@synopackageland/templates 0.41.4 → 0.42.0

package/templates/_shared/pnpm-workspace.yaml

@@ -0,0 +1,2 @@
+allowBuilds:
+  esbuild: true

package/templates/_shared/third-party-notices.mjs

@@ -1,24 +1,90 @@
-import { existsSync, mkdirSync, readFileSync, readdirSync, rmSync, writeFileSync } from 'node:fs';
-import { join } from 'node:path';
+import { existsSync, mkdirSync, readFileSync, readdirSync, realpathSync, rmSync, writeFileSync } from 'node:fs';
+import { join, resolve } from 'node:path';
+import { createRequire } from 'node:module';
+import { parseAllDocuments } from 'yaml';
 
 const OWNED = ['THIRD_PARTY_NOTICES.txt', 'inventory.json', 'UI-LICENSE', 'UI-THIRD_PARTY.md'];
 
+function productionPackages(root) {
+  if (!existsSync(join(root, 'pnpm-lock.yaml'))) {
+    const lock = JSON.parse(readFileSync(join(root, 'package-lock.json'), 'utf8'));
+    if (lock.lockfileVersion < 2 || !lock.packages) throw new Error('Notice generation requires a v2/v3 npm lockfile');
+    return Object.entries(lock.packages).filter(([path, entry]) => path && !entry.dev)
+      .map(([path, entry]) => [path, entry, join(root, path)]);
+  }
+  const documents = parseAllDocuments(readFileSync(join(root, 'pnpm-lock.yaml'), 'utf8'));
+  if (documents.some(document => document.errors.length)) throw new Error('Invalid pnpm notice lockfile');
+  const lock = documents.at(-1)?.toJSON();
+  if (String(lock.lockfileVersion) !== '9.0' || !lock.importers?.['.'] || !lock.snapshots)
+    throw new Error('Notice generation requires a pnpm lockfile with importers and snapshots');
+  const importer = lock.importers['.'];
+  const manifest = JSON.parse(readFileSync(join(root, 'package.json'), 'utf8'));
+  // Keep the inventory's logical paths stable across package-manager layouts.
+  // Conflicting transitive versions remain beneath their owning dependency.
+  const versions = new Map();
+  for (const key of Object.keys(lock.packages ?? {})) {
+    const match = /^((?:@[^/]+\/)?[^@]+)@(.+)$/.exec(key);
+    if (!match) continue;
+    const [, name, version] = match;
+    const set = versions.get(name) ?? new Set();
+    set.add(version);
+    versions.set(name, set);
+  }
+  for (const group of ['dependencies', 'optionalDependencies'])
+    for (const [name, spec] of Object.entries(manifest[group] ?? {}))
+      if (importer[group]?.[name]?.specifier !== spec) throw new Error('Notice lockfile is out of date; run pnpm install');
+  const queue = [];
+  const enqueue = (entries, parent, path, optional = false) => {
+    for (const [name, ref] of Object.entries(entries ?? {}))
+      queue.push({name, ref: typeof ref === 'string' ? ref : ref.version, parent, path, optional});
+  };
+  enqueue(importer.dependencies, root, '');
+  enqueue(importer.optionalDependencies, root, '', true);
+  const seen = new Set(), paths = new Set(), entries = [];
+  while (queue.length) {
+    const {name, ref, parent, path: parentPath, optional} = queue.shift();
+    const key = `${name}@${ref}`;
+    const direct = importer.dependencies?.[name] ?? importer.optionalDependencies?.[name];
+    const nested = parentPath && versions.get(name)?.size > 1 && direct?.version !== ref;
+    const seenKey = nested ? `${key} from ${parent}` : key;
+    if (seen.has(seenKey)) continue;
+    seen.add(seenKey);
+    const snapshot = lock.snapshots[key];
+    const packageKey = key.replace(/\(.*$/, '');
+    const entry = lock.packages?.[packageKey];
+    if (!snapshot || !entry) throw new Error(`Missing locked notice dependency: ${key}`);
+    const search = createRequire(join(parent, 'package.json')).resolve.paths(name) ?? [];
+    const installed = search.map(dir => join(dir, name)).find(dir => existsSync(join(dir, 'package.json')));
+    if (!installed && optional) continue;
+    if (!installed) throw new Error(`Missing installed notice dependency: ${name}; run pnpm install --frozen-lockfile`);
+    const dir = realpathSync(installed);
+    let path = nested ? `${parentPath}/node_modules/${name}` : `node_modules/${name}`;
+    if (paths.has(path)) path = `${parentPath}/node_modules/${name}`;
+    paths.add(path);
+    // A local tarball ref names a file; pnpm records its version separately.
+    const version = entry.resolution?.type === 'directory'
+      ? JSON.parse(readFileSync(join(dir, 'package.json'), 'utf8')).version
+      : entry.version ?? ref.replace(/\(.*$/, '');
+    entries.push([path, {version, integrity: entry.resolution?.integrity}, dir]);
+    enqueue(snapshot.dependencies, dir, path);
+    enqueue(snapshot.optionalDependencies, dir, path, true);
+  }
+  return entries;
+}
+
 // Conservative inventory of every locked production dependency, including
 // dependencies tree-shaken from the bundle. Build tools marked dev are omitted.
 // Read actual upstream license/notice files, never synthesize license text from
-// SPDX metadata. npm ci must have installed the exact lock before this runs.
+// SPDX metadata. Install the exact lock before this runs.
 export function writeThirdPartyNotices(root, output, { ui = false } = {}) {
-  const lock = JSON.parse(readFileSync(join(root, 'package-lock.json'), 'utf8'));
-  if (lock.lockfileVersion < 2 || !lock.packages) throw new Error('Notice generation requires a v2/v3 npm lockfile');
+  root = resolve(root);
   const inventory = [];
   const sections = [];
   let uiFiles;
-  for (const [path, entry] of Object.entries(lock.packages).sort(([a], [b]) => a.localeCompare(b, 'en'))) {
-    if (!path || entry.dev) continue;
+  for (const [path, entry, dir] of productionPackages(root).sort(([a], [b]) => a.localeCompare(b, 'en'))) {
     if (!/^node_modules\//.test(path) || path.split('/').includes('..') || entry.link) throw new Error(`Unsupported notice package path: ${path}`);
-    const dir = join(root, path);
     const pkg = JSON.parse(readFileSync(join(dir, 'package.json'), 'utf8'));
-    if (pkg.version !== entry.version) throw new Error(`Notice version mismatch: ${path}; run npm ci`);
+    if (pkg.version !== entry.version) throw new Error(`Notice version mismatch: ${path}; run pnpm install --frozen-lockfile`);
     const files = readdirSync(dir, { withFileTypes: true })
       .filter(f => f.isFile() && /^(licen[sc]e|copying|notice|copyright)([.-]|$)/i.test(f.name))
       .map(f => f.name).sort();

package/templates/binary/README.md

@@ -7,12 +7,12 @@ Copy `.env.example` to the ignored `.env` only for optional AI tests; keep real
 From the project root, install the test tools before running the optional tests:
 
 ```sh
-npm install --include=dev
-npm test
+pnpm install --prod=false
+pnpm test
 ```
 
 `NODE_ENV=production` skips devDependencies; `test:local` needs the CLI.
-After committing the generated root lockfile, use `npm ci --include=dev`.
+After committing the generated root lockfile, use `pnpm install --frozen-lockfile --prod=false`.
 The scaffold provides example prebuilt binaries; replace them with your own
 Linux binaries before packaging. See `AGENTS.md` for the package workflow.
 

package/templates/compose/README.md

@@ -7,12 +7,12 @@ Copy `.env.example` to the ignored `.env` only for optional AI tests; keep real
 From the project root, install the test tools before running the optional tests:
 
 ```sh
-npm install --include=dev
-npm test
+pnpm install --prod=false
+pnpm test
 ```
 
 `NODE_ENV=production` skips devDependencies; `test:local` needs the CLI.
-After committing the generated root lockfile, use `npm ci --include=dev`.
+After committing the generated root lockfile, use `pnpm install --frozen-lockfile --prod=false`.
 Configure the upstream image and its real readiness endpoint before
 `test:local`; see `AGENTS.md` for the Compose packaging workflow.
 

package/templates/compose/dsm-package.yaml

@@ -23,7 +23,7 @@ compose:
   web: {service: web, port: 8080, health: {path: /, status: 200}}
   network: {egress: isolated}
 identity_gateway:
-  sdk: 0.53.9
+  sdk: 0.53.16
   mode: none
   listen: {http: 28000}
 # Web Apps default to new-page through the shared app-launch resolver.

package/templates/native-go/README.md

@@ -36,13 +36,13 @@ Copy `.env.example` to the ignored `.env` only for optional AI tests; keep real
 From the project root, install the test tools before running the optional tests:
 
 ```sh
-npm install --include=dev
-npm test
+pnpm install --prod=false
+pnpm test
 ```
 
 `NODE_ENV=production` skips devDependencies; `test:local` needs the CLI.
-After committing the generated root lockfile, use `npm ci --include=dev`.
-Before `npm run test:local`, prepare the backend and, for Vue, build the
+After committing the generated root lockfile, use `pnpm install --frozen-lockfile --prod=false`.
+Before `pnpm run test:local`, prepare the backend and, for Vue, build the
 frontend using the steps below and the backend section in `AGENTS.md`, then
 run `synopkgland ctl generate`.
 
@@ -282,7 +282,7 @@ ui:
   dir: web/dist
   build:
     cwd: web
-    command: [npm, run, build]
+    command: [pnpm, run, build]
 ```
 
 The build must emit `app.js` (a classic script that registers `mount`) or
@@ -490,7 +490,7 @@ select `ui: false`. For an upstream web panel with no SDK UI, set `ui: false`
 in `synology/dsm-package.yaml` and configure `identity_gateway` for the panel.
 Remove `synology/ui/` (or `synology/frontend/` for Vue),
 `synology/tests/e2e/`, `synology/e2e.config.ts` and
-`synology/e2e.ai.config.ts`, and remove the `e2e:*` npm scripts.
+`synology/e2e.ai.config.ts`, and remove the `e2e:*` package scripts.
 Keep `synology/backend/`, `synology/i18n/messages/`, `synology/operations.json` and
 the local/ctl tests: the entry gate still needs the backend and message catalogs.
 Read `synopkgland skill show upstream-fork` and

package/templates/native-go/backend/THIRD_PARTY_NOTICES.txt

@@ -1,6 +1,6 @@
 Native Go package build dependencies
 
-github.com/synopackageland/syno-pkg-land-sdk v0.53.9 (MIT)
+github.com/synopackageland/syno-pkg-land-sdk v0.53.16 (MIT)
 
 Copyright (c) 2026 synopkgland
 

package/templates/native-go/backend/go.mod

@@ -2,6 +2,6 @@ module __PACKAGE__
 
 go 1.26.10
 
-require github.com/synopackageland/syno-pkg-land-sdk v0.53.9
+require github.com/synopackageland/syno-pkg-land-sdk v0.53.16
 
 require golang.org/x/sys v0.44.0 // indirect

package/templates/native-go/backend/go.sum

@@ -1,4 +1,4 @@
-github.com/synopackageland/syno-pkg-land-sdk v0.53.9 h1:lZVxNX0JdRCv9Rn+IAhYdYvqgBfgW345fCvAZC3lVM0=
-github.com/synopackageland/syno-pkg-land-sdk v0.53.9/go.mod h1:JMfenGwAhlVgGUtoSQFA9XRbtN8Zcs+0xdrOaaam+Fg=
+github.com/synopackageland/syno-pkg-land-sdk v0.53.16 h1:i4FCBCpOr7ma31zFathuS2QLpCWa13y3v9rWvlg+AfE=
+github.com/synopackageland/syno-pkg-land-sdk v0.53.16/go.mod h1:JMfenGwAhlVgGUtoSQFA9XRbtN8Zcs+0xdrOaaam+Fg=
 golang.org/x/sys v0.44.0 h1:ildZl3J4uzeKP07r2F++Op7E9B29JRUy+a27EibtBTQ=
 golang.org/x/sys v0.44.0/go.mod h1:4GL1E5IUh+htKOUEOaiffhrAeqysfVGipDYzABqnCmw=

package/templates/native-go-vue/README.md

@@ -14,13 +14,13 @@ Copy `.env.example` to the ignored `.env` only for optional AI tests; keep real
 From the project root, install the test tools before running the optional tests:
 
 ```sh
-npm install --include=dev
-npm test
+pnpm install --prod=false
+pnpm test
 ```
 
 `NODE_ENV=production` skips devDependencies; `test:local` needs the CLI.
-After committing the generated root lockfile, use `npm ci --include=dev`.
-Before `npm run test:local`, prepare the backend and, for Vue, build the
+After committing the generated root lockfile, use `pnpm install --frozen-lockfile --prod=false`.
+Before `pnpm run test:local`, prepare the backend and, for Vue, build the
 frontend using the steps below and the backend section in `AGENTS.md`, then
 run `synopkgland ctl generate`.
 
@@ -37,9 +37,9 @@ See the [fork guide](https://github.com/synopackageland/syno-pkg-land-templates#
 
 ```sh
 cd frontend
-npm ci --include=dev
-npm test
-npm run build
+pnpm install --frozen-lockfile --prod=false
+pnpm test
+pnpm run build
 ```
 
 The base app reads package status and edits the package greeting through
@@ -139,7 +139,7 @@ Read `synopkgland skill show ui-vue` for direct Vue component work and
 `synopkgland skill show ui-json` for optional declarative specs and their
 validate/render workflow. The existing host/backend lifecycle remains in place.
 
-For UI discovery, run `npx --no syno-pkg-land-ui catalog --json` and
-`npx --no syno-pkg-land-ui describe Button --json` from the installed frontend.
+For UI discovery, run `pnpm exec syno-pkg-land-ui catalog --json` and
+`pnpm exec syno-pkg-land-ui describe Button --json` from the installed frontend.
 Read its prompt and exported Vue docs/types before choosing component APIs.
-Use `syno-pkg-land-ui` directly in npm scripts; keep AI guidance version-independent.
+Use `syno-pkg-land-ui` directly in package scripts; keep AI guidance version-independent.

package/templates/native-go-vue/frontend/DESIGN.md

@@ -22,10 +22,10 @@ spacing:
 
 Read `AGENTS.md` at the project root and `synopkgland skill show ui-vue` before UI edits.
 
-For UI discovery, run `npx --no syno-pkg-land-ui catalog --json` and
-`npx --no syno-pkg-land-ui describe Button --json` from the installed frontend.
+For UI discovery, run `pnpm exec syno-pkg-land-ui catalog --json` and
+`pnpm exec syno-pkg-land-ui describe Button --json` from the installed frontend.
 Read its prompt and exported Vue docs/types before choosing component APIs.
-Use `syno-pkg-land-ui` directly in npm scripts; keep AI guidance version-independent.
+Use `syno-pkg-land-ui` directly in package scripts; keep AI guidance version-independent.
 
 ## Overview
 

package/templates/native-go-vue/frontend/package.json

@@ -8,8 +8,8 @@
   },
   "dependencies": {
     "@lucide/vue": "1.48.0",
-    "@synopackageland/sdk": "~0.53.9",
-    "@synopackageland/ui": "~0.23.8",
+    "@synopackageland/sdk": "~0.53.16",
+    "@synopackageland/ui": "~0.25.2",
     "vue": "3.5.43"
   },
   "devDependencies": {
@@ -18,6 +18,8 @@
     "typescript": "5.9.3",
     "vite": "7.3.6",
     "vitest": "4.1.11",
-    "vue-tsc": "3.3.11"
-  }
+    "vue-tsc": "3.3.11",
+    "yaml": "^2.9.1"
+  },
+  "packageManager": "pnpm@12.18.0"
 }