@synopackageland/templates 0.30.0 → 0.31.0

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (14) hide show
  1. package/README.md +8 -8
  2. package/package.json +1 -1
  3. package/templates/compose/dsm-package.yaml +1 -1
  4. package/templates/native-go/backend/THIRD_PARTY_NOTICES.txt +1 -1
  5. package/templates/native-go/backend/go.mod +1 -1
  6. package/templates/native-go/backend/go.sum +2 -2
  7. package/templates/native-go/backend/internal/app/background.go +7 -1
  8. package/templates/native-go/backend/internal/app/background_test.go +13 -2
  9. package/templates/native-go-vue/frontend/package-lock.json +4 -4
  10. package/templates/native-go-vue/frontend/package.json +1 -1
  11. package/templates/native-node/dsm-package.yaml +1 -1
  12. package/templates/native-python/dsm-package.yaml +1 -1
  13. package/templates/native-rust/backend/Cargo.lock +2 -2
  14. package/templates/native-rust/backend/Cargo.toml +1 -1
package/README.md CHANGED
@@ -22,8 +22,8 @@ daemon:
22
22
  window_seconds: 300
23
23
  ```
24
24
 
25
- Templates pin UI 0.14.10 and SDK 0.30.0 in native and Compose projects.
26
- Use CLI 0.30.0 or later. Go Apps select
25
+ Templates pin UI 0.14.10 and SDK 0.31.0 in native and Compose projects.
26
+ Use CLI 0.31.0 or later. Go Apps select
27
27
  their controller from their Go SDK requirement; an identity gateway selects it
28
28
  from `identity_gateway.sdk`. The CLI rejects older selected versions, even for
29
29
  an explicit `mode: off`, rather than dropping the declaration. A local SDK source
@@ -39,7 +39,7 @@ for declaration bounds, SDK selection, build/inspect checks and diagnostics.
39
39
 
40
40
  An opt-in [Shared Folder permission example](examples/shared-folder-permission/README.md)
41
41
  shows the Go status-handler registration and a Vue notice for startup checks and
42
- storage failures. It uses the same SDK 0.30.0 release pinned by the default scaffolds.
42
+ storage failures. It uses the same SDK 0.31.0 release pinned by the default scaffolds.
43
43
 
44
44
  An opt-in [native UI plus DSM console example](examples/dual-entry-console/README.md)
45
45
  shows the `console` declaration for an App that wraps a web service behind the
@@ -79,18 +79,18 @@ calls each one from the generated script of the same name (`synopkgland skill sh
79
79
  The placeholders `__PACKAGE__` (also the Go module path), `__DISPLAY_NAME__` and
80
80
  `__BACKGROUND_ENABLED__` are substituted by `init`.
81
81
 
82
- `backend/go.mod` requires `github.com/synopackageland/syno-pkg-land-sdk v0.30.0`; that line is
82
+ `backend/go.mod` requires `github.com/synopackageland/syno-pkg-land-sdk v0.31.0`; that line is
83
83
  the single source of the SDK version and `frontend/package.json` pins
84
84
  `@synopackageland/sdk` to the same version. Python and Node.js name it in
85
85
  `backend.sdk`, Rust in the `syno-pkg-land-app` tag of `backend/Cargo.toml`
86
- (and `Cargo.lock`); all of them pin 0.30.0. The Vue frontend pins
87
- `@synopackageland/ui` 0.14.10. SDK 0.30.0 accepts UI `>=0.10.1 <0.16.0`,
86
+ (and `Cargo.lock`); all of them pin 0.31.0. The Vue frontend pins
87
+ `@synopackageland/ui` 0.14.10. SDK 0.31.0 accepts UI `>=0.10.1 <0.16.0`,
88
88
  so no UI peer override is needed. Tests use jsdom 30 for UI floating-layer styles.
89
89
 
90
90
  SDK 0.27.0 moves interactive NAS file operations to same-origin browser calls.
91
91
  Custom file handlers use the SDK's
92
92
  [session transport migration](https://github.com/synopackageland/syno-pkg-land-sdk/blob/v0.27.0/docs/dsm-session-transport.md).
93
- Use CLI 0.30.0 for the matching SDK 0.30.0 executor/lifecycle digests. Rebuilt
93
+ Use CLI 0.31.0 for the matching SDK 0.31.0 executor/lifecycle digests. Rebuilt
94
94
  protected executors follow normal administrator approval. No NAS acceptance is claimed.
95
95
 
96
96
  UI and i18n text, including the DSM glossary, omit terminal sentence periods.
@@ -230,4 +230,4 @@ The bridge examples expose submission, lookup and cancellation through
230
230
 
231
231
  ## External access
232
232
 
233
- With CLI/SDK 0.30.0, a gateway App may declare `identity_gateway.external_access: {connect: optional, origin_change: confirm, single_origin: true}` for an upstream that signs in on one fixed URL. The policy is forwarded to the packaged gateway. A single-origin App's `manual_origin` accepts an explicit HTTPS port; the `external-origin` installation setting remains restricted to port 443. The DSM launcher selects a provider destination, probes `/_spl/ping` for up to eight seconds, and explains failures before offering **Open anyway**. A configured single-origin App always opens its primary external origin.
233
+ With CLI/SDK 0.31.0, a gateway App may declare `identity_gateway.external_access: {connect: optional, origin_change: confirm, single_origin: true}` for an upstream that signs in on one fixed URL. The policy is forwarded to the packaged gateway. A single-origin App's `manual_origin` accepts an explicit HTTPS port; the `external-origin` installation setting remains restricted to port 443. The DSM launcher selects a provider destination, probes `/_spl/ping` for up to eight seconds, and explains failures before offering **Open anyway**. A configured single-origin App always opens its primary external origin.
package/package.json CHANGED
@@ -1,6 +1,6 @@
1
1
  {
2
2
  "name": "@synopackageland/templates",
3
- "version": "0.30.0",
3
+ "version": "0.31.0",
4
4
  "description": "Project templates for synopkgland init: native-go, native-python, native-node and native-rust (plain or Vue, with jobs, delegate and root-ops overlays), binary and compose.",
5
5
  "license": "MIT",
6
6
  "repository": {
package/templates/compose/dsm-package.yaml CHANGED
@@ -14,7 +14,7 @@ compose:
14
14
  web: {service: web, port: 8080, health: {path: /, status: 200}}
15
15
  network: {egress: isolated}
16
16
  identity_gateway:
17
- sdk: 0.30.0
17
+ sdk: 0.31.0
18
18
  mode: none
19
19
  listen: {http: 28000}
20
20
  # Web Apps default to new-page through the shared app-launch resolver.
package/templates/native-go/backend/THIRD_PARTY_NOTICES.txt CHANGED
@@ -1,6 +1,6 @@
1
1
  Native Go package build dependencies
2
2
 
3
- github.com/synopackageland/syno-pkg-land-sdk v0.30.0 (MIT)
3
+ github.com/synopackageland/syno-pkg-land-sdk v0.31.0 (MIT)
4
4
 
5
5
  Copyright (c) 2026 synopkgland
6
6
 
package/templates/native-go/backend/go.mod CHANGED
@@ -4,6 +4,6 @@ go 1.25.0
4
4
 
5
5
  toolchain go1.26.10
6
6
 
7
- require github.com/synopackageland/syno-pkg-land-sdk v0.30.0
7
+ require github.com/synopackageland/syno-pkg-land-sdk v0.31.0
8
8
 
9
9
  require golang.org/x/sys v0.44.0 // indirect
package/templates/native-go/backend/go.sum CHANGED
@@ -1,4 +1,4 @@
1
- github.com/synopackageland/syno-pkg-land-sdk v0.30.0 h1:J3b55Csho3oBfpyod1BOmNzqcGf216g829j8VnsU2uI=
2
- github.com/synopackageland/syno-pkg-land-sdk v0.30.0/go.mod h1:8GwREGbczc8mAk4Gv8FUHaukXXCUstjzkovQrNV59Cc=
1
+ github.com/synopackageland/syno-pkg-land-sdk v0.31.0 h1:YL7yuEffWdi0nNdmDGxSzBseREXdmm8/ewobQNR7orc=
2
+ github.com/synopackageland/syno-pkg-land-sdk v0.31.0/go.mod h1:8GwREGbczc8mAk4Gv8FUHaukXXCUstjzkovQrNV59Cc=
3
3
  golang.org/x/sys v0.44.0 h1:ildZl3J4uzeKP07r2F++Op7E9B29JRUy+a27EibtBTQ=
4
4
  golang.org/x/sys v0.44.0/go.mod h1:4GL1E5IUh+htKOUEOaiffhrAeqysfVGipDYzABqnCmw=
package/templates/native-go/backend/internal/app/background.go CHANGED
@@ -10,6 +10,7 @@ import (
10
10
  "os"
11
11
  "os/user"
12
12
  "path/filepath"
13
+ "strings"
13
14
  "syscall"
14
15
  "time"
15
16
 
@@ -137,7 +138,8 @@ func (b backgroundAPI) submit(ctx context.Context, _ api.Caller, _ *http.Request
137
138
  return map[string]any{"job": job, "duplicate": duplicate}, nil
138
139
  }
139
140
 
140
- // readInput accepts only an existing regular file inside the App data directory.
141
+ // readInput accepts only an existing regular file inside the App data directory,
142
+ // outside the job spool.
141
143
  // The App's producer imports it first; jobs and schedules retain a private copy.
142
144
  func (b backgroundAPI) readInput(input string) ([]byte, error) {
143
145
  bad := api.BadRequest("input must be a regular file in the App data directory")
@@ -145,6 +147,10 @@ func (b backgroundAPI) readInput(input string) ([]byte, error) {
145
147
  if err != nil || !filepath.IsAbs(input) || !filepath.IsLocal(rel) {
146
148
  return nil, bad
147
149
  }
150
+ // The job spool keeps other owners' private copies; it is never an input.
151
+ if first, _, _ := strings.Cut(filepath.ToSlash(rel), "/"); first == "background" {
152
+ return nil, bad
153
+ }
148
154
  root, err := os.OpenRoot(b.dataDir)
149
155
  if err != nil {
150
156
  return nil, bad
package/templates/native-go/backend/internal/app/background_test.go CHANGED
@@ -172,7 +172,18 @@ func TestBackgroundSubmitRejectsExternalAndOversizedInput(t *testing.T) {
172
172
  if err := os.Symlink(outside, filepath.Join(e.dataDir, "escape")); err != nil {
173
173
  t.Fatal(err)
174
174
  }
175
- for _, input := range []string{outside, "input.txt", filepath.Join(e.dataDir, "escape"), e.dataDir} {
175
+ if code, _ := e.call(alice, "bg.jobs.submit", e.submitParams("first")); code != "" {
176
+ t.Fatal(code)
177
+ }
178
+ spooled, err := filepath.Glob(filepath.Join(e.dataDir, "background", "*"))
179
+ if err != nil || len(spooled) == 0 {
180
+ t.Fatalf("no spool files: %v", err)
181
+ }
182
+ if err := os.WriteFile(filepath.Join(e.dataDir, "background", "copy"), []byte("x"), 0600); err != nil {
183
+ t.Fatal(err)
184
+ }
185
+ inputs := []string{outside, "input.txt", filepath.Join(e.dataDir, "escape"), e.dataDir, filepath.Join(e.dataDir, "background", "copy")}
186
+ for _, input := range append(inputs, spooled...) {
176
187
  p, _ := json.Marshal(map[string]string{"key": "bad", "name": "a.txt", "input": input})
177
188
  if code, _ := e.call(alice, "bg.jobs.submit", string(p)); code != "bad_request" {
178
189
  t.Fatalf("%s: %s", input, code)
@@ -185,7 +196,7 @@ func TestBackgroundSubmitRejectsExternalAndOversizedInput(t *testing.T) {
185
196
  t.Fatal(code)
186
197
  }
187
198
  jobs, err := e.store.List(context.Background())
188
- if err != nil || len(jobs) != 0 {
199
+ if err != nil || len(jobs) != 1 {
189
200
  t.Fatalf("invalid input queued: %v %v", jobs, err)
190
201
  }
191
202
  }
package/templates/native-go-vue/frontend/package-lock.json CHANGED
@@ -7,7 +7,7 @@
7
7
  "name": "native-dsm-vue-app",
8
8
  "dependencies": {
9
9
  "@lucide/vue": "1.48.0",
10
- "@synopackageland/sdk": "0.30.0",
10
+ "@synopackageland/sdk": "0.31.0",
11
11
  "@synopackageland/ui": "0.14.10",
12
12
  "vue": "3.5.43"
13
13
  },
@@ -1152,9 +1152,9 @@
1152
1152
  }
1153
1153
  },
1154
1154
  "node_modules/@synopackageland/sdk": {
1155
- "version": "0.30.0",
1156
- "resolved": "https://registry.npmjs.org/@synopackageland/sdk/-/sdk-0.30.0.tgz",
1157
- "integrity": "sha512-dyUCtTcW4/XmhC8R2x1/RiifzT6K8AkjeIX1H2DkrvZsoWwGdeV6u/NgVYptN80WaqbkwcKbqOVa5Dq6ppwo7A==",
1155
+ "version": "0.31.0",
1156
+ "resolved": "https://registry.npmjs.org/@synopackageland/sdk/-/sdk-0.31.0.tgz",
1157
+ "integrity": "sha512-CWgXWp6UPqLbrAhF+vgpWdfvnzy8YYUIUaozA8+vzjzGHozQJo2pmzQMpiXXhA5UtTJarEAEeQ2of91/SGUXmw==",
1158
1158
  "license": "MIT",
1159
1159
  "peerDependencies": {
1160
1160
  "@lucide/vue": "^1.48.0",
package/templates/native-go-vue/frontend/package.json CHANGED
@@ -8,7 +8,7 @@
8
8
  },
9
9
  "dependencies": {
10
10
  "@lucide/vue": "1.48.0",
11
- "@synopackageland/sdk": "0.30.0",
11
+ "@synopackageland/sdk": "0.31.0",
12
12
  "@synopackageland/ui": "0.14.10",
13
13
  "vue": "3.5.43"
14
14
  },
package/templates/native-node/dsm-package.yaml CHANGED
@@ -49,7 +49,7 @@ backend:
49
49
  runtime: node
50
50
  dir: backend/app
51
51
  entry: main.js
52
- sdk: 0.30.0
52
+ sdk: 0.31.0
53
53
  node: { package: Node.js_v22 }
54
54
 
55
55
  ui:
package/templates/native-python/dsm-package.yaml CHANGED
@@ -47,7 +47,7 @@ backend:
47
47
  runtime: python
48
48
  dir: backend/app
49
49
  entry: main.py
50
- sdk: 0.30.0
50
+ sdk: 0.31.0
51
51
 
52
52
  ui:
53
53
  # Non-UI-SDK frontends open a full page; Portal is a separate opt-in.
package/templates/native-rust/backend/Cargo.lock CHANGED
@@ -104,8 +104,8 @@ dependencies = [
104
104
 
105
105
  [[package]]
106
106
  name = "syno-pkg-land-app"
107
- version = "0.30.0"
108
- source = "git+https://github.com/synopackageland/syno-pkg-land-sdk?tag=v0.30.0#30b08ee64ec8def3819c8c17765d778606c356f3"
107
+ version = "0.31.0"
108
+ source = "git+https://github.com/synopackageland/syno-pkg-land-sdk?tag=v0.31.0#1fcaf866a8f85e7b731f2aac2c8822300363ff15"
109
109
  dependencies = [
110
110
  "libc",
111
111
  "serde",
package/templates/native-rust/backend/Cargo.toml CHANGED
@@ -9,7 +9,7 @@ libc = "0.2"
9
9
  serde = { version = "1", features = ["derive"] }
10
10
  serde_json = "1"
11
11
  # The SDK version is the tag; `synopkgland check` reads it from Cargo.lock.
12
- syno-pkg-land-app = { git = "https://github.com/synopackageland/syno-pkg-land-sdk", tag = "v0.30.0" }
12
+ syno-pkg-land-app = { git = "https://github.com/synopackageland/syno-pkg-land-sdk", tag = "v0.31.0" }
13
13
 
14
14
  [profile.release]
15
15
  # A handler panic becomes an "internal" reply; abort would end the App without one.