name), ctl = client(host);
+                const host = targets.find(host => host.name === name), ctl = client(host);
                 if (args[0] === 'list') {
                     if (args.length !== 1)
                         throw new CtlError('CTL_ARGUMENT_INVALID', 'Unexpected list arguments.', `run: synopkgland ctl list --host ${name}`);

package/dist/ctl/dsm-auth.d.ts

@@ -1,10 +1 @@
-import { type DsmSession, type JsonRequest } from './transport.js';
-export interface LoginOptions {
-    remember?: boolean;
-    deviceId?: string;
-    otp: () => Promise<string>;
-    request?: JsonRequest;
-    ca?: string;
-}
-export declare function loginDsm(origin: string, username: string, password: string, options: LoginOptions): Promise<DsmSession>;
-export declare function logoutDsm(session: DsmSession, request?: JsonRequest): Promise<void>;
+export * from "../nas/auth.js";

package/dist/ctl/dsm-auth.js

@@ -1,30 +1,2 @@
-import { CtlError } from './errors.js';
-import { createRequest } from './transport.js';
-export async function loginDsm(origin, username, password, options) {
-    const request = options.request ?? createRequest(origin, 30000, options.ca);
-    const form = new URLSearchParams({ api: 'SYNO.API.Auth', version: '7', method: 'login', account: username, passwd: password, session: 'DSM', format: 'cookie', enable_syno_token: 'yes', enable_device_token: options.remember === false ? 'no' : 'yes', device_name: 'synopkgland', device_id: options.deviceId ?? '' });
-    let result = await request('/webapi/entry.cgi', form);
-    if (result?.error?.code === 402) {
-        form.delete('session');
-        result = await request('/webapi/entry.cgi', form);
-    }
-    if (result?.error?.code === 403) {
-        const otp = await options.otp();
-        if (!/^\d{6}$/.test(otp))
-            throw new CtlError('CTL_OTP_INVALID', 'OTP must be six digits.', 'run: synopkgland host login <name>', 2);
-        form.set('otp_code', otp);
-        result = await request('/webapi/entry.cgi', form);
-    }
-    if (result?.success !== true || typeof result.data?.sid !== 'string' || !result.data.sid || typeof result.data.synotoken !== 'string' || !result.data.synotoken)
-        throw new CtlError('CTL_AUTH_FAILED', `DSM login failed (${Number(result?.error?.code) || 'invalid response'}).`, 'run: synopkgland host login <name>', 2);
-    if (/[;\r\n\x00]/.test(result.data.sid) || /[\r\n\x00]/.test(result.data.synotoken) || result.data.sid.length > 4096 || result.data.synotoken.length > 4096)
-        throw new CtlError('CTL_AUTH_FAILED', 'DSM returned invalid session carriers.', 'Check the DSM endpoint.', 2);
-    const returnedDevice = result.data.device_id || result.data.did || options.deviceId;
-    const deviceId = options.remember === false ? undefined : typeof returnedDevice === 'string' && returnedDevice.length <= 4096 && !/[\r\n\x00]/.test(returnedDevice) ? returnedDevice : undefined;
-    return { origin, username, cookie: `id=${result.data.sid}`, token: result.data.synotoken, ...(deviceId ? { deviceId } : {}) };
-}
-export async function logoutDsm(session, request = createRequest(session.origin)) {
-    const body = await request('/webapi/entry.cgi', new URLSearchParams({ api: 'SYNO.API.Auth', version: '7', method: 'logout', SynoToken: session.token }), session);
-    if (body?.success !== true)
-        throw new CtlError('CTL_LOGOUT_FAILED', 'DSM did not confirm logout.', 'Retry logout or revoke the NAS session.', 2);
-}
+// Compatibility export; NAS connection implementation lives in one module.
+export * from "../nas/auth.js";

package/dist/ctl/input.js

@@ -34,7 +34,7 @@ export function selectOperation(app, path) {
         return { id: found[0], operation: found[1] };
     return choose(path.join(' '), Object.values(app.payload.commands).map(op => op.cli.join(' ')), 'command');
 }
-export const RESERVED_FLAGS = new Set(['host', 'all-hosts', 'json', 'app', 'refresh', 'yes', 'dry-run', 'approve-installed', 'help', 'input', 'wait', 'no-wait', 'timeout']);
+export const RESERVED_FLAGS = new Set(['ca', 'strict-tls', 'host', 'all-hosts', 'json', 'app', 'refresh', 'yes', 'dry-run', 'approve-installed', 'help', 'input', 'wait', 'no-wait', 'timeout']);
 export function flagName(key) { return key.replace(/[A-Z]/g, c => '-' + c.toLowerCase()).replaceAll('_', '-'); }
 export function operationInput(op, args, stdin, helpHint) {
     const fail = (message, allowed) => { throw new CtlError('CTL_PARAMS_INVALID', message, helpHint ?? ('run: synopkgland ctl <package> ' + op.cli.join(' ') + ' --help'), 3, allowed); };

package/dist/ctl/service.js

@@ -1,4 +1,3 @@
-import { readFileSync } from 'node:fs';
 import { CtlError, errorData, choose } from './errors.js';
 import { APP_COOKIE, CTL_TIMEOUT_MS, createRequest } from './transport.js';
 import { DESCRIPTION_METHOD, validateDescriptor, ajv } from './descriptor.js';
@@ -17,7 +16,7 @@ export class CtlClient {
     constructor(store, host, request, timeoutMs = CTL_TIMEOUT_MS) {
         this.store = store;
         this.host = host;
-        this.request = request ?? createRequest(host.origin, () => this.remaining(timeoutMs), host.ca ? readFileSync(host.ca, 'utf8') : undefined, { fingerprint: host.fingerprint, name: host.name });
+        this.request = request ?? createRequest(host.origin, () => this.remaining(timeoutMs), undefined, store.trust(host));
     }
     until;
     remaining(fallback) { return this.until === undefined ? fallback : Math.max(0, this.until - performance.now()); }
@@ -150,10 +149,9 @@ export class CtlClient {
                     }
                     return response.data;
                 };
-                const ca = this.host.ca ? readFileSync(this.host.ca, 'utf8') : undefined;
                 const result = await runFlow(operation.flow, params, invoke, { wait: options.wait, timeoutMs: this.remaining(options.timeoutMs ?? CTL_TIMEOUT_MS),
-                    ndjson: (method, input) => transferRequest(appSession, app.payload.transport.path, method, input, { ca, trust: { fingerprint: this.host.fingerprint, name: this.host.name }, timeoutMs: this.remaining(options.timeoutMs ?? CTL_TIMEOUT_MS) }),
-                    upload: (method, input, flow) => transferRequest(appSession, app.payload.transport.path, method, {}, { ca, trust: { fingerprint: this.host.fingerprint, name: this.host.name }, timeoutMs: this.remaining(options.timeoutMs ?? CTL_TIMEOUT_MS), file: { path: String(input[flow.fileParam]), parent: String(input[flow.parentParam]), name: String(input[flow.nameParam]) } }) });
+                    ndjson: (method, input) => transferRequest(appSession, app.payload.transport.path, method, input, { trust: this.store.trust(this.host), timeoutMs: this.remaining(options.timeoutMs ?? CTL_TIMEOUT_MS) }),
+                    upload: (method, input, flow) => transferRequest(appSession, app.payload.transport.path, method, {}, { trust: this.store.trust(this.host), timeoutMs: this.remaining(options.timeoutMs ?? CTL_TIMEOUT_MS), file: { path: String(input[flow.fileParam]), parent: String(input[flow.parentParam]), name: String(input[flow.nameParam]) } }) });
                 if (operation.resultSchema && !ajv.validate(operation.resultSchema, result))
                     throw new CtlError('CTL_RESPONSE_INVALID', 'Result does not match command schema.', 'Check the App version.', 5);
                 return output.clean(result, operation.resultSchema);

package/dist/ctl/store.d.ts

@@ -1,55 +1 @@
-import type { DsmSession } from './transport.js';
-export interface Approval {
-    version: string;
-    hash?: string;
-}
-export interface Host {
-    name: string;
-    origin: string;
-    username: string;
-    fingerprint?: string;
-    tunnel?: boolean;
-    ca?: string;
-    lastUsed?: string;
-    approved: Record<string, Approval>;
-}
-export interface CredentialStore {
-    get(key: string): Promise<DsmSession | null>;
-    set(key: string, value: DsmSession): Promise<void>;
-    delete(key: string): Promise<void>;
-}
-export declare class OsCredentialStore implements CredentialStore {
-    private entry;
-    get(key: string): Promise<DsmSession | null>;
-    set(key: string, value: DsmSession): Promise<void>;
-    delete(key: string): Promise<void>;
-}
-export declare class CtlStore {
-    root: string;
-    credentials: CredentialStore;
-    constructor(root?: string, credentials?: CredentialStore);
-    private safe;
-    private file;
-    key(host: Host): string;
-    defaultName(): string | undefined;
-    setDefault(name: string): void;
-    select(name?: string): Host;
-    list(): Host[];
-    get(name: string): Host;
-    save(host: Host): void;
-    add(host: Host, session: DsmSession): Promise<void>;
-    session(host: Host): Promise<DsmSession>;
-    cacheRoot(host: Host): string;
-    cacheFile(host: Host, pkg: string, version: string): string;
-    cache(host: Host, pkg: string, version: string): any | null;
-    putCache(host: Host, pkg: string, version: string, description: any): void;
-    putFailure(host: Host, pkg: string, version: string, failure: unknown): void;
-    revoke(name: string, pkg: string): {
-        revoked: string;
-        cacheCleared: boolean;
-    };
-    remove(name: string): Promise<{
-        removed: string;
-        deleted: string[];
-    }>;
-}
+export * from "../nas/store.js";

package/dist/ctl/store.js

@@ -1,121 +1,2 @@
-import { mkdirSync, readFileSync, writeFileSync, renameSync, readdirSync, rmSync, existsSync, chmodSync } from 'node:fs';
-import { homedir } from 'node:os';
-import { join } from 'node:path';
-import { randomUUID, createHash } from 'node:crypto';
-import { CtlError, choose } from './errors.js';
-import { loginDsm } from './dsm-auth.js';
-import { createRequest } from './transport.js';
-import { publicDescriptor } from './redaction.js';
-export class OsCredentialStore {
-    async entry(key) { try {
-        const { AsyncEntry } = await import('@napi-rs/keyring');
-        return new AsyncEntry('synopkgland.ctl', key, { linux: { store: 'secret-service' } });
-    }
-    catch {
-        throw new CtlError('CTL_CREDENTIAL_STORE', 'OS secure credential store unavailable.', 'Unlock the OS credential store and retry.', 2);
-    } }
-    async get(key) { try {
-        const raw = await (await this.entry(key)).getPassword();
-        return raw ? JSON.parse(raw) : null;
-    }
-    catch (e) {
-        if (e instanceof CtlError)
-            throw e;
-        throw new CtlError('CTL_CREDENTIAL_STORE', 'Cannot read OS credentials.', 'Unlock the OS credential store and retry.', 2);
-    } }
-    async set(key, value) { try {
-        await (await this.entry(key)).setPassword(JSON.stringify(value));
-    }
-    catch {
-        throw new CtlError('CTL_CREDENTIAL_STORE', 'Cannot save session in OS secure storage.', 'Unlock the OS credential store and retry.', 2);
-    } }
-    async delete(key) { try {
-        await (await this.entry(key)).deleteCredential();
-    }
-    catch {
-        throw new CtlError('CTL_CREDENTIAL_STORE', 'Cannot remove OS credentials.', 'Unlock the OS credential store and retry removal.', 2);
-    } }
-}
-export class CtlStore {
-    root;
-    credentials;
-    constructor(root = process.env.SYNOPKGLAND_CTL_DIR ?? join(homedir(), '.synopkgland', 'ctl'), credentials = new OsCredentialStore()) {
-        this.root = root;
-        this.credentials = credentials;
-    }
-    safe(name) { if (!/^[a-zA-Z0-9][a-zA-Z0-9._-]{0,63}$/.test(name))
-        throw new CtlError('CTL_HOST_INVALID', 'Invalid host name.', 'Use letters, digits, dots, dashes or underscores.'); return name; }
-    file(name) { return join(this.root, 'hosts', this.safe(name) + '.json'); }
-    key(host) { return createHash('sha256').update(host.name + '\0' + host.origin + '\0' + host.username).digest('hex'); }
-    defaultName() { try {
-        return JSON.parse(readFileSync(join(this.root, 'default.json'), 'utf8')).name;
-    }
-    catch {
-        return undefined;
-    } }
-    setDefault(name) { this.get(name); mkdirSync(this.root, { recursive: true, mode: 0o700 }); const file = join(this.root, 'default.json'), temp = file + '.' + randomUUID(); writeFileSync(temp, JSON.stringify({ name }), { mode: 0o600 }); renameSync(temp, file); }
-    select(name) { if (name)
-        return this.get(name); const hosts = this.list(); const selected = this.defaultName(); if (selected)
-        return this.get(selected); if (hosts.length === 1)
-        return hosts[0]; throw new CtlError('CTL_HOST_REQUIRED', hosts.length ? 'Choose a NAS with --host.' : 'No NAS hosts registered.', hosts.length ? 'run: synopkgland host default <name>' : 'run: synopkgland host add <name> --url https://<nas>:5001', 2); }
-    list() { const dir = join(this.root, 'hosts'); if (!existsSync(dir))
-        return []; return readdirSync(dir).filter(n => n.endsWith('.json')).map(n => JSON.parse(readFileSync(join(dir, n), 'utf8'))).sort((a, b) => a.name.localeCompare(b.name)); }
-    get(name) { this.safe(name); const host = this.list().find(h => h.name === name); if (!host)
-        return choose(name, this.list().map(h => h.name), 'host'); return host; }
-    save(host) { const file = this.file(host.name); mkdirSync(join(this.root, 'hosts'), { recursive: true, mode: 0o700 }); const temp = file + '.' + randomUUID(); writeFileSync(temp, JSON.stringify(host), { mode: 0o600 }); renameSync(temp, file); chmodSync(file, 0o600); }
-    async add(host, session) { if (this.list().some(h => h.name === host.name))
-        throw new CtlError('CTL_HOST_EXISTS', 'Host name already registered.', `run: synopkgland host login ${host.name}`); await this.credentials.set(this.key(host), session); try {
-        this.save(host);
-    }
-    catch (e) {
-        await this.credentials.delete(this.key(host));
-        throw e;
-    } }
-    async session(host) {
-        let session;
-        if (process.env.DSM_USERNAME && process.env.DSM_PASSWORD) {
-            if (process.env.DSM_USERNAME !== host.username)
-                throw new CtlError('CTL_CREDENTIAL_MISMATCH', 'Automation account differs from the registered host.', 'Use the registered account or a separately named host.', 2);
-            session = await loginDsm(host.origin, host.username, process.env.DSM_PASSWORD, { remember: false, otp: async () => process.env.DSM_OTP ?? '', request: createRequest(host.origin, 30000, host.ca ? readFileSync(host.ca, 'utf8') : undefined, { fingerprint: host.fingerprint, name: host.name }) });
-        }
-        else
-            session = await this.credentials.get(this.key(host));
-        if (!session?.cookie || !session.token)
-            throw new CtlError('CTL_NOT_AUTHENTICATED', `Host ${host.name} is not logged in.`, `run: synopkgland host login ${host.name}`, 2);
-        if (/[\r\n\0]/.test(session.cookie + session.token))
-            throw new CtlError('CTL_CREDENTIAL_MISMATCH', 'Stored session carriers are invalid', `run: synopkgland host login ${host.name}`, 2);
-        if (session.origin !== host.origin || session.username !== host.username)
-            throw new CtlError('CTL_CREDENTIAL_MISMATCH', 'Stored credentials do not match host.', 'Run synopkgland host login again.', 2);
-        return session;
-    }
-    cacheRoot(host) { return join(this.root, 'cache', this.key(host)); }
-    cacheFile(host, pkg, version) { return join(this.cacheRoot(host), createHash('sha256').update(pkg + '\0' + version).digest('hex') + '.json'); }
-    cache(host, pkg, version) {
-        try {
-            const entry = JSON.parse(readFileSync(this.cacheFile(host, pkg, version), 'utf8'));
-            if (entry.description && !entry.redacted) {
-                const safe = publicDescriptor(entry.description);
-                if (JSON.stringify(safe) !== JSON.stringify(entry.description)) {
-                    this.putCache(host, pkg, version, entry.description);
-                    return { ...entry, description: safe, redacted: true };
-                }
-            }
-            return entry;
-        }
-        catch {
-            return null;
-        }
-    }
-    putCache(host, pkg, version, description) {
-        const safe = publicDescriptor(description);
-        const redacted = JSON.stringify(safe) !== JSON.stringify(description);
-        mkdirSync(this.cacheRoot(host), { recursive: true, mode: 0o700 });
-        const file = this.cacheFile(host, pkg, version), tmp = file + '.' + randomUUID();
-        writeFileSync(tmp, JSON.stringify({ hash: description.sha256, description: safe, ...(redacted ? { redacted: true } : {}) }), { mode: 0o600 });
-        renameSync(tmp, file);
-    }
-    putFailure(host, pkg, version, failure) { mkdirSync(this.cacheRoot(host), { recursive: true, mode: 0o700 }); const file = this.cacheFile(host, pkg, version), tmp = file + '.' + randomUUID(); writeFileSync(tmp, JSON.stringify({ failure }), { mode: 0o600 }); renameSync(tmp, file); }
-    revoke(name, pkg) { const host = this.get(name); delete host.approved[pkg]; this.save(host); rmSync(this.cacheRoot(host), { recursive: true, force: true }); return { revoked: pkg, cacheCleared: true }; }
-    async remove(name) { const host = this.get(name); await this.credentials.delete(this.key(host)); rmSync(this.cacheRoot(host), { recursive: true, force: true }); rmSync(this.file(name)); if (this.defaultName() === name)
-        rmSync(join(this.root, 'default.json'), { force: true }); return { removed: name, deleted: ['session', 'SynoToken', 'device token', 'App approvals', 'hash pins', 'list cache', 'host registration'] }; }
-}
+// Compatibility export; NAS connection implementation lives in one module.
+export * from "../nas/store.js";

package/dist/ctl/tls.d.ts

@@ -1,22 +1 @@
-import https from "node:https";
-import { CtlError } from "./errors.js";
-export interface HostTls {
-    fingerprint?: string;
-    name?: string;
-}
-export declare function normalizeFingerprint(value: string): string;
-export declare function networkError(error: unknown): CtlError;
-export declare function timeoutError(): CtlError;
-/** TLS-only handshake. No HTTP headers, password or session is sent during discovery. */
-export declare function probeCertificate(origin: string, options?: {
-    ca?: string;
-    fingerprint?: string;
-    name?: string;
-    timeoutMs?: number;
-}): Promise<{
-    fingerprint?: string;
-    leafFingerprint?: string;
-    trusted: boolean;
-}>;
-/** Release the socket to HTTPS only after matching the leaf pin on this exact connection. */
-export declare function pinnedAgent(origin: string, trust: HostTls, timeoutMs: number): https.Agent;
+export * from "../nas/tls.js";

package/dist/ctl/tls.js

@@ -1,118 +1,2 @@
-import tls from "node:tls";
-import https from "node:https";
-import { isIP } from "node:net";
-import { CtlError } from "./errors.js";
-export function normalizeFingerprint(value) {
-    const normalized = value.replaceAll(":", "").toLowerCase();
-    if (!/^[a-f0-9]{64}$/.test(normalized))
-        throw new CtlError("HOST_FINGERPRINT_INVALID", "A SHA-256 fingerprint must contain 64 hexadecimal digits", "Use the SHA-256 leaf certificate fingerprint", 3);
-    return normalized;
-}
-export function networkError(error) {
-    if (error instanceof CtlError)
-        return error;
-    const code = error?.code;
-    if (code === "ENOTFOUND" || code === "EAI_AGAIN")
-        return new CtlError("HOST_DNS_FAILED", "NAS hostname could not be resolved", "Check the NAS hostname and DNS", 6);
-    if (code === "ECONNREFUSED")
-        return new CtlError("HOST_CONNECTION_REFUSED", "NAS refused the connection", "Check the DSM port and NAS availability", 6);
-    if (code === "ETIMEDOUT" || code === "ESOCKETTIMEDOUT")
-        return new CtlError("HOST_TIMEOUT", "NAS connection timed out", "Check the NAS connection and firewall", 6);
-    if (code &&
-        /CERT|SELF_SIGNED|UNABLE_TO_VERIFY|UNABLE_TO_GET_ISSUER/.test(code))
-        return new CtlError("HOST_TLS_UNTRUSTED", "NAS TLS certificate is not trusted", "Use synopkgland host login <name>, --ca, or an expected --fingerprint", 6);
-    return new CtlError("CTL_NETWORK", "NAS connection failed", "Check the NAS connection; state-changing requests are not replayed", 6);
-}
-export function timeoutError() {
-    return new CtlError("HOST_TIMEOUT", "NAS connection timed out", "Check the NAS connection and firewall", 6);
-}
-function changed(old, current, name) {
-    return new CtlError("HOST_CERT_CHANGED", `NAS certificate changed: expected SHA-256 ${old}; received ${current}`, `Verify the new certificate, then run: synopkgland host trust ${name ?? "<name>"}`, 6);
-}
-function socketOptions(origin, ca) {
-    const url = new URL(origin), host = url.hostname.replace(/^\[|\]$/g, "");
-    return {
-        host,
-        port: Number(url.port || 443),
-        ...(isIP(host) ? {} : { servername: host }),
-        ...(ca ? { ca } : {}),
-    };
-}
-/** TLS-only handshake. No HTTP headers, password or session is sent during discovery. */
-export function probeCertificate(origin, options = {}) {
-    if (new URL(origin).protocol !== "https:")
-        return Promise.resolve({ trusted: true });
-    return new Promise((resolve, reject) => {
-        const socket = tls.connect({
-            ...socketOptions(origin, options.ca),
-            rejectUnauthorized: false,
-        });
-        const timer = setTimeout(() => socket.destroy(timeoutError()), options.timeoutMs ?? 30000);
-        socket.once("error", (e) => reject(networkError(e)));
-        socket.once("close", () => clearTimeout(timer));
-        socket.once("secureConnect", () => {
-            try {
-                const raw = socket.getPeerCertificate().fingerprint256;
-                if (!raw)
-                    throw new CtlError("HOST_TLS_UNTRUSTED", "NAS did not provide a leaf certificate", "Check the NAS HTTPS endpoint", 6);
-                const fingerprint = normalizeFingerprint(raw);
-                if (options.fingerprint &&
-                    normalizeFingerprint(options.fingerprint) !== fingerprint)
-                    throw changed(normalizeFingerprint(options.fingerprint), fingerprint, options.name);
-                // A caller-provided CA is an explicit trust policy, never a TOFU fallback.
-                if (options.ca && !socket.authorized)
-                    throw new CtlError("HOST_TLS_UNTRUSTED", "NAS certificate was not verified by the supplied CA", "Check the CA file and NAS hostname", 6);
-                resolve({
-                    trusted: socket.authorized,
-                    leafFingerprint: fingerprint,
-                    fingerprint: options.fingerprint || !socket.authorized ? fingerprint : undefined,
-                });
-            }
-            catch (e) {
-                reject(e);
-            }
-            finally {
-                socket.destroy();
-            }
-        });
-    });
-}
-/** Release the socket to HTTPS only after matching the leaf pin on this exact connection. */
-export function pinnedAgent(origin, trust, timeoutMs) {
-    const agent = new https.Agent({ keepAlive: false });
-    agent.createConnection = (_options, callback) => {
-        let done = false;
-        const socket = tls.connect({
-            ...socketOptions(origin),
-            rejectUnauthorized: false,
-        });
-        const timer = setTimeout(() => socket.destroy(timeoutError()), timeoutMs);
-        const finish = (error) => {
-            if (done)
-                return;
-            done = true;
-            clearTimeout(timer);
-            if (error) {
-                socket.destroy();
-                callback?.(error, null);
-            }
-            else
-                callback?.(null, socket);
-        };
-        socket.once("error", (e) => finish(networkError(e)));
-        socket.once("secureConnect", () => {
-            try {
-                const current = normalizeFingerprint(socket.getPeerCertificate().fingerprint256 ?? "");
-                const old = normalizeFingerprint(trust.fingerprint);
-                if (old !== current)
-                    throw changed(old, current, trust.name);
-                finish();
-            }
-            catch (e) {
-                finish(e);
-            }
-        });
-        return undefined;
-    };
-    return agent;
-}
+// Compatibility export; NAS connection implementation lives in one module.
+export * from "../nas/tls.js";

package/dist/ctl/transfers.d.ts

@@ -1,16 +1 @@
-import { type HostTls } from './tls.js';
-import { type DsmSession } from './transport.js';
-export declare function localFile(file: unknown): {
-    file: string;
-    size: number;
-};
-export declare function transferRequest(session: DsmSession, path: string, method: string, params: Record<string, unknown>, options?: {
-    file?: {
-        path: string;
-        parent: string;
-        name: string;
-    };
-    ca?: string;
-    timeoutMs?: number;
-    trust?: HostTls;
-}): Promise<any>;
+export * from "../nas/transfers.js";