@synopackageland/templates 0.41.2 → 0.41.4

package/CHANGELOG.md

@@ -1,5 +1,18 @@
 # Changelog
 
+## 0.41.4
+
+- Align SDK/App references and locks across native and Compose templates with 0.53.9
+- Use frontend SDK ~0.53.9 and UI ~0.23.8, and require CLI ~0.52.6 in generated Apps
+- Document light-only DSM windows and HTTPS-only standalone login for Apps opened outside DSM windows
+- Keep login opt-in only when the product needs independent sign-in
+
+## 0.41.3
+
+- Align SDK/App references across Go, Python, Node.js, Rust and Compose templates with 0.53.2 and refresh dependency locks
+- Use frontend SDK ~0.53.2 and UI ~0.23.3 with a refreshed public npm lockfile
+- Require CLI ~0.52.3 in generated Apps and verify the shared scaffold dependency in layout checks
+
 ## 0.41.2
 
 - Align SDK/App references across native and Compose templates and refresh dependency locks

package/README.md

@@ -151,8 +151,14 @@ See the SDK's [request deadline contract](https://github.com/synopackageland/syn
 
 ## HTTPS and stale DSM tokens
 
-Many CRUD, settings and file Apps work over HTTP; templates do not force HTTPS.
-Require it only for secure context features (`getUserMedia`, clipboard, Service
+`init --with login` declares `identity: standalone`. It is HTTPS-only for both
+password sign-in and Continue with DSM because its session cookie is Secure.
+Use it only for Apps opened outside a DSM window (Portal or their own tab).
+Do not add `--with login` without a product reason for independent sign-in;
+DSM-window Apps use their existing DSM session.
+
+Many CRUD, settings and file Apps without standalone identity work over HTTP.
+For those Apps, require HTTPS only for secure context features (`getUserMedia`, clipboard, Service
 Worker, WebCrypto `subtle`), pairing or an explicit secure Origin policy. Return
 `https_required`, distinct from authentication errors, and show a dedicated
 HTTPS page using SDK `identityCopy(locale).httpsTitle` / `errors.https_required`.
@@ -187,6 +193,12 @@ their data lives in container volumes.
 
 ## Vue frontend modules
 
+DSM windows always use the embedded light theme. Do not bind `color-scheme` or
+`colorScheme` to `matchMedia('(prefers-color-scheme: dark)')` in a DSM window.
+Only the App's own full page (Portal or its own tab) may follow the system
+colour scheme, guarded by `ctx.fullPage`. The shared Vue shell leaves the
+SDK's light default in place.
+
 Vue scaffolds export `mount(root, ctx)` from `app.module.js` and emit `app.css`.
 Keep `base: './'`, relative imports and `cssCodeSplit: false`; allow lazy chunks
 with `() => import('./Page.vue')` or `defineAsyncComponent`. Each mount creates

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@synopackageland/templates",
-  "version": "0.41.2",
+  "version": "0.41.4",
   "description": "Project templates for synopkgland init: native-go, native-python, native-node and native-rust (plain or Vue, with jobs, delegate and root-ops overlays), binary and compose.",
   "license": "MIT",
   "repository": {

package/templates/_shared/AGENTS.md

@@ -313,7 +313,19 @@ sweep forward the cancel instead of admitting it.
 
 ## HTTPS and stale DSM tokens
 
-Do not force HTTPS for ordinary CRUD/settings/file Apps. Only secure context
+`init --with login` declares `identity: standalone`. It is HTTPS-only for both
+password sign-in and Continue with DSM because its session cookie is Secure.
+Use it only for Apps opened outside a DSM window (Portal or their own tab).
+Do not add `--with login` without a product reason for independent sign-in;
+DSM-window Apps use their existing DSM session.
+
+DSM windows always use the embedded light theme. Do not bind `color-scheme` or
+`colorScheme` to `matchMedia('(prefers-color-scheme: dark)')` in a DSM window.
+Only the App's own full page (Portal or its own tab) may follow the system
+colour scheme, guarded by `ctx.fullPage`. Leave the SDK's light default in
+place for DSM windows.
+
+Without standalone identity, do not force HTTPS for ordinary CRUD/settings/file Apps. Only secure context
 features, pairing or a strict secure Origin policy justify it. Return
 `https_required`, not a generic authentication error, and render the SDK's
 `identityCopy(locale).httpsTitle` / `errors.https_required` with reopening

package/templates/_shared/package.json

@@ -11,7 +11,7 @@
     "e2e:ai": "node --env-file-if-exists=.env node_modules/@synopackageland/cli/dist/e2e/dsm.js tunnel -- e2e run --config e2e.ai.config.ts tests/e2e/action.ai.e2e.ts"
   },
   "devDependencies": {
-    "@synopackageland/cli": "~0.49.0",
+    "@synopackageland/cli": "~0.52.6",
     "@e2e-dev/web": "^0.14.0",
     "e2e": "^0.19.0"
   }

package/templates/compose/dsm-package.yaml

@@ -23,7 +23,7 @@ compose:
   web: {service: web, port: 8080, health: {path: /, status: 200}}
   network: {egress: isolated}
 identity_gateway:
-  sdk: 0.53.1
+  sdk: 0.53.9
   mode: none
   listen: {http: 28000}
 # Web Apps default to new-page through the shared app-launch resolver.

package/templates/native-go/README.md

@@ -77,14 +77,15 @@ as and what the backend reports.
 `dsm-package.yaml` requires `schema: 2` and `backend: {kind: go, dir: backend}`.
 Declare `capabilities.files: session` for interactive File Station access,
 `capabilities.jobs: true` for persistent package-account jobs,
-`capabilities.identity: standalone` for independent DSM login, and
+`capabilities.identity: standalone` for HTTPS-only independent DSM login outside
+a DSM window, and
 `capabilities.rootOps: true` for administrator-approved fixed executor operations.
 `init --with files,jobs,root-ops` supports plain and Vue UI; `login` and
 `delegate` need the Vue UI. `daemon` cannot be combined with `jobs`, but it can
 be combined with an until-revoked `delegate`.
 
 ```sh
-synopkgland add files jobs login
+synopkgland add files jobs
 synopkgland check --json
 synopkgland status --host my-nas --json
 ```
@@ -96,6 +97,18 @@ resolve them before retrying. Already-declared capabilities are a no-op.
 `check`, `build`, `inspect`, `deploy`, `status` emit one stdout object with
 `--json`; failures include `code`, `message`, `hint`.
 
+`init --with login` declares `identity: standalone`. It is HTTPS-only for both
+password sign-in and Continue with DSM because its session cookie is Secure.
+Use it only for Apps opened outside a DSM window (Portal or their own tab).
+Do not add `--with login` without a product reason for independent sign-in;
+DSM-window Apps use their existing DSM session.
+
+DSM windows always use the embedded light theme. In a Vue frontend, do not
+bind `color-scheme` or `colorScheme` to
+`matchMedia('(prefers-color-scheme: dark)')` in a DSM window. Only the App's own
+full page (Portal or its own tab) may follow the system colour scheme, guarded
+by `ctx.fullPage`.
+
 ## Project layout
 
 | Path | What it is | Edit it? |

package/templates/native-go/backend/THIRD_PARTY_NOTICES.txt

@@ -1,6 +1,6 @@
 Native Go package build dependencies
 
-github.com/synopackageland/syno-pkg-land-sdk v0.53.1 (MIT)
+github.com/synopackageland/syno-pkg-land-sdk v0.53.9 (MIT)
 
 Copyright (c) 2026 synopkgland
 

package/templates/native-go/backend/go.mod

@@ -2,6 +2,6 @@ module __PACKAGE__
 
 go 1.26.10
 
-require github.com/synopackageland/syno-pkg-land-sdk v0.53.1
+require github.com/synopackageland/syno-pkg-land-sdk v0.53.9
 
 require golang.org/x/sys v0.44.0 // indirect

package/templates/native-go/backend/go.sum

@@ -1,4 +1,4 @@
-github.com/synopackageland/syno-pkg-land-sdk v0.53.1 h1:bgfWJRVjWWAofaIxRh4lhGrToPdhZ2AwbQp+YQMWqMo=
-github.com/synopackageland/syno-pkg-land-sdk v0.53.1/go.mod h1:JMfenGwAhlVgGUtoSQFA9XRbtN8Zcs+0xdrOaaam+Fg=
+github.com/synopackageland/syno-pkg-land-sdk v0.53.9 h1:lZVxNX0JdRCv9Rn+IAhYdYvqgBfgW345fCvAZC3lVM0=
+github.com/synopackageland/syno-pkg-land-sdk v0.53.9/go.mod h1:JMfenGwAhlVgGUtoSQFA9XRbtN8Zcs+0xdrOaaam+Fg=
 golang.org/x/sys v0.44.0 h1:ildZl3J4uzeKP07r2F++Op7E9B29JRUy+a27EibtBTQ=
 golang.org/x/sys v0.44.0/go.mod h1:4GL1E5IUh+htKOUEOaiffhrAeqysfVGipDYzABqnCmw=

package/templates/native-go-vue/README.md

@@ -75,7 +75,22 @@ Use public library controls, the embedded theme, per-app modal scope and unique
 Vue ID prefixes. Backend route permissions and DSM checks remain authoritative.
 Generated build and unit tests do not establish NAS runtime acceptance.
 
-The manifest is dsm-package.yaml schema 2: backend.kind: go and capabilities.files: session, jobs: true, identity: standalone, rootOps: true. Use --with login to declare standalone identity. Existing projects use synopkgland add <cap>...; app entrypoints stay app-owned, SDK conflicts are refused. check, inspect, build, deploy and status accept --json.
+The manifest is dsm-package.yaml schema 2: backend.kind: go, with optional
+capabilities.files: session, jobs: true and rootOps: true. Existing projects
+use `synopkgland add <cap>...`; app entrypoints stay app-owned, SDK conflicts
+are refused. check, inspect, build, deploy and status accept --json.
+
+`init --with login` declares `identity: standalone`. It is HTTPS-only for both
+password sign-in and Continue with DSM because its session cookie is Secure.
+Use it only for Apps opened outside a DSM window (Portal or their own tab).
+Do not add `--with login` without a product reason for independent sign-in;
+DSM-window Apps use their existing DSM session.
+
+DSM windows always use the embedded light theme. Do not bind `color-scheme` or
+`colorScheme` to `matchMedia('(prefers-color-scheme: dark)')` in a DSM window.
+Only the App's own full page (Portal or its own tab) may follow the system
+colour scheme, guarded by `ctx.fullPage`. The shared Vue shell leaves the
+SDK's light default in place.
 
 Use the installed `@synopackageland/ui` and its declared compatible patch range.
 `App.vue` lays the shell out with the SDK's `AppShell` (`@synopackageland/sdk/vue`):

package/templates/native-go-vue/frontend/DESIGN.md

@@ -54,6 +54,8 @@ user-and-UID ownership isolation, and stop polling on unmount.
 ## Do's and Don'ts
 
 - Do use existing public UI components, embedded theme tokens and state/recovery copy.
+- Keep DSM windows light. Only an App-owned full page (`ctx.fullPage`) may follow `prefers-color-scheme`; never bind a DSM window's `color-scheme` or `colorScheme` to the system preference.
+- Use `--with login` (`identity: standalone`) only for a product reason for independent sign-in outside a DSM window; it requires HTTPS for password sign-in and Continue with DSM. DSM-window Apps use the existing DSM session.
 - Do retain permission gating, readable loading/empty/error states and per-instance cleanup.
 - Do open the App at once: render `AppShell` immediately and run session, permission and status checks in the background, never a full-window "Checking…" placeholder. Only a confirmed refusal (signed out, expired session, not an administrator) shows the sign-in page or a library `Dialog`; loading text inside a section is fine.
 - Do use the library's `Select`, `Checkbox`, `Input`, `Textarea`, `Form`, `FormItem`, `FilePicker` (`variant="compact"`, in the app locale) and `Link` for controls; there is no native `<input>` or `<a>`. Leave `Form` on its automatic direction (labels stack below 520px of container width) and let a `FormItem` bind its control, with no `direction="vertical"`, `role="group"` or `field.controlId`.

package/templates/native-go-vue/frontend/package-lock.json

@@ -7,8 +7,8 @@
       "name": "native-dsm-vue-app",
       "dependencies": {
         "@lucide/vue": "1.48.0",
-        "@synopackageland/sdk": "~0.53.1",
-        "@synopackageland/ui": "~0.23.2",
+        "@synopackageland/sdk": "~0.53.9",
+        "@synopackageland/ui": "~0.23.8",
         "vue": "3.5.43"
       },
       "devDependencies": {
@@ -1174,13 +1174,13 @@
       "license": "Apache-2.0"
     },
     "node_modules/@synopackageland/sdk": {
-      "version": "0.53.1",
-      "resolved": "https://registry.npmjs.org/@synopackageland/sdk/-/sdk-0.53.1.tgz",
-      "integrity": "sha512-Riw45zAJW4L4aU7VxLT95q3NhG+zD2dIFsuiHyqPZizugeT3e2U4bckFRTMY8YPL5Nc0jz4Jk4MFpDSCnXddqw==",
+      "version": "0.53.9",
+      "resolved": "https://registry.npmjs.org/@synopackageland/sdk/-/sdk-0.53.9.tgz",
+      "integrity": "sha512-tFuT4oBjWHIYQMKy5RoMd6jDstEnZo2cdfU4zXsJJrlNpbDNjCYnSwGAskt2Uevr2fq72fKYuojPaXpgd5+k1A==",
       "license": "MIT",
       "peerDependencies": {
         "@lucide/vue": "^1.48.0",
-        "@synopackageland/ui": ">=0.23.2 <0.24.0",
+        "@synopackageland/ui": ">=0.23.5 <0.24.0",
         "vue": "^3.5.0"
       },
       "peerDependenciesMeta": {
@@ -1193,9 +1193,9 @@
       }
     },
     "node_modules/@synopackageland/ui": {
-      "version": "0.23.2",
-      "resolved": "https://registry.npmjs.org/@synopackageland/ui/-/ui-0.23.2.tgz",
-      "integrity": "sha512-3qVl482czZERMsxd2M0ueP+Qy6INW1+OlaalX9RpUMxp6z5eydN/9s6HhT8SQZSX2dpboZg61R8djgQm9PqOuQ==",
+      "version": "0.23.8",
+      "resolved": "https://registry.npmjs.org/@synopackageland/ui/-/ui-0.23.8.tgz",
+      "integrity": "sha512-VjHGSB1kx64lml6o18vSzskYJkU285W9fM4w3YEQNTsViKit32IAZKvWpWsZMozf4hIU33KJvnM7zSrAfJR0jw==",
       "license": "MIT",
       "dependencies": {
         "@floating-ui/dom": "1.8.0",
@@ -2512,9 +2512,9 @@
       }
     },
     "node_modules/prosemirror-model": {
-      "version": "1.25.12",
-      "resolved": "https://registry.npmjs.org/prosemirror-model/-/prosemirror-model-1.25.12.tgz",
-      "integrity": "sha512-Ue2gTmXMa7EhpLNhC7J+h4+ykD8ha12K6rrZFFKKJHBForfIStw5gJ6Zrf1mqqAa9NmpmEB4wp9bKmA4eUVjWg==",
+      "version": "1.25.13",
+      "resolved": "https://registry.npmjs.org/prosemirror-model/-/prosemirror-model-1.25.13.tgz",
+      "integrity": "sha512-MlDMWGjYXaYOeCiO17jcybntCOzPnN+97U0809ke2QsgPtxW3n5/sD6ZKyJONUgMw1iP93ohZTjeKjnRJ7L6kQ==",
       "license": "MIT",
       "dependencies": {
         "orderedmap": "^2.0.0"

package/templates/native-go-vue/frontend/package.json

@@ -8,8 +8,8 @@
   },
   "dependencies": {
     "@lucide/vue": "1.48.0",
-    "@synopackageland/sdk": "~0.53.1",
-    "@synopackageland/ui": "~0.23.2",
+    "@synopackageland/sdk": "~0.53.9",
+    "@synopackageland/ui": "~0.23.8",
     "vue": "3.5.43"
   },
   "devDependencies": {

package/templates/native-go-vue/frontend/test/apps.test.ts

@@ -30,6 +30,23 @@ test('independent mounts load only their own package status and no sample operat
   expect(a.call.mock.calls).toHaveLength(stopped)
  }finally{a.close();b.close()}
 })
+test('a DSM window stays light when the system prefers dark',async()=>{
+ const query=window.matchMedia
+ Object.defineProperty(window,'matchMedia',{configurable:true,writable:true,value:vi.fn((media:string)=>({
+  media,matches:media==='(prefers-color-scheme: dark)',onchange:null,
+  addListener:vi.fn(),removeListener:vi.fn(),addEventListener:vi.fn(),removeEventListener:vi.fn(),dispatchEvent:vi.fn(),
+ }))})
+ const f=fixture('Light')
+ try{
+  await settle()
+  const app=f.root.querySelector<HTMLElement>('[data-ui-app]')
+  expect(app).not.toBeNull()
+  // The embedded theme's default is light; dark must be an explicit App choice.
+  expect(app!.getAttribute('data-ui-color-scheme')).not.toBe('dark')
+  expect(app!.style.colorScheme).not.toBe('dark')
+  expect(f.root.textContent).toContain('Light')
+ }finally{f.close();Object.defineProperty(window,'matchMedia',{configurable:true,writable:true,value:query})}
+})
 test('failed status loading offers a retry and releases the mounting class',async()=>{
  const f=fixture('Failure')
  try{

package/templates/native-node/backend/package-lock.json

@@ -49,7 +49,7 @@
       "license": "MIT"
     },
     "vendor/@synopackageland/app": {
-      "version": "0.53.1",
+      "version": "0.53.9",
       "license": "MIT",
       "engines": {
         "node": ">=22"

package/templates/native-node/dsm-package.yaml

@@ -49,7 +49,7 @@ backend:
   runtime: node
   dir: backend/app
   entry: main.js
-  sdk: 0.53.1
+  sdk: 0.53.9
   node: { package: Node.js_v22 }
 
 ui:

package/templates/native-python/dsm-package.yaml

@@ -47,7 +47,7 @@ backend:
   runtime: python
   dir: backend/app
   entry: main.py
-  sdk: 0.53.1
+  sdk: 0.53.9
 
 ui:
   # Non-UI-SDK frontends open a full page; Portal is a separate opt-in.

package/templates/native-rust/backend/Cargo.lock

@@ -104,8 +104,8 @@ dependencies = [
 
 [[package]]
 name = "syno-pkg-land-app"
-version = "0.53.1"
-source = "git+https://github.com/synopackageland/syno-pkg-land-sdk?tag=v0.53.1#67feea7b8c05f0bbb5e31b07e40be617691b9de9"
+version = "0.53.9"
+source = "git+https://github.com/synopackageland/syno-pkg-land-sdk?tag=v0.53.9#5feb4b5cfd136de6e9774c8ba3aa3ab3052665f8"
 dependencies = [
  "libc",
  "serde",

package/templates/native-rust/backend/Cargo.toml

@@ -9,7 +9,7 @@ libc = "0.2"
 serde = { version = "1", features = ["derive"] }
 serde_json = "1"
 # The SDK version is the tag; `synopkgland check` reads it from Cargo.lock.
-syno-pkg-land-app = { git = "https://github.com/synopackageland/syno-pkg-land-sdk", tag = "v0.53.1" }
+syno-pkg-land-app = { git = "https://github.com/synopackageland/syno-pkg-land-sdk", tag = "v0.53.9" }
 
 [profile.release]
 # A handler panic becomes an "internal" reply; abort would end the App without one.

package/templates/native-rust-delegate/backend/Cargo.lock

@@ -170,8 +170,8 @@ dependencies = [
 
 [[package]]
 name = "syno-pkg-land-app"
-version = "0.53.1"
-source = "git+https://github.com/synopackageland/syno-pkg-land-sdk?tag=v0.53.1#67feea7b8c05f0bbb5e31b07e40be617691b9de9"
+version = "0.53.9"
+source = "git+https://github.com/synopackageland/syno-pkg-land-sdk?tag=v0.53.9#5feb4b5cfd136de6e9774c8ba3aa3ab3052665f8"
 dependencies = [
  "libc",
  "serde",

package/templates/native-rust-delegate/backend/Cargo.toml

@@ -10,7 +10,7 @@ libc = "0.2"
 serde = { version = "1", features = ["derive"] }
 serde_json = "1"
 # The SDK version is the tag; `synopkgland check` reads it from Cargo.lock.
-syno-pkg-land-app = { git = "https://github.com/synopackageland/syno-pkg-land-sdk", tag = "v0.53.1" }
+syno-pkg-land-app = { git = "https://github.com/synopackageland/syno-pkg-land-sdk", tag = "v0.53.9" }
 
 [profile.release]
 # A handler panic becomes an "internal" reply; abort would end the App without one.