@synopackageland/templates 0.40.3 → 0.41.0

package/CHANGELOG.md

@@ -1,5 +1,18 @@
 # Changelog
 
+## 0.41.0
+
+- Require CLI `~0.49.0` in every generated project through the shared test scaffold
+- Pin SDK/App 0.51.0 across Go, Python, Node.js, Rust and Compose templates, with the frontend SDK on `~0.51.0` and regenerated dependency locks
+- Pin UI 0.20.5 to satisfy the frontend SDK peer dependency and retain reproducible Vue builds
+
+## 0.40.4
+
+- Ignore private environment variants, key and certificate files, and npm credentials in every scaffold while keeping `.env.example` trackable
+- Include placeholder-only environment examples for the optional AI tests
+- Document secret storage under `synology/` for upstream forks without changing upstream ignore files
+- Verify Git ignore behavior for every template and UI variant, including upstream forks, using the packed templates and actual CLI
+
 ## 0.40.3
 
 - Use CLI architecture names in local package tests and SDK constants in background-limit assertions

package/README.md

@@ -354,6 +354,32 @@ configuration and DSM service definition, and upgrades retain the selection.
 Changing ports uses reinstall. Declare `{port: gateway_https}` runtime bindings
 when an upstream application needs its public port in its own configuration.
 
+## Secret files
+
+Every scaffold ignores `.env`, `.env.*`, `*.pem`, `*.key`, `*.p12` and `.npmrc`
+at any depth within its project. `.env.example` remains trackable and contains
+only placeholders for the optional AI tests; those commands load `.env` from
+their working directory. Copy the example only when configuring those tests.
+Keep real credentials out of examples and commits.
+
+Templates ship ignore files as `gitignore` because npm excludes `.gitignore`;
+`synopkgland init` restores the `.gitignore` name in the generated project.
+The scaffold tests use the actual packed templates to verify that behavior.
+
+### Upstream fork secret storage
+
+For `init --upstream-fork`, all wrapper-owned files belong in `synology/`.
+Store secrets in **`synology/.env`, never the fork root**, and run the optional
+tests from `synology/`. Copy `synology/.env.example` only when configuring the
+optional AI tests. Keep keys, certificates and private npm configuration under
+`synology/` as well.
+
+The upstream root `.gitignore` is not ours to edit and may not ignore a root
+`.env`. The generated `synology/.gitignore` protects secrets inside `synology/`;
+it cannot protect files in the parent directory. Preserve upstream ignore files
+and history. Use the CLI's `synopkgland skill show upstream-fork` for the rest of
+the fork workflow.
+
 ## App-open smoke
 
 Every generated project includes `tests/e2e/smoke.e2e.ts`, `e2e.config.ts` and

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@synopackageland/templates",
-  "version": "0.40.3",
+  "version": "0.41.0",
   "description": "Project templates for synopkgland init: native-go, native-python, native-node and native-rust (plain or Vue, with jobs, delegate and root-ops overlays), binary and compose.",
   "license": "MIT",
   "repository": {

package/templates/_shared/package.json

@@ -11,7 +11,7 @@
     "e2e:ai": "node --env-file-if-exists=.env node_modules/@synopackageland/cli/dist/e2e/dsm.js tunnel -- e2e run --config e2e.ai.config.ts tests/e2e/action.ai.e2e.ts"
   },
   "devDependencies": {
-    "@synopackageland/cli": "~0.48.20",
+    "@synopackageland/cli": "~0.49.0",
     "@e2e-dev/web": "^0.14.0",
     "e2e": "^0.19.0"
   }

package/templates/binary/.env.example

@@ -0,0 +1,5 @@
+# Optional AI tests only: replace these placeholders in your private .env.
+# For an upstream fork, use synology/.env, never the fork root.
+E2E_LLM_BASE_URL=https://api.example.com/v1
+E2E_LLM_MODEL=replace-with-model
+E2E_LLM_API_KEY=replace-with-api-key

package/templates/binary/README.md

@@ -2,6 +2,8 @@
 
 ## Local tests
 
+Copy `.env.example` to the ignored `.env` only for optional AI tests; keep real credentials out of examples and commits.
+
 From the project root, install the test tools before running the optional tests:
 
 ```sh

package/templates/binary/gitignore

@@ -4,3 +4,9 @@ dist/
 # Private NAS smoke sessions and credentials
 .e2e/
 .env
+.env.*
+!.env.example
+*.pem
+*.key
+*.p12
+.npmrc

package/templates/compose/.env.example

@@ -0,0 +1,5 @@
+# Optional AI tests only: replace these placeholders in your private .env.
+# For an upstream fork, use synology/.env, never the fork root.
+E2E_LLM_BASE_URL=https://api.example.com/v1
+E2E_LLM_MODEL=replace-with-model
+E2E_LLM_API_KEY=replace-with-api-key

package/templates/compose/README.md

@@ -2,6 +2,8 @@
 
 ## Local tests
 
+Copy `.env.example` to the ignored `.env` only for optional AI tests; keep real credentials out of examples and commits.
+
 From the project root, install the test tools before running the optional tests:
 
 ```sh
@@ -14,3 +16,12 @@ After committing the generated root lockfile, use `npm ci --include=dev`.
 Configure the upstream image and its real readiness endpoint before
 `test:local`; see `AGENTS.md` for the Compose packaging workflow.
 
+## Secrets in an upstream fork
+
+With `--upstream-fork`, store secrets in `synology/.env`, never in the fork root.
+Run the optional tests from `synology/`; its `.gitignore` protects `.env`,
+`.env.*`, `*.pem`, `*.key`, `*.p12` and `.npmrc`, while `.env.example` remains
+trackable with placeholders only. The upstream root `.gitignore` is not ours
+to edit and may not ignore a root `.env`.
+See the [fork guide](https://github.com/synopackageland/syno-pkg-land-templates#upstream-fork-secret-storage).
+

package/templates/compose/dsm-package.yaml

@@ -23,7 +23,7 @@ compose:
   web: {service: web, port: 8080, health: {path: /, status: 200}}
   network: {egress: isolated}
 identity_gateway:
-  sdk: 0.50.0
+  sdk: 0.51.0
   mode: none
   listen: {http: 28000}
 # Web Apps default to new-page through the shared app-launch resolver.

package/templates/compose/gitignore

@@ -1,5 +1,11 @@
 node_modules/
 .e2e/
 .env
+.env.*
+!.env.example
+*.pem
+*.key
+*.p12
+.npmrc
 dist/
 *.spk

package/templates/native-go/.env.example

@@ -0,0 +1,5 @@
+# Optional AI tests only: replace these placeholders in your private .env.
+# For an upstream fork, use synology/.env, never the fork root.
+E2E_LLM_BASE_URL=https://api.example.com/v1
+E2E_LLM_MODEL=replace-with-model
+E2E_LLM_API_KEY=replace-with-api-key

package/templates/native-go/README.md

@@ -31,6 +31,8 @@ nonblocking job. See the SDK's [request deadline contract](https://github.com/sy
 
 ## Local tests
 
+Copy `.env.example` to the ignored `.env` only for optional AI tests; keep real credentials out of examples and commits.
+
 From the project root, install the test tools before running the optional tests:
 
 ```sh
@@ -44,6 +46,15 @@ Before `npm run test:local`, prepare the backend and, for Vue, build the
 frontend using the steps below and the backend section in `AGENTS.md`, then
 run `synopkgland ctl generate`.
 
+## Secrets in an upstream fork
+
+With `--upstream-fork`, store secrets in `synology/.env`, never in the fork root.
+Run the optional tests from `synology/`; its `.gitignore` protects `.env`,
+`.env.*`, `*.pem`, `*.key`, `*.p12` and `.npmrc`, while `.env.example` remains
+trackable with placeholders only. The upstream root `.gitignore` is not ours
+to edit and may not ignore a root `.env`.
+See the [fork guide](https://github.com/synopackageland/syno-pkg-land-templates#upstream-fork-secret-storage).
+
 ## Quick start
 
 Needs Node.js with `synopkgland` installed, and Go 1.26.10.

package/templates/native-go/backend/THIRD_PARTY_NOTICES.txt

@@ -1,6 +1,6 @@
 Native Go package build dependencies
 
-github.com/synopackageland/syno-pkg-land-sdk v0.50.0 (MIT)
+github.com/synopackageland/syno-pkg-land-sdk v0.51.0 (MIT)
 
 Copyright (c) 2026 synopkgland
 

package/templates/native-go/backend/go.mod

@@ -2,6 +2,6 @@ module __PACKAGE__
 
 go 1.26.10
 
-require github.com/synopackageland/syno-pkg-land-sdk v0.50.0
+require github.com/synopackageland/syno-pkg-land-sdk v0.51.0
 
 require golang.org/x/sys v0.44.0 // indirect

package/templates/native-go/backend/go.sum

@@ -1,4 +1,4 @@
-github.com/synopackageland/syno-pkg-land-sdk v0.50.0 h1:eaehFfsLqa18qFe0S3xjF/eaS3qg5ZSCycZdnGAvt7c=
-github.com/synopackageland/syno-pkg-land-sdk v0.50.0/go.mod h1:A4ZvKEQnCMk5offv/57Zsf1Z/pV1RmylS9cMfDqdBMQ=
+github.com/synopackageland/syno-pkg-land-sdk v0.51.0 h1:DkFlrW3gsvUze8oqHtDJ+I4yrIdbFUyImqCcF4zWT0I=
+github.com/synopackageland/syno-pkg-land-sdk v0.51.0/go.mod h1:A4ZvKEQnCMk5offv/57Zsf1Z/pV1RmylS9cMfDqdBMQ=
 golang.org/x/sys v0.44.0 h1:ildZl3J4uzeKP07r2F++Op7E9B29JRUy+a27EibtBTQ=
 golang.org/x/sys v0.44.0/go.mod h1:4GL1E5IUh+htKOUEOaiffhrAeqysfVGipDYzABqnCmw=

package/templates/native-go/gitignore

@@ -3,3 +3,9 @@ dist/
 # Private NAS smoke sessions and credentials
 .e2e/
 .env
+.env.*
+!.env.example
+*.pem
+*.key
+*.p12
+.npmrc

package/templates/native-go-delegate/frontend/test/capability-panels.test.ts

@@ -42,10 +42,13 @@ test('the default surface binds the real routes and the session-only picker',asy
   expect(url).toBe('/webapi/entry.cgi')
   const body=init?.body as URLSearchParams
   expect(body.get('api')).toBe('SYNO.FileStation.List')
-  expect(body.get('method')).toBe('list_share')
-  expect(body.get('SynoToken')).toBe('fixture-token')
+  expect(['list_share','list']).toContain(body.get('method'))
+  expect(body.has('SynoToken')).toBe(false)
+  expect(new Headers(init?.headers).get('X-SYNO-TOKEN')).toBe('fixture-token')
   expect(init?.credentials).toBe('same-origin')
-  return new Response(JSON.stringify({success:true,data:{shares:[{name:'home',path:'/home',isdir:true}],offset:0,total:1}}))
+  if(body.get('method')==='list_share')return new Response(JSON.stringify({success:true,data:{shares:[{name:'home',path:'/home',isdir:true}],offset:0,total:1}}))
+  expect(body.get('folder_path')).toBe('/home')
+  return new Response(JSON.stringify({success:true,data:{files:[],offset:0,total:0}}))
  })
  vi.stubGlobal('fetch',fetch);cleanup.push(()=>vi.unstubAllGlobals())
  const call=vi.fn(async(method:string,params?:unknown)=>{
@@ -61,10 +64,12 @@ test('the default surface binds the real routes and the session-only picker',asy
  const root=render({call,locale:'en',files:{token:()=> 'fixture-token'}});await settle()
  button(root,'Choose folder').click();await settle()
  // The SDK picker selects a folder with a row click.
- const row=root.querySelector<HTMLElement>('tr[data-row-key="/home"]')!;expect(row).toBeTruthy();row.dispatchEvent(new MouseEvent('click',{bubbles:true}));await settle()
+ await vi.waitFor(()=>expect(root.querySelector('[data-row-key="/home"]')).toBeTruthy())
+ const row=root.querySelector<HTMLElement>('[data-row-key="/home"]')!;row.dispatchEvent(new MouseEvent('click',{bubbles:true}));await settle()
  button(root,'Confirm selection').click();await settle()
  expect(call).toHaveBeenCalledWith('delegate.select_destination',{key:'save',path:'/home'})
- expect(fetch).toHaveBeenCalledTimes(1)
+ // Selecting a folder prefetches its children through the same session-only provider.
+ await vi.waitFor(()=>expect(fetch).toHaveBeenCalledTimes(2))
  expect(call).not.toHaveBeenCalledWith('bg.browse',expect.anything())
  // The SDK hides the sample save unless an App opts in; the template opts in with sample-save.
  button(root,'Save example file').click();await settle()

package/templates/native-go-vue/README.md

@@ -9,6 +9,8 @@ files, portal, jobs and delegate components come from `@synopackageland/sdk/vue`
 
 ## Local tests
 
+Copy `.env.example` to the ignored `.env` only for optional AI tests; keep real credentials out of examples and commits.
+
 From the project root, install the test tools before running the optional tests:
 
 ```sh
@@ -22,6 +24,17 @@ Before `npm run test:local`, prepare the backend and, for Vue, build the
 frontend using the steps below and the backend section in `AGENTS.md`, then
 run `synopkgland ctl generate`.
 
+## Secrets in an upstream fork
+
+With `--upstream-fork`, store secrets in `synology/.env`, never in the fork root.
+Run the optional tests from `synology/`; its `.gitignore` protects `.env`,
+`.env.*`, `*.pem`, `*.key`, `*.p12` and `.npmrc`, while `.env.example` remains
+trackable with placeholders only. The upstream root `.gitignore` is not ours
+to edit and may not ignore a root `.env`.
+See the [fork guide](https://github.com/synopackageland/syno-pkg-land-templates#upstream-fork-secret-storage).
+
+## Frontend
+
 ```sh
 cd frontend
 npm ci --include=dev

package/templates/native-go-vue/frontend/package-lock.json

@@ -7,8 +7,8 @@
       "name": "native-dsm-vue-app",
       "dependencies": {
         "@lucide/vue": "1.48.0",
-        "@synopackageland/sdk": "0.50.0",
-        "@synopackageland/ui": "0.20.0",
+        "@synopackageland/sdk": "~0.51.0",
+        "@synopackageland/ui": "0.20.5",
         "vue": "3.5.43"
       },
       "devDependencies": {
@@ -1168,22 +1168,19 @@
       "license": "MIT"
     },
     "node_modules/@swc/helpers": {
-      "version": "0.5.23",
-      "resolved": "https://registry.npmjs.org/@swc/helpers/-/helpers-0.5.23.tgz",
-      "integrity": "sha512-5lSsMOTXURePglDfvuAQUqkGek9Hg2kksOYay2m0+XR++b2NWYL/4sWyuvVBIs8oKnJaxkdi9whaL/sqN13afw==",
-      "license": "Apache-2.0",
-      "dependencies": {
-        "tslib": "^2.8.0"
-      }
+      "version": "0.5.24",
+      "resolved": "https://registry.npmjs.org/@swc/helpers/-/helpers-0.5.24.tgz",
+      "integrity": "sha512-6tcXo4kA8HgGO7AVmawB57RYi/piBPYVHVcO6dXjX+SZw8GoHmi262sp4v2Ha2kNP9Cx84qei27yT+fjS1lxgg==",
+      "license": "Apache-2.0"
     },
     "node_modules/@synopackageland/sdk": {
-      "version": "0.50.0",
-      "resolved": "https://registry.npmjs.org/@synopackageland/sdk/-/sdk-0.50.0.tgz",
-      "integrity": "sha512-9cc/aBNicwE/2Ospx1a/akBGU2B8B2cQg6i06LbpZe8rdDBuPdLmAZh5WIlREsUruetq0mfmlVoeQ8l/lrdZ3g==",
+      "version": "0.51.0",
+      "resolved": "https://registry.npmjs.org/@synopackageland/sdk/-/sdk-0.51.0.tgz",
+      "integrity": "sha512-Ijv4n5B2YlDde4P2c3AZj0YPiO08ft+kUiNYIGfQiv3nbyniljX0k6nllG7oi85jD2gPrWQM+HIw7BVpU70WWg==",
       "license": "MIT",
       "peerDependencies": {
         "@lucide/vue": "^1.48.0",
-        "@synopackageland/ui": ">=0.10.1 <0.21.0",
+        "@synopackageland/ui": ">=0.20.5 <0.21.0",
         "vue": "^3.5.0"
       },
       "peerDependenciesMeta": {
@@ -1196,9 +1193,9 @@
       }
     },
     "node_modules/@synopackageland/ui": {
-      "version": "0.20.0",
-      "resolved": "https://registry.npmjs.org/@synopackageland/ui/-/ui-0.20.0.tgz",
-      "integrity": "sha512-YoeMoI2s1jw+1fdyVjc2L9GzwaDCiCrj+zMQDOBiCCjPdPiOElENAbBm1vo/XKViVNhPoH4p3gXQEQxf4RRUXA==",
+      "version": "0.20.5",
+      "resolved": "https://registry.npmjs.org/@synopackageland/ui/-/ui-0.20.5.tgz",
+      "integrity": "sha512-lyn3W+VvPu5BuZN1CMPZP3R7B1phUcqRzhmSmSJ8rubptPk1/wbfa91cLdYtRC9qKBBSnXlf6c9ibjkskf5qLQ==",
       "license": "MIT",
       "dependencies": {
         "@floating-ui/dom": "1.8.0",
@@ -2440,9 +2437,9 @@
       }
     },
     "node_modules/prosemirror-changeset": {
-      "version": "2.4.5",
-      "resolved": "https://registry.npmjs.org/prosemirror-changeset/-/prosemirror-changeset-2.4.5.tgz",
-      "integrity": "sha512-hv3Qhsn5GyoferiBqL8euGvj3Y8Z+2Ef75NnPLChr5DTWArpPAjK6F96Yc0iM7SBYNDPQbQaA+xEtAR8NuWo9A==",
+      "version": "2.4.6",
+      "resolved": "https://registry.npmjs.org/prosemirror-changeset/-/prosemirror-changeset-2.4.6.tgz",
+      "integrity": "sha512-P0cY3DSLm4M2boUOCmHDyaID5o6HgWmb21Bvs9p8lLqfJjKBBEHG5Ma5qW5SCmwOYamtWOLf2k+yvt6077zlTg==",
       "license": "MIT",
       "dependencies": {
         "prosemirror-transform": "^1.0.0"
@@ -2559,9 +2556,9 @@
       }
     },
     "node_modules/prosemirror-transform": {
-      "version": "1.12.4",
-      "resolved": "https://registry.npmjs.org/prosemirror-transform/-/prosemirror-transform-1.12.4.tgz",
-      "integrity": "sha512-2/WuPum3pn+O/Vi2vzpi8210ICUe2kIPXdLYjQ09Pv5DtT5bcKWMJhAKPBwvpPjpp5iOYUVwVEr0gOM1BY1Mgw==",
+      "version": "1.12.5",
+      "resolved": "https://registry.npmjs.org/prosemirror-transform/-/prosemirror-transform-1.12.5.tgz",
+      "integrity": "sha512-3EBXZBM4h3MKuWvs9sQ7IA0/v6jCqCZ4wC08PIvzY1VSQWDL90KEyfg5C0Ex52UJesf/QVogxvuBsZdKmLc3NQ==",
       "license": "MIT",
       "dependencies": {
         "prosemirror-model": "^1.21.0"
@@ -2783,12 +2780,6 @@
         "node": "^22.14.0 || >=24.0.0"
       }
     },
-    "node_modules/tslib": {
-      "version": "2.8.1",
-      "resolved": "https://registry.npmjs.org/tslib/-/tslib-2.8.1.tgz",
-      "integrity": "sha512-oJFu94HQb+KVduSUQL7wnpmqnfmLsOA/nAh6b6EH0wCEoK0/mPeXU6c3wKDV83MkOuHPRHtSXKKU99IBazS/2w==",
-      "license": "0BSD"
-    },
     "node_modules/typescript": {
       "version": "5.9.3",
       "resolved": "https://registry.npmjs.org/typescript/-/typescript-5.9.3.tgz",

package/templates/native-go-vue/frontend/package.json

@@ -8,8 +8,8 @@
   },
   "dependencies": {
     "@lucide/vue": "1.48.0",
-    "@synopackageland/sdk": "0.50.0",
-    "@synopackageland/ui": "0.20.0",
+    "@synopackageland/sdk": "~0.51.0",
+    "@synopackageland/ui": "0.20.5",
     "vue": "3.5.43"
   },
   "devDependencies": {

package/templates/native-go-vue/gitignore

@@ -4,3 +4,9 @@ node_modules/
 # Private NAS smoke sessions and credentials
 .e2e/
 .env
+.env.*
+!.env.example
+*.pem
+*.key
+*.p12
+.npmrc

package/templates/native-node/.env.example

@@ -0,0 +1,5 @@
+# Optional AI tests only: replace these placeholders in your private .env.
+# For an upstream fork, use synology/.env, never the fork root.
+E2E_LLM_BASE_URL=https://api.example.com/v1
+E2E_LLM_MODEL=replace-with-model
+E2E_LLM_API_KEY=replace-with-api-key

package/templates/native-node/README.md

@@ -31,6 +31,8 @@ nonblocking job. See the SDK's [request deadline contract](https://github.com/sy
 
 ## Local tests
 
+Copy `.env.example` to the ignored `.env` only for optional AI tests; keep real credentials out of examples and commits.
+
 From the project root, install the test tools before running the optional tests:
 
 ```sh

package/templates/native-node/backend/package-lock.json

@@ -49,7 +49,7 @@
       "license": "MIT"
     },
     "vendor/@synopackageland/app": {
-      "version": "0.50.0",
+      "version": "0.51.0",
       "license": "MIT",
       "engines": {
         "node": ">=22"

package/templates/native-node/dsm-package.yaml

@@ -49,7 +49,7 @@ backend:
   runtime: node
   dir: backend/app
   entry: main.js
-  sdk: 0.50.0
+  sdk: 0.51.0
   node: { package: Node.js_v22 }
 
 ui:

package/templates/native-node/gitignore

@@ -6,3 +6,9 @@ backend/app/*.js
 # Private NAS smoke sessions and credentials
 .e2e/
 .env
+.env.*
+!.env.example
+*.pem
+*.key
+*.p12
+.npmrc

package/templates/native-node-vue/README.md

@@ -9,6 +9,8 @@ delegate components come from `@synopackageland/sdk/vue` (types from
 
 ## Local tests
 
+Copy `.env.example` to the ignored `.env` only for optional AI tests; keep real credentials out of examples and commits.
+
 From the project root, install the test tools before running the optional tests:
 
 ```sh

package/templates/native-node-vue/gitignore

@@ -6,3 +6,9 @@ backend/app/*.js
 # Private NAS smoke sessions and credentials
 .e2e/
 .env
+.env.*
+!.env.example
+*.pem
+*.key
+*.p12
+.npmrc

package/templates/native-python/.env.example

@@ -0,0 +1,5 @@
+# Optional AI tests only: replace these placeholders in your private .env.
+# For an upstream fork, use synology/.env, never the fork root.
+E2E_LLM_BASE_URL=https://api.example.com/v1
+E2E_LLM_MODEL=replace-with-model
+E2E_LLM_API_KEY=replace-with-api-key

package/templates/native-python/README.md

@@ -31,6 +31,8 @@ nonblocking job. See the SDK's [request deadline contract](https://github.com/sy
 
 ## Local tests
 
+Copy `.env.example` to the ignored `.env` only for optional AI tests; keep real credentials out of examples and commits.
+
 From the project root, install the test tools before running the optional tests:
 
 ```sh

package/templates/native-python/dsm-package.yaml

@@ -47,7 +47,7 @@ backend:
   runtime: python
   dir: backend/app
   entry: main.py
-  sdk: 0.50.0
+  sdk: 0.51.0
 
 ui:
   # Non-UI-SDK frontends open a full page; Portal is a separate opt-in.

package/templates/native-python/gitignore

@@ -4,3 +4,9 @@ __pycache__/
 # Private NAS smoke sessions and credentials
 .e2e/
 .env
+.env.*
+!.env.example
+*.pem
+*.key
+*.p12
+.npmrc

package/templates/native-python-vue/README.md

@@ -9,6 +9,8 @@ delegate components come from `@synopackageland/sdk/vue` (types from
 
 ## Local tests
 
+Copy `.env.example` to the ignored `.env` only for optional AI tests; keep real credentials out of examples and commits.
+
 From the project root, install the test tools before running the optional tests:
 
 ```sh

package/templates/native-python-vue/gitignore

@@ -5,3 +5,9 @@ node_modules/
 # Private NAS smoke sessions and credentials
 .e2e/
 .env
+.env.*
+!.env.example
+*.pem
+*.key
+*.p12
+.npmrc

package/templates/native-rust/.env.example

@@ -0,0 +1,5 @@
+# Optional AI tests only: replace these placeholders in your private .env.
+# For an upstream fork, use synology/.env, never the fork root.
+E2E_LLM_BASE_URL=https://api.example.com/v1
+E2E_LLM_MODEL=replace-with-model
+E2E_LLM_API_KEY=replace-with-api-key

package/templates/native-rust/README.md

@@ -31,6 +31,8 @@ nonblocking job. See the SDK's [request deadline contract](https://github.com/sy
 
 ## Local tests
 
+Copy `.env.example` to the ignored `.env` only for optional AI tests; keep real credentials out of examples and commits.
+
 From the project root, install the test tools before running the optional tests:
 
 ```sh

package/templates/native-rust/backend/Cargo.lock

@@ -104,8 +104,8 @@ dependencies = [
 
 [[package]]
 name = "syno-pkg-land-app"
-version = "0.50.0"
-source = "git+https://github.com/synopackageland/syno-pkg-land-sdk?tag=v0.50.0#b1adac9407cf1338fa79741ebfcbdaa5c1698b6f"
+version = "0.51.0"
+source = "git+https://github.com/synopackageland/syno-pkg-land-sdk?tag=v0.51.0#fffdbb3781fe7f8c57294cdf082b1bf347c0957d"
 dependencies = [
  "libc",
  "serde",

package/templates/native-rust/backend/Cargo.toml

@@ -9,7 +9,7 @@ libc = "0.2"
 serde = { version = "1", features = ["derive"] }
 serde_json = "1"
 # The SDK version is the tag; `synopkgland check` reads it from Cargo.lock.
-syno-pkg-land-app = { git = "https://github.com/synopackageland/syno-pkg-land-sdk", tag = "v0.50.0" }
+syno-pkg-land-app = { git = "https://github.com/synopackageland/syno-pkg-land-sdk", tag = "v0.51.0" }
 
 [profile.release]
 # A handler panic becomes an "internal" reply; abort would end the App without one.

package/templates/native-rust/gitignore

@@ -4,3 +4,9 @@ backend/target/
 # Private NAS smoke sessions and credentials
 .e2e/
 .env
+.env.*
+!.env.example
+*.pem
+*.key
+*.p12
+.npmrc

package/templates/native-rust-delegate/backend/Cargo.lock

@@ -170,8 +170,8 @@ dependencies = [
 
 [[package]]
 name = "syno-pkg-land-app"
-version = "0.50.0"
-source = "git+https://github.com/synopackageland/syno-pkg-land-sdk?tag=v0.50.0#b1adac9407cf1338fa79741ebfcbdaa5c1698b6f"
+version = "0.51.0"
+source = "git+https://github.com/synopackageland/syno-pkg-land-sdk?tag=v0.51.0#fffdbb3781fe7f8c57294cdf082b1bf347c0957d"
 dependencies = [
  "libc",
  "serde",

package/templates/native-rust-delegate/backend/Cargo.toml

@@ -10,7 +10,7 @@ libc = "0.2"
 serde = { version = "1", features = ["derive"] }
 serde_json = "1"
 # The SDK version is the tag; `synopkgland check` reads it from Cargo.lock.
-syno-pkg-land-app = { git = "https://github.com/synopackageland/syno-pkg-land-sdk", tag = "v0.50.0" }
+syno-pkg-land-app = { git = "https://github.com/synopackageland/syno-pkg-land-sdk", tag = "v0.51.0" }
 
 [profile.release]
 # A handler panic becomes an "internal" reply; abort would end the App without one.

package/templates/native-rust-vue/README.md

@@ -9,6 +9,8 @@ delegate components come from `@synopackageland/sdk/vue` (types from
 
 ## Local tests
 
+Copy `.env.example` to the ignored `.env` only for optional AI tests; keep real credentials out of examples and commits.
+
 From the project root, install the test tools before running the optional tests:
 
 ```sh

package/templates/native-rust-vue/gitignore

@@ -5,3 +5,9 @@ backend/target/
 # Private NAS smoke sessions and credentials
 .e2e/
 .env
+.env.*
+!.env.example
+*.pem
+*.key
+*.p12
+.npmrc