@synopackageland/cli 0.41.6 → 0.41.8

package/CHANGELOG.md

@@ -1,5 +1,24 @@
 # Changelog
 
+## 0.41.8 (2026-10-30)
+
+- Preserve the manifest's installer ports, settings and shared-folder context
+  when locking Compose images during build. Apps referencing `install.ports`
+  in runtime environment declarations now build as well as pass check.
+- Cover offline locking and Compose scaffold build/inspection with installer
+  runtime ports in the CLI release gates.
+- Derive app-open smoke expectations from the manifest: an `admin-only` App
+  requires gateway denial for a normal user, with App content and ready markers
+  absent. Administrators and permitted normal users still require ready.
+
+## 0.41.7 (2026-10-30)
+
+- Allow `webapi` raw profiles to set `raw_max_bytes` up to 10 GiB
+  (10737418240 bytes), matching SDK/App 0.38.3 and executor/v0.38.3. The limit
+  shipped in 0.41.6 without a changelog entry. Larger raw downloads need SDK
+  0.38.3; templates ~0.35.5 still pin SDK 0.38.2. Raising a profile limit
+  requires administrator approval and fresh user consent.
+
 ## 0.41.6
 
 - Share administrator, permitted normal-user and fresh anonymous app-open smoke tests through `@synopackageland/cli/e2e`, with manifest-derived entry URLs and explicit missing-account skips.

package/README.md

@@ -88,7 +88,7 @@ alongside npm lockfiles. Do not disable checksum verification for public SDK
 packages. Private mirrors can use explicitly configured Go authentication and
 checksum settings; a failed fetch reports `SDK_DOWNLOAD_FAILED`.
 
-CLI 0.41.5 uses templates ~0.35.3, whose default SDK pin is 0.38.2. Compose import and SDK defaults
+CLI 0.41.7 uses templates ~0.35.5, whose default SDK pin is 0.38.2. Compose import and SDK defaults
 read the SDK pin from the installed templates; explicit App SDK declarations take precedence.
 Every App method must be declared in the permissions table. Dynamic names and
 custom HTTP dispatchers are rejected. With SDK 0.33.0, use fixed
@@ -99,7 +99,7 @@ unimported development commands are excluded. Use
 authentication. See [App entry and registration](docs/app-entry.md).
 
 `init` and `add` read their templates from the locally installed
-`@synopackageland/templates`. CLI 0.41.5 depends on `~0.35.3`: npm installation or
+`@synopackageland/templates`. CLI 0.41.7 depends on `~0.35.5`: npm installation or
 update can select the latest templates patch in the 0.35 minor line. Templates
 patches need only a templates release; update the npm installation to receive them.
 The CLI never fetches templates at runtime, so offline use works after installation;
@@ -275,8 +275,14 @@ appOpenSmoke({ ready: '[data-app-ready]' });
 `ready` is an app-content CSS selector or `{text: 'Exact text'}`. The helper
 reads `dsm-package.yaml` (`app` overrides its filename) and derives the launcher
 and entry using the packaging defaults. `entry` overrides a configured Portal
-alias or ingress URL. Three tests cover administrator (A), normal user with
-Application Privileges (N), and a fresh anonymous browser context (X).
+alias or ingress URL. Three tests cover administrator (A), normal user (N),
+and a fresh anonymous browser context (X). A must reach `ready`. For
+`entry: admin-only`, N must see the SDK gateway's access-denied page, with
+the `ready` and App content markers absent from the DOM. Set `content` to
+an App shell selector or text marker when it differs from `ready`, for example
+`appOpenSmoke({ready: '[data-app-ready]', content: '#app'})`.
+For other entry kinds, N must reach `ready`; grant that account Application
+Privileges as needed. Keep the App's intended entry policy to run the smoke.
 N explicitly skips when neither `DSM_E2E_ACCOUNT_NORMAL` nor its saved profile
 exists; `normal` selects another named account/profile. A defaults to `admin`.
 An expired saved profile needs its account file to sign in again and fails if

package/dist/e2e/app-open.d.ts

@@ -9,6 +9,8 @@ export interface AppOpenSmokeOptions {
     /** Override the manifest-derived entry, e.g. a configured Portal alias. */
     entry?: string;
     ready: SmokeMarker;
+    /** App shell/content marker to exclude on denied pages; defaults to ready. */
+    content?: SmokeMarker;
     /** Required only for an entry the manifest declares upstream-authenticated. */
     publicLogin?: SmokeMarker;
     admin?: string;
@@ -21,6 +23,7 @@ export interface SmokeEntry {
     entry: string;
     window: boolean;
     upstreamAuthenticated: boolean;
+    normalExpectation: 'ready' | 'denied';
 }
 /** Uses the same launch defaults and legacy web entry resolver as packaging. */
 export declare function deriveSmokeEntry(raw: any, entry?: string): SmokeEntry;

package/dist/e2e/app-open.js

@@ -36,7 +36,8 @@ export function deriveSmokeEntry(raw, entry) {
     const upstreamAuthenticated = (gateway?.upstream_access === 'public' && pathname !== menuEntry) ||
         (!native && raw.integration?.web?.access === 'public') ||
         (gateway?.upstream_auth_paths ?? []).some((prefix) => pathname === prefix || pathname.startsWith(prefix.endsWith('/') ? prefix : `${prefix}/`));
-    return { package: raw.package, appId, entry: selected, window: entry ? false : window, upstreamAuthenticated };
+    return { package: raw.package, appId, entry: selected, window: entry ? false : window, upstreamAuthenticated,
+        normalExpectation: raw.entry === 'admin-only' ? 'denied' : 'ready' };
 }
 export function readSmokeEntry(options) {
     return deriveSmokeEntry(parse(readFileSync(options.app ?? 'dsm-package.yaml', 'utf8')), options.entry);

package/dist/e2e/dsm.d.ts

@@ -193,5 +193,7 @@ export declare function openPortal(app: App, path: string, browser?: DialogBrows
 export declare function normalSmokeSkip(user?: string, env?: Env): string | undefined;
 /** Checks rendered errors as well as HTTP errors; ready alone never proves success. */
 export declare function assertSmokePage(page: Page, ready: SmokeMarker, anonymous?: boolean, publicLogin?: SmokeMarker): Promise<void>;
-/** Registers A (admin), N (permitted normal user), X (fresh anonymous context). */
+/** A denied entry must show the SDK denial page and contain no App markers. */
+export declare function assertSmokeAccess(page: Page, root: Page | Locator, options: Pick<AppOpenSmokeOptions, 'ready' | 'content'>, expectation: 'ready' | 'denied', timeout: number): Promise<void>;
+/** Registers A (admin), N (manifest entry policy), X (fresh anonymous context). */
 export declare function appOpenSmoke(options: AppOpenSmokeOptions): void;

package/dist/e2e/dsm.js

@@ -587,7 +587,7 @@ export function normalSmokeSkip(user = "normal", env = process.env) {
     const file = profilePath(env.DSM_E2E_TARGET || "dsm", user, env);
     if (existsSync(file) && loadProfile(file, dsmUrl(env)))
         return undefined;
-    return `Normal-user smoke requires ${key} (mode 600) or a saved ${user} profile with app permission.`;
+    return `Normal-user smoke requires ${key} (mode 600) or a saved ${user} profile.`;
 }
 function marker(root, value) {
     return typeof value === "string" ? root.locator(value).first()
@@ -610,6 +610,7 @@ async function dsmLoginVisible(page) {
 }
 const signInText = /sign in to DSM|log in to DSM|\u767b\u5165 DSM|\u767b\u5f55 DSM/i;
 const errorText = /(?:^|\n)\s*(?:[45]0[0-9]\b|internal server error|bad gateway|service unavailable|gateway timeout|not found|access denied|you are not authorized)/i;
+const gatewayDenied = '[data-error-code="dsm_admin_required"][data-i18n="gateway.admin_required"], [data-error-code="dsm_app_privilege_denied"][data-i18n="gateway.app_privilege_denied"]';
 /** Checks rendered errors as well as HTTP errors; ready alone never proves success. */
 export async function assertSmokePage(page, ready, anonymous = false, publicLogin) {
     if (await page.locator('body').innerText().then(text => errorText.test(text)))
@@ -629,7 +630,24 @@ export async function assertSmokePage(page, ready, anonymous = false, publicLogi
         throw new Error('Signed-in app smoke reached a login gate.');
     }
 }
-/** Registers A (admin), N (permitted normal user), X (fresh anonymous context). */
+/** A denied entry must show the SDK denial page and contain no App markers. */
+export async function assertSmokeAccess(page, root, options, expectation, timeout) {
+    if (expectation === 'ready') {
+        await marker(root, options.ready).waitFor({ state: 'visible', timeout });
+        await assertSmokePage(page, options.ready);
+        return;
+    }
+    await root.locator(gatewayDenied).first().waitFor({ state: 'visible', timeout });
+    if (await dsmLoginVisible(page))
+        throw new Error('Denied app smoke reached a login gate.');
+    if (await marker(root, options.ready).count() || await marker(root, options.content ?? options.ready).count()) {
+        throw new Error('Denied app smoke exposed app content or its ready marker.');
+    }
+    if (await page.locator('body').innerText().then(text => /(?:^|\n)\s*(?:50[0-9]\b|internal server error|bad gateway|service unavailable|gateway timeout)/i.test(text))) {
+        throw new Error('Denied app smoke reached a server error page.');
+    }
+}
+/** Registers A (admin), N (manifest entry policy), X (fresh anonymous context). */
 export function appOpenSmoke(options) {
     const entry = readSmokeEntry(options);
     if (entry.upstreamAuthenticated && !options.publicLogin) {
@@ -644,7 +662,8 @@ export function appOpenSmoke(options) {
     if (normal === admin)
         throw new Error('Normal smoke must use a separate named profile.');
     for (const [role, user] of [['A administrator', admin], ['N normal user', normal]]) {
-        test(`${entry.package}: app opens — ${role}`, {
+        const expectation = user === normal ? entry.normalExpectation : 'ready';
+        test(`${entry.package}: app opens — ${role}${expectation === 'denied' ? ' (access denied)' : ''}`, {
             timeout, skip: user === normal ? normalSmokeSkip(normal) : undefined,
         }, async ({ app, browser }) => {
             await signIn(app, user);
@@ -659,8 +678,7 @@ export function appOpenSmoke(options) {
             try {
                 const root = entry.window ? await openApp(app, entry.appId, timeout, browser)
                     : (await handleDialogs(browser), await openPath(app, new URL(entry.entry, dsmUrl()).href), dsmPage());
-                await marker(root, options.ready).waitFor({ state: 'visible', timeout });
-                await assertSmokePage(page, options.ready);
+                await assertSmokeAccess(page, root, options, expectation, timeout);
                 if (failures.length)
                     throw new Error(`App smoke received HTTP ${failures.join(', ')}.`);
             }

package/dist/standalone/compose.d.ts

@@ -87,6 +87,21 @@ export interface ComposeApp {
     plan: ComposePlan;
 }
 export declare const COMPOSE_FIELDS: readonly ["host_udp", "devices", "startup_timeout_seconds", "resource_prefix", "files", "env_files", "profiles", "web", "data", "shares", "network", "services", "helpers", "sdk"];
+/** Keep manifest parsing and image-lock replanning on the same installation context. */
+export declare function composeManifestContext(m: Pick<StandaloneManifest, 'identityGateway' | 'capabilities' | 'sharedFolder' | 'installSettings' | 'installPorts'> & {
+    package?: string;
+}): {
+    package: string | undefined;
+    sdk: string | undefined;
+    mode: import("./identity-gateway.js").GatewayMode;
+    composeMounts: true | undefined;
+    sharedFolder: SharedFolder | undefined;
+    installSettings: InstallSettings | undefined;
+    installPorts: Record<string, {
+        default: number;
+        protocol: "tcp";
+    }> | undefined;
+};
 export declare function readComposeApp(value: unknown, root: string, arches: NativeArchFamily[], fail: (e: StandaloneError) => void, context?: {
     package?: string;
     sdk?: string;

package/dist/standalone/compose.js

@@ -1,3 +1,4 @@
+import { portDefaults } from './install-ports.js';
 import { validComposeAppData } from "../runtime/compose-data.js";
 import { composeDiagnosisMessages, renderComposeDiagnosis } from "../build-spk/compose-diagnosis.js";
 import { COMPOSE_ERRORS } from "./compose-errors.js";
@@ -58,6 +59,18 @@ function planner(sdk) {
     process.once("exit", () => rmSync(work, { recursive: true, force: true }));
     return out;
 }
+/** Keep manifest parsing and image-lock replanning on the same installation context. */
+export function composeManifestContext(m) {
+    return {
+        package: m.package,
+        sdk: m.identityGateway?.sdk,
+        mode: m.identityGateway?.mode ?? 'none',
+        composeMounts: m.capabilities.composeMounts,
+        sharedFolder: m.sharedFolder,
+        installSettings: m.installSettings,
+        installPorts: m.installPorts ? portDefaults(m) : undefined,
+    };
+}
 export function readComposeApp(value, root, arches, fail, context = {}) {
     if (value === undefined)
         return;
@@ -287,12 +300,8 @@ export function lockComposeImages(m, arch, resolveImages, imageProofs) {
     const compose = readComposeApp(m.compose.declaration, m.root, m.arches, (e) => {
         error = e;
     }, {
-        package: m.package,
+        ...composeManifestContext(m),
         sdk: m.compose.sdk,
-        mode: m.identityGateway?.mode ?? "none",
-        composeMounts: m.capabilities.composeMounts,
-        sharedFolder: m.sharedFolder,
-        installSettings: m.installSettings,
         resolveImages,
         architecture: arch,
         imageProofs,

package/dist/standalone/manifest.js

@@ -13,7 +13,7 @@ import { parse } from "yaml";
 import { isNativeArchFamily, } from "../build-spk/dsm-arch.js";
 import { checkGlossary, loadCatalogs, readInfoTranslations, } from "./i18n.js";
 import { loadRootOps, readRootSettings, rootBinaryProblem, ROOT_OPS_DIR, } from "./root-ops.js";
-import { readComposeApp } from "./compose.js";
+import { composeManifestContext, readComposeApp } from "./compose.js";
 import { daemonSdkVersion, readDaemon, readLifecycleTimeouts } from "./daemon.js";
 import { daemonRestartSdkProblem } from "./daemon-restart.js";
 import { daemonIngressMinDsmProblem } from "./daemon-ingress.js";
@@ -278,15 +278,18 @@ function readManifest(raw, c) {
     const installSettings = readInstallSettings(isRecord(raw.install) ? raw.install.settings : undefined, e => c.fail(e.code, e.message));
     const hyperBackup = readHyperBackup(raw.backup, { compose: raw.compose !== undefined }, e => c.fail(e.code, e.message));
     const compose = arches &&
-        readComposeApp(raw.compose, c.root, arches, (e) => c.fail(e.code, e.message), {
+        readComposeApp(raw.compose, c.root, arches, (e) => c.fail(e.code, e.message), composeManifestContext({
             package: packageId,
-            sdk: typeof gatewayRaw.sdk === "string" ? gatewayRaw.sdk : undefined,
-            mode: typeof gatewayRaw.mode === "string" ? gatewayRaw.mode : "none",
-            composeMounts: capabilities.composeMounts,
+            identityGateway: {
+                ...gatewayRaw,
+                sdk: typeof gatewayRaw.sdk === "string" ? gatewayRaw.sdk : undefined,
+                mode: typeof gatewayRaw.mode === "string" ? gatewayRaw.mode : "none",
+            },
+            capabilities,
             sharedFolder,
             installSettings,
-            installPorts: installPorts ? portDefaults({ installPorts, identityGateway: gatewayRaw }) : undefined,
-        });
+            installPorts,
+        }));
     if (raw.compose !== undefined &&
         ((raw.daemon !== undefined && !timeoutOnly) ||
             Object.keys(capabilities).some((k) => k !== "composeMounts") ||

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@synopackageland/cli",
-  "version": "0.41.6",
+  "version": "0.41.8",
   "description": "Syno Package Land Developer Kit CLI",
   "type": "module",
   "bin": {

package/skills/SKILL.md

@@ -26,7 +26,7 @@ Use this guide to initialize, build and inspect own applications or upstream OSS
 
 For an existing open-source App, first read [reference/upstream-fork.md](reference/upstream-fork.md): upstream fork/history + untouched upstream files + all packaging in `synology/`, official container images pinned by tag/index digest, native official release binaries pinned by SHA-256 or a source build hook, and a single tag-merge upgrade command. Use `init --upstream-fork`; never rewrite the App as a component. Integrated upstream Apps require direct DSM administrator entry without a separate App password or an OIDC/SSO server: supported trusted headers first, disabling native login second; the shipped OpenList pattern uses the existing SDK 0.17.3 token adapter (`mode: token`, `access: dsm-admins`, `entry: admin-only`) with server-side Authorization injection. All DSM admins share one upstream admin; token reset requires package restart; WebDAV retains its native credentials.
 
-Use SDK/App 0.38.2 and CLI 0.41.5 for App entry enforcement. Declare every App method
+Use SDK/App 0.38.3 and CLI 0.41.7 for App entry enforcement. Declare every App method
 in the permissions table; dynamic names and unregistered HTTP dispatchers are rejected.
 Use fixed SDK routes and `identity_gateway.upstream_auth_paths` for client API
 paths that rely on upstream authentication. Read
@@ -316,7 +316,11 @@ Use `appOpenSmoke` from `@synopackageland/cli/e2e`; keep one content-specific
 reuses the existing DSM credentials/profiles/tunnel, and registers administrator,
 normal-user and fresh anonymous tests. Configure `DSM_E2E_ACCOUNT_ADMIN` and
 `DSM_E2E_ACCOUNT_NORMAL` as private account files; a missing normal profile and
-credentials is a reported skip. Grant Application Privileges before running.
+credentials is a reported skip. For `entry: admin-only`, N must see the SDK
+gateway denial page with no App content or ready marker in the DOM; use
+`content` for a separate App shell marker. Other entry kinds require N to
+reach `ready`; grant Application Privileges as needed. Preserve the manifest's
+entry policy when running the smoke.
 Override `app` for a manifest filename or `entry` for a configured URL.
 Only a manifest-declared upstream-authenticated entry may use `publicLogin`.
 Keep `.env` and `.e2e/` untracked; never add NAS details to source.

package/skills/reference/install.md

@@ -1,6 +1,6 @@
 # Native installation settings
 
-Use SDK/App 0.38.2, CLI 0.41.5 and templates 0.35.3. Configure installation through the manifest and generated wizard; do not add App ACL writers, root hooks or independent port state.
+Use SDK/App 0.38.3, CLI 0.41.7 and templates 0.35.5. Configure installation through the manifest and generated wizard; do not add App ACL writers, root hooks or independent port state.
 
 ```yaml
 install: