@synopackageland/cli 0.25.0 → 0.25.2

package/CHANGELOG.md

@@ -1,5 +1,16 @@
 # Changelog
 
+## 0.25.2 (2026-10-22)
+
+- Use templates 0.25.1 with the native Rust lockfile pinned to the public SDK 0.25.0 commit. SDK/App support and executor/lifecycle digests are unchanged.
+- Update SDK download and Go build diagnostics for anonymous access to the public repository.
+
+## 0.25.1 (2026-10-22)
+
+- Fix upgrades that first add a `daemon`: the generated `preupgrade` ran the old payload's missing `daemon/control` and DSM rolled back with error 4541. The hook now exits 0 when the outgoing payload has no `daemon/` (plain, executor and delegated-worker variants); inspect still accepts the released unguarded hook.
+- Add `daemon.node` (`package: Node.js_v18|v20|v22`, optional `min_version`): the daemon's `exec` is a JavaScript entry run by the Package Center Node.js package through a generated launcher, with INFO `install_dep_packages`. The SPK bundles no Node. See docs/daemon.md for availability and dependency behaviour.
+- Add `daemon.ingress` (`path`, optional `timeout`, default 3600 s): a same-origin path in DSM's nginx through web-config `nginx-static-config` `type: dsm`, proxied unbuffered to `/tmp/synopkgland-ingress-<package>.sock`, with nginx reloads in INFO. check requires os_min_ver 7.2-64570 or later (`STANDALONE_DAEMON_INGRESS_MIN_DSM`); inspect verifies the location, resource, INFO and daemon environment.
+
 ## 0.25.0 (2026-10-22)
 
 - Add the opt-in `console` declaration for native Apps with `identity_gateway`: a native UI URL launcher and an administrator-only DSM console, selected by Package Center Open. Validate both entries and refuse incompatible launch declarations.

package/dist/error-registry.js

@@ -322,6 +322,21 @@ export const ERROR_REGISTRY = {
             description: "The package daemon's Go supervisor could not be built.",
             suggestion: "Install Go 1.21 or later (builds pin go1.26.10 and need it offline) and check the compiler stderr; the NAS does not need a Go toolchain.",
         },
+        STANDALONE_DAEMON_NODE_INVALID: {
+            code: "STANDALONE_DAEMON_NODE_INVALID",
+            description: "daemon.node does not name a Package Center Node.js package and a version of its major.",
+            suggestion: "Set daemon.node.package to Node.js_v18, Node.js_v20 or Node.js_v22, and min_version (optional) to a version of that major such as 22.19.0.",
+        },
+        STANDALONE_DAEMON_INGRESS_INVALID: {
+            code: "STANDALONE_DAEMON_INGRESS_INVALID",
+            description: "daemon.ingress does not declare one same-origin path and a bounded proxy timeout.",
+            suggestion: "Set daemon.ingress.path to /<name>/ with lowercase letters, digits and -, not a DSM path, and timeout (optional) to 1–3600 seconds.",
+        },
+        STANDALONE_DAEMON_INGRESS_MIN_DSM: {
+            code: "STANDALONE_DAEMON_INGRESS_MIN_DSM",
+            description: "daemon.ingress uses DSM's web-config worker, which DSM 7.1 refuses in an unsigned package.",
+            suggestion: "Raise os_min_ver to 7.2-64570 or later, or remove daemon.ingress.",
+        },
         STANDALONE_DAEMON_PAYLOAD_INVALID: {
             code: "STANDALONE_DAEMON_PAYLOAD_INVALID",
             description: "The daemon payload is not a bounded, link-free directory inside the project.",
@@ -525,7 +540,7 @@ export const ERROR_REGISTRY = {
         STANDALONE_GO_BUILD_FAILED: {
             code: "STANDALONE_GO_BUILD_FAILED",
             description: "go build failed.",
-            suggestion: "Run go build ./... in the backend directory and fix the errors. If github.com/synopackageland/syno-pkg-land-sdk is unreachable, make sure git can read github.com with credentials (verify with git ls-remote).",
+            suggestion: "Run go build ./... in the backend directory and fix the errors. If github.com/synopackageland/syno-pkg-land-sdk is unreachable, check network access to the configured Go proxy or the public GitHub repository.",
         },
         STANDALONE_PORTAL_INVALID: {
             code: "STANDALONE_PORTAL_INVALID",
@@ -890,7 +905,7 @@ export const ERROR_REGISTRY = {
         SDK_DOWNLOAD_FAILED: {
             code: "SDK_DOWNLOAD_FAILED",
             description: "go mod download cannot fetch the SDK version backend/go.mod requires.",
-            suggestion: "The CLI fetches the private SDK with git: make sure git can read github.com with credentials (verify with git ls-remote), then confirm the version exists. Offline, run go mod download once on the same machine first.",
+            suggestion: "Confirm the SDK version exists in the public repository and check network access to the configured Go proxy or github.com. Offline, run go mod download for that version on the same machine first.",
         },
         TEMPLATES_MISSING: {
             code: "TEMPLATES_MISSING",

package/dist/standalone/daemon-ingress.d.ts

@@ -0,0 +1,21 @@
+import type { StandaloneError } from "./manifest.js";
+/** `daemon.ingress`: one path in DSM's own server blocks, proxied to the daemon. */
+export interface DaemonIngress {
+    /** `/<name>/`, served on DSM's ports and custom domains, so same-origin with DSM. */
+    path: string;
+    /** nginx proxy_read_timeout and proxy_send_timeout in seconds. */
+    timeout: number;
+}
+export declare const DAEMON_INGRESS_CONFIG = "daemon/ingress-nginx.conf";
+export declare function readDaemonIngress(value: unknown, fail: (error: StandaloneError) => void): DaemonIngress | undefined;
+/** DSM before 7.2 rejects an unsigned web-config, the worker this path uses. */
+export declare function daemonIngressMinDsmProblem(osMinVer: string | undefined): string | undefined;
+export declare const daemonIngressSocket: (pkg: string) => string;
+/** What the daemon learns: where to listen and which path prefix it serves. */
+export declare function ingressEnv(pkg: string, ingress: DaemonIngress): Record<string, string>;
+export declare function daemonIngressResource(): Record<string, unknown>;
+/**
+ * Included in DSM's own server blocks. Streaming responses (SSE) pass
+ * unbuffered; nginx replaces any client X-Real-IP with the peer address.
+ */
+export declare function renderDaemonIngressConfig(pkg: string, ingress: DaemonIngress): string;

package/dist/standalone/daemon-ingress.js

@@ -0,0 +1,61 @@
+import { isDsmAtLeast, PORTAL_MIN_DSM } from "../build-spk/dsm-version.js";
+import { RESERVED_PORTAL_ALIASES } from "../portal/alias.js";
+export const DAEMON_INGRESS_CONFIG = "daemon/ingress-nginx.conf";
+const PATH = /^\/[a-z0-9](?:[a-z0-9-]{0,62}[a-z0-9])?\/$/;
+const reserved = (path) => RESERVED_PORTAL_ALIASES.includes(path.slice(1, -1));
+export function readDaemonIngress(value, fail) {
+    if (value === undefined)
+        return undefined;
+    const v = value && typeof value === "object" && !Array.isArray(value) ? value : undefined;
+    const timeout = v?.timeout ?? 3600;
+    if (!v ||
+        Object.keys(v).some((k) => k !== "path" && k !== "timeout") ||
+        typeof v.path !== "string" ||
+        !PATH.test(v.path) ||
+        reserved(v.path) ||
+        !Number.isInteger(timeout) ||
+        timeout < 1 ||
+        timeout > 3600) {
+        fail({
+            code: "STANDALONE_DAEMON_INGRESS_INVALID",
+            message: `daemon.ingress needs path "/<name>/" (lowercase letters, digits and -, not a DSM path such as /webapi/) and an optional timeout of 1–3600 seconds.`,
+        });
+        return undefined;
+    }
+    return { path: v.path, timeout: timeout };
+}
+/** DSM before 7.2 rejects an unsigned web-config, the worker this path uses. */
+export function daemonIngressMinDsmProblem(osMinVer) {
+    if (osMinVer && isDsmAtLeast(osMinVer, PORTAL_MIN_DSM))
+        return undefined;
+    return `daemon.ingress needs os_min_ver ${PORTAL_MIN_DSM} or later; os_min_ver is "${osMinVer ?? ""}". DSM 7.1 rejects the unsigned web-config worker that adds the path to DSM's nginx. Raise os_min_ver or remove daemon.ingress.`;
+}
+export const daemonIngressSocket = (pkg) => `/tmp/synopkgland-ingress-${pkg}.sock`;
+/** What the daemon learns: where to listen and which path prefix it serves. */
+export function ingressEnv(pkg, ingress) {
+    return { SYNOPKGLAND_INGRESS_PATH: ingress.path, SYNOPKGLAND_INGRESS_SOCKET: daemonIngressSocket(pkg) };
+}
+export function daemonIngressResource() {
+    return { "nginx-static-config": { enable: [{ type: "dsm", relpath: DAEMON_INGRESS_CONFIG }] } };
+}
+/**
+ * Included in DSM's own server blocks. Streaming responses (SSE) pass
+ * unbuffered; nginx replaces any client X-Real-IP with the peer address.
+ */
+export function renderDaemonIngressConfig(pkg, ingress) {
+    return `location ^~ ${ingress.path} {
+    proxy_pass http://unix:${daemonIngressSocket(pkg)}:;
+    proxy_http_version 1.1;
+    proxy_set_header Host $http_host;
+    proxy_set_header X-Real-IP $remote_addr;
+    proxy_set_header Connection "";
+    proxy_buffering off;
+    proxy_request_buffering off;
+    proxy_cache off;
+    gzip off;
+    proxy_read_timeout ${ingress.timeout}s;
+    proxy_send_timeout ${ingress.timeout}s;
+    client_max_body_size 8m;
+}
+`;
+}

package/dist/standalone/daemon.d.ts

@@ -1,4 +1,6 @@
 import type { NativeArchFamily } from "../build-spk/dsm-arch.js";
+import { NODE_PACKAGES } from "./bridge-backend.js";
+import { type DaemonIngress } from "./daemon-ingress.js";
 import type { CommandRunner } from "./build.js";
 import type { StandaloneError, StandaloneManifest } from "./manifest.js";
 export interface Daemon {
@@ -17,7 +19,26 @@ export interface Daemon {
         status: number;
         uninstall: number;
     };
+    /** `exec` is a JavaScript entry run by the node of a Package Center Node.js package. */
+    node?: DaemonNode;
+    /** A same-origin DSM path that nginx proxies to the daemon's Unix socket. */
+    ingress?: DaemonIngress;
 }
+export interface DaemonNode {
+    package: (typeof NODE_PACKAGES)[number];
+    /** The lowest package version INFO install_dep_packages accepts. */
+    min_version?: string;
+}
+/** The CLI-generated launcher; the payload must not ship its own directory. */
+export declare const NODE_LAUNCHER = "_synopkgland/node";
+export declare const nodeBinary: (pkg: string) => string;
+/** INFO install_dep_packages for a Node daemon. */
+export declare function nodeDependency(node: DaemonNode): string;
+/**
+ * Runs the dependency's node in place of the shell, so daemon/control
+ * supervises node itself. A removed dependency fails start with a clear line.
+ */
+export declare function renderNodeLauncher(node: DaemonNode): string;
 /** A fixed argv or env value: only the package's own directories expand. */
 export declare const token: (v: unknown) => v is string;
 /** An application variable that cannot steer the loader, the shell or DSM. */
@@ -26,6 +47,11 @@ export declare const envKey: (k: string) => boolean;
 export declare const relativeExec: (v: unknown) => v is string;
 export declare function readDaemon(value: unknown, root: string, arches: NativeArchFamily[], fail: (error: StandaloneError) => void): Daemon | undefined;
 export declare function daemonConfig(manifest: StandaloneManifest): string;
+/**
+ * The argv and environment daemon/control runs: a Node daemon execs the
+ * launcher with its entry first, and ingress names the socket to listen on.
+ */
+export declare function runnableDaemon(pkg: string, daemon: Daemon): Daemon;
 export declare function buildDaemonControl(manifest: StandaloneManifest, arch: NativeArchFamily, work: string, run: CommandRunner): Promise<string | undefined>;
 export declare function copyDaemonPayload(manifest: StandaloneManifest, arch: NativeArchFamily, target: string, controller: string): void;
 /** Copies a bounded, link-free package-account payload tree. */

package/dist/standalone/daemon.js

@@ -1,14 +1,37 @@
 import { operationBudgetSeconds, runtimeBudgetSdkSupported } from "../runtime/runtime-budgets.js";
 import { goChildEnv } from "../runtime/go-env.js";
 import { chmodSync, existsSync, copyFileSync, lstatSync, mkdirSync, readdirSync, realpathSync, writeFileSync, } from "node:fs";
-import { isAbsolute, join, relative, resolve } from "node:path";
+import { dirname, isAbsolute, join, relative, resolve } from "node:path";
 import { PINNED_GO_HINT, pinnedGoBuildEnv, pinnedGoProblem, } from "../build-spk/go-toolchain.js";
 import { sdkSource, appSdkVersion } from "../runtime/sdk-source.js";
 import { templateSdkVersion } from "../template-paths.js";
 import { checkCgiBinary } from "./binary.js";
+import { NODE_PACKAGES } from "./bridge-backend.js";
+import { readDaemonIngress, ingressEnv } from "./daemon-ingress.js";
 import { composeDaemon, composeNetwork } from "./compose.js";
 import { gatewayDaemon } from "./identity-gateway.js";
 import { StandaloneBuildError } from "./spk.js";
+/** The CLI-generated launcher; the payload must not ship its own directory. */
+export const NODE_LAUNCHER = "_synopkgland/node";
+export const nodeBinary = (pkg) => `/var/packages/${pkg}/target/usr/local/bin/node`;
+/** INFO install_dep_packages for a Node daemon. */
+export function nodeDependency(node) {
+    return node.min_version ? `${node.package}>=${node.min_version}` : node.package;
+}
+/**
+ * Runs the dependency's node in place of the shell, so daemon/control
+ * supervises node itself. A removed dependency fails start with a clear line.
+ */
+export function renderNodeLauncher(node) {
+    return `#!/bin/sh
+node=${nodeBinary(node.package)}
+if [ ! -x "$node" ]; then
+  echo "${node.package} is not installed or is incomplete; install it in Package Center." >&2
+  exit 127
+fi
+exec "$node" "$@"
+`;
+}
 const fields = new Set([
     "exec",
     "targets",
@@ -16,6 +39,8 @@ const fields = new Set([
     "env",
     "timeouts",
     "uninstall_args",
+    "node",
+    "ingress",
 ]);
 const record = (v) => Boolean(v) && typeof v === "object" && !Array.isArray(v);
 /** A fixed argv or env value: only the package's own directories expand. */
@@ -34,6 +59,8 @@ export const relativeExec = (v) => typeof v === "string" &&
     v.length <= 200 &&
     /^[A-Za-z0-9_-]+(?:\/[A-Za-z0-9_.-]+)*$/.test(v) &&
     !v.split("/").some((p) => p === "." || p === "..");
+/** A Node entry such as `server.mjs` or `dist/main.js`, inside the payload. */
+const relativeEntry = (v) => typeof v === "string" && relativeExec(`_/${v}`);
 export function readDaemon(value, root, arches, fail) {
     if (value === undefined)
         return undefined;
@@ -46,7 +73,7 @@ export function readDaemon(value, root, arches, fail) {
     };
     if (!record(value) || Object.keys(value).some((k) => !fields.has(k)))
         return invalid();
-    if (!relativeExec(value.exec))
+    if (!(value.node === undefined ? relativeExec(value.exec) : relativeEntry(value.exec)))
         return invalid();
     if (!record(value.targets) ||
         Object.keys(value.targets).length !== arches.length)
@@ -83,6 +110,14 @@ export function readDaemon(value, root, arches, fail) {
     const timeouts = readLifecycleTimeouts(value.timeouts, fail);
     if (!timeouts)
         return undefined;
+    const node = readDaemonNode(value.node, fail);
+    if (value.node !== undefined && !node)
+        return undefined;
+    const ingress = readDaemonIngress(value.ingress, fail);
+    if (value.ingress !== undefined && !ingress)
+        return undefined;
+    if (ingress && Object.keys(env).some((key) => key in ingressEnv("", ingress)))
+        return invalid();
     return {
         exec: value.exec,
         targets,
@@ -92,8 +127,31 @@ export function readDaemon(value, root, arches, fail) {
             .sort()
             .map((key) => [key, env[key]])),
         timeouts: timeouts,
+        ...(node ? { node } : {}),
+        ...(ingress ? { ingress } : {}),
     };
 }
+function readDaemonNode(value, fail) {
+    if (value === undefined)
+        return undefined;
+    const pkg = record(value) ? value.package : undefined;
+    const min = record(value) ? value.min_version : undefined;
+    const major = typeof pkg === "string" ? pkg.replace("Node.js_v", "") : "";
+    if (!record(value) ||
+        Object.keys(value).some((k) => k !== "package" && k !== "min_version") ||
+        !NODE_PACKAGES.includes(pkg) ||
+        (min !== undefined &&
+            (typeof min !== "string" ||
+                !/^[0-9]{1,3}(\.[0-9]{1,4}){0,2}$/.test(min) ||
+                min.split(".")[0] !== major))) {
+        fail({
+            code: "STANDALONE_DAEMON_NODE_INVALID",
+            message: `daemon.node needs package (${NODE_PACKAGES.join(", ")}) and an optional min_version of that major, such as "22.19.0".`,
+        });
+        return undefined;
+    }
+    return { package: pkg, ...(min ? { min_version: min } : {}) };
+}
 function daemonSdkVersion(manifest) {
     return manifest.identityGateway?.sdk ??
         (manifest.backend.kind === "go" ? appSdkVersion(manifest.backend) : undefined) ??
@@ -104,7 +162,7 @@ export function daemonConfig(manifest) {
         ? composeDaemon(manifest)
         : manifest.identityGateway
             ? gatewayDaemon(manifest.daemon)
-            : manifest.daemon;
+            : runnableDaemon(manifest.package, manifest.daemon);
     return (JSON.stringify({
         package: manifest.package,
         exec,
@@ -117,6 +175,20 @@ export function daemonConfig(manifest) {
         ...(manifest.compose ? { network: composeNetwork(manifest) } : {}),
     }) + "\n");
 }
+/**
+ * The argv and environment daemon/control runs: a Node daemon execs the
+ * launcher with its entry first, and ingress names the socket to listen on.
+ */
+export function runnableDaemon(pkg, daemon) {
+    const entry = daemon.node && [`\${SYNOPKG_PKGDEST}/daemon/payload/${daemon.exec}`];
+    const env = daemon.ingress ? { ...daemon.env, ...ingressEnv(pkg, daemon.ingress) } : daemon.env;
+    return {
+        ...daemon,
+        ...(entry ? { exec: NODE_LAUNCHER, args: [...entry, ...daemon.args] } : {}),
+        ...(entry && daemon.uninstall_args ? { uninstall_args: [...entry, ...daemon.uninstall_args] } : {}),
+        env: Object.fromEntries(Object.keys(env).sort().map((key) => [key, env[key]])),
+    };
+}
 export async function buildDaemonControl(manifest, arch, work, run) {
     if (!manifest.daemon && !(manifest.compose && manifest.identityGateway))
         return undefined;
@@ -151,7 +223,18 @@ export function copyDaemonPayload(manifest, arch, target, controller) {
         copyPayloadTree(manifest.root, source, join(target, "payload"));
     else
         mkdirSync(join(target, "payload"), { recursive: true });
-    if (!manifest.compose) {
+    if (!manifest.compose && manifest.daemon?.node) {
+        const exec = join(source, daemon.exec);
+        if (!existsSync(exec) || !lstatSync(exec).isFile())
+            throw new StandaloneBuildError("STANDALONE_DAEMON_PAYLOAD_INVALID", `daemon.exec must name the Node entry file inside the payload: ${exec}`);
+        if (existsSync(join(source, NODE_LAUNCHER.split("/")[0])))
+            throw new StandaloneBuildError("STANDALONE_DAEMON_PAYLOAD_INVALID", `The daemon payload must not contain ${NODE_LAUNCHER.split("/")[0]}/; the CLI writes its Node launcher there.`);
+        mkdirSync(join(target, "payload", dirname(NODE_LAUNCHER)), { recursive: true });
+        chmodSync(join(target, "payload", dirname(NODE_LAUNCHER)), 0o755);
+        writeFileSync(join(target, "payload", NODE_LAUNCHER), renderNodeLauncher(manifest.daemon.node));
+        chmodSync(join(target, "payload", NODE_LAUNCHER), 0o755);
+    }
+    else if (!manifest.compose) {
         const exec = join(source, daemon.exec);
         const problem = checkCgiBinary(manifest.root, exec, arch);
         if (problem)

package/dist/standalone/inspect-spk.js

@@ -21,7 +21,8 @@ import { familyOfArchToken, NATIVE_ARCH_FAMILIES, } from "../build-spk/dsm-arch.
 import { CONTAINER_MIN_DSM, isDsmAtLeast, PORTAL_EXECUTOR_MIN_DSM, PORTAL_MIN_DSM, PORTAL_MIN_DSM_REASON, } from "../build-spk/dsm-version.js";
 import { ELF_MACHINE } from "./binary.js";
 import { CGI_PAYLOAD_PATH, entryLauncherAccess } from "./dsm-window.js";
-import { daemonConfig, readDaemon, readLifecycleTimeouts } from "./daemon.js";
+import { daemonConfig, readDaemon, readLifecycleTimeouts, renderNodeLauncher, nodeDependency, NODE_LAUNCHER } from "./daemon.js";
+import { DAEMON_INGRESS_CONFIG, daemonIngressMinDsmProblem, readDaemonIngress, renderDaemonIngressConfig } from "./daemon-ingress.js";
 import { ROOT_SCRIPT_HINTS } from "./root-ops.js";
 import { DELETE_STATE_KEY } from "../build-spk/uninstall-wizard.js";
 import { readUninstallRecord, stateItemTexts } from "./uninstall.js";
@@ -155,12 +156,14 @@ export async function inspectSpk(spkPath, expectedKind) {
         const combined = metadata.compose === undefined
             ? undefined
             : await recoverCompose(dir, metadata.compose, findings);
-        const info = readInfo(join(dir, "INFO"), findings, kind, Boolean(combined));
+        const daemonNode = recoverDaemonNode(metadata.daemon_node, findings);
+        const info = readInfo(join(dir, "INFO"), findings, kind, Boolean(combined), daemonNode);
         if (combined &&
             (!info.os_min_ver || !isDsmAtLeast(info.os_min_ver, CONTAINER_MIN_DSM)))
             findings.push("compose identity_gateway requires DSM >= 7.2.1");
         await checkArch(dir, info, kind, paths.has(CGI_PAYLOAD_PATH), findings);
         const nativeGateway = await recoverNativeGateway(dir, metadata.native_gateway, info, findings);
+        const daemonIngress = await recoverDaemonIngress(dir, metadata.daemon_ingress, info, paths, findings);
         const background = compiledKind && paths.has(BACKGROUND_WORKER_PAYLOAD);
         // Before any fixed-lifecycle comparison: those see the SDK steps alone.
         const appScripts = standalone || kind === "container"
@@ -179,7 +182,7 @@ export async function inspectSpk(spkPath, expectedKind) {
             !isDsmAtLeast(info.os_min_ver, PORTAL_MIN_DSM)) {
             findings.push(`INFO os_min_ver "${info.os_min_ver}" is below the DSM ${PORTAL_MIN_DSM} a portal needs; ${PORTAL_MIN_DSM_REASON}`);
         }
-        checkConf(dir, findings, kind, background, sharedFolder, info.package, portal, combined?.compose, nativeGateway, info.os_min_ver);
+        checkConf(dir, findings, kind, background, sharedFolder, info.package, portal, combined?.compose, nativeGateway, info.os_min_ver, daemonIngress);
         checkScripts(dir, findings);
         checkUninstall(dir, findings);
         if (kind === "container")
@@ -207,7 +210,7 @@ export async function inspectSpk(spkPath, expectedKind) {
         if (standalone && portal)
             findings.push(...inspectPortalInfo(info, hasExecutor));
         const daemon = standalone
-            ? await checkDaemon(dir, info, paths, payload, findings, hasExecutor, background, combined, nativeGateway, uninstallHook?.uninstall)
+            ? await checkDaemon(dir, info, paths, payload, findings, hasExecutor, background, combined, nativeGateway, uninstallHook?.uninstall, { ingress: daemonIngress, node: daemonNode })
             : undefined;
         if (background)
             checkBackground(dir, info, payload, findings, hasExecutor, daemon, kind !== "native-go", metadata.lifecycleTimeouts, nativeGateway);
@@ -847,7 +850,7 @@ async function recoverCompose(dir, value, findings) {
         return undefined;
     }
 }
-async function checkDaemon(dir, info, paths, payload, findings, executor, background, combined, nativeGateway, uninstall) {
+async function checkDaemon(dir, info, paths, payload, findings, executor, background, combined, nativeGateway, uninstall, extras = {}) {
     if (![...paths].some((path) => path.startsWith("daemon/")))
         return;
     if (info.precheckstartstop !== "yes")
@@ -861,7 +864,7 @@ async function checkDaemon(dir, info, paths, payload, findings, executor, backgr
     await tar.x({
         file: join(dir, "package.tgz"),
         cwd: unpacked,
-        filter: (path) => path.replace(/^\.\//, "") === "daemon/config.json",
+        filter: (path) => ["daemon/config.json", `daemon/payload/${NODE_LAUNCHER}`].includes(path.replace(/^\.\//, "")),
     });
     try {
         const config = JSON.parse(readFileSync(join(unpacked, "daemon/config.json"), "utf8"));
@@ -887,6 +890,14 @@ async function checkDaemon(dir, info, paths, payload, findings, executor, backgr
         }, dir, ["x86_64"], () => { });
         if (!daemon)
             throw new Error("invalid config");
+        // The packaged config already carries the launcher argv; only the launcher itself is checked here.
+        if (extras.node &&
+            (daemon.exec !== NODE_LAUNCHER ||
+                !daemon.args[0]?.startsWith("${SYNOPKG_PKGDEST}/daemon/payload/") ||
+                readOptional(join(unpacked, "daemon/payload", NODE_LAUNCHER)) !== renderNodeLauncher(extras.node)))
+            throw new Error("Node launcher differs from its build declaration");
+        if (extras.ingress)
+            daemon.ingress = extras.ingress;
         if (config.operation_seconds !== undefined && (!Number.isInteger(config.operation_seconds) || config.operation_seconds < 1 || config.operation_seconds > 3600))
             throw new Error('invalid operation budget');
         if (combined &&
@@ -955,7 +966,7 @@ function archivedInfoTranslations(info) {
     }
     return translations;
 }
-function readInfo(path, findings, kind, compose = false) {
+function readInfo(path, findings, kind, compose = false, daemonNode) {
     if (!existsSync(path)) {
         findings.push("INFO is missing");
         return {};
@@ -984,7 +995,10 @@ function readInfo(path, findings, kind, compose = false) {
             : kind === "native-node"
                 ? /^Node\.js_v[0-9]{2}([><=].*)?$/
                 : undefined;
-    if (info.install_dep_packages &&
+    if (daemonNode && info.install_dep_packages !== nodeDependency(daemonNode))
+        findings.push(`daemon.node requires INFO install_dep_packages="${nodeDependency(daemonNode)}"`);
+    else if (!daemonNode &&
+        info.install_dep_packages &&
         !(allowed &&
             info.install_dep_packages.split(":").every((dep) => allowed.test(dep)))) {
         findings.push(`INFO depends on other packages: ${info.install_dep_packages}`);
@@ -1088,7 +1102,44 @@ async function recoverNativeGateway(dir, value, info, findings) {
         return undefined;
     }
 }
-function checkConf(dir, findings, kind, background, sharedFolder, pkg, portal, compose, nativeGateway, osMinVer) {
+function recoverDaemonNode(value, findings) {
+    if (value === undefined)
+        return undefined;
+    const daemon = readDaemon({ exec: "x", targets: {}, node: value }, tmpdir(), [], () => { });
+    if (!daemon?.node || !isDeepStrictEqual(daemon.node, value)) {
+        findings.push("DAEMON_NODE_INVALID sdk-package.json daemon_node is not a Node.js package declaration build writes");
+        return undefined;
+    }
+    return daemon.node;
+}
+async function recoverDaemonIngress(dir, value, info, paths, findings) {
+    if (value === undefined)
+        return undefined;
+    try {
+        const ingress = readDaemonIngress(value, () => { });
+        if (!ingress || !isDeepStrictEqual(ingress, value))
+            throw new Error("invalid ingress record");
+        const minDsm = daemonIngressMinDsmProblem(info.os_min_ver);
+        if (minDsm)
+            throw new Error(minDsm);
+        if (!paths.has("daemon/config.json"))
+            throw new Error("ingress needs the package daemon");
+        const root = join(dir, "daemon-ingress-inspection");
+        mkdirSync(root);
+        await tar.x({ file: join(dir, "package.tgz"), cwd: root, filter: (path) => path.replace(/^\.\//, "") === DAEMON_INGRESS_CONFIG });
+        if (readOptional(join(root, DAEMON_INGRESS_CONFIG)) !== renderDaemonIngressConfig(info.package, ingress))
+            throw new Error("ingress location differs from its fixed proxy");
+        for (const key of ["instuninst_restart_services", "startstop_restart_services"])
+            if (!(info[key] ?? "").split(/\s+/).includes("nginx.service"))
+                throw new Error(`ingress requires INFO ${key}`);
+        return ingress;
+    }
+    catch (e) {
+        findings.push(`DAEMON_INGRESS_INVALID ${e.message}`);
+        return undefined;
+    }
+}
+function checkConf(dir, findings, kind, background, sharedFolder, pkg, portal, compose, nativeGateway, osMinVer, daemonIngress) {
     const confDir = join(dir, "conf");
     const entries = existsSync(confDir) ? readdirSync(confDir) : [];
     const nativeResource = kind !== "container"
@@ -1101,6 +1152,7 @@ function checkConf(dir, findings, kind, background, sharedFolder, pkg, portal, c
                 ? { jobs: { worker: "sha256-v1" } }
                 : {},
             ...(sharedFolder ? { sharedFolder } : {}),
+            ...(daemonIngress ? { daemon: { ingress: daemonIngress } } : {}),
         }, portal)
         : undefined;
     if (nativeResource !== undefined &&

package/dist/standalone/lifecycle.js

@@ -42,7 +42,10 @@ function standaloneScriptVariants(name, manifest, expected) {
     const diagnostic = renderNativeGatewayDiagnostic(manifest, name);
     const wait = renderNativeGatewayPortWait(manifest, name);
     const diagnosticOnly = wait ? expected.replace(wait, '') : expected;
-    return [expected, ...(wait ? [diagnosticOnly] : []), ...(diagnostic ? [diagnosticOnly.replace(diagnostic, '')] : [])];
+    const variants = [expected, ...(wait ? [diagnosticOnly] : []), ...(diagnostic ? [diagnosticOnly.replace(diagnostic, '')] : [])];
+    // Released packages stop the daemon in preupgrade without the first-daemon guard.
+    const unguarded = (v) => v.replace(daemonGuard(manifest.package), '').replace(delegatedDaemonGuard(manifest.package), '');
+    return name === 'preupgrade' ? [...new Set([...variants, ...variants.map(unguarded)])] : variants;
 }
 function renderStandaloneScriptInternal(name, manifest) {
     if (manifest.compose) {
@@ -212,11 +215,11 @@ function renderDelegatedDaemonScript(name, manifest) {
     const worker = (action) => `/usr/syno/bin/synosystemctl ${action} ${backgroundUnitName(pkg)}`;
     // Try every owner even on failure; never leave protected ingress open merely
     // because a producer could not stop. A partial teardown remains a failure.
-    const stop = (daemonAction, executorAction, executorStop = executor(executorAction)) => `result=0\nstop_background_worker || result=1\n${daemon} ${daemonAction} ${paths} || result=1\n${executorStop} || result=1\nexit "$result"\n`;
+    const stop = (daemonAction, executorAction, executorStop = executor(executorAction), guard = "") => `result=0\nstop_background_worker || result=1\n${guard}${daemon} ${daemonAction} ${paths} || result=1\n${executorStop} || result=1\nexit "$result"\n`;
     const workerStop = renderBackgroundWorkerStop(pkg);
     if (name !== "start-stop-status") {
         if (name === "preupgrade")
-            return `#!/bin/sh\n${renderExecutorUpgradeStop(pkg)}${workerStop}${stop("stop", "stop", UPGRADE_STOP)}`;
+            return `#!/bin/sh\n${renderExecutorUpgradeStop(pkg)}${workerStop}${stop("stop", "stop", UPGRADE_STOP, delegatedDaemonGuard(pkg))}`;
         const purge = manifest.uninstall
             ? stop(manifest.daemon?.uninstall_args ? "uninstall" : "stop", "purge $synopkgland_purge_args").replace(executor("purge $synopkgland_purge_args"), () => `synopkgland_uninstall_hook\n${executor("purge $synopkgland_purge_args")}`)
             : stop(manifest.daemon?.uninstall_args ? "uninstall" : "stop", "purge");
@@ -273,6 +276,17 @@ function renderExecutorUpgradeStop(pkg) {
 }
 `;
 }
+/**
+ * preupgrade runs before DSM replaces the payload, so it sees the outgoing
+ * package. Only a payload without any daemon/ is an upgrade that introduces
+ * the daemon; a partial or symlinked daemon/ still stops or fails closed.
+ */
+const daemonAbsent = (pkg) => {
+    const dir = `"\${SYNOPKG_PKGDEST:-/var/packages/${pkg}/target}/daemon"`;
+    return `[ ! -e ${dir} ] && [ ! -L ${dir} ]`;
+};
+const daemonGuard = (pkg) => `if ${daemonAbsent(pkg)}; then exit 0; fi\n`;
+const delegatedDaemonGuard = (pkg) => `${daemonAbsent(pkg)} || `;
 function renderDaemonScript(name, manifest) {
     const pkg = manifest.package;
     const control = `"/var/packages/${pkg}/target/daemon/control"`;
@@ -283,7 +297,7 @@ function renderDaemonScript(name, manifest) {
         const uninstall = name === "preuninst" && manifest.daemon?.uninstall_args;
         const upgrade = uninstall
             ? `if [ "\${SYNOPKG_PKG_STATUS:-}" = "UPGRADE" ]; then\n  exec ${control} stop ${paths}\nfi\n`
-            : "";
+            : name === "preupgrade" ? daemonGuard(pkg) : "";
         return `#!/bin/sh\n${upgrade}exec ${control} ${uninstall ? "uninstall" : "stop"} ${paths}\n`;
     }
     if (name !== "start-stop-status")

package/dist/standalone/manifest.js

@@ -11,6 +11,7 @@ import { checkGlossary, loadCatalogs, readInfoTranslations, } from "./i18n.js";
 import { loadRootOps, readRootSettings, rootBinaryProblem, ROOT_OPS_DIR, } from "./root-ops.js";
 import { readComposeApp } from "./compose.js";
 import { readDaemon, readLifecycleTimeouts } from "./daemon.js";
+import { daemonIngressMinDsmProblem } from "./daemon-ingress.js";
 import { readIdentityGateway, } from "./identity-gateway.js";
 import { readUninstall } from "./uninstall.js";
 import { readAppScripts } from "./app-scripts.js";
@@ -277,6 +278,13 @@ function readManifest(raw, c) {
         c.fail("COMPOSE_WEB_INVALID", "Compose upstream is derived from the SDK Compose ingress endpoint; remove identity_gateway.upstream.");
     // A failed Compose plan already explains the invalid upstream declaration.
     const identityGateway = raw.compose !== undefined && !compose ? undefined : readIdentityGateway(gatewayValue, daemon || (compose ? { targets: compose.targets } : undefined), (e) => c.fail(e.code, e.message), false, Boolean(compose?.plan.ingress));
+    if (daemon?.ingress) {
+        const problem = daemonIngressMinDsmProblem(osMinVer);
+        if (problem)
+            c.fail("STANDALONE_DAEMON_INGRESS_MIN_DSM", problem);
+    }
+    if ((daemon?.ingress || daemon?.node) && raw.identity_gateway !== undefined)
+        c.fail("STANDALONE_DAEMON_INVALID", "daemon.node and daemon.ingress run the App's own daemon; identity_gateway runs its gateway as the daemon. Use one or the other.");
     if (compose && identityGateway && compose.sdk !== identityGateway.sdk)
         c.fail("STANDALONE_IDENTITY_GATEWAY_INVALID", "compose and identity_gateway must use the same SDK release.");
     if (compose &&

package/dist/standalone/resource.d.ts

@@ -3,6 +3,7 @@ import type { Capabilities } from "./manifest.js";
 import { type SharedFolder } from "./shared-folder.js";
 import { type PortalPackage } from "../portal/package.js";
 import { type NativeGatewayPlan } from './native-gateway.js';
+import { type DaemonIngress } from "./daemon-ingress.js";
 /**
  * `conf/resource` for a native package: only DSM's official `data-share`,
  * `systemd-user-unit` and `web-config` workers, in a fixed key order.
@@ -15,4 +16,7 @@ export declare function renderStandaloneResource(m: {
     capabilities: Capabilities;
     compose?: ComposeApp;
     sharedFolder?: SharedFolder;
+    daemon?: {
+        ingress?: DaemonIngress;
+    };
 }, portal?: PortalPackage): string | undefined;

package/dist/standalone/resource.js

@@ -2,6 +2,7 @@ import { renderDockerProjectResource } from "../build-spk/resource-worker.js";
 import { sharedFolderResource } from "./shared-folder.js";
 import { portalResource } from "../portal/package.js";
 import { nativeGatewayResource } from './native-gateway.js';
+import { daemonIngressResource } from "./daemon-ingress.js";
 /**
  * `conf/resource` for a native package: only DSM's official `data-share`,
  * `systemd-user-unit` and `web-config` workers, in a fixed key order.
@@ -9,7 +10,10 @@ import { nativeGatewayResource } from './native-gateway.js';
  */
 export function renderStandaloneResource(m, portal) {
     const dataShare = m.sharedFolder && sharedFolderResource(m.package, m.sharedFolder);
-    const webConfig = { ...(portal ? portalResource()['web-config'] : {}), ...nativeGatewayResource(m) };
+    const nginx = [nativeGatewayResource(m), m.daemon?.ingress && daemonIngressResource()]
+        .flatMap((r) => r?.["nginx-static-config"]?.enable ?? []);
+    const webConfig = { ...(portal ? portalResource()['web-config'] : {}),
+        ...(nginx.length ? { 'nginx-static-config': { enable: nginx } } : {}) };
     const resource = {
         ...(m.compose?.plan.devices?.gpu && !m.compose.plan.mounts_blocked ? { "video-driver": {} } : {}),
         ...(m.compose && !m.compose.plan.mounts_blocked

package/dist/standalone/spk.js

@@ -29,7 +29,8 @@ import { copyAppTree } from "./bridge-app.js";
 import { isBridgeBackend } from "./bridge-backend.js";
 import { hostScriptName, renderHostAdapterScript } from "./host-adapter.js";
 import { writeComposePayload } from "./compose.js";
-import { copyDaemonPayload } from "./daemon.js";
+import { copyDaemonPayload, nodeDependency } from "./daemon.js";
+import { DAEMON_INGRESS_CONFIG, renderDaemonIngressConfig } from "./daemon-ingress.js";
 import { GATEWAY_CGI_PATH, GATEWAY_CONFIG_PATH, GATEWAY_EXEC, identityGatewayConfig, identityGatewayDeclaration, } from "./identity-gateway.js";
 import { BACKGROUND_UNIT_DIR, BACKGROUND_WORKER_PAYLOAD, backgroundUnitName, renderBackgroundUnit, BRIDGE_WORKER_ARGS, } from "./background.js";
 import { renderStandaloneResource } from "./resource.js";
@@ -104,6 +105,8 @@ export async function assembleStandaloneSpk(options) {
             if (!options.daemonControl)
                 throw new StandaloneBuildError("STANDALONE_DAEMON_ARTIFACT_REQUIRED", "daemon controller artifact required.");
             copyDaemonPayload(manifest, options.arch, join(staging, "package", "daemon"), options.daemonControl);
+            if (manifest.daemon?.ingress)
+                writeFile(join(staging, "package", DAEMON_INGRESS_CONFIG), renderDaemonIngressConfig(manifest.package, manifest.daemon.ingress));
         }
         if (manifest.identityGateway) {
             if (!options.identityGateway)
@@ -230,6 +233,8 @@ export async function assembleStandaloneSpk(options) {
             backend: manifest.backend.kind,
             ...(gatewayAdmissionPolicy(manifest.identityGateway, manifest.entry) ? { provider_only_oidc: gatewayAdmissionPolicy(manifest.identityGateway, manifest.entry) } : {}),
             ...(nativeGatewaySupported(manifest) ? { native_gateway: { sdk: manifest.identityGateway.sdk, listen: manifest.identityGateway.listen } } : {}),
+            ...(manifest.daemon?.ingress ? { daemon_ingress: manifest.daemon.ingress } : {}),
+            ...(manifest.daemon?.node ? { daemon_node: manifest.daemon.node } : {}),
             launch: resolvedSdkLaunch(manifest),
             capabilities: Object.keys(manifest.capabilities).sort(),
             ...(manifest.compose
@@ -360,6 +365,8 @@ export function renderInfo(manifest, arch, checksum, executorDigest) {
     const backend = manifest.backend;
     if (isBridgeBackend(backend) && backend.node)
         fields.push(["install_dep_packages", backend.node.package]);
+    if (manifest.daemon?.node)
+        fields.push(["install_dep_packages", nodeDependency(manifest.daemon.node)]);
     fields.push(...metadataInfoFields(manifest.metadata));
     // Background packages need prestart: it runs before DSM's systemd-user-unit acquire.
     if (manifest.daemon || manifest.compose || manifest.capabilities.jobs)
@@ -371,9 +378,11 @@ export function renderInfo(manifest, arch, checksum, executorDigest) {
         if (text?.description)
             fields.push([`description_${DSM_LANGS[locale]}`, text.description]);
     }
-    if (nativeGatewaySupported(manifest))
+    // DSM reloads nginx on start and stop so the location follows the package state.
+    const nginx = nativeGatewaySupported(manifest) || Boolean(manifest.daemon?.ingress);
+    if (nginx)
         fields.push(['startstop_restart_services', 'nginx.service']);
-    return portalInfoFields(fields, Boolean(manifest.portal) || nativeGatewaySupported(manifest)).map(([key, value]) => `${key}=${quote(value)}\n`).join("");
+    return portalInfoFields(fields, Boolean(manifest.portal) || nginx).map(([key, value]) => `${key}=${quote(value)}\n`).join("");
 }
 function copyUiTree(source, target) {
     for (const entry of ["app.js", "app.css"]) {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@synopackageland/cli",
-  "version": "0.25.0",
+  "version": "0.25.2",
   "description": "Syno Package Land Developer Kit CLI",
   "type": "module",
   "bin": {
@@ -27,7 +27,7 @@
   },
   "dependencies": {
     "@napi-rs/keyring": "^2.1.1",
-    "@synopackageland/templates": "0.25.0",
+    "@synopackageland/templates": "0.25.1",
     "ajv": "^8.17.1",
     "commander": "^13.1.0",
     "json-canonicalize": "^3.0.1",