@synopackageland/cli 0.25.1 → 0.26.0

package/CHANGELOG.md

@@ -1,5 +1,17 @@
 # Changelog
 
+## 0.26.0 (2026-10-22)
+
+- Support SDK/App 0.26.x and pin templates 0.26.0, retaining UI 0.14.3 and executor/v0.24.0 with unchanged protected payload digests.
+- Add optional bounded `daemon.restart` crash recovery for native Apps; require SDK 0.26.0 or later, validate the policy and record it for inspection. Initial startup and intentional stops retain their existing behavior.
+
+- Add `ui: false` for native Apps with `identity_gateway` and no SDK window. The main menu gets one url launcher to `sso/open.cgi` (new tab) and Package Center's Open goes to the same entry through INFO `adminurl`, as for Compose Apps. check refuses it without a gateway, with `console` or `portal`, or with capabilities whose approval or sign-in needs the SDK window (`STANDALONE_UI_NO_WINDOW_INVALID`); inspect verifies the single launcher and `adminurl`. Apps with `ui.dir` build unchanged.
+
+## 0.25.2 (2026-10-22)
+
+- Use templates 0.25.1 with the native Rust lockfile pinned to the public SDK 0.25.0 commit. SDK/App support and executor/lifecycle digests are unchanged.
+- Update SDK download and Go build diagnostics for anonymous access to the public repository.
+
 ## 0.25.1 (2026-10-22)
 
 - Fix upgrades that first add a `daemon`: the generated `preupgrade` ran the old payload's missing `daemon/control` and DSM rolled back with error 4541. The hook now exits 0 when the outgoing payload has no `daemon/` (plain, executor and delegated-worker variants); inspect still accepts the released unguarded hook.

package/README.md

@@ -278,6 +278,16 @@ sets it for every language. Omit `console` to keep one icon. check refuses
 `console` on Compose, without `identity_gateway`, or with `ui.launch` or
 `portal`. A cold DSM sign-in resumes through the url launcher.
 
+A native App with `identity_gateway` whose only UI is the wrapped web app
+declares `ui: false` instead of `ui.dir`. It gets no SDK window: the main menu
+has one icon (`displayname`, a `type: "url"` launcher to `sso/open.cgi` that
+opens a new tab), and Package Center's Open goes to the same entry through
+INFO `adminurl`, as for a Compose App. The backend and ctl commands are
+unchanged. check refuses `ui: false` without `identity_gateway`, with `console`
+or `portal`, or with `capabilities.rootOps`, `delegate`, `webapi` or
+`identity`, whose approval or sign-in is shown in the SDK window
+(`STANDALONE_UI_NO_WINDOW_INVALID`). A missing `ui` is still an error.
+
 Compose uses schema-2 `dsm-package.yaml` and `ui.launch`; the default is new-page.
 Classless gateways use type url via the shared contract/app-launch resolver;
 AppWindow wrappers use standalone. Headless projects have no launcher.

package/dist/error-registry.js

@@ -282,6 +282,16 @@ export const ERROR_REGISTRY = {
             description: "The package daemon declaration does not match the fixed argv, environment and lifecycle contract.",
             suggestion: "Check daemon.exec, the per-architecture targets, args, env, uninstall_args and integer-second timeouts; remove shell, user and custom conf.",
         },
+        STANDALONE_DAEMON_RESTART_INVALID: {
+            code: "STANDALONE_DAEMON_RESTART_INVALID",
+            description: "daemon.restart does not match the bounded native crash-recovery policy.",
+            suggestion: "Use mode off or on-failure, integer delay/attempt/window limits, and max_seconds at least initial_seconds; omit or set limits to zero for SDK defaults and remove unknown fields.",
+        },
+        STANDALONE_DAEMON_RESTART_SDK_REQUIRED: {
+            code: "STANDALONE_DAEMON_RESTART_SDK_REQUIRED",
+            description: "The selected controller SDK version or source does not support daemon.restart.",
+            suggestion: "Upgrade the selected controller SDK to 0.26.0 or later and use matching sources, including a local SDK override; update the App SDK requirement, identity_gateway.sdk or the templates that supply the default.",
+        },
         UNINSTALL_INVALID: {
             code: "UNINSTALL_INVALID",
             description: "The uninstall declaration does not match the fixed exec, argv, environment and timeout contract.",
@@ -485,7 +495,12 @@ export const ERROR_REGISTRY = {
         STANDALONE_UI_INVALID: {
             code: "STANDALONE_UI_INVALID",
             description: "The ui configuration is invalid.",
-            suggestion: "Provide ui.dir.",
+            suggestion: "Provide ui.dir, or ui: false for a native identity_gateway App without an SDK window.",
+        },
+        STANDALONE_UI_NO_WINDOW_INVALID: {
+            code: "STANDALONE_UI_NO_WINDOW_INVALID",
+            description: "ui: false is declared where the App needs an SDK window.",
+            suggestion: "ui: false needs identity_gateway and no console, portal, capabilities.rootOps, delegate, webapi or identity; otherwise declare ui.dir.",
         },
         STANDALONE_UI_BUILD_INVALID: {
             code: "STANDALONE_UI_BUILD_INVALID",
@@ -540,7 +555,7 @@ export const ERROR_REGISTRY = {
         STANDALONE_GO_BUILD_FAILED: {
             code: "STANDALONE_GO_BUILD_FAILED",
             description: "go build failed.",
-            suggestion: "Run go build ./... in the backend directory and fix the errors. If github.com/synopackageland/syno-pkg-land-sdk is unreachable, make sure git can read github.com with credentials (verify with git ls-remote).",
+            suggestion: "Run go build ./... in the backend directory and fix the errors. If github.com/synopackageland/syno-pkg-land-sdk is unreachable, check network access to the configured Go proxy or the public GitHub repository.",
         },
         STANDALONE_PORTAL_INVALID: {
             code: "STANDALONE_PORTAL_INVALID",
@@ -905,7 +920,7 @@ export const ERROR_REGISTRY = {
         SDK_DOWNLOAD_FAILED: {
             code: "SDK_DOWNLOAD_FAILED",
             description: "go mod download cannot fetch the SDK version backend/go.mod requires.",
-            suggestion: "The CLI fetches the private SDK with git: make sure git can read github.com with credentials (verify with git ls-remote), then confirm the version exists. Offline, run go mod download once on the same machine first.",
+            suggestion: "Confirm the SDK version exists in the public repository and check network access to the configured Go proxy or github.com. Offline, run go mod download for that version on the same machine first.",
         },
         TEMPLATES_MISSING: {
             code: "TEMPLATES_MISSING",

package/dist/runtime/executor-digests.json

@@ -1,5 +1,5 @@
 {
-    "0.25.0": {
+    "0.26.0": {
         "x86_64": "de78684faac211c24a7cda8a4541ab1b138d37f6d580936fe354bb9bd0d78a0f",
         "aarch64": "8ef7c736203f6c111816b76f970b7204fa6f8d871ff3222fd7c0a27d0075b847",
         "armv7": "a38703119554b5f2a8bf4810ec2a6c8f1d793bfbb1ca96803eb1b39a26ffd96c",

package/dist/runtime/sdk-source.js

@@ -76,7 +76,7 @@ function goMod(backendDir) {
     }
 }
 /** SDK releases that reuse an immutable executor release with identical payload bytes. */
-const EXECUTOR_RELEASES = { '0.21.0': '0.20.0', '0.21.1': '0.20.0', '0.22.0': '0.20.0', '0.23.0': '0.20.0', '0.23.1': '0.20.0', '0.23.2': '0.20.0', '0.24.1': '0.24.0', '0.25.0': '0.24.0' };
+const EXECUTOR_RELEASES = { '0.21.0': '0.20.0', '0.21.1': '0.20.0', '0.22.0': '0.20.0', '0.23.0': '0.20.0', '0.23.1': '0.20.0', '0.23.2': '0.20.0', '0.24.1': '0.24.0', '0.25.0': '0.24.0', '0.26.0': '0.24.0' };
 /**
  * The module directories of one SDK version. SYNOPKGLAND_SDK_DIR names a
  * local sdk checkout (development and gates only); otherwise modules come from

package/dist/standalone/daemon-restart.d.ts

@@ -0,0 +1,15 @@
+import type { StandaloneError } from "./manifest.js";
+export declare const DAEMON_RESTART_MIN_SDK = "0.26.0";
+export interface DaemonRestart {
+    mode: "off" | "on-failure";
+    initial_seconds: number;
+    max_seconds: number;
+    max_attempts: number;
+    window_seconds: number;
+}
+/** Normalize exactly the SDK's zero/omitted defaults; omission itself stays off. */
+export declare function readDaemonRestart(value: unknown, fail: (error: StandaloneError) => void): DaemonRestart | undefined;
+export declare function daemonRestartSdkSupported(sdk: string): boolean;
+export declare function daemonRestartSdkProblem(sdk: string): string | undefined;
+/** Development overrides must contain the decoder as well as the restart code. */
+export declare function requireDaemonRestartSource(dir: string, sdk: string, policy?: DaemonRestart): void;

package/dist/standalone/daemon-restart.js

@@ -0,0 +1,55 @@
+import { Ajv } from "ajv";
+import { readFileSync } from "node:fs";
+import { join } from "node:path";
+import { StandaloneBuildError } from "./spk.js";
+export const DAEMON_RESTART_MIN_SDK = "0.26.0";
+let validator;
+function restartValidator() {
+    return validator ??= new Ajv().compile(JSON.parse(readFileSync(new URL("../../schema/daemon-restart.v1.schema.json", import.meta.url), "utf8")));
+}
+/** Normalize exactly the SDK's zero/omitted defaults; omission itself stays off. */
+export function readDaemonRestart(value, fail) {
+    if (value === undefined)
+        return undefined;
+    if (restartValidator()(value)) {
+        const raw = value;
+        const policy = {
+            mode: raw.mode,
+            initial_seconds: raw.initial_seconds || 1,
+            max_seconds: raw.max_seconds || 30,
+            max_attempts: raw.max_attempts || 5,
+            window_seconds: raw.window_seconds || 300,
+        };
+        if (policy.max_seconds >= policy.initial_seconds)
+            return policy;
+    }
+    fail({
+        code: "STANDALONE_DAEMON_RESTART_INVALID",
+        message: "daemon.restart requires mode off or on-failure; delays 1–3600s (max >= initial), attempts 1–100 and window 1–86400s. Omitted or zero limits use SDK defaults; unknown fields are rejected.",
+    });
+    return undefined;
+}
+export function daemonRestartSdkSupported(sdk) {
+    const match = /^(\d+)\.(\d+)\.(\d+)$/.exec(sdk);
+    return Boolean(match && (Number(match[1]) > 0 || Number(match[2]) >= 26));
+}
+export function daemonRestartSdkProblem(sdk) {
+    if (!daemonRestartSdkSupported(sdk))
+        return `daemon.restart requires SDK ${DAEMON_RESTART_MIN_SDK} or later; selected SDK ${sdk}. Upgrade the App's SDK pin, identity_gateway.sdk or the templates supplying the default controller SDK before rebuilding.`;
+    return undefined;
+}
+/** Development overrides must contain the decoder as well as the restart code. */
+export function requireDaemonRestartSource(dir, sdk, policy) {
+    if (!policy)
+        return;
+    let main = "", restart = "";
+    try {
+        main = readFileSync(join(dir, "daemonctl/main.go"), "utf8");
+        restart = readFileSync(join(dir, "daemonctl/restart.go"), "utf8");
+    }
+    catch { /* Fail below before compiling or packaging a mismatched runtime. */ }
+    const problem = daemonRestartSdkProblem(sdk);
+    if (problem || !/\bRestart\s+\*restartPolicy\s+`json:"restart,omitempty"`/.test(main) ||
+        !/^func normalizeRestart\(/m.test(restart) || !/^type restartBudget struct\s*\{/m.test(restart))
+        throw new StandaloneBuildError("STANDALONE_DAEMON_RESTART_SDK_REQUIRED", problem ?? `Selected SDK ${sdk} source does not support daemon.restart; use matching SDK ${DAEMON_RESTART_MIN_SDK} or later sources, including for a local development override.`);
+}

package/dist/standalone/daemon.d.ts

@@ -1,9 +1,12 @@
 import type { NativeArchFamily } from "../build-spk/dsm-arch.js";
 import { NODE_PACKAGES } from "./bridge-backend.js";
 import { type DaemonIngress } from "./daemon-ingress.js";
+import { type DaemonRestart } from "./daemon-restart.js";
 import type { CommandRunner } from "./build.js";
 import type { StandaloneError, StandaloneManifest } from "./manifest.js";
 export interface Daemon {
+    /** Optional bounded recovery; omitted means off. SDK 0.26.0 or later. */
+    restart?: DaemonRestart;
     /** Fixed foreground executable relative to daemon/payload. */
     exec: string;
     /** Architecture-specific project directories, copied without links. */
@@ -46,6 +49,7 @@ export declare const envKey: (k: string) => boolean;
 /** A relative path to a fixed executable, without `.` or `..` parts. */
 export declare const relativeExec: (v: unknown) => v is string;
 export declare function readDaemon(value: unknown, root: string, arches: NativeArchFamily[], fail: (error: StandaloneError) => void): Daemon | undefined;
+export declare function daemonSdkVersion(manifest: Pick<StandaloneManifest, "backend" | "identityGateway">): string;
 export declare function daemonConfig(manifest: StandaloneManifest): string;
 /**
  * The argv and environment daemon/control runs: a Node daemon execs the

package/dist/standalone/daemon.js

@@ -8,6 +8,7 @@ import { templateSdkVersion } from "../template-paths.js";
 import { checkCgiBinary } from "./binary.js";
 import { NODE_PACKAGES } from "./bridge-backend.js";
 import { readDaemonIngress, ingressEnv } from "./daemon-ingress.js";
+import { readDaemonRestart, requireDaemonRestartSource } from "./daemon-restart.js";
 import { composeDaemon, composeNetwork } from "./compose.js";
 import { gatewayDaemon } from "./identity-gateway.js";
 import { StandaloneBuildError } from "./spk.js";
@@ -41,6 +42,7 @@ const fields = new Set([
     "uninstall_args",
     "node",
     "ingress",
+    "restart",
 ]);
 const record = (v) => Boolean(v) && typeof v === "object" && !Array.isArray(v);
 /** A fixed argv or env value: only the package's own directories expand. */
@@ -110,6 +112,9 @@ export function readDaemon(value, root, arches, fail) {
     const timeouts = readLifecycleTimeouts(value.timeouts, fail);
     if (!timeouts)
         return undefined;
+    const restart = readDaemonRestart(value.restart, fail);
+    if (value.restart !== undefined && !restart)
+        return undefined;
     const node = readDaemonNode(value.node, fail);
     if (value.node !== undefined && !node)
         return undefined;
@@ -129,6 +134,7 @@ export function readDaemon(value, root, arches, fail) {
         timeouts: timeouts,
         ...(node ? { node } : {}),
         ...(ingress ? { ingress } : {}),
+        ...(restart ? { restart } : {}),
     };
 }
 function readDaemonNode(value, fail) {
@@ -152,13 +158,13 @@ function readDaemonNode(value, fail) {
     }
     return { package: pkg, ...(min ? { min_version: min } : {}) };
 }
-function daemonSdkVersion(manifest) {
+export function daemonSdkVersion(manifest) {
     return manifest.identityGateway?.sdk ??
         (manifest.backend.kind === "go" ? appSdkVersion(manifest.backend) : undefined) ??
         templateSdkVersion();
 }
 export function daemonConfig(manifest) {
-    const { exec, args, uninstall_args, env, timeouts } = manifest.compose
+    const { exec, args, uninstall_args, env, timeouts, restart } = manifest.compose
         ? composeDaemon(manifest)
         : manifest.identityGateway
             ? gatewayDaemon(manifest.daemon)
@@ -168,6 +174,7 @@ export function daemonConfig(manifest) {
         exec,
         args,
         ...(uninstall_args ? { uninstall_args } : {}),
+        ...(restart ? { restart } : {}),
         env,
         timeouts,
         ...(runtimeBudgetSdkSupported(daemonSdkVersion(manifest))
@@ -193,6 +200,9 @@ export async function buildDaemonControl(manifest, arch, work, run) {
     if (!manifest.daemon && !(manifest.compose && manifest.identityGateway))
         return undefined;
     const out = join(work, `daemon-control-${arch}`);
+    const sdk = daemonSdkVersion(manifest);
+    const source = runtimeBudgetSource(sdkSource(sdk).goDir, manifest);
+    requireDaemonRestartSource(source, sdk, manifest.daemon?.restart);
     const result = await run("go", [
         "build",
         "-trimpath",
@@ -203,7 +213,7 @@ export async function buildDaemonControl(manifest, arch, work, run) {
         out,
         "./daemonctl",
     ], {
-        cwd: runtimeBudgetSource(sdkSource(daemonSdkVersion(manifest)).goDir, manifest),
+        cwd: source,
         env: goChildEnv({ ...process.env, ...pinnedGoBuildEnv(arch) }),
     });
     if (result.missing || result.status !== 0)

package/dist/standalone/dsm-window.d.ts

@@ -25,6 +25,8 @@ export declare function windowScriptName(manifest: Pick<StandaloneManifest, "bui
 /** The launcher fields an entry mode fixes; inspect checks a built SPK against them. */
 export declare function entryLauncherAccess(entry: EntryMode): Record<string, unknown>;
 export declare function appTitle(manifest: StandaloneManifest): AppTitle;
+/** Whether the App ships the SDK window; Compose and `ui: false` Apps open the gateway instead. */
+export declare function hasSdkWindow(manifest: Pick<StandaloneManifest, "compose" | "sdkWindow">): boolean;
 /** The DSM app class whose launch opens the SDK window: the console's when the App declares one. */
 export declare function windowAppId(manifest: Pick<StandaloneManifest, "package" | "console">): string;
 /**

package/dist/standalone/dsm-window.js

@@ -74,7 +74,7 @@ function launcherAccess(manifest) {
     return manifest.entry
         ? entryLauncherAccess(manifest.entry)
         : {
-            allUsers: manifest.compose || manifest.console
+            allUsers: manifest.compose || manifest.console || !hasSdkWindow(manifest)
                 ? manifest.identityGateway?.access !== "dsm-admins"
                 : permitsOrdinaryUsers(manifest.apiPermissions),
         };
@@ -107,6 +107,10 @@ function displayNameCatalogs(manifest) {
     }
     return catalogs;
 }
+/** Whether the App ships the SDK window; Compose and `ui: false` Apps open the gateway instead. */
+export function hasSdkWindow(manifest) {
+    return !manifest.compose && manifest.sdkWindow !== false;
+}
 /** The DSM app class whose launch opens the SDK window: the console's when the App declares one. */
 export function windowAppId(manifest) {
     return `SYNO.SDS.${manifest.package}.${manifest.console ? "Console" : "Instance"}`;
@@ -128,7 +132,7 @@ export function renderUiConfig(manifest, icons = packageIcons(manifest.icon), lo
     const icon = windowIconTemplate(icons);
     const ns = `SYNO.SDS.${manifest.package}`;
     const titleFields = uiTitleFields(appTitle(manifest));
-    if (manifest.compose) {
+    if (!hasSdkWindow(manifest)) {
         if (!manifest.identityGateway)
             return "{}\n";
         return (JSON.stringify({

package/dist/standalone/inspect-spk.js

@@ -23,6 +23,7 @@ import { ELF_MACHINE } from "./binary.js";
 import { CGI_PAYLOAD_PATH, entryLauncherAccess } from "./dsm-window.js";
 import { daemonConfig, readDaemon, readLifecycleTimeouts, renderNodeLauncher, nodeDependency, NODE_LAUNCHER } from "./daemon.js";
 import { DAEMON_INGRESS_CONFIG, daemonIngressMinDsmProblem, readDaemonIngress, renderDaemonIngressConfig } from "./daemon-ingress.js";
+import { daemonRestartSdkProblem, readDaemonRestart } from "./daemon-restart.js";
 import { ROOT_SCRIPT_HINTS } from "./root-ops.js";
 import { DELETE_STATE_KEY } from "../build-spk/uninstall-wizard.js";
 import { readUninstallRecord, stateItemTexts } from "./uninstall.js";
@@ -114,7 +115,9 @@ export async function inspectSpk(spkPath, expectedKind) {
                     new Set(raw.capabilities).size !== raw.capabilities.length ||
                     (raw.entry !== undefined &&
                         !["admin-only", "app-privilege"].includes(raw.entry)) ||
-                    (raw.console !== undefined && raw.console !== true))
+                    (raw.console !== undefined && raw.console !== true) ||
+                    (raw.window !== undefined &&
+                        (raw.window !== false || raw.console !== undefined)))
                     throw new Error();
                 if (raw.lifecycleTimeouts !== undefined && (!readLifecycleTimeouts(raw.lifecycleTimeouts, () => { }) || Object.keys(raw.lifecycleTimeouts).length !== 4))
                     throw new Error();
@@ -126,6 +129,9 @@ export async function inspectSpk(spkPath, expectedKind) {
                 findings.push("sdk-package.json does not match the schema 2 capability inventory.");
             }
         }
+        const daemonRestart = recoverDaemonRestart(metadata.daemon_restart, metadata.daemon_sdk, findings);
+        if (metadata.daemon_restart !== undefined && (metadata.compose !== undefined || !paths.has("daemon/control")))
+            findings.push("DAEMON_RESTART_INVALID daemon restart requires a native daemon controller, without Compose supervision");
         const identityGateway = await inspectProviderOnlyAdmission(dir, paths, metadata.provider_only_oidc, findings);
         const installSettings = await inspectInstallSettings(dir, payload, metadata, findings);
         if (metadata.compose !== undefined) {
@@ -210,7 +216,7 @@ export async function inspectSpk(spkPath, expectedKind) {
         if (standalone && portal)
             findings.push(...inspectPortalInfo(info, hasExecutor));
         const daemon = standalone
-            ? await checkDaemon(dir, info, paths, payload, findings, hasExecutor, background, combined, nativeGateway, uninstallHook?.uninstall, { ingress: daemonIngress, node: daemonNode })
+            ? await checkDaemon(dir, info, paths, payload, findings, hasExecutor, background, combined, nativeGateway, uninstallHook?.uninstall, { ingress: daemonIngress, node: daemonNode, restart: daemonRestart })
             : undefined;
         if (background)
             checkBackground(dir, info, payload, findings, hasExecutor, daemon, kind !== "native-go", metadata.lifecycleTimeouts, nativeGateway);
@@ -276,7 +282,7 @@ export async function inspectSpk(spkPath, expectedKind) {
         }
         if (metadata.entry)
             await checkEntryLauncher(dir, info.package, metadata.entry, findings);
-        const launch = await checkLaunchConfiguration(dir, info, standalone, metadata.launch, portal?.alias ?? executor?.policy.portal?.alias, findings, metadata.console === true);
+        const launch = await checkLaunchConfiguration(dir, info, standalone, metadata.launch, portal?.alias ?? executor?.policy.portal?.alias, findings, metadata.console === true, metadata.window === false);
         const loginStyle = standalone
             ? await inspectLoginStyle(dir, info.package, Boolean(portal || executor?.policy.portal), findings)
             : undefined;
@@ -340,7 +346,7 @@ export async function inspectSpk(spkPath, expectedKind) {
 const LAUNCHER_TYPE_MISMATCH = "LAUNCHER_TYPE_MISMATCH";
 const LAUNCHER_PORTAL_MISMATCH = "LAUNCHER_PORTAL_MISMATCH";
 /** Compare the actual launcher and Portal fields to the packaged declaration. */
-async function checkLaunchConfiguration(dir, info, native, declared, alias, findings, console = false) {
+async function checkLaunchConfiguration(dir, info, native, declared, alias, findings, console = false, windowless = false) {
     const target = join(dir, "launch-inspection");
     mkdirSync(target);
     await tar.x({
@@ -395,6 +401,10 @@ async function checkLaunchConfiguration(dir, info, native, declared, alias, find
         checkConsoleLaunchers(target, info, native, findings);
         return launch;
     }
+    if (windowless) {
+        checkGatewayOnlyLauncher(target, info, native, findings);
+        return launch;
+    }
     const type = dsmLauncherType(launch, native);
     if (!launcher ||
         launcher.type !== type ||
@@ -443,6 +453,36 @@ function checkConsoleLaunchers(target, info, native, findings) {
         findings.push(`${LAUNCHER_TYPE_MISMATCH} console requires a url launcher at ${ns}.Instance to sso/open.cgi, an administrator-only app launcher at ${ns}.Console and INFO dsmapplaunchname=${ns}.Console; rebuild with synopkgland build`);
     }
 }
+/**
+ * A `ui: false` App's ui/config: one url launcher at `.Instance` to the
+ * gateway, which INFO's adminurl also opens for Package Center's Open, and
+ * no SDK window.
+ */
+function checkGatewayOnlyLauncher(target, info, native, findings) {
+    const ns = `SYNO.SDS.${info.package}`;
+    const entry = `/webman/3rdparty/${info.package}/sso/open.cgi`;
+    let config = {};
+    try {
+        config = JSON.parse(readFileSync(join(target, "ui/config"), "utf8"));
+    }
+    catch {
+        /* reported below as a missing launcher */
+    }
+    const sections = Object.keys(config);
+    const instance = config[".url"]?.[`${ns}.Instance`];
+    if (!native ||
+        sections.length !== 1 ||
+        Object.keys(config[".url"] ?? {}).length !== 1 ||
+        instance?.type !== "url" ||
+        instance.url !== entry ||
+        instance.appWindow !== undefined ||
+        info.dsmuidir !== "ui" ||
+        info.dsmappname !== `${ns}.Instance` ||
+        info.dsmapplaunchname !== undefined ||
+        info.adminurl !== entry) {
+        findings.push(`${LAUNCHER_TYPE_MISMATCH} ui: false requires only a url launcher at ${ns}.Instance to sso/open.cgi and INFO adminurl to the same entry; rebuild with synopkgland build`);
+    }
+}
 /** The launcher in ui/config must carry exactly the access the declared entry mode fixes. */
 async function checkEntryLauncher(dir, pkg, entry, findings) {
     const target = join(dir, "entry-inspection");
@@ -877,15 +917,19 @@ async function checkDaemon(dir, info, paths, payload, findings, executor, backgr
                 "timeouts",
                 "operation_seconds",
                 "uninstall_args",
+                "restart",
                 ...(combined ? ["network"] : []),
             ].includes(key)))
             throw new Error("package/config mismatch");
+        if (!isDeepStrictEqual(config.restart, extras.restart))
+            throw new Error("daemon restart differs from its build declaration");
         const daemon = readDaemon({
             exec: config.exec,
             args: config.args,
             uninstall_args: config.uninstall_args,
             env: config.env,
             timeouts: config.timeouts,
+            restart: config.restart,
             targets: { x86_64: "payload" },
         }, dir, ["x86_64"], () => { });
         if (!daemon)
@@ -947,8 +991,18 @@ async function checkDaemon(dir, info, paths, payload, findings, executor, backgr
         return daemon;
     }
     catch {
-        findings.push("daemon/config.json or the payload does not match the fixed daemon contract");
+        findings.push("daemon/config.json (including restart) or the payload does not match the fixed daemon contract");
+    }
+}
+function recoverDaemonRestart(value, sdk, findings) {
+    if (value === undefined && sdk === undefined)
+        return undefined;
+    const policy = readDaemonRestart(value, () => { });
+    if (!policy || !isDeepStrictEqual(policy, value) || typeof sdk !== "string" || daemonRestartSdkProblem(sdk)) {
+        findings.push("DAEMON_RESTART_INVALID sdk-package.json must record a normalized daemon restart policy and SDK 0.26.0 or later");
+        return undefined;
     }
+    return policy;
 }
 /** INFO retains the localized title inputs used by build's ui/config renderer. */
 function archivedInfoTranslations(info) {

package/dist/standalone/manifest.d.ts

@@ -100,6 +100,12 @@ export interface StandaloneManifest {
     entry?: EntryMode;
     /** `portal`: registers the DSM Application Portal entry; an administrator activates it. */
     portal?: PortalDeclaration;
+    /**
+     * `ui: false`: a native identity_gateway App with no SDK window. Its one
+     * main-menu icon and Package Center's Open both go to the gateway's web UI,
+     * as for a Compose App. Absent when the App has a `ui` directory.
+     */
+    sdkWindow?: false;
     /**
      * `console`: the main menu gets two icons, the gateway's native UI in a new
      * tab and the SDK UI in an administrator-only DSM window titled `title`

package/dist/standalone/manifest.js

@@ -10,7 +10,8 @@ import { isNativeArchFamily, } from "../build-spk/dsm-arch.js";
 import { checkGlossary, loadCatalogs, readInfoTranslations, } from "./i18n.js";
 import { loadRootOps, readRootSettings, rootBinaryProblem, ROOT_OPS_DIR, } from "./root-ops.js";
 import { readComposeApp } from "./compose.js";
-import { readDaemon, readLifecycleTimeouts } from "./daemon.js";
+import { daemonSdkVersion, readDaemon, readLifecycleTimeouts } from "./daemon.js";
+import { daemonRestartSdkProblem } from "./daemon-restart.js";
 import { daemonIngressMinDsmProblem } from "./daemon-ingress.js";
 import { readIdentityGateway, } from "./identity-gateway.js";
 import { readUninstall } from "./uninstall.js";
@@ -283,6 +284,11 @@ function readManifest(raw, c) {
         if (problem)
             c.fail("STANDALONE_DAEMON_INGRESS_MIN_DSM", problem);
     }
+    if (daemon?.restart && backend) {
+        const problem = daemonRestartSdkProblem(daemonSdkVersion({ backend, identityGateway }));
+        if (problem)
+            c.fail("STANDALONE_DAEMON_RESTART_SDK_REQUIRED", problem);
+    }
     if ((daemon?.ingress || daemon?.node) && raw.identity_gateway !== undefined)
         c.fail("STANDALONE_DAEMON_INVALID", "daemon.node and daemon.ingress run the App's own daemon; identity_gateway runs its gateway as the daemon. Use one or the other.");
     if (compose && identityGateway && compose.sdk !== identityGateway.sdk)
@@ -338,7 +344,10 @@ function readManifest(raw, c) {
         }
         permissions.policy = floored.policy;
     }
-    const ui = raw.compose !== undefined
+    const noWindow = raw.compose === undefined && raw.ui === false;
+    if (noWindow)
+        readNoWindow(raw, capabilities, c);
+    const ui = raw.compose !== undefined || noWindow
         ? {
             dir: c.root,
             ...(isRecord(raw.ui) && raw.ui.launch !== undefined
@@ -347,8 +356,8 @@ function readManifest(raw, c) {
         }
         : readUi(raw.ui, c);
     if (raw.compose !== undefined &&
-        isRecord(raw.ui) &&
-        Object.keys(raw.ui).some((k) => k !== "launch"))
+        raw.ui !== undefined &&
+        (!isRecord(raw.ui) || Object.keys(raw.ui).some((k) => k !== "launch")))
         c.fail("STANDALONE_UI_INVALID", "Compose uses the SDK gateway; ui accepts only launch.");
     if (raw.compose !== undefined &&
         ui?.launch !== undefined &&
@@ -466,6 +475,7 @@ function readManifest(raw, c) {
         ...(entry ? { entry } : {}),
         ...(portal ? { portal } : {}),
         ...(dsmConsole ? { console: dsmConsole } : {}),
+        ...(noWindow ? { sdkWindow: false } : {}),
         ...(icon ? { icon } : {}),
         ...(loginStyle ? { loginStyle } : {}),
         ...(appScripts ? { appScripts } : {}),
@@ -539,6 +549,24 @@ function readConsole(raw, launch, c) {
         c.fail("STANDALONE_CONSOLE_PORTAL", "console and portal both claim the App's SDK UI; declare one of them.");
     return value.title === undefined ? {} : { title: value.title };
 }
+/**
+ * `ui: false`: the gateway's web UI is the App's only UI, so the App needs
+ * identity_gateway, and nothing may need the SDK window: a console or portal
+ * is that window, and root, delegate and WebAPI approvals and the standalone
+ * sign-in page are shown in it.
+ */
+function readNoWindow(raw, capabilities, c) {
+    const fail = (why) => c.fail("STANDALONE_UI_NO_WINDOW_INVALID", `ui: false ${why}`);
+    if (raw.identity_gateway === undefined)
+        fail("needs identity_gateway: its web UI is what the main-menu icon and Package Center's Open start.");
+    if (raw.console !== undefined)
+        fail("leaves no SDK window for the console; remove console, or declare ui.dir.");
+    if (raw.portal !== undefined)
+        fail("leaves no SDK window for the portal; remove portal, or declare ui.dir.");
+    for (const name of ["rootOps", "delegate", "webapi", "identity"])
+        if (capabilities[name])
+            fail(`cannot use capabilities.${name}: its approval or sign-in is shown in the SDK window; declare ui.dir.`);
+}
 /** `login_style`: a portal's colour, wallpaper (with its thumbnail) and title image, each optional. */
 function readLoginStyle(value, portal, c) {
     const invalid = (message) => c.fail("STANDALONE_LOGIN_STYLE_INVALID", message);
@@ -736,7 +764,7 @@ function goReadsTimeout(backend, c) {
 }
 function readUi(value, c) {
     if (!isRecord(value)) {
-        return c.fail("STANDALONE_UI_INVALID", "ui must contain dir.");
+        return c.fail("STANDALONE_UI_INVALID", "ui must contain dir; a native identity_gateway App without an SDK window declares ui: false.");
     }
     if (value.launch !== undefined && !isWebLaunchMode(value.launch))
         return c.fail("STANDALONE_UI_LAUNCH_INVALID", "ui.launch must be dsm-window or new-page. Application Portal is a separate opt-in.");

package/dist/standalone/spk.js

@@ -21,7 +21,7 @@ import { renderStandaloneScript } from "./lifecycle.js";
 import { APP_SCRIPTS_DIR, APP_SCRIPTS_SPK_DIR } from "./app-scripts.js";
 import { codedMessage } from "../errors.js";
 import { DSM_LANGS, LOCALES } from "./i18n.js";
-import { appTitle, CGI_PAYLOAD_PATH, renderUiConfig, renderWindowScript, windowScriptName, } from "./dsm-window.js";
+import { appTitle, CGI_PAYLOAD_PATH, hasSdkWindow, renderUiConfig, renderWindowScript, windowScriptName, } from "./dsm-window.js";
 import { writeUiTexts } from "../build-spk/ui-texts.js";
 import { loginStyleAssets } from "../build-spk/login-style.js";
 import { copyStandaloneNotices, copyNoticeTree } from "../build-spk/notices.js";
@@ -29,7 +29,7 @@ import { copyAppTree } from "./bridge-app.js";
 import { isBridgeBackend } from "./bridge-backend.js";
 import { hostScriptName, renderHostAdapterScript } from "./host-adapter.js";
 import { writeComposePayload } from "./compose.js";
-import { copyDaemonPayload, nodeDependency } from "./daemon.js";
+import { copyDaemonPayload, daemonSdkVersion, nodeDependency } from "./daemon.js";
 import { DAEMON_INGRESS_CONFIG, renderDaemonIngressConfig } from "./daemon-ingress.js";
 import { GATEWAY_CGI_PATH, GATEWAY_CONFIG_PATH, GATEWAY_EXEC, identityGatewayConfig, identityGatewayDeclaration, } from "./identity-gateway.js";
 import { BACKGROUND_UNIT_DIR, BACKGROUND_WORKER_PAYLOAD, backgroundUnitName, renderBackgroundUnit, BRIDGE_WORKER_ARGS, } from "./background.js";
@@ -77,7 +77,7 @@ export async function assembleStandaloneSpk(options) {
         const icons = packageIcons(manifest.icon);
         const uiRoot = join(staging, "package", "ui");
         const appDir = join(uiRoot, "app");
-        if (!manifest.compose)
+        if (hasSdkWindow(manifest))
             copyUiTree(manifest.ui.dir, appDir);
         else
             mkdirSync(appDir, { recursive: true });
@@ -88,7 +88,7 @@ export async function assembleStandaloneSpk(options) {
         writeFile(join(uiRoot, "config"), renderUiConfig(manifest, icons, login?.fields));
         for (const [path, bytes] of login?.files ?? [])
             writeFile(join(uiRoot, path), bytes);
-        if (!manifest.compose)
+        if (hasSdkWindow(manifest))
             writeFile(join(uiRoot, windowScriptName(manifest)), renderWindowScript(manifest, assetVersion, icons, options.portalText));
         writeFile(join(uiRoot, hostScriptName(manifest.build)), renderHostAdapterScript(manifest.package));
         writeDsmWindowIcons(uiRoot, icons);
@@ -235,6 +235,7 @@ export async function assembleStandaloneSpk(options) {
             ...(nativeGatewaySupported(manifest) ? { native_gateway: { sdk: manifest.identityGateway.sdk, listen: manifest.identityGateway.listen } } : {}),
             ...(manifest.daemon?.ingress ? { daemon_ingress: manifest.daemon.ingress } : {}),
             ...(manifest.daemon?.node ? { daemon_node: manifest.daemon.node } : {}),
+            ...(manifest.daemon?.restart ? { daemon_restart: manifest.daemon.restart, daemon_sdk: daemonSdkVersion(manifest) } : {}),
             launch: resolvedSdkLaunch(manifest),
             capabilities: Object.keys(manifest.capabilities).sort(),
             ...(manifest.compose
@@ -248,6 +249,7 @@ export async function assembleStandaloneSpk(options) {
                 : {}),
             ...(manifest.entry ? { entry: manifest.entry } : {}),
             ...(manifest.console ? { console: true } : {}),
+            ...(manifest.sdkWindow === false ? { window: false } : {}),
             ...(manifest.uninstall
                 ? {
                     uninstall: uninstallRecord(manifest.uninstall, manifest.i18n?.catalogs),
@@ -353,15 +355,14 @@ export function renderInfo(manifest, arch, checksum, executorDigest) {
     // Package Center writes INFO as root; root tasks accept only this executor.
     if (executorDigest)
         fields.push([EXECUTOR_ANCHOR, executorDigest]);
-    if (manifest.compose) {
-        // DSM dependency status can fail while the official docker-project worker is available.
-        // Let that worker check availability; never start or repair Container Manager here.
-        if (manifest.identityGateway)
-            fields.push([
-                "adminurl",
-                gatewayEntryPath(manifest),
-            ]);
-    }
+    // Package Center's Open goes to the gateway entry when there is no SDK window.
+    // A Compose App's entry lets the docker-project worker check availability;
+    // never start or repair Container Manager here.
+    if (!hasSdkWindow(manifest) && manifest.identityGateway)
+        fields.push([
+            "adminurl",
+            gatewayEntryPath(manifest),
+        ]);
     const backend = manifest.backend;
     if (isBridgeBackend(backend) && backend.node)
         fields.push(["install_dep_packages", backend.node.package]);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@synopackageland/cli",
-  "version": "0.25.1",
+  "version": "0.26.0",
   "description": "Syno Package Land Developer Kit CLI",
   "type": "module",
   "bin": {
@@ -27,7 +27,7 @@
   },
   "dependencies": {
     "@napi-rs/keyring": "^2.1.1",
-    "@synopackageland/templates": "0.25.0",
+    "@synopackageland/templates": "0.26.0",
     "ajv": "^8.17.1",
     "commander": "^13.1.0",
     "json-canonicalize": "^3.0.1",

package/schema/daemon-restart.v1.schema.json

@@ -0,0 +1,16 @@
+{
+  "$schema": "http://json-schema.org/draft-07/schema#",
+  "$id": "https://synopkgland.com/schemas/daemon-restart/1",
+  "title": "Native daemon restart policy",
+  "description": "The daemon.restart declaration in schema-2 dsm-package.yaml. Requires SDK 0.26.0 or later. Omitted or zero numeric limits use SDK defaults; normalized max_seconds must be at least initial_seconds.",
+  "type": "object",
+  "additionalProperties": false,
+  "required": ["mode"],
+  "properties": {
+    "mode": { "type": "string", "enum": ["off", "on-failure"] },
+    "initial_seconds": { "type": "integer", "minimum": 0, "maximum": 3600, "default": 1 },
+    "max_seconds": { "type": "integer", "minimum": 0, "maximum": 3600, "default": 30 },
+    "max_attempts": { "type": "integer", "minimum": 0, "maximum": 100, "default": 5 },
+    "window_seconds": { "type": "integer", "minimum": 0, "maximum": 86400, "default": 300 }
+  }
+}

package/skills/SKILL.md

@@ -176,6 +176,12 @@ Application Portal 是獨立 opt-in：不想要別名就省略 `portal`，不生
 compose App、沒有 gateway 的 App、`ui.launch` 或 `portal` 都會被 check 拒絕。
 冷登入由 url 圖示經 `open.cgi` 續接，`oidc.browser` 需要支援此續接的 SDK。
 
+原生 App 搭配 `identity_gateway`、而且唯一的 UI 就是包裝的網頁時，宣告 `ui: false` 取代 `ui.dir`。
+沒有 SDK 視窗：主選單只有一個 `displayname` 圖示，是 `type: "url"`，經 `sso/open.cgi` 在新分頁開原生 UI；
+套件中心「開啟」經 INFO `adminurl` 開同一個入口，與 compose App 相同。backend 與 ctl 指令不受影響。
+沒有 `identity_gateway`、搭配 `console` 或 `portal`、或使用 `capabilities.rootOps`、`delegate`、`webapi`、`identity`
+（這些的核准或登入畫面在 SDK 視窗裡）都會被 check 以 `STANDALONE_UI_NO_WINDOW_INVALID` 拒絕。省略 `ui` 仍是錯誤。
+
 Schema 2 Compose 使用 `dsm-package.yaml` 的 `compose.files`、`compose.web` 與
 `identity_gateway`；不使用 file/targets/address_env 或手寫 upstream。
 省略 `ui.launch` 時預設 `new-page`，使用 SDK standalone launcher，不帶 Application Portal。

package/skills/reference/portal.md

@@ -66,6 +66,12 @@ Application Portal 是獨立 opt-in：不想要別名就省略 `portal`，不生
 compose App、沒有 gateway 的 App、`ui.launch` 或 `portal` 都會被 check 拒絕。
 冷登入由 url 圖示經 `open.cgi` 續接，`oidc.browser` 需要支援此續接的 SDK。
 
+原生 App 搭配 `identity_gateway`、而且唯一的 UI 就是包裝的網頁時，宣告 `ui: false` 取代 `ui.dir`。
+沒有 SDK 視窗：主選單只有一個 `displayname` 圖示，是 `type: "url"`，經 `sso/open.cgi` 在新分頁開原生 UI；
+套件中心「開啟」經 INFO `adminurl` 開同一個入口，與 compose App 相同。backend 與 ctl 指令不受影響。
+沒有 `identity_gateway`、搭配 `console` 或 `portal`、或使用 `capabilities.rootOps`、`delegate`、`webapi`、`identity`
+（這些的核准或登入畫面在 SDK 視窗裡）都會被 check 以 `STANDALONE_UI_NO_WINDOW_INVALID` 拒絕。省略 `ui` 仍是錯誤。
+
 Docker／web service App 設定 `integration.web.launch`，內建預設是 `new-page`；
 省略開啟方式時直接開新分頁，不宣告 Application Portal。SDK 原生 App
 省略時使用 `dsm-window`；非 UI SDK 原生 App 必須明確寫 `ui.launch: new-page`。

package/skills/reference/ui-vue.md

@@ -165,6 +165,12 @@ Application Portal 是獨立 opt-in：不想要別名就省略 `portal`，不生
 compose App、沒有 gateway 的 App、`ui.launch` 或 `portal` 都會被 check 拒絕。
 冷登入由 url 圖示經 `open.cgi` 續接，`oidc.browser` 需要支援此續接的 SDK。
 
+原生 App 搭配 `identity_gateway`、而且唯一的 UI 就是包裝的網頁時，宣告 `ui: false` 取代 `ui.dir`。
+沒有 SDK 視窗：主選單只有一個 `displayname` 圖示，是 `type: "url"`，經 `sso/open.cgi` 在新分頁開原生 UI；
+套件中心「開啟」經 INFO `adminurl` 開同一個入口，與 compose App 相同。backend 與 ctl 指令不受影響。
+沒有 `identity_gateway`、搭配 `console` 或 `portal`、或使用 `capabilities.rootOps`、`delegate`、`webapi`、`identity`
+（這些的核准或登入畫面在 SDK 視窗裡）都會被 check 以 `STANDALONE_UI_NO_WINDOW_INVALID` 拒絕。省略 `ui` 仍是錯誤。
+
 Docker／web service App 設定 `integration.web.launch`，內建預設是 `new-page`；
 省略開啟方式時直接開新分頁，不宣告 Application Portal。SDK 原生 App
 省略時使用 `dsm-window`；非 UI SDK 原生 App 必須明確寫 `ui.launch: new-page`。