@synopackageland/templates 0.41.5 → 0.42.0

package/CHANGELOG.md

@@ -1,5 +1,11 @@
 # Changelog
 
+## 0.42.0
+
+- Scaffold pnpm projects with pinned package managers and reproducible lockfiles
+- Use pnpm in App guides, scripts and development checks
+- Generate the same production license notices from pnpm dependency graphs
+
 ## 0.41.5
 
 - Align SDK/App references and locks across native and Compose templates with 0.53.16

package/README.md

@@ -1,5 +1,7 @@
 # @synopackageland/templates
 
+Use pnpm for JavaScript dependencies and scripts; enable it with `corepack enable pnpm`.
+
 Project templates for `synopkgland init` and `synopkgland add`. They hold only
 the files an App owns; the SDK (`github.com/synopackageland/syno-pkg-land-sdk`, npm
 `@synopackageland/sdk`) is a dependency of the generated project, never a copy.
@@ -56,7 +58,7 @@ identity gateway and keeps its own settings in an administrator-only DSM window.
 | `native-go-delegate` | Delegate routes, the delegate background worker, the delegate `CapabilityPanels.vue` |
 | `native-go-root-ops` | The SDK's executor routes and `root.run` in `internal/app`, an example `root/whoami.sh`, and the Vue `ExecutorGate.vue` that holds the pages until the executor is approved |
 | `native-python` | Base: `dsm-package.yaml` (`backend.runtime: python`), the App in `backend/app` (`routes.py`, stub capability modules, `permissions.json`), unittest tests |
-| `native-node` | Base: `dsm-package.yaml` (`backend.runtime: node`), TypeScript in `backend/src` compiled into `backend/app`, node:test tests, `package-lock.json` |
+| `native-node` | Base: `dsm-package.yaml` (`backend.runtime: node`), TypeScript in `backend/src` compiled into `backend/app`, node:test tests, `pnpm-lock.yaml` |
 | `native-rust` | Base: `dsm-package.yaml` (`backend.runtime: rust`, `methods`), the Cargo project in `backend` on the `syno-pkg-land-app` crate, `Cargo.lock`, `rust-toolchain.toml` |
 | `native-{python,node,rust}-{jobs,root-ops,delegate}` | The capability's example module, replacing the base's stub, with its tests |
 | `native-{python,node,rust}-vue` | The README and `.gitignore` of the Vue shell |
@@ -239,7 +241,7 @@ SYNOPKGLAND_CLI="$(command -v synopkgland)" node --test scripts/test/scaffold.te
 The gate installs the CLI range declared by the shared scaffold into its temporary
 directory, or uses the executable in `SYNOPKGLAND_CLI`. Its existing `node:test`
 harness runs real CLI init for every template and both native UI variants,
-then each generated project's default `npm test`. Native projects assert the
+then each generated project's default `pnpm test`. Native projects assert the
 starter operation; binary and Compose report the expected skip because they
 have no starter registry. One plain native project also runs its generated
 `test:local` check/build/inspect tier. Backend tests and Vue builds stay in the
@@ -253,7 +255,7 @@ resolves once). Set `SYNOPKGLAND_SDK_TARBALL` to a published tarball to test tha
 release without rebuilding the SDK frontend. With `SYNOPKGLAND_UI_TARBALL` set it installs that tarball as
 `@synopackageland/ui`, for a UI version not yet on npm.
 The Python and Node.js combinations need `SYNOPKGLAND_SDK_DIR` (its `python/`,
-and `node/` built with `npm ci && npm run build`) for their App SDK, and the
+and `node/` built with `pnpm install && pnpm run build`) for their App SDK, and the
 Rust ones fetch the SDK crate from it (`scripts/rust-env.sh`), so it must hold
 the tag `Cargo.lock` pins. The gate runs each language's tests on Linux in
 Docker (`scripts/bridge-linux-test.sh`: Python 3.8, Node.js 22, Rust).
@@ -268,7 +270,7 @@ prints a failed job's whole log. On `SYNOPKGLAND_DOCKER_SSH` the Rust checks
 run in `synopkgland-gate-templates:<hash>` (`scripts/gate.Dockerfile`) with
 the host's shared `synopkgland-cache-cargo` volume, and wait for one of its
 two gate slots. There the Vue frontends' checks (`scripts/frontend-check.sh`:
-npm install, vitest, the build) run too, in the official `node:24.22.1` image
+pnpm install, vitest, the build) run too, in the official `node:24.22.1` image
 with the shared `synopkgland-cache-npm` volume
 (`scripts/frontend-docker-checks.sh`; `SYNOPKGLAND_DOCKER_NPM_REGISTRY` to select an alternate registry), so the Mac's load cannot slow them.
 Without `SYNOPKGLAND_DOCKER_SSH` they run here.
@@ -400,11 +402,11 @@ the fork workflow.
 ## App-open smoke
 
 Every generated project includes `tests/e2e/smoke.e2e.ts`, `e2e.config.ts` and
-a root `package.json`. Run `npm install --include=dev` at the project root
-(or `npm ci --include=dev` after committing its lockfile).
+a root `package.json`. Run `pnpm install --prod=false` at the project root
+(or `pnpm install --frozen-lockfile --prod=false` after committing its lockfile).
 `NODE_ENV=production` skips devDependencies; `test:local` needs the CLI.
 Install Chromium once with
-`npx @e2e-dev/web install chromium`, then run `npm run e2e:smoke`. Set `DSM_E2E_SSH` and private mode-600 account files in
+`pnpm dlx @e2e-dev/web install chromium`, then run `pnpm run e2e:smoke`. Set `DSM_E2E_SSH` and private mode-600 account files in
 `DSM_E2E_ACCOUNT_ADMIN` and `DSM_E2E_ACCOUNT_NORMAL`; grant the normal account
 Application Privileges first. Missing normal credentials/profile produces a
 reported skip. Profiles reuse the existing CLI target/user cache. `.env` and

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@synopackageland/templates",
-  "version": "0.41.5",
+  "version": "0.42.0",
   "description": "Project templates for synopkgland init: native-go, native-python, native-node and native-rust (plain or Vue, with jobs, delegate and root-ops overlays), binary and compose.",
   "license": "MIT",
   "repository": {
@@ -20,5 +20,9 @@
   "scripts": {
     "check:docs": "node --test scripts/check-doc-versions.test.mjs && node scripts/check-doc-versions.mjs",
     "gate": "scripts/gate.sh"
+  },
+  "packageManager": "pnpm@12.18.0",
+  "dependencies": {
+    "yaml": "^2.9.1"
   }
 }

package/templates/_shared/AGENTS.md

@@ -6,10 +6,10 @@ skill with `synopkgland skill show <id>` before editing.
 For UI work, read `synopkgland skill show ui-vue` and `synopkgland skill show ui-json`.
 Use the installed SDK contracts and preserve package.json/lockfile pins.
 
-For UI discovery, run `npx --no syno-pkg-land-ui catalog --json` and
-`npx --no syno-pkg-land-ui describe Button --json` from the installed frontend.
+For UI discovery, run `pnpm exec syno-pkg-land-ui catalog --json` and
+`pnpm exec syno-pkg-land-ui describe Button --json` from the installed frontend.
 Read its prompt and exported Vue docs/types before choosing component APIs.
-Use `syno-pkg-land-ui` directly in npm scripts; keep AI guidance version-independent.
+Use `syno-pkg-land-ui` directly in package scripts; keep AI guidance version-independent.
 
 Open the App at once: render its shell immediately and run session, permission
 and status checks in the background, never a full-window "Checking…" placeholder.
@@ -22,7 +22,7 @@ sections at the end name each language's files, types and test commands.
 
 From the project root, run `synopkgland check --json`,
 `synopkgland build --json`, then `synopkgland inspect <spk> --json` on the emitted SPK.
-For Vue, first run `npm ci --include=dev` and `npm run build` in frontend. Run its tests only if the user chose tests.
+For Vue, first run `pnpm install --frozen-lockfile --prod=false` and `pnpm run build` in frontend. Run its tests only if the user chose tests.
 Do not connect to or change a NAS without explicit task authorization.
 
 ## Optional testing
@@ -32,14 +32,14 @@ Accept no tests, remember the choice, do not nag and never block a build or rele
 on tests. Scaffolding is included by default; writing and running tests are optional.
 Read `synopkgland skill show testing` when setting up or extending tests.
 
-The default `npm test` runs only fast local unit/ctl registry contracts.
-At the project root, run `npm install --include=dev` first; after committing its
-lockfile, use `npm ci --include=dev`.
+The default `pnpm test` runs only fast local unit/ctl registry contracts.
+At the project root, run `pnpm install --prod=false` first; after committing its
+lockfile, use `pnpm install --frozen-lockfile --prod=false`.
 `NODE_ENV=production` skips devDependencies; `test:local` needs the CLI and frontend builds need dev tools.
 Before `test:local`, prepare the backend/frontend as described below and run
 `synopkgland ctl generate` for a native App.
-`npm run test:local` opts into check/build/inspect. Only on explicit user request,
-run `npm run test:nas:ctl`, `npm run e2e:smoke`, `npm run e2e:ui` or `npm run e2e:ai`.
+`pnpm run test:local` opts into check/build/inspect. Only on explicit user request,
+run `pnpm run test:nas:ctl`, `pnpm run e2e:smoke`, `pnpm run e2e:ui` or `pnpm run e2e:ai`.
 The full suite is slow. Never call these from build, install, DSM hooks or release.
 For non-AI use, no model/key is required; AI dependencies are optional installs.
 
@@ -396,13 +396,13 @@ their capabilities with `synopkgland init --with`.
 - Methods: `backend/src/routes.ts` (`build` registers them, the capability
   modules `jobs.ts`, `root-ops.ts`, `delegate.ts` add theirs); permissions:
   `backend/app/permissions.json`. TypeScript with `"module": "NodeNext"`;
-  `npm run build` compiles it into `backend/app`, which the SPK ships, so run it
+  `pnpm run build` compiles it into `backend/app`, which the SPK ships, so run it
   before `synopkgland check` or `build`.
 - Params: `strings(params, ...names)` (`params.ts`); errors:
   `new AppError(code, message)`, `AppError.badRequest(message)`. Call services
   through `service(ctx, op, params)` (`service.ts`), which passes the runtime's
   refusals on; a bare `ctx.runtime` refusal would reach the browser as `internal`.
-- Test with `(cd backend && npm ci --include=dev && npm test && npm run typecheck)`; `test/support.ts`'s
+- Test with `(cd backend && pnpm install --frozen-lockfile --prod=false && pnpm test && pnpm run typecheck)`; `test/support.ts`'s
   `call` plays the runtime.
 
 ## Rust backend

package/templates/_shared/package.json

@@ -2,7 +2,7 @@
   "private": true,
   "type": "module",
   "scripts": {
-    "test": "npm run test:unit",
+    "test": "pnpm run test:unit",
     "test:unit": "node --test tests/unit/*.test.mjs",
     "test:local": "node --test tests/local/*.test.mjs",
     "test:nas:ctl": "node --env-file-if-exists=.env --test tests/ctl/*.test.mjs",
@@ -14,5 +14,6 @@
     "@synopackageland/cli": "~0.52.11",
     "@e2e-dev/web": "^0.14.0",
     "e2e": "^0.19.0"
-  }
+  },
+  "packageManager": "pnpm@12.18.0"
 }