@synopackageland/templates 0.9.9 → 0.10.1

package/templates/native-python/backend/tests/support.py

@@ -0,0 +1,72 @@
+"""Calls an App method the way the runtime does: over a channel, with the
+hello, the call, the services the method asks for and its result."""
+
+import json
+import os
+import sys
+import threading
+
+_backend = os.path.dirname(os.path.dirname(os.path.abspath(__file__)))
+# The App's own directory, and the SDK the runtime ships in the App's vendor/.
+sys.path[:0] = [os.path.join(_backend, "app"), os.path.join(_backend, "vendor")]
+
+from synopkgland_app import Error  # noqa: E402
+
+
+class Reply:
+    """A call's result frame, and the services the method asked for in order."""
+
+    def __init__(self, frame, services):
+        self.ok = frame["ok"]
+        self.data = frame.get("data")
+        self.error = frame.get("error")
+        self.services = services
+
+
+def call(app, method, params=None, user="admin", admin=True, services=None):
+    """Answer one call of method; services maps an op to fn(params), which
+    returns the result or raises Error. An op it lacks is unknown_service."""
+    services = services or {}
+    to_app, app_in = os.pipe()
+    app_out, from_app = os.pipe()
+    rfile, wfile = os.fdopen(to_app, "rb"), os.fdopen(from_app, "wb")
+
+    def serve():
+        try:
+            app.serve(rfile, wfile)
+        finally:
+            wfile.close()
+
+    thread = threading.Thread(target=serve, daemon=True)
+    thread.start()
+    out, inp = os.fdopen(app_in, "wb"), os.fdopen(app_out, "rb")
+    send = lambda frame: (out.write(json.dumps(frame).encode() + b"\n"), out.flush())
+    send({"t": "hello", "versions": [1]})
+    inp.readline()
+    ctx = {"user": user, "admin": admin, "locale": "en", "request_id": "0" * 32, "deadline_ms": 30000}
+    send({"t": "call", "id": "1", "method": method, "params": params, "ctx": ctx})
+    asked = []
+    try:
+        for line in inp:
+            frame = json.loads(line)
+            if frame["t"] == "result":
+                return Reply(frame, asked)
+            asked.append((frame["op"], frame["params"]))
+            send(_answer(services, frame))
+        raise AssertionError("the App ended the channel without a result")
+    finally:
+        out.close()
+        thread.join(5)
+        rfile.close()
+        inp.close()
+
+
+def _answer(services, frame):
+    reply = {"t": "svc_result", "id": frame["id"]}
+    service = services.get(frame["op"])
+    try:
+        if service is None:
+            raise Error("unknown_service", "no service " + frame["op"])
+        return dict(reply, ok=True, result=service(frame["params"]))
+    except Error as e:
+        return dict(reply, ok=False, error={"code": e.code, "message": e.message})

package/templates/native-python/backend/tests/test_routes.py

@@ -0,0 +1,73 @@
+import json
+import os
+import tempfile
+import unittest
+
+from support import call
+
+import routes
+
+
+class RoutesTest(unittest.TestCase):
+    def setUp(self):
+        self.dir = tempfile.TemporaryDirectory()
+        self.addCleanup(self.dir.cleanup)
+        root = self.dir.name
+        self.data = os.path.join(root, "var")
+        os.mkdir(self.data)
+        self.cfg = routes.Config("ExampleApp", self.data, packages_root=os.path.join(root, "packages"))
+        self.app = routes.build(self.cfg)
+
+    def write_info(self, text):
+        os.makedirs(os.path.join(self.cfg.packages_root, "ExampleApp"))
+        with open(os.path.join(self.cfg.packages_root, "ExampleApp", "INFO"), "w") as f:
+            f.write(text)
+
+    def test_status_reports_the_caller_and_the_installed_version(self):
+        self.write_info('package="ExampleApp"\nversion="0.1.0-0001"\n')
+        reply = call(self.app, "app.status", user="alice", admin=False)
+        self.assertTrue(reply.ok, reply.error)
+        status = reply.data
+        self.assertEqual((status["package"], status["version"]), ("ExampleApp", "0.1.0-0001"))
+        self.assertEqual((status["user"], status["admin"]), ("alice", False))
+        self.assertEqual(status["process"], {"uid": os.getuid(), "gid": os.getgid()})
+        self.assertTrue(status["language"].startswith("Python 3."), status["language"])
+        self.assertRegex(status["platform"], r"^\w+/\w+$")
+        self.assertRegex(status["time"], r"^\d{4}-\d\d-\d\dT\d\d:\d\d:\d\dZ$")
+
+    def test_status_without_info_has_no_version(self):
+        self.assertEqual(call(self.app, "app.status").data["version"], "")
+
+    def test_status_shows_the_portal_when_the_runtime_offers_it(self):
+        portal = {"enabled": True, "alias": "example"}
+        reply = call(self.app, "app.status", services={"portal.status": lambda params: portal})
+        self.assertEqual(reply.data["portal"], portal)
+        self.assertEqual(reply.services, [("portal.status", None)])
+
+    def test_status_without_a_portal_leaves_it_out(self):
+        reply = call(self.app, "app.status")
+        self.assertTrue(reply.ok, reply.error)
+        self.assertNotIn("portal", reply.data)
+
+    def test_greeting_defaults_to_hello(self):
+        self.assertEqual(call(self.app, "greeting.get").data, {"text": "Hello"})
+
+    def test_greeting_set_stores_the_text_and_who_set_it(self):
+        reply = call(self.app, "greeting.set", {"text": "Hi 👋"}, user="alice")
+        self.assertEqual(reply.data, {"text": "Hi 👋", "updated_by": "alice"})
+        self.assertEqual(call(self.app, "greeting.get").data, {"text": "Hi 👋", "updated_by": "alice"})
+        self.assertEqual(os.listdir(self.data), ["greeting.json"])
+
+    def test_greeting_counts_characters_not_bytes(self):
+        self.assertTrue(call(self.app, "greeting.set", {"text": "é" * 200}).ok)
+
+    def test_greeting_set_refuses_invalid_params_and_keeps_the_old_text(self):
+        for params in [None, [], {}, {"text": ""}, {"text": "x" * 201}, {"text": 5}, {"text": "hi", "extra": 1}]:
+            with self.subTest(params=params):
+                reply = call(self.app, "greeting.set", params)
+                self.assertEqual(reply.error["code"], "bad_request")
+        self.assertEqual(os.listdir(self.data), [])
+
+
+if __name__ == "__main__":
+    unittest.main()

package/templates/native-python/dsm-package.yaml

@@ -0,0 +1,77 @@
+# Standalone native DSM package: an unsigned SPK that runs as its own package
+# `synopkgland build` reads this file.
+schema: 2
+
+# INFO.package: letters and digits, starting with a letter. It also names the
+# DSM app (SYNO.SDS.<package>) and the CGI URL /webman/3rdparty/<package>/.
+package: __PACKAGE__
+version: 0.1.0
+# Increase for every SPK you hand out with the same version (INFO 0.1.0-0001).
+build: 1
+displayname: __DISPLAY_NAME__
+description: A native DSM package with a Python backend and a DSM window UI.
+# Package Center and DSM window icon: a square PNG of at least 256x256, or a
+# folder of icon_<size>.png. Omit to use the SDK default icon.
+# icon: assets/icon.png
+maintainer: Your Name
+# Optional INFO/website metadata. Omit fields you do not need.
+# metadata:
+#   contact_email: you@example.com
+#   support_email: support@example.com
+#   homepage: https://example.com
+#   source_url: https://github.com/you/your-app
+#   issues_url: https://github.com/you/your-app/issues
+#   license: MIT
+#   long_description:
+#     en: |-
+#       Explain what the app does and how to use it.
+#     zh-TW: Translated description.
+#   changelog:          # text, or per-language like long_description
+#     en: |-
+#       - Most important change first. Omit to use Release notes.
+#     zh-TW: |-
+#       - Translated changes.
+#   screenshots: [https://example.com/screenshot.png]
+os_min_ver: "7.1-42661"
+
+# One SPK per architecture. Supported: x86_64, aarch64, armv7 (add it here to
+# build it; armv7 is built but not NAS-verified).
+arches: [x86_64, aarch64]
+
+# The SDK's Go runtime is the CGI: it checks the DSM session, the entry gate
+# and app/permissions.json, then runs `python3 main.py` in backend/app as the
+# package account, once per call, with DSM's own Python (3.8 or later).
+# sdk is the SDK release whose runtime and Python SDK (vendor/synopkgland_app)
+# the build ships; the build reads the methods from `main.py --describe`.
+backend:
+  runtime: python
+  dir: backend/app
+  entry: main.py
+  sdk: 0.10.1
+
+ui:
+  # Static files served at /webman/3rdparty/<package>/app/. app.js and app.css
+  # are required; anything else (images, chunks) is copied as is.
+  dir: ui
+
+# UI languages: i18n/messages/<locale>.json for en, zh-TW, zh-CN, ja, ko, de,
+# fr, es and it (DSM's other languages fall back to English). build checks
+# that every language has the en.json keys and placeholders, and that the keys
+# listed in the glossary use DSM's own wording.
+i18n:
+  messages: i18n/messages
+  glossary: i18n/glossary.json
+  # Package Center text per language (INFO displayname_<lang>/description_<lang>).
+  # English comes from displayname/description above.
+  info:
+    zh-TW: { description: 以 Python 後端與 DSM 視窗介面打造的原生 DSM 套件。 }
+    zh-CN: { description: 以 Python 后端与 DSM 窗口界面构建的原生 DSM 套件。 }
+    ja: { description: Python バックエンドと DSM ウィンドウ UI を備えたネイティブ DSM パッケージ。 }
+    ko: { description: Python 백엔드와 DSM 창 UI를 갖춘 네이티브 DSM 패키지. }
+    de: { description: Ein natives DSM-Paket mit Python-Backend und DSM-Fenster-Oberfläche. }
+    fr: { description: Un paquet DSM natif avec un backend Python et une interface en fenêtre DSM. }
+    es: { description: Un paquete nativo de DSM con backend en Python e interfaz en ventana de DSM. }
+    it: { description: Un pacchetto DSM nativo con backend Python e interfaccia in una finestra DSM. }
+
+# Optional SDK capabilities; delegate/rootOps share administrator-approved executor setup.
+capabilities: {}

package/templates/native-python/gitignore

@@ -0,0 +1,2 @@
+dist/
+__pycache__/

package/templates/native-python-delegate/backend/app/delegate.py

@@ -0,0 +1,42 @@
+"""Saves to a user's destination: write a report and move it there.
+
+The browser picks the destination with the SDK's Background saves page and
+sends its delegation ID; the executor checks that it is the caller's grant
+and writes the file as the caller, never as root. A save that failed may be
+repeated with the same job ID: the same file is sent again, and the executor
+copies it at most once.
+"""
+
+import os
+import re
+import time
+
+from synopkgland_app import Error
+
+from params import fields
+
+JOB_ID = re.compile(r"[a-zA-Z0-9][a-zA-Z0-9._-]{0,127}\Z")
+
+
+def register(app, cfg):
+    app.method("report.save")(lambda ctx, params: save(cfg, ctx, params))
+
+
+def save(cfg, ctx, params):
+    p = fields(params, delegation_id=str, job_id=str)
+    if not JOB_ID.match(p["job_id"]):
+        raise Error.bad_request("job_id must be 1 to 128 letters, digits, '.', '_' or '-'")
+    name = "report-%s.txt" % p["job_id"]
+    # The runtime's delegate service moves files from here.
+    staging = os.path.join(cfg.data_dir, "executor-staging")
+    os.makedirs(staging, mode=0o700, exist_ok=True)
+    path = os.path.join(staging, name)
+    try:
+        fd = os.open(path, os.O_WRONLY | os.O_CREAT | os.O_EXCL, 0o600)
+    except FileExistsError:
+        pass
+    else:
+        with os.fdopen(fd, "w", encoding="utf-8") as f:
+            f.write("Report for %s, %s\n" % (ctx.user, time.strftime("%Y-%m-%dT%H:%M:%SZ", time.gmtime())))
+    move = {"delegation_id": p["delegation_id"], "job_id": p["job_id"], "staging": name, "name": name, "size": os.path.getsize(path)}
+    return ctx.runtime("delegate.move_from_staging", move)

package/templates/native-python-delegate/backend/tests/test_delegate.py

@@ -0,0 +1,58 @@
+import os
+import stat
+import tempfile
+import unittest
+
+from support import Error, call
+
+import routes
+
+SAVED = {"state": "queued"}
+
+
+class DelegateTest(unittest.TestCase):
+    def setUp(self):
+        self.dir = tempfile.TemporaryDirectory()
+        self.addCleanup(self.dir.cleanup)
+        self.staging = os.path.join(self.dir.name, "executor-staging")
+        self.app = routes.build(routes.Config("ExampleApp", self.dir.name))
+
+    def save(self, job_id="job-1", user="alice", move=lambda p: SAVED):
+        params = {"delegation_id": "d1", "job_id": job_id}
+        return call(self.app, "report.save", params, user=user, admin=False, services={"delegate.move_from_staging": move})
+
+    def test_save_moves_a_private_report_to_the_callers_destination(self):
+        reply = self.save()
+        self.assertEqual(reply.data, SAVED)
+        path = os.path.join(self.staging, "report-job-1.txt")
+        with open(path, encoding="utf-8") as f:
+            self.assertIn("alice", f.read())
+        self.assertEqual(stat.S_IMODE(os.stat(path).st_mode), 0o600)
+        move = {"delegation_id": "d1", "job_id": "job-1", "staging": "report-job-1.txt", "name": "report-job-1.txt", "size": os.path.getsize(path)}
+        self.assertEqual(reply.services, [("delegate.move_from_staging", move)])
+
+    def test_a_repeated_save_sends_the_same_file_again(self):
+        first = self.save().services
+        path = os.path.join(self.staging, "report-job-1.txt")
+        with open(path, encoding="utf-8") as f:
+            report = f.read()
+        self.assertEqual(self.save(user="bob").services, first)
+        with open(path, encoding="utf-8") as f:
+            self.assertEqual(f.read(), report)
+
+    def test_save_passes_on_the_executors_refusal(self):
+        def denied(params):
+            raise Error("DELEGATION_DENIED", "The destination is no longer allowed.")
+
+        self.assertEqual(self.save(move=denied).error["code"], "DELEGATION_DENIED")
+
+    def test_save_refuses_invalid_params_before_writing(self):
+        for params in [None, {"delegation_id": "d1"}, {"delegation_id": "d1", "job_id": "../x"}, {"delegation_id": "d1", "job_id": ""}, {"delegation_id": 1, "job_id": "j"}]:
+            with self.subTest(params=params):
+                reply = call(self.app, "report.save", params)
+                self.assertEqual((reply.error["code"], reply.services), ("bad_request", []))
+        self.assertFalse(os.path.exists(self.staging))
+
+
+if __name__ == "__main__":
+    unittest.main()

package/templates/native-python-jobs/backend/app/jobs.py

@@ -0,0 +1,40 @@
+"""Background jobs: hash a NAS file the caller may read.
+
+The SDK's worker runs each job as the package account: it hashes the job's
+input (SHA-256) and keeps the result for the job's owner, the caller. The
+runtime serves files.read with the caller's DSM session and bg.* for the
+caller's own jobs only.
+"""
+
+import os
+import shutil
+import tempfile
+
+from synopkgland_app import Error
+
+from params import fields
+
+# A job's input is at most 512 KiB, copied into the job when it is submitted.
+MAX_INPUT = 512 * 1024
+
+
+def register(app, cfg):
+    app.method("hash.submit")(lambda ctx, params: submit(cfg, ctx, params))
+    app.method("hash.get")(lambda ctx, params: ctx.runtime("bg.get", fields(params, id=str)))
+    app.method("hash.cancel")(lambda ctx, params: ctx.runtime("bg.cancel", fields(params, id=str)))
+
+
+def submit(cfg, ctx, params):
+    p = fields(params, key=str, path=str)
+    read = ctx.runtime("files.read", {"path": p["path"]})
+    if read["size"] > MAX_INPUT:
+        raise Error("limit_exceeded", "The file is larger than allowed.")
+    # bg.submit takes its input from the data directory; the call's spool is elsewhere.
+    inputs = os.path.join(cfg.data_dir, "hash-inputs")
+    os.makedirs(inputs, mode=0o700, exist_ok=True)
+    with open(read["path"], "rb") as source, tempfile.NamedTemporaryFile(dir=inputs, delete=False) as copy:
+        shutil.copyfileobj(source, copy)
+    try:
+        return ctx.runtime("bg.submit", {"key": p["key"], "name": os.path.basename(p["path"]), "input": copy.name})
+    finally:
+        os.unlink(copy.name)

package/templates/native-python-jobs/backend/tests/test_jobs.py

@@ -0,0 +1,72 @@
+import os
+import tempfile
+import unittest
+
+from support import Error, call
+
+import routes
+
+JOB = {"job": {"id": "j1", "state": "queued"}, "duplicate": False}
+
+
+class JobsTest(unittest.TestCase):
+    def setUp(self):
+        self.dir = tempfile.TemporaryDirectory()
+        self.addCleanup(self.dir.cleanup)
+        self.data = os.path.join(self.dir.name, "var")
+        os.mkdir(self.data)
+        self.app = routes.build(routes.Config("ExampleApp", self.data))
+        self.submitted = []
+
+    def spool(self, content):
+        path = os.path.join(self.dir.name, "spool")
+        with open(path, "wb") as f:
+            f.write(content)
+        return {"path": path, "size": len(content)}
+
+    def submit(self, params):
+        # The runtime reads the input file while it answers bg.submit.
+        with open(params["input"], "rb") as f:
+            self.submitted.append(dict(params, content=f.read()))
+        return JOB
+
+    def test_submit_hashes_a_copy_of_the_callers_file(self):
+        services = {"files.read": lambda p: self.spool(b"hello"), "bg.submit": self.submit}
+        reply = call(self.app, "hash.submit", {"key": "k1", "path": "/home/report.txt"}, services=services)
+        self.assertEqual(reply.data, JOB)
+        self.assertEqual([op for op, _ in reply.services], ["files.read", "bg.submit"])
+        self.assertEqual(reply.services[0][1], {"path": "/home/report.txt"})
+        [submitted] = self.submitted
+        self.assertEqual((submitted["key"], submitted["name"], submitted["content"]), ("k1", "report.txt", b"hello"))
+        self.assertTrue(submitted["input"].startswith(self.data + os.sep))
+        self.assertFalse(os.path.exists(submitted["input"]), "the copy is removed once submitted")
+
+    def test_submit_refuses_a_file_over_the_job_input_limit(self):
+        services = {"files.read": lambda p: self.spool(b"x" * (512 * 1024 + 1)), "bg.submit": self.submit}
+        reply = call(self.app, "hash.submit", {"key": "k1", "path": "/home/big.bin"}, services=services)
+        self.assertEqual(reply.error["code"], "limit_exceeded")
+        self.assertEqual(self.submitted, [])
+
+    def test_submit_passes_on_the_runtimes_refusal(self):
+        def unreadable(params):
+            raise Error("read_failed", "Unable to read the file.")
+
+        reply = call(self.app, "hash.submit", {"key": "k1", "path": "/home/a"}, services={"files.read": unreadable})
+        self.assertEqual(reply.error["code"], "read_failed")
+
+    def test_submit_refuses_invalid_params_before_any_service(self):
+        for params in [None, {"key": "k1"}, {"key": 1, "path": "/home/a"}, {"key": "k1", "path": "/home/a", "x": 1}]:
+            with self.subTest(params=params):
+                reply = call(self.app, "hash.submit", params)
+                self.assertEqual((reply.error["code"], reply.services), ("bad_request", []))
+
+    def test_get_and_cancel_act_on_the_callers_job(self):
+        for method, op in [("hash.get", "bg.get"), ("hash.cancel", "bg.cancel")]:
+            with self.subTest(method=method):
+                reply = call(self.app, method, {"id": "j1"}, services={op: lambda p: JOB["job"]})
+                self.assertEqual((reply.data, reply.services), (JOB["job"], [(op, {"id": "j1"})]))
+                self.assertEqual(call(self.app, method, {}).error["code"], "bad_request")
+
+
+if __name__ == "__main__":
+    unittest.main()

package/templates/native-python-root-ops/backend/app/root_ops.py

@@ -0,0 +1,18 @@
+"""Root operations: run root/whoami.sh as root.
+
+The executor runs only the root programs an administrator approved, and
+checks the caller's DSM session and Application Privileges itself; the App
+names the program and never runs anything as root.
+"""
+
+from synopkgland_app import Error
+
+
+def register(app, cfg):
+    app.method("whoami.run")(lambda ctx, params: whoami(ctx, params))
+
+
+def whoami(ctx, params):
+    if params not in (None, {}):
+        raise Error.bad_request("whoami.run takes no params")
+    return ctx.runtime("root.run", {"name": "whoami"})

package/templates/native-python-root-ops/backend/tests/test_root_ops.py

@@ -0,0 +1,34 @@
+import tempfile
+import unittest
+
+from support import Error, call
+
+import routes
+
+
+class RootOpsTest(unittest.TestCase):
+    def setUp(self):
+        self.dir = tempfile.TemporaryDirectory()
+        self.addCleanup(self.dir.cleanup)
+        self.app = routes.build(routes.Config("ExampleApp", self.dir.name))
+
+    def test_whoami_runs_the_approved_root_program(self):
+        output = {"exit_code": 0, "stdout": "0\n", "stderr": ""}
+        for params in [None, {}]:
+            with self.subTest(params=params):
+                reply = call(self.app, "whoami.run", params, services={"root.run": lambda p: output})
+                self.assertEqual((reply.data, reply.services), (output, [("root.run", {"name": "whoami"})]))
+
+    def test_whoami_passes_on_the_executors_refusal(self):
+        def paused(params):
+            raise Error("EXECUTOR_PAUSED", "The executor is paused.")
+
+        reply = call(self.app, "whoami.run", {}, services={"root.run": paused})
+        self.assertEqual(reply.error["code"], "EXECUTOR_PAUSED")
+
+    def test_whoami_takes_no_params(self):
+        self.assertEqual(call(self.app, "whoami.run", {"name": "other"}).error["code"], "bad_request")
+
+
+if __name__ == "__main__":
+    unittest.main()

package/templates/native-python-vue/README.md

@@ -0,0 +1,56 @@
+# Native Python with Vue
+
+The Vue shell is the same as the Go template's. Edit `frontend/src/App.vue`
+and `main.ts` to build a DSM-window app with the public `@synopackageland/ui`
+components and embedded theme. The shell, sign-in, files, portal, jobs and
+delegate components come from `@synopackageland/sdk/vue` (types from
+`@synopackageland/sdk`); its version must equal the `backend.sdk` in dsm-package.yaml. See
+<https://github.com/synopackageland/syno-pkg-land-sdk> for the components and their props.
+
+```sh
+cd frontend
+npm ci
+npm test
+npm run build
+```
+
+The base app reads package status and edits the package greeting through
+`ctx.call`. Errors show the app's own `frontend/src/i18n` text, or the SDK's
+`bridgeErrorCopy` for the codes the bridge runtime adds (`app_unavailable`
+and the services' refusals). Each window has its own Vue mount, request state
+and host subscriptions; unmount disposes subscriptions and ignores late responses.
+
+The `--with jobs`, `root-ops` and `delegate` examples add their methods to
+the Python App; the shell's panels call them with `ctx.call`. The SDK's
+background-jobs page and executor settings call the runtime's own browser
+methods (`bg.*`, `executor.*`); check the SDK release notes for the ones a
+bridge App's runtime serves.
+
+Use the installed `@synopackageland/ui`; package.json pins its version.
+`App.vue` lays the shell out with the SDK's `AppShell` (`@synopackageland/sdk/vue`):
+`pages` from `shellPages`, the header buttons in `#actions` and the pages in its
+default slot. Given `ctx`, it follows the launch. In a DSM desktop window it
+keeps `wide-layout="window"`, even maximized; the DSM host sets the 700px
+minimum window width. A Portal or standalone launch owns the whole page
+(`ctx.fullPage`, from the generated window): `AppShell` takes
+`wide-layout="web"` (the SaaS layout at 1200px or wider, mobile on a phone) and
+a device-width viewport, undone at unmount, since DSM's page has no
+device-width viewport. Its full-page sidebar names the App with
+`ctx.displayName` and `ctx.appIcon` (without them the page title and icon) and
+shows the signed-in DSM account and its role from `ctx.user`. See the ui's
+`docs/adaptive-layout.md`.
+`AppShell`'s `app-root` wraps it in an app-local `AppRoot` (app modal scope, on
+a full page as well, bounded at `height: 100%`) with the UI locale from
+`locale`; do not add another `AppRoot`.
+In a DSM window (not a full page) that `AppRoot` takes
+`dialog-bounds="viewport"`, so Dialogs can be dragged out of the window, and
+pressing one calls `ctx.host.activateWindow()` to bring the window to the
+front. Elsewhere Dialogs stay inside the App. A confirmed sign-in need sets
+`denied`: the `#denied` slot's `LoginPage` takes the place of the App's pages.
+Import `themes/dsm7-embedded.css` and assign each mount a unique
+`app.config.idPrefix` before mounting.
+
+Start with AGENTS.md, `synopkgland skill list` and `synopkgland skill path`.
+Read `synopkgland skill show ui-vue` for direct Vue component work. For UI
+discovery, run `npx --no syno-pkg-land-ui catalog --json` and
+`npx --no syno-pkg-land-ui describe Button --json` from the installed frontend.

package/templates/native-python-vue/gitignore

@@ -0,0 +1,3 @@
+dist/
+__pycache__/
+node_modules/