@synopackageland/templates 0.14.1 → 0.15.0

package/README.md

@@ -17,7 +17,7 @@ the files an App owns; the SDK (`github.com/synopackageland/syno-pkg-land-sdk`,
 | `native-{python,node,rust}-{jobs,root-ops,delegate}` | The capability's example module, replacing the base's stub, with its tests |
 | `native-{python,node,rust}-vue` | The README and `.gitignore` of the Vue shell |
 | `binary` | A prebuilt static CGI (`example/main.go`) with a plain UI |
-| `compose` | Container Manager project (`compose.yaml`, `synology-app.yaml`) |
+| `compose` | Container Manager project (upstream `compose.yaml`, schema-2 `dsm-package.yaml`) |
 | `_shared` | Agent guides, template license, Go license texts, third-party notice writer, `dsm-scripts/` (DSM lifecycle scripts) |
 
 Overlays are copied over `native-go` in the order root-ops, vue, jobs, delegate.
@@ -38,11 +38,11 @@ calls each one from the generated script of the same name (`synopkgland skill sh
 The placeholders `__PACKAGE__` (also the Go module path), `__DISPLAY_NAME__` and
 `__BACKGROUND_ENABLED__` are substituted by `init`.
 
-`backend/go.mod` requires `github.com/synopackageland/syno-pkg-land-sdk v0.14.1`; that line is
+`backend/go.mod` requires `github.com/synopackageland/syno-pkg-land-sdk v0.15.0`; that line is
 the single source of the SDK version and `frontend/package.json` pins
 `@synopackageland/sdk` to the same version. Python and Node.js name it in
 `backend.sdk`, Rust in the `syno-pkg-land-app` tag of `backend/Cargo.toml`
-(and `Cargo.lock`); all of them pin 0.14.1. The Vue frontend pins
+(and `Cargo.lock`); all of them pin 0.15.0. The Vue frontend pins
 `@synopackageland/ui` 0.11.0.
 
 ## Notice writer
@@ -139,3 +139,11 @@ service: omitted `ui.launch` resolves to `new-page`, without Application Portal.
 Both Compose routes share `contract/app-launch.ts` for defaults and launcher types.
 An explicit `ui.launch` overrides this default. Native SDK Apps without a web
 service keep `dsm-window` when `ui.launch` is absent.
+
+## Compose identity and file access
+
+The CLI preserves upstream bytes and the SDK planner generates an override and one worker model. No dummy backend, UI or wrapper container is needed. Containers use the fixed package identity and do not inherit each signed-in user's File Station ACL. Shared Folder intent is explicit composeMounts, confirmed by an admin after install; activation is unsupported until official protected ACL/project control is verified. Fine egress allowlists are rejected; isolated/internet are the two declared levels. See the SDK Compose support matrix before deployment.
+
+## AI commands
+
+All four native templates explicitly declare status and greeting commands in `ctl.commands`. Build packages a private `synopkgland-api.json`; only the authenticated SDK description endpoint returns it. Internal routes are not automatically commands. Read `synopkgland skill show ctl` before adding command schemas or workflow bindings.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@synopackageland/templates",
-  "version": "0.14.1",
+  "version": "0.15.0",
   "description": "Project templates for synopkgland init: native-go, native-python, native-node and native-rust (plain or Vue, with jobs, delegate and root-ops overlays), binary and compose.",
   "license": "MIT",
   "repository": {"type": "git", "url": "git+https://github.com/synopackageland/syno-pkg-land-templates.git"},

package/templates/compose/compose.yaml

@@ -1,8 +1,5 @@
 services:
-  worker:
-    image: alpine:3.20@sha256:d9e853e87e55526f6b2917df91a2115c36dd7c696a35be12163d44e6e2a4b6bc
-    command: ["sleep", "infinity"]
-    volumes:
-      # intentionally outside the zero-config docker-project resource-worker path.
-      - "${MEDIA_SHARE}/data:/data:ro"
-      - "${SYNOPKG_PKGVAR}/state:/state"
+  web:
+    image: busybox:1.37.0
+    command: [httpd, -f, -p, '8080']
+    ports: ['8080:8080']

package/templates/compose/dsm-package.yaml

@@ -0,0 +1,23 @@
+# Upstream Compose stays byte-for-byte unchanged. Only DSM differences go here.
+schema: 2
+package: __PACKAGE__
+version: 0.1.0
+build: 1
+displayname: __DISPLAY_NAME__
+description: An upstream container application with a DSM identity gateway.
+maintainer: Your Name
+os_min_ver: "7.2.1-69057"
+arches: [x86_64, aarch64]
+capabilities: {}
+compose:
+  files: [compose.yaml]
+  web: {service: web, port: 8080, health: {path: /, status: 200}}
+  network: {egress: isolated}
+identity_gateway:
+  sdk: 0.15.0
+  mode: none
+  listen: {http: 28000}
+# Web Apps default to new-page through the shared app-launch resolver.
+# ui: {launch: new-page}
+# Containers use a fixed package UID, never the signed-in user's File Station ACL.
+# For existing Share access, opt in to composeMounts and confirm after install.

package/templates/native-go/backend/THIRD_PARTY_NOTICES.txt

@@ -1,6 +1,6 @@
 Native Go package build dependencies
 
-github.com/synopackageland/syno-pkg-land-sdk v0.14.1 (MIT)
+github.com/synopackageland/syno-pkg-land-sdk v0.15.0 (MIT)
 
 Copyright (c) 2026 synopkgland
 

package/templates/native-go/backend/cmd/app/main.go

@@ -6,11 +6,13 @@
 package main
 
 import (
+	"encoding/json"
 	"fmt"
 	"log"
 	"net/http"
 	"net/http/cgi"
 	"os"
+	"path/filepath"
 	"strconv"
 	"time"
 
@@ -65,6 +67,24 @@ func main() {
 		}
 		return
 	}
+	if os.Getenv("GATEWAY_INTERFACE") == "" && len(os.Args) == 2 && os.Args[1] == "--describe" {
+		permissions, err := appapi.Permissions()
+		if err != nil {
+			log.Fatal(err)
+		}
+		cfg := app.Config{PackageID: packageID, Version: version, DataDir: ".", Portal: portal != ""}
+		if app.SessionFilesEnabled(fileStation) {
+			cfg.SessionFiles = filestation.Local(cfg.DataDir)
+		}
+		methods, err := api.DescribeRoutes(permissions, app.Routes(cfg)...)
+		if err != nil {
+			log.Fatal(err)
+		}
+		if err := json.NewEncoder(os.Stdout).Encode(methods); err != nil {
+			log.Fatal(err)
+		}
+		return
+	}
 	if os.Getenv("GATEWAY_INTERFACE") == "" {
 		fmt.Fprintf(os.Stderr, "%s %s: this program runs as the package's DSM CGI; open the app from the DSM main menu.\n", packageID, version)
 		os.Exit(2)
@@ -118,6 +138,11 @@ func main() {
 	if standalone != nil {
 		handler = standalone.Wrap(handler)
 	}
+	descriptorAuth, err := dsm.NewEntryGate(dsm.NewAuthenticator(), entry, packageID, cfg.DataDir)
+	if err != nil {
+		log.Fatal(err)
+	}
+	handler = api.WithDescription(handler, descriptorAuth, filepath.Join("/var/packages", packageID, "target", api.DescriptionFile))
 	if err := cgi.Serve(api.WithRequestDeadline(handler, deadline())); err != nil {
 		log.Fatal(err)
 	}

package/templates/native-go/backend/go.mod

@@ -4,6 +4,6 @@ go 1.25.0
 
 toolchain go1.26.9
 
-require github.com/synopackageland/syno-pkg-land-sdk v0.14.1
+require github.com/synopackageland/syno-pkg-land-sdk v0.15.0
 
 require golang.org/x/sys v0.44.0 // indirect

package/templates/native-go/backend/go.sum

@@ -1,4 +1,4 @@
-github.com/synopackageland/syno-pkg-land-sdk v0.14.1 h1:CtfrestOxidmXXoBSVZTOd6qUwciwBw0uY8oUPCmi5w=
-github.com/synopackageland/syno-pkg-land-sdk v0.14.1/go.mod h1:hlsvaVuH2wsAoR8jzI1Rg/NeejQSFpAaN6zpIWsVbjI=
+github.com/synopackageland/syno-pkg-land-sdk v0.15.0 h1:M/QoJFpARKzLbK/xRk5GU3FEdCl7drgeO8prgHgD/y4=
+github.com/synopackageland/syno-pkg-land-sdk v0.15.0/go.mod h1:msR4MhJQnVZ8NKLb0E/1K79ldZUvcOJmWhKq+gPEa+4=
 golang.org/x/sys v0.44.0 h1:ildZl3J4uzeKP07r2F++Op7E9B29JRUy+a27EibtBTQ=
 golang.org/x/sys v0.44.0/go.mod h1:4GL1E5IUh+htKOUEOaiffhrAeqysfVGipDYzABqnCmw=

package/templates/native-go/dsm-package.yaml

@@ -89,3 +89,34 @@ capabilities: {}
 #   state:
 #     items:
 #       - key: jobs          # i18n key uninstall.state.jobs
+
+# Explicit AI commands. Internal/UI methods are not automatically exposed.
+ctl:
+  enabled: true
+  commands:
+    status.show:
+      cli: [status]
+      summary: Show this App's status and verified caller
+      effect: read
+      flow: {type: invoke, method: app.status}
+      paramsSchema: {type: object, additionalProperties: false}
+      examples: [{}]
+    greeting.get:
+      cli: [greeting, get]
+      summary: Read the greeting
+      effect: read
+      flow: {type: invoke, method: greeting.get}
+      paramsSchema: {type: object, additionalProperties: false}
+      examples: [{}]
+    greeting.set:
+      cli: [greeting, set]
+      summary: Set the greeting
+      effect: write
+      flow: {type: invoke, method: greeting.set}
+      paramsSchema:
+        type: object
+        required: [text]
+        additionalProperties: false
+        properties:
+          text: {type: string, minLength: 1, maxLength: 200, description: Greeting text, examples: [Hello]}
+      examples: [{text: Hello}]

package/templates/native-go-vue/frontend/package-lock.json

@@ -7,7 +7,7 @@
       "name": "native-dsm-vue-app",
       "dependencies": {
         "@lucide/vue": "1.48.0",
-        "@synopackageland/sdk": "0.14.1",
+        "@synopackageland/sdk": "0.15.0",
         "@synopackageland/ui": "0.11.4",
         "vue": "3.5.43"
       },
@@ -1148,9 +1148,9 @@
       }
     },
     "node_modules/@synopackageland/sdk": {
-      "version": "0.14.1",
-      "resolved": "https://registry.npmjs.org/@synopackageland/sdk/-/sdk-0.14.1.tgz",
-      "integrity": "sha512-ZfK8z5vnu8LWyrJghDINEaCOGaNZhtfsIytU3gIPKHBItw0T68t8KKBJUCJoJ8pPZfNrAKq08tHrSB2TAJD6DA==",
+      "version": "0.15.0",
+      "resolved": "https://registry.npmjs.org/@synopackageland/sdk/-/sdk-0.15.0.tgz",
+      "integrity": "sha512-Y8NRMedQ96Plex8Ori5SmsiqY8X7edhyyHm7oaot1/PizinyOBrW3zE9ZhjrvSu5Kh6PFwEE+Uz7SM8yK2wJpw==",
       "license": "MIT",
       "peerDependencies": {
         "@lucide/vue": "^1.48.0",

package/templates/native-go-vue/frontend/package.json

@@ -8,7 +8,7 @@
   },
   "dependencies": {
     "@lucide/vue": "1.48.0",
-    "@synopackageland/sdk": "0.14.1",
+    "@synopackageland/sdk": "0.15.0",
     "@synopackageland/ui": "0.11.4",
     "vue": "3.5.43"
   },

package/templates/native-node/dsm-package.yaml

@@ -49,7 +49,7 @@ backend:
   runtime: node
   dir: backend/app
   entry: main.js
-  sdk: 0.14.1
+  sdk: 0.15.0
   node: { package: Node.js_v20 }
 
 ui:
@@ -80,3 +80,34 @@ i18n:
 
 # Optional SDK capabilities; delegate/rootOps share administrator-approved executor setup.
 capabilities: {}
+
+# Explicit AI commands. Internal/UI methods are not automatically exposed.
+ctl:
+  enabled: true
+  commands:
+    status.show:
+      cli: [status]
+      summary: Show this App's status and verified caller
+      effect: read
+      flow: {type: invoke, method: app.status}
+      paramsSchema: {type: object, additionalProperties: false}
+      examples: [{}]
+    greeting.get:
+      cli: [greeting, get]
+      summary: Read the greeting
+      effect: read
+      flow: {type: invoke, method: greeting.get}
+      paramsSchema: {type: object, additionalProperties: false}
+      examples: [{}]
+    greeting.set:
+      cli: [greeting, set]
+      summary: Set the greeting
+      effect: write
+      flow: {type: invoke, method: greeting.set}
+      paramsSchema:
+        type: object
+        required: [text]
+        additionalProperties: false
+        properties:
+          text: {type: string, minLength: 1, maxLength: 200, description: Greeting text, examples: [Hello]}
+      examples: [{text: Hello}]

package/templates/native-python/dsm-package.yaml

@@ -47,7 +47,7 @@ backend:
   runtime: python
   dir: backend/app
   entry: main.py
-  sdk: 0.14.1
+  sdk: 0.15.0
 
 ui:
   # Non-UI-SDK frontends open a full page; Portal is a separate opt-in.
@@ -77,3 +77,34 @@ i18n:
 
 # Optional SDK capabilities; delegate/rootOps share administrator-approved executor setup.
 capabilities: {}
+
+# Explicit AI commands. Internal/UI methods are not automatically exposed.
+ctl:
+  enabled: true
+  commands:
+    status.show:
+      cli: [status]
+      summary: Show this App's status and verified caller
+      effect: read
+      flow: {type: invoke, method: app.status}
+      paramsSchema: {type: object, additionalProperties: false}
+      examples: [{}]
+    greeting.get:
+      cli: [greeting, get]
+      summary: Read the greeting
+      effect: read
+      flow: {type: invoke, method: greeting.get}
+      paramsSchema: {type: object, additionalProperties: false}
+      examples: [{}]
+    greeting.set:
+      cli: [greeting, set]
+      summary: Set the greeting
+      effect: write
+      flow: {type: invoke, method: greeting.set}
+      paramsSchema:
+        type: object
+        required: [text]
+        additionalProperties: false
+        properties:
+          text: {type: string, minLength: 1, maxLength: 200, description: Greeting text, examples: [Hello]}
+      examples: [{text: Hello}]

package/templates/native-rust/backend/Cargo.lock

@@ -104,8 +104,8 @@ dependencies = [
 
 [[package]]
 name = "syno-pkg-land-app"
-version = "0.14.1"
-source = "git+https://github.com/synopackageland/syno-pkg-land-sdk?tag=v0.14.1#89690a632bcc2542c465fb5d1d02e18b85de5762"
+version = "0.15.0"
+source = "git+https://github.com/synopackageland/syno-pkg-land-sdk?tag=v0.15.0#a68ee74f311b2fa7b980330c340bd61bd146aec4"
 dependencies = [
  "libc",
  "serde",

package/templates/native-rust/backend/Cargo.toml

@@ -9,7 +9,7 @@ libc = "0.2"
 serde = { version = "1", features = ["derive"] }
 serde_json = "1"
 # The SDK version is the tag; `synopkgland check` reads it from Cargo.lock.
-syno-pkg-land-app = { git = "https://github.com/synopackageland/syno-pkg-land-sdk", tag = "v0.14.1" }
+syno-pkg-land-app = { git = "https://github.com/synopackageland/syno-pkg-land-sdk", tag = "v0.15.0" }
 
 [profile.release]
 # A handler panic becomes an "internal" reply; abort would end the App without one.

package/templates/native-rust/dsm-package.yaml

@@ -78,3 +78,34 @@ i18n:
 
 # Optional SDK capabilities; delegate/rootOps share administrator-approved executor setup.
 capabilities: {}
+
+# Explicit AI commands. Internal/UI methods are not automatically exposed.
+ctl:
+  enabled: true
+  commands:
+    status.show:
+      cli: [status]
+      summary: Show this App's status and verified caller
+      effect: read
+      flow: {type: invoke, method: app.status}
+      paramsSchema: {type: object, additionalProperties: false}
+      examples: [{}]
+    greeting.get:
+      cli: [greeting, get]
+      summary: Read the greeting
+      effect: read
+      flow: {type: invoke, method: greeting.get}
+      paramsSchema: {type: object, additionalProperties: false}
+      examples: [{}]
+    greeting.set:
+      cli: [greeting, set]
+      summary: Set the greeting
+      effect: write
+      flow: {type: invoke, method: greeting.set}
+      paramsSchema:
+        type: object
+        required: [text]
+        additionalProperties: false
+        properties:
+          text: {type: string, minLength: 1, maxLength: 200, description: Greeting text, examples: [Hello]}
+      examples: [{text: Hello}]

package/templates/compose/synology-app.yaml

@@ -1,22 +0,0 @@
-schema: 1
-package: com.synology.hello.files
-version: 0.1.0
-displayname: Hello Files
-description: A minimal headless app with a Shared Folder mount.
-# Package Center and DSM window icon: a square PNG of at least 256x256, or a
-# folder of icon_<size>.png. Omit to use the SDK default icon.
-# icon: assets/icon.png
-maintainer: Syno Package Land
-os_min_ver: "7.2.1-69057"
-
-install:
-  MEDIA_SHARE:
-    type: shared_folder
-  RUN_AS:
-    type: dsm_user
-
-# For a web frontend, declare adminport/adminurl and explicitly choose:
-# integration:
-#   web:
-#     launch: new-page
-# No Application Portal declaration is needed. Omitted web launch means new-page.