@synopackageland/cli 0.41.11 → 0.41.12

package/CHANGELOG.md

@@ -1,5 +1,14 @@
 # Changelog
 
+## 0.41.12 (2026-10-31)
+
+- Remove the delegated WebAPI profile API-name and method-name word lists so
+  explicitly declared calls such as `SYNO.MailClient.Setting.SMTP` `list` pass
+  CLI profile validation. Keep name formats, exact API/method/version pins,
+  approval digests and all other checks, including SDK executor policy validation.
+  Pair with SDK/App 0.38.6 (executor/v0.38.6), which removes the matching
+  executor name blocklists; templates ~0.35.5 still pin SDK 0.38.2.
+
 ## 0.41.11 (2026-10-30)
 
 - Pre-pull inspected Compose image references on the NAS with byte progress, a

package/README.md

@@ -88,7 +88,7 @@ alongside npm lockfiles. Do not disable checksum verification for public SDK
 packages. Private mirrors can use explicitly configured Go authentication and
 checksum settings; a failed fetch reports `SDK_DOWNLOAD_FAILED`.
 
-CLI 0.41.7 uses templates ~0.35.5, whose default SDK pin is 0.38.2. Compose import and SDK defaults
+CLI 0.41.12 uses templates ~0.35.5, whose default SDK pin is 0.38.2. Compose import and SDK defaults
 read the SDK pin from the installed templates; explicit App SDK declarations take precedence.
 Every App method must be declared in the permissions table. Dynamic names and
 custom HTTP dispatchers are rejected. With SDK 0.33.0, use fixed
@@ -99,7 +99,7 @@ unimported development commands are excluded. Use
 authentication. See [App entry and registration](docs/app-entry.md).
 
 `init` and `add` read their templates from the locally installed
-`@synopackageland/templates`. CLI 0.41.7 depends on `~0.35.5`: npm installation or
+`@synopackageland/templates`. CLI 0.41.12 depends on `~0.35.5`: npm installation or
 update can select the latest templates patch in the 0.35 minor line. Templates
 patches need only a templates release; update the npm installation to receive them.
 The CLI never fetches templates at runtime, so offline use works after installation;
@@ -344,9 +344,9 @@ capabilities:
 
 Use matching backend/frontend SDK pins. The profile participates in the
 normal executor approval digest; a profile change needs administrator approval.
-Users grant the named profile separately. The permanent denylist, current-user
-permission checks, bounded JSON and uncertain-outcome rules are in the SDK's
-executor/README.md.
+Users grant the named profile separately. API and method names must have valid
+formats, with each API, method and version listed exactly. Current-user permission
+checks, bounded JSON and uncertain-outcome rules are in the SDK's executor/README.md.
 
 ## Raw WebAPI profiles
 

package/dist/runtime/webapi-profile.js

@@ -1,6 +1,4 @@
 const record = (v) => !!v && typeof v === 'object' && !Array.isArray(v);
-const blocked = new Set(['api', 'entry', 'core', 'auth', 'authentication', 'filestation', 'package', 'packagemanager', 'packagemanagement', 'user', 'users', 'group', 'groups', 'permission', 'permissions', 'privilege', 'privileges', 'owner', 'sharing', 'admin', 'setting', 'settings', 'teamfolder', 'mailplusserver', 'directoryserver', 'taskscheduler', 'eventscheduler', 'request', 'batch', 'compound']);
-const methodBlocked = new Set(['auth', 'login', 'logout', 'sudo', 'permission', 'permissions', 'privilege', 'privileges', 'share', 'sharing', 'owner', 'admin']);
 export function validWebAPIProfiles(value) {
     if (!record(value) || !Object.keys(value).length || Object.keys(value).length > 32)
         return false;
@@ -11,10 +9,10 @@ export function validWebAPIProfiles(value) {
         if (p.raw_max_bytes !== undefined && (!Number.isSafeInteger(p.raw_max_bytes) || Number(p.raw_max_bytes) < 0 || Number(p.raw_max_bytes) > 10737418240))
             return false;
         for (const [api, methods] of Object.entries(p.apis)) {
-            if (!/^SYNO\.[A-Za-z][A-Za-z0-9]*(\.[A-Za-z][A-Za-z0-9]*)*$/.test(api) || api.toLowerCase().split('.').slice(1).some(x => blocked.has(x)) || !record(methods) || !Object.keys(methods).length)
+            if (!/^SYNO\.[A-Za-z][A-Za-z0-9]*(\.[A-Za-z][A-Za-z0-9]*)*$/.test(api) || !record(methods) || !Object.keys(methods).length)
                 return false;
             for (const [method, versions] of Object.entries(methods)) {
-                if (!/^[a-z][a-z0-9_]{0,63}$/.test(method) || method.split('_').some(x => methodBlocked.has(x)) || !Array.isArray(versions) || !versions.length || new Set(versions).size !== versions.length || versions.some(x => !Number.isSafeInteger(x) || x < 1 || x > 65535))
+                if (!/^[a-z][a-z0-9_]{0,63}$/.test(method) || !Array.isArray(versions) || !versions.length || new Set(versions).size !== versions.length || versions.some(x => !Number.isSafeInteger(x) || x < 1 || x > 65535))
                     return false;
                 total += versions.length;
                 if (total > 256)

package/dist/standalone/manifest.js

@@ -1002,7 +1002,7 @@ function readCapabilities(value, c) {
             if (validWebAPIProfiles(setting))
                 result.webapi = setting;
             else
-                c.fail("CAPABILITY_INVALID", "webapi requires named profiles with purpose and exact safe API/method/version lists.");
+                c.fail("CAPABILITY_INVALID", "webapi requires named profiles with purpose and exact API/method/version lists.");
         }
         else if (name === "delegate") {
             if (validDelegate(setting))

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@synopackageland/cli",
-  "version": "0.41.11",
+  "version": "0.41.12",
   "description": "Syno Package Land Developer Kit CLI",
   "type": "module",
   "bin": {

package/skills/SKILL.md

@@ -26,7 +26,7 @@ Use this guide to initialize, build and inspect own applications or upstream OSS
 
 For an existing open-source App, first read [reference/upstream-fork.md](reference/upstream-fork.md): upstream fork/history + untouched upstream files + all packaging in `synology/`, official container images pinned by tag/index digest, native official release binaries pinned by SHA-256 or a source build hook, and a single tag-merge upgrade command. Use `init --upstream-fork`; never rewrite the App as a component. Integrated upstream Apps require direct DSM administrator entry without a separate App password or an OIDC/SSO server: supported trusted headers first, disabling native login second; the shipped OpenList pattern uses the existing SDK 0.17.3 token adapter (`mode: token`, `access: dsm-admins`, `entry: admin-only`) with server-side Authorization injection. All DSM admins share one upstream admin; token reset requires package restart; WebDAV retains its native credentials.
 
-Use SDK/App 0.38.3 and CLI 0.41.7 for App entry enforcement. Declare every App method
+Use SDK/App 0.38.6 and CLI 0.41.12 for App entry enforcement. Declare every App method
 in the permissions table; dynamic names and unregistered HTTP dispatchers are rejected.
 Use fixed SDK routes and `identity_gateway.upstream_auth_paths` for client API
 paths that rely on upstream authentication. Read

package/skills/reference/install.md

@@ -1,6 +1,6 @@
 # Native installation settings
 
-Use SDK/App 0.38.3, CLI 0.41.7 and templates 0.35.5. Configure installation through the manifest and generated wizard; do not add App ACL writers, root hooks or independent port state.
+Use SDK/App 0.38.6, CLI 0.41.12 and templates 0.35.5. Configure installation through the manifest and generated wizard; do not add App ACL writers, root hooks or independent port state.
 
 ```yaml
 install: