@synopackageland/cli 0.24.1 → 0.25.1

package/dist/standalone/inspect-spk.js

@@ -21,7 +21,8 @@ import { familyOfArchToken, NATIVE_ARCH_FAMILIES, } from "../build-spk/dsm-arch.
 import { CONTAINER_MIN_DSM, isDsmAtLeast, PORTAL_EXECUTOR_MIN_DSM, PORTAL_MIN_DSM, PORTAL_MIN_DSM_REASON, } from "../build-spk/dsm-version.js";
 import { ELF_MACHINE } from "./binary.js";
 import { CGI_PAYLOAD_PATH, entryLauncherAccess } from "./dsm-window.js";
-import { daemonConfig, readDaemon, readLifecycleTimeouts } from "./daemon.js";
+import { daemonConfig, readDaemon, readLifecycleTimeouts, renderNodeLauncher, nodeDependency, NODE_LAUNCHER } from "./daemon.js";
+import { DAEMON_INGRESS_CONFIG, daemonIngressMinDsmProblem, readDaemonIngress, renderDaemonIngressConfig } from "./daemon-ingress.js";
 import { ROOT_SCRIPT_HINTS } from "./root-ops.js";
 import { DELETE_STATE_KEY } from "../build-spk/uninstall-wizard.js";
 import { readUninstallRecord, stateItemTexts } from "./uninstall.js";
@@ -36,7 +37,7 @@ import { renderNativePrivilege } from "../build-spk/native-lifecycle.js";
 import { renderUiConfig } from "./dsm-window.js";
 import { identityGatewayConfig, gatewayAdmissionReport, gatewayAdmissionPolicy, readIdentityGateway, } from "./identity-gateway.js";
 import { checkCgiBinary } from "./binary.js";
-import { matchesStandaloneScript, renderStandaloneScript } from "./lifecycle.js";
+import { matchesStandaloneScript, renderStandaloneScript, matchesStandaloneScriptPrefix } from "./lifecycle.js";
 import { listPortExposures, loadCompose } from "../compose/analyze.js";
 import { uninstallCleanup, } from "../runtime/uninstall-cleanup.js";
 import { PORTAL_JSON_RELPATH, PORTAL_MUSTACHE_RELPATH, renderPortalJson, renderPortalLifecycle, renderPortalMustache, renderPortalWizardStep, } from "../portal/package.js";
@@ -112,7 +113,8 @@ export async function inspectSpk(spkPath, expectedKind) {
                     ].includes(String(name))) ||
                     new Set(raw.capabilities).size !== raw.capabilities.length ||
                     (raw.entry !== undefined &&
-                        !["admin-only", "app-privilege"].includes(raw.entry)))
+                        !["admin-only", "app-privilege"].includes(raw.entry)) ||
+                    (raw.console !== undefined && raw.console !== true))
                     throw new Error();
                 if (raw.lifecycleTimeouts !== undefined && (!readLifecycleTimeouts(raw.lifecycleTimeouts, () => { }) || Object.keys(raw.lifecycleTimeouts).length !== 4))
                     throw new Error();
@@ -154,12 +156,14 @@ export async function inspectSpk(spkPath, expectedKind) {
         const combined = metadata.compose === undefined
             ? undefined
             : await recoverCompose(dir, metadata.compose, findings);
-        const info = readInfo(join(dir, "INFO"), findings, kind, Boolean(combined));
+        const daemonNode = recoverDaemonNode(metadata.daemon_node, findings);
+        const info = readInfo(join(dir, "INFO"), findings, kind, Boolean(combined), daemonNode);
         if (combined &&
             (!info.os_min_ver || !isDsmAtLeast(info.os_min_ver, CONTAINER_MIN_DSM)))
             findings.push("compose identity_gateway requires DSM >= 7.2.1");
         await checkArch(dir, info, kind, paths.has(CGI_PAYLOAD_PATH), findings);
         const nativeGateway = await recoverNativeGateway(dir, metadata.native_gateway, info, findings);
+        const daemonIngress = await recoverDaemonIngress(dir, metadata.daemon_ingress, info, paths, findings);
         const background = compiledKind && paths.has(BACKGROUND_WORKER_PAYLOAD);
         // Before any fixed-lifecycle comparison: those see the SDK steps alone.
         const appScripts = standalone || kind === "container"
@@ -178,7 +182,7 @@ export async function inspectSpk(spkPath, expectedKind) {
             !isDsmAtLeast(info.os_min_ver, PORTAL_MIN_DSM)) {
             findings.push(`INFO os_min_ver "${info.os_min_ver}" is below the DSM ${PORTAL_MIN_DSM} a portal needs; ${PORTAL_MIN_DSM_REASON}`);
         }
-        checkConf(dir, findings, kind, background, sharedFolder, info.package, portal, combined?.compose, nativeGateway, info.os_min_ver);
+        checkConf(dir, findings, kind, background, sharedFolder, info.package, portal, combined?.compose, nativeGateway, info.os_min_ver, daemonIngress);
         checkScripts(dir, findings);
         checkUninstall(dir, findings);
         if (kind === "container")
@@ -206,7 +210,7 @@ export async function inspectSpk(spkPath, expectedKind) {
         if (standalone && portal)
             findings.push(...inspectPortalInfo(info, hasExecutor));
         const daemon = standalone
-            ? await checkDaemon(dir, info, paths, payload, findings, hasExecutor, background, combined, nativeGateway, uninstallHook?.uninstall)
+            ? await checkDaemon(dir, info, paths, payload, findings, hasExecutor, background, combined, nativeGateway, uninstallHook?.uninstall, { ingress: daemonIngress, node: daemonNode })
             : undefined;
         if (background)
             checkBackground(dir, info, payload, findings, hasExecutor, daemon, kind !== "native-go", metadata.lifecycleTimeouts, nativeGateway);
@@ -272,7 +276,7 @@ export async function inspectSpk(spkPath, expectedKind) {
         }
         if (metadata.entry)
             await checkEntryLauncher(dir, info.package, metadata.entry, findings);
-        const launch = await checkLaunchConfiguration(dir, info, standalone, metadata.launch, portal?.alias ?? executor?.policy.portal?.alias, findings);
+        const launch = await checkLaunchConfiguration(dir, info, standalone, metadata.launch, portal?.alias ?? executor?.policy.portal?.alias, findings, metadata.console === true);
         const loginStyle = standalone
             ? await inspectLoginStyle(dir, info.package, Boolean(portal || executor?.policy.portal), findings)
             : undefined;
@@ -336,7 +340,7 @@ export async function inspectSpk(spkPath, expectedKind) {
 const LAUNCHER_TYPE_MISMATCH = "LAUNCHER_TYPE_MISMATCH";
 const LAUNCHER_PORTAL_MISMATCH = "LAUNCHER_PORTAL_MISMATCH";
 /** Compare the actual launcher and Portal fields to the packaged declaration. */
-async function checkLaunchConfiguration(dir, info, native, declared, alias, findings) {
+async function checkLaunchConfiguration(dir, info, native, declared, alias, findings, console = false) {
     const target = join(dir, "launch-inspection");
     mkdirSync(target);
     await tar.x({
@@ -387,6 +391,10 @@ async function checkLaunchConfiguration(dir, info, native, declared, alias, find
     catch {
         /* report the missing or malformed launcher below */
     }
+    if (console) {
+        checkConsoleLaunchers(target, info, native, findings);
+        return launch;
+    }
     const type = dsmLauncherType(launch, native);
     if (!launcher ||
         launcher.type !== type ||
@@ -406,6 +414,35 @@ async function checkLaunchConfiguration(dir, info, native, declared, alias, find
     }
     return launch;
 }
+/**
+ * A console App's ui/config: `.Instance` is the url launcher to the gateway,
+ * `.Console` the administrator-only SDK window Package Center's Open starts.
+ */
+function checkConsoleLaunchers(target, info, native, findings) {
+    const ns = `SYNO.SDS.${info.package}`;
+    let config = {};
+    try {
+        config = JSON.parse(readFileSync(join(target, "ui/config"), "utf8"));
+    }
+    catch {
+        /* reported below as a missing launcher */
+    }
+    const find = (id) => Object.values(config).map((entries) => entries?.[id]).find(Boolean);
+    const instance = find(`${ns}.Instance`);
+    const console = find(`${ns}.Console`);
+    if (!native ||
+        instance?.type !== "url" ||
+        instance.url !== `/webman/3rdparty/${info.package}/sso/open.cgi` ||
+        console?.type !== "app" ||
+        console.appWindow !== `${ns}.MainWindow` ||
+        console.allUsers !== false ||
+        console.grantPrivilege !== undefined ||
+        info.dsmuidir !== "ui" ||
+        info.dsmappname !== `${ns}.Instance ${ns}.Console` ||
+        info.dsmapplaunchname !== `${ns}.Console`) {
+        findings.push(`${LAUNCHER_TYPE_MISMATCH} console requires a url launcher at ${ns}.Instance to sso/open.cgi, an administrator-only app launcher at ${ns}.Console and INFO dsmapplaunchname=${ns}.Console; rebuild with synopkgland build`);
+    }
+}
 /** The launcher in ui/config must carry exactly the access the declared entry mode fixes. */
 async function checkEntryLauncher(dir, pkg, entry, findings) {
     const target = join(dir, "entry-inspection");
@@ -813,7 +850,7 @@ async function recoverCompose(dir, value, findings) {
         return undefined;
     }
 }
-async function checkDaemon(dir, info, paths, payload, findings, executor, background, combined, nativeGateway, uninstall) {
+async function checkDaemon(dir, info, paths, payload, findings, executor, background, combined, nativeGateway, uninstall, extras = {}) {
     if (![...paths].some((path) => path.startsWith("daemon/")))
         return;
     if (info.precheckstartstop !== "yes")
@@ -827,7 +864,7 @@ async function checkDaemon(dir, info, paths, payload, findings, executor, backgr
     await tar.x({
         file: join(dir, "package.tgz"),
         cwd: unpacked,
-        filter: (path) => path.replace(/^\.\//, "") === "daemon/config.json",
+        filter: (path) => ["daemon/config.json", `daemon/payload/${NODE_LAUNCHER}`].includes(path.replace(/^\.\//, "")),
     });
     try {
         const config = JSON.parse(readFileSync(join(unpacked, "daemon/config.json"), "utf8"));
@@ -853,6 +890,14 @@ async function checkDaemon(dir, info, paths, payload, findings, executor, backgr
         }, dir, ["x86_64"], () => { });
         if (!daemon)
             throw new Error("invalid config");
+        // The packaged config already carries the launcher argv; only the launcher itself is checked here.
+        if (extras.node &&
+            (daemon.exec !== NODE_LAUNCHER ||
+                !daemon.args[0]?.startsWith("${SYNOPKG_PKGDEST}/daemon/payload/") ||
+                readOptional(join(unpacked, "daemon/payload", NODE_LAUNCHER)) !== renderNodeLauncher(extras.node)))
+            throw new Error("Node launcher differs from its build declaration");
+        if (extras.ingress)
+            daemon.ingress = extras.ingress;
         if (config.operation_seconds !== undefined && (!Number.isInteger(config.operation_seconds) || config.operation_seconds < 1 || config.operation_seconds > 3600))
             throw new Error('invalid operation budget');
         if (combined &&
@@ -921,7 +966,7 @@ function archivedInfoTranslations(info) {
     }
     return translations;
 }
-function readInfo(path, findings, kind, compose = false) {
+function readInfo(path, findings, kind, compose = false, daemonNode) {
     if (!existsSync(path)) {
         findings.push("INFO is missing");
         return {};
@@ -950,7 +995,10 @@ function readInfo(path, findings, kind, compose = false) {
             : kind === "native-node"
                 ? /^Node\.js_v[0-9]{2}([><=].*)?$/
                 : undefined;
-    if (info.install_dep_packages &&
+    if (daemonNode && info.install_dep_packages !== nodeDependency(daemonNode))
+        findings.push(`daemon.node requires INFO install_dep_packages="${nodeDependency(daemonNode)}"`);
+    else if (!daemonNode &&
+        info.install_dep_packages &&
         !(allowed &&
             info.install_dep_packages.split(":").every((dep) => allowed.test(dep)))) {
         findings.push(`INFO depends on other packages: ${info.install_dep_packages}`);
@@ -1054,7 +1102,44 @@ async function recoverNativeGateway(dir, value, info, findings) {
         return undefined;
     }
 }
-function checkConf(dir, findings, kind, background, sharedFolder, pkg, portal, compose, nativeGateway, osMinVer) {
+function recoverDaemonNode(value, findings) {
+    if (value === undefined)
+        return undefined;
+    const daemon = readDaemon({ exec: "x", targets: {}, node: value }, tmpdir(), [], () => { });
+    if (!daemon?.node || !isDeepStrictEqual(daemon.node, value)) {
+        findings.push("DAEMON_NODE_INVALID sdk-package.json daemon_node is not a Node.js package declaration build writes");
+        return undefined;
+    }
+    return daemon.node;
+}
+async function recoverDaemonIngress(dir, value, info, paths, findings) {
+    if (value === undefined)
+        return undefined;
+    try {
+        const ingress = readDaemonIngress(value, () => { });
+        if (!ingress || !isDeepStrictEqual(ingress, value))
+            throw new Error("invalid ingress record");
+        const minDsm = daemonIngressMinDsmProblem(info.os_min_ver);
+        if (minDsm)
+            throw new Error(minDsm);
+        if (!paths.has("daemon/config.json"))
+            throw new Error("ingress needs the package daemon");
+        const root = join(dir, "daemon-ingress-inspection");
+        mkdirSync(root);
+        await tar.x({ file: join(dir, "package.tgz"), cwd: root, filter: (path) => path.replace(/^\.\//, "") === DAEMON_INGRESS_CONFIG });
+        if (readOptional(join(root, DAEMON_INGRESS_CONFIG)) !== renderDaemonIngressConfig(info.package, ingress))
+            throw new Error("ingress location differs from its fixed proxy");
+        for (const key of ["instuninst_restart_services", "startstop_restart_services"])
+            if (!(info[key] ?? "").split(/\s+/).includes("nginx.service"))
+                throw new Error(`ingress requires INFO ${key}`);
+        return ingress;
+    }
+    catch (e) {
+        findings.push(`DAEMON_INGRESS_INVALID ${e.message}`);
+        return undefined;
+    }
+}
+function checkConf(dir, findings, kind, background, sharedFolder, pkg, portal, compose, nativeGateway, osMinVer, daemonIngress) {
     const confDir = join(dir, "conf");
     const entries = existsSync(confDir) ? readdirSync(confDir) : [];
     const nativeResource = kind !== "container"
@@ -1067,6 +1152,7 @@ function checkConf(dir, findings, kind, background, sharedFolder, pkg, portal, c
                 ? { jobs: { worker: "sha256-v1" } }
                 : {},
             ...(sharedFolder ? { sharedFolder } : {}),
+            ...(daemonIngress ? { daemon: { ingress: daemonIngress } } : {}),
         }, portal)
         : undefined;
     if (nativeResource !== undefined &&
@@ -1229,8 +1315,8 @@ async function inspectInstallSettings(dir, payload, metadata, findings) {
     mkdirSync(root);
     await tar.x({ file: join(dir, 'package.tgz'), cwd: root });
     const info = readInfo(join(dir, 'INFO'), findings, 'binary', Boolean(metadata.compose));
-    const gateway = metadata.compose?.gateway ?? (metadata.native_gateway ? { listen: metadata.native_gateway.listen } : undefined);
-    const m = { package: info.package, installSettings: settings, identityGateway: gateway };
+    const gateway = metadata.compose?.gateway ?? metadata.native_gateway;
+    const m = { package: info.package, os_min_ver: info.os_min_ver, capabilities: {}, installSettings: settings, identityGateway: gateway };
     try {
         if (readOptional(join(root, 'install/settings.json')) !== JSON.stringify(settingsConfig(m), null, 2) + '\n')
             throw new Error('settings inventory differs from its declaration or gateway port');
@@ -1243,7 +1329,8 @@ async function inspectInstallSettings(dir, payload, metadata, findings) {
         // App wrappers remain intact here; remove exactly the SDK prefix within them.
         for (const name of ['preinst', 'postinst', 'postupgrade', 'preuninst']) {
             const file = join(dir, 'scripts', name), text = readOptional(file), prefix = renderSettingsHook(name, m);
-            if (!text || !sdkScriptOf(name, text)?.sdk.startsWith('#!/bin/sh\n' + prefix) || text.split(prefix).length !== 2)
+            const sdk = text && sdkScriptOf(name, text)?.sdk;
+            if (!sdk || !matchesStandaloneScriptPrefix(name, m, sdk) || text.split(prefix).length !== 2)
                 throw new Error(`scripts/${name} lacks the exact SDK settings hook`);
             writeFileSync(file, text.replace(prefix, ''));
         }

package/dist/standalone/lifecycle.d.ts

@@ -1,5 +1,8 @@
 import type { StandaloneManifest } from "./manifest.js";
 /** Package-account lifecycle hooks for CGI, daemon and background packages. */
 export declare function renderStandaloneScript(name: string, manifest: StandaloneManifest): string;
+/** Settings inspection peels its hook only at the position build's renderer writes.
+ * The backend inspector then replays the entire remaining lifecycle script. */
+export declare function matchesStandaloneScriptPrefix(name: string, manifest: StandaloneManifest, actual: string): boolean;
 /** Accept the exact current, diagnostic-only, and released lifecycle variants. */
 export declare function matchesStandaloneScript(name: string, manifest: StandaloneManifest, actual: string | undefined): boolean;

package/dist/standalone/lifecycle.js

@@ -15,23 +15,37 @@ const UNINSTALL_ONLY = '[ "${SYNOPKG_PKG_STATUS:-}" = UPGRADE ] || synopkgland_u
 /** Package-account lifecycle hooks for CGI, daemon and background packages. */
 export function renderStandaloneScript(name, manifest) {
     const script = renderStandaloneScriptInternal(name, manifest);
-    const prepared = ['postinst', 'postupgrade'].includes(name) ? renderNativeGatewayPrepare(manifest) : '';
-    const prefix = renderNativeGatewayDiagnostic(manifest, name) + renderNativeGatewayPortWait(manifest, name) + renderSettingsHook(name, manifest) + prepared;
+    const prefix = renderStandaloneScriptPrefix(name, manifest);
     const sdk = prefix ? script.replace('#!/bin/sh\n', () => '#!/bin/sh\n' + prefix) : script;
     return manifest.appScripts?.some((app) => app === name)
         ? composeAppScript(name, sdk)
         : sdk;
 }
+function renderStandaloneScriptPrefix(name, manifest) {
+    const prepared = ['postinst', 'postupgrade'].includes(name) ? renderNativeGatewayPrepare(manifest) : '';
+    return renderNativeGatewayDiagnostic(manifest, name) + renderNativeGatewayPortWait(manifest, name) + renderSettingsHook(name, manifest) + prepared;
+}
+/** Settings inspection peels its hook only at the position build's renderer writes.
+ * The backend inspector then replays the entire remaining lifecycle script. */
+export function matchesStandaloneScriptPrefix(name, manifest, actual) {
+    const blocks = [renderNativeGatewayDiagnostic(manifest, name), renderNativeGatewayPortWait(manifest, name)].filter(Boolean);
+    return standaloneScriptVariants(name, manifest, renderStandaloneScriptPrefix(name, manifest)).some(prefix => actual.startsWith('#!/bin/sh\n' + prefix) &&
+        // A released prefix omits these blocks entirely; moving one after the
+        // settings hook must not masquerade as that released variant.
+        blocks.every(block => prefix.includes(block) || !actual.includes(block)));
+}
 /** Accept the exact current, diagnostic-only, and released lifecycle variants. */
 export function matchesStandaloneScript(name, manifest, actual) {
-    const expected = renderStandaloneScript(name, manifest);
-    if (actual === expected)
-        return true;
+    return actual !== undefined && standaloneScriptVariants(name, manifest, renderStandaloneScript(name, manifest)).includes(actual);
+}
+function standaloneScriptVariants(name, manifest, expected) {
     const diagnostic = renderNativeGatewayDiagnostic(manifest, name);
     const wait = renderNativeGatewayPortWait(manifest, name);
     const diagnosticOnly = wait ? expected.replace(wait, '') : expected;
-    return (wait !== '' && actual === diagnosticOnly) ||
-        (diagnostic !== '' && actual === diagnosticOnly.replace(diagnostic, ''));
+    const variants = [expected, ...(wait ? [diagnosticOnly] : []), ...(diagnostic ? [diagnosticOnly.replace(diagnostic, '')] : [])];
+    // Released packages stop the daemon in preupgrade without the first-daemon guard.
+    const unguarded = (v) => v.replace(daemonGuard(manifest.package), '').replace(delegatedDaemonGuard(manifest.package), '');
+    return name === 'preupgrade' ? [...new Set([...variants, ...variants.map(unguarded)])] : variants;
 }
 function renderStandaloneScriptInternal(name, manifest) {
     if (manifest.compose) {
@@ -201,11 +215,11 @@ function renderDelegatedDaemonScript(name, manifest) {
     const worker = (action) => `/usr/syno/bin/synosystemctl ${action} ${backgroundUnitName(pkg)}`;
     // Try every owner even on failure; never leave protected ingress open merely
     // because a producer could not stop. A partial teardown remains a failure.
-    const stop = (daemonAction, executorAction, executorStop = executor(executorAction)) => `result=0\nstop_background_worker || result=1\n${daemon} ${daemonAction} ${paths} || result=1\n${executorStop} || result=1\nexit "$result"\n`;
+    const stop = (daemonAction, executorAction, executorStop = executor(executorAction), guard = "") => `result=0\nstop_background_worker || result=1\n${guard}${daemon} ${daemonAction} ${paths} || result=1\n${executorStop} || result=1\nexit "$result"\n`;
     const workerStop = renderBackgroundWorkerStop(pkg);
     if (name !== "start-stop-status") {
         if (name === "preupgrade")
-            return `#!/bin/sh\n${renderExecutorUpgradeStop(pkg)}${workerStop}${stop("stop", "stop", UPGRADE_STOP)}`;
+            return `#!/bin/sh\n${renderExecutorUpgradeStop(pkg)}${workerStop}${stop("stop", "stop", UPGRADE_STOP, delegatedDaemonGuard(pkg))}`;
         const purge = manifest.uninstall
             ? stop(manifest.daemon?.uninstall_args ? "uninstall" : "stop", "purge $synopkgland_purge_args").replace(executor("purge $synopkgland_purge_args"), () => `synopkgland_uninstall_hook\n${executor("purge $synopkgland_purge_args")}`)
             : stop(manifest.daemon?.uninstall_args ? "uninstall" : "stop", "purge");
@@ -262,6 +276,17 @@ function renderExecutorUpgradeStop(pkg) {
 }
 `;
 }
+/**
+ * preupgrade runs before DSM replaces the payload, so it sees the outgoing
+ * package. Only a payload without any daemon/ is an upgrade that introduces
+ * the daemon; a partial or symlinked daemon/ still stops or fails closed.
+ */
+const daemonAbsent = (pkg) => {
+    const dir = `"\${SYNOPKG_PKGDEST:-/var/packages/${pkg}/target}/daemon"`;
+    return `[ ! -e ${dir} ] && [ ! -L ${dir} ]`;
+};
+const daemonGuard = (pkg) => `if ${daemonAbsent(pkg)}; then exit 0; fi\n`;
+const delegatedDaemonGuard = (pkg) => `${daemonAbsent(pkg)} || `;
 function renderDaemonScript(name, manifest) {
     const pkg = manifest.package;
     const control = `"/var/packages/${pkg}/target/daemon/control"`;
@@ -272,7 +297,7 @@ function renderDaemonScript(name, manifest) {
         const uninstall = name === "preuninst" && manifest.daemon?.uninstall_args;
         const upgrade = uninstall
             ? `if [ "\${SYNOPKG_PKG_STATUS:-}" = "UPGRADE" ]; then\n  exec ${control} stop ${paths}\nfi\n`
-            : "";
+            : name === "preupgrade" ? daemonGuard(pkg) : "";
         return `#!/bin/sh\n${upgrade}exec ${control} ${uninstall ? "uninstall" : "stop"} ${paths}\n`;
     }
     if (name !== "start-stop-status")

package/dist/standalone/manifest.d.ts

@@ -100,6 +100,12 @@ export interface StandaloneManifest {
     entry?: EntryMode;
     /** `portal`: registers the DSM Application Portal entry; an administrator activates it. */
     portal?: PortalDeclaration;
+    /**
+     * `console`: the main menu gets two icons, the gateway's native UI in a new
+     * tab and the SDK UI in an administrator-only DSM window titled `title`
+     * (default "<displayname> for DSM"). Absent keeps the single window icon.
+     */
+    console?: ConsoleDeclaration;
     /** The project's dsm-scripts/<DSM script name> files, each run inside the generated script of that name. */
     appScripts?: AppScriptName[];
     /** `icon`: a square PNG of at least 256 px, or a directory of icon_<size>.png; absent uses the SDK default. */
@@ -112,6 +118,9 @@ export interface StandaloneManifest {
  * accounts DSM's Control Panel > Application Privileges allows for the app.
  */
 export type EntryMode = "admin-only" | "app-privilege";
+export interface ConsoleDeclaration {
+    title?: string;
+}
 export interface Capabilities {
     composeMounts?: true;
     webapi?: WebAPIProfiles;

package/dist/standalone/manifest.js

@@ -11,6 +11,7 @@ import { checkGlossary, loadCatalogs, readInfoTranslations, } from "./i18n.js";
 import { loadRootOps, readRootSettings, rootBinaryProblem, ROOT_OPS_DIR, } from "./root-ops.js";
 import { readComposeApp } from "./compose.js";
 import { readDaemon, readLifecycleTimeouts } from "./daemon.js";
+import { daemonIngressMinDsmProblem } from "./daemon-ingress.js";
 import { readIdentityGateway, } from "./identity-gateway.js";
 import { readUninstall } from "./uninstall.js";
 import { readAppScripts } from "./app-scripts.js";
@@ -56,6 +57,7 @@ export const KNOWN_FIELDS = new Set([
     "uninstall",
     "entry",
     "portal",
+    "console",
     "icon",
     "reproducible",
     "root",
@@ -65,6 +67,7 @@ const I18N_FIELDS = new Set(["messages", "glossary", "info"]);
 const PACKAGE_ID = /^[A-Za-z][A-Za-z0-9]{1,63}$/;
 const VERSION = /^\d+(\.\d+){0,3}$/;
 const OS_MIN_VER = /^\d+\.\d+(\.\d+)?-\d+$/;
+const CONSOLE_TITLE = /^[^"\\\x00-\x1f\x7f]{1,64}$/;
 const GO_MAIN = /^\.\/[A-Za-z0-9_./-]*$/;
 function isRecord(value) {
     return typeof value === "object" && value !== null && !Array.isArray(value);
@@ -275,6 +278,13 @@ function readManifest(raw, c) {
         c.fail("COMPOSE_WEB_INVALID", "Compose upstream is derived from the SDK Compose ingress endpoint; remove identity_gateway.upstream.");
     // A failed Compose plan already explains the invalid upstream declaration.
     const identityGateway = raw.compose !== undefined && !compose ? undefined : readIdentityGateway(gatewayValue, daemon || (compose ? { targets: compose.targets } : undefined), (e) => c.fail(e.code, e.message), false, Boolean(compose?.plan.ingress));
+    if (daemon?.ingress) {
+        const problem = daemonIngressMinDsmProblem(osMinVer);
+        if (problem)
+            c.fail("STANDALONE_DAEMON_INGRESS_MIN_DSM", problem);
+    }
+    if ((daemon?.ingress || daemon?.node) && raw.identity_gateway !== undefined)
+        c.fail("STANDALONE_DAEMON_INVALID", "daemon.node and daemon.ingress run the App's own daemon; identity_gateway runs its gateway as the daemon. Use one or the other.");
     if (compose && identityGateway && compose.sdk !== identityGateway.sdk)
         c.fail("STANDALONE_IDENTITY_GATEWAY_INVALID", "compose and identity_gateway must use the same SDK release.");
     if (compose &&
@@ -399,6 +409,7 @@ function readManifest(raw, c) {
         : undefined;
     if (entryProblem)
         c.fail("STANDALONE_PORTAL_ENTRY_INVALID", entryProblem);
+    const dsmConsole = raw.console === undefined ? undefined : readConsole(raw, ui?.launch, c);
     const loginStyle = raw.login_style === undefined
         ? undefined
         : readLoginStyle(raw.login_style, raw.portal !== undefined, c);
@@ -454,6 +465,7 @@ function readManifest(raw, c) {
         ...(installSettings ? { installSettings } : {}),
         ...(entry ? { entry } : {}),
         ...(portal ? { portal } : {}),
+        ...(dsmConsole ? { console: dsmConsole } : {}),
         ...(icon ? { icon } : {}),
         ...(loginStyle ? { loginStyle } : {}),
         ...(appScripts ? { appScripts } : {}),
@@ -503,6 +515,30 @@ const LOGIN_STYLE_FIELDS = [
     "wallpaper_thumbnail",
     "title",
 ];
+/**
+ * `console`: {} or { title }. The native icon is the gateway's url launcher,
+ * so the App needs identity_gateway and its own SDK window; that window is the
+ * console, never a new page or a portal.
+ */
+function readConsole(raw, launch, c) {
+    const value = raw.console;
+    if (!isRecord(value) ||
+        Object.keys(value).some((k) => k !== "title") ||
+        (value.title !== undefined &&
+            (typeof value.title !== "string" || !CONSOLE_TITLE.test(value.title)))) {
+        c.fail("STANDALONE_CONSOLE_INVALID", 'console must be {} or { title: <1-64 characters, no quotes, backslashes or control characters> }.');
+        return undefined;
+    }
+    if (raw.identity_gateway === undefined || raw.compose !== undefined) {
+        c.fail("STANDALONE_CONSOLE_REQUIRES_GATEWAY", "console needs identity_gateway on an App with its own SDK UI: the native icon opens the gateway, the console opens the SDK UI. Compose and Apps without a gateway keep one icon.");
+        return undefined;
+    }
+    if (launch !== undefined)
+        c.fail("STANDALONE_CONSOLE_LAUNCH", "console always opens in a DSM window and the native icon in a new tab; remove ui.launch.");
+    if (raw.portal !== undefined)
+        c.fail("STANDALONE_CONSOLE_PORTAL", "console and portal both claim the App's SDK UI; declare one of them.");
+    return value.title === undefined ? {} : { title: value.title };
+}
 /** `login_style`: a portal's colour, wallpaper (with its thumbnail) and title image, each optional. */
 function readLoginStyle(value, portal, c) {
     const invalid = (message) => c.fail("STANDALONE_LOGIN_STYLE_INVALID", message);

package/dist/standalone/resource.d.ts

@@ -3,6 +3,7 @@ import type { Capabilities } from "./manifest.js";
 import { type SharedFolder } from "./shared-folder.js";
 import { type PortalPackage } from "../portal/package.js";
 import { type NativeGatewayPlan } from './native-gateway.js';
+import { type DaemonIngress } from "./daemon-ingress.js";
 /**
  * `conf/resource` for a native package: only DSM's official `data-share`,
  * `systemd-user-unit` and `web-config` workers, in a fixed key order.
@@ -15,4 +16,7 @@ export declare function renderStandaloneResource(m: {
     capabilities: Capabilities;
     compose?: ComposeApp;
     sharedFolder?: SharedFolder;
+    daemon?: {
+        ingress?: DaemonIngress;
+    };
 }, portal?: PortalPackage): string | undefined;

package/dist/standalone/resource.js

@@ -2,6 +2,7 @@ import { renderDockerProjectResource } from "../build-spk/resource-worker.js";
 import { sharedFolderResource } from "./shared-folder.js";
 import { portalResource } from "../portal/package.js";
 import { nativeGatewayResource } from './native-gateway.js';
+import { daemonIngressResource } from "./daemon-ingress.js";
 /**
  * `conf/resource` for a native package: only DSM's official `data-share`,
  * `systemd-user-unit` and `web-config` workers, in a fixed key order.
@@ -9,7 +10,10 @@ import { nativeGatewayResource } from './native-gateway.js';
  */
 export function renderStandaloneResource(m, portal) {
     const dataShare = m.sharedFolder && sharedFolderResource(m.package, m.sharedFolder);
-    const webConfig = { ...(portal ? portalResource()['web-config'] : {}), ...nativeGatewayResource(m) };
+    const nginx = [nativeGatewayResource(m), m.daemon?.ingress && daemonIngressResource()]
+        .flatMap((r) => r?.["nginx-static-config"]?.enable ?? []);
+    const webConfig = { ...(portal ? portalResource()['web-config'] : {}),
+        ...(nginx.length ? { 'nginx-static-config': { enable: nginx } } : {}) };
     const resource = {
         ...(m.compose?.plan.devices?.gpu && !m.compose.plan.mounts_blocked ? { "video-driver": {} } : {}),
         ...(m.compose && !m.compose.plan.mounts_blocked

package/dist/standalone/spk.d.ts

@@ -36,4 +36,9 @@ export interface AssembleOptions {
  */
 export declare function assembleStandaloneSpk(options: AssembleOptions): Promise<void>;
 /** Manifest validation already refused quotes, backslashes and newlines. */
+/**
+ * INFO `dsmappname` lists the App's launchable classes. With a console,
+ * Package Center's Open (`dsmapplaunchname`) opens the console window.
+ */
+export declare function consoleInfo(manifest: Pick<StandaloneManifest, "package" | "console">): Array<[string, string]>;
 export declare function renderInfo(manifest: StandaloneManifest, arch: NativeArchFamily, checksum: string, executorDigest?: string): string;

package/dist/standalone/spk.js

@@ -29,7 +29,8 @@ import { copyAppTree } from "./bridge-app.js";
 import { isBridgeBackend } from "./bridge-backend.js";
 import { hostScriptName, renderHostAdapterScript } from "./host-adapter.js";
 import { writeComposePayload } from "./compose.js";
-import { copyDaemonPayload } from "./daemon.js";
+import { copyDaemonPayload, nodeDependency } from "./daemon.js";
+import { DAEMON_INGRESS_CONFIG, renderDaemonIngressConfig } from "./daemon-ingress.js";
 import { GATEWAY_CGI_PATH, GATEWAY_CONFIG_PATH, GATEWAY_EXEC, identityGatewayConfig, identityGatewayDeclaration, } from "./identity-gateway.js";
 import { BACKGROUND_UNIT_DIR, BACKGROUND_WORKER_PAYLOAD, backgroundUnitName, renderBackgroundUnit, BRIDGE_WORKER_ARGS, } from "./background.js";
 import { renderStandaloneResource } from "./resource.js";
@@ -91,7 +92,7 @@ export async function assembleStandaloneSpk(options) {
             writeFile(join(uiRoot, windowScriptName(manifest)), renderWindowScript(manifest, assetVersion, icons, options.portalText));
         writeFile(join(uiRoot, hostScriptName(manifest.build)), renderHostAdapterScript(manifest.package));
         writeDsmWindowIcons(uiRoot, icons);
-        writeUiTexts(uiRoot, appTitle(manifest));
+        writeUiTexts(uiRoot, appTitle(manifest), manifest.console);
         if (options.apiDescription)
             writeFile(join(staging, "package", "synopkgland-api.json"), JSON.stringify(options.apiDescription) + "\n");
         const cgiTarget = join(staging, "package", CGI_PAYLOAD_PATH);
@@ -104,6 +105,8 @@ export async function assembleStandaloneSpk(options) {
             if (!options.daemonControl)
                 throw new StandaloneBuildError("STANDALONE_DAEMON_ARTIFACT_REQUIRED", "daemon controller artifact required.");
             copyDaemonPayload(manifest, options.arch, join(staging, "package", "daemon"), options.daemonControl);
+            if (manifest.daemon?.ingress)
+                writeFile(join(staging, "package", DAEMON_INGRESS_CONFIG), renderDaemonIngressConfig(manifest.package, manifest.daemon.ingress));
         }
         if (manifest.identityGateway) {
             if (!options.identityGateway)
@@ -230,6 +233,8 @@ export async function assembleStandaloneSpk(options) {
             backend: manifest.backend.kind,
             ...(gatewayAdmissionPolicy(manifest.identityGateway, manifest.entry) ? { provider_only_oidc: gatewayAdmissionPolicy(manifest.identityGateway, manifest.entry) } : {}),
             ...(nativeGatewaySupported(manifest) ? { native_gateway: { sdk: manifest.identityGateway.sdk, listen: manifest.identityGateway.listen } } : {}),
+            ...(manifest.daemon?.ingress ? { daemon_ingress: manifest.daemon.ingress } : {}),
+            ...(manifest.daemon?.node ? { daemon_node: manifest.daemon.node } : {}),
             launch: resolvedSdkLaunch(manifest),
             capabilities: Object.keys(manifest.capabilities).sort(),
             ...(manifest.compose
@@ -242,6 +247,7 @@ export async function assembleStandaloneSpk(options) {
                 }
                 : {}),
             ...(manifest.entry ? { entry: manifest.entry } : {}),
+            ...(manifest.console ? { console: true } : {}),
             ...(manifest.uninstall
                 ? {
                     uninstall: uninstallRecord(manifest.uninstall, manifest.i18n?.catalogs),
@@ -319,6 +325,16 @@ function quote(value) {
     return `"${value.replace(/([\\"$`])/g, "\\$1")}"`;
 }
 /** Manifest validation already refused quotes, backslashes and newlines. */
+/**
+ * INFO `dsmappname` lists the App's launchable classes. With a console,
+ * Package Center's Open (`dsmapplaunchname`) opens the console window.
+ */
+export function consoleInfo(manifest) {
+    const ns = `SYNO.SDS.${manifest.package}`;
+    return manifest.console
+        ? [["dsmappname", `${ns}.Instance ${ns}.Console`], ["dsmapplaunchname", `${ns}.Console`]]
+        : [["dsmappname", `${ns}.Instance`]];
+}
 export function renderInfo(manifest, arch, checksum, executorDigest) {
     const fields = [
         ["package", manifest.package],
@@ -329,7 +345,7 @@ export function renderInfo(manifest, arch, checksum, executorDigest) {
         ["arch", infoArchValue(arch)],
         ["os_min_ver", manifest.os_min_ver],
         ["dsmuidir", "ui"],
-        ["dsmappname", `SYNO.SDS.${manifest.package}.Instance`],
+        ...consoleInfo(manifest),
         ["thirdparty", "yes"],
         ["startable", "yes"],
         ["checksum", checksum],
@@ -349,6 +365,8 @@ export function renderInfo(manifest, arch, checksum, executorDigest) {
     const backend = manifest.backend;
     if (isBridgeBackend(backend) && backend.node)
         fields.push(["install_dep_packages", backend.node.package]);
+    if (manifest.daemon?.node)
+        fields.push(["install_dep_packages", nodeDependency(manifest.daemon.node)]);
     fields.push(...metadataInfoFields(manifest.metadata));
     // Background packages need prestart: it runs before DSM's systemd-user-unit acquire.
     if (manifest.daemon || manifest.compose || manifest.capabilities.jobs)
@@ -360,9 +378,11 @@ export function renderInfo(manifest, arch, checksum, executorDigest) {
         if (text?.description)
             fields.push([`description_${DSM_LANGS[locale]}`, text.description]);
     }
-    if (nativeGatewaySupported(manifest))
+    // DSM reloads nginx on start and stop so the location follows the package state.
+    const nginx = nativeGatewaySupported(manifest) || Boolean(manifest.daemon?.ingress);
+    if (nginx)
         fields.push(['startstop_restart_services', 'nginx.service']);
-    return portalInfoFields(fields, Boolean(manifest.portal) || nativeGatewaySupported(manifest)).map(([key, value]) => `${key}=${quote(value)}\n`).join("");
+    return portalInfoFields(fields, Boolean(manifest.portal) || nginx).map(([key, value]) => `${key}=${quote(value)}\n`).join("");
 }
 function copyUiTree(source, target) {
     for (const entry of ["app.js", "app.css"]) {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@synopackageland/cli",
-  "version": "0.24.1",
+  "version": "0.25.1",
   "description": "Syno Package Land Developer Kit CLI",
   "type": "module",
   "bin": {
@@ -27,7 +27,7 @@
   },
   "dependencies": {
     "@napi-rs/keyring": "^2.1.1",
-    "@synopackageland/templates": "0.24.0",
+    "@synopackageland/templates": "0.25.0",
     "ajv": "^8.17.1",
     "commander": "^13.1.0",
     "json-canonicalize": "^3.0.1",