@synopackageland/cli 0.9.4 → 0.9.6

package/dist/add.js

@@ -1,14 +1,17 @@
 import { existsSync, lstatSync, mkdirSync, mkdtempSync, readFileSync, readdirSync, rmSync, writeFileSync } from 'node:fs';
 import { tmpdir } from 'node:os';
 import { dirname, join, relative } from 'node:path';
-import { isScalar, parseDocument } from 'yaml';
+import { parse } from 'yaml';
+import { setTopLevel } from './yaml-edit.js';
 import { capabilityNames, capabilitySettings } from './capabilities.js';
 import { initFromTemplate, nativeCapabilitySettings } from './init.js';
 import { templatesRoot } from './template-paths.js';
-import { borrowedTarget, capabilityOverlays } from './capability-overlays.js';
-import { DEFAULT_MIN_DSM, isDsmAtLeast, PORTAL_MIN_DSM } from './build-spk/dsm-version.js';
+import { borrowedFiles, borrowedTarget, capabilityOverlays } from './capability-overlays.js';
+import { API_PERMISSIONS_FILE } from './standalone/api-permissions.js';
+import { DEFAULT_MIN_DSM, isDsmAtLeast, PORTAL_EXECUTOR_MIN_DSM } from './build-spk/dsm-version.js';
 import { loadStandaloneManifest } from './standalone/manifest.js';
 import { PORTAL_REQUIRES_EXECUTOR } from './portal/alias.js';
+const NATIVE_TEMPLATE = { go: 'native-go', rust: 'native-rust' };
 function files(root, dir = root) {
     if (!existsSync(dir))
         return [];
@@ -37,13 +40,11 @@ function safePath(root, file) {
     }
     return true;
 }
-/** Raise a lower os_min_ver to the floor a capability needs; a higher one stays. Returns the notice. */
-function raiseOsMinVer(doc, current, floor, capability) {
-    const osMinVer = doc.get('os_min_ver', true);
-    if (!isScalar(osMinVer) || isDsmAtLeast(current, floor))
-        return [];
-    osMinVer.value = floor;
-    return [`os_min_ver raised from ${current} to ${floor}: ${capability} needs DSM ${floor} or later.`];
+/** Raise a lower os_min_ver to the floor a capability needs; a higher one stays. Returns the change and its notice. */
+function raiseOsMinVer(current, floor, capability) {
+    if (isDsmAtLeast(current, floor))
+        return { values: {}, notes: [] };
+    return { values: { os_min_ver: floor }, notes: [`os_min_ver raised from ${current} to ${floor}: ${capability} needs DSM ${floor} or later.`] };
 }
 function withNotes(result, notes) {
     const all = [...(result.notes ?? []), ...notes];
@@ -51,7 +52,7 @@ function withNotes(result, notes) {
 }
 /**
  * `portal: {}` in dsm-package.yaml; the Go and binary starters already carry the UI and backend side.
- * A lower os_min_ver is raised to PORTAL_MIN_DSM, the oldest DSM verified to install a portal.
+ * A lower os_min_ver is raised to PORTAL_EXECUTOR_MIN_DSM; below PORTAL_MIN_DSM the executor registers the entry.
  */
 function addPortal(root, result) {
     const loaded = loadStandaloneManifest(root);
@@ -62,10 +63,8 @@ function addPortal(root, result) {
     if (!safePath(root, 'dsm-package.yaml'))
         throw new Error('[ADD_FILE_CONFLICT] 既有檔案與 SDK overlay 不同：dsm-package.yaml；請先移動或合併衝突，不會覆寫。');
     const manifestPath = join(root, 'dsm-package.yaml');
-    const doc = parseDocument(readFileSync(manifestPath, 'utf8'));
-    doc.set('portal', doc.createNode({}, { flow: true }));
-    const notes = raiseOsMinVer(doc, loaded.manifest.os_min_ver, PORTAL_MIN_DSM, 'portal');
-    writeFileSync(manifestPath, String(doc));
+    const { values, notes } = raiseOsMinVer(loaded.manifest.os_min_ver, PORTAL_EXECUTOR_MIN_DSM, 'portal');
+    writeFileSync(manifestPath, setTopLevel(readFileSync(manifestPath, 'utf8'), { ...values, portal: {} }));
     return withNotes({ ...result, added: [...result.added, 'portal'] }, notes);
 }
 /** A portal needs the executor tier, already declared or added in the same call; nothing is written otherwise. */
@@ -90,8 +89,9 @@ export function addCapabilities(root, requested) {
     if (!loaded.ok)
         throw new Error(loaded.errors.map(e => `[${e.code}] ${e.message}`).join('\n'));
     const m = loaded.manifest;
-    if (m.backend.kind !== 'go')
-        throw new Error('[CAPABILITY_UNSUPPORTED] add 需要 backend.kind: go。');
+    if (m.backend.kind === 'binary')
+        throw new Error('[CAPABILITY_UNSUPPORTED] add 需要 backend.kind: go 或 rust。');
+    const template = NATIVE_TEMPLATE[m.backend.kind];
     const existing = Object.entries(capabilitySettings(names)).filter(([key]) => key in m.capabilities).map(([key]) => key);
     const unchanged = names.filter(name => existing.includes(Object.keys(capabilitySettings([name]))[0]));
     const added = names.filter(name => !unchanged.includes(name));
@@ -106,10 +106,10 @@ export function addCapabilities(root, requested) {
         // Generate SDK files using init's identical substitutions, without touching app-owned files.
         const existingNames = Object.keys(m.capabilities).map(name => name === 'identity' ? 'login' : name === 'rootOps' ? 'root-ops' : name);
         const before = join(work, 'before'), generated = join(work, 'generated');
-        initFromTemplate('native-go', before, { ui: m.ui.build ? 'vue' : 'plain', with: existingNames, packageId: m.package, displayName: m.displayname });
-        initFromTemplate('native-go', generated, { ui: m.ui.build ? 'vue' : 'plain', with: [...existingNames, ...added], packageId: m.package, displayName: m.displayname });
-        const capability = capabilityOverlays(added);
-        const destinations = [...new Set([...capability.overlays.flatMap(overlay => files(join(templatesRoot(), overlay))), ...capability.borrowed.map(borrowedTarget)])].filter(file => existsSync(join(generated, file)));
+        initFromTemplate(template, before, { ui: m.ui.build ? 'vue' : 'plain', with: existingNames, packageId: m.package, displayName: m.displayname });
+        initFromTemplate(template, generated, { ui: m.ui.build ? 'vue' : 'plain', with: [...existingNames, ...added], packageId: m.package, displayName: m.displayname });
+        const capability = capabilityOverlays(template, added);
+        const destinations = [...new Set([...capability.overlays.flatMap(overlay => files(join(templatesRoot(), overlay))), ...borrowedFiles(templatesRoot(), capability.borrowed).map(borrowedTarget)])].filter(file => existsSync(join(generated, file)));
         const deletions = capability.removed;
         const conflicts = [];
         for (const file of destinations) {
@@ -120,21 +120,21 @@ export function addCapabilities(root, requested) {
         }
         for (const file of deletions) {
             const path = join(root, file);
-            if (!safePath(root, file) || (existsSync(path) && (!lstatSync(path).isFile() || !readFileSync(path).equals(readFileSync(join(templatesRoot(), 'native-go', file))))))
+            if (!safePath(root, file) || (existsSync(path) && (!lstatSync(path).isFile() || !readFileSync(path).equals(readFileSync(join(templatesRoot(), template, file))))))
                 conflicts.push(file);
         }
         const manifestPath = join(root, 'dsm-package.yaml');
-        if (added.includes('delegate') && !safePath(root, 'backend/internal/api/permissions.json'))
-            conflicts.push('backend/internal/api/permissions.json');
+        const permissions = `backend/${API_PERMISSIONS_FILE[m.backend.kind]}`;
+        if (added.includes('delegate') && !safePath(root, permissions))
+            conflicts.push(permissions);
         if (!safePath(root, 'dsm-package.yaml'))
             conflicts.push('dsm-package.yaml');
         if (conflicts.length)
             throw new Error(`[ADD_FILE_CONFLICT] 既有檔案與 SDK overlay 不同：${conflicts.join(', ')}；請先移動或合併衝突，不會覆寫。`);
-        const doc = parseDocument(readFileSync(manifestPath, 'utf8'));
-        for (const [key, value] of Object.entries(nativeCapabilitySettings(added)))
-            doc.setIn(['capabilities', key], value);
+        const text = readFileSync(manifestPath, 'utf8');
+        const capabilities = { ...parse(text).capabilities, ...nativeCapabilitySettings(added) };
         // rootOps needs DSM 7.1-42661 or later.
-        const notes = added.includes('root-ops') ? raiseOsMinVer(doc, m.os_min_ver, DEFAULT_MIN_DSM, 'root-ops') : [];
+        const { values, notes } = added.includes('root-ops') ? raiseOsMinVer(m.os_min_ver, DEFAULT_MIN_DSM, 'root-ops') : { values: {}, notes: [] };
         for (const file of destinations) {
             const path = join(root, file);
             mkdirSync(dirname(path), { recursive: true });
@@ -142,7 +142,7 @@ export function addCapabilities(root, requested) {
         }
         for (const file of deletions)
             rmSync(join(root, file), { force: true });
-        writeFileSync(manifestPath, String(doc));
+        writeFileSync(manifestPath, setTopLevel(text, { ...values, capabilities }));
         return withNotes({ added, unchanged }, notes);
     }
     finally {

package/dist/build-spk/dsm-version.d.ts

@@ -8,11 +8,21 @@ export declare const DEFAULT_MIN_DSM: string;
 export declare const CONTAINER_MIN_DSM: string;
 /**
  * DSM registers an Application Portal through the package's web-config
- * app-portal resource. DSM 7.1.1-42962 refuses that resource in an unsigned
- * package (error 320, "internal worker"); DSM 7.3.2-86009 and 7.4 install it.
- * 7.2 and 7.3.0/7.3.1 are untested, so the floor is the oldest verified build.
+ * app-portal resource. DSM 7.1's package manager marks the web-config worker
+ * Synology-only and refuses it in an unsigned package (error 320, "internal
+ * worker"); synopkg from DSM 7.2 on does not. That 7.2 floor comes from the
+ * source and is not yet verified on a 7.2 NAS.
  */
-export declare const PORTAL_MIN_DSM = "7.3.2-86009";
+export declare const PORTAL_MIN_DSM: string;
+/** Why DSM below PORTAL_MIN_DSM refuses a package that declares the web-config portal resource. */
+export declare const PORTAL_MIN_DSM_REASON = "DSM 7.1 \u628A web-config \u5217\u70BA Synology \u5C08\u7528 worker\uFF0C\u4EE5\u932F\u8AA4 320 \u62D2\u88DD\u5E36 portal\uFF08web-config app-portal\uFF09\u7684\u672A\u7C3D\u7AE0\u5957\u4EF6\uFF1B7.2 \u8D77\u958B\u653E\u662F\u4F9D synopkg \u539F\u59CB\u78BC\u5224\u65B7\uFF0C\u5C1A\u672A\u5BE6\u6A5F\u9A57\u8B49";
+/**
+ * Below {@link PORTAL_MIN_DSM} the root executor registers the portal entry in
+ * DSM's app.d instead; that file format is verified from DSM 7.1 on.
+ */
+export declare const PORTAL_EXECUTOR_MIN_DSM: string;
+/** `true` when a portal package for `osMinVer` has its executor register the entry instead of web-config. */
+export declare function portalByExecutor(osMinVer: string): boolean;
 /** Why a portal package cannot declare `value`, and how to fix it; `field` names the portal key. */
 export declare function portalMinDsmMessage(value: string, field: string): string;
 /** `true` when `value` is not older than `floor`, comparing version parts then build. */

package/dist/build-spk/dsm-version.js

@@ -15,14 +15,26 @@ export const DEFAULT_MIN_DSM = FIRST_BUILD["7.1"];
 export const CONTAINER_MIN_DSM = FIRST_BUILD["7.2.1"];
 /**
  * DSM registers an Application Portal through the package's web-config
- * app-portal resource. DSM 7.1.1-42962 refuses that resource in an unsigned
- * package (error 320, "internal worker"); DSM 7.3.2-86009 and 7.4 install it.
- * 7.2 and 7.3.0/7.3.1 are untested, so the floor is the oldest verified build.
+ * app-portal resource. DSM 7.1's package manager marks the web-config worker
+ * Synology-only and refuses it in an unsigned package (error 320, "internal
+ * worker"); synopkg from DSM 7.2 on does not. That 7.2 floor comes from the
+ * source and is not yet verified on a 7.2 NAS.
  */
-export const PORTAL_MIN_DSM = "7.3.2-86009";
+export const PORTAL_MIN_DSM = FIRST_BUILD["7.2"];
+/** Why DSM below PORTAL_MIN_DSM refuses a package that declares the web-config portal resource. */
+export const PORTAL_MIN_DSM_REASON = "DSM 7.1 把 web-config 列為 Synology 專用 worker，以錯誤 320 拒裝帶 portal（web-config app-portal）的未簽章套件；7.2 起開放是依 synopkg 原始碼判斷，尚未實機驗證";
+/**
+ * Below {@link PORTAL_MIN_DSM} the root executor registers the portal entry in
+ * DSM's app.d instead; that file format is verified from DSM 7.1 on.
+ */
+export const PORTAL_EXECUTOR_MIN_DSM = FIRST_BUILD["7.1"];
+/** `true` when a portal package for `osMinVer` has its executor register the entry instead of web-config. */
+export function portalByExecutor(osMinVer) {
+    return !isDsmAtLeast(osMinVer, PORTAL_MIN_DSM);
+}
 /** Why a portal package cannot declare `value`, and how to fix it; `field` names the portal key. */
 export function portalMinDsmMessage(value, field) {
-    return `${field} 需要 DSM ${PORTAL_MIN_DSM} 以上，os_min_ver 是「${value}」。DSM 7.1.1 以錯誤 320 拒裝帶 portal（web-config app-portal）的未簽章套件；DSM 7.3.2 與 7.4 已驗證可裝，7.2 未驗證。請把 os_min_ver 提高到 ${PORTAL_MIN_DSM} 以上，或移除 ${field}。`;
+    return `${field} 需要 DSM ${PORTAL_EXECUTOR_MIN_DSM} 以上，os_min_ver 是「${value}」。DSM ${PORTAL_MIN_DSM} 以前由 executor 寫入 DSM 的 app.d 註冊入口，這個格式只在 DSM 7.1 起驗證過。請把 os_min_ver 提高到 ${PORTAL_EXECUTOR_MIN_DSM} 以上，或移除 ${field}。`;
 }
 /** `true` when `value` is not older than `floor`, comparing version parts then build. */
 export function isDsmAtLeast(value, floor) {

package/dist/build-spk/notices.d.ts

@@ -1,5 +1,12 @@
+import { type SdkBackend } from '../runtime/sdk-source.js';
 /** Copy legal text only; never follow a project-supplied symlink. */
 export declare function copyNoticeTree(source: string, target: string): void;
 /** Fixed payload location, independent of app code/binary paths. */
 export declare function copyProjectNotices(root: string, payload: string): void;
-export declare function copyStandaloneNotices(root: string, uiDir: string, payload: string, go: boolean, goDir?: string): void;
+/** The runtimes linked into the payload's binaries, and the backend whose dependency files name the SDK release. */
+export interface NoticeSources {
+    go: boolean;
+    rust: boolean;
+    sdk?: SdkBackend;
+}
+export declare function copyStandaloneNotices(root: string, uiDir: string, payload: string, { go, rust, sdk: backend }: NoticeSources): void;

package/dist/build-spk/notices.js

@@ -1,6 +1,6 @@
 import { copyFileSync, existsSync, lstatSync, mkdirSync, readFileSync, readdirSync } from 'node:fs';
 import { dirname, join } from 'node:path';
-import { sdkRequirement, sdkSource } from '../runtime/sdk-source.js';
+import { appSdkVersion, sdkSource } from '../runtime/sdk-source.js';
 /** Copy legal text only; never follow a project-supplied symlink. */
 export function copyNoticeTree(source, target) {
     const stat = lstatSync(source);
@@ -26,7 +26,7 @@ export function copyProjectNotices(root, payload) {
     if (existsSync(join(root, 'LICENSE')))
         copyNoticeTree(join(root, 'LICENSE'), join(dest, 'APP.txt'));
 }
-export function copyStandaloneNotices(root, uiDir, payload, go, goDir = join(root, 'backend')) {
+export function copyStandaloneNotices(root, uiDir, payload, { go, rust, sdk: backend }) {
     copyProjectNotices(root, payload);
     const dest = join(payload, 'LICENSES');
     const shared = new URL('../../assets/licenses/', import.meta.url);
@@ -34,11 +34,20 @@ export function copyStandaloneNotices(root, uiDir, payload, go, goDir = join(roo
         mkdirSync(dest, { recursive: true });
         for (const name of ['GO-LICENSE', 'GO-PATENTS'])
             copyFileSync(new URL(name, shared), join(dest, name));
+        const goDir = backend?.kind === 'go' ? backend.dir : join(root, 'backend');
         if (existsSync(join(goDir, 'THIRD_PARTY_NOTICES.txt')))
             copyNoticeTree(join(goDir, 'THIRD_PARTY_NOTICES.txt'), join(dest, 'GO-THIRD_PARTY_NOTICES.txt'));
     }
-    // The SDK's dsm package embeds the native administrator and AppPriv bridges; their sources and terms ship with them.
-    const sdk = go ? sdkRequirement(goDir) : undefined;
+    // Rust's standard library and, on x86_64 and aarch64, musl are linked into every Rust binary.
+    if (rust && backend) {
+        mkdirSync(dest, { recursive: true });
+        for (const name of ['RUST-COPYRIGHT-library.html', 'MUSL-COPYRIGHT'])
+            copyFileSync(new URL(name, shared), join(dest, name));
+        if (existsSync(join(backend.dir, 'THIRD_PARTY_NOTICES.txt')))
+            copyNoticeTree(join(backend.dir, 'THIRD_PARTY_NOTICES.txt'), join(dest, 'RUST-THIRD_PARTY_NOTICES.txt'));
+    }
+    // The SDK embeds the native administrator and AppPriv bridges; their sources and terms ship with them.
+    const sdk = backend ? appSdkVersion(backend) : undefined;
     if (sdk) {
         const source = sdkSource(sdk);
         const license = join(source.goDir, 'LICENSE');

package/dist/build-spk/uninstall-wizard.d.ts

@@ -1,11 +1,22 @@
+import type { Locale } from "../standalone/i18n.js";
 /** The key DSM's built-in packages use for their "also remove my data" box. */
 export declare const REMOVE_ADDITIONAL_KEY = "pkgwizard_remove_additional";
+/** uninstall.state's box: the App deletes the state it lists, apart from package data. */
+export declare const DELETE_STATE_KEY = "pkgwizard_delete_state";
 export type UninstallWizardKind = "native" | "container";
 interface UninstallWizardOptions {
     /** The App runs the root executor (rootOps or delegate), which purges DSM's leftovers on uninstall. */
     executor?: boolean;
     /** The App declares a Login Portal alias (web-config app-portal); only the executor tier can. */
     portal?: boolean;
+    /** Below DSM 7.2 the executor registered the App's Application Portal entry. */
+    portalEntry?: boolean;
+    /** uninstall.state: the App's own texts of the items it deletes, per locale. */
+    state?: {
+        items: (locale: Locale) => string[];
+    };
+    /** uninstall.purge.root: the executor runs an approved root step at uninstall. */
+    rootPurge?: boolean;
 }
 /** `uninstall_uifile` (English) plus one `uninstall_uifile_<dsm language>` per locale. */
 export declare function renderUninstallWizardFiles(packageName: string, kind: UninstallWizardKind, options?: UninstallWizardOptions): Record<string, string>;

package/dist/build-spk/uninstall-wizard.js

@@ -1,10 +1,14 @@
+import { portalEntryCleanupCommands } from "../runtime/uninstall-cleanup.js";
 import { renderWizardFiles } from "./wizard-i18n.js";
 /** The key DSM's built-in packages use for their "also remove my data" box. */
 export const REMOVE_ADDITIONAL_KEY = "pkgwizard_remove_additional";
+/** uninstall.state's box: the App deletes the state it lists, apart from package data. */
+export const DELETE_STATE_KEY = "pkgwizard_delete_state";
 function list(items) {
     return `<ul class="synopkg-ul-list">${items.map((item) => `<li>${item}</li>`).join("")}</ul>`;
 }
-function renderUninstallWizard(t, packageName, kind, { executor = false, portal = false }) {
+const html = (text) => text.replace(/&/g, "&amp;").replace(/</g, "&lt;").replace(/>/g, "&gt;");
+function renderUninstallWizard(t, locale, packageName, kind, { executor = false, portal = false, portalEntry = false, state, rootPurge = false }) {
     const vars = { package: packageName };
     return [{
             step_title: t("uninstall.step"),
@@ -23,15 +27,24 @@ function renderUninstallWizard(t, packageName, kind, { executor = false, portal
                 ...(executor ? [{ desc: t("uninstall.executor", vars) }] : []),
                 { desc: t(executor ? "uninstall.appPrivilege.auto" : "uninstall.appPrivilege", vars) },
                 ...(executor && portal ? [{ desc: t("uninstall.portal.auto", vars) }] : []),
+                ...(executor && portalEntry ? [
+                    { desc: t("uninstall.portalEntry", vars) },
+                    { desc: portalEntryCleanupCommands(packageName).map((line) => `<code>${html(line)}</code>`).join("<br>") },
+                ] : []),
+                ...(executor && rootPurge ? [{ desc: t("uninstall.purge.root", vars) }] : []),
+                ...(state ? [{ desc: t("uninstall.state.heading") }, { desc: list(state.items(locale).map(html)) }] : []),
                 { desc: t("uninstall.backup") },
                 {
                     type: "multiselect",
-                    subitems: [{ key: REMOVE_ADDITIONAL_KEY, desc: t("uninstall.checkbox"), defaultValue: false }],
+                    subitems: [
+                        { key: REMOVE_ADDITIONAL_KEY, desc: t("uninstall.checkbox"), defaultValue: false },
+                        ...(state ? [{ key: DELETE_STATE_KEY, desc: t("uninstall.state.checkbox"), defaultValue: false }] : []),
+                    ],
                 },
             ],
         }];
 }
 /** `uninstall_uifile` (English) plus one `uninstall_uifile_<dsm language>` per locale. */
 export function renderUninstallWizardFiles(packageName, kind, options = {}) {
-    return renderWizardFiles("uninstall_uifile", (t) => renderUninstallWizard(t, packageName, kind, options));
+    return renderWizardFiles("uninstall_uifile", (t, locale) => renderUninstallWizard(t, locale, packageName, kind, options));
 }

package/dist/build-spk/wizard-i18n.d.ts

@@ -9,7 +9,7 @@ export declare function translator(locale: Locale): Translate;
  * every other locale is `<base>_<dsm language>`, which DSM prefers when the
  * administrator's language matches.
  */
-export declare function renderWizardFiles(base: string, render: (t: Translate) => unknown): Record<string, string>;
+export declare function renderWizardFiles(base: string, render: (t: Translate, locale: Locale) => unknown): Record<string, string>;
 /**
  * Writes `WIZARD_UIFILES/<name>` for every rendered file under an SPK staging
  * directory. A dynamic wizard (`<name>.sh`) is executable: DSM runs it to

package/dist/build-spk/wizard-i18n.js

@@ -20,7 +20,7 @@ export function translator(locale) {
 export function renderWizardFiles(base, render) {
     return Object.fromEntries(LOCALES.map((locale) => [
         locale === "en" ? base : `${base}_${DSM_LANGS[locale]}`,
-        JSON.stringify(render(translator(locale)), null, 2),
+        JSON.stringify(render(translator(locale), locale), null, 2),
     ]));
 }
 /**

package/dist/build-spk/wizard-messages.d.ts

@@ -417,6 +417,17 @@ export declare const WIZARD_MESSAGES: {
         es: string;
         it: string;
     };
+    "uninstall.portalEntry": {
+        en: string;
+        "zh-TW": string;
+        "zh-CN": string;
+        ja: string;
+        ko: string;
+        de: string;
+        fr: string;
+        es: string;
+        it: string;
+    };
     "uninstall.keep.native": {
         en: string;
         "zh-TW": string;
@@ -461,6 +472,39 @@ export declare const WIZARD_MESSAGES: {
         es: string;
         it: string;
     };
+    "uninstall.state.heading": {
+        en: string;
+        "zh-TW": string;
+        "zh-CN": string;
+        ja: string;
+        ko: string;
+        de: string;
+        fr: string;
+        es: string;
+        it: string;
+    };
+    "uninstall.state.checkbox": {
+        en: string;
+        "zh-TW": string;
+        "zh-CN": string;
+        ja: string;
+        ko: string;
+        de: string;
+        fr: string;
+        es: string;
+        it: string;
+    };
+    "uninstall.purge.root": {
+        en: string;
+        "zh-TW": string;
+        "zh-CN": string;
+        ja: string;
+        ko: string;
+        de: string;
+        fr: string;
+        es: string;
+        it: string;
+    };
     "nativeShare.selectIntro": {
         en: string;
         "zh-TW": string;

package/dist/build-spk/wizard-messages.js

@@ -417,6 +417,17 @@ export const WIZARD_MESSAGES = {
         es: "Después de que DSM elimine el alias del Portal de inicio de sesión de {package}, la desinstalación recarga automáticamente el servidor web, de modo que el alias deja de funcionar al instante. Solo si esta recarga falla, como indica la entrada synopkgland-executor del registro del sistema, un administrador debe guardar un alias de aplicación en Panel de control > Portal de inicio de sesión > Aplicaciones, lo que recarga el servidor web, o reiniciar el NAS.",
         it: "Dopo che DSM ha rimosso l’alias del Portale di accesso di {package}, la disinstallazione ricarica automaticamente il server web, così l’alias smette subito di funzionare. Solo se questo ricaricamento non riesce, come segnala la voce synopkgland-executor del registro di sistema, un amministratore deve salvare un alias di applicazione in Pannello di controllo > Portale di accesso > Applicazioni, che ricarica il server web, oppure riavviare il NAS.",
     },
+    "uninstall.portalEntry": {
+        en: "Uninstall asks the root executor to remove the Application Portal entry of {package}. If the executor is not running or was never approved, uninstall does not remove the entry; an administrator then runs these commands as root:",
+        "zh-TW": "解除安裝會由 root executor 移除 {package} 的應用程式入口。如果 executor 未執行或從未核准，解除安裝不會移除應用程式入口，管理員需以 root 執行下列指令：",
+        "zh-CN": "卸载会由 root executor 移除 {package} 的应用程序门户入口。如果 executor 未运行或从未核准，卸载不会移除应用程序门户入口，管理员需以 root 执行下列命令：",
+        ja: "アンインストール時に root executor が {package} のアプリケーションポータルのエントリを削除します。executor が実行されていない、または承認されていない場合、アンインストールではエントリが削除されないため、管理者が root で次のコマンドを実行してください:",
+        ko: "제거 시 root executor가 {package}의 응용 프로그램 포털 항목을 제거합니다. executor가 실행 중이 아니거나 승인된 적이 없으면 제거 과정에서 항목이 제거되지 않으므로 관리자가 root로 다음 명령을 실행하십시오.",
+        de: "Bei der Deinstallation entfernt der Root-Executor den Eintrag von {package} im Anwendungsportal. Läuft der Executor nicht oder wurde er nie genehmigt, entfernt die Deinstallation den Eintrag nicht; ein Administrator führt dann diese Befehle als root aus:",
+        fr: "La désinstallation demande à l’executor root de supprimer l’entrée de {package} dans le Portail d’application. Si l’executor ne s’exécute pas ou n’a jamais été approuvé, la désinstallation ne supprime pas l’entrée ; un administrateur exécute alors ces commandes en tant que root :",
+        es: "La desinstalación pide al executor root que elimine la entrada de {package} del Portal de aplicaciones. Si el executor no se está ejecutando o nunca se aprobó, la desinstalación no elimina la entrada; un administrador debe ejecutar estos comandos como root:",
+        it: "La disinstallazione chiede all’executor root di rimuovere la voce di {package} dal Portale applicazioni. Se l’executor non è in esecuzione o non è mai stato approvato, la disinstallazione non rimuove la voce; un amministratore deve eseguire questi comandi come root:",
+    },
     "uninstall.keep.native": {
         en: "Never deleted: Shared Folders, the package account, and other apps' data.",
         "zh-TW": "不會被刪除：共用資料夾（Shared Folder）、套件帳號，以及其他 App 的資料。",
@@ -461,6 +472,39 @@ export const WIZARD_MESSAGES = {
         es: "Eliminar también los datos de la aplicación indicados arriba",
         it: "Elimina anche i dati dell'app elencati sopra",
     },
+    "uninstall.state.heading": {
+        en: "The app deletes its own state only when you tick the second box below; package data is the first box. The app deletes:",
+        "zh-TW": "只有勾選下方第二個選項時，App 才會刪除自己的狀態；套件資料是第一個選項。App 會刪除：",
+        "zh-CN": "只有勾选下方第二个选项时，应用才会删除自己的状态；套件数据是第一个选项。应用会删除：",
+        ja: "下の 2 番目のボックスをオンにした場合にのみ、アプリは自身の状態を削除します。パッケージデータは 1 番目のボックスです。アプリが削除するもの：",
+        ko: "아래 두 번째 상자를 선택한 경우에만 앱이 자체 상태를 삭제합니다. 패키지 데이터는 첫 번째 상자입니다. 앱이 삭제하는 항목:",
+        de: "Die App löscht ihren eigenen Zustand nur, wenn Sie unten das zweite Kästchen aktivieren; Paketdaten betrifft das erste Kästchen. Die App löscht:",
+        fr: "L'application ne supprime son propre état que si vous cochez la deuxième case ci-dessous ; les données du paquet relèvent de la première case. L'application supprime :",
+        es: "La aplicación solo elimina su propio estado si marca la segunda casilla de abajo; los datos del paquete corresponden a la primera casilla. La aplicación elimina:",
+        it: "L'app elimina il proprio stato solo se si seleziona la seconda casella qui sotto; i dati del pacchetto riguardano la prima casella. L'app elimina:",
+    },
+    "uninstall.state.checkbox": {
+        en: "Also delete the app's own state listed above",
+        "zh-TW": "一併刪除上列 App 自身狀態",
+        "zh-CN": "同时删除上列应用自身状态",
+        ja: "上記のアプリ自身の状態も削除する",
+        ko: "위에 나열된 앱 자체 상태도 삭제",
+        de: "Oben aufgeführten eigenen Zustand der App ebenfalls löschen",
+        fr: "Supprimer aussi l'état propre de l'application listé ci-dessus",
+        es: "Eliminar también el estado propio de la aplicación indicado arriba",
+        it: "Elimina anche lo stato proprio dell'app elencato sopra",
+    },
+    "uninstall.purge.root": {
+        en: "If an administrator approval of {package}'s executor is still valid, uninstall runs its approved root uninstall step as root. Without a valid approval the step is skipped, and anything it would remove stays for an administrator to clean up.",
+        "zh-TW": "若 {package} 的 executor 管理員核准仍有效，解除安裝會以 root 執行其已核准的 root 解除安裝步驟。沒有有效核准時會略過此步驟，原本要移除的項目會留給管理員清理。",
+        "zh-CN": "若 {package} 的 executor 管理员批准仍有效，卸载会以 root 执行其已批准的 root 卸载步骤。没有有效批准时会跳过此步骤，原本要移除的内容会留给管理员清理。",
+        ja: "{package} の executor に対する管理者の承認がまだ有効な場合、アンインストール時に承認済みの root アンインストール手順が root として実行されます。有効な承認がない場合、この手順はスキップされ、削除されるはずだったものは管理者が後片付けするために残ります。",
+        ko: "{package} executor에 대한 관리자 승인이 아직 유효하면, 제거 시 승인된 root 제거 단계가 root로 실행됩니다. 유효한 승인이 없으면 이 단계는 건너뛰며, 제거되었어야 할 항목은 관리자가 정리하도록 남습니다.",
+        de: "Ist eine Administratorfreigabe des Executors von {package} noch gültig, führt die Deinstallation dessen freigegebenen Root-Deinstallationsschritt als root aus. Ohne gültige Freigabe wird der Schritt übersprungen, und was er entfernen würde, bleibt zur Bereinigung durch einen Administrator erhalten.",
+        fr: "Si une approbation administrateur de l'exécuteur de {package} est toujours valide, la désinstallation exécute en tant que root son étape de désinstallation root approuvée. Sans approbation valide, l'étape est ignorée et ce qu'elle aurait supprimé reste à nettoyer par un administrateur.",
+        es: "Si una aprobación de administrador del ejecutor de {package} sigue siendo válida, la desinstalación ejecuta como root su paso de desinstalación root aprobado. Sin una aprobación válida, el paso se omite y lo que habría eliminado queda para que lo limpie un administrador.",
+        it: "Se un'approvazione dell'amministratore dell'executor di {package} è ancora valida, la disinstallazione esegue come root il passaggio di disinstallazione root approvato. Senza un'approvazione valida il passaggio viene saltato e ciò che avrebbe rimosso resta da pulire per un amministratore.",
+    },
     "nativeShare.selectIntro": {
         en: "This app keeps its files in a Shared Folder you select below. DSM does not give the app's package account access to a folder chosen here: after installing, open Control Panel > Shared Folder, edit the folder, and under Permissions > System internal user give the package account {account} {permission} access. Until then the app reports that it cannot use the folder.",
         "zh-TW": "此 App 會把檔案存放在你於下方選擇的共用資料夾。DSM 不會自動讓 App 的套件帳號存取這裡選的資料夾：安裝後請到「控制台」>「共用資料夾」，編輯該資料夾，在「權限」>「系統內部使用者」中授予套件帳號 {account}「{permission}」權限。在此之前，App 會回報無法使用該資料夾。",

package/dist/capability-overlays.d.ts

@@ -1,15 +1,20 @@
 /**
- * How each native-go capability is laid over the base template: the template
- * directories copied on top, files borrowed from another overlay, and the
- * base files the overlay replaces. init and add both read this table.
+ * How each capability of a native template is laid over its base template: the
+ * template directories copied on top, files borrowed from another overlay, and
+ * the base files the overlay replaces. init and add both read this table.
  */
 export interface CapabilityOverlay {
     overlays: string[];
     borrowed: string[];
     removed: string[];
 }
-export declare const CAPABILITY_OVERLAYS: Record<string, CapabilityOverlay>;
+export type NativeTemplate = 'native-go' | 'native-rust';
+export declare const CAPABILITY_OVERLAYS: Record<NativeTemplate, Record<string, CapabilityOverlay>>;
+/** The overlays of a native template's Vue frontend, copied before the capabilities'. */
+export declare const VUE_OVERLAYS: Record<NativeTemplate, string[]>;
 /** The overlays of these capabilities, in table order, each once; a capability without one adds nothing. */
-export declare function capabilityOverlays(names: readonly string[]): CapabilityOverlay;
+export declare function capabilityOverlays(template: NativeTemplate, names: readonly string[]): CapabilityOverlay;
+/** Each file of the borrowed paths, a borrowed folder listed file by file, under `templates`. */
+export declare function borrowedFiles(templates: string, borrowed: readonly string[]): string[];
 /** A borrowed path names its overlay first; this is where it lands in a project. */
 export declare const borrowedTarget: (path: string) => string;

package/dist/capability-overlays.js

@@ -1,18 +1,40 @@
+import { readdirSync, statSync } from 'node:fs';
+import { join } from 'node:path';
 const EXECUTOR_SHELL = ['backend/internal/app/executor.go', 'backend/internal/app/executor_test.go'];
-export const CAPABILITY_OVERLAYS = {
-    'root-ops': { overlays: ['native-go-root-ops'], borrowed: [], removed: ['backend/internal/app/root_none.go'] },
-    jobs: { overlays: ['native-go-jobs'], borrowed: [], removed: ['backend/internal/app/background_none.go'] },
-    delegate: {
-        overlays: ['native-go-jobs', 'native-go-delegate'],
-        borrowed: EXECUTOR_SHELL.map(file => `native-go-root-ops/${file}`),
-        removed: ['backend/internal/app/background_none.go', 'backend/internal/app/root_none.go', 'backend/internal/app/delegate_none.go'],
+export const CAPABILITY_OVERLAYS = { 'native-go': {
+        'root-ops': { overlays: ['native-go-root-ops'], borrowed: [], removed: ['backend/internal/app/root_none.go'] },
+        jobs: { overlays: ['native-go-jobs'], borrowed: [], removed: ['backend/internal/app/background_none.go'] },
+        delegate: {
+            overlays: ['native-go-jobs', 'native-go-delegate'],
+            borrowed: EXECUTOR_SHELL.map(file => `native-go-root-ops/${file}`),
+            removed: ['backend/internal/app/background_none.go', 'backend/internal/app/root_none.go', 'backend/internal/app/delegate_none.go'],
+        },
     },
-};
+    // Rust has no build tags: an overlay overwrites the base's same-named files and
+    // nothing is removed. The frontend and root/ files come from native-go's overlays.
+    'native-rust': {
+        'root-ops': { overlays: ['native-rust-root-ops'], borrowed: ['native-go-root-ops/root'], removed: [] },
+        jobs: { overlays: ['native-rust-jobs'], borrowed: ['native-go-jobs/frontend'], removed: [] },
+        delegate: {
+            overlays: ['native-rust-jobs', 'native-rust-delegate'],
+            borrowed: ['native-go-jobs/frontend', 'native-go-delegate/frontend', 'native-rust-root-ops/backend/src/app/root_routes.rs'],
+            removed: [],
+        },
+    } };
+/** The overlays of a native template's Vue frontend, copied before the capabilities'. */
+export const VUE_OVERLAYS = { 'native-go': ['native-go-vue'], 'native-rust': ['native-go-vue', 'native-rust-vue'] };
 /** The overlays of these capabilities, in table order, each once; a capability without one adds nothing. */
-export function capabilityOverlays(names) {
-    const chosen = Object.entries(CAPABILITY_OVERLAYS).filter(([name]) => names.includes(name)).map(([, overlay]) => overlay);
+export function capabilityOverlays(template, names) {
+    const chosen = Object.entries(CAPABILITY_OVERLAYS[template]).filter(([name]) => names.includes(name)).map(([, overlay]) => overlay);
     const unique = (pick) => [...new Set(chosen.flatMap(pick))];
     return { overlays: unique(o => o.overlays), borrowed: unique(o => o.borrowed), removed: unique(o => o.removed) };
 }
+/** Each file of the borrowed paths, a borrowed folder listed file by file, under `templates`. */
+export function borrowedFiles(templates, borrowed) {
+    const walk = (path) => statSync(join(templates, path)).isDirectory()
+        ? readdirSync(join(templates, path)).sort().flatMap(name => walk(`${path}/${name}`))
+        : [path];
+    return [...new Set(borrowed.flatMap(walk))];
+}
 /** A borrowed path names its overlay first; this is where it lands in a project. */
 export const borrowedTarget = (path) => path.split('/').slice(1).join('/');

package/dist/cli.js

@@ -271,16 +271,16 @@ export async function runCli(argv) {
         .option("-t, --template <name>", `模板：${listTemplates().join(" | ")}`)
         .option("--package <id>", "INFO.package（預設由目錄名產生）")
         .option("--name <display>", "顯示名稱")
-        .option("--ui <vue|plain>", `native-go：UI，預設 vue（UI ${JSON.parse(readFileSync(join(templatesRoot(), "native-go-vue/frontend/package.json"), "utf8")).dependencies["@synopackageland/ui"]}）；plain 使用 ui/app.js`)
+        .option("--ui <vue|plain>", `原生模板 UI，預設 vue（UI ${JSON.parse(readFileSync(join(templatesRoot(), "native-go-vue/frontend/package.json"), "utf8")).dependencies["@synopackageland/ui"]}）；plain 使用 ui/app.js`)
         .option("--with <caps>", `能力（逗號分隔）：${CAPABILITY_NAMES.join(",")}`)
         .option("--from <compose.yaml>", "compose：匯入現有 Compose；省略時建立範例")
         .option("--shared-folder <select|create>", "安裝精靈選擇或建立共用資料夾")
         .option("--shared-folder-name <name>", "建立的共用資料夾名稱")
         .option("--shared-folder-key <key>", "設定鍵，預設 shared")
         .option("--shared-folder-permission <ro|rw>", "套件帳號權限，預設 rw")
-        .option("--min-dsm <version>", `最低 DSM 版本（native-go／binary 預設 ${DEFAULT_MIN_DSM}，compose 預設 ${CONTAINER_MIN_DSM}）`)
+        .option("--min-dsm <version>", `最低 DSM 版本（native-go／native-rust／binary 預設 ${DEFAULT_MIN_DSM}，compose 預設 ${CONTAINER_MIN_DSM}）`)
         .argument("[dir]", "目標目錄", ".")
-        .addHelpText("after", "\n原生專案：native-go 與 binary 使用 dsm-package.yaml schema 2。\nCompose 專案：compose 使用 synology-app.yaml；--from 匯入 compose.yaml。\n快速開始：synopkgland init -t native-go --with files,jobs,login my-app\n  cd my-app && synopkgland build\n")
+        .addHelpText("after", "\n原生專案：native-go、native-rust 與 binary 使用 dsm-package.yaml schema 2。\nCompose 專案：compose 使用 synology-app.yaml；--from 匯入 compose.yaml。\n快速開始：synopkgland init -t native-go --with files,jobs,login my-app\n  cd my-app && synopkgland build\n")
         .action((dir, options, command) => {
         if (command.parent?.opts().project)
             throw failure("CLI_OPTION_INVALID", "--project 不適用於 init。");
@@ -309,8 +309,8 @@ export async function runCli(argv) {
         });
         stdout(`已建立 ${options.template} 專案於 ${targetDir}`);
         // --install-links packs a local SDK like the released package; a symlink would load the checkout's own node_modules.
-        if (options.template === "native-go")
-            stdout(`下一步：\n  cd ${dir}\n  (cd backend && go test ./...)\n${existsSync(join(targetDir, "frontend", "package.json")) ? `  (cd frontend && npm install${process.env.SYNOPKGLAND_SDK_DIR ? " --install-links" : ""})\n` : ""}  synopkgland build\n說明見 README.md。`);
+        if (options.template === "native-go" || options.template === "native-rust")
+            stdout(`下一步：\n  cd ${dir}\n  (cd backend && ${options.template === "native-go" ? "go test ./..." : "cargo test"})\n${existsSync(join(targetDir, "frontend", "package.json")) ? `  (cd frontend && npm install${process.env.SYNOPKGLAND_SDK_DIR ? " --install-links" : ""})\n` : ""}  synopkgland build\n說明見 README.md。`);
     });
     program
         .command("add <caps...>")

package/dist/deploy/plan.d.ts

@@ -3,7 +3,7 @@ import type { NativeArchFamily } from "../build-spk/dsm-arch.js";
 import type { NasHost } from "../host/types.js";
 export interface DeploymentPlan {
     root: string;
-    kind: "native-go" | "binary" | "native-layout" | "container";
+    kind: "native-go" | "native-rust" | "binary" | "native-layout" | "container";
     packageId: string;
     version: string;
     arch?: NativeArchFamily;

package/dist/deploy/plan.js

@@ -29,7 +29,7 @@ export function planDeployment(root, options = {}) {
             throw fail("STANDALONE_ARCH_NOT_DECLARED", `Architecture not declared: ${options.arch}; add it to dsm-package.yaml arches to deploy it`);
         return {
             root: standalone,
-            kind: m.backend.kind === "go" ? "native-go" : "binary",
+            kind: m.backend.kind === "binary" ? "binary" : `native-${m.backend.kind}`,
             packageId: m.package,
             version: m.spkVersion,
             arch: options.arch,