@synopackageland/templates 0.42.2 → 0.43.0

package/CHANGELOG.md

@@ -1,5 +1,12 @@
 # Changelog
 
+## 0.43.0
+
+- Move Vue and capability layers under `templates/overlays/`; keep six main templates.
+- Let init resolve compatible SDK/UI releases and its own CLI version from shipped defaults.
+- Refresh offline defaults and remove shipped npm lockfiles; first install creates them.
+- Preserve release checksums and document Go/Rust dependency initialization.
+
 ## 0.42.2
 
 - New Apps get no header Refresh. The Vue templates leave `AppShell`'s `#actions` empty (Sign out only with standalone login), so the shell draws no bar above the page; the plain UI's title row drops its Refresh button

package/README.md

@@ -24,7 +24,7 @@ daemon:
     window_seconds: 300
 ```
 
-Templates pin compatible UI and SDK releases in native and Compose projects.
+Templates carry offline fallback dependency versions; init resolves compatible current releases.
 Use a CLI that supports executor manifest format 1. The Vue `AppShell` shows a
 non-blocking **Reload** notice when an upgrade replaced the UI an open page
 loaded. Go Apps select
@@ -50,15 +50,20 @@ An opt-in [native UI plus DSM console example](examples/dual-entry-console/READM
 shows the `console` declaration for an App that wraps a web service behind the
 identity gateway and keeps its own settings in an administrator-only DSM window.
 
-| Template | What it adds |
+The first level of `templates/` contains the six main templates, `_shared/`,
+and `overlays/`. All Vue, jobs, delegate and root-ops layers live under `overlays/`.
+The shipped manifest versions are fallback defaults; init rewrites them through its
+existing substitution pass. SDK/UI/CLI patches do not require a templates release.
+
+| Template or overlay | What it adds |
 | --- | --- |
 | `native-go` | Base: `dsm-package.yaml`, Go module (`backend/cmd/{app,background-worker}`, `backend/internal/app`, `backend/internal/api/permissions.json`), plain `ui/`, i18n |
-| `native-go-vue` | Vue shell in `frontend/` (`App.vue`, `main.ts`, app i18n, `CapabilityPanels.vue`, `ExecutorGate.vue`) |
-| `native-go-jobs` | Background job routes in `internal/app` and a shell lifecycle test |
-| `native-go-delegate` | Delegate routes, the delegate background worker, the delegate `CapabilityPanels.vue` |
-| `native-go-root-ops` | The SDK's executor routes and `root.run` in `internal/app`, an example `root/whoami.sh`, and the Vue `ExecutorGate.vue` that holds the pages until the executor is approved |
+| `overlays/native-go-vue` | Vue shell in `frontend/` (`App.vue`, `main.ts`, app i18n, `CapabilityPanels.vue`, `ExecutorGate.vue`) |
+| `overlays/native-go-jobs` | Background job routes in `internal/app` and a shell lifecycle test |
+| `overlays/native-go-delegate` | Delegate routes, the delegate background worker, the delegate `CapabilityPanels.vue` |
+| `overlays/native-go-root-ops` | The SDK's executor routes and `root.run` in `internal/app`, an example `root/whoami.sh`, and the Vue `ExecutorGate.vue` that holds the pages until the executor is approved |
 | `native-python` | Base: `dsm-package.yaml` (`backend.runtime: python`), the App in `backend/app` (`routes.py`, stub capability modules, `permissions.json`), unittest tests |
-| `native-node` | Base: `dsm-package.yaml` (`backend.runtime: node`), TypeScript in `backend/src` compiled into `backend/app`, node:test tests, `pnpm-lock.yaml` |
+| `native-node` | Base: `dsm-package.yaml` (`backend.runtime: node`), TypeScript in `backend/src` compiled into `backend/app`, node:test tests, an install-generated lockfile |
 | `native-rust` | Base: `dsm-package.yaml` (`backend.runtime: rust`, `methods`), the Cargo project in `backend` on the `syno-pkg-land-app` crate, `Cargo.lock`, `rust-toolchain.toml` |
 | `native-{python,node,rust}-{jobs,root-ops,delegate}` | The capability's example module, replacing the base's stub, with its tests |
 | `native-{python,node,rust}-vue` | The README and `.gitignore` of the Vue shell |
@@ -70,8 +75,8 @@ Overlays are copied over `native-go` in the order root-ops, vue, jobs, delegate.
 An overlay may replace `internal/app/*_none.go` (the CLI deletes the matching
 `_none.go` file); nothing outside `internal/app` and the Vue shell differs.
 The Python, Node.js and Rust templates borrow the Go template's UI: `ui/` and
-`i18n/` from `native-go`, `frontend/` from `native-go-vue` (and the jobs and
-delegate overlays' frontend files), `root/whoami.sh` from `native-go-root-ops`.
+`i18n/` from `native-go`, `frontend/` from `overlays/native-go-vue` (and the jobs and
+delegate overlays' frontend files), `root/whoami.sh` from `overlays/native-go-root-ops`.
 Their overlays are copied in the order vue, root-ops, jobs, delegate; delegate
 also makes `app.status` and `report.save` `authenticated`, and the Rust
 manifest gets the overlays' methods. `init` copies the App SDK into
@@ -84,13 +89,22 @@ calls each one from the generated script of the same name (`synopkgland skill sh
 The placeholders `__PACKAGE__` (also the Go module path), `__DISPLAY_NAME__` and
 `__BACKGROUND_ENABLED__` are substituted by `init`.
 
-`backend/go.mod` requires `github.com/synopackageland/syno-pkg-land-sdk`; that line is
-the single source of the SDK version and `frontend/package.json` sets
-`@synopackageland/sdk` to a patch range starting at the same version. Python and Node.js name it in
-`backend.sdk`, Rust in the `syno-pkg-land-app` tag of `backend/Cargo.toml`
-(and `Cargo.lock`). The Vue frontend uses a compatible patch range for
-`@synopackageland/ui`. The shipped lockfile fixes both installed versions;
-update it deliberately to take newer patches.
+`init` defaults to `native-go` with Vue. The CLI writes its own `~` version,
+selects the newest stable, non-deprecated SDK and UI releases in its declared
+compatibility ranges, and writes the same exact SDK version to npm and the backend.
+UI stays in the supported minor line. Registry errors or unavailable compatible
+releases print one hint and use the shipped defaults; there is no short custom timeout.
+Templates are still read from the installed package, never downloaded by `init`.
+The CLI compatibility ranges live in `src/init-versions.ts`.
+
+Templates do not ship npm lockfiles. Run `pnpm install` in the project root and
+frontend (and the Node backend) to create them, then commit them and use
+`pnpm install --frozen-lockfile` for subsequent installs. For Go, run
+`(cd backend && go mod tidy)` before check/build. When init selects a newer Rust
+SDK tag, run `(cd backend && cargo generate-lockfile)` before check/build;
+the old release's Cargo.lock is removed rather than relabeling its commit.
+`SYNOPKGLAND_SDK_DIR` still overrides the generated SDK dependency for local development.
+
 Read the SDK's published peer dependency range with
 `npm view @synopackageland/sdk peerDependencies` rather than overriding it. Tests use jsdom 30 for UI floating-layer styles.
 

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@synopackageland/templates",
-  "version": "0.42.2",
-  "description": "Project templates for synopkgland init: native-go, native-python, native-node and native-rust (plain or Vue, with jobs, delegate and root-ops overlays), binary and compose.",
+  "version": "0.43.0",
+  "description": "Project templates for synopkgland init: native-go, native-python, native-node and native-rust (plain or Vue, with layers in templates/overlays), binary and compose.",
   "license": "MIT",
   "repository": {
     "type": "git",

package/templates/_shared/AGENTS.md

@@ -28,7 +28,7 @@ sections at the end name each language's files, types and test commands.
 
 From the project root, run `synopkgland check --json`,
 `synopkgland build --json`, then `synopkgland inspect <spk> --json` on the emitted SPK.
-For Vue, first run `pnpm install --frozen-lockfile --prod=false` and `pnpm run build` in frontend. Run its tests only if the user chose tests.
+For Vue, first run `pnpm install --prod=false` (creates its lockfile) and `pnpm run build` in frontend. Run its tests only if the user chose tests.
 Do not connect to or change a NAS without explicit task authorization.
 
 ## Optional testing
@@ -408,7 +408,7 @@ their capabilities with `synopkgland init --with`.
   `new AppError(code, message)`, `AppError.badRequest(message)`. Call services
   through `service(ctx, op, params)` (`service.ts`), which passes the runtime's
   refusals on; a bare `ctx.runtime` refusal would reach the browser as `internal`.
-- Test with `(cd backend && pnpm install --frozen-lockfile --prod=false && pnpm test && pnpm run typecheck)`; `test/support.ts`'s
+- Test with `(cd backend && pnpm install --prod=false && pnpm test && pnpm run typecheck)`; `test/support.ts`'s
   `call` plays the runtime.
 
 ## Rust backend

package/templates/_shared/package.json

@@ -11,7 +11,7 @@
     "e2e:ai": "node --env-file-if-exists=.env node_modules/@synopackageland/cli/dist/e2e/dsm.js tunnel -- e2e run --config e2e.ai.config.ts tests/e2e/action.ai.e2e.ts"
   },
   "devDependencies": {
-    "@synopackageland/cli": "~0.52.11",
+    "@synopackageland/cli": "~0.53.18",
     "@e2e-dev/web": "^0.14.0",
     "e2e": "^0.19.0"
   },

package/templates/_shared/pnpm-workspace.yaml

@@ -1,2 +1,3 @@
 allowBuilds:
   esbuild: true
+  koffi: true

package/templates/compose/dsm-package.yaml

@@ -23,7 +23,7 @@ compose:
   web: {service: web, port: 8080, health: {path: /, status: 200}}
   network: {egress: isolated}
 identity_gateway:
-  sdk: 0.53.16
+  sdk: 0.53.42
   mode: none
   listen: {http: 28000}
 # Web Apps default to new-page through the shared app-launch resolver.

package/templates/native-go/README.md

@@ -498,3 +498,6 @@ Keep `synology/backend/`, `synology/i18n/messages/`, `synology/operations.json`
 the local/ctl tests: the entry gate still needs the backend and message catalogs.
 Read `synopkgland skill show upstream-fork` and
 `synopkgland skill show orchestrator` for the wrapper workflow.
+
+Before the first check/build, install the project dependencies with `pnpm install`
+and run `(cd backend && go mod tidy)` to populate checksums for the selected SDK.

package/templates/native-go/backend/THIRD_PARTY_NOTICES.txt

@@ -1,6 +1,6 @@
 Native Go package build dependencies
 
-github.com/synopackageland/syno-pkg-land-sdk v0.53.16 (MIT)
+github.com/synopackageland/syno-pkg-land-sdk v0.53.42 (MIT)
 
 Copyright (c) 2026 synopkgland
 

package/templates/native-go/backend/go.mod

@@ -2,6 +2,6 @@ module __PACKAGE__
 
 go 1.26.10
 
-require github.com/synopackageland/syno-pkg-land-sdk v0.53.16
+require github.com/synopackageland/syno-pkg-land-sdk v0.53.42
 
 require golang.org/x/sys v0.44.0 // indirect

package/templates/native-go/backend/go.sum

@@ -1,4 +1,4 @@
-github.com/synopackageland/syno-pkg-land-sdk v0.53.16 h1:i4FCBCpOr7ma31zFathuS2QLpCWa13y3v9rWvlg+AfE=
-github.com/synopackageland/syno-pkg-land-sdk v0.53.16/go.mod h1:JMfenGwAhlVgGUtoSQFA9XRbtN8Zcs+0xdrOaaam+Fg=
+github.com/synopackageland/syno-pkg-land-sdk v0.53.42 h1:qhbKCjU6ME8OpuMgpz03LHs3KGL66xSwDRvePGWlyEU=
+github.com/synopackageland/syno-pkg-land-sdk v0.53.42/go.mod h1:mmtgnyafLwci1588LJFpRIsWflHwjaHJoDm7grXFh8A=
 golang.org/x/sys v0.44.0 h1:ildZl3J4uzeKP07r2F++Op7E9B29JRUy+a27EibtBTQ=
 golang.org/x/sys v0.44.0/go.mod h1:4GL1E5IUh+htKOUEOaiffhrAeqysfVGipDYzABqnCmw=

package/templates/native-node/README.md

@@ -51,7 +51,7 @@ run `synopkgland ctl generate`.
 Needs Node.js 20 or later with `synopkgland` installed. The SPK depends on DSM's **Node.js v20** package (INFO `install_dep_packages`).
 
 ```bash
-(cd backend && pnpm install --frozen-lockfile --prod=false && pnpm test && pnpm run build)   # method tests, then app/*.js
+(cd backend && pnpm install --prod=false && pnpm test && pnpm run build)   # method tests, then app/*.js
 synopkgland ctl generate
 synopkgland check
 synopkgland build           # → dist/__PACKAGE__-0.1.0-0001-{x86_64,aarch64}.spk

package/templates/native-node/dsm-package.yaml

@@ -49,7 +49,7 @@ backend:
   runtime: node
   dir: backend/app
   entry: main.js
-  sdk: 0.53.16
+  sdk: 0.53.42
   node: { package: Node.js_v22 }
 
 ui:

package/templates/native-python/dsm-package.yaml

@@ -47,7 +47,7 @@ backend:
   runtime: python
   dir: backend/app
   entry: main.py
-  sdk: 0.53.16
+  sdk: 0.53.42
 
 ui:
   # Non-UI-SDK frontends open a full page; Portal is a separate opt-in.

package/templates/native-rust/README.md

@@ -225,3 +225,6 @@ Draft writes require a non-mutating preview and explicit human confirmation.
 Long operations use the existing job flow; tools own polling and pagination.
 
 Use a matching SDK/CLI/templates release containing the registry support.
+
+After init selects a new SDK tag, run `(cd backend && cargo generate-lockfile)`
+before check/build, then commit the generated Cargo.lock.

package/templates/native-rust/backend/Cargo.lock

@@ -14,15 +14,15 @@ dependencies = [
 
 [[package]]
 name = "itoa"
-version = "1.0.18"
+version = "1.0.19"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "8f42a60cbdf9a97f5d2305f08a87dc4e09308d1276d28c869c684d7777685682"
+checksum = "3bd1574e617a9a6c1f8f8181bd7e841e1f20e4277607ef28945765188d6284d4"
 
 [[package]]
 name = "libc"
-version = "0.2.190"
+version = "0.2.191"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "ce5d3ddc6d3fa000eb1536d85e147bfe31aacaba692ed6a876f95cb7c855be78"
+checksum = "65cd87c9a6d60536580b316ad985726104730a5151c99845f2490428ef91240a"
 
 [[package]]
 name = "memchr"
@@ -93,9 +93,9 @@ dependencies = [
 
 [[package]]
 name = "syn"
-version = "3.0.9"
+version = "3.0.10"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "d78c8dee4c7bf0e14673097256fed6142ce9d3b85a408189d07482442145823b"
+checksum = "4ae9ccbea3a7b0b09443036490c8f34a8b1b760fd345e5c0dae0aac718faea79"
 dependencies = [
  "proc-macro2",
  "quote",
@@ -104,8 +104,8 @@ dependencies = [
 
 [[package]]
 name = "syno-pkg-land-app"
-version = "0.53.16"
-source = "git+https://github.com/synopackageland/syno-pkg-land-sdk?tag=v0.53.16#6751951c140fb032e5f050dc53f5cc58fcd0bf60"
+version = "0.53.42"
+source = "git+https://github.com/synopackageland/syno-pkg-land-sdk?tag=v0.53.42#02d5b526c852b3bd30e4dc9031414c9907fadb57"
 dependencies = [
  "libc",
  "serde",

package/templates/native-rust/backend/Cargo.toml

@@ -9,7 +9,7 @@ libc = "0.2"
 serde = { version = "1", features = ["derive"] }
 serde_json = "1"
 # The SDK version is the tag; `synopkgland check` reads it from Cargo.lock.
-syno-pkg-land-app = { git = "https://github.com/synopackageland/syno-pkg-land-sdk", tag = "v0.53.16" }
+syno-pkg-land-app = { git = "https://github.com/synopackageland/syno-pkg-land-sdk", tag = "v0.53.42" }
 
 [profile.release]
 # A handler panic becomes an "internal" reply; abort would end the App without one.

package/templates/{native-go-vue → overlays/native-go-vue}/README.md

@@ -37,7 +37,7 @@ See the [fork guide](https://github.com/synopackageland/syno-pkg-land-templates#
 
 ```sh
 cd frontend
-pnpm install --frozen-lockfile --prod=false
+pnpm install --prod=false
 pnpm test
 pnpm run build
 ```
@@ -150,3 +150,6 @@ For UI discovery, run `pnpm exec syno-pkg-land-ui catalog --json` and
 `pnpm exec syno-pkg-land-ui describe Button --json` from the installed frontend.
 Read its prompt and exported Vue docs/types before choosing component APIs.
 Use `syno-pkg-land-ui` directly in package scripts; keep AI guidance version-independent.
+
+Before the first check/build, install the project dependencies with `pnpm install`
+and run `(cd backend && go mod tidy)` to populate checksums for the selected SDK.

package/templates/{native-go-vue → overlays/native-go-vue}/frontend/package.json

@@ -8,8 +8,8 @@
   },
   "dependencies": {
     "@lucide/vue": "1.48.0",
-    "@synopackageland/sdk": "~0.53.16",
-    "@synopackageland/ui": "~0.25.2",
+    "@synopackageland/sdk": "~0.53.42",
+    "@synopackageland/ui": "~0.25.17",
     "vue": "3.5.43"
   },
   "devDependencies": {

package/templates/{native-node-vue → overlays/native-node-vue}/README.md

@@ -26,7 +26,7 @@ run `synopkgland ctl generate`.
 
 ```sh
 cd frontend
-pnpm install --frozen-lockfile --prod=false
+pnpm install --prod=false
 pnpm test
 pnpm run build
 ```

package/templates/{native-python-vue → overlays/native-python-vue}/README.md

@@ -26,7 +26,7 @@ run `synopkgland ctl generate`.
 
 ```sh
 cd frontend
-pnpm install --frozen-lockfile --prod=false
+pnpm install --prod=false
 pnpm test
 pnpm run build
 ```

package/templates/{native-rust-delegate → overlays/native-rust-delegate}/backend/Cargo.lock

@@ -69,15 +69,15 @@ dependencies = [
 
 [[package]]
 name = "itoa"
-version = "1.0.18"
+version = "1.0.19"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "8f42a60cbdf9a97f5d2305f08a87dc4e09308d1276d28c869c684d7777685682"
+checksum = "3bd1574e617a9a6c1f8f8181bd7e841e1f20e4277607ef28945765188d6284d4"
 
 [[package]]
 name = "libc"
-version = "0.2.190"
+version = "0.2.191"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "ce5d3ddc6d3fa000eb1536d85e147bfe31aacaba692ed6a876f95cb7c855be78"
+checksum = "65cd87c9a6d60536580b316ad985726104730a5151c99845f2490428ef91240a"
 
 [[package]]
 name = "memchr"
@@ -159,9 +159,9 @@ dependencies = [
 
 [[package]]
 name = "syn"
-version = "3.0.9"
+version = "3.0.10"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "d78c8dee4c7bf0e14673097256fed6142ce9d3b85a408189d07482442145823b"
+checksum = "4ae9ccbea3a7b0b09443036490c8f34a8b1b760fd345e5c0dae0aac718faea79"
 dependencies = [
  "proc-macro2",
  "quote",
@@ -170,8 +170,8 @@ dependencies = [
 
 [[package]]
 name = "syno-pkg-land-app"
-version = "0.53.16"
-source = "git+https://github.com/synopackageland/syno-pkg-land-sdk?tag=v0.53.16#6751951c140fb032e5f050dc53f5cc58fcd0bf60"
+version = "0.53.42"
+source = "git+https://github.com/synopackageland/syno-pkg-land-sdk?tag=v0.53.42#02d5b526c852b3bd30e4dc9031414c9907fadb57"
 dependencies = [
  "libc",
  "serde",

package/templates/{native-rust-delegate → overlays/native-rust-delegate}/backend/Cargo.toml

@@ -10,7 +10,7 @@ libc = "0.2"
 serde = { version = "1", features = ["derive"] }
 serde_json = "1"
 # The SDK version is the tag; `synopkgland check` reads it from Cargo.lock.
-syno-pkg-land-app = { git = "https://github.com/synopackageland/syno-pkg-land-sdk", tag = "v0.53.16" }
+syno-pkg-land-app = { git = "https://github.com/synopackageland/syno-pkg-land-sdk", tag = "v0.53.42" }
 
 [profile.release]
 # A handler panic becomes an "internal" reply; abort would end the App without one.

package/templates/{native-rust-vue → overlays/native-rust-vue}/README.md

@@ -26,7 +26,7 @@ run `synopkgland ctl generate`.
 
 ```sh
 cd frontend
-pnpm install --frozen-lockfile --prod=false
+pnpm install --prod=false
 pnpm test
 pnpm run build
 ```