@synopackageland/cli 0.25.2 → 0.27.0

package/CHANGELOG.md

@@ -1,5 +1,18 @@
 # Changelog
 
+## 0.27.0 (2026-10-23)
+
+- Depend on templates `~0.27.0` with SDK/App 0.27.0 and UI 0.14.9. Templates patches can ship independently and resolve during npm installation/update; runtime uses the installed templates without network fetching. SDK minor upgrades still require a CLI release for executor mappings/digests and `SDK_UNSUPPORTED` checks. New scaffolds use browser same-origin DSM file operations and the idle-storage fixes.
+- Resolve SDK 0.27.0 to the new executor/v0.27.0 and ship all six verified executor/lifecycle digests. Preserve the previous 0.26.0 inventory and exact-version refusal for unrecorded patches. Protected Apps must rebuild and follow normal administrator approval.
+- Keep Go 1.26.10 and the existing runtime/toolchain requirements. Rust crate publication and NAS/App upgrade certification are outside this release.
+
+## 0.26.0 (2026-10-22)
+
+- Support SDK/App 0.26.x and pin templates 0.26.0, retaining UI 0.14.3 and executor/v0.24.0 with unchanged protected payload digests.
+- Add optional bounded `daemon.restart` crash recovery for native Apps; require SDK 0.26.0 or later, validate the policy and record it for inspection. Initial startup and intentional stops retain their existing behavior.
+
+- Add `ui: false` for native Apps with `identity_gateway` and no SDK window. The main menu gets one url launcher to `sso/open.cgi` (new tab) and Package Center's Open goes to the same entry through INFO `adminurl`, as for Compose Apps. check refuses it without a gateway, with `console` or `portal`, or with capabilities whose approval or sign-in needs the SDK window (`STANDALONE_UI_NO_WINDOW_INVALID`); inspect verifies the single launcher and `adminurl`. Apps with `ui.dir` build unchanged.
+
 ## 0.25.2 (2026-10-22)
 
 - Use templates 0.25.1 with the native Rust lockfile pinned to the public SDK 0.25.0 commit. SDK/App support and executor/lifecycle digests are unchanged.

package/README.md

@@ -64,8 +64,18 @@ a failed fetch reports `SDK_DOWNLOAD_FAILED`.
 CLI-only patch releases can differ from the SDK patch. Compose import and SDK defaults
 read the SDK pin from the installed templates; explicit App SDK declarations take precedence.
 
-`init` and `add` read their templates from `@synopackageland/templates`, an exact-pinned
-dependency. For development against local checkouts, set `SYNOPKGLAND_TEMPLATES_DIR` to a
+`init` and `add` read their templates from the locally installed
+`@synopackageland/templates`. CLI 0.27.0 depends on `~0.27.0`: npm installation or
+update can select the latest templates patch in the 0.27 minor line. Templates
+patches need only a templates release; update the npm installation to receive them.
+The CLI never fetches templates at runtime, so offline use works after installation;
+commit a lockfile and use `npm ci` to reproduce a chosen dependency tree.
+The templates' SDK pin must stay in the CLI-supported minor line. An SDK minor
+upgrade still needs a CLI release for its executor mapping/digests and
+`SDK_UNSUPPORTED` checks. Runtime SDK defaults continue to come from the actual
+installed templates, independently of the CLI patch version.
+
+For development against local checkouts, set `SYNOPKGLAND_TEMPLATES_DIR` to a
 templates checkout and `SYNOPKGLAND_SDK_DIR` to an SDK checkout; SPKs built with
 `SYNOPKGLAND_SDK_DIR` warn `EXECUTOR_DIGEST_UNVERIFIED` and must not be published. A Vue project
 packs the local SDK into its frontend (`npm install --install-links`) without building it: run
@@ -81,7 +91,7 @@ This compares `OFF_GLOSSARY` and the Italian sentence rule, including regex sour
 flags. It supports declaration-only rules with read-only use in `glossaryProblems`;
 post-declaration mutations, aliases and other unsupported rule uses fail the check instead of
 comparing a partial snapshot. The command also fails on drift or missing source. It needs a checkout because templates
-0.15.1 does not publish `scripts/test/i18n.test.mjs`. The npm gate runs this check when
+does not publish `scripts/test/i18n.test.mjs`. The npm gate runs this check when
 `SYNOPKGLAND_TEMPLATES_DIR` is set; otherwise it explicitly reports that the drift check was skipped.
 
 ## Capabilities
@@ -278,6 +288,16 @@ sets it for every language. Omit `console` to keep one icon. check refuses
 `console` on Compose, without `identity_gateway`, or with `ui.launch` or
 `portal`. A cold DSM sign-in resumes through the url launcher.
 
+A native App with `identity_gateway` whose only UI is the wrapped web app
+declares `ui: false` instead of `ui.dir`. It gets no SDK window: the main menu
+has one icon (`displayname`, a `type: "url"` launcher to `sso/open.cgi` that
+opens a new tab), and Package Center's Open goes to the same entry through
+INFO `adminurl`, as for a Compose App. The backend and ctl commands are
+unchanged. check refuses `ui: false` without `identity_gateway`, with `console`
+or `portal`, or with `capabilities.rootOps`, `delegate`, `webapi` or
+`identity`, whose approval or sign-in is shown in the SDK window
+(`STANDALONE_UI_NO_WINDOW_INVALID`). A missing `ui` is still an error.
+
 Compose uses schema-2 `dsm-package.yaml` and `ui.launch`; the default is new-page.
 Classless gateways use type url via the shared contract/app-launch resolver;
 AppWindow wrappers use standalone. Headless projects have no launcher.

package/dist/error-registry.js

@@ -282,6 +282,16 @@ export const ERROR_REGISTRY = {
             description: "The package daemon declaration does not match the fixed argv, environment and lifecycle contract.",
             suggestion: "Check daemon.exec, the per-architecture targets, args, env, uninstall_args and integer-second timeouts; remove shell, user and custom conf.",
         },
+        STANDALONE_DAEMON_RESTART_INVALID: {
+            code: "STANDALONE_DAEMON_RESTART_INVALID",
+            description: "daemon.restart does not match the bounded native crash-recovery policy.",
+            suggestion: "Use mode off or on-failure, integer delay/attempt/window limits, and max_seconds at least initial_seconds; omit or set limits to zero for SDK defaults and remove unknown fields.",
+        },
+        STANDALONE_DAEMON_RESTART_SDK_REQUIRED: {
+            code: "STANDALONE_DAEMON_RESTART_SDK_REQUIRED",
+            description: "The selected controller SDK version or source does not support daemon.restart.",
+            suggestion: "Upgrade the selected controller SDK to 0.26.0 or later and use matching sources, including a local SDK override; update the App SDK requirement, identity_gateway.sdk or the templates that supply the default.",
+        },
         UNINSTALL_INVALID: {
             code: "UNINSTALL_INVALID",
             description: "The uninstall declaration does not match the fixed exec, argv, environment and timeout contract.",
@@ -485,7 +495,12 @@ export const ERROR_REGISTRY = {
         STANDALONE_UI_INVALID: {
             code: "STANDALONE_UI_INVALID",
             description: "The ui configuration is invalid.",
-            suggestion: "Provide ui.dir.",
+            suggestion: "Provide ui.dir, or ui: false for a native identity_gateway App without an SDK window.",
+        },
+        STANDALONE_UI_NO_WINDOW_INVALID: {
+            code: "STANDALONE_UI_NO_WINDOW_INVALID",
+            description: "ui: false is declared where the App needs an SDK window.",
+            suggestion: "ui: false needs identity_gateway and no console, portal, capabilities.rootOps, delegate, webapi or identity; otherwise declare ui.dir.",
         },
         STANDALONE_UI_BUILD_INVALID: {
             code: "STANDALONE_UI_BUILD_INVALID",

package/dist/runtime/executor-digests.json

@@ -1,5 +1,5 @@
 {
-    "0.25.0": {
+    "0.26.0": {
         "x86_64": "de78684faac211c24a7cda8a4541ab1b138d37f6d580936fe354bb9bd0d78a0f",
         "aarch64": "8ef7c736203f6c111816b76f970b7204fa6f8d871ff3222fd7c0a27d0075b847",
         "armv7": "a38703119554b5f2a8bf4810ec2a6c8f1d793bfbb1ca96803eb1b39a26ffd96c",
@@ -9,5 +9,16 @@
             "armv7": "6d25fc972eba12e3ac68f8b6a95a45e9e5706ebe19ffc1ff774fc318acbeb90f"
         },
         "goToolchain": "go1.26.10"
+    },
+    "0.27.0": {
+        "x86_64": "35f760533c133f7ed99d62c11dc4696d06a56fd2d125d53291aa21743d8327cc",
+        "aarch64": "04dff10b52ca4c54e3e6a825c27bac876f296031d8f572f667e6902e18464e31",
+        "armv7": "8789b2663b683ae0a5a457b41ccfcff4d54be4c98dcd3af338622051ad24f943",
+        "lifecycle": {
+            "x86_64": "c6fbb377ecd5ec7ee5b96439f22091d9fa5965dfd616d510ca9445722f436721",
+            "aarch64": "a9ca1750d4d5cff4727dc29789e6eaf0a365cb0e674f1bb796971d82f2d4fa27",
+            "armv7": "6d25fc972eba12e3ac68f8b6a95a45e9e5706ebe19ffc1ff774fc318acbeb90f"
+        },
+        "goToolchain": "go1.26.10"
     }
 }

package/dist/runtime/sdk-source.js

@@ -75,8 +75,8 @@ function goMod(backendDir) {
         return '';
     }
 }
-/** SDK releases that reuse an immutable executor release with identical payload bytes. */
-const EXECUTOR_RELEASES = { '0.21.0': '0.20.0', '0.21.1': '0.20.0', '0.22.0': '0.20.0', '0.23.0': '0.20.0', '0.23.1': '0.20.0', '0.23.2': '0.20.0', '0.24.1': '0.24.0', '0.25.0': '0.24.0' };
+/** Explicit executor release pins; older SDK versions can reuse an immutable release with identical payload bytes. */
+const EXECUTOR_RELEASES = { '0.21.0': '0.20.0', '0.21.1': '0.20.0', '0.22.0': '0.20.0', '0.23.0': '0.20.0', '0.23.1': '0.20.0', '0.23.2': '0.20.0', '0.24.1': '0.24.0', '0.25.0': '0.24.0', '0.26.0': '0.24.0', '0.27.0': '0.27.0' };
 /**
  * The module directories of one SDK version. SYNOPKGLAND_SDK_DIR names a
  * local sdk checkout (development and gates only); otherwise modules come from

package/dist/standalone/daemon-restart.d.ts

@@ -0,0 +1,15 @@
+import type { StandaloneError } from "./manifest.js";
+export declare const DAEMON_RESTART_MIN_SDK = "0.26.0";
+export interface DaemonRestart {
+    mode: "off" | "on-failure";
+    initial_seconds: number;
+    max_seconds: number;
+    max_attempts: number;
+    window_seconds: number;
+}
+/** Normalize exactly the SDK's zero/omitted defaults; omission itself stays off. */
+export declare function readDaemonRestart(value: unknown, fail: (error: StandaloneError) => void): DaemonRestart | undefined;
+export declare function daemonRestartSdkSupported(sdk: string): boolean;
+export declare function daemonRestartSdkProblem(sdk: string): string | undefined;
+/** Development overrides must contain the decoder as well as the restart code. */
+export declare function requireDaemonRestartSource(dir: string, sdk: string, policy?: DaemonRestart): void;

package/dist/standalone/daemon-restart.js

@@ -0,0 +1,55 @@
+import { Ajv } from "ajv";
+import { readFileSync } from "node:fs";
+import { join } from "node:path";
+import { StandaloneBuildError } from "./spk.js";
+export const DAEMON_RESTART_MIN_SDK = "0.26.0";
+let validator;
+function restartValidator() {
+    return validator ??= new Ajv().compile(JSON.parse(readFileSync(new URL("../../schema/daemon-restart.v1.schema.json", import.meta.url), "utf8")));
+}
+/** Normalize exactly the SDK's zero/omitted defaults; omission itself stays off. */
+export function readDaemonRestart(value, fail) {
+    if (value === undefined)
+        return undefined;
+    if (restartValidator()(value)) {
+        const raw = value;
+        const policy = {
+            mode: raw.mode,
+            initial_seconds: raw.initial_seconds || 1,
+            max_seconds: raw.max_seconds || 30,
+            max_attempts: raw.max_attempts || 5,
+            window_seconds: raw.window_seconds || 300,
+        };
+        if (policy.max_seconds >= policy.initial_seconds)
+            return policy;
+    }
+    fail({
+        code: "STANDALONE_DAEMON_RESTART_INVALID",
+        message: "daemon.restart requires mode off or on-failure; delays 1–3600s (max >= initial), attempts 1–100 and window 1–86400s. Omitted or zero limits use SDK defaults; unknown fields are rejected.",
+    });
+    return undefined;
+}
+export function daemonRestartSdkSupported(sdk) {
+    const match = /^(\d+)\.(\d+)\.(\d+)$/.exec(sdk);
+    return Boolean(match && (Number(match[1]) > 0 || Number(match[2]) >= 26));
+}
+export function daemonRestartSdkProblem(sdk) {
+    if (!daemonRestartSdkSupported(sdk))
+        return `daemon.restart requires SDK ${DAEMON_RESTART_MIN_SDK} or later; selected SDK ${sdk}. Upgrade the App's SDK pin, identity_gateway.sdk or the templates supplying the default controller SDK before rebuilding.`;
+    return undefined;
+}
+/** Development overrides must contain the decoder as well as the restart code. */
+export function requireDaemonRestartSource(dir, sdk, policy) {
+    if (!policy)
+        return;
+    let main = "", restart = "";
+    try {
+        main = readFileSync(join(dir, "daemonctl/main.go"), "utf8");
+        restart = readFileSync(join(dir, "daemonctl/restart.go"), "utf8");
+    }
+    catch { /* Fail below before compiling or packaging a mismatched runtime. */ }
+    const problem = daemonRestartSdkProblem(sdk);
+    if (problem || !/\bRestart\s+\*restartPolicy\s+`json:"restart,omitempty"`/.test(main) ||
+        !/^func normalizeRestart\(/m.test(restart) || !/^type restartBudget struct\s*\{/m.test(restart))
+        throw new StandaloneBuildError("STANDALONE_DAEMON_RESTART_SDK_REQUIRED", problem ?? `Selected SDK ${sdk} source does not support daemon.restart; use matching SDK ${DAEMON_RESTART_MIN_SDK} or later sources, including for a local development override.`);
+}

package/dist/standalone/daemon.d.ts

@@ -1,9 +1,12 @@
 import type { NativeArchFamily } from "../build-spk/dsm-arch.js";
 import { NODE_PACKAGES } from "./bridge-backend.js";
 import { type DaemonIngress } from "./daemon-ingress.js";
+import { type DaemonRestart } from "./daemon-restart.js";
 import type { CommandRunner } from "./build.js";
 import type { StandaloneError, StandaloneManifest } from "./manifest.js";
 export interface Daemon {
+    /** Optional bounded recovery; omitted means off. SDK 0.26.0 or later. */
+    restart?: DaemonRestart;
     /** Fixed foreground executable relative to daemon/payload. */
     exec: string;
     /** Architecture-specific project directories, copied without links. */
@@ -46,6 +49,7 @@ export declare const envKey: (k: string) => boolean;
 /** A relative path to a fixed executable, without `.` or `..` parts. */
 export declare const relativeExec: (v: unknown) => v is string;
 export declare function readDaemon(value: unknown, root: string, arches: NativeArchFamily[], fail: (error: StandaloneError) => void): Daemon | undefined;
+export declare function daemonSdkVersion(manifest: Pick<StandaloneManifest, "backend" | "identityGateway">): string;
 export declare function daemonConfig(manifest: StandaloneManifest): string;
 /**
  * The argv and environment daemon/control runs: a Node daemon execs the

package/dist/standalone/daemon.js

@@ -8,6 +8,7 @@ import { templateSdkVersion } from "../template-paths.js";
 import { checkCgiBinary } from "./binary.js";
 import { NODE_PACKAGES } from "./bridge-backend.js";
 import { readDaemonIngress, ingressEnv } from "./daemon-ingress.js";
+import { readDaemonRestart, requireDaemonRestartSource } from "./daemon-restart.js";
 import { composeDaemon, composeNetwork } from "./compose.js";
 import { gatewayDaemon } from "./identity-gateway.js";
 import { StandaloneBuildError } from "./spk.js";
@@ -41,6 +42,7 @@ const fields = new Set([
     "uninstall_args",
     "node",
     "ingress",
+    "restart",
 ]);
 const record = (v) => Boolean(v) && typeof v === "object" && !Array.isArray(v);
 /** A fixed argv or env value: only the package's own directories expand. */
@@ -110,6 +112,9 @@ export function readDaemon(value, root, arches, fail) {
     const timeouts = readLifecycleTimeouts(value.timeouts, fail);
     if (!timeouts)
         return undefined;
+    const restart = readDaemonRestart(value.restart, fail);
+    if (value.restart !== undefined && !restart)
+        return undefined;
     const node = readDaemonNode(value.node, fail);
     if (value.node !== undefined && !node)
         return undefined;
@@ -129,6 +134,7 @@ export function readDaemon(value, root, arches, fail) {
         timeouts: timeouts,
         ...(node ? { node } : {}),
         ...(ingress ? { ingress } : {}),
+        ...(restart ? { restart } : {}),
     };
 }
 function readDaemonNode(value, fail) {
@@ -152,13 +158,13 @@ function readDaemonNode(value, fail) {
     }
     return { package: pkg, ...(min ? { min_version: min } : {}) };
 }
-function daemonSdkVersion(manifest) {
+export function daemonSdkVersion(manifest) {
     return manifest.identityGateway?.sdk ??
         (manifest.backend.kind === "go" ? appSdkVersion(manifest.backend) : undefined) ??
         templateSdkVersion();
 }
 export function daemonConfig(manifest) {
-    const { exec, args, uninstall_args, env, timeouts } = manifest.compose
+    const { exec, args, uninstall_args, env, timeouts, restart } = manifest.compose
         ? composeDaemon(manifest)
         : manifest.identityGateway
             ? gatewayDaemon(manifest.daemon)
@@ -168,6 +174,7 @@ export function daemonConfig(manifest) {
         exec,
         args,
         ...(uninstall_args ? { uninstall_args } : {}),
+        ...(restart ? { restart } : {}),
         env,
         timeouts,
         ...(runtimeBudgetSdkSupported(daemonSdkVersion(manifest))
@@ -193,6 +200,9 @@ export async function buildDaemonControl(manifest, arch, work, run) {
     if (!manifest.daemon && !(manifest.compose && manifest.identityGateway))
         return undefined;
     const out = join(work, `daemon-control-${arch}`);
+    const sdk = daemonSdkVersion(manifest);
+    const source = runtimeBudgetSource(sdkSource(sdk).goDir, manifest);
+    requireDaemonRestartSource(source, sdk, manifest.daemon?.restart);
     const result = await run("go", [
         "build",
         "-trimpath",
@@ -203,7 +213,7 @@ export async function buildDaemonControl(manifest, arch, work, run) {
         out,
         "./daemonctl",
     ], {
-        cwd: runtimeBudgetSource(sdkSource(daemonSdkVersion(manifest)).goDir, manifest),
+        cwd: source,
         env: goChildEnv({ ...process.env, ...pinnedGoBuildEnv(arch) }),
     });
     if (result.missing || result.status !== 0)

package/dist/standalone/dsm-window.d.ts

@@ -25,6 +25,8 @@ export declare function windowScriptName(manifest: Pick<StandaloneManifest, "bui
 /** The launcher fields an entry mode fixes; inspect checks a built SPK against them. */
 export declare function entryLauncherAccess(entry: EntryMode): Record<string, unknown>;
 export declare function appTitle(manifest: StandaloneManifest): AppTitle;
+/** Whether the App ships the SDK window; Compose and `ui: false` Apps open the gateway instead. */
+export declare function hasSdkWindow(manifest: Pick<StandaloneManifest, "compose" | "sdkWindow">): boolean;
 /** The DSM app class whose launch opens the SDK window: the console's when the App declares one. */
 export declare function windowAppId(manifest: Pick<StandaloneManifest, "package" | "console">): string;
 /**

package/dist/standalone/dsm-window.js

@@ -74,7 +74,7 @@ function launcherAccess(manifest) {
     return manifest.entry
         ? entryLauncherAccess(manifest.entry)
         : {
-            allUsers: manifest.compose || manifest.console
+            allUsers: manifest.compose || manifest.console || !hasSdkWindow(manifest)
                 ? manifest.identityGateway?.access !== "dsm-admins"
                 : permitsOrdinaryUsers(manifest.apiPermissions),
         };
@@ -107,6 +107,10 @@ function displayNameCatalogs(manifest) {
     }
     return catalogs;
 }
+/** Whether the App ships the SDK window; Compose and `ui: false` Apps open the gateway instead. */
+export function hasSdkWindow(manifest) {
+    return !manifest.compose && manifest.sdkWindow !== false;
+}
 /** The DSM app class whose launch opens the SDK window: the console's when the App declares one. */
 export function windowAppId(manifest) {
     return `SYNO.SDS.${manifest.package}.${manifest.console ? "Console" : "Instance"}`;
@@ -128,7 +132,7 @@ export function renderUiConfig(manifest, icons = packageIcons(manifest.icon), lo
     const icon = windowIconTemplate(icons);
     const ns = `SYNO.SDS.${manifest.package}`;
     const titleFields = uiTitleFields(appTitle(manifest));
-    if (manifest.compose) {
+    if (!hasSdkWindow(manifest)) {
         if (!manifest.identityGateway)
             return "{}\n";
         return (JSON.stringify({

package/dist/standalone/inspect-spk.js

@@ -23,6 +23,7 @@ import { ELF_MACHINE } from "./binary.js";
 import { CGI_PAYLOAD_PATH, entryLauncherAccess } from "./dsm-window.js";
 import { daemonConfig, readDaemon, readLifecycleTimeouts, renderNodeLauncher, nodeDependency, NODE_LAUNCHER } from "./daemon.js";
 import { DAEMON_INGRESS_CONFIG, daemonIngressMinDsmProblem, readDaemonIngress, renderDaemonIngressConfig } from "./daemon-ingress.js";
+import { daemonRestartSdkProblem, readDaemonRestart } from "./daemon-restart.js";
 import { ROOT_SCRIPT_HINTS } from "./root-ops.js";
 import { DELETE_STATE_KEY } from "../build-spk/uninstall-wizard.js";
 import { readUninstallRecord, stateItemTexts } from "./uninstall.js";
@@ -114,7 +115,9 @@ export async function inspectSpk(spkPath, expectedKind) {
                     new Set(raw.capabilities).size !== raw.capabilities.length ||
                     (raw.entry !== undefined &&
                         !["admin-only", "app-privilege"].includes(raw.entry)) ||
-                    (raw.console !== undefined && raw.console !== true))
+                    (raw.console !== undefined && raw.console !== true) ||
+                    (raw.window !== undefined &&
+                        (raw.window !== false || raw.console !== undefined)))
                     throw new Error();
                 if (raw.lifecycleTimeouts !== undefined && (!readLifecycleTimeouts(raw.lifecycleTimeouts, () => { }) || Object.keys(raw.lifecycleTimeouts).length !== 4))
                     throw new Error();
@@ -126,6 +129,9 @@ export async function inspectSpk(spkPath, expectedKind) {
                 findings.push("sdk-package.json does not match the schema 2 capability inventory.");
             }
         }
+        const daemonRestart = recoverDaemonRestart(metadata.daemon_restart, metadata.daemon_sdk, findings);
+        if (metadata.daemon_restart !== undefined && (metadata.compose !== undefined || !paths.has("daemon/control")))
+            findings.push("DAEMON_RESTART_INVALID daemon restart requires a native daemon controller, without Compose supervision");
         const identityGateway = await inspectProviderOnlyAdmission(dir, paths, metadata.provider_only_oidc, findings);
         const installSettings = await inspectInstallSettings(dir, payload, metadata, findings);
         if (metadata.compose !== undefined) {
@@ -210,7 +216,7 @@ export async function inspectSpk(spkPath, expectedKind) {
         if (standalone && portal)
             findings.push(...inspectPortalInfo(info, hasExecutor));
         const daemon = standalone
-            ? await checkDaemon(dir, info, paths, payload, findings, hasExecutor, background, combined, nativeGateway, uninstallHook?.uninstall, { ingress: daemonIngress, node: daemonNode })
+            ? await checkDaemon(dir, info, paths, payload, findings, hasExecutor, background, combined, nativeGateway, uninstallHook?.uninstall, { ingress: daemonIngress, node: daemonNode, restart: daemonRestart })
             : undefined;
         if (background)
             checkBackground(dir, info, payload, findings, hasExecutor, daemon, kind !== "native-go", metadata.lifecycleTimeouts, nativeGateway);
@@ -276,7 +282,7 @@ export async function inspectSpk(spkPath, expectedKind) {
         }
         if (metadata.entry)
             await checkEntryLauncher(dir, info.package, metadata.entry, findings);
-        const launch = await checkLaunchConfiguration(dir, info, standalone, metadata.launch, portal?.alias ?? executor?.policy.portal?.alias, findings, metadata.console === true);
+        const launch = await checkLaunchConfiguration(dir, info, standalone, metadata.launch, portal?.alias ?? executor?.policy.portal?.alias, findings, metadata.console === true, metadata.window === false);
         const loginStyle = standalone
             ? await inspectLoginStyle(dir, info.package, Boolean(portal || executor?.policy.portal), findings)
             : undefined;
@@ -340,7 +346,7 @@ export async function inspectSpk(spkPath, expectedKind) {
 const LAUNCHER_TYPE_MISMATCH = "LAUNCHER_TYPE_MISMATCH";
 const LAUNCHER_PORTAL_MISMATCH = "LAUNCHER_PORTAL_MISMATCH";
 /** Compare the actual launcher and Portal fields to the packaged declaration. */
-async function checkLaunchConfiguration(dir, info, native, declared, alias, findings, console = false) {
+async function checkLaunchConfiguration(dir, info, native, declared, alias, findings, console = false, windowless = false) {
     const target = join(dir, "launch-inspection");
     mkdirSync(target);
     await tar.x({
@@ -395,6 +401,10 @@ async function checkLaunchConfiguration(dir, info, native, declared, alias, find
         checkConsoleLaunchers(target, info, native, findings);
         return launch;
     }
+    if (windowless) {
+        checkGatewayOnlyLauncher(target, info, native, findings);
+        return launch;
+    }
     const type = dsmLauncherType(launch, native);
     if (!launcher ||
         launcher.type !== type ||
@@ -443,6 +453,36 @@ function checkConsoleLaunchers(target, info, native, findings) {
         findings.push(`${LAUNCHER_TYPE_MISMATCH} console requires a url launcher at ${ns}.Instance to sso/open.cgi, an administrator-only app launcher at ${ns}.Console and INFO dsmapplaunchname=${ns}.Console; rebuild with synopkgland build`);
     }
 }
+/**
+ * A `ui: false` App's ui/config: one url launcher at `.Instance` to the
+ * gateway, which INFO's adminurl also opens for Package Center's Open, and
+ * no SDK window.
+ */
+function checkGatewayOnlyLauncher(target, info, native, findings) {
+    const ns = `SYNO.SDS.${info.package}`;
+    const entry = `/webman/3rdparty/${info.package}/sso/open.cgi`;
+    let config = {};
+    try {
+        config = JSON.parse(readFileSync(join(target, "ui/config"), "utf8"));
+    }
+    catch {
+        /* reported below as a missing launcher */
+    }
+    const sections = Object.keys(config);
+    const instance = config[".url"]?.[`${ns}.Instance`];
+    if (!native ||
+        sections.length !== 1 ||
+        Object.keys(config[".url"] ?? {}).length !== 1 ||
+        instance?.type !== "url" ||
+        instance.url !== entry ||
+        instance.appWindow !== undefined ||
+        info.dsmuidir !== "ui" ||
+        info.dsmappname !== `${ns}.Instance` ||
+        info.dsmapplaunchname !== undefined ||
+        info.adminurl !== entry) {
+        findings.push(`${LAUNCHER_TYPE_MISMATCH} ui: false requires only a url launcher at ${ns}.Instance to sso/open.cgi and INFO adminurl to the same entry; rebuild with synopkgland build`);
+    }
+}
 /** The launcher in ui/config must carry exactly the access the declared entry mode fixes. */
 async function checkEntryLauncher(dir, pkg, entry, findings) {
     const target = join(dir, "entry-inspection");
@@ -877,15 +917,19 @@ async function checkDaemon(dir, info, paths, payload, findings, executor, backgr
                 "timeouts",
                 "operation_seconds",
                 "uninstall_args",
+                "restart",
                 ...(combined ? ["network"] : []),
             ].includes(key)))
             throw new Error("package/config mismatch");
+        if (!isDeepStrictEqual(config.restart, extras.restart))
+            throw new Error("daemon restart differs from its build declaration");
         const daemon = readDaemon({
             exec: config.exec,
             args: config.args,
             uninstall_args: config.uninstall_args,
             env: config.env,
             timeouts: config.timeouts,
+            restart: config.restart,
             targets: { x86_64: "payload" },
         }, dir, ["x86_64"], () => { });
         if (!daemon)
@@ -947,8 +991,18 @@ async function checkDaemon(dir, info, paths, payload, findings, executor, backgr
         return daemon;
     }
     catch {
-        findings.push("daemon/config.json or the payload does not match the fixed daemon contract");
+        findings.push("daemon/config.json (including restart) or the payload does not match the fixed daemon contract");
+    }
+}
+function recoverDaemonRestart(value, sdk, findings) {
+    if (value === undefined && sdk === undefined)
+        return undefined;
+    const policy = readDaemonRestart(value, () => { });
+    if (!policy || !isDeepStrictEqual(policy, value) || typeof sdk !== "string" || daemonRestartSdkProblem(sdk)) {
+        findings.push("DAEMON_RESTART_INVALID sdk-package.json must record a normalized daemon restart policy and SDK 0.26.0 or later");
+        return undefined;
     }
+    return policy;
 }
 /** INFO retains the localized title inputs used by build's ui/config renderer. */
 function archivedInfoTranslations(info) {

package/dist/standalone/manifest.d.ts

@@ -100,6 +100,12 @@ export interface StandaloneManifest {
     entry?: EntryMode;
     /** `portal`: registers the DSM Application Portal entry; an administrator activates it. */
     portal?: PortalDeclaration;
+    /**
+     * `ui: false`: a native identity_gateway App with no SDK window. Its one
+     * main-menu icon and Package Center's Open both go to the gateway's web UI,
+     * as for a Compose App. Absent when the App has a `ui` directory.
+     */
+    sdkWindow?: false;
     /**
      * `console`: the main menu gets two icons, the gateway's native UI in a new
      * tab and the SDK UI in an administrator-only DSM window titled `title`

package/dist/standalone/manifest.js

@@ -10,7 +10,8 @@ import { isNativeArchFamily, } from "../build-spk/dsm-arch.js";
 import { checkGlossary, loadCatalogs, readInfoTranslations, } from "./i18n.js";
 import { loadRootOps, readRootSettings, rootBinaryProblem, ROOT_OPS_DIR, } from "./root-ops.js";
 import { readComposeApp } from "./compose.js";
-import { readDaemon, readLifecycleTimeouts } from "./daemon.js";
+import { daemonSdkVersion, readDaemon, readLifecycleTimeouts } from "./daemon.js";
+import { daemonRestartSdkProblem } from "./daemon-restart.js";
 import { daemonIngressMinDsmProblem } from "./daemon-ingress.js";
 import { readIdentityGateway, } from "./identity-gateway.js";
 import { readUninstall } from "./uninstall.js";
@@ -283,6 +284,11 @@ function readManifest(raw, c) {
         if (problem)
             c.fail("STANDALONE_DAEMON_INGRESS_MIN_DSM", problem);
     }
+    if (daemon?.restart && backend) {
+        const problem = daemonRestartSdkProblem(daemonSdkVersion({ backend, identityGateway }));
+        if (problem)
+            c.fail("STANDALONE_DAEMON_RESTART_SDK_REQUIRED", problem);
+    }
     if ((daemon?.ingress || daemon?.node) && raw.identity_gateway !== undefined)
         c.fail("STANDALONE_DAEMON_INVALID", "daemon.node and daemon.ingress run the App's own daemon; identity_gateway runs its gateway as the daemon. Use one or the other.");
     if (compose && identityGateway && compose.sdk !== identityGateway.sdk)
@@ -338,7 +344,10 @@ function readManifest(raw, c) {
         }
         permissions.policy = floored.policy;
     }
-    const ui = raw.compose !== undefined
+    const noWindow = raw.compose === undefined && raw.ui === false;
+    if (noWindow)
+        readNoWindow(raw, capabilities, c);
+    const ui = raw.compose !== undefined || noWindow
         ? {
             dir: c.root,
             ...(isRecord(raw.ui) && raw.ui.launch !== undefined
@@ -347,8 +356,8 @@ function readManifest(raw, c) {
         }
         : readUi(raw.ui, c);
     if (raw.compose !== undefined &&
-        isRecord(raw.ui) &&
-        Object.keys(raw.ui).some((k) => k !== "launch"))
+        raw.ui !== undefined &&
+        (!isRecord(raw.ui) || Object.keys(raw.ui).some((k) => k !== "launch")))
         c.fail("STANDALONE_UI_INVALID", "Compose uses the SDK gateway; ui accepts only launch.");
     if (raw.compose !== undefined &&
         ui?.launch !== undefined &&
@@ -466,6 +475,7 @@ function readManifest(raw, c) {
         ...(entry ? { entry } : {}),
         ...(portal ? { portal } : {}),
         ...(dsmConsole ? { console: dsmConsole } : {}),
+        ...(noWindow ? { sdkWindow: false } : {}),
         ...(icon ? { icon } : {}),
         ...(loginStyle ? { loginStyle } : {}),
         ...(appScripts ? { appScripts } : {}),
@@ -539,6 +549,24 @@ function readConsole(raw, launch, c) {
         c.fail("STANDALONE_CONSOLE_PORTAL", "console and portal both claim the App's SDK UI; declare one of them.");
     return value.title === undefined ? {} : { title: value.title };
 }
+/**
+ * `ui: false`: the gateway's web UI is the App's only UI, so the App needs
+ * identity_gateway, and nothing may need the SDK window: a console or portal
+ * is that window, and root, delegate and WebAPI approvals and the standalone
+ * sign-in page are shown in it.
+ */
+function readNoWindow(raw, capabilities, c) {
+    const fail = (why) => c.fail("STANDALONE_UI_NO_WINDOW_INVALID", `ui: false ${why}`);
+    if (raw.identity_gateway === undefined)
+        fail("needs identity_gateway: its web UI is what the main-menu icon and Package Center's Open start.");
+    if (raw.console !== undefined)
+        fail("leaves no SDK window for the console; remove console, or declare ui.dir.");
+    if (raw.portal !== undefined)
+        fail("leaves no SDK window for the portal; remove portal, or declare ui.dir.");
+    for (const name of ["rootOps", "delegate", "webapi", "identity"])
+        if (capabilities[name])
+            fail(`cannot use capabilities.${name}: its approval or sign-in is shown in the SDK window; declare ui.dir.`);
+}
 /** `login_style`: a portal's colour, wallpaper (with its thumbnail) and title image, each optional. */
 function readLoginStyle(value, portal, c) {
     const invalid = (message) => c.fail("STANDALONE_LOGIN_STYLE_INVALID", message);
@@ -736,7 +764,7 @@ function goReadsTimeout(backend, c) {
 }
 function readUi(value, c) {
     if (!isRecord(value)) {
-        return c.fail("STANDALONE_UI_INVALID", "ui must contain dir.");
+        return c.fail("STANDALONE_UI_INVALID", "ui must contain dir; a native identity_gateway App without an SDK window declares ui: false.");
     }
     if (value.launch !== undefined && !isWebLaunchMode(value.launch))
         return c.fail("STANDALONE_UI_LAUNCH_INVALID", "ui.launch must be dsm-window or new-page. Application Portal is a separate opt-in.");

package/dist/standalone/spk.js

@@ -21,7 +21,7 @@ import { renderStandaloneScript } from "./lifecycle.js";
 import { APP_SCRIPTS_DIR, APP_SCRIPTS_SPK_DIR } from "./app-scripts.js";
 import { codedMessage } from "../errors.js";
 import { DSM_LANGS, LOCALES } from "./i18n.js";
-import { appTitle, CGI_PAYLOAD_PATH, renderUiConfig, renderWindowScript, windowScriptName, } from "./dsm-window.js";
+import { appTitle, CGI_PAYLOAD_PATH, hasSdkWindow, renderUiConfig, renderWindowScript, windowScriptName, } from "./dsm-window.js";
 import { writeUiTexts } from "../build-spk/ui-texts.js";
 import { loginStyleAssets } from "../build-spk/login-style.js";
 import { copyStandaloneNotices, copyNoticeTree } from "../build-spk/notices.js";
@@ -29,7 +29,7 @@ import { copyAppTree } from "./bridge-app.js";
 import { isBridgeBackend } from "./bridge-backend.js";
 import { hostScriptName, renderHostAdapterScript } from "./host-adapter.js";
 import { writeComposePayload } from "./compose.js";
-import { copyDaemonPayload, nodeDependency } from "./daemon.js";
+import { copyDaemonPayload, daemonSdkVersion, nodeDependency } from "./daemon.js";
 import { DAEMON_INGRESS_CONFIG, renderDaemonIngressConfig } from "./daemon-ingress.js";
 import { GATEWAY_CGI_PATH, GATEWAY_CONFIG_PATH, GATEWAY_EXEC, identityGatewayConfig, identityGatewayDeclaration, } from "./identity-gateway.js";
 import { BACKGROUND_UNIT_DIR, BACKGROUND_WORKER_PAYLOAD, backgroundUnitName, renderBackgroundUnit, BRIDGE_WORKER_ARGS, } from "./background.js";
@@ -77,7 +77,7 @@ export async function assembleStandaloneSpk(options) {
         const icons = packageIcons(manifest.icon);
         const uiRoot = join(staging, "package", "ui");
         const appDir = join(uiRoot, "app");
-        if (!manifest.compose)
+        if (hasSdkWindow(manifest))
             copyUiTree(manifest.ui.dir, appDir);
         else
             mkdirSync(appDir, { recursive: true });
@@ -88,7 +88,7 @@ export async function assembleStandaloneSpk(options) {
         writeFile(join(uiRoot, "config"), renderUiConfig(manifest, icons, login?.fields));
         for (const [path, bytes] of login?.files ?? [])
             writeFile(join(uiRoot, path), bytes);
-        if (!manifest.compose)
+        if (hasSdkWindow(manifest))
             writeFile(join(uiRoot, windowScriptName(manifest)), renderWindowScript(manifest, assetVersion, icons, options.portalText));
         writeFile(join(uiRoot, hostScriptName(manifest.build)), renderHostAdapterScript(manifest.package));
         writeDsmWindowIcons(uiRoot, icons);
@@ -235,6 +235,7 @@ export async function assembleStandaloneSpk(options) {
             ...(nativeGatewaySupported(manifest) ? { native_gateway: { sdk: manifest.identityGateway.sdk, listen: manifest.identityGateway.listen } } : {}),
             ...(manifest.daemon?.ingress ? { daemon_ingress: manifest.daemon.ingress } : {}),
             ...(manifest.daemon?.node ? { daemon_node: manifest.daemon.node } : {}),
+            ...(manifest.daemon?.restart ? { daemon_restart: manifest.daemon.restart, daemon_sdk: daemonSdkVersion(manifest) } : {}),
             launch: resolvedSdkLaunch(manifest),
             capabilities: Object.keys(manifest.capabilities).sort(),
             ...(manifest.compose
@@ -248,6 +249,7 @@ export async function assembleStandaloneSpk(options) {
                 : {}),
             ...(manifest.entry ? { entry: manifest.entry } : {}),
             ...(manifest.console ? { console: true } : {}),
+            ...(manifest.sdkWindow === false ? { window: false } : {}),
             ...(manifest.uninstall
                 ? {
                     uninstall: uninstallRecord(manifest.uninstall, manifest.i18n?.catalogs),
@@ -353,15 +355,14 @@ export function renderInfo(manifest, arch, checksum, executorDigest) {
     // Package Center writes INFO as root; root tasks accept only this executor.
     if (executorDigest)
         fields.push([EXECUTOR_ANCHOR, executorDigest]);
-    if (manifest.compose) {
-        // DSM dependency status can fail while the official docker-project worker is available.
-        // Let that worker check availability; never start or repair Container Manager here.
-        if (manifest.identityGateway)
-            fields.push([
-                "adminurl",
-                gatewayEntryPath(manifest),
-            ]);
-    }
+    // Package Center's Open goes to the gateway entry when there is no SDK window.
+    // A Compose App's entry lets the docker-project worker check availability;
+    // never start or repair Container Manager here.
+    if (!hasSdkWindow(manifest) && manifest.identityGateway)
+        fields.push([
+            "adminurl",
+            gatewayEntryPath(manifest),
+        ]);
     const backend = manifest.backend;
     if (isBridgeBackend(backend) && backend.node)
         fields.push(["install_dep_packages", backend.node.package]);

package/dist/template-paths.d.ts

@@ -1,5 +1,5 @@
 /**
- * The scaffold templates come from the exactly pinned @synopackageland/templates
+ * The scaffold templates come from the locally installed @synopackageland/templates
  * package; SYNOPKGLAND_TEMPLATES_DIR points at a templates checkout instead.
  */
 export declare function templatesRoot(env?: NodeJS.ProcessEnv, from?: string): string;

package/dist/template-paths.js

@@ -2,7 +2,7 @@ import { createRequire } from "node:module";
 import { dirname, join } from "node:path";
 import { sdkRequirement } from "./runtime/sdk-source.js";
 /**
- * The scaffold templates come from the exactly pinned @synopackageland/templates
+ * The scaffold templates come from the locally installed @synopackageland/templates
  * package; SYNOPKGLAND_TEMPLATES_DIR points at a templates checkout instead.
  */
 export function templatesRoot(env = process.env, from = import.meta.url) {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@synopackageland/cli",
-  "version": "0.25.2",
+  "version": "0.27.0",
   "description": "Syno Package Land Developer Kit CLI",
   "type": "module",
   "bin": {
@@ -27,7 +27,7 @@
   },
   "dependencies": {
     "@napi-rs/keyring": "^2.1.1",
-    "@synopackageland/templates": "0.25.1",
+    "@synopackageland/templates": "~0.27.0",
     "ajv": "^8.17.1",
     "commander": "^13.1.0",
     "json-canonicalize": "^3.0.1",

package/schema/daemon-restart.v1.schema.json

@@ -0,0 +1,16 @@
+{
+  "$schema": "http://json-schema.org/draft-07/schema#",
+  "$id": "https://synopkgland.com/schemas/daemon-restart/1",
+  "title": "Native daemon restart policy",
+  "description": "The daemon.restart declaration in schema-2 dsm-package.yaml. Requires SDK 0.26.0 or later. Omitted or zero numeric limits use SDK defaults; normalized max_seconds must be at least initial_seconds.",
+  "type": "object",
+  "additionalProperties": false,
+  "required": ["mode"],
+  "properties": {
+    "mode": { "type": "string", "enum": ["off", "on-failure"] },
+    "initial_seconds": { "type": "integer", "minimum": 0, "maximum": 3600, "default": 1 },
+    "max_seconds": { "type": "integer", "minimum": 0, "maximum": 3600, "default": 30 },
+    "max_attempts": { "type": "integer", "minimum": 0, "maximum": 100, "default": 5 },
+    "window_seconds": { "type": "integer", "minimum": 0, "maximum": 86400, "default": 300 }
+  }
+}

package/skills/SKILL.md

@@ -5,6 +5,14 @@ description: Initialize, extend, check, build, inspect, and deploy Synology appl
 
 # Independent Synology SPKs
 
+CLI 0.27.x installs templates through `~0.27.0`. A templates patch needs only a
+templates release; npm install/update selects a patch in that minor line. The CLI
+uses the locally installed templates and reads their SDK pin for defaults; it
+never downloads templates at runtime. Preserve the lockfile and use `npm ci` for
+reproducible offline-ready installations. An SDK minor upgrade still requires a
+CLI release with executor mappings/digests and `SDK_UNSUPPORTED` validation; a
+templates patch must keep its SDK pin in the CLI-supported minor line.
+
 Before releasing an executor App, read [reference/approval-upgrades.md](reference/approval-upgrades.md). Run build/inspect with the previous released SPK as `--baseline` and include the approval difference in release notes. Without a comparable baseline, retention is unknown.
 
 Use this guide to initialize, build and inspect own applications or upstream OSS as independent packages. 依已實作能力區分 DSM session 檔案、私有 jobs 與 App 登入；delegate 已實作並隨 CLI 提供固定操作的離線委託（預設 `files.moveFromStaging`）；共用 delegate／rootOps executor 的完整裝置生命週期驗收仍待完成，不得宣稱已通過；支援邊界依 delegate guide／support matrix，禁止發明新的身分平台。
@@ -25,6 +33,8 @@ Read [reference/lifecycle.md](reference/lifecycle.md) before editing `dsm-script
 
 Read [reference/ui-vue.md](reference/ui-vue.md) when editing Vue components in the native-go Vue template; use the installed SDK contracts, keep DSM embedding boundaries, and verify the actual app.
 
+Buttons follow DSM's policy ([reference/ui-vue.md](reference/ui-vue.md#buttons), the UI package's `docs/button-policy.md`): only the bar that closes a dialog, wizard or form draws capsules, with Cancel/Reset first and one primary (or one danger to confirm a deletion) last; toolbar, page, section and row actions are grey tool buttons, Delete included; links go to `Link`. Choose the variant, never the shape.
+
 Read [reference/ui-json.md](reference/ui-json.md) when generating or editing JSON UI; discover the installed catalog, validate the spec, then render and fix layout issues.
 
 ## UI copywriting
@@ -176,6 +186,12 @@ Application Portal 是獨立 opt-in：不想要別名就省略 `portal`，不生
 compose App、沒有 gateway 的 App、`ui.launch` 或 `portal` 都會被 check 拒絕。
 冷登入由 url 圖示經 `open.cgi` 續接，`oidc.browser` 需要支援此續接的 SDK。
 
+原生 App 搭配 `identity_gateway`、而且唯一的 UI 就是包裝的網頁時，宣告 `ui: false` 取代 `ui.dir`。
+沒有 SDK 視窗：主選單只有一個 `displayname` 圖示，是 `type: "url"`，經 `sso/open.cgi` 在新分頁開原生 UI；
+套件中心「開啟」經 INFO `adminurl` 開同一個入口，與 compose App 相同。backend 與 ctl 指令不受影響。
+沒有 `identity_gateway`、搭配 `console` 或 `portal`、或使用 `capabilities.rootOps`、`delegate`、`webapi`、`identity`
+（這些的核准或登入畫面在 SDK 視窗裡）都會被 check 以 `STANDALONE_UI_NO_WINDOW_INVALID` 拒絕。省略 `ui` 仍是錯誤。
+
 Schema 2 Compose 使用 `dsm-package.yaml` 的 `compose.files`、`compose.web` 與
 `identity_gateway`；不使用 file/targets/address_env 或手寫 upstream。
 省略 `ui.launch` 時預設 `new-page`，使用 SDK standalone launcher，不帶 Application Portal。

package/skills/reference/compose.md

@@ -232,7 +232,7 @@ declared availability readiness, LAN isolation/egress, protected grant lifecycle
 ACLs, two-user visibility and clean install/upgrade/reboot/stop/uninstall before
 calling the package supported on a NAS. No NAS is accessed by the build gate.
 
-The unified Compose contract uses SDK 0.17.3 and templates 0.17.5 with CLI 0.17.3. Use the published, matching versions together; the legacy packaging route and bridge publish mode are removed.
+The unified Compose contract uses SDK 0.27.x with CLI 0.27.x and locally installed templates from `~0.27.0`. Templates patches can ship independently; npm install/update resolves them, and SDK defaults come from the installed templates. SDK minor upgrades still require a CLI release with executor mappings/digests and `SDK_UNSUPPORTED` checks. The CLI does not fetch templates at runtime. The legacy packaging route and bridge publish mode are removed.
 
 Primary override files, and each included override set, must share a directory. Cross-directory override bases are rejected before loader I/O. Included implicit .env files are confined, inventoried and preserved; symlinks are rejected.
 

package/skills/reference/portal.md

@@ -66,6 +66,12 @@ Application Portal 是獨立 opt-in：不想要別名就省略 `portal`，不生
 compose App、沒有 gateway 的 App、`ui.launch` 或 `portal` 都會被 check 拒絕。
 冷登入由 url 圖示經 `open.cgi` 續接，`oidc.browser` 需要支援此續接的 SDK。
 
+原生 App 搭配 `identity_gateway`、而且唯一的 UI 就是包裝的網頁時，宣告 `ui: false` 取代 `ui.dir`。
+沒有 SDK 視窗：主選單只有一個 `displayname` 圖示，是 `type: "url"`，經 `sso/open.cgi` 在新分頁開原生 UI；
+套件中心「開啟」經 INFO `adminurl` 開同一個入口，與 compose App 相同。backend 與 ctl 指令不受影響。
+沒有 `identity_gateway`、搭配 `console` 或 `portal`、或使用 `capabilities.rootOps`、`delegate`、`webapi`、`identity`
+（這些的核准或登入畫面在 SDK 視窗裡）都會被 check 以 `STANDALONE_UI_NO_WINDOW_INVALID` 拒絕。省略 `ui` 仍是錯誤。
+
 Docker／web service App 設定 `integration.web.launch`，內建預設是 `new-page`；
 省略開啟方式時直接開新分頁，不宣告 Application Portal。SDK 原生 App
 省略時使用 `dsm-window`；非 UI SDK 原生 App 必須明確寫 `ui.launch: new-page`。

package/skills/reference/ui-vue.md

@@ -61,6 +61,31 @@ Reuse the embedded theme's typography, spacing and public controls. Preserve
 loading, empty, error, disabled and permission states. Backend policies and DSM
 checks decide authority; component visibility cannot grant access.
 
+## Buttons
+
+Follow DSM's button policy, in the installed
+`node_modules/@synopackageland/ui/docs/button-policy.md`. Choose only the
+`variant`; the container chooses the shape, so do not set `kind="action"`.
+
+| Place | Use |
+| --- | --- |
+| Dialog, Sheet, Wizard footer; `FormActions`, `AppActionBar`, `Footbar`, Panel `#fbar` | capsule: Cancel or Reset `secondary`, then one `primary` last |
+| Confirming a deletion | Dialog footer: Cancel, then one `danger` last |
+| Toolbar, PageHeader, section or card body and `#footer`, beside a field | grey tool `Button` (Delete too) |
+| List or grid row | `IconButton` with a `label` |
+| Help, docs, external pages | `Link`, not a button |
+
+- A capsule only ends something: it closes a dialog, applies a form or moves a
+  wizard. Disable this connection, Open or Check again stay tool buttons, even
+  in a `SettingsSection` `#footer`; put a section's Save / Cancel in `FormActions`.
+- One main action per footer, placed last. Inside a page, `primary` only for
+  the one step that unblocks it (Sign in), at most one per section.
+- Keep the default size; neighbouring buttons share one size. One refresh per
+  page, in the PageHeader.
+- In development the UI warns in the console about a capsule outside a footer,
+  two main actions in a footer, or a main action that is not last. Clear these
+  warnings before handing over the app.
+
 ## Start fast
 
 Every api.cgi call pays DSM's session check (about 60–240 ms on a NAS), so
@@ -165,6 +190,12 @@ Application Portal 是獨立 opt-in：不想要別名就省略 `portal`，不生
 compose App、沒有 gateway 的 App、`ui.launch` 或 `portal` 都會被 check 拒絕。
 冷登入由 url 圖示經 `open.cgi` 續接，`oidc.browser` 需要支援此續接的 SDK。
 
+原生 App 搭配 `identity_gateway`、而且唯一的 UI 就是包裝的網頁時，宣告 `ui: false` 取代 `ui.dir`。
+沒有 SDK 視窗：主選單只有一個 `displayname` 圖示，是 `type: "url"`，經 `sso/open.cgi` 在新分頁開原生 UI；
+套件中心「開啟」經 INFO `adminurl` 開同一個入口，與 compose App 相同。backend 與 ctl 指令不受影響。
+沒有 `identity_gateway`、搭配 `console` 或 `portal`、或使用 `capabilities.rootOps`、`delegate`、`webapi`、`identity`
+（這些的核准或登入畫面在 SDK 視窗裡）都會被 check 以 `STANDALONE_UI_NO_WINDOW_INVALID` 拒絕。省略 `ui` 仍是錯誤。
+
 Docker／web service App 設定 `integration.web.launch`，內建預設是 `new-page`；
 省略開啟方式時直接開新分頁，不宣告 Application Portal。SDK 原生 App
 省略時使用 `dsm-window`；非 UI SDK 原生 App 必須明確寫 `ui.launch: new-page`。