@synopackageland/templates 0.16.0 → 0.17.0

package/README.md

@@ -38,12 +38,12 @@ calls each one from the generated script of the same name (`synopkgland skill sh
 The placeholders `__PACKAGE__` (also the Go module path), `__DISPLAY_NAME__` and
 `__BACKGROUND_ENABLED__` are substituted by `init`.
 
-`backend/go.mod` requires `github.com/synopackageland/syno-pkg-land-sdk v0.16.0`; that line is
+`backend/go.mod` requires `github.com/synopackageland/syno-pkg-land-sdk v0.17.0`; that line is
 the single source of the SDK version and `frontend/package.json` pins
 `@synopackageland/sdk` to the same version. Python and Node.js name it in
 `backend.sdk`, Rust in the `syno-pkg-land-app` tag of `backend/Cargo.toml`
-(and `Cargo.lock`); all of them pin 0.16.0. The Vue frontend pins
-`@synopackageland/ui` 0.12.0. SDK 0.16.0 accepts UI `>=0.10.1 <0.13.0`,
+(and `Cargo.lock`); all of them pin 0.17.0. The Vue frontend pins
+`@synopackageland/ui` 0.12.0. SDK 0.17.0 accepts UI `>=0.10.1 <0.13.0`,
 so no UI peer override is needed. Tests use jsdom 30 for UI floating-layer styles.
 
 ## Notice writer
@@ -149,3 +149,9 @@ The CLI preserves upstream bytes and the SDK planner generates an override and o
 ## AI commands
 
 All four native templates explicitly declare status and greeting commands in `ctl.commands`. Build packages a private `synopkgland-api.json`; only the authenticated SDK description endpoint returns it. Internal routes are not automatically commands. Read `synopkgland skill show ctl` before adding command schemas or workflow bindings.
+
+The Vue scaffold batches independent startup status/greeting reads when the
+window already identifies an administrator and supplies `ctx.batch`. Rebuild
+with the current CLI and SDK to get that client. Older generated contexts keep
+the single-call path. Each batch result is handled separately; the shell stays
+visible while reads run. The backend permissions remain authoritative.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@synopackageland/templates",
-  "version": "0.16.0",
+  "version": "0.17.0",
   "description": "Project templates for synopkgland init: native-go, native-python, native-node and native-rust (plain or Vue, with jobs, delegate and root-ops overlays), binary and compose.",
   "license": "MIT",
   "repository": {"type": "git", "url": "git+https://github.com/synopackageland/syno-pkg-land-templates.git"},

package/templates/_shared/AGENTS.md

@@ -62,26 +62,30 @@ call `greeting.set`.
 
 ## DSM Application Portal (`portal`)
 
-Only an App with the root executor (`rootOps` or `delegate`) may declare a
-portal: its uninstall then reloads nginx so the alias stops answering, which a
-no-privilege App cannot do without root. `synopkgland add portal` (with
-`root-ops` or `delegate` in the same call or already declared; or `portal: {}` /
-`portal: {alias: my-app}` in dsm-package.yaml) registers
-`https://<nas>/<alias>/`, which opens the app after DSM sign-in. Compose Apps
-cannot declare a portal. Read `synopkgland skill show portal` before changing it.
-The install wizard only proposes the alias; an administrator activates it from
-the app's portal panel (`ctx.portal`, DSM's own `SYNO.Core.AppPortal` in the
-admin's session) or Control Panel > Login Portal > Applications. Ordinary users
-get the link from the backend's read-only `portal.status`, else "ask an
-administrator". Never write `AppPortal.json` or `@appconf/<package>`, never add
-a backend route that sets the alias, and never relay QuickConnect responses or
-build QuickConnect links. A portal needs os_min_ver 7.1-42661 or later, and
-`add portal` raises a lower one. Below DSM 7.2 the executor registers the
-entry: there is no alias wizard step, and an administrator enables the entry
-from the portal panel (`ctx.portal.register()`), which the executor's approved
-`portal.register` operation carries out. From 7.2 the SPK registers it as a
-DSM resource. Beyond that, support is detected (SYNO.API.Info), not
-version-gated.
+From DSM 7.2-64570, Apps can declare `portal` without an executor. DSM's
+web-config resource registers the entry, and INFO
+`instuninst_restart_services="nginx.service"` asks DSM to reload nginx after
+install, upgrade and uninstall. The reload is asynchronous; package hooks stay
+unprivileged and never reload nginx themselves. Schema-2 Compose/gateway Apps
+may also use a top-level `portal`; legacy `integration.web.portal` is unsupported.
+
+`synopkgland add portal` adds `portal: {}` (or set
+`portal: {alias: my-app}` in dsm-package.yaml). Without an executor, set
+`os_min_ver` to 7.2-64570 or later before adding Portal; the command refuses a
+lower target and never raises it silently. With an executor, a portal needs
+`os_min_ver` 7.1-42661 or later. Below DSM 7.2 the executor registers the entry:
+DSM 7.1 rejects the unsigned web-config worker, there is no alias wizard step,
+and an administrator enables it through `ctx.portal.register()` after executor
+approval. From DSM 7.2, the SPK registers it as a DSM resource.
+
+Read `synopkgland skill show portal` before changing it. The install wizard only
+proposes the alias; an administrator activates it in the App's portal panel
+(`ctx.portal`, DSM's own `SYNO.Core.AppPortal` in the admin session) or Control
+Panel > Login Portal > Applications. Other signed-in users get the link from
+read-only `portal.status`, else "ask an administrator". Never write
+`AppPortal.json` or `@appconf/<package>`, never add a backend route that sets
+the alias, and never relay QuickConnect responses or build QuickConnect links.
+Beyond the packaging floor, support is detected with SYNO.API.Info.
 
 ### Login page look (`login_style`)
 

package/templates/compose/dsm-package.yaml

@@ -14,7 +14,7 @@ compose:
   web: {service: web, port: 8080, health: {path: /, status: 200}}
   network: {egress: isolated}
 identity_gateway:
-  sdk: 0.16.0
+  sdk: 0.17.0
   mode: none
   listen: {http: 28000}
 # Web Apps default to new-page through the shared app-launch resolver.

package/templates/native-go/README.md

@@ -297,23 +297,21 @@ refusal for unknown methods.
 
 ## DSM Application Portal link
 
-Only an App with the root executor (`rootOps` or `delegate`) can declare a
-portal; `synopkgland add root-ops portal` declares both. Uninstall then
-removes the App's Application Privileges rules and reloads nginx once DSM has
-removed the alias, so it stops answering. `synopkgland add portal` adds
-`portal: {}` to dsm-package.yaml so
-`https://<nas>/<alias>/` opens this app right after DSM sign-in. The install
-wizard proposes the alias (the package name in lowercase by default); an
-administrator turns it on from the app's portal panel or Control Panel >
-Login Portal > Applications. Ordinary users then see the link; until then
-they see "ask an administrator". DSM owns the setting: the backend's
-`portal.status` only reads it, and nothing in the package may write it. See
-`synopkgland skill show portal`.
-
-A portal needs DSM 7.3.2-86009 or later, so `add portal` raises a lower
-`os_min_ver` and build refuses one below it. DSM 7.1.1 rejects an unsigned
-package that registers a portal (Package Center error 320); 7.3.2 and 7.4
-install it; 7.2 is untested. To keep supporting older DSM, remove `portal:`.
+From DSM 7.2-64570, an App can declare `portal` without an executor. Set
+`os_min_ver` to that floor or later before `synopkgland add portal`; the command
+refuses a lower no-privilege target instead of silently raising it. The command
+adds `portal: {}` so `https://<nas>/<alias>/` opens the App after DSM sign-in.
+The install wizard proposes the alias; an administrator applies it in the App
+panel or Control Panel > Login Portal > Applications. Other users see the link
+or "ask an administrator". DSM owns the setting; `portal.status` only reads it.
+
+Every Portal SPK asks DSM to reload nginx through INFO
+`instuninst_restart_services="nginx.service"` after install, upgrade and
+uninstall. The reload is asynchronous; package hooks stay unprivileged.
+DSM 7.1-42661 still needs an approved executor to register the entry, since its
+web-config worker rejects unsigned packages. For that route, declare an
+executor capability, for example `synopkgland add root-ops portal`. See
+`synopkgland skill show portal` before changing Portal settings.
 
 The build also gives the portal a login page look: a neutral default
 wallpaper (its thumbnail is what Control Panel > Login Portal > Applications

package/templates/native-go/backend/THIRD_PARTY_NOTICES.txt

@@ -1,6 +1,6 @@
 Native Go package build dependencies
 
-github.com/synopackageland/syno-pkg-land-sdk v0.16.0 (MIT)
+github.com/synopackageland/syno-pkg-land-sdk v0.17.0 (MIT)
 
 Copyright (c) 2026 synopkgland
 

package/templates/native-go/backend/go.mod

@@ -4,6 +4,6 @@ go 1.25.0
 
 toolchain go1.26.9
 
-require github.com/synopackageland/syno-pkg-land-sdk v0.16.0
+require github.com/synopackageland/syno-pkg-land-sdk v0.17.0
 
 require golang.org/x/sys v0.44.0 // indirect

package/templates/native-go/backend/go.sum

@@ -1,4 +1,4 @@
-github.com/synopackageland/syno-pkg-land-sdk v0.16.0 h1:9MYFliraGfCE+1TXyFQD6s/YPMBMhGbj4bY+HHh9Y08=
-github.com/synopackageland/syno-pkg-land-sdk v0.16.0/go.mod h1:vixf5Lo4PssQDGU5zam0Mb5sFu9wPUP4Ck36BMAVbNc=
+github.com/synopackageland/syno-pkg-land-sdk v0.17.0 h1:DaYDHCDlukkXtTm+3m26p7pU86r298MTasKDrV/tRl4=
+github.com/synopackageland/syno-pkg-land-sdk v0.17.0/go.mod h1:vixf5Lo4PssQDGU5zam0Mb5sFu9wPUP4Ck36BMAVbNc=
 golang.org/x/sys v0.44.0 h1:ildZl3J4uzeKP07r2F++Op7E9B29JRUy+a27EibtBTQ=
 golang.org/x/sys v0.44.0/go.mod h1:4GL1E5IUh+htKOUEOaiffhrAeqysfVGipDYzABqnCmw=

package/templates/native-go-vue/frontend/package-lock.json

@@ -7,8 +7,8 @@
       "name": "native-dsm-vue-app",
       "dependencies": {
         "@lucide/vue": "1.48.0",
-        "@synopackageland/sdk": "0.16.0",
-        "@synopackageland/ui": "0.12.0",
+        "@synopackageland/sdk": "0.17.0",
+        "@synopackageland/ui": "0.12.1",
         "vue": "3.5.43"
       },
       "devDependencies": {
@@ -1152,8 +1152,8 @@
       }
     },
     "node_modules/@synopackageland/sdk": {
-      "version": "0.16.0",
-      "resolved": "https://registry.npmjs.org/@synopackageland/sdk/-/sdk-0.16.0.tgz",
+      "version": "0.17.0",
+      "resolved": "https://registry.npmjs.org/@synopackageland/sdk/-/sdk-0.17.0.tgz",
       "integrity": "sha512-3h7PjF55kJjKDJHZE9tbR0UxOgmxfGEnY9eKkpKPStdy8OiTOGjOlB298+YvJtkRBLiOZ13En10sa/ADbU9DnA==",
       "license": "MIT",
       "peerDependencies": {
@@ -1171,9 +1171,9 @@
       }
     },
     "node_modules/@synopackageland/ui": {
-      "version": "0.12.0",
-      "resolved": "https://registry.npmjs.org/@synopackageland/ui/-/ui-0.12.0.tgz",
-      "integrity": "sha512-LGdkmceKcybJj4kvbwBZk5vewKepDi4vyGohkittpucnfOM9EOlCWkaWfWoZZ5MD0LQlwZf2ueydcrEOLq3R/A==",
+      "version": "0.12.1",
+      "resolved": "https://registry.npmjs.org/@synopackageland/ui/-/ui-0.12.1.tgz",
+      "integrity": "sha512-nyHKefcyKWiaXpjsjFfxrgsH4RSDHgO71bOV8uGRf89Ch2kDapNTfv42RtR2idIfNTt7A3/gKw8eUlyRn9VJDQ==",
       "license": "MIT",
       "dependencies": {
         "@internationalized/date": "3.12.4",

package/templates/native-go-vue/frontend/package.json

@@ -8,8 +8,8 @@
   },
   "dependencies": {
     "@lucide/vue": "1.48.0",
-    "@synopackageland/sdk": "0.16.0",
-    "@synopackageland/ui": "0.12.0",
+    "@synopackageland/sdk": "0.17.0",
+    "@synopackageland/ui": "0.12.1",
     "vue": "3.5.43"
   },
   "devDependencies": {

package/templates/native-go-vue/frontend/src/App.vue

@@ -43,10 +43,24 @@ async function refresh() {
  const early = !login.ready.value
  const call: typeof login.call = early ? (method, params) => props.ctx.call(method, params) : login.call
  busy.value = true; error.value = ''
+ // An administrator DSM names up front has the greeting read beside the status.
+ const startupBatch = props.ctx.user?.isAdmin === true ? props.ctx.batch : undefined
+ const read = !startupBatch && props.ctx.user?.isAdmin ? call<{text:string}>('greeting.get') : undefined
+ read?.catch(() => {})
  try {
-  const a = await call<AppStatus>('app.status')
-  if(!disposed) app.value = a
-  if(a.admin) {const greeting = await call<{text:string}>('greeting.get'); if(!disposed) text.value = greeting.text}
+  if(startupBatch) {
+   const batch = early ? startupBatch : login.batch
+   const results = await batch([{method:'app.status'},{method:'greeting.get'}])
+   const status = results[0]!, greeting = results[1]!
+   if(!status.success) throw status.error
+   if(!disposed) app.value = status.data as AppStatus
+   if(!greeting.success) throw greeting.error
+   if(!disposed) text.value = (greeting.data as {text:string}).text
+  } else {
+   const a = await call<AppStatus>('app.status')
+   if(!disposed) app.value = a
+   if(a.admin) {const greeting = await (read ?? call<{text:string}>('greeting.get')); if(!disposed) text.value = greeting.text}
+  }
  } catch(e) {if(!disposed && !(early && login.enabled.value)) error.value = message(e)}
  finally {if(!disposed) {busy.value=false; if(again) {again=false; void refresh()}}}
 }

package/templates/native-go-vue/frontend/test/apps.test.ts

@@ -88,6 +88,19 @@ test('the app renders and loads status while the session check is still pending'
   expect([...root.querySelectorAll('[data-app-status] [data-app-value]')].map(node=>node.textContent)).toEqual(['Eager','admin','1'])
  }finally{app.unmount();root.remove()}
 })
+test('an administrator DSM names up front has the greeting read beside the status',async()=>{
+ const call=vi.fn(async(method:string)=>{
+  if(method==='app.status')return new Promise(()=>{})
+  if(method==='greeting.get')return {text:'Hello Early'}
+  throw {code:'unknown_method'}
+ })
+ const root=document.createElement('div');document.body.append(root)
+ const app=mount(root,dsmWindow({call,user:{name:'admin',isAdmin:true}}))
+ try{
+  await settle()
+  expect(call.mock.calls.map(([method])=>method)).toContain('greeting.get')
+ }finally{app.unmount();root.remove()}
+})
 test('a status request that raced the session check is retried once the session is confirmed',async()=>{
  let session=false,rejectEarly:(e:unknown)=>void=()=>{}
  const call=vi.fn(async(method:string)=>{
@@ -239,3 +252,16 @@ test('an administrator sees a pending Shared Folder with the grant step; a plain
   expect(root.textContent).toContain('Ask an administrator')
  }finally{app.unmount();root.remove();plain.close()}
 })
+
+test('batches startup reads for a known administrator', async () => {
+ const calls: string[]=[]
+ const batch=vi.fn(async () => [{success:true as const,data:{package:'Batch',version:'1',user:'admin',admin:true}},{success:true as const,data:{text:'Hello Batch'}}])
+ const ctx=dsmWindow({user:{name:'admin',isAdmin:true},batch:batch as NonNullable<Context['batch']>,call:async <T,>(method:string)=>{calls.push(method);if(method==='identity.status')return {enabled:false} as T;throw {code:'unknown_method'}}})
+ const root=document.createElement('div');document.body.append(root)
+ const app=mount(root,ctx)
+ await settle()
+ expect(batch).toHaveBeenCalledWith([{method:'app.status'},{method:'greeting.get'}])
+ expect(calls).not.toContain('app.status');expect(calls).not.toContain('greeting.get')
+ expect((root.querySelector('textarea') as HTMLTextAreaElement).value).toBe('Hello Batch')
+ app.unmount();root.remove()
+})

package/templates/native-node/dsm-package.yaml

@@ -49,7 +49,7 @@ backend:
   runtime: node
   dir: backend/app
   entry: main.js
-  sdk: 0.16.0
+  sdk: 0.17.0
   node: { package: Node.js_v20 }
 
 ui:

package/templates/native-python/dsm-package.yaml

@@ -47,7 +47,7 @@ backend:
   runtime: python
   dir: backend/app
   entry: main.py
-  sdk: 0.16.0
+  sdk: 0.17.0
 
 ui:
   # Non-UI-SDK frontends open a full page; Portal is a separate opt-in.

package/templates/native-rust/backend/Cargo.lock

@@ -104,8 +104,8 @@ dependencies = [
 
 [[package]]
 name = "syno-pkg-land-app"
-version = "0.16.0"
-source = "git+https://github.com/synopackageland/syno-pkg-land-sdk?tag=v0.16.0#b49f8a178c7fd0e8a2b402edb8ed829104125bfd"
+version = "0.17.0"
+source = "git+https://github.com/synopackageland/syno-pkg-land-sdk?tag=v0.17.0#91fa899beec935af9668a04c24ccd64b0d03b00b"
 dependencies = [
  "libc",
  "serde",

package/templates/native-rust/backend/Cargo.toml

@@ -9,7 +9,7 @@ libc = "0.2"
 serde = { version = "1", features = ["derive"] }
 serde_json = "1"
 # The SDK version is the tag; `synopkgland check` reads it from Cargo.lock.
-syno-pkg-land-app = { git = "https://github.com/synopackageland/syno-pkg-land-sdk", tag = "v0.16.0" }
+syno-pkg-land-app = { git = "https://github.com/synopackageland/syno-pkg-land-sdk", tag = "v0.17.0" }
 
 [profile.release]
 # A handler panic becomes an "internal" reply; abort would end the App without one.