@synopackageland/templates 0.35.2 → 0.35.3

package/README.md

@@ -22,7 +22,7 @@ daemon:
     window_seconds: 300
 ```
 
-Templates 0.35.2 pin UI 0.16.1 and SDK 0.38.1 in native and Compose projects.
+Templates 0.35.3 pin UI 0.16.1 and SDK 0.38.2 in native and Compose projects.
 Use CLI 0.41.2. The Vue `AppShell` shows a
 non-blocking **Reload** notice when an upgrade replaced the UI an open page
 loaded. Go Apps select
@@ -81,18 +81,18 @@ calls each one from the generated script of the same name (`synopkgland skill sh
 The placeholders `__PACKAGE__` (also the Go module path), `__DISPLAY_NAME__` and
 `__BACKGROUND_ENABLED__` are substituted by `init`.
 
-`backend/go.mod` requires `github.com/synopackageland/syno-pkg-land-sdk v0.38.1`; that line is
+`backend/go.mod` requires `github.com/synopackageland/syno-pkg-land-sdk v0.38.2`; that line is
 the single source of the SDK version and `frontend/package.json` pins
 `@synopackageland/sdk` to the same version. Python and Node.js name it in
 `backend.sdk`, Rust in the `syno-pkg-land-app` tag of `backend/Cargo.toml`
-(and `Cargo.lock`); all of them pin 0.38.1. The Vue frontend pins
-`@synopackageland/ui` 0.16.1. SDK 0.38.1 accepts UI `>=0.10.1 <0.18.0`,
+(and `Cargo.lock`); all of them pin 0.38.2. The Vue frontend pins
+`@synopackageland/ui` 0.16.1. SDK 0.38.2 accepts UI `>=0.10.1 <0.18.0`,
 so no UI peer override is needed. Tests use jsdom 30 for UI floating-layer styles.
 
 Interactive NAS file operations use same-origin browser calls.
 Custom file handlers use the SDK's
-[session transport migration](https://github.com/synopackageland/syno-pkg-land-sdk/blob/v0.38.1/docs/dsm-session-transport.md).
-CLI 0.41.2 reads SDK 0.38.1's release manifest, which names immutable
+[session transport migration](https://github.com/synopackageland/syno-pkg-land-sdk/blob/v0.38.2/docs/dsm-session-transport.md).
+CLI 0.41.2 reads SDK 0.38.2's release manifest, which names immutable
 executor/v0.32.0 and its executor digests. Its `~0.35.2` templates
 dependency selects this release.
 
@@ -108,7 +108,7 @@ Keep punctuation between sentences and intentional loading ellipses.
 
 ## Request deadlines and background work
 
-SDK/App 0.38.1 defaults to 300 seconds for cooperative requests and 302 seconds
+SDK/App 0.38.2 defaults to 300 seconds for cooperative requests and 302 seconds
 for the TS client and generated DSM window. The CLI reads the selected SDK's
 timeout spec; `backend.timeout_seconds` explicitly overrides it for native
 backends, and an earlier parent deadline still wins. Go assembly should fall
@@ -140,7 +140,7 @@ caps, approved root policy/program budgets and credential lifetimes retain
 their existing limits; long root work uses `root.start` / `root.jobs.*`.
 The independent ctl transport keeps its 62-second default: use an explicit
 `--timeout` for long synchronous calls, or an existing nonblocking job flow.
-See the SDK's [request deadline contract](https://github.com/synopackageland/syno-pkg-land-sdk/blob/v0.38.1/docs/request-deadlines.md).
+See the SDK's [request deadline contract](https://github.com/synopackageland/syno-pkg-land-sdk/blob/v0.38.2/docs/request-deadlines.md).
 
 ## Hyper Backup
 
@@ -299,4 +299,17 @@ The bridge examples expose submission, lookup and cancellation through
 
 ## External access
 
-With CLI 0.40.0 and SDK 0.38.1, a gateway App may declare `identity_gateway.external_access: {connect: optional, origin_change: confirm, single_origin: true}` for an upstream that signs in on one fixed URL. The policy is forwarded to the packaged gateway. A single-origin App's `manual_origin` accepts an explicit HTTPS port; the `external-origin` installation setting remains restricted to port 443. The DSM launcher selects a provider destination, probes `/_spl/ping` for up to eight seconds, and explains failures before offering **Open anyway**. A configured single-origin App always opens its primary external origin.
+With CLI 0.40.0 and SDK 0.38.2, a gateway App may declare `identity_gateway.external_access: {connect: optional, origin_change: confirm, single_origin: true}` for an upstream that signs in on one fixed URL. The policy is forwarded to the packaged gateway. A single-origin App's `manual_origin` accepts an explicit HTTPS port; the `external-origin` installation setting remains restricted to port 443. The DSM launcher selects a provider destination, probes `/_spl/ping` for up to eight seconds, and explains failures before offering **Open anyway**. A configured single-origin App always opens its primary external origin.
+
+
+Compose templates declare an app-named dedicated shared folder by default. DSM
+creates it and grants the package account the declared permission. The optional
+existing-folder field must pass the CLI's folder and access validation. Native
+Apps that need shared data use the same `install.sharedFolder` declaration with
+`mode: dedicated`, a package-specific `name`, `key` and `permission`.
+
+The Compose gateway also enables `install.ports: true`: its manifest listener
+ports prefill the DSM wizard, selected values flow through the SDK-generated
+configuration and DSM service definition, and upgrades retain the selection.
+Changing ports uses reinstall. Declare `{port: gateway_https}` runtime bindings
+when an upstream application needs its public port in its own configuration.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@synopackageland/templates",
-  "version": "0.35.2",
+  "version": "0.35.3",
   "description": "Project templates for synopkgland init: native-go, native-python, native-node and native-rust (plain or Vue, with jobs, delegate and root-ops overlays), binary and compose.",
   "license": "MIT",
   "repository": {

package/templates/compose/dsm-package.yaml

@@ -9,6 +9,13 @@ maintainer: Your Name
 os_min_ver: "7.2.1-69057"
 arches: [x86_64, aarch64]
 capabilities: {}
+install:
+  ports: true
+  sharedFolder:
+    mode: dedicated
+    key: data
+    name: __PACKAGE__
+    permission: rw
 # Hyper Backup application backup is off for Compose Apps: their data lives
 # in container volumes, which it does not cover.
 compose:
@@ -16,10 +23,11 @@ compose:
   web: {service: web, port: 8080, health: {path: /, status: 200}}
   network: {egress: isolated}
 identity_gateway:
-  sdk: 0.38.1
+  sdk: 0.38.2
   mode: none
   listen: {http: 28000}
 # Web Apps default to new-page through the shared app-launch resolver.
 # ui: {launch: new-page}
 # Containers use a fixed package UID, never the signed-in user's File Station ACL.
-# For existing Share access, opt in to composeMounts and confirm after install.
+# Bind shared data with compose.shares, select: install, key: data and the same permission.
+# The dedicated share is created by DSM; an optional existing share must pass wizard validation.

package/templates/native-go/README.md

@@ -17,7 +17,7 @@ DSM main menu → DSM window (ui/app.js)
 
 ## Requests and long work
 
-SDK/App 0.38.1 defaults to 300-second requests and a 302-second browser wait.
+SDK/App 0.38.2 defaults to 300-second requests and a 302-second browser wait.
 Explicit `backend.timeout_seconds` and earlier parent deadlines still apply;
 rebuild the App to use the new SDK. For long NAS work, enable the existing jobs
 capability: return admission and the original job ID promptly, execute in the
@@ -27,7 +27,7 @@ last queued/running state intact. After a lost admission reply, reuse the same
 idempotency key and input instead of replaying a mutation with a new key.
 Jobs default to 30 minutes; approved executor limits remain separate. ctl keeps
 its 62-second transport default; use an explicit `--timeout` or an existing
-nonblocking job. See the SDK's [request deadline contract](https://github.com/synopackageland/syno-pkg-land-sdk/blob/v0.38.1/docs/request-deadlines.md).
+nonblocking job. See the SDK's [request deadline contract](https://github.com/synopackageland/syno-pkg-land-sdk/blob/v0.38.2/docs/request-deadlines.md).
 
 ## Quick start
 
@@ -393,9 +393,10 @@ or deletes outside the package's own folders.
 
 ## Shared Folder access
 
-A `install.sharedFolder` in `dsm-package.yaml` lets the administrator pick a folder in the
-install wizard, but DSM does not give the package account access to a picked folder. The
-backend reports the real state: the `sharedfolder.status` operation (administrators only
+Use `install.sharedFolder: {mode: dedicated, key: media, name: __PACKAGE__, permission: rw}`
+for shared data. DSM creates the app-specific folder and grants the declared
+package-account permission. The wizard defaults to it and validates any existing
+folder choice before Next. The backend reports the real state: the `sharedfolder.status` operation (administrators only
 unless you change `permissions.json`) returns each folder with what the App needs, what the
 package account has (`none`, `read`, `write`) and a `state` (`ready`, `pending`, `missing`,
 `ambiguous`). `cfg.SharedFolderPath(key)` returns the path or an error that names the

package/templates/native-go/backend/THIRD_PARTY_NOTICES.txt

@@ -1,6 +1,6 @@
 Native Go package build dependencies
 
-github.com/synopackageland/syno-pkg-land-sdk v0.38.1 (MIT)
+github.com/synopackageland/syno-pkg-land-sdk v0.38.2 (MIT)
 
 Copyright (c) 2026 synopkgland
 

package/templates/native-go/backend/go.mod

@@ -4,6 +4,6 @@ go 1.25.0
 
 toolchain go1.26.10
 
-require github.com/synopackageland/syno-pkg-land-sdk v0.38.1
+require github.com/synopackageland/syno-pkg-land-sdk v0.38.2
 
 require golang.org/x/sys v0.44.0 // indirect

package/templates/native-go/backend/go.sum

@@ -1,4 +1,4 @@
-github.com/synopackageland/syno-pkg-land-sdk v0.38.1 h1:W1+QI88KAnGyPxVI4wK4Q67b63JEwF3KaFigWlsUbYA=
-github.com/synopackageland/syno-pkg-land-sdk v0.38.1/go.mod h1:8GwREGbczc8mAk4Gv8FUHaukXXCUstjzkovQrNV59Cc=
+github.com/synopackageland/syno-pkg-land-sdk v0.38.2 h1:UJh6tbUxhmcRdy8Y6qqJYHcxZtYkShE9UxtXjbN5vV8=
+github.com/synopackageland/syno-pkg-land-sdk v0.38.2/go.mod h1:8GwREGbczc8mAk4Gv8FUHaukXXCUstjzkovQrNV59Cc=
 golang.org/x/sys v0.44.0 h1:ildZl3J4uzeKP07r2F++Op7E9B29JRUy+a27EibtBTQ=
 golang.org/x/sys v0.44.0/go.mod h1:4GL1E5IUh+htKOUEOaiffhrAeqysfVGipDYzABqnCmw=

package/templates/native-go/backend/internal/app/background_test.go

@@ -113,7 +113,7 @@ func TestBackgroundStatusReportsLimitsAndWorker(t *testing.T) {
 		t.Fatalf("%s %v", code, out)
 	}
 	limits := d["limits"].(map[string]any)
-	if limits["maxInputBytes"].(float64) != 512*1024 || limits["maxQueued"].(float64) != 16 || limits["maxTotalBytes"].(float64) != 16<<20 || limits["jobTimeoutSeconds"].(float64) != 60 {
+	if limits["maxInputBytes"].(float64) != 512*1024 || limits["maxQueued"].(float64) != 16 || limits["maxTotalBytes"].(float64) != 16<<20 || limits["jobTimeoutSeconds"].(float64) != 30*60 {
 		t.Fatalf("limits: %v", limits)
 	}
 	info := background.WorkerInfo{PID: os.Getpid(), UID: os.Getuid(), Username: "pkg"}

package/templates/native-go-vue/frontend/package-lock.json

@@ -7,7 +7,7 @@
       "name": "native-dsm-vue-app",
       "dependencies": {
         "@lucide/vue": "1.48.0",
-        "@synopackageland/sdk": "0.38.1",
+        "@synopackageland/sdk": "0.38.2",
         "@synopackageland/ui": "0.16.1",
         "vue": "3.5.43"
       },
@@ -1152,9 +1152,9 @@
       }
     },
     "node_modules/@synopackageland/sdk": {
-      "version": "0.38.1",
-      "resolved": "https://registry.npmjs.org/@synopackageland/sdk/-/sdk-0.38.1.tgz",
-      "integrity": "sha512-Z/YxRFekMRwRU31pVudkHgHKgmJFCjRzJqHYkIq9FNCrprxQCFTbTgQTu3eqKXZ+gVJPHXlJccfk2B/ohMQnFA==",
+      "version": "0.38.2",
+      "resolved": "https://registry.npmjs.org/@synopackageland/sdk/-/sdk-0.38.2.tgz",
+      "integrity": "sha512-ZSZKn5T8TbOpUF+PYMgq0IU+czw9HG4O9C4JuCeaT8Xoa3gMNiHbv6N1+VdRfxm46GtbtFNHzdQBoZ3mbmvKKg==",
       "license": "MIT",
       "peerDependencies": {
         "@lucide/vue": "^1.48.0",

package/templates/native-go-vue/frontend/package.json

@@ -8,7 +8,7 @@
   },
   "dependencies": {
     "@lucide/vue": "1.48.0",
-    "@synopackageland/sdk": "0.38.1",
+    "@synopackageland/sdk": "0.38.2",
     "@synopackageland/ui": "0.16.1",
     "vue": "3.5.43"
   },

package/templates/native-node/README.md

@@ -17,7 +17,7 @@ DSM main menu → DSM window (ui/app.js)
 
 ## Requests and long work
 
-SDK/App 0.38.1 defaults to 300-second requests and a 302-second browser wait.
+SDK/App 0.38.2 defaults to 300-second requests and a 302-second browser wait.
 Explicit `backend.timeout_seconds` and earlier parent deadlines still apply;
 rebuild the App to use the new SDK. For long NAS work, enable the existing jobs
 capability: return admission and the original job ID promptly, execute in the
@@ -27,7 +27,7 @@ last queued/running state intact. After a lost admission reply, reuse the same
 idempotency key and input instead of replaying a mutation with a new key.
 Jobs default to 30 minutes; approved executor limits remain separate. ctl keeps
 its 62-second transport default; use an explicit `--timeout` or an existing
-nonblocking job. See the SDK's [request deadline contract](https://github.com/synopackageland/syno-pkg-land-sdk/blob/v0.38.1/docs/request-deadlines.md).
+nonblocking job. See the SDK's [request deadline contract](https://github.com/synopackageland/syno-pkg-land-sdk/blob/v0.38.2/docs/request-deadlines.md).
 
 ## Quick start
 

package/templates/native-node/dsm-package.yaml

@@ -49,7 +49,7 @@ backend:
   runtime: node
   dir: backend/app
   entry: main.js
-  sdk: 0.38.1
+  sdk: 0.38.2
   node: { package: Node.js_v22 }
 
 ui:

package/templates/native-python/README.md

@@ -17,7 +17,7 @@ DSM main menu → DSM window (ui/app.js)
 
 ## Requests and long work
 
-SDK/App 0.38.1 defaults to 300-second requests and a 302-second browser wait.
+SDK/App 0.38.2 defaults to 300-second requests and a 302-second browser wait.
 Explicit `backend.timeout_seconds` and earlier parent deadlines still apply;
 rebuild the App to use the new SDK. For long NAS work, enable the existing jobs
 capability: return admission and the original job ID promptly, execute in the
@@ -27,7 +27,7 @@ last queued/running state intact. After a lost admission reply, reuse the same
 idempotency key and input instead of replaying a mutation with a new key.
 Jobs default to 30 minutes; approved executor limits remain separate. ctl keeps
 its 62-second transport default; use an explicit `--timeout` or an existing
-nonblocking job. See the SDK's [request deadline contract](https://github.com/synopackageland/syno-pkg-land-sdk/blob/v0.38.1/docs/request-deadlines.md).
+nonblocking job. See the SDK's [request deadline contract](https://github.com/synopackageland/syno-pkg-land-sdk/blob/v0.38.2/docs/request-deadlines.md).
 
 ## Quick start
 

package/templates/native-python/dsm-package.yaml

@@ -47,7 +47,7 @@ backend:
   runtime: python
   dir: backend/app
   entry: main.py
-  sdk: 0.38.1
+  sdk: 0.38.2
 
 ui:
   # Non-UI-SDK frontends open a full page; Portal is a separate opt-in.

package/templates/native-rust/README.md

@@ -17,7 +17,7 @@ DSM main menu → DSM window (ui/app.js)
 
 ## Requests and long work
 
-SDK/App 0.38.1 defaults to 300-second requests and a 302-second browser wait.
+SDK/App 0.38.2 defaults to 300-second requests and a 302-second browser wait.
 Explicit `backend.timeout_seconds` and earlier parent deadlines still apply;
 rebuild the App to use the new SDK. For long NAS work, enable the existing jobs
 capability: return admission and the original job ID promptly, execute in the
@@ -27,7 +27,7 @@ last queued/running state intact. After a lost admission reply, reuse the same
 idempotency key and input instead of replaying a mutation with a new key.
 Jobs default to 30 minutes; approved executor limits remain separate. ctl keeps
 its 62-second transport default; use an explicit `--timeout` or an existing
-nonblocking job. See the SDK's [request deadline contract](https://github.com/synopackageland/syno-pkg-land-sdk/blob/v0.38.1/docs/request-deadlines.md).
+nonblocking job. See the SDK's [request deadline contract](https://github.com/synopackageland/syno-pkg-land-sdk/blob/v0.38.2/docs/request-deadlines.md).
 
 ## Quick start
 

package/templates/native-rust/backend/Cargo.lock

@@ -104,8 +104,8 @@ dependencies = [
 
 [[package]]
 name = "syno-pkg-land-app"
-version = "0.38.1"
-source = "git+https://github.com/synopackageland/syno-pkg-land-sdk?tag=v0.38.1#8919aef63aa22d37791190ca8db87525a23796ad"
+version = "0.38.2"
+source = "git+https://github.com/synopackageland/syno-pkg-land-sdk?tag=v0.38.2#103014ec9ec31e91062053d7678b4d2b115be71e"
 dependencies = [
  "libc",
  "serde",

package/templates/native-rust/backend/Cargo.toml

@@ -9,7 +9,7 @@ libc = "0.2"
 serde = { version = "1", features = ["derive"] }
 serde_json = "1"
 # The SDK version is the tag; `synopkgland check` reads it from Cargo.lock.
-syno-pkg-land-app = { git = "https://github.com/synopackageland/syno-pkg-land-sdk", tag = "v0.38.1" }
+syno-pkg-land-app = { git = "https://github.com/synopackageland/syno-pkg-land-sdk", tag = "v0.38.2" }
 
 [profile.release]
 # A handler panic becomes an "internal" reply; abort would end the App without one.