@synopackageland/cli 0.9.2 → 0.9.4

package/CHANGELOG.md

@@ -1,5 +1,51 @@
 # Changelog
 
+## 0.9.4 (2026-10-12)
+
+Builds with SDK 0.9.5 and templates 0.9.4: `init` writes SDK v0.9.5 and
+`@synopackageland/sdk` 0.9.5, and the Vue App's `AppRoot` lets Dialogs leave
+a DSM window. The executor digest table records SDK 0.9.5, whose executor
+equals 0.9.4's; the policy digest stays the same, so an installed App needs
+no new approval. AI guidance for DSM-window Dialogs matches the Vue App.
+
+繁中摘要：使用 SDK 0.9.5 與 templates 0.9.4。SDK 0.9.5 只改 TypeScript（NAS
+picker 改用 UI 0.9.1 元件），executor digest 與 0.9.4 相同，policy digest 不變，
+已安裝的 App 不需重新核准。ui-vue 與 ui-json 指引改為在 DSM 視窗內給 `AppRoot`
+`dialog-bounds="viewport"`，並把 `activate` 接到 `ctx.host.activateWindow()`：
+Dialog 可拖出 App 視窗，點 Dialog 會把視窗帶到最前；600px 以下為底部 sheet。
+
+- `ui-vue` and `ui-json`: in a DSM window (`ctx.host.platform().host === 'dsm'`),
+  give `AppRoot` `dialog-bounds="viewport"` and connect its `activate` event to
+  `ctx.host.activateWindow()`, so Dialogs can be dragged out of the window and
+  pressing one brings the window to the front. Below 600px they are bottom
+  sheets. Standalone web, Portal and previews keep Dialogs inside the App.
+- A host-window test pins that the mounted App's `activateWindow` fronts only
+  its own DSM window.
+
+## 0.9.3 (2026-10-12)
+
+Builds with SDK 0.9.4 and templates 0.9.3: `init` writes SDK v0.9.4 and
+`@synopackageland/sdk` 0.9.4. The executor digest table records SDK 0.9.4,
+whose executor asks DSM's native `SLIBAppPrivUserHas` for App Privileges
+instead of the `SYNO.Core.AppPriv.App` preview. An App rebuilt with SDK 0.9.4
+gets the new executor; the policy digest stays the same, so an installed App
+needs no new approval.
+
+繁中摘要：使用 SDK 0.9.4 與 templates 0.9.3。executor 改以 DSM 原生
+`SLIBAppPrivUserHas` 判斷應用程式權限，digest 表加入 0.9.4；policy digest 不變，
+重新建置後已安裝的 App 不需重新核准。限定 IP 的應用程式權限規則改為依瀏覽器位址
+判斷；自行組 `auth` 的呼叫端必須帶 `remote_addr`，否則 executor 回 `APP_DENIED`。
+
+- Behavior change: an Application Privileges rule limited to IP addresses
+  applies to the browser's address; with SDK 0.9.3 or earlier the executor
+  refused every request under such a rule. Work no browser asked for is
+  checked as coming from 127.0.0.1. The generated CGI sends the address
+  through `api.DSMSession`; code that builds the executor `auth` itself must
+  add `remote_addr` or the executor refuses with `APP_DENIED`.
+- The fake-DSM executor flow tests host the 0.9.4 executor's embedded bridge
+  and check the online grant against the browser's address and the offline
+  write against 127.0.0.1.
+
 ## 0.9.2 (2026-10-12)
 
 Builds with SDK 0.9.3 and templates 0.9.2: `init` writes SDK v0.9.3 and

package/dist/runtime/executor-digests.json

@@ -42,5 +42,27 @@
             "armv7": "b65a14f0fc77a1d3221c7dc6781eb66059aa200956b094d58a62bd1cad10f116"
         },
         "goToolchain": "go1.26.9"
+    },
+    "0.9.4": {
+        "x86_64": "fc3c206b6a8e30b7470cedabf6676c027960311469685eab2fe544fe6cc671ac",
+        "aarch64": "aa1a8a1b88758ad47ca69d30e9649a24a93b94b5b5fc181ce782035c2c77c497",
+        "armv7": "0c39cb98b67735fede6bbbe91471695e26707f377cbc50dd860a1d9a7fe06fcf",
+        "lifecycle": {
+            "x86_64": "819459580135e016184ad80c258350d57194d6134e8aa4cf1caf5237085b1004",
+            "aarch64": "5abcfc21403e84a0af15d972bcb819ac6fedfd9aaf5898ddc8c4bb06130f9f59",
+            "armv7": "b65a14f0fc77a1d3221c7dc6781eb66059aa200956b094d58a62bd1cad10f116"
+        },
+        "goToolchain": "go1.26.9"
+    },
+    "0.9.5": {
+        "x86_64": "fc3c206b6a8e30b7470cedabf6676c027960311469685eab2fe544fe6cc671ac",
+        "aarch64": "aa1a8a1b88758ad47ca69d30e9649a24a93b94b5b5fc181ce782035c2c77c497",
+        "armv7": "0c39cb98b67735fede6bbbe91471695e26707f377cbc50dd860a1d9a7fe06fcf",
+        "lifecycle": {
+            "x86_64": "819459580135e016184ad80c258350d57194d6134e8aa4cf1caf5237085b1004",
+            "aarch64": "5abcfc21403e84a0af15d972bcb819ac6fedfd9aaf5898ddc8c4bb06130f9f59",
+            "armv7": "b65a14f0fc77a1d3221c7dc6781eb66059aa200956b094d58a62bd1cad10f116"
+        },
+        "goToolchain": "go1.26.9"
     }
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@synopackageland/cli",
-  "version": "0.9.2",
+  "version": "0.9.4",
   "description": "Syno Package Land Developer Kit CLI",
   "type": "module",
   "bin": {
@@ -19,12 +19,12 @@
   "scripts": {
     "build": "rm -rf dist && tsc",
     "test": "npm run build && node --import tsx --test test/**/*.test.ts",
-    "test:scripts": "node --test scripts/test/release.test.mjs scripts/test/pack-docker.test.mjs scripts/test/npm-pack.test.mjs scripts/test/executor-bump.test.mjs scripts/test/smoke-exports.test.mjs scripts/test/executor-digests.test.mjs",
+    "test:scripts": "node --test scripts/test/gate.test.mjs scripts/test/release.test.mjs scripts/test/pack-docker.test.mjs scripts/test/npm-pack.test.mjs scripts/test/executor-bump.test.mjs scripts/test/smoke-exports.test.mjs scripts/test/executor-digests.test.mjs",
     "gates": "bash scripts/ci/gate.sh npm && bash scripts/ci/gate.sh native-go && bash scripts/ci/gate.sh daemon-gateway",
     "prepublishOnly": "npm run build"
   },
   "dependencies": {
-    "@synopackageland/templates": "0.9.2",
+    "@synopackageland/templates": "0.9.4",
     "ajv": "^8.17.1",
     "commander": "^13.1.0",
     "tar": "^7.4.3",

package/skills/reference/ui-json.md

@@ -68,7 +68,11 @@ also exports `@synopackageland/ui/json-catalog.schema.json` and
 
 In DSM windows, keep a bounded `AppRoot` (for example `height: 100%`), use its
 default app modal scope or explicit `modalScope: "app"`, and set JSON `AppShell`
-`wideLayout: "window"`. Vue `AppLayout` uses `wide-layout="window"`. Reserve
+`wideLayout: "window"`. Vue `AppLayout` uses `wide-layout="window"`. In a DSM
+window (`ctx.host.platform().host === 'dsm'`), the Vue wrapper gives `AppRoot`
+`dialog-bounds="viewport"` and connects its `activate` event to
+`ctx.host.activateWindow()`, so Dialogs can leave the window and pressing one
+brings the window to the front; below 600px they are bottom sheets. Reserve
 root sizing for the Vue/host wrapper; only use props exposed by the current JSON
 schema inside the spec. Reserve
 `modalScope: "document"` and `wideLayout: "web"` for whole-page web/Portal apps.

package/skills/reference/ui-vue.md

@@ -34,6 +34,13 @@ do not guess APIs or copy a version-specific component inventory.
 - Keep a bounded `AppRoot`, for example `<AppRoot style="height: 100%">`, with
   a sized host/mount container. Use its default app modal scope (`modalScope`);
   avoid overriding it to document scope in a DSM window.
+- In a DSM window (`ctx.host.platform().host === 'dsm'`), give `AppRoot`
+  `dialog-bounds="viewport"` so Dialogs can be dragged out of the window as
+  DSM's own are, and connect its `activate` event to
+  `ctx.host.activateWindow()` so pressing a Dialog brings the window to the
+  front. Below 600px of viewport width the UI turns them into bottom sheets.
+  Keep the default `app` bounds outside DSM windows (standalone web, Portal,
+  previews).
 - Import only `@synopackageland/ui/themes/dsm7-embedded.css` for the template.
   The standalone `theme.css` and `dsm7.css` entrypoints affect the host page.
 - Set a unique `app.config.idPrefix` for every independent Vue app before