@synopackageland/cli 0.41.3 → 0.41.5

package/CHANGELOG.md

@@ -1,6 +1,18 @@
 # Changelog
 
-## Unreleased
+## 0.41.5
+
+- Generate dedicated shared folders and guarded existing-folder choices, retain upgrade selections, validate required HTTPS settings before Next, and enable cold sign-in resume for all gateway modes. Pin templates 0.35.3 and SDK 0.38.2.
+
+- Select and validate host ports in the DSM wizard; materialize gateway, ingress, service definitions and app environment from one retained selection.
+
+## 0.41.4 (2026-10-30)
+
+- Allow `webapi` raw profiles to set `raw_max_bytes` up to 2 GiB, matching
+  SDK/App 0.38.2. That SDK removes Go `JobWebAPI.CallRaw` and
+  `RawWebAPIResult.Body`; raw consumers must move to `CallRawTo(..., io.Writer)`.
+  Templates ~0.35.2 still pin SDK 0.38.1; declare SDK 0.38.2 to use larger raw
+  downloads.
 
 ## 0.41.3 (2026-10-30)
 

package/README.md

@@ -88,7 +88,7 @@ alongside npm lockfiles. Do not disable checksum verification for public SDK
 packages. Private mirrors can use explicitly configured Go authentication and
 checksum settings; a failed fetch reports `SDK_DOWNLOAD_FAILED`.
 
-CLI 0.41.3 uses templates ~0.35.2, whose default SDK pin is 0.38.1. Compose import and SDK defaults
+CLI 0.41.5 uses templates ~0.35.3, whose default SDK pin is 0.38.2. Compose import and SDK defaults
 read the SDK pin from the installed templates; explicit App SDK declarations take precedence.
 Every App method must be declared in the permissions table. Dynamic names and
 custom HTTP dispatchers are rejected. With SDK 0.33.0, use fixed
@@ -99,7 +99,7 @@ unimported development commands are excluded. Use
 authentication. See [App entry and registration](docs/app-entry.md).
 
 `init` and `add` read their templates from the locally installed
-`@synopackageland/templates`. CLI 0.41.3 depends on `~0.35.2`: npm installation or
+`@synopackageland/templates`. CLI 0.41.5 depends on `~0.35.3`: npm installation or
 update can select the latest templates patch in the 0.35 minor line. Templates
 patches need only a templates release; update the npm installation to receive them.
 The CLI never fetches templates at runtime, so offline use works after installation;

package/dist/build-spk/compose-diagnosis.js

@@ -8,5 +8,5 @@ export function composeDiagnosisMessages() {
 }
 /** Diagnostics are informational and cannot mask or replace a native result. */
 export function renderComposeDiagnosis(project, phase) {
-    return `"${project}/control" diagnose --project "${project}" --phase ${phase} || :\n`;
+    return `"${project}/control" diagnose --project "${project}" --phase ${phase} >/dev/null || :\n`;
 }

package/dist/build-spk/share-validation.d.ts

@@ -0,0 +1,3 @@
+/** Read-only DSM wizard validation. Permission metadata is advisory; runtime
+ * repeats the kernel check as the package account before opening any mount. */
+export declare function existingShareValidator(account: string, permission: 'ro' | 'rw', reason: string, blank?: boolean, dedicatedName?: string): string;

package/dist/build-spk/share-validation.js

@@ -0,0 +1,5 @@
+/** Read-only DSM wizard validation. Permission metadata is advisory; runtime
+ * repeats the kernel check as the package account before opening any mount. */
+export function existingShareValidator(account, permission, reason, blank = false, dedicatedName = '') {
+    return `{var name=arguments[0];if(!name)return ${blank ? 'true' : JSON.stringify(reason)};if(typeof name!=='string'||name.length>32||/[\\x00-\\x1f\\x7f/\\\\]/.test(name)||/^(homes?|users|ftp|root|admin|guest|system|volume[0-9]*|(usb|sata|sd)share[0-9]*|ActiveBackupforBusiness|surveillance|docker|web_packages)$/i.test(name))return ${JSON.stringify(reason)};try{var login=new XMLHttpRequest();login.open('GET','/webman/login.cgi?enable_syno_token=yes',false);login.send();var token=JSON.parse(login.responseText).SynoToken;if(!token)throw new Error();function call(api,method,params){var x=new XMLHttpRequest();x.open('POST','/webapi/entry.cgi',false);x.setRequestHeader('Content-Type','application/x-www-form-urlencoded');x.setRequestHeader('X-SYNO-TOKEN',token);var data={api:api,version:1,method:method};Object.keys(params).forEach(function(k){data[k]=params[k]});x.send(Object.keys(data).map(function(k){return encodeURIComponent(k)+'='+encodeURIComponent(data[k])}).join('&'));if(x.status!==200)throw new Error();var j=JSON.parse(x.responseText);if(j.success!==true){var e=new Error();e.code=j.error&&j.error.code;throw e;}return j.data}var share;try{share=call('SYNO.Core.Share','get',{name:name,additional:JSON.stringify(['encryption','is_aclmode','is_force_readonly','is_share_moving','is_missing_share','is_offline_share','is_c2_share','load_worm_attr'])});}catch(e){if(name===${JSON.stringify(dedicatedName)}&&e.code===402)return true;throw e;}if(!share||share.name!==name||share.is_usb_share||share.is_aclmode!==true||share.encryption===2||share.is_force_readonly||share.is_share_moving||share.is_missing_share||share.is_offline_share||share.is_c2_share||share.is_worm_share||share.worm_state) return ${JSON.stringify(reason)};if(name===${JSON.stringify(dedicatedName)})return true;var rows=call('SYNO.Core.Share.Permission','list_by_user',{name:${JSON.stringify(account)},user_group_type:'local_user',with_inherit:true,limit:-1,offset:0}).shares;var row=rows&&rows.filter(function(r){return r.name===name})[0];if(!row||row.is_deny||row.is_custom||row.is_mask||!${permission === 'rw' ? 'row.is_writable' : '(row.is_readonly||row.is_writable)'})return ${JSON.stringify(reason)};return true}catch(e){return ${JSON.stringify(reason)}}}`;
+}

package/dist/build-spk/wizard-messages.d.ts

@@ -1,4 +1,103 @@
 export declare const WIZARD_MESSAGES: {
+    "ports.http": {
+        en: string;
+        "zh-TW": string;
+        "zh-CN": string;
+        ja: string;
+        ko: string;
+        de: string;
+        fr: string;
+        es: string;
+        it: string;
+    };
+    "ports.https": {
+        en: string;
+        "zh-TW": string;
+        "zh-CN": string;
+        ja: string;
+        ko: string;
+        de: string;
+        fr: string;
+        es: string;
+        it: string;
+    };
+    "ports.signin": {
+        en: string;
+        "zh-TW": string;
+        "zh-CN": string;
+        ja: string;
+        ko: string;
+        de: string;
+        fr: string;
+        es: string;
+        it: string;
+    };
+    "ports.title": {
+        en: string;
+        "zh-TW": string;
+        "zh-CN": string;
+        ja: string;
+        ko: string;
+        de: string;
+        fr: string;
+        es: string;
+        it: string;
+    };
+    "ports.invalid": {
+        en: string;
+        "zh-TW": string;
+        "zh-CN": string;
+        ja: string;
+        ko: string;
+        de: string;
+        fr: string;
+        es: string;
+        it: string;
+    };
+    "ports.originInvalid": {
+        en: string;
+        "zh-TW": string;
+        "zh-CN": string;
+        ja: string;
+        ko: string;
+        de: string;
+        fr: string;
+        es: string;
+        it: string;
+    };
+    "nativeShare.optionalExisting": {
+        en: string;
+        "zh-TW": string;
+        "zh-CN": string;
+        ja: string;
+        ko: string;
+        de: string;
+        fr: string;
+        es: string;
+        it: string;
+    };
+    "nativeShare.selectionInvalid": {
+        en: string;
+        "zh-TW": string;
+        "zh-CN": string;
+        ja: string;
+        ko: string;
+        de: string;
+        fr: string;
+        es: string;
+        it: string;
+    };
+    "settings.originInvalid": {
+        en: string;
+        "zh-TW": string;
+        "zh-CN": string;
+        ja: string;
+        ko: string;
+        de: string;
+        fr: string;
+        es: string;
+        it: string;
+    };
     "uninstall.composeRetained": {
         en: string;
         "zh-TW": string;

package/dist/build-spk/wizard-messages.js

@@ -1,4 +1,103 @@
 export const WIZARD_MESSAGES = {
+    "ports.http": {
+        "en": "HTTP port",
+        "zh-TW": "HTTP 連接埠",
+        "zh-CN": "HTTP 端口",
+        "ja": "HTTP ポート",
+        "ko": "HTTP 포트",
+        "de": "HTTP-Port",
+        "fr": "Port HTTP",
+        "es": "Puerto HTTP",
+        "it": "Porta HTTP"
+    },
+    "ports.https": {
+        "en": "HTTPS port",
+        "zh-TW": "HTTPS 連接埠",
+        "zh-CN": "HTTPS 端口",
+        "ja": "HTTPS ポート",
+        "ko": "HTTPS 포트",
+        "de": "HTTPS-Port",
+        "fr": "Port HTTPS",
+        "es": "Puerto HTTPS",
+        "it": "Porta HTTPS"
+    },
+    "ports.signin": {
+        "en": "Local sign-in port",
+        "zh-TW": "本機登入連接埠",
+        "zh-CN": "本地登录端口",
+        "ja": "ローカルサインインポート",
+        "ko": "로컬 로그인 포트",
+        "de": "Lokaler Anmeldeport",
+        "fr": "Port de connexion local",
+        "es": "Puerto de inicio de sesión local",
+        "it": "Porta di accesso locale"
+    },
+    "ports.title": {
+        "en": "App ports",
+        "zh-TW": "應用程式連接埠",
+        "zh-CN": "应用程序端口",
+        "ja": "アプリのポート",
+        "ko": "앱 포트",
+        "de": "App-Ports",
+        "fr": "Ports de l’application",
+        "es": "Puertos de la aplicación",
+        "it": "Porte dell’app"
+    },
+    "ports.invalid": {
+        "en": "Choose a port from 1024 to 65535 that is not reserved or used by another service; DSM must be able to verify it",
+        "zh-TW": "請選擇 1024 至 65535 間未保留、未被其他服務使用的連接埠；DSM 必須能確認其狀態",
+        "zh-CN": "请选择 1024 至 65535 之间未保留、未被其他服务使用的端口；DSM 必须能确认其状态",
+        "ja": "1024～65535 の予約済みでも他サービスが使用中でもないポートを選択してください（DSM による確認が必要）",
+        "ko": "1024~65535 사이에서 예약되지 않고 다른 서비스가 사용하지 않는 포트를 선택하십시오 (DSM 확인 필요)",
+        "de": "Wählen Sie einen nicht reservierten, unbenutzten Port von 1024 bis 65535, den DSM prüfen kann",
+        "fr": "Choisissez un port de 1024 à 65535 non réservé et non utilisé par un autre service, vérifiable par DSM",
+        "es": "Seleccionar un puerto entre 1024 y 65535 que no esté reservado ni en uso y que DSM pueda verificar",
+        "it": "Selezionare una porta da 1024 a 65535 non riservata né usata da altri servizi e verificabile da DSM"
+    },
+    "ports.originInvalid": {
+        "en": "Enter a root HTTPS origin using the HTTPS port selected in this wizard",
+        "zh-TW": "請輸入根 HTTPS 來源，並使用此精靈所選的 HTTPS 連接埠",
+        "zh-CN": "请输入根 HTTPS 源，并使用此向导所选的 HTTPS 端口",
+        "ja": "このウィザードで選択した HTTPS ポートを使うルート HTTPS オリジンを入力してください",
+        "ko": "이 마법사에서 선택한 HTTPS 포트의 루트 HTTPS 원본을 입력하십시오",
+        "de": "Geben Sie einen HTTPS-Ursprung mit dem hier gewählten HTTPS-Port ein",
+        "fr": "Saisissez une origine HTTPS racine avec le port HTTPS choisi dans cet assistant",
+        "es": "Introducir un origen HTTPS raíz con el puerto HTTPS elegido en este asistente",
+        "it": "Inserire un’origine HTTPS radice con la porta HTTPS selezionata in questa procedura"
+    },
+    "nativeShare.optionalExisting": {
+        "en": "Optional: choose an accessible existing shared folder, or leave empty to create {name}",
+        "zh-TW": "選填：選擇已有權限的共用資料夾，留空則建立 {name}",
+        "zh-CN": "可选：选择已有权限的共享文件夹，留空则创建 {name}",
+        "ja": "アクセス可能な既存の共有フォルダを選択するか、空欄で {name} を作成",
+        "ko": "접근 가능한 기존 공유 폴더를 선택하거나 비워 두어 {name} 생성",
+        "de": "Optional: zugänglichen vorhandenen gemeinsamen Ordner wählen oder leer lassen, um {name} zu erstellen",
+        "fr": "Facultatif : choisissez un dossier partagé accessible ou laissez vide pour créer {name}",
+        "es": "Opcional: elija una carpeta compartida accesible o deje vacío para crear {name}",
+        "it": "Facoltativo: scegli una cartella condivisa accessibile o lascia vuoto per creare {name}"
+    },
+    "nativeShare.selectionInvalid": {
+        "en": "Cannot verify the required package-account access to this folder, or the folder is unsupported; choose the dedicated folder or ask an administrator to grant the declared RO/RW permission",
+        "zh-TW": "無法確認套件帳號對此資料夾具有所需權限，或不支援此資料夾；請使用專用資料夾，或請管理員授予宣告的 RO/RW 權限",
+        "zh-CN": "无法确认套件账户对此文件夹具有所需权限，或不支持此文件夹；请使用专用文件夹，或请管理员授予声明的 RO/RW 权限",
+        "ja": "必要なパッケージアカウント権限を確認できないか、このフォルダは未対応です。専用フォルダを使用するか、管理者に宣言された RO/RW 権限を依頼してください",
+        "ko": "필요한 패키지 계정 권한을 확인할 수 없거나 지원하지 않는 폴더입니다. 전용 폴더를 사용하거나 관리자에게 선언된 RO/RW 권한을 요청하십시오",
+        "de": "Erforderlicher Paketzugriff nicht bestätigt oder Ordner nicht unterstützt; verwenden Sie den eigenen Ordner oder bitten Sie den Administrator um die deklarierten RO/RW-Rechte",
+        "fr": "Accès du compte du paquet non vérifié ou dossier non pris en charge ; utilisez le dossier dédié ou demandez les droits RO/RW déclarés à l’administrateur",
+        "es": "No se puede verificar el acceso de la cuenta del paquete o la carpeta no es compatible; use la carpeta dedicada o solicite los permisos RO/RW declarados al administrador",
+        "it": "Accesso dell’account del pacchetto non verificato o cartella non supportata; usa la cartella dedicata o chiedi all’amministratore i permessi RO/RW dichiarati"
+    },
+    "settings.originInvalid": {
+        "en": "Enter an HTTPS origin such as https://app.example{port}, without a path, credentials, query or fragment",
+        "zh-TW": "請輸入 HTTPS 來源，例如 https://app.example{port}，不可含路徑、帳密、查詢或片段",
+        "zh-CN": "请输入 HTTPS 源，例如 https://app.example{port}，不可包含路径、凭据、查询或片段",
+        "ja": "https://app.example{port} の形式で HTTPS オリジンを入力してください（パス、認証情報、クエリ、フラグメントは不可）",
+        "ko": "https://app.example{port} 형식의 HTTPS 원본을 입력하십시오 (경로, 자격 증명, 쿼리, 프래그먼트 제외)",
+        "de": "Geben Sie einen HTTPS-Ursprung wie https://app.example{port} ohne Pfad, Anmeldedaten, Abfrage oder Fragment ein",
+        "fr": "Saisissez une origine HTTPS telle que https://app.example{port}, sans chemin, identifiants, requête ni fragment",
+        "es": "Introducir un origen HTTPS como https://app.example{port}, sin rutas ni credenciales ni parámetros ni fragmentos",
+        "it": "Inserisci un’origine HTTPS come https://app.example{port}, senza percorso, credenziali, query o frammento"
+    },
     "uninstall.composeRetained": {
         "en": "Container data volumes are kept, even when you select delete-data: {volumes}. Their data will NOT be deleted.",
         "zh-TW": "即使勾選刪除資料，容器資料磁碟區會保留：{volumes}。其中的資料不會刪除。",
@@ -682,15 +781,15 @@ export const WIZARD_MESSAGES = {
         it: "Se un'approvazione dell'amministratore dell'executor di {package} è ancora valida, la disinstallazione esegue come root il passaggio di disinstallazione root approvato. Senza un'approvazione valida il passaggio viene saltato e ciò che avrebbe rimosso resta da pulire per un amministratore.",
     },
     "nativeShare.selectIntro": {
-        en: "This app keeps its files in a Shared Folder you select below. DSM does not give the app's package account access to a folder chosen here: after installing, open Control Panel > Shared Folder, edit the folder, and under Permissions > System internal user give the package account {account} {permission} access. Until then the app reports that it cannot use the folder.",
-        "zh-TW": "此 App 會把檔案存放在你於下方選擇的共用資料夾。DSM 不會自動讓 App 的套件帳號存取這裡選的資料夾：安裝後請到「控制台」>「共用資料夾」，編輯該資料夾，在「權限」>「系統內部使用者」中授予套件帳號 {account}「{permission}」權限。在此之前，App 會回報無法使用該資料夾。",
-        "zh-CN": "此应用会把文件存放在你在下方选择的共享文件夹。DSM 不会自动让应用的套件账户访问此处所选的文件夹：安装后请前往“控制面板”>“共享文件夹”，编辑该文件夹，在“权限”>“系统内部用户”中授予套件账户 {account}“{permission}”权限。在此之前，应用会报告无法使用该文件夹。",
-        ja: "このアプリは、以下で選択した共有フォルダにファイルを保存します。DSM は、ここで選択したフォルダへのアクセス権をアプリのパッケージアカウントに自動では付与しません。インストール後に [コントロールパネル] > [共有フォルダ] でそのフォルダを編集し、[権限] > [システム内部ユーザー] でパッケージアカウント {account} に「{permission}」権限を付与してください。付与するまで、アプリはこのフォルダを使用できないと報告します。",
-        ko: "이 앱은 아래에서 선택한 공유 폴더에 파일을 저장합니다. DSM은 여기서 선택한 폴더에 대한 접근 권한을 앱의 패키지 계정에 자동으로 부여하지 않습니다. 설치 후 [제어판] > [공유 폴더]에서 해당 폴더를 편집하고 [권한] > [시스템 내부 사용자]에서 패키지 계정 {account}에 '{permission}' 권한을 부여하십시오. 그때까지 앱은 이 폴더를 사용할 수 없다고 보고합니다.",
-        de: "Diese App speichert ihre Dateien in einem freigegebenen Ordner, den Sie unten auswählen. DSM gewährt dem Paketkonto der App keinen automatischen Zugriff auf hier gewählte Ordner: Öffnen Sie nach der Installation Systemsteuerung > Gemeinsamer Ordner, bearbeiten Sie den Ordner und geben Sie dem Paketkonto {account} unter Berechtigungen > Interner Systembenutzer die Berechtigung „{permission}“. Bis dahin meldet die App, dass sie den Ordner nicht verwenden kann.",
-        fr: "Cette application enregistre ses fichiers dans un dossier partagé que vous sélectionnez ci-dessous. DSM n'accorde pas automatiquement au compte de paquet de l'application l'accès à un dossier choisi ici : après l'installation, ouvrez Panneau de configuration > Dossier partagé, modifiez le dossier et, sous Autorisations > Utilisateur système interne, accordez au compte de paquet {account} l'accès « {permission} ». D'ici là, l'application signale qu'elle ne peut pas utiliser le dossier.",
-        es: "Esta aplicación guarda sus archivos en una carpeta compartida que seleccione a continuación. DSM no concede automáticamente a la cuenta de paquete de la aplicación acceso a una carpeta elegida aquí: después de instalar, abra Panel de control > Carpeta compartida, edite la carpeta y, en Permisos > Usuario interno del sistema, conceda a la cuenta de paquete {account} el acceso «{permission}». Hasta entonces, la aplicación informará de que no puede usar la carpeta.",
-        it: "Questa app salva i propri file in una cartella condivisa selezionata qui sotto. DSM non concede automaticamente all'account del pacchetto dell'app l'accesso a una cartella scelta qui: dopo l'installazione aprire Pannello di controllo > Cartella condivisa, modificare la cartella e, in Autorizzazioni > Utente interno del sistema, concedere all'account del pacchetto {account} l'accesso «{permission}». Fino ad allora l'app segnalerà di non poter usare la cartella.",
+        "en": "Choose an existing shared folder that already gives package account {account} {permission} access; the wizard verifies it before installation",
+        "zh-TW": "選擇已授予套件帳號 {account} {permission} 權限的既有共用資料夾；精靈會在安裝前驗證",
+        "zh-CN": "选择已授予套件账户 {account} {permission} 权限的现有共享文件夹；向导会在安装前验证",
+        "ja": "パッケージアカウント {account} に {permission} 権限がある既存の共有フォルダを選択してください（インストール前に確認します）",
+        "ko": "패키지 계정 {account}에 {permission} 권한이 있는 기존 공유 폴더를 선택하십시오 (설치 전 확인)",
+        "de": "Wählen Sie einen vorhandenen gemeinsamen Ordner mit {permission}-Zugriff für Paketkonto {account}; der Assistent prüft dies vor der Installation",
+        "fr": "Choisissez un dossier partagé existant avec les droits {permission} pour le compte du paquet {account} ; l’assistant les vérifie avant l’installation",
+        "es": "Seleccionar una carpeta compartida existente con acceso {permission} para la cuenta del paquete {account}; el asistente lo verifica antes de instalar",
+        "it": "Selezionare una cartella condivisa esistente con accesso {permission} per l’account del pacchetto {account}; la procedura verifica prima dell’installazione"
     },
     "nativeShare.createIntro": {
         en: "This app creates the Shared Folder {name} and gives its package account {permission} access to it. If {name} already exists, it is kept and only the package account's permission is set. Uninstalling the app never deletes this Shared Folder or the files in it.",

package/dist/cli.js

@@ -516,7 +516,7 @@ async function runCliWithin(argv) {
         .option("--ui <vue|plain>", `Native UI ${JSON.parse(readFileSync(join(templatesRoot(), "native-go-vue/frontend/package.json"), "utf8")).dependencies["@synopackageland/ui"]} by default (vue); plain uses ui/app.js`)
         .option("--with <caps>", `Capabilities (comma-separated): ${CAPABILITY_NAMES.join(",")}`)
         .option("--from <compose.yaml>", "compose: import an existing Compose; omit to create an example")
-        .option("--shared-folder <select|create>", "Select or create a shared folder in the install wizard")
+        .option("--shared-folder <dedicated|select|create>", "Use a dedicated shared folder by default, or select an existing folder")
         .option("--shared-folder-name <name>", "Name of the shared folder to create")
         .option("--shared-folder-key <key>", "Settings key, defaults to shared")
         .option("--shared-folder-permission <ro|rw>", "Package account permission, defaults to rw")

package/dist/deploy/native-install-values.js

@@ -1,3 +1,4 @@
+import { portDefaults } from "../standalone/install-ports.js";
 const USAGE = "synopkgland deploy --param delegate_share=<shared folder>, or --param delegate_home=true";
 /** Mirrors the preinst draft check in build-spk/delegate-scope.ts. */
 function validShareName(name) {
@@ -13,14 +14,15 @@ function validShareName(name) {
 export function resolveNativeInstallValues(manifest, provided, state) {
     const fail = (code, message) => ({ ok: false, code, message });
     const selected = manifest.capabilities.delegate?.scope === "install-selected";
-    const folder = manifest.sharedFolder?.mode === "select" ? manifest.sharedFolder : undefined;
+    const folder = manifest.sharedFolder && manifest.sharedFolder.mode !== "create" ? manifest.sharedFolder : undefined;
     const key = folder?.key;
     const changeKey = key ? `CHANGE_${key}` : undefined;
     const settingNames = Object.keys(manifest.installSettings ?? {}).map(key => `pkgwizard_setting_${key}`);
+    const portNames = Object.keys(portDefaults(manifest)).map(key => "pkgwizard_port_" + key);
     const names = Object.keys(provided);
-    if (!selected && !folder && !settingNames.length && names.length)
+    if (!selected && !folder && !settingNames.length && !portNames.length && names.length)
         return fail("DEPLOY_PARAM_UNDECLARED", `${manifest.package} has no install wizard values; remove --param ${names[0]}.`);
-    const unknown = names.find((name) => !(selected && (name === "delegate_share" || name === "delegate_home")) && name !== key && name !== changeKey && !settingNames.includes(name));
+    const unknown = names.find((name) => !(selected && (name === "delegate_share" || name === "delegate_home")) && name !== key && name !== changeKey && !settingNames.includes(name) && !portNames.includes(name));
     if (unknown)
         return fail("DEPLOY_PARAM_UNDECLARED", `--param ${unknown} is not an install wizard value. Use: ${folder ? `--param ${folder.key}=<shared folder>` : USAGE}.`);
     if (key && changeKey) {
@@ -29,11 +31,21 @@ export function resolveNativeInstallValues(manifest, provided, state) {
             return fail("DEPLOY_PARAM_TYPE_INVALID", `--param ${changeKey} must be true or false.`);
         if (name !== undefined && (name === "" || /[/\\"\x00-\x1f\x7f]/.test(name) || name.includes("..") || /^[.@]/.test(name)))
             return fail("DEPLOY_PARAM_TYPE_INVALID", `--param ${key} must be one DSM Shared Folder name, never a path.`);
-        if ((!state.installed || change === "true") && name === undefined)
+        if ((!state.installed || change === "true") && name === undefined && folder?.mode !== "dedicated")
             return fail("DEPLOY_PARAM_REQUIRED", `Select the native Shared Folder with --param ${key}=<shared folder>.`);
         if (state.installed && name !== undefined && change !== "true")
             return fail("DEPLOY_PARAM_REQUIRED", `Changing the selected folder requires --param ${changeKey}=true and --param ${key}=<shared folder>.`);
     }
+    for (const name of portNames) {
+        const raw = provided[name];
+        if (raw === undefined)
+            continue;
+        const port = Number(raw);
+        if (state.installed)
+            return fail('DEPLOY_PARAM_TYPE_INVALID', 'Changing selected ports requires reinstall');
+        if (!/^[1-9][0-9]{3,4}$/.test(raw) || port < 1024 || port > 65535 || [1900, 5000, 5001, 5005, 5006, 5353, 6690].includes(port))
+            return fail('DEPLOY_PARAM_TYPE_INVALID', 'Choose non-reserved ports from 1024 to 65535');
+    }
     const share = selected ? provided.delegate_share : undefined, home = selected ? provided.delegate_home : undefined;
     if (home !== undefined && home !== "true" && home !== "false")
         return fail("DEPLOY_PARAM_TYPE_INVALID", "--param delegate_home must be true or false.");

package/dist/error-registry.js

@@ -13,6 +13,8 @@ export const ERROR_REGISTRY = {
     INIT_PUBLISHER_INVALID: { code: "INIT_PUBLISHER_INVALID", description: "The attribution name or publisher URL is invalid.", suggestion: "Use plain single-line project/publisher names and an http(s) publisher URL without credentials." },
     UPSTREAM_ATTRIBUTION: { code: "UPSTREAM_ATTRIBUTION", description: "Upstream App attribution is incomplete or names the distributor as maintainer.", suggestion: "Name the original project/team or owner as maintainer; set metadata.maintainer_url to the upstream repository and metadata.distributor/distributor_url to your publisher; resolve TODOs before release." },
     INSTALL_SETTINGS_INVALID: { "code": "INSTALL_SETTINGS_INVALID", "description": "The installation setting declaration is invalid.", "suggestion": "Declare 1–32 lowercase identifier keys in install.settings, each with type https-origin, a plain label and an explicit boolean required; omit defaults and values." },
+    INSTALL_PORT_INVALID: { code: "INSTALL_PORT_INVALID", description: "The installation port declaration or selected value is invalid", suggestion: "Enable install.ports for a declared identity gateway and choose distinct available non-reserved ports between 1024 and 65535" },
+    SDK_PORT_SETTINGS_UNSUPPORTED: { code: "SDK_PORT_SETTINGS_UNSUPPORTED", description: "The selected SDK does not provide installer-selected ports", suggestion: "Pin SDK 0.38.2 or a matching supported release and rebuild with the matching CLI" },
     SDK_INSTALL_SETTINGS_UNSUPPORTED: { "code": "SDK_INSTALL_SETTINGS_UNSUPPORTED", "description": "The selected SDK does not provide native installation settings.", "suggestion": "Pin SDK 0.24.0 or a matching supported release with installsettings/cmd/control, then rebuild with the matching CLI." },
     SDK_INSTALL_SETTINGS_BUILD_FAILED: { "code": "SDK_INSTALL_SETTINGS_BUILD_FAILED", "description": "The SDK installation settings controller could not be built.", "suggestion": "Install the pinned Go toolchain, inspect the compiler diagnostics and rebuild with a complete matching SDK release." },
     BACKUP_INVALID: { code: "BACKUP_INVALID", description: "The Hyper Backup application backup declaration or its packaged scripts are invalid.", suggestion: "Use backup.hyper_backup: false to opt out, or only online, data_version (\"major.minor\") and hook; rebuild so scripts/backup holds exactly the fixed export, import, info and version files." },

package/dist/init.d.ts

@@ -26,7 +26,7 @@ export interface InitOptions {
     healthStatus?: number;
     /** native-go: `install.sharedFolder` (select from the NAS, or create one). key defaults to "shared", permission to "rw". */
     sharedFolder?: {
-        mode: "select" | "create";
+        mode: "select" | "create" | "dedicated";
         name?: string;
         key?: string;
         permission?: "ro" | "rw";

package/dist/init.js

@@ -401,6 +401,7 @@ function importCompose(from, targetDir) {
     else {
         doc.deleteIn(["compose", "web"]);
         doc.delete("identity_gateway");
+        doc.deleteIn(["install", "ports"]);
     } // Ambiguous ingress requires an explicit developer decision.
     writeFileSync(path, String(doc));
 }

package/dist/runtime/webapi-profile.js

@@ -8,7 +8,7 @@ export function validWebAPIProfiles(value) {
     for (const [name, p] of Object.entries(value)) {
         if (!/^[a-z][a-z0-9_-]{0,63}$/.test(name) || name === 'home' || !record(p) || Object.keys(p).some(k => !['purpose', 'apis', 'raw_max_bytes'].includes(k)) || typeof p.purpose !== 'string' || !p.purpose.trim() || Buffer.byteLength(p.purpose) > 1024 || /[\x00-\x1f\x7f]/.test(p.purpose) || !record(p.apis) || !Object.keys(p.apis).length)
             return false;
-        if (p.raw_max_bytes !== undefined && (!Number.isSafeInteger(p.raw_max_bytes) || Number(p.raw_max_bytes) < 0 || Number(p.raw_max_bytes) > 67108864))
+        if (p.raw_max_bytes !== undefined && (!Number.isSafeInteger(p.raw_max_bytes) || Number(p.raw_max_bytes) < 0 || Number(p.raw_max_bytes) > 2147483648))
             return false;
         for (const [api, methods] of Object.entries(p.apis)) {
             if (!/^SYNO\.[A-Za-z][A-Za-z0-9]*(\.[A-Za-z][A-Za-z0-9]*)*$/.test(api) || api.toLowerCase().split('.').slice(1).some(x => blocked.has(x)) || !record(methods) || !Object.keys(methods).length)

package/dist/standalone/compose.d.ts

@@ -94,6 +94,10 @@ export declare function readComposeApp(value: unknown, root: string, arches: Nat
     composeMounts?: boolean;
     sharedFolder?: SharedFolder;
     installSettings?: InstallSettings;
+    installPorts?: Record<string, {
+        default: number;
+        protocol: "tcp";
+    }>;
     resolveImages?: boolean;
     architecture?: NativeArchFamily;
     imageProofs?: unknown;

package/dist/standalone/compose.js

@@ -109,8 +109,9 @@ export function readComposeApp(value, root, arches, fail, context = {}) {
                 package: context.package ?? "ComposeApp",
                 identity_mode: context.mode ?? "none",
                 compose_mounts: context.composeMounts === true,
-                ...(context.sharedFolder?.mode === "select" ? { install_shared_folder: context.sharedFolder } : {}),
+                ...(context.sharedFolder && context.sharedFolder.mode !== "create" ? { install_shared_folder: context.sharedFolder } : {}),
                 install_settings: context.installSettings,
+                install_ports: context.installPorts,
                 resolve_images: context.resolveImages === true,
                 registry_mirrors: context.resolveImages &&
                     process.env.SYNOPKGLAND_COMPOSE_REGISTRY_MIRRORS

package/dist/standalone/daemon.js

@@ -1,3 +1,4 @@
+import { portDefaults } from "./install-ports.js";
 import { operationBudgetSeconds, runtimeBudgetSdkSupported } from "../runtime/runtime-budgets.js";
 import { goChildEnv } from "../runtime/go-env.js";
 import { chmodSync, existsSync, copyFileSync, lstatSync, mkdirSync, readdirSync, readFileSync, realpathSync, writeFileSync, } from "node:fs";
@@ -185,7 +186,7 @@ export function daemonConfig(manifest) {
         args,
         ...(uninstall_args ? { uninstall_args } : {}),
         ...(restart ? { restart } : {}),
-        env,
+        env: { ...env, ...Object.fromEntries(Object.entries(portDefaults(manifest)).map(([key, p]) => ["SYNOPKGLAND_PORT_" + key.toUpperCase(), String(p.default)])) },
         timeouts,
         ...(runtimeBudgetSdkSupported(daemonSdkVersion(manifest))
             ? { operation_seconds: operationBudgetSeconds(manifest) } : {}),

package/dist/standalone/dsm-window.js

@@ -117,8 +117,7 @@ export function windowAppId(manifest) {
 }
 /** Whether the window itself resumes a cold DSM sign-in; with a console the url launcher does. */
 function windowResumesOIDC(manifest) {
-    const oidc = manifest.identityGateway?.oidc;
-    return Boolean((oidc?.native_login || oidc?.browser) && !manifest.console);
+    return Boolean(manifest.identityGateway && !manifest.console);
 }
 /**
  * `ui/config`: registers the DSM main-menu app and its window class. With a