@synopackageland/cli 0.41.2 → 0.41.4

package/CHANGELOG.md

@@ -2,6 +2,23 @@
 
 ## Unreleased
 
+## 0.41.4 (2026-10-30)
+
+- Allow `webapi` raw profiles to set `raw_max_bytes` up to 2 GiB, matching
+  SDK/App 0.38.2. That SDK removes Go `JobWebAPI.CallRaw` and
+  `RawWebAPIResult.Body`; raw consumers must move to `CallRawTo(..., io.Writer)`.
+  Templates ~0.35.2 still pin SDK 0.38.1; declare SDK 0.38.2 to use larger raw
+  downloads.
+
+## 0.41.3 (2026-10-30)
+
+- Build Portal Apps without an executor on DSM 7.2-64570+ using the App SDK
+  pin for the panel text. Keep executor SDK selection unchanged.
+- Reject a no-executor Portal without an SDK during both check and build
+  (`STANDALONE_PORTAL_SDK_REQUIRED`); cover the Portal/executor/SDK/DSM matrix
+  and a real Go CGI-to-SPK build.
+- Complete diagnostics for invalid external caller declarations and entry policies.
+
 ## 0.41.2 (2026-10-29)
 
 - Require templates ~0.35.2 with SDK/App 0.38.1 and clean registry metadata.

package/README.md

@@ -76,13 +76,19 @@ and checks both payloads against the resolved SDK's `executor-manifest.json`.
 The manifest declares format 1, the exact executor release, its Go toolchain and
 six SHA-256 digests. SDK minor versions are independent of CLI minor versions.
 
+Portal panel text comes from the App's SDK even when it has no executor: the
+existing `identity_gateway.sdk` pin, or otherwise the backend SDK requirement
+(`backend/go.mod`, `backend.sdk`, Rust SDK tag, or project `go.mod` for a binary).
+A Portal without an SDK is rejected by both `check` and `build` with
+`STANDALONE_PORTAL_SDK_REQUIRED`. DSM 7.2-64570+ needs no executor for Portal.
+
 SDK module downloads preserve normal Go checksum verification and the user's Go
 settings; Go Apps also check their existing `backend/go.sum`. Commit that file
 alongside npm lockfiles. Do not disable checksum verification for public SDK
 packages. Private mirrors can use explicitly configured Go authentication and
 checksum settings; a failed fetch reports `SDK_DOWNLOAD_FAILED`.
 
-CLI 0.41.2 uses templates ~0.35.2, whose default SDK pin is 0.38.1. Compose import and SDK defaults
+CLI 0.41.4 uses templates ~0.35.2, whose default SDK pin is 0.38.1. Compose import and SDK defaults
 read the SDK pin from the installed templates; explicit App SDK declarations take precedence.
 Every App method must be declared in the permissions table. Dynamic names and
 custom HTTP dispatchers are rejected. With SDK 0.33.0, use fixed
@@ -93,7 +99,7 @@ unimported development commands are excluded. Use
 authentication. See [App entry and registration](docs/app-entry.md).
 
 `init` and `add` read their templates from the locally installed
-`@synopackageland/templates`. CLI 0.41.2 depends on `~0.35.2`: npm installation or
+`@synopackageland/templates`. CLI 0.41.4 depends on `~0.35.2`: npm installation or
 update can select the latest templates patch in the 0.35 minor line. Templates
 patches need only a templates release; update the npm installation to receive them.
 The CLI never fetches templates at runtime, so offline use works after installation;

package/dist/error-registry.js

@@ -38,6 +38,21 @@ export const ERROR_REGISTRY = {
             description: "The launcher has Portal fields without a matching explicit Portal declaration.",
             suggestion: "Remove defaultAlias and login fields, or explicitly enable portal and rebuild.",
         },
+        CTL_EXTERNAL_TRANSPORT: {
+            code: "CTL_EXTERNAL_TRANSPORT",
+            description: "External callers require the DSM session transport.",
+            suggestion: "Use the DSM session transport for external entries; remove capabilities.identity from an external-enabled App.",
+        },
+        CTL_EXTERNAL_ENTRY: {
+            code: "CTL_EXTERNAL_ENTRY",
+            description: "An external entry is not a registered administrator RPC method.",
+            suggestion: "Register a fixed RPC method, declare it as administrators in permissions.json, and reference it in ctl.external.",
+        },
+        CTL_EXTERNAL_DECLARATION_INVALID: {
+            code: "CTL_EXTERNAL_DECLARATION_INVALID",
+            description: "ctl.external contains an invalid protocol or RPC method declaration.",
+            suggestion: "Use protocol names mapped to objects with a fixed method, for example ctl.external.mcp: {method: app.mcp}.",
+        },
         LAUNCHER_TYPE_MISMATCH: {
             code: "LAUNCHER_TYPE_MISMATCH",
             description: "The built launcher or INFO entry differs from the declared launch mode.",
@@ -618,6 +633,11 @@ export const ERROR_REGISTRY = {
             description: "console is declared together with portal.",
             suggestion: "Declare either console or portal, not both.",
         },
+        STANDALONE_PORTAL_SDK_REQUIRED: {
+            code: "STANDALONE_PORTAL_SDK_REQUIRED",
+            description: "A Portal App has no SDK pin for its panel text.",
+            suggestion: "Declare the App SDK in backend/go.mod (project go.mod for a binary), backend.sdk, the Rust SDK dependency, or identity_gateway.sdk; otherwise remove portal. An executor is not required on DSM 7.2-64570+.",
+        },
         STANDALONE_PORTAL_REQUIRES_EXECUTOR: {
             code: "STANDALONE_PORTAL_REQUIRES_EXECUTOR",
             description: "An App targeting DSM below 7.2-64570 declares portal without an executor.",

package/dist/runtime/webapi-profile.js

@@ -8,7 +8,7 @@ export function validWebAPIProfiles(value) {
     for (const [name, p] of Object.entries(value)) {
         if (!/^[a-z][a-z0-9_-]{0,63}$/.test(name) || name === 'home' || !record(p) || Object.keys(p).some(k => !['purpose', 'apis', 'raw_max_bytes'].includes(k)) || typeof p.purpose !== 'string' || !p.purpose.trim() || Buffer.byteLength(p.purpose) > 1024 || /[\x00-\x1f\x7f]/.test(p.purpose) || !record(p.apis) || !Object.keys(p.apis).length)
             return false;
-        if (p.raw_max_bytes !== undefined && (!Number.isSafeInteger(p.raw_max_bytes) || Number(p.raw_max_bytes) < 0 || Number(p.raw_max_bytes) > 67108864))
+        if (p.raw_max_bytes !== undefined && (!Number.isSafeInteger(p.raw_max_bytes) || Number(p.raw_max_bytes) < 0 || Number(p.raw_max_bytes) > 2147483648))
             return false;
         for (const [api, methods] of Object.entries(p.apis)) {
             if (!/^SYNO\.[A-Za-z][A-Za-z0-9]*(\.[A-Za-z][A-Za-z0-9]*)*$/.test(api) || api.toLowerCase().split('.').slice(1).some(x => blocked.has(x)) || !record(methods) || !Object.keys(methods).length)

package/dist/standalone/build.js

@@ -25,6 +25,7 @@ import { isBridgeBackend } from "./bridge-backend.js";
 import { requestTimeoutSeconds } from "./request-timeout.js";
 import { buildBridge, prepareBridge, } from "./bridge-build.js";
 import { portalCatalogs } from "./portal-window.js";
+import { portalSdkVersion } from "./portal.js";
 /** Argv only, never a shell; output streams to the terminal except stderr, which is also kept, and captured stdout. */
 export const runCommand = (command, args, options) => new Promise((done) => {
     const child = spawn(command, args, {
@@ -159,9 +160,9 @@ export async function buildStandalone(options) {
             const installSettingsControl = await buildInstallSettings(manifest, arch, archWork, run);
             const appBackupControl = await buildAppBackup(manifest, arch, archWork, run, (w) => warnings.add(w));
             const composeStorageInit = await buildComposeStorageInit(manifest, arch, archWork, run);
-            // A portal needs the executor, so the executor's SDK carries the panel text.
-            const portalText = manifest.portal && executor
-                ? portalCatalogs(sdkSource(executor.sdk).goDir)
+            // Executor Apps keep their executor's SDK; no-root Apps use their own SDK pin.
+            const portalText = manifest.portal
+                ? portalCatalogs(sdkSource(executor?.sdk ?? portalSdkVersion(manifest)).goDir)
                 : undefined;
             await assembleStandaloneSpk({
                 manifest: builtManifest,

package/dist/standalone/manifest.js

@@ -30,6 +30,7 @@ import { LOGIN_COLOR, loginImageProblem, } from "../build-spk/login-style.js";
 import { validateReproducible } from "../reproducible-config.js";
 import { appSdkVersion, SDK_MODULE, sdkSource, } from "../runtime/sdk-source.js";
 import { sdkProblems } from "./sdk-check.js";
+import { portalSdkVersion } from "./portal.js";
 import { readWindowSize } from "./window-size.js";
 import { appSdkTimeouts } from "../runtime/sdk-timeouts.js";
 import { requestTimeoutSeconds, rootRunDeadlineProblem, TIMEOUT_USAGE, validTimeoutSeconds, } from "./request-timeout.js";
@@ -466,6 +467,16 @@ function readManifest(raw, c) {
     if (portal && osMinVer && !isDsmAtLeast(osMinVer, PORTAL_EXECUTOR_MIN_DSM)) {
         c.fail("STANDALONE_PORTAL_MIN_DSM", portalMinDsmMessage(osMinVer, "portal"));
     }
+    if (portal && backend && osMinVer && !portalByExecutor(osMinVer) &&
+        !capabilities.rootOps && !capabilities.delegate && !capabilities.webapi) {
+        try {
+            if (!portalSdkVersion({ backend, root: c.root, identityGateway }))
+                c.fail("STANDALONE_PORTAL_SDK_REQUIRED", "portal needs the App's SDK for its panel text: require github.com/synopackageland/syno-pkg-land-sdk in the Go backend's go.mod (project go.mod for a binary), set backend.sdk for Python/Node, pin the Rust SDK release, or use identity_gateway.sdk. Remove portal if the App has no SDK.");
+        }
+        catch {
+            // sdkProblems reports an invalid backend SDK pin above.
+        }
+    }
     const entryProblem = portal && packageId && displayname && osMinVer && portalByExecutor(osMinVer)
         ? portalEntryProblem(packageId, {
             application: displayname,

package/dist/standalone/portal.d.ts

@@ -1,5 +1,7 @@
 import type { StandaloneManifest } from "./manifest.js";
 import type { PortalPackage } from "../portal/package.js";
+/** The App's existing gateway pin or backend SDK; never the CLI/templates default. */
+export declare function portalSdkVersion(manifest: Pick<StandaloneManifest, "backend" | "root" | "identityGateway">): string | undefined;
 /**
  * A native portal registered through DSM's web-config resource; it opens the
  * package's own DSM window. Below DSM 7.2 the executor registers it instead.

package/dist/standalone/portal.js

@@ -1,4 +1,9 @@
 import { portalByExecutor } from "../build-spk/dsm-version.js";
+import { appSdkVersion } from "../runtime/sdk-source.js";
+/** The App's existing gateway pin or backend SDK; never the CLI/templates default. */
+export function portalSdkVersion(manifest) {
+    return manifest.identityGateway?.sdk ?? appSdkVersion(manifest.backend.kind === "binary" ? { kind: "go", dir: manifest.root } : manifest.backend);
+}
 /**
  * A native portal registered through DSM's web-config resource; it opens the
  * package's own DSM window. Below DSM 7.2 the executor registers it instead.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@synopackageland/cli",
-  "version": "0.41.2",
+  "version": "0.41.4",
   "description": "Syno Package Land Developer Kit CLI",
   "type": "module",
   "bin": {

package/skills/SKILL.md

@@ -24,7 +24,7 @@ Use this guide to initialize, build and inspect own applications or upstream OSS
 
 For an existing open-source App, first read [reference/upstream-fork.md](reference/upstream-fork.md): upstream fork/history + untouched upstream files + all packaging in `synology/`, official container images pinned by tag/index digest, native official release binaries pinned by SHA-256 or a source build hook, and a single tag-merge upgrade command. Use `init --upstream-fork`; never rewrite the App as a component. Integrated upstream Apps require direct DSM administrator entry without a separate App password or an OIDC/SSO server: supported trusted headers first, disabling native login second; the shipped OpenList pattern uses the existing SDK 0.17.3 token adapter (`mode: token`, `access: dsm-admins`, `entry: admin-only`) with server-side Authorization injection. All DSM admins share one upstream admin; token reset requires package restart; WebDAV retains its native credentials.
 
-Use SDK/App 0.38.1 and CLI 0.41.2 for App entry enforcement. Declare every App method
+Use SDK/App 0.38.2 and CLI 0.41.4 for App entry enforcement. Declare every App method
 in the permissions table; dynamic names and unregistered HTTP dispatchers are rejected.
 Use fixed SDK routes and `identity_gateway.upstream_auth_paths` for client API
 paths that rely on upstream authentication. Read

package/skills/reference/portal.md

@@ -2,6 +2,8 @@
 
 Tier: a schema-2 App targeting DSM 7.2-64570+ may declare a Portal without an executor, including a unified Compose App. The CLI adds `instuninst_restart_services="nginx.service"` to INFO (merging service names without duplicates), so DSM reloads nginx after install, upgrade and uninstall. App hooks still run as the package account; a no-privilege App never runs root code. Declaring a Portal does not activate an alias or automatically open it: an administrator must apply the alias through DSM.
 
+Portal needs the App's SDK for its panel text, including the no-executor route. The CLI uses the existing `identity_gateway.sdk` pin when present; otherwise it reads the backend SDK (`backend/go.mod` for Go, `backend.sdk` for Python/Node, the Rust release tag in Cargo.lock, or project `go.mod` for a binary). It does not substitute the CLI/templates SDK default. Without an SDK, `check` and `build` both refuse `STANDALONE_PORTAL_SDK_REQUIRED`: declare the App's SDK or remove Portal. Executor Apps continue using their executor's SDK.
+
 On DSM 7.1 the unsigned web-config worker is unavailable, so entry registration still requires an executor (`rootOps`, `delegate` or `webapi`). `check`/`build` and `add portal` refuse a no-executor App targeting below 7.2 with `STANDALONE_PORTAL_REQUIRES_EXECUTOR`; raise `os_min_ver` to 7.2-64570+, add an executor capability, or omit Portal. `add portal` preserves a supported DSM target; it does not silently upgrade a no-privilege App's target or add root capabilities. The legacy `integration.web.portal` contract is unsupported; use the schema-2 top-level `portal` declaration.
 
 Declare: `portal: {}` or `portal: {alias: my-app}` in dsm-package.yaml (`synopkgland add portal` with os_min_ver 7.2-64570+, or `synopkgland add root-ops portal` for the DSM 7.1 executor route). The alias defaults to the package name in lowercase. Aliases are 1–64 lowercase letters, digits or `-`, not starting or ending with `-`, and not a DSM path or Synology App alias (`webman`, `file`, …). The native-layout `backend: {kind: native}` owns its conf/scripts and its own root helper: `portal: {}` or `{alias}` there needs os_min_ver 7.1-42661+ and writes `synopkgland_portal_alias="<alias>"` and the nginx reload declaration into INFO, which Package Center writes as root, so the product's root helper can trust it; the helper registers the app.d entry (application = INFO displayname) and owns its uninstall cleanup and wizard. inspect checks that INFO line against `native-layout.json`.