@synopackageland/cli 0.24.1 → 0.25.1

package/CHANGELOG.md

@@ -1,5 +1,18 @@
 # Changelog
 
+## 0.25.1 (2026-10-22)
+
+- Fix upgrades that first add a `daemon`: the generated `preupgrade` ran the old payload's missing `daemon/control` and DSM rolled back with error 4541. The hook now exits 0 when the outgoing payload has no `daemon/` (plain, executor and delegated-worker variants); inspect still accepts the released unguarded hook.
+- Add `daemon.node` (`package: Node.js_v18|v20|v22`, optional `min_version`): the daemon's `exec` is a JavaScript entry run by the Package Center Node.js package through a generated launcher, with INFO `install_dep_packages`. The SPK bundles no Node. See docs/daemon.md for availability and dependency behaviour.
+- Add `daemon.ingress` (`path`, optional `timeout`, default 3600 s): a same-origin path in DSM's nginx through web-config `nginx-static-config` `type: dsm`, proxied unbuffered to `/tmp/synopkgland-ingress-<package>.sock`, with nginx reloads in INFO. check requires os_min_ver 7.2-64570 or later (`STANDALONE_DAEMON_INGRESS_MIN_DSM`); inspect verifies the location, resource, INFO and daemon environment.
+
+## 0.25.0 (2026-10-22)
+
+- Add the opt-in `console` declaration for native Apps with `identity_gateway`: a native UI URL launcher and an administrator-only DSM console, selected by Package Center Open. Validate both entries and refuse incompatible launch declarations.
+- Fix installation-settings inspection when native identity-gateway diagnostics precede the settings hook, retaining full lifecycle validation.
+- Document punctuation rules for owned UI copy in the development skill.
+- Support SDK/App 0.25.0 and templates 0.25.0, with UI 0.14.3 in Vue scaffolds. Reuse executor/v0.24.0 with unchanged protected executor/lifecycle payloads and Go 1.26.10. OIDC browser cold-login continuation requires SDK 0.25.0. No NAS acceptance is claimed.
+
 ## 0.24.1 (2026-10-22)
 
 - Build SDK/App 0.24.1 with the verified immutable executor/v0.24.0 release and its exact executor/lifecycle digests; retain SDK/App 0.24.0 support. SDK 0.24.1 adds AppShell brand navigation to the first page and supports UI 0.14.3.

package/README.md

@@ -268,6 +268,16 @@ A full page does not need Application Portal. Omit `portal` unless an alias is
 explicitly wanted; only that opt-in adds `defaultAlias`, login styling, Portal
 panels and capabilities. No Portal is a healthy default for inspect/info/doctor.
 
+A native App with `identity_gateway` can declare `console` to get two main-menu
+icons: the native UI (`displayname`, a `type: "url"` launcher to `sso/open.cgi`
+that opens a new tab) and an administrator-only DSM window running the SDK UI
+from `ui.dir`, named "<displayname> for DSM" by default. Package Center's Open
+(INFO `dsmapplaunchname`) starts the console, and Application Privileges lists
+only the native icon. `console: {}` keeps the default name; `console: { title }`
+sets it for every language. Omit `console` to keep one icon. check refuses
+`console` on Compose, without `identity_gateway`, or with `ui.launch` or
+`portal`. A cold DSM sign-in resumes through the url launcher.
+
 Compose uses schema-2 `dsm-package.yaml` and `ui.launch`; the default is new-page.
 Classless gateways use type url via the shared contract/app-launch resolver;
 AppWindow wrappers use standalone. Headless projects have no launcher.

package/dist/build-spk/ui-texts.d.ts

@@ -18,6 +18,18 @@ export declare function uiTitleFields(app: AppTitle): {
     texts?: string;
     preloadTexts?: string[];
 };
+/** The console's name: the declared title in every language, else "<displayname> for DSM". */
+export declare function consoleTitle(displayname: string, console: {
+    title?: string;
+}): string;
+/** {@link uiTitleFields} for the console window, which shares the App's description. */
+export declare function uiConsoleTitleFields(app: AppTitle, console: {
+    title?: string;
+}): ReturnType<typeof uiTitleFields>;
 /** `ui/texts/<dsm lang>/strings` for English and every translated language; none without translations. */
-export declare function renderUiTexts(app: AppTitle): Map<string, string>;
-export declare function writeUiTexts(uiRoot: string, app: AppTitle): void;
+export declare function renderUiTexts(app: AppTitle, console?: {
+    title?: string;
+}): Map<string, string>;
+export declare function writeUiTexts(uiRoot: string, app: AppTitle, console?: {
+    title?: string;
+}): void;

package/dist/build-spk/ui-texts.js

@@ -4,6 +4,7 @@ import { DSM_LANGS, LOCALES } from "../standalone/i18n.js";
 const SECTION = "synopkgland";
 const TITLE = `${SECTION}:app_title`;
 const DESC = `${SECTION}:app_desc`;
+const CONSOLE_TITLE = `${SECTION}:console_title`;
 /** `ui/` subdirectory with the strings; a `ui/config` entry's `texts` names it relative to `ui/`. */
 const TEXTS_DIR = "texts";
 function translated(app) {
@@ -21,8 +22,18 @@ export function uiTitleFields(app) {
         ? { title: TITLE, desc: DESC, texts: TEXTS_DIR, preloadTexts: [TITLE, DESC] }
         : { title: app.displayname, desc: app.description };
 }
+/** The console's name: the declared title in every language, else "<displayname> for DSM". */
+export function consoleTitle(displayname, console) {
+    return console.title ?? `${displayname} for DSM`;
+}
+/** {@link uiTitleFields} for the console window, which shares the App's description. */
+export function uiConsoleTitleFields(app, console) {
+    return translated(app)
+        ? { title: CONSOLE_TITLE, desc: DESC, texts: TEXTS_DIR, preloadTexts: [CONSOLE_TITLE, DESC] }
+        : { title: consoleTitle(app.displayname, console), desc: app.description };
+}
 /** `ui/texts/<dsm lang>/strings` for English and every translated language; none without translations. */
-export function renderUiTexts(app) {
+export function renderUiTexts(app, console) {
     const files = new Map();
     if (!translated(app))
         return files;
@@ -32,12 +43,13 @@ export function renderUiTexts(app) {
             continue;
         const title = text?.displayname ?? app.displayname;
         const desc = text?.description ?? app.description;
-        files.set(DSM_LANGS[locale], `[${SECTION}]\napp_title="${title}"\napp_desc="${desc}"\n`);
+        const consoleLine = console ? `console_title="${consoleTitle(title, console)}"\n` : "";
+        files.set(DSM_LANGS[locale], `[${SECTION}]\napp_title="${title}"\napp_desc="${desc}"\n${consoleLine}`);
     }
     return files;
 }
-export function writeUiTexts(uiRoot, app) {
-    for (const [lang, strings] of renderUiTexts(app)) {
+export function writeUiTexts(uiRoot, app, console) {
+    for (const [lang, strings] of renderUiTexts(app, console)) {
         mkdirSync(join(uiRoot, TEXTS_DIR, lang), { recursive: true });
         const path = join(uiRoot, TEXTS_DIR, lang, "strings");
         writeFileSync(path, strings, "utf8");

package/dist/contract/app-launch.d.ts

@@ -6,6 +6,9 @@ export declare const DEFAULT_WEB_LAUNCH: AppLaunchMode;
 export declare function isAppLaunchMode(value: unknown): value is AppLaunchMode;
 /** Both Compose routes use the same web default; a valid explicit choice wins. */
 export declare function resolveAppLaunch(value: unknown, webService: boolean): AppLaunchMode | undefined;
-export declare function resolvedSdkLaunch(manifest: Pick<StandaloneManifest, 'ui' | 'compose' | 'identityGateway'>): AppLaunchMode;
+/** A console always opens the SDK UI in a DSM window. */
+export declare function resolvedSdkLaunch(manifest: Pick<StandaloneManifest, 'ui' | 'compose' | 'identityGateway'> & {
+    console?: unknown;
+}): AppLaunchMode;
 /** DSM rewrites standalone URLs to launchApp; only SDK wrappers provide that class. */
 export declare function dsmLauncherType(launch: AppLaunchMode, sdkWindow: boolean): 'standalone' | 'app' | 'url';

package/dist/contract/app-launch.js

@@ -9,8 +9,9 @@ export function resolveAppLaunch(value, webService) {
     return value === undefined ? webService ? DEFAULT_WEB_LAUNCH : DEFAULT_NATIVE_LAUNCH
         : isAppLaunchMode(value) ? value : undefined;
 }
+/** A console always opens the SDK UI in a DSM window. */
 export function resolvedSdkLaunch(manifest) {
-    return resolveAppLaunch(manifest.ui.launch, Boolean(manifest.compose || manifest.identityGateway));
+    return resolveAppLaunch(manifest.console ? 'dsm-window' : manifest.ui.launch, Boolean(manifest.compose || manifest.identityGateway));
 }
 /** DSM rewrites standalone URLs to launchApp; only SDK wrappers provide that class. */
 export function dsmLauncherType(launch, sdkWindow) {

package/dist/error-registry.js

@@ -322,6 +322,21 @@ export const ERROR_REGISTRY = {
             description: "The package daemon's Go supervisor could not be built.",
             suggestion: "Install Go 1.21 or later (builds pin go1.26.10 and need it offline) and check the compiler stderr; the NAS does not need a Go toolchain.",
         },
+        STANDALONE_DAEMON_NODE_INVALID: {
+            code: "STANDALONE_DAEMON_NODE_INVALID",
+            description: "daemon.node does not name a Package Center Node.js package and a version of its major.",
+            suggestion: "Set daemon.node.package to Node.js_v18, Node.js_v20 or Node.js_v22, and min_version (optional) to a version of that major such as 22.19.0.",
+        },
+        STANDALONE_DAEMON_INGRESS_INVALID: {
+            code: "STANDALONE_DAEMON_INGRESS_INVALID",
+            description: "daemon.ingress does not declare one same-origin path and a bounded proxy timeout.",
+            suggestion: "Set daemon.ingress.path to /<name>/ with lowercase letters, digits and -, not a DSM path, and timeout (optional) to 1–3600 seconds.",
+        },
+        STANDALONE_DAEMON_INGRESS_MIN_DSM: {
+            code: "STANDALONE_DAEMON_INGRESS_MIN_DSM",
+            description: "daemon.ingress uses DSM's web-config worker, which DSM 7.1 refuses in an unsigned package.",
+            suggestion: "Raise os_min_ver to 7.2-64570 or later, or remove daemon.ingress.",
+        },
         STANDALONE_DAEMON_PAYLOAD_INVALID: {
             code: "STANDALONE_DAEMON_PAYLOAD_INVALID",
             description: "The daemon payload is not a bounded, link-free directory inside the project.",
@@ -532,6 +547,26 @@ export const ERROR_REGISTRY = {
             description: "The portal format or alias in dsm-package.yaml is invalid.",
             suggestion: "Use portal: {} or portal: { alias: my-app }; alias is 1-64 lowercase alphanumerics or -, and not a DSM reserved path.",
         },
+        STANDALONE_CONSOLE_INVALID: {
+            code: "STANDALONE_CONSOLE_INVALID",
+            description: "The console format or title in dsm-package.yaml is invalid.",
+            suggestion: 'Use console: {} for "<displayname> for DSM", or console: { title: My App Admin } with 1-64 characters and no quotes, backslashes or control characters.',
+        },
+        STANDALONE_CONSOLE_REQUIRES_GATEWAY: {
+            code: "STANDALONE_CONSOLE_REQUIRES_GATEWAY",
+            description: "console is declared on a Compose App or an App without identity_gateway.",
+            suggestion: "Declare console only on a native App whose web UI the identity gateway serves; otherwise remove console and keep one icon.",
+        },
+        STANDALONE_CONSOLE_LAUNCH: {
+            code: "STANDALONE_CONSOLE_LAUNCH",
+            description: "console is declared together with ui.launch.",
+            suggestion: "Remove ui.launch: the console always opens in a DSM window and the native icon in a new tab.",
+        },
+        STANDALONE_CONSOLE_PORTAL: {
+            code: "STANDALONE_CONSOLE_PORTAL",
+            description: "console is declared together with portal.",
+            suggestion: "Declare either console or portal, not both.",
+        },
         STANDALONE_PORTAL_REQUIRES_EXECUTOR: {
             code: "STANDALONE_PORTAL_REQUIRES_EXECUTOR",
             description: "An App targeting DSM below 7.2-64570 declares portal without an executor.",

package/dist/runtime/executor-digests.json

@@ -1,16 +1,5 @@
 {
-    "0.24.0": {
-        "x86_64": "de78684faac211c24a7cda8a4541ab1b138d37f6d580936fe354bb9bd0d78a0f",
-        "aarch64": "8ef7c736203f6c111816b76f970b7204fa6f8d871ff3222fd7c0a27d0075b847",
-        "armv7": "a38703119554b5f2a8bf4810ec2a6c8f1d793bfbb1ca96803eb1b39a26ffd96c",
-        "lifecycle": {
-            "x86_64": "c6fbb377ecd5ec7ee5b96439f22091d9fa5965dfd616d510ca9445722f436721",
-            "aarch64": "a9ca1750d4d5cff4727dc29789e6eaf0a365cb0e674f1bb796971d82f2d4fa27",
-            "armv7": "6d25fc972eba12e3ac68f8b6a95a45e9e5706ebe19ffc1ff774fc318acbeb90f"
-        },
-        "goToolchain": "go1.26.10"
-    },
-    "0.24.1": {
+    "0.25.0": {
         "x86_64": "de78684faac211c24a7cda8a4541ab1b138d37f6d580936fe354bb9bd0d78a0f",
         "aarch64": "8ef7c736203f6c111816b76f970b7204fa6f8d871ff3222fd7c0a27d0075b847",
         "armv7": "a38703119554b5f2a8bf4810ec2a6c8f1d793bfbb1ca96803eb1b39a26ffd96c",

package/dist/runtime/sdk-source.js

@@ -76,7 +76,7 @@ function goMod(backendDir) {
     }
 }
 /** SDK releases that reuse an immutable executor release with identical payload bytes. */
-const EXECUTOR_RELEASES = { '0.21.0': '0.20.0', '0.21.1': '0.20.0', '0.22.0': '0.20.0', '0.23.0': '0.20.0', '0.23.1': '0.20.0', '0.23.2': '0.20.0', '0.24.1': '0.24.0' };
+const EXECUTOR_RELEASES = { '0.21.0': '0.20.0', '0.21.1': '0.20.0', '0.22.0': '0.20.0', '0.23.0': '0.20.0', '0.23.1': '0.20.0', '0.23.2': '0.20.0', '0.24.1': '0.24.0', '0.25.0': '0.24.0' };
 /**
  * The module directories of one SDK version. SYNOPKGLAND_SDK_DIR names a
  * local sdk checkout (development and gates only); otherwise modules come from

package/dist/standalone/daemon-ingress.d.ts

@@ -0,0 +1,21 @@
+import type { StandaloneError } from "./manifest.js";
+/** `daemon.ingress`: one path in DSM's own server blocks, proxied to the daemon. */
+export interface DaemonIngress {
+    /** `/<name>/`, served on DSM's ports and custom domains, so same-origin with DSM. */
+    path: string;
+    /** nginx proxy_read_timeout and proxy_send_timeout in seconds. */
+    timeout: number;
+}
+export declare const DAEMON_INGRESS_CONFIG = "daemon/ingress-nginx.conf";
+export declare function readDaemonIngress(value: unknown, fail: (error: StandaloneError) => void): DaemonIngress | undefined;
+/** DSM before 7.2 rejects an unsigned web-config, the worker this path uses. */
+export declare function daemonIngressMinDsmProblem(osMinVer: string | undefined): string | undefined;
+export declare const daemonIngressSocket: (pkg: string) => string;
+/** What the daemon learns: where to listen and which path prefix it serves. */
+export declare function ingressEnv(pkg: string, ingress: DaemonIngress): Record<string, string>;
+export declare function daemonIngressResource(): Record<string, unknown>;
+/**
+ * Included in DSM's own server blocks. Streaming responses (SSE) pass
+ * unbuffered; nginx replaces any client X-Real-IP with the peer address.
+ */
+export declare function renderDaemonIngressConfig(pkg: string, ingress: DaemonIngress): string;

package/dist/standalone/daemon-ingress.js

@@ -0,0 +1,61 @@
+import { isDsmAtLeast, PORTAL_MIN_DSM } from "../build-spk/dsm-version.js";
+import { RESERVED_PORTAL_ALIASES } from "../portal/alias.js";
+export const DAEMON_INGRESS_CONFIG = "daemon/ingress-nginx.conf";
+const PATH = /^\/[a-z0-9](?:[a-z0-9-]{0,62}[a-z0-9])?\/$/;
+const reserved = (path) => RESERVED_PORTAL_ALIASES.includes(path.slice(1, -1));
+export function readDaemonIngress(value, fail) {
+    if (value === undefined)
+        return undefined;
+    const v = value && typeof value === "object" && !Array.isArray(value) ? value : undefined;
+    const timeout = v?.timeout ?? 3600;
+    if (!v ||
+        Object.keys(v).some((k) => k !== "path" && k !== "timeout") ||
+        typeof v.path !== "string" ||
+        !PATH.test(v.path) ||
+        reserved(v.path) ||
+        !Number.isInteger(timeout) ||
+        timeout < 1 ||
+        timeout > 3600) {
+        fail({
+            code: "STANDALONE_DAEMON_INGRESS_INVALID",
+            message: `daemon.ingress needs path "/<name>/" (lowercase letters, digits and -, not a DSM path such as /webapi/) and an optional timeout of 1–3600 seconds.`,
+        });
+        return undefined;
+    }
+    return { path: v.path, timeout: timeout };
+}
+/** DSM before 7.2 rejects an unsigned web-config, the worker this path uses. */
+export function daemonIngressMinDsmProblem(osMinVer) {
+    if (osMinVer && isDsmAtLeast(osMinVer, PORTAL_MIN_DSM))
+        return undefined;
+    return `daemon.ingress needs os_min_ver ${PORTAL_MIN_DSM} or later; os_min_ver is "${osMinVer ?? ""}". DSM 7.1 rejects the unsigned web-config worker that adds the path to DSM's nginx. Raise os_min_ver or remove daemon.ingress.`;
+}
+export const daemonIngressSocket = (pkg) => `/tmp/synopkgland-ingress-${pkg}.sock`;
+/** What the daemon learns: where to listen and which path prefix it serves. */
+export function ingressEnv(pkg, ingress) {
+    return { SYNOPKGLAND_INGRESS_PATH: ingress.path, SYNOPKGLAND_INGRESS_SOCKET: daemonIngressSocket(pkg) };
+}
+export function daemonIngressResource() {
+    return { "nginx-static-config": { enable: [{ type: "dsm", relpath: DAEMON_INGRESS_CONFIG }] } };
+}
+/**
+ * Included in DSM's own server blocks. Streaming responses (SSE) pass
+ * unbuffered; nginx replaces any client X-Real-IP with the peer address.
+ */
+export function renderDaemonIngressConfig(pkg, ingress) {
+    return `location ^~ ${ingress.path} {
+    proxy_pass http://unix:${daemonIngressSocket(pkg)}:;
+    proxy_http_version 1.1;
+    proxy_set_header Host $http_host;
+    proxy_set_header X-Real-IP $remote_addr;
+    proxy_set_header Connection "";
+    proxy_buffering off;
+    proxy_request_buffering off;
+    proxy_cache off;
+    gzip off;
+    proxy_read_timeout ${ingress.timeout}s;
+    proxy_send_timeout ${ingress.timeout}s;
+    client_max_body_size 8m;
+}
+`;
+}

package/dist/standalone/daemon.d.ts

@@ -1,4 +1,6 @@
 import type { NativeArchFamily } from "../build-spk/dsm-arch.js";
+import { NODE_PACKAGES } from "./bridge-backend.js";
+import { type DaemonIngress } from "./daemon-ingress.js";
 import type { CommandRunner } from "./build.js";
 import type { StandaloneError, StandaloneManifest } from "./manifest.js";
 export interface Daemon {
@@ -17,7 +19,26 @@ export interface Daemon {
         status: number;
         uninstall: number;
     };
+    /** `exec` is a JavaScript entry run by the node of a Package Center Node.js package. */
+    node?: DaemonNode;
+    /** A same-origin DSM path that nginx proxies to the daemon's Unix socket. */
+    ingress?: DaemonIngress;
 }
+export interface DaemonNode {
+    package: (typeof NODE_PACKAGES)[number];
+    /** The lowest package version INFO install_dep_packages accepts. */
+    min_version?: string;
+}
+/** The CLI-generated launcher; the payload must not ship its own directory. */
+export declare const NODE_LAUNCHER = "_synopkgland/node";
+export declare const nodeBinary: (pkg: string) => string;
+/** INFO install_dep_packages for a Node daemon. */
+export declare function nodeDependency(node: DaemonNode): string;
+/**
+ * Runs the dependency's node in place of the shell, so daemon/control
+ * supervises node itself. A removed dependency fails start with a clear line.
+ */
+export declare function renderNodeLauncher(node: DaemonNode): string;
 /** A fixed argv or env value: only the package's own directories expand. */
 export declare const token: (v: unknown) => v is string;
 /** An application variable that cannot steer the loader, the shell or DSM. */
@@ -26,6 +47,11 @@ export declare const envKey: (k: string) => boolean;
 export declare const relativeExec: (v: unknown) => v is string;
 export declare function readDaemon(value: unknown, root: string, arches: NativeArchFamily[], fail: (error: StandaloneError) => void): Daemon | undefined;
 export declare function daemonConfig(manifest: StandaloneManifest): string;
+/**
+ * The argv and environment daemon/control runs: a Node daemon execs the
+ * launcher with its entry first, and ingress names the socket to listen on.
+ */
+export declare function runnableDaemon(pkg: string, daemon: Daemon): Daemon;
 export declare function buildDaemonControl(manifest: StandaloneManifest, arch: NativeArchFamily, work: string, run: CommandRunner): Promise<string | undefined>;
 export declare function copyDaemonPayload(manifest: StandaloneManifest, arch: NativeArchFamily, target: string, controller: string): void;
 /** Copies a bounded, link-free package-account payload tree. */

package/dist/standalone/daemon.js

@@ -1,14 +1,37 @@
 import { operationBudgetSeconds, runtimeBudgetSdkSupported } from "../runtime/runtime-budgets.js";
 import { goChildEnv } from "../runtime/go-env.js";
 import { chmodSync, existsSync, copyFileSync, lstatSync, mkdirSync, readdirSync, realpathSync, writeFileSync, } from "node:fs";
-import { isAbsolute, join, relative, resolve } from "node:path";
+import { dirname, isAbsolute, join, relative, resolve } from "node:path";
 import { PINNED_GO_HINT, pinnedGoBuildEnv, pinnedGoProblem, } from "../build-spk/go-toolchain.js";
 import { sdkSource, appSdkVersion } from "../runtime/sdk-source.js";
 import { templateSdkVersion } from "../template-paths.js";
 import { checkCgiBinary } from "./binary.js";
+import { NODE_PACKAGES } from "./bridge-backend.js";
+import { readDaemonIngress, ingressEnv } from "./daemon-ingress.js";
 import { composeDaemon, composeNetwork } from "./compose.js";
 import { gatewayDaemon } from "./identity-gateway.js";
 import { StandaloneBuildError } from "./spk.js";
+/** The CLI-generated launcher; the payload must not ship its own directory. */
+export const NODE_LAUNCHER = "_synopkgland/node";
+export const nodeBinary = (pkg) => `/var/packages/${pkg}/target/usr/local/bin/node`;
+/** INFO install_dep_packages for a Node daemon. */
+export function nodeDependency(node) {
+    return node.min_version ? `${node.package}>=${node.min_version}` : node.package;
+}
+/**
+ * Runs the dependency's node in place of the shell, so daemon/control
+ * supervises node itself. A removed dependency fails start with a clear line.
+ */
+export function renderNodeLauncher(node) {
+    return `#!/bin/sh
+node=${nodeBinary(node.package)}
+if [ ! -x "$node" ]; then
+  echo "${node.package} is not installed or is incomplete; install it in Package Center." >&2
+  exit 127
+fi
+exec "$node" "$@"
+`;
+}
 const fields = new Set([
     "exec",
     "targets",
@@ -16,6 +39,8 @@ const fields = new Set([
     "env",
     "timeouts",
     "uninstall_args",
+    "node",
+    "ingress",
 ]);
 const record = (v) => Boolean(v) && typeof v === "object" && !Array.isArray(v);
 /** A fixed argv or env value: only the package's own directories expand. */
@@ -34,6 +59,8 @@ export const relativeExec = (v) => typeof v === "string" &&
     v.length <= 200 &&
     /^[A-Za-z0-9_-]+(?:\/[A-Za-z0-9_.-]+)*$/.test(v) &&
     !v.split("/").some((p) => p === "." || p === "..");
+/** A Node entry such as `server.mjs` or `dist/main.js`, inside the payload. */
+const relativeEntry = (v) => typeof v === "string" && relativeExec(`_/${v}`);
 export function readDaemon(value, root, arches, fail) {
     if (value === undefined)
         return undefined;
@@ -46,7 +73,7 @@ export function readDaemon(value, root, arches, fail) {
     };
     if (!record(value) || Object.keys(value).some((k) => !fields.has(k)))
         return invalid();
-    if (!relativeExec(value.exec))
+    if (!(value.node === undefined ? relativeExec(value.exec) : relativeEntry(value.exec)))
         return invalid();
     if (!record(value.targets) ||
         Object.keys(value.targets).length !== arches.length)
@@ -83,6 +110,14 @@ export function readDaemon(value, root, arches, fail) {
     const timeouts = readLifecycleTimeouts(value.timeouts, fail);
     if (!timeouts)
         return undefined;
+    const node = readDaemonNode(value.node, fail);
+    if (value.node !== undefined && !node)
+        return undefined;
+    const ingress = readDaemonIngress(value.ingress, fail);
+    if (value.ingress !== undefined && !ingress)
+        return undefined;
+    if (ingress && Object.keys(env).some((key) => key in ingressEnv("", ingress)))
+        return invalid();
     return {
         exec: value.exec,
         targets,
@@ -92,8 +127,31 @@ export function readDaemon(value, root, arches, fail) {
             .sort()
             .map((key) => [key, env[key]])),
         timeouts: timeouts,
+        ...(node ? { node } : {}),
+        ...(ingress ? { ingress } : {}),
     };
 }
+function readDaemonNode(value, fail) {
+    if (value === undefined)
+        return undefined;
+    const pkg = record(value) ? value.package : undefined;
+    const min = record(value) ? value.min_version : undefined;
+    const major = typeof pkg === "string" ? pkg.replace("Node.js_v", "") : "";
+    if (!record(value) ||
+        Object.keys(value).some((k) => k !== "package" && k !== "min_version") ||
+        !NODE_PACKAGES.includes(pkg) ||
+        (min !== undefined &&
+            (typeof min !== "string" ||
+                !/^[0-9]{1,3}(\.[0-9]{1,4}){0,2}$/.test(min) ||
+                min.split(".")[0] !== major))) {
+        fail({
+            code: "STANDALONE_DAEMON_NODE_INVALID",
+            message: `daemon.node needs package (${NODE_PACKAGES.join(", ")}) and an optional min_version of that major, such as "22.19.0".`,
+        });
+        return undefined;
+    }
+    return { package: pkg, ...(min ? { min_version: min } : {}) };
+}
 function daemonSdkVersion(manifest) {
     return manifest.identityGateway?.sdk ??
         (manifest.backend.kind === "go" ? appSdkVersion(manifest.backend) : undefined) ??
@@ -104,7 +162,7 @@ export function daemonConfig(manifest) {
         ? composeDaemon(manifest)
         : manifest.identityGateway
             ? gatewayDaemon(manifest.daemon)
-            : manifest.daemon;
+            : runnableDaemon(manifest.package, manifest.daemon);
     return (JSON.stringify({
         package: manifest.package,
         exec,
@@ -117,6 +175,20 @@ export function daemonConfig(manifest) {
         ...(manifest.compose ? { network: composeNetwork(manifest) } : {}),
     }) + "\n");
 }
+/**
+ * The argv and environment daemon/control runs: a Node daemon execs the
+ * launcher with its entry first, and ingress names the socket to listen on.
+ */
+export function runnableDaemon(pkg, daemon) {
+    const entry = daemon.node && [`\${SYNOPKG_PKGDEST}/daemon/payload/${daemon.exec}`];
+    const env = daemon.ingress ? { ...daemon.env, ...ingressEnv(pkg, daemon.ingress) } : daemon.env;
+    return {
+        ...daemon,
+        ...(entry ? { exec: NODE_LAUNCHER, args: [...entry, ...daemon.args] } : {}),
+        ...(entry && daemon.uninstall_args ? { uninstall_args: [...entry, ...daemon.uninstall_args] } : {}),
+        env: Object.fromEntries(Object.keys(env).sort().map((key) => [key, env[key]])),
+    };
+}
 export async function buildDaemonControl(manifest, arch, work, run) {
     if (!manifest.daemon && !(manifest.compose && manifest.identityGateway))
         return undefined;
@@ -151,7 +223,18 @@ export function copyDaemonPayload(manifest, arch, target, controller) {
         copyPayloadTree(manifest.root, source, join(target, "payload"));
     else
         mkdirSync(join(target, "payload"), { recursive: true });
-    if (!manifest.compose) {
+    if (!manifest.compose && manifest.daemon?.node) {
+        const exec = join(source, daemon.exec);
+        if (!existsSync(exec) || !lstatSync(exec).isFile())
+            throw new StandaloneBuildError("STANDALONE_DAEMON_PAYLOAD_INVALID", `daemon.exec must name the Node entry file inside the payload: ${exec}`);
+        if (existsSync(join(source, NODE_LAUNCHER.split("/")[0])))
+            throw new StandaloneBuildError("STANDALONE_DAEMON_PAYLOAD_INVALID", `The daemon payload must not contain ${NODE_LAUNCHER.split("/")[0]}/; the CLI writes its Node launcher there.`);
+        mkdirSync(join(target, "payload", dirname(NODE_LAUNCHER)), { recursive: true });
+        chmodSync(join(target, "payload", dirname(NODE_LAUNCHER)), 0o755);
+        writeFileSync(join(target, "payload", NODE_LAUNCHER), renderNodeLauncher(manifest.daemon.node));
+        chmodSync(join(target, "payload", NODE_LAUNCHER), 0o755);
+    }
+    else if (!manifest.compose) {
         const exec = join(source, daemon.exec);
         const problem = checkCgiBinary(manifest.root, exec, arch);
         if (problem)

package/dist/standalone/dsm-window.d.ts

@@ -25,8 +25,13 @@ export declare function windowScriptName(manifest: Pick<StandaloneManifest, "bui
 /** The launcher fields an entry mode fixes; inspect checks a built SPK against them. */
 export declare function entryLauncherAccess(entry: EntryMode): Record<string, unknown>;
 export declare function appTitle(manifest: StandaloneManifest): AppTitle;
+/** The DSM app class whose launch opens the SDK window: the console's when the App declares one. */
+export declare function windowAppId(manifest: Pick<StandaloneManifest, "package" | "console">): string;
 /**
- * `ui/config`: registers the DSM main-menu app and its window class. A portal
+ * `ui/config`: registers the DSM main-menu app and its window class. With a
+ * console, `.Instance` is the gateway's url launcher (new tab) and `.Console`
+ * the administrator-only window; DSM lists only `.Instance` under Application
+ * Privileges. A portal
  * App's launcher also carries the Login Portal style and its icon as the
  * login page icon (DSM shows `loginIcon`, never `icon`, there).
  */

package/dist/standalone/dsm-window.js

@@ -9,7 +9,7 @@ import { HOST_ADAPTER_RUNTIME } from "./host-adapter.js";
 import { permitsOrdinaryUsers } from "./api-permissions.js";
 import { portalRuntime } from "./portal-window.js";
 import { portalByExecutor } from "../build-spk/dsm-version.js";
-import { uiTitleFields } from "../build-spk/ui-texts.js";
+import { consoleTitle, uiConsoleTitleFields, uiTitleFields } from "../build-spk/ui-texts.js";
 import { packageIcons, windowIconFile, windowIconTemplate, } from "../build-spk/dsm-icons.js";
 import { DEFAULT_WINDOW, FULL_PAGE_MIN_WIDTH } from "./window-size.js";
 import { requestTimeoutSeconds } from "./request-timeout.js";
@@ -74,7 +74,7 @@ function launcherAccess(manifest) {
     return manifest.entry
         ? entryLauncherAccess(manifest.entry)
         : {
-            allUsers: manifest.compose
+            allUsers: manifest.compose || manifest.console
                 ? manifest.identityGateway?.access !== "dsm-admins"
                 : permitsOrdinaryUsers(manifest.apiPermissions),
         };
@@ -92,19 +92,35 @@ export function appTitle(manifest) {
         info: manifest.i18n?.info,
     };
 }
-/** The app name by locale, as `ui/texts` names the window: `createI18n(lang, ...).t("app_title")`. */
+/**
+ * The window's name by locale, as `ui/texts` names it: `createI18n(lang,
+ * ...).t("app_title")`. A console window carries the console's name.
+ */
 function displayNameCatalogs(manifest) {
+    const name = (displayname) => manifest.console ? consoleTitle(displayname, manifest.console) : displayname;
     const catalogs = {
-        en: { app_title: manifest.displayname },
+        en: { app_title: name(manifest.displayname) },
     };
     for (const [locale, text] of Object.entries(manifest.i18n?.info ?? {})) {
         if (text?.displayname)
-            catalogs[locale] = { app_title: text.displayname };
+            catalogs[locale] = { app_title: name(text.displayname) };
     }
     return catalogs;
 }
+/** The DSM app class whose launch opens the SDK window: the console's when the App declares one. */
+export function windowAppId(manifest) {
+    return `SYNO.SDS.${manifest.package}.${manifest.console ? "Console" : "Instance"}`;
+}
+/** Whether the window itself resumes a cold DSM sign-in; with a console the url launcher does. */
+function windowResumesOIDC(manifest) {
+    const oidc = manifest.identityGateway?.oidc;
+    return Boolean((oidc?.native_login || oidc?.browser) && !manifest.console);
+}
 /**
- * `ui/config`: registers the DSM main-menu app and its window class. A portal
+ * `ui/config`: registers the DSM main-menu app and its window class. With a
+ * console, `.Instance` is the gateway's url launcher (new tab) and `.Console`
+ * the administrator-only window; DSM lists only `.Instance` under Application
+ * Privileges. A portal
  * App's launcher also carries the Login Portal style and its icon as the
  * login page icon (DSM shows `loginIcon`, never `icon`, there).
  */
@@ -127,6 +143,38 @@ export function renderUiConfig(manifest, icons = packageIcons(manifest.icon), lo
             },
         }, null, 2) + "\n");
     }
+    if (manifest.console) {
+        const consoleFields = uiConsoleTitleFields(appTitle(manifest), manifest.console);
+        return `${JSON.stringify({
+            ".url": {
+                [`${ns}.Instance`]: {
+                    type: "url",
+                    ...titleFields,
+                    icon,
+                    ...launcherAccess(manifest),
+                    url: gatewayEntryPath(manifest),
+                },
+            },
+            [windowScriptName(manifest)]: {
+                [`${ns}.Console`]: {
+                    type: "app",
+                    ...consoleFields,
+                    icon,
+                    appWindow: `${ns}.MainWindow`,
+                    allowMultiInstance: false,
+                    allUsers: false,
+                    depend: [`${ns}.MainWindow`],
+                },
+                [`${ns}.MainWindow`]: {
+                    type: "lib",
+                    title: consoleFields.title,
+                    texts: consoleFields.texts,
+                    icon,
+                    depend: [],
+                },
+            },
+        }, null, 2)}\n`;
+    }
     return `${JSON.stringify({
         [windowScriptName(manifest)]: {
             [`${ns}.Instance`]: {
@@ -379,7 +427,7 @@ ${ns}.prepareFullPage = function (title) {
   favicon.href = ${ns}.appIcon;
 };
 
-${(manifest.identityGateway?.oidc?.native_login || manifest.identityGateway?.oidc?.browser) ? `${ns}.resumeOIDC = ${oidcResumeRuntime(pkg, Object.values(manifest.identityGateway.listen).filter((p) => typeof p === "number"))};` : ""}
+${windowResumesOIDC(manifest) ? `${ns}.resumeOIDC = ${oidcResumeRuntime(pkg, Object.values(manifest.identityGateway.listen).filter((p) => typeof p === "number"))};` : ""}
 
 // DSM reopens a window at the size it was last left at, even one saved on a
 // larger screen, and only moves a window that does not fit: keep it inside.
@@ -390,7 +438,7 @@ ${ns}.fitDesktop = function (size) {
   return size;
 };
 
-Ext.define(${JSON.stringify(`${ns}.Instance`)}, {
+Ext.define(${JSON.stringify(windowAppId(manifest))}, {
   extend: "SYNO.SDS.AppInstance",
   appWindowName: ${JSON.stringify(`${ns}.MainWindow`)}
 });
@@ -408,7 +456,7 @@ Ext.define(${JSON.stringify(`${ns}.MainWindow`)}, {
   },
   onOpen: function (param) {
     this.callParent(arguments);
-    ${(manifest.identityGateway?.oidc?.native_login || manifest.identityGateway?.oidc?.browser) ? `if (${ns}.resumeOIDC(param)) return;` : ""}
+    ${windowResumesOIDC(manifest) ? `if (${ns}.resumeOIDC(param)) return;` : ""}
     var me = this;
     if (me.mounted) {
       me.reopenEvents.emit();
@@ -471,7 +519,7 @@ ${root ? root.mount : ""}    ${ns}.loadApp(function (app) {
   // with that launch's param. Before the App mounts, it mounts with the latest.
   onRequest: function (param) {
     this.callParent(arguments);
-    ${(manifest.identityGateway?.oidc?.native_login || manifest.identityGateway?.oidc?.browser) ? `if (${ns}.resumeOIDC(param)) return;` : ""}
+    ${windowResumesOIDC(manifest) ? `if (${ns}.resumeOIDC(param)) return;` : ""}
     var params = ${ns}.launchParams(param);
     if (!this.mounted) {
       if (this.mountPending && Object.keys(params).length) this.launchParams = params;