@synopackageland/cli 0.8.0 → 0.9.1

package/templates/_gateway/groups.go

@@ -1,66 +0,0 @@
-package main
-
-import (
-	"bufio"
-	"context"
-	"fmt"
-	"os"
-	"slices"
-	"strings"
-)
-
-// groupsOf reads local group files fresh on each request. Directory accounts
-// use NSS afresh; DSM provider caching may delay directory membership changes.
-// DSM keeps no member list for the group
-// that is an account's primary group (users), so membership is the member
-// list or the primary gid from the passwd file. Accounts absent from passwd use
-// DSM NSS; no local member-list fallback is permitted on lookup failure.
-func (a *dsmAuthenticator) groupsOf(ctx context.Context, user string) ([]string, error) {
-	primary, err := a.primaryGID(user)
-	if err != nil {
-		return nil, err
-	}
-	if primary == "" {
-		if a.directoryGroups == nil {
-			return nil, fmt.Errorf("directory group lookup unavailable")
-		}
-		return a.directoryGroups(ctx, user)
-	}
-	f, err := os.Open(a.groupFile)
-	if err != nil {
-		return nil, fmt.Errorf("read groups: %w", err)
-	}
-	defer f.Close()
-	var groups []string
-	scanner := bufio.NewScanner(f)
-	for scanner.Scan() {
-		fields := strings.Split(scanner.Text(), ":")
-		if len(fields) == 4 && (fields[2] == primary || slices.Contains(strings.Split(fields[3], ","), user)) {
-			groups = append(groups, fields[0])
-		}
-	}
-	if err := scanner.Err(); err != nil {
-		return nil, fmt.Errorf("read groups: %w", err)
-	}
-	return groups, nil
-}
-
-// primaryGID is the account's gid in the passwd file; "" when the account has
-// no local entry, which requires a fresh directory lookup.
-func (a *dsmAuthenticator) primaryGID(user string) (string, error) {
-	f, err := os.Open(a.passwdFile)
-	if err != nil {
-		return "", fmt.Errorf("read accounts: %w", err)
-	}
-	defer f.Close()
-	scanner := bufio.NewScanner(f)
-	for scanner.Scan() {
-		if fields := strings.Split(scanner.Text(), ":"); len(fields) >= 4 && fields[0] == user {
-			return fields[3], nil
-		}
-	}
-	if err := scanner.Err(); err != nil {
-		return "", fmt.Errorf("read accounts: %w", err)
-	}
-	return "", nil
-}

package/templates/_gateway/main.go

@@ -1,45 +0,0 @@
-// Command gateway is the DSM-authenticated front door of a container package.
-// DSM runs it as a CGI (ui/cgi/gateway.cgi in the package) under the package
-// account, once per request.
-package main
-
-import (
-	"bytes"
-	"encoding/json"
-	"fmt"
-	"log"
-	"net/http/cgi"
-	"os"
-)
-
-// Set by `synopkgland build-spk` through -ldflags -X; never read from a request.
-var (
-	packageID  = "dev"
-	configJSON = ""
-)
-
-func main() {
-	log.SetFlags(0)
-	log.SetPrefix(packageID + ": ")
-	if os.Getenv("GATEWAY_INTERFACE") == "" {
-		fmt.Fprintf(os.Stderr, "%s: this program runs as the package's DSM CGI; open the app from the DSM main menu.\n", packageID)
-		os.Exit(2)
-	}
-	var cfg config
-	decoder := json.NewDecoder(bytes.NewReader([]byte(configJSON)))
-	decoder.DisallowUnknownFields()
-	if err := decoder.Decode(&cfg); err != nil {
-		log.Fatalf("invalid gateway configuration: %v", err)
-	}
-	g, err := newGateway(cfg, newDSMAuthenticator())
-	if err != nil {
-		log.Fatal(err)
-	}
-	req, err := cgi.Request()
-	if err != nil {
-		log.Fatal(err)
-	}
-	if err := serveCGI(g, req, os.Stdin, os.Stdout); err != nil {
-		log.Fatal(err)
-	}
-}

package/templates/_shared/AGENTS.md

@@ -1,146 +0,0 @@
-# AI authoring
-
-Start with `synopkgland skill list`, then `synopkgland skill show orchestrator`.
-Use `synopkgland skill path` to locate the bundled references; read the relevant
-skill with `synopkgland skill show <id>` before editing.
-For UI work, read `synopkgland skill show ui-vue` and `synopkgland skill show ui-json`.
-Use the installed SDK contracts and preserve package.json/lockfile pins.
-
-For UI discovery, run `npx --no syno-pkg-land-ui catalog --json` and
-`npx --no syno-pkg-land-ui describe Button --json` from the installed frontend.
-Read its prompt and exported Vue docs/types before choosing component APIs.
-Use `syno-pkg-land-ui` directly in npm scripts; keep AI guidance version-independent.
-
-From the project root, run `synopkgland check --json`,
-`synopkgland build --json`, then `synopkgland inspect <spk> --json` on the emitted SPK.
-For Vue, first run `npm ci`, `npm test` and `npm run build` in frontend.
-Do not connect to or change a NAS without explicit task authorization.
-
-## Who may use the app (`entry`)
-
-Omit `entry` to keep legacy access. `entry: admin-only` admits DSM administrators
-only. `entry: app-privilege` also admits accounts that Control Panel >
-Application Privileges allows for `SYNO.SDS.<package>.Instance`; DSM's install
-default allows administrators only, so nobody else enters until an admin grants
-access. One CGI check covers every route; failures refuse; changes apply within
-30 seconds. Never re-implement AppPriv rules in the App.
-Mark routes ordinary users call `authenticated` in permissions.json, keep whole
-admin routes at the default, guard global settings inside shared routes with
-`api.RequireAdmin(caller)`, and hide admin controls with `ctx.user?.isAdmin`
-(UI only, never the authority). Example: users read the greeting; only admins
-call `greeting.set`.
-
-## DSM Application Portal (`portal`)
-
-`synopkgland add portal` (or `portal: {}` / `portal: {alias: my-app}` in
-dsm-package.yaml; Compose: `integration.web.portal` for a DSM-window app behind
-the auth gateway) registers `https://<nas>/<alias>/`, which opens the app after
-DSM sign-in. Read `synopkgland skill show portal` before changing it.
-The install wizard only proposes the alias; an administrator activates it from
-the app's portal panel (`ctx.portal`, DSM's own `SYNO.Core.AppPortal` in the
-admin's session) or Control Panel > Login Portal > Applications. Ordinary users
-get the link from the backend's read-only `portal.status`, else "ask an
-administrator". Never write `AppPortal.json` or `@appconf/<package>`, never add
-a backend route that sets the alias, and never relay QuickConnect responses or
-build QuickConnect links. A portal needs os_min_ver 7.3.2-86009 or later (DSM
-7.1.1 refuses it with error 320; 7.2 is untested) and `add portal` raises it;
-beyond that, support is detected (SYNO.API.Info), not version-gated.
-
-## Permanent destination integration
-
-`init --with delegate` / `add delegate` default to `operations: [files.moveFromStaging]`,
-`destinations: [save]`, `lifetime: until-revoked`, `scope: install-selected`. Existing legacy
-TTL declarations retain their 1–3600 second service / 30-day wire ceiling and
-64 MiB / 60-second URL example. Do not apply those limits to the new move API.
-Delegate can coexist with daemon; ordinary standalone jobs cannot. Preserve
-App business route floors. Binary/compose remain unsupported.
-
-Use File Station `/home[/...]`, never `/homes/<user>`. The SDK destination picker
-selection itself grants access after fresh DSM session/UID/write verification,
-without a second consent dialog. Ordinary and administrator subjects use their
-own nonzero UID/current groups, never root. An online App can create an in-scope
-grant using a valid session; there is no trusted external consent or notification.
-
-Use the default `createBackgroundSaveFacade(ctx)` / CapabilityPanels management
-page. `delegate.status` exposes verified `disabled` and manifest mode; missing
-protected evidence must not imply enabled. `delegate.operations.list` accepts
-only `{}`, uses the backend move mirrors, and returns the caller's username+UID
-operations only, including for admins. Mirrors are not completion receipts:
-query original `delegate.operations.get` and show Saved only for committed with
-a receipt. Cancel by the same reference; revoke by grant ID. Never resubmit
-uncertain/interrupted work. Admin disable is protected and revokes grants;
-enable/mailbox start does not resurrect them. Keep IDs, never session credentials.
-
-App-owned daemon completion and scheduled CSV export call configured Go
-`Service.MoveFromStaging` with `delegation_id`, stable `job_id`, private relative
-`staging`, `name`, `size`. No owner/UID selector. Bounds: 16 GiB/file, queued16,
-active1/package, 24-hour attempt, 5-second revalidation, 10 MiB operation records,
-50 MiB audit. Scope is a usage restriction, not hard subtree confinement.
-Local production-executor fixtures use fake DSM/peer/bulk writer; do not claim
-NAS ACL, actual writer UID, logout/reboot or full lifecycle acceptance from them.
-Gopeed product wiring remains a separate task.
-
-Admission recovery (per job): on `EXECUTOR_UNAVAILABLE`, `EXECUTOR_TIMEOUT`,
-`EXECUTOR_PROTOCOL`, `canceled`, `EXECUTOR_PAUSED`, `queue-full`,
-`STORAGE_ERROR`, `ADMISSION_PENDING`, `jobs_busy` or `jobs_unavailable` (the
-package journal was busy or failed transiently; a caller deadline or cancel
-spent waiting for it is `canceled`), call `MoveFromStaging` again later with
-the same exact params. It queries the original reference first and re-sends
-admission only when the executor does not know it and the pinned source is
-unchanged; executor tuple deduplication keeps one operation, so a lost reply or a
-racing caller never copies twice. At most 10 possibly-delivered sends, 2 s
-backoff doubling to 5 min; the worker sweep does the same. Terminal, do not
-retry: `APP_DENIED`, `DELEGATION_DENIED`, `operation-conflict`, `disabled`,
-`SCOPE_DENIED` and other executor refusals, `STAGING_CHANGED`,
-`ADMISSION_EXHAUSTED`, `spool_unsafe` and `journal_corrupt` (repair the package
-spool first), and `operation-not-found` for an accepted operation.
-Never change job/grant IDs, delete mirrors or call the socket directly to retry.
-
-Cancellation (per job): `CancelOperation` / `delegate.operations.cancel` with the
-original ref is idempotent; repeat it with the same ref after any retryable
-error or a lost reply. A reply `queued`→`canceled` is final at once. A copy in
-flight answers `copying` with code `CANCEL_REQUESTED`: the cancel is accepted and
-durable, not finished; poll `OperationStatus` on the same ref until terminal
-(repeating the cancel is harmless). `canceled` (`OPERATION_CANCELED`) guarantees the writer
-stopped, its part file is removed, nothing was published and staging is kept; it
-stays canceled across executor crash, package stop/start and logout. `committed`
-means publication won the race: the file stays (cancel never removes it) and only
-the app record may be dropped. `uncertain` means a publish attempt failed before
-the cancel; keep querying. A cancel of a ref the executor has not admitted yet
-(reserved/sent mirror) returns `canceled` and leaves a tombstone, so a late or
-recovered admission of that ref returns `canceled` and never copies; a producer
-cancel is also written to the mirror first, so `MoveFromStaging` and the worker
-sweep forward the cancel instead of admitting it.
-
-
-### Install-selected scope and the destination API
-
-- The DSM install wizard dynamically lists local shares (`SYNO.Core.Share list`
-  via `api_store`) and offers home. It saves only a package-owned pre-selection
-  in `var/delegate-install.json`; never trust that file for authority.
-- The existing administrator PasswordConfirm form displays this pre-selection
-  at first enable. `ctx.executor.authorize(password, selectedScope)` confirms it
-  through a pinned, exact-readback one-time root task. Settings changes use the
-  same form/password path; no App CGI route may set protected scope directly.
-- The executor trusts `/usr/local/etc/synopkgland/<pkg>/delegations/selected-scope.record`
-  only. Its scope/generation are runtime protected state; shipped policy pins
-  lock the selection mode and operations. Changes revoke old grants and cancel
-  pending writes. Change-away-and-back never revives an old grant.
-- Follow `selection` from verified `delegate.status` / `sdk.destination(key)`.
-  If the draft differs, display the difference and follow the protected value.
-  Home and fixed `shared:<name>` manifests stay compatible.
-- Frontend: `const sdk = createBackgroundSaveFacade(ctx); const current = await
-  sdk.destination('save')` returns typed `{key, selection, destination, status}`.
-  `selection` contains `{scope, root, generation}`; `destination` is this caller's
-  grant or null. Handle active/missing/reselection-required/needs-scope-confirmation/disabled.
-- Go: `Service.Destination(ctx, caller, request, key)` verifies the fresh DSM
-  session and username+UID. Capture its active grant ID into the App job. The
-  offline producer uses existing `Service.MoveFromStaging`; no user/UID selector,
-  cookie, token, or browser path cache. Executor revalidates at use/publication.
-- The generated Background saves page includes a working **Save example file**
-  (`sdk.exportExample({key, job_id})`, `delegate.example.export`). Go
-  `ExportExample` creates a private JSON file, calls `MoveFromStaging` once, and
-  repeats the original request on repeated IDs. Review `example.go` to
-  adapt a real producer; show Saved only from a protected committed receipt.
-- Wizard support is measured on vt-nas DSM 7.4 via a session-only SSH local
-  forward. This is not proof of other DSM releases or full writer/reboot behavior.

package/templates/_shared/CLAUDE.md

@@ -1 +0,0 @@
-Read [AGENTS.md](AGENTS.md).

package/templates/_shared/GO-LICENSE

@@ -1,27 +0,0 @@
-Copyright 2009 The Go Authors.
-
-Redistribution and use in source and binary forms, with or without
-modification, are permitted provided that the following conditions are
-met:
-
-   * Redistributions of source code must retain the above copyright
-notice, this list of conditions and the following disclaimer.
-   * Redistributions in binary form must reproduce the above
-copyright notice, this list of conditions and the following disclaimer
-in the documentation and/or other materials provided with the
-distribution.
-   * Neither the name of Google LLC nor the names of its
-contributors may be used to endorse or promote products derived from
-this software without specific prior written permission.
-
-THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
-"AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
-LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
-A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
-OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
-SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
-LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
-DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
-THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
-(INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
-OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.

package/templates/_shared/GO-PATENTS

@@ -1,22 +0,0 @@
-Additional IP Rights Grant (Patents)
-
-"This implementation" means the copyrightable works distributed by
-Google as part of the Go project.
-
-Google hereby grants to You a perpetual, worldwide, non-exclusive,
-no-charge, royalty-free, irrevocable (except as stated in this section)
-patent license to make, have made, use, offer to sell, sell, import,
-transfer and otherwise run, modify and propagate the contents of this
-implementation of Go, where such license applies only to those patent
-claims, both currently owned or controlled by Google and acquired in
-the future, licensable by Google that are necessarily infringed by this
-implementation of Go.  This grant does not include claims that would be
-infringed only as a consequence of further modification of this
-implementation.  If you or your agent or exclusive licensee institute or
-order or agree to the institution of patent litigation against any
-entity (including a cross-claim or counterclaim in a lawsuit) alleging
-that this implementation of Go or any code incorporated within this
-implementation of Go constitutes direct or contributory patent
-infringement, or inducement of patent infringement, then any patent
-rights granted to you under this License for this implementation of Go
-shall terminate as of the date such litigation is filed.

package/templates/_shared/LICENSES/TEMPLATE.txt

@@ -1,21 +0,0 @@
-MIT License
-
-Copyright (c) 2026 synopkgland
-
-Permission is hereby granted, free of charge, to any person obtaining a copy
-of this software and associated documentation files (the "Software"), to deal
-in the Software without restriction, including without limitation the rights
-to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
-copies of the Software, and to permit persons to whom the Software is
-furnished to do so, subject to the following conditions:
-
-The above copyright notice and this permission notice shall be included in all
-copies or substantial portions of the Software.
-
-THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
-IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
-FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
-AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
-LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
-OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
-SOFTWARE.

package/templates/_shared/third-party-notices.mjs

@@ -1,51 +0,0 @@
-import { existsSync, mkdirSync, readFileSync, readdirSync, rmSync, writeFileSync } from 'node:fs';
-import { join } from 'node:path';
-
-// Conservative inventory of every locked production dependency, including
-// dependencies tree-shaken from the bundle. Build tools marked dev are omitted.
-// Read actual upstream license/notice files, never synthesize license text from
-// SPDX metadata. npm ci must have installed the exact lock before this runs.
-export function writeThirdPartyNotices(root, output, { ui = false } = {}) {
-  const lock = JSON.parse(readFileSync(join(root, 'package-lock.json'), 'utf8'));
-  if (lock.lockfileVersion < 2 || !lock.packages) throw new Error('Notice generation requires a v2/v3 npm lockfile');
-  const inventory = [];
-  const sections = [];
-  let uiFiles;
-  for (const [path, entry] of Object.entries(lock.packages).sort(([a], [b]) => a.localeCompare(b, 'en'))) {
-    if (!path || entry.dev) continue;
-    if (!/^node_modules\//.test(path) || path.split('/').includes('..') || entry.link) throw new Error(`Unsupported notice package path: ${path}`);
-    const dir = join(root, path);
-    const pkg = JSON.parse(readFileSync(join(dir, 'package.json'), 'utf8'));
-    if (pkg.version !== entry.version) throw new Error(`Notice version mismatch: ${path}; run npm ci`);
-    const files = readdirSync(dir, { withFileTypes: true })
-      .filter(f => f.isFile() && /^(licen[sc]e|copying|notice|copyright)([.-]|$)/i.test(f.name))
-      .map(f => f.name).sort();
-    const texts = files.map(file => ({ file, text: readFileSync(join(dir, file), 'utf8') }));
-    let source, provenance;
-    if (!files.some(f => /^(licen[sc]e|copying)([.-]|$)/i.test(f))) {
-      const index = new URL('./notice-overrides/index.json', import.meta.url);
-      const overrides = existsSync(index) ? JSON.parse(readFileSync(index, 'utf8')) : {};
-      const override = overrides[`${pkg.name}@${pkg.version}`];
-      if (!override || !entry.integrity || override.integrity !== entry.integrity) throw new Error(`Missing upstream license text: ${pkg.name}@${pkg.version}`);
-      source = override.source;
-      provenance = override.provenance;
-      texts.push({file: 'LICENSE (pinned upstream source)', text: readFileSync(new URL(`./notice-overrides/${override.file}`, import.meta.url), 'utf8')});
-      files.push(override.file);
-    }
-    // UI ships its own aggregate for fonts, icons and dependencies/assets.
-    if (pkg.name === '@synopackageland/ui') {
-      uiFiles = {
-        'UI-LICENSE': readFileSync(join(dir, 'LICENSE'), 'utf8'),
-        'UI-THIRD_PARTY.md': readFileSync(join(dir, 'LICENSES/THIRD_PARTY.md'), 'utf8'),
-      };
-    }
-    inventory.push({ name: pkg.name, version: pkg.version, license: pkg.license ?? entry.license ?? 'unknown', integrity: entry.integrity, path, files, ...(source ? {source, provenance} : {}) });
-    sections.push(`\n===== ${pkg.name}@${pkg.version} (${pkg.license ?? entry.license ?? 'unknown'}) =====\n` + (source ? `Source: ${source}\n${provenance}\n` : '') + texts.map(({ file, text }) => `\n--- ${file} ---\n${text}\n`).join(''));
-  }
-  if (ui && !uiFiles) throw new Error('UI dependency is missing from the locked production inventory');
-  rmSync(output, { recursive: true, force: true });
-  mkdirSync(output, { recursive: true });
-  writeFileSync(join(output, 'THIRD_PARTY_NOTICES.txt'), 'Locked production dependency notices (conservative superset of bundled code).\n' + sections.join(''));
-  writeFileSync(join(output, 'inventory.json'), JSON.stringify(inventory, null, 2) + '\n');
-  for (const [name, text] of Object.entries(uiFiles ?? {})) writeFileSync(join(output, name), text);
-}

package/templates/binary/LICENSES/GO-LICENSE

@@ -1,27 +0,0 @@
-Copyright 2009 The Go Authors.
-
-Redistribution and use in source and binary forms, with or without
-modification, are permitted provided that the following conditions are
-met:
-
-   * Redistributions of source code must retain the above copyright
-notice, this list of conditions and the following disclaimer.
-   * Redistributions in binary form must reproduce the above
-copyright notice, this list of conditions and the following disclaimer
-in the documentation and/or other materials provided with the
-distribution.
-   * Neither the name of Google LLC nor the names of its
-contributors may be used to endorse or promote products derived from
-this software without specific prior written permission.
-
-THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
-"AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
-LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
-A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
-OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
-SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
-LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
-DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
-THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
-(INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
-OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.

package/templates/binary/LICENSES/GO-PATENTS

@@ -1,22 +0,0 @@
-Additional IP Rights Grant (Patents)
-
-"This implementation" means the copyrightable works distributed by
-Google as part of the Go project.
-
-Google hereby grants to You a perpetual, worldwide, non-exclusive,
-no-charge, royalty-free, irrevocable (except as stated in this section)
-patent license to make, have made, use, offer to sell, sell, import,
-transfer and otherwise run, modify and propagate the contents of this
-implementation of Go, where such license applies only to those patent
-claims, both currently owned or controlled by Google and acquired in
-the future, licensable by Google that are necessarily infringed by this
-implementation of Go.  This grant does not include claims that would be
-infringed only as a consequence of further modification of this
-implementation.  If you or your agent or exclusive licensee institute or
-order or agree to the institution of patent litigation against any
-entity (including a cross-claim or counterclaim in a lawsuit) alleging
-that this implementation of Go or any code incorporated within this
-implementation of Go constitutes direct or contributory patent
-infringement, or inducement of patent infringement, then any patent
-rights granted to you under this License for this implementation of Go
-shall terminate as of the date such litigation is filed.

package/templates/binary/dsm-package.yaml

@@ -1,46 +0,0 @@
-# A prebuilt, static Linux CGI using the same DSM package surface as native-go.
-schema: 2
-package: __PACKAGE__
-version: 0.1.0
-build: 1
-displayname: __DISPLAY_NAME__
-description: A DSM package with a prebuilt binary CGI and DSM window UI.
-# Package Center and DSM window icon: a square PNG of at least 256x256, or a
-# folder of icon_<size>.png. Omit to use the SDK default icon.
-# icon: assets/icon.png
-maintainer: Your Name
-# Optional INFO/website metadata. Omit fields you do not need.
-# metadata:
-#   contact_email: you@example.com
-#   support_email: support@example.com
-#   homepage: https://example.com
-#   source_url: https://github.com/you/your-app
-#   issues_url: https://github.com/you/your-app/issues
-#   license: MIT
-#   long_description:
-#     en: |-
-#       Explain what the app does and how to use it.
-#     zh-TW: Translated description.
-#   changelog:          # text, or per-language like long_description
-#     en: |-
-#       - Most important change first. Omit to use Release notes.
-#     zh-TW: |-
-#       - Translated changes.
-#   screenshots: [https://example.com/screenshot.png]
-os_min_ver: "7.1-42661"
-# One SPK per architecture. For armv7, add it here and a static 32-bit ARM file
-# under files (e.g. CGO_ENABLED=0 GOARCH=arm GOARM=7 go build).
-arches: [x86_64, aarch64]
-backend:
-  kind: binary
-  files:
-    x86_64: prebuilt/api-x86_64
-    aarch64: prebuilt/api-aarch64
-ui: {dir: ui}
-# UI languages: i18n/messages/<locale>.json for en, zh-TW, zh-CN, ja, ko, de,
-# fr, es and it (DSM's other languages fall back to English); ctx.t(key) reads them.
-i18n:
-  messages: i18n/messages
-# init compiles example/main.go for convenience. Replace prebuilt/api-* with
-# your application's static Linux ELF files; the CGI owns authentication.
-# daemon may optionally declare a separately packaged foreground service.

package/templates/binary/example/main.go

@@ -1,16 +0,0 @@
-// The starter CGI is compiled once by init. Production binary apps supply their
-// own static Linux executables and must authenticate their application routes.
-package main
-
-import (
-	"encoding/json"
-	"net/http"
-	"net/http/cgi"
-)
-
-func main() {
-	_ = cgi.Serve(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
-		w.Header().Set("Content-Type", "application/json; charset=utf-8")
-		_ = json.NewEncoder(w).Encode(map[string]string{"status": "ready", "backend": "binary"})
-	}))
-}

package/templates/binary/gitignore

@@ -1,2 +0,0 @@
-dist/
-*.spk

package/templates/binary/i18n/messages/de.json

@@ -1,4 +0,0 @@
-{
-  "app.description": "Ihr vorab kompiliertes CGI ist in dieser DSM-Anwendung enthalten.",
-  "app.title": "Binary App"
-}

package/templates/binary/i18n/messages/en.json

@@ -1,4 +0,0 @@
-{
-  "app.description": "Your prebuilt CGI is packaged in this DSM application.",
-  "app.title": "Binary App"
-}

package/templates/binary/i18n/messages/es.json

@@ -1,4 +0,0 @@
-{
-  "app.description": "Su CGI precompilado está empaquetado en esta aplicación de DSM.",
-  "app.title": "Binary App"
-}

package/templates/binary/i18n/messages/fr.json

@@ -1,4 +0,0 @@
-{
-  "app.description": "Votre CGI précompilé est intégré à cette application DSM.",
-  "app.title": "Binary App"
-}

package/templates/binary/i18n/messages/it.json

@@ -1,4 +0,0 @@
-{
-  "app.description": "Il CGI precompilato è incluso in questa applicazione DSM.",
-  "app.title": "Binary App"
-}

package/templates/binary/i18n/messages/ja.json

@@ -1,4 +0,0 @@
-{
-  "app.description": "事前にビルドした CGI がこの DSM アプリケーションにパッケージ化されています。",
-  "app.title": "Binary App"
-}

package/templates/binary/i18n/messages/ko.json

@@ -1,4 +0,0 @@
-{
-  "app.description": "미리 빌드한 CGI가 이 DSM 응용 프로그램에 패키징되어 있습니다.",
-  "app.title": "Binary App"
-}

package/templates/binary/i18n/messages/zh-CN.json

@@ -1,4 +0,0 @@
-{
-  "app.description": "预先构建的 CGI 已打包在此 DSM 应用程序中。",
-  "app.title": "Binary App"
-}

package/templates/binary/i18n/messages/zh-TW.json

@@ -1,4 +0,0 @@
-{
-  "app.description": "預先建置的 CGI 已封裝在這個 DSM 應用程式中。",
-  "app.title": "Binary App"
-}

package/templates/binary/ui/app.css

@@ -1,4 +0,0 @@
-:root { font-family: system-ui, sans-serif; color: #1e293b; background: #f8fafc; }
-.binary-app { padding: 2rem; }
-.binary-app h1 { font-size: 1.5rem; }
-.binary-app p { line-height: 1.6; }

package/templates/binary/ui/app.js

@@ -1,32 +0,0 @@
-(function () {
-  "use strict";
-  window.DsmPackageApps = window.DsmPackageApps || {};
-  window.DsmPackageApps["__PACKAGE__"] = {
-    // ctx.t(key) returns text from i18n/messages/<locale>.json in DSM's language.
-    // ctx.portal exists only with `portal:` in dsm-package.yaml; its panel
-    // shows the DSM Application Portal link, or the alias form to administrators.
-    mount(root, ctx) {
-      const app = document.createElement("main");
-      app.className = "binary-app";
-      const title = document.createElement("h1");
-      title.textContent = ctx.t("app.title");
-      const description = document.createElement("p");
-      description.textContent = ctx.t("app.description");
-      app.append(title, description);
-      let portalPanel = null;
-      if (ctx.portal) {
-        const portal = document.createElement("section");
-        portal.setAttribute("class", "dsmapp-portal");
-        app.append(portal);
-        portalPanel = ctx.portal.mountPanel(portal);
-      }
-      root.append(app);
-      return {
-        unmount() {
-          if (portalPanel) portalPanel.dispose();
-          app.remove();
-        },
-      };
-    },
-  };
-})();

package/templates/compose/compose.yaml

@@ -1,8 +0,0 @@
-services:
-  worker:
-    image: alpine:3.20@sha256:d9e853e87e55526f6b2917df91a2115c36dd7c696a35be12163d44e6e2a4b6bc
-    command: ["sleep", "infinity"]
-    volumes:
-      # intentionally outside the zero-config docker-project resource-worker path.
-      - "${MEDIA_SHARE}/data:/data:ro"
-      - "${SYNOPKG_PKGVAR}/state:/state"

package/templates/compose/synology-app.yaml

@@ -1,16 +0,0 @@
-schema: 1
-package: com.synology.hello.files
-version: 0.1.0
-displayname: Hello Files
-description: A minimal headless app with a Shared Folder mount.
-# Package Center and DSM window icon: a square PNG of at least 256x256, or a
-# folder of icon_<size>.png. Omit to use the SDK default icon.
-# icon: assets/icon.png
-maintainer: Syno Package Land
-os_min_ver: "7.2.1-69057"
-
-install:
-  MEDIA_SHARE:
-    type: shared_folder
-  RUN_AS:
-    type: dsm_user