@synopackageland/cli 0.41.1 → 0.41.2

package/CHANGELOG.md

@@ -2,6 +2,10 @@
 
 ## Unreleased
 
+## 0.41.2 (2026-10-29)
+
+- Require templates ~0.35.2 with SDK/App 0.38.1 and clean registry metadata.
+
 ## 0.41.1 (2026-10-29)
 
 - `ui.banner: shown | hidden` lets an App choose whether DSM draws its banner

package/README.md

@@ -82,7 +82,7 @@ alongside npm lockfiles. Do not disable checksum verification for public SDK
 packages. Private mirrors can use explicitly configured Go authentication and
 checksum settings; a failed fetch reports `SDK_DOWNLOAD_FAILED`.
 
-CLI 0.41.1 uses templates ~0.35.1, whose default SDK pin is 0.38.0. Compose import and SDK defaults
+CLI 0.41.2 uses templates ~0.35.2, whose default SDK pin is 0.38.1. Compose import and SDK defaults
 read the SDK pin from the installed templates; explicit App SDK declarations take precedence.
 Every App method must be declared in the permissions table. Dynamic names and
 custom HTTP dispatchers are rejected. With SDK 0.33.0, use fixed
@@ -93,7 +93,7 @@ unimported development commands are excluded. Use
 authentication. See [App entry and registration](docs/app-entry.md).
 
 `init` and `add` read their templates from the locally installed
-`@synopackageland/templates`. CLI 0.41.1 depends on `~0.35.1`: npm installation or
+`@synopackageland/templates`. CLI 0.41.2 depends on `~0.35.2`: npm installation or
 update can select the latest templates patch in the 0.35 minor line. Templates
 patches need only a templates release; update the npm installation to receive them.
 The CLI never fetches templates at runtime, so offline use works after installation;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@synopackageland/cli",
-  "version": "0.41.1",
+  "version": "0.41.2",
   "description": "Syno Package Land Developer Kit CLI",
   "type": "module",
   "bin": {
@@ -28,7 +28,7 @@
   },
   "dependencies": {
     "@napi-rs/keyring": "^2.1.1",
-    "@synopackageland/templates": "~0.35.1",
+    "@synopackageland/templates": "~0.35.2",
     "ajv": "^8.17.1",
     "commander": "^13.1.0",
     "json-canonicalize": "^3.0.1",

package/skills/SKILL.md

@@ -5,7 +5,7 @@ description: Initialize, extend, check, build, inspect, and deploy Synology appl
 
 # Independent Synology SPKs
 
-The CLI installs templates through `~0.35.1`. A templates patch needs only a
+The CLI installs templates through `~0.35.2`. A templates patch needs only a
 templates release; npm install/update selects a patch in that minor line. The CLI
 uses the locally installed templates and reads their SDK pin for defaults; it
 never downloads templates at runtime. Preserve the lockfile and use `npm ci` for
@@ -24,7 +24,7 @@ Use this guide to initialize, build and inspect own applications or upstream OSS
 
 For an existing open-source App, first read [reference/upstream-fork.md](reference/upstream-fork.md): upstream fork/history + untouched upstream files + all packaging in `synology/`, official container images pinned by tag/index digest, native official release binaries pinned by SHA-256 or a source build hook, and a single tag-merge upgrade command. Use `init --upstream-fork`; never rewrite the App as a component. Integrated upstream Apps require direct DSM administrator entry without a separate App password or an OIDC/SSO server: supported trusted headers first, disabling native login second; the shipped OpenList pattern uses the existing SDK 0.17.3 token adapter (`mode: token`, `access: dsm-admins`, `entry: admin-only`) with server-side Authorization injection. All DSM admins share one upstream admin; token reset requires package restart; WebDAV retains its native credentials.
 
-Use SDK/App 0.38.0 and CLI 0.41.1 for App entry enforcement. Declare every App method
+Use SDK/App 0.38.1 and CLI 0.41.2 for App entry enforcement. Declare every App method
 in the permissions table; dynamic names and unregistered HTTP dispatchers are rejected.
 Use fixed SDK routes and `identity_gateway.upstream_auth_paths` for client API
 paths that rely on upstream authentication. Read
@@ -41,7 +41,7 @@ cannot upgrade a connection; use an existing upgrade-capable deployment
 transport. The audit follows each configured Go binary's Linux import graph,
 including declared workers; unshipped dev commands are excluded.
 
-SDK/App 0.38.0 allows 300 seconds for requests by default, with the browser
+SDK/App 0.38.1 allows 300 seconds for requests by default, with the browser
 waiting 302 seconds. Explicit budgets and earlier parent deadlines still win.
 For long work, use existing independent workers with prompt job admission,
 progress and authorized status/result polling by the original ID. A timed-out

package/skills/reference/create.md

@@ -62,7 +62,7 @@ backend: {runtime: rust, dir: app, entry: hello, methods: [hello.greet]}
 
 ## 請求期限與視窗尺寸
 
-SDK/App 0.38.0 的 backend 請求期限預設 300 秒，DSM 視窗與 TS client 預設等候 302 秒。CLI 從 App 所選 SDK 的 timeout spec 讀取預設；`backend.timeout_seconds`（1–3600 的整數）可明確覆寫，go、python、node、rust 都適用，較早的 parent deadline 仍優先。到期時 App 回 `request_timeout`；DSM 視窗把工作期限放進 `ctx.requestTimeout`（毫秒），`ctx.call` 與 SDK 瀏覽器 client 多等 2 秒，讓 backend 的回覆先到。已安裝的 App、舊 SDK 或既有明確 timeout 不會自動改變；需使用匹配的 Go/TS SDK 重建。
+SDK/App 0.38.1 的 backend 請求期限預設 300 秒，DSM 視窗與 TS client 預設等候 302 秒。CLI 從 App 所選 SDK 的 timeout spec 讀取預設；`backend.timeout_seconds`（1–3600 的整數）可明確覆寫，go、python、node、rust 都適用，較早的 parent deadline 仍優先。到期時 App 回 `request_timeout`；DSM 視窗把工作期限放進 `ctx.requestTimeout`（毫秒），`ctx.call` 與 SDK 瀏覽器 client 多等 2 秒，讓 backend 的回覆先到。已安裝的 App、舊 SDK 或既有明確 timeout 不會自動改變；需使用匹配的 Go/TS SDK 重建。
 
 - python、node、rust：build 把它寫進 `bridge.json` 的 `timeout_seconds`；runtime 以它為期限，傳給 App 的 `deadline_ms` 是送出呼叫時剩下的時間。
 - go：build 以 `-X main.requestTimeout=<秒>` 傳入。要寫 `timeout_seconds`，`main.go` 必須讀這個變數，否則 check 回 `STANDALONE_TIMEOUT_UNSUPPORTED`；未設定時使用所選 SDK 的 `api.DefaultRequestTimeout`：
@@ -93,7 +93,7 @@ func deadline() api.DeadlineOption {
 
 直接 File Station 瀏覽器讀取預設也為 302 秒；identity gateway 等候 upstream headers 預設 310 秒，自訂期限需對齊 gateway 與外部 proxy。這些預設不保證所有 DSM/proxy 都能完成五分鐘請求。executor batch 的 60 秒上限、已核准 root policy/program budget 與 credential lifetime 維持原契約；長 root 工作使用既有 `root.start` / `root.jobs.*`。
 
-獨立 `ctl` transport 預設仍是 62 秒。長同步呼叫須明確指定 `--timeout`，或使用既有 nonblocking job flow；參考 [ctl](ctl.md)。完整契約見 SDK 的 [request deadlines](https://github.com/synopackageland/syno-pkg-land-sdk/blob/v0.38.0/docs/request-deadlines.md)。
+獨立 `ctl` transport 預設仍是 62 秒。長同步呼叫須明確指定 `--timeout`，或使用既有 nonblocking job flow；參考 [ctl](ctl.md)。完整契約見 SDK 的 [request deadlines](https://github.com/synopackageland/syno-pkg-land-sdk/blob/v0.38.1/docs/request-deadlines.md)。
 
 DSM 視窗預設 960×640、最小 700×420；`ui.window` 只寫要改的欄位：
 

package/skills/reference/ctl.md

@@ -132,7 +132,7 @@ every App supports cancellation or singleton deduplication.
 
 For AI consumers:
 
-The independent ctl transport defaults to 62 seconds even with SDK/App 0.38.0.
+The independent ctl transport defaults to 62 seconds even with SDK/App 0.38.1.
 For a long synchronous call, set `--timeout` explicitly; for an existing job
 flow, use `--no-wait` and the original ID. A status read timeout leaves the last
 known queued/running state intact. If the App's admission API supports an