@synopackageland/cli 0.9.4 → 0.9.6

package/dist/error-registry.js

@@ -409,6 +409,41 @@ export const ERROR_REGISTRY = {
         "description": "套件 daemon 的宣告不符合固定 argv、環境與生命週期契約。",
         "suggestion": "核對 daemon.exec、各架構 targets、args、env、uninstall_args 與整數秒 timeouts；移除 shell、user 與自訂 conf。"
     },
+    "UNINSTALL_INVALID": {
+        "code": "UNINSTALL_INVALID",
+        "description": "uninstall 的宣告不符合固定 exec、argv、環境與逾時契約。",
+        "suggestion": "核對 uninstall.purge 的 exec（套件內、不在 executor/ 或 root/）、args、env（不可用 SYNOPKGLAND_*）與 2–120 秒 timeout，以及 state.items 的唯一 key。"
+    },
+    "UNINSTALL_STATE_REQUIRES_PURGE": {
+        "code": "UNINSTALL_STATE_REQUIRES_PURGE",
+        "description": "uninstall.state 沒有可刪除狀態的 App 卸載 hook。",
+        "suggestion": "加上 uninstall.purge，由 App 在 SYNOPKGLAND_DELETE_STATE=1 時刪除所列狀態；或移除 uninstall.state。"
+    },
+    "UNINSTALL_STATE_TEXT_MISSING": {
+        "code": "UNINSTALL_STATE_TEXT_MISSING",
+        "description": "卸載精靈無法列出 uninstall.state 項目的文字。",
+        "suggestion": "在 i18n.messages 的 en.json（與其他語言）加入 uninstall.state.<key>。"
+    },
+    "UNINSTALL_ROOT_REQUIRES_ROOT_OPS": {
+        "code": "UNINSTALL_ROOT_REQUIRES_ROOT_OPS",
+        "description": "uninstall.purge.root 需要管理員核准的 root 操作。",
+        "suggestion": "宣告 capabilities.rootOps: true 並提供 root/<名稱>.sh，或移除 uninstall.purge.root。"
+    },
+    "UNINSTALL_ROOT_OP_MISSING": {
+        "code": "UNINSTALL_ROOT_OP_MISSING",
+        "description": "uninstall.purge.root 指向不存在的 root 操作。",
+        "suggestion": "新增 root/<名稱>.sh，或把 uninstall.purge.root 改成既有的 root 操作名稱。"
+    },
+    "UNINSTALL_EXEC_MISSING": {
+        "code": "UNINSTALL_EXEC_MISSING",
+        "description": "uninstall.purge.exec 不是建置後套件內可執行的一般檔案。",
+        "suggestion": "指向套件內的執行檔，例如 ui/cgi/api.cgi、background/worker 或 daemon/payload/ 下具執行權限的檔案。"
+    },
+    "UNINSTALL_EXEC_UNSAFE": {
+        "code": "UNINSTALL_EXEC_UNSAFE",
+        "description": "uninstall.purge.exec 是嘗試取得 root 的 shell script。",
+        "suggestion": "hook 一律以套件帳號執行；需要 root 的清理請放在 root/<名稱>.sh 並以 uninstall.purge.root 宣告。"
+    },
     "STANDALONE_DAEMON_BUILD_FAILED": {
         "code": "STANDALONE_DAEMON_BUILD_FAILED",
         "description": "無法建置套件 daemon 的 Go supervisor。",
@@ -584,6 +619,11 @@ export const ERROR_REGISTRY = {
         "description": "go build 失敗。",
         "suggestion": "請在 backend 目錄執行 go build ./... 並修正錯誤。取不到 github.com/synopackageland/syno-pkg-land-sdk 時，設定 GOPRIVATE=github.com/synopackageland/* 並讓 git 能以憑證讀 github.com。"
     },
+    "STANDALONE_RUST_BUILD_FAILED": {
+        "code": "STANDALONE_RUST_BUILD_FAILED",
+        "description": "cargo build 失敗。",
+        "suggestion": "請在 backend 目錄執行 cargo build --release --locked 並修正錯誤；Cargo.lock 必須已提交。取不到 github.com/synopackageland/syno-pkg-land-sdk 時，設定 CARGO_NET_GIT_FETCH_WITH_CLI=true 並讓 git 能以憑證讀 github.com。"
+    },
     "STANDALONE_PORTAL_INVALID": {
         "code": "STANDALONE_PORTAL_INVALID",
         "description": "dsm-package.yaml 的 portal 格式或 alias 不正確。",
@@ -649,7 +689,8 @@ for (const [code, description, suggestion] of [
     ERROR_REGISTRY[code] = { code, description, suggestion };
 ERROR_REGISTRY["ADD_LAYOUT_UNSUPPORTED"] = { "code": "ADD_LAYOUT_UNSUPPORTED", "description": "SDK overlay 需要標準 backend 目錄。", "suggestion": "使用 backend.dir: backend，或手動合併 SDK overlay。" };
 ERROR_REGISTRY["MIN_DSM_CONTAINER_FLOOR"] = { "code": "MIN_DSM_CONTAINER_FLOOR", "description": "Compose 最低 DSM 版本過低。", "suggestion": "Compose 需要 DSM 7.2.1-69057 或以上。" };
-ERROR_REGISTRY.STANDALONE_PORTAL_MIN_DSM = { "code": "STANDALONE_PORTAL_MIN_DSM", "description": "宣告 portal 的套件 os_min_ver 低於 DSM 7.3.2-86009。", "suggestion": "DSM 7.1.1 以 320 拒裝帶 portal 的未簽章套件、7.2 未驗證；把 os_min_ver 提高到 7.3.2-86009 以上，或移除 portal。" };
+ERROR_REGISTRY.STANDALONE_PORTAL_ENTRY_INVALID = { "code": "STANDALONE_PORTAL_ENTRY_INVALID", "description": "os_min_ver 低於 DSM 7.2-64570 時由 executor 註冊 portal，套件名稱或 displayname 不符合它的規則。", "suggestion": "套件名稱只能用英數字，以 . _ - 分隔，最多 64 字；displayname 1–64 個字，不可含控制字元。" };
+ERROR_REGISTRY.STANDALONE_PORTAL_MIN_DSM = { "code": "STANDALONE_PORTAL_MIN_DSM", "description": "宣告 portal 的套件 os_min_ver 低於 DSM 7.1-42661。", "suggestion": "DSM 7.2-64570 以前由 executor 寫入 DSM 的 app.d 註冊入口，這個格式只在 DSM 7.1 起驗證過。把 os_min_ver 提高到 7.1-42661 以上，或移除 portal。" };
 ERROR_REGISTRY["MIN_DSM_INVALID"] = { "code": "MIN_DSM_INVALID", "description": "最低 DSM 版本格式不合法。", "suggestion": "指定 7.x release 或完整 7.x-build。" };
 ERROR_REGISTRY["NOTICE_UNSAFE"] = { "code": "NOTICE_UNSAFE", "description": "授權檔案不符合一般檔案限制。", "suggestion": "移除 symlink、特殊檔與超大授權檔案。" };
 ERROR_REGISTRY["NOTICE_MISSING"] = { "code": "NOTICE_MISSING", "description": "缺少第三方授權資訊。", "suggestion": "重新安裝模板依賴並產生 third-party notices。" };
@@ -697,9 +738,10 @@ for (const [code, description, suggestion] of [
     ["EXECUTOR_BUILD_FAILED", "從 App 相依的 SDK 版本編譯 executor 或 lifecycle helper 失敗。", "確認已安裝 Go 1.21 以上且可取得 go1.26.9（離線時請先備妥），查看訊息中的編譯器輸出。"],
     ["EXECUTOR_DIGEST_MISMATCH", "由 SDK 版本建出的 executor 與 CLI 內建的 sha256 表不符，或表中沒有這個 SDK 版本。", "確認 backend/go.mod 的 github.com/synopackageland/syno-pkg-land-sdk 是正式版本且 Go 為 go1.26.9；表中沒有該版本時升級 CLI。"],
     ["EXECUTOR_DIGEST_UNVERIFIED", "SYNOPKGLAND_SDK_DIR 指向本機 SDK，executor 未對照 sha256 表（警告）。", "只用於開發；要發佈的 SPK 請取消 SYNOPKGLAND_SDK_DIR 後重新 build。"],
-    ["SDK_REQUIRED", "rootOps 或 delegate 需要 SDK，但 backend/go.mod 沒有 require github.com/synopackageland/syno-pkg-land-sdk。", "在 backend/go.mod 加入 require github.com/synopackageland/syno-pkg-land-sdk 與 CLI 同一 minor 的版本，或改用 init 產生的 Go 後端。"],
-    ["SDK_VERSION_MISMATCH", "frontend/package.json 的 @synopackageland/sdk 與 backend/go.mod 要求的 SDK 版本不同。", "把兩邊改成同一個版本；file: 相依時，比對的是該目錄 package.json 的 version。"],
-    ["SDK_UNSUPPORTED", "backend/go.mod 要求的 SDK 不是這個 CLI 的 minor 版本線。", "改用與 SDK 同一 minor 的 CLI，或把 SDK 升到 CLI 支援的版本線（訊息列出）。"],
+    ["SDK_REQUIRED", "rootOps 或 delegate 需要 SDK，但後端沒有相依 syno-pkg-land-sdk（Go：backend/go.mod；Rust：backend/Cargo.toml）。", "Go 在 backend/go.mod 加入 require github.com/synopackageland/syno-pkg-land-sdk；Rust 在 backend/Cargo.toml 以 git＋tag 相依 syno-pkg-land-sdk；版本與 CLI 同一 minor，或改用 init 產生的後端。"],
+    ["SDK_TAG_REQUIRED", "Rust 後端的 backend/Cargo.lock 沒有以正式 release tag 鎖定唯一一個 syno-pkg-land-sdk（branch、rev、path、registry 或多個版本都不接受）。", "在 backend/Cargo.toml 寫 syno-pkg-land-sdk = { git = \"https://github.com/synopackageland/syno-pkg-land-sdk\", tag = \"vX.Y.Z\" }，執行 cargo update -p syno-pkg-land-sdk 並提交 Cargo.lock。"],
+    ["SDK_VERSION_MISMATCH", "frontend/package.json 的 @synopackageland/sdk 與後端（backend/go.mod 或 backend/Cargo.lock）要求的 SDK 版本不同。", "把兩邊改成同一個版本；file: 相依時，比對的是該目錄 package.json 的 version。"],
+    ["SDK_UNSUPPORTED", "後端（backend/go.mod 或 backend/Cargo.lock）要求的 SDK 不是這個 CLI 的 minor 版本線。", "改用與 SDK 同一 minor 的 CLI，或把 SDK 升到 CLI 支援的版本線（訊息列出）。"],
     ["SDK_DIR_NOT_READY", "SYNOPKGLAND_SDK_DIR 指向的 SDK checkout 根目錄缺少 go.mod，或 Vue 專案需要的 ts 套件尚未建置（沒有 ts/dist）。", "指向 syno-pkg-land-sdk checkout；Vue 專案先在 $SYNOPKGLAND_SDK_DIR/ts 執行 npm ci && npm run build（npm 安裝 file: 套件時不會替它 build）。"],
     ["SDK_DOWNLOAD_FAILED", "go mod download 取不到 backend/go.mod 要求的 SDK 版本。", "SDK repo 目前是 private，不能經 proxy.golang.org 取得：設定 GOPRIVATE=github.com/synopackageland/*（例如 go env -w），並讓 git 能以憑證讀 github.com（git ls-remote 可驗證）；再確認版本存在。離線時先在同一台機器 go mod download 一次。"],
     ["TEMPLATES_MISSING", "找不到 @synopackageland/templates。", "重新安裝 @synopackageland/cli，或把 SYNOPKGLAND_TEMPLATES_DIR 指向 templates checkout。"],

package/dist/info.js

@@ -1,9 +1,10 @@
 import { existsSync } from "node:fs";
 import { join } from "node:path";
+import { portalByExecutor } from "./build-spk/dsm-version.js";
 import { loadContract } from "./contract/load.js";
 import { appOriginFromContract } from "./host/open-url.js";
 import { resolveDeployIdentity } from "./deploy/identity.js";
-import { loadStandaloneManifest, } from "./standalone/manifest.js";
+import { loadStandaloneManifest, sdkBackend, } from "./standalone/manifest.js";
 import { inspectSpk } from "./standalone/inspect-spk.js";
 import { isNativeLayout, loadNativeLayout } from "./standalone/native-layout.js";
 import { executorPolicy, executorPolicyText, sha256 } from "./runtime/executor-policy.js";
@@ -69,7 +70,7 @@ export function classifyRootTasks(expected, inventory) {
 async function liveRootCapability(m, host) {
     try {
         const policyDigest = sha256(executorPolicyText(executorPolicy(m)));
-        const classified = classifyRootTasks(executorTasks({ package: m.package, policyDigest }, requiredSdk(m.backend.kind === "go" ? m.backend.dir : m.root).executorDir), await host.getRootTaskInventory?.(m.package));
+        const classified = classifyRootTasks(executorTasks({ package: m.package, policyDigest }, requiredSdk(sdkBackend(m)).executorDir), await host.getRootTaskInventory?.(m.package));
         if (classified.state !== "ready")
             return classified;
         const observed = await host.getExecutorStatus?.(m.package);
@@ -169,7 +170,7 @@ export async function standaloneInfo(options) {
         ...state,
         capabilities,
         ...(executor ? { executor } : {}),
-        uninstallCleanup: uninstallCleanup(m.package, { executor: Boolean(m.capabilities.rootOps || m.capabilities.delegate), portal: Boolean(m.portal) }),
+        uninstallCleanup: uninstallCleanup(m.package, { executor: Boolean(m.capabilities.rootOps || m.capabilities.delegate), portal: Boolean(m.portal && !portalByExecutor(m.os_min_ver)), portalEntry: Boolean(m.portal && portalByExecutor(m.os_min_ver)) }),
     };
 }
 /** What the installed App's portal.status says; DSM owns the alias, an administrator sets it. */

package/dist/init.js

@@ -1,19 +1,26 @@
 import { spawnSync } from "node:child_process";
-import { isMap, isScalar, parse, parseDocument, stringify } from "yaml";
+import { isMap, isScalar, parse, parseDocument } from "yaml";
+import { setTopLevel } from "./yaml-edit.js";
 import { capabilityNames, capabilitySettings } from "./capabilities.js";
 import { MOVE_FROM_STAGING } from './runtime/delegate-contract.js';
 import { cpSync, existsSync, mkdirSync, readdirSync, readFileSync, renameSync, rmSync, statSync, writeFileSync } from "node:fs";
-import { basename, join, relative, resolve } from "node:path";
+import { basename, dirname, join, relative, resolve } from "node:path";
 import { SDK_MODULE, SDK_PACKAGE } from "./runtime/sdk-source.js";
 import { templatesRoot } from "./template-paths.js";
-import { borrowedTarget, capabilityOverlays } from "./capability-overlays.js";
+import { borrowedFiles, borrowedTarget, capabilityOverlays, VUE_OVERLAYS } from "./capability-overlays.js";
+import { API_PERMISSIONS_FILE } from "./standalone/api-permissions.js";
 import { resolveMinDsm, assertContainerMinDsm, DEFAULT_MIN_DSM, isDsmAtLeast } from "./build-spk/dsm-version.js";
 import { readSharedFolder } from "./standalone/shared-folder.js";
 const TEMPLATE_NAMES = [
     "compose",
     "binary",
     "native-go",
+    "native-rust",
 ];
+/** Templates built from source with the SDK: capabilities, a Vue or plain UI, a shared folder. */
+const NATIVE_TEMPLATES = ["native-go", "native-rust"];
+const isNativeTemplate = (template) => NATIVE_TEMPLATES.includes(template);
+const BACKEND_KIND = { "native-go": "go", "native-rust": "rust" };
 /** Templates whose App runs through the DSM docker-project resource worker. */
 const CONTAINER_TEMPLATES = [
     "compose",
@@ -38,7 +45,7 @@ export function nativeCapabilitySettings(names) {
     return settings;
 }
 /** Templates whose identity is filled in at init: every generated file may carry a placeholder. */
-const IDENTIFIED = ["native-go", "binary"];
+const IDENTIFIED = [...NATIVE_TEMPLATES, "binary"];
 const PACKAGE_ID = /^[A-Za-z][A-Za-z0-9]{1,63}$/;
 /** npm never publishes files named .gitignore, so templates ship them as `gitignore`. */
 const RENAMED = { gitignore: ".gitignore" };
@@ -67,9 +74,9 @@ function templateFiles(root, dir = root) {
 function targetName(file) {
     return RENAMED[file] ?? file;
 }
-/** native-go defaults to the Vue shell; the CLI and the library entry point agree. */
+/** Native templates default to the Vue shell; the CLI and the library entry point agree. */
 function resolvedUi(template, options) {
-    return template === "native-go" ? options.ui ?? "vue" : options.ui;
+    return isNativeTemplate(template) ? options.ui ?? "vue" : options.ui;
 }
 /**
  * Copy one template tree into a project. A template directory may carry a local
@@ -93,9 +100,9 @@ export function initFromTemplate(template, targetDir, options = {}) {
         throw new Error("[CAPABILITY_COMBINATION_INVALID] delegate 的 install-selected scope 只能在 Vue 面板確認；plain UI 不支援，請改用 --ui vue。");
     if (options.from && template !== "compose")
         throw new Error("[INIT_OPTIONS_UNSUPPORTED] --from 只適用於 compose。");
-    if (caps.length && template !== "native-go")
+    if (caps.length && !isNativeTemplate(template))
         throw new Error("[CAPABILITY_UNSUPPORTED] binary／compose 不支援 --with 能力。");
-    const localSdk = template === "native-go" && process.env.SYNOPKGLAND_SDK_DIR ? resolve(process.env.SYNOPKGLAND_SDK_DIR) : undefined;
+    const localSdk = isNativeTemplate(template) && process.env.SYNOPKGLAND_SDK_DIR ? resolve(process.env.SYNOPKGLAND_SDK_DIR) : undefined;
     if (localSdk)
         assertLocalSdkReady(localSdk, resolvedUi(template, options) === "vue");
     const source = join(templatesRoot(), template);
@@ -112,14 +119,15 @@ export function initFromTemplate(template, targetDir, options = {}) {
     if (rootExample && minDsm !== undefined && !isDsmAtLeast(minDsm, DEFAULT_MIN_DSM)) {
         throw new Error(`[MIN_DSM_INVALID] root templates require DSM ${DEFAULT_MIN_DSM} or later.`);
     }
-    const capability = capabilityOverlays(caps);
-    const overlays = [...(ui === "vue" ? ["native-go-vue"] : []), ...capability.overlays].map(name => join(templatesRoot(), name));
+    const capability = isNativeTemplate(template) ? capabilityOverlays(template, caps) : { overlays: [], borrowed: [], removed: [] };
+    const borrowed = borrowedFiles(templatesRoot(), capability.borrowed);
+    const overlays = [...(ui === "vue" && isNativeTemplate(template) ? VUE_OVERLAYS[template] : []), ...capability.overlays].map(name => join(templatesRoot(), name));
     // Shared legal resources also live in the CLI package; only the template
     // terms are an unconditional part of a generated project.
     const shared = join(templatesRoot(), "_shared");
     const sharedFiles = ["LICENSES/TEMPLATE.txt", "AGENTS.md", "CLAUDE.md"];
     const files = [...templateFiles(source), ...sharedFiles, ...overlays.flatMap(root => templateFiles(root)),
-        ...capability.borrowed.map(borrowedTarget), ...(ui === "vue" ? ["frontend/third-party-notices.mjs"] : [])];
+        ...borrowed.map(borrowedTarget), ...(ui === "vue" ? ["frontend/third-party-notices.mjs"] : [])];
     const collisions = files.map(targetName).filter((file) => existsSync(join(targetDir, file)));
     if (collisions.length > 0) {
         throw new Error(`[INIT_TARGET_NOT_EMPTY] ${targetDir} 已有 ${collisions.join(", ")}；init 不會覆蓋既有檔案。請改用空目錄。`);
@@ -134,12 +142,14 @@ export function initFromTemplate(template, targetDir, options = {}) {
     for (const dir of (ui === "vue" ? ["frontend"] : [])) {
         cpSync(join(shared, "third-party-notices.mjs"), join(targetDir, dir, "third-party-notices.mjs"));
     }
-    for (const path of capability.borrowed)
+    for (const path of borrowed) {
+        mkdirSync(dirname(join(targetDir, borrowedTarget(path))), { recursive: true });
         cpSync(join(templatesRoot(), path), join(targetDir, borrowedTarget(path)));
+    }
     for (const file of capability.removed)
         rmSync(join(targetDir, file));
-    if (caps.includes("delegate")) {
-        const path = join(targetDir, "backend/internal/api/permissions.json");
+    if (caps.includes("delegate") && isNativeTemplate(template)) {
+        const path = join(targetDir, "backend", API_PERMISSIONS_FILE[BACKEND_KIND[template]]);
         const policy = JSON.parse(readFileSync(path, "utf8"));
         policy.methods["app.status"] = "authenticated";
         writeFileSync(path, JSON.stringify(policy, null, 2) + "\n");
@@ -151,8 +161,8 @@ export function initFromTemplate(template, targetDir, options = {}) {
     }
     for (const file of files.map(targetName))
         substitute(join(targetDir, file), substitutions);
-    if (localSdk)
-        useLocalSdk(targetDir, localSdk);
+    if (localSdk && isNativeTemplate(template))
+        useLocalSdk(targetDir, localSdk, BACKEND_KIND[template]);
     if (minDsm) {
         const manifest = join(targetDir, template !== "compose" ? "dsm-package.yaml" : "synology-app.yaml");
         writeFileSync(manifest, readFileSync(manifest, "utf8").replace(/^os_min_ver:.*$/m, `os_min_ver: "${minDsm}"`));
@@ -165,10 +175,9 @@ export function initFromTemplate(template, targetDir, options = {}) {
     if (ui !== "vue")
         rmSync(join(targetDir, "frontend"), { recursive: true, force: true });
     if (template !== "compose") {
+        // Only the capabilities change: the template's comments document the optional fields.
         const path = join(targetDir, "dsm-package.yaml");
-        const raw = parse(readFileSync(path, "utf8"));
-        raw.capabilities = nativeCapabilitySettings(caps);
-        writeFileSync(path, stringify(raw));
+        writeFileSync(path, setTopLevel(readFileSync(path, "utf8"), { capabilities: nativeCapabilitySettings(caps) }));
     }
     if (template === "compose" && options.from)
         importCompose(options.from, targetDir, options);
@@ -236,16 +245,32 @@ function assertLocalSdkReady(sdkDir, vue) {
         throw new Error(`[SDK_DIR_NOT_READY] ${ts} 尚未建置；前端安裝本機 SDK 時 npm 不會替它 build。請先執行 (cd ${ts} && npm ci && npm run build)，SDK 原始碼改動後也要重新 build。`);
     }
 }
-/** SYNOPKGLAND_SDK_DIR: the project builds against a local sdk checkout instead of the released version. */
-function useLocalSdk(targetDir, sdkDir) {
-    const goMod = join(targetDir, "backend/go.mod");
-    writeFileSync(goMod, `${readFileSync(goMod, "utf8")}\nreplace ${SDK_MODULE} => ${sdkDir}\n`);
+/**
+ * SYNOPKGLAND_SDK_DIR: the project builds against a local sdk checkout instead
+ * of the released version. A Rust backend keeps its Cargo files; at build time
+ * git reads the SDK repository from the checkout.
+ */
+function useLocalSdk(targetDir, sdkDir, backend) {
+    if (backend === "go") {
+        const goMod = join(targetDir, "backend/go.mod");
+        writeFileSync(goMod, `${readFileSync(goMod, "utf8")}\nreplace ${SDK_MODULE} => ${sdkDir}\n`);
+    }
     const frontend = join(targetDir, "frontend/package.json");
     if (!existsSync(frontend))
         return;
+    const local = `file:${join(sdkDir, "ts")}`;
     const pkg = JSON.parse(readFileSync(frontend, "utf8"));
-    pkg.dependencies[SDK_PACKAGE] = `file:${join(sdkDir, "ts")}`;
+    pkg.dependencies[SDK_PACKAGE] = local;
     writeFileSync(frontend, JSON.stringify(pkg, null, 2) + "\n");
+    // npm installs what the lockfile records; without the released entry it installs the local package.
+    const lockPath = join(targetDir, "frontend/package-lock.json");
+    if (!existsSync(lockPath))
+        return;
+    const lock = JSON.parse(readFileSync(lockPath, "utf8"));
+    if (lock.packages?.[""]?.dependencies)
+        lock.packages[""].dependencies[SDK_PACKAGE] = local;
+    delete lock.packages?.[`node_modules/${SDK_PACKAGE}`];
+    writeFileSync(lockPath, JSON.stringify(lock, null, 2) + "\n");
 }
 /** Fill the placeholders of one generated file; files without one, or removed by an overlay, stay untouched. */
 function substitute(path, substitutions) {
@@ -258,11 +283,11 @@ function substitute(path, substitutions) {
 }
 function substitutionsFor(template, targetDir, options) {
     const caps = capabilityNames(options.with ?? []);
-    if (options.ui !== undefined && template !== "native-go")
-        throw new Error("[INIT_OPTIONS_UNSUPPORTED] --ui 只適用於 native-go。");
+    if (options.ui !== undefined && !isNativeTemplate(template))
+        throw new Error("[INIT_OPTIONS_UNSUPPORTED] --ui 只適用於 native-go 與 native-rust。");
     if (options.sharedFolder) {
-        if (template !== "native-go")
-            throw new Error("[INIT_SHARED_FOLDER_INVALID] --shared-folder 只適用於 -t native-go。");
+        if (!isNativeTemplate(template))
+            throw new Error("[INIT_SHARED_FOLDER_INVALID] --shared-folder 只適用於 -t native-go 與 native-rust。");
         sharedFolderYaml(options.sharedFolder);
     }
     if (options.ui !== undefined && !["plain", "vue"].includes(options.ui))

package/dist/portal/alias.d.ts

@@ -25,3 +25,11 @@ export declare function isPortalAlias(value: unknown): value is string;
 export declare function defaultPortalAlias(packageId: string): string;
 /** `{}` or `{alias}`; undefined for any other shape. */
 export declare function readPortalDeclaration(value: unknown, packageId: string): PortalDeclaration | undefined;
+/** The Application Portal entry a root executor registers in DSM's app.d, as its approved policy states it. */
+export interface PortalEntry {
+    /** Control Panel display name. */
+    application: string;
+    alias: string;
+}
+/** Why the executor would refuse this entry; undefined when it accepts it. */
+export declare function portalEntryProblem(packageId: string, entry: PortalEntry): string | undefined;

package/dist/portal/alias.js

@@ -41,3 +41,19 @@ export function readPortalDeclaration(value, packageId) {
         return { alias: defaultPortalAlias(packageId) };
     return isPortalAlias(alias) ? { alias } : undefined;
 }
+/**
+ * The executor's own rules (executor/portal_entry.go): the package name and
+ * alias become DSM file and nginx names, the application a JSON string.
+ */
+const ENTRY_PACKAGE = /^[A-Za-z0-9]+(?:[._-][A-Za-z0-9]+)*$/;
+const ENTRY_ALIAS = /^[A-Za-z0-9][A-Za-z0-9_-]{0,63}$/;
+/** Why the executor would refuse this entry; undefined when it accepts it. */
+export function portalEntryProblem(packageId, entry) {
+    if (packageId.length > 64 || !ENTRY_PACKAGE.test(packageId))
+        return `套件名稱「${packageId}」不能當作 Application Portal 的檔名：只能用英數字，以 . _ - 分隔，最多 64 字。`;
+    if (!ENTRY_ALIAS.test(entry.alias))
+        return `portal 別名「${entry.alias}」不能當作 Application Portal 的路徑。`;
+    if (!entry.application || [...entry.application].length > 64 || /\p{Cc}/u.test(entry.application))
+        return `displayname「${entry.application}」不能當作 Application Portal 的名稱：1–64 個字，不可含控制字元。`;
+    return undefined;
+}

package/dist/runtime/executor-build.d.ts

@@ -1,6 +1,6 @@
 import type { NativeArchFamily } from '../build-spk/dsm-arch.js';
 import type { CommandRunner } from '../standalone/build.js';
-import type { StandaloneManifest } from '../standalone/manifest.js';
+import { type StandaloneManifest } from '../standalone/manifest.js';
 import { type ExecutorPolicy } from './executor-policy.js';
 import { type ExecutorPins, type ExecutorTask } from './executor-tasks.js';
 import { type ExecutorDigestTable } from './executor-source.js';

package/dist/runtime/executor-build.js

@@ -1,6 +1,7 @@
 import { mkdirSync, readFileSync } from 'node:fs';
 import { join } from 'node:path';
 import { PINNED_GO_HINT, pinnedGoBuildEnv, pinnedGoProblem } from '../build-spk/go-toolchain.js';
+import { sdkBackend } from '../standalone/manifest.js';
 import { StandaloneBuildError } from '../standalone/spk.js';
 import { checkCgiBinary } from '../standalone/binary.js';
 import { executorPolicy, executorPolicyText, sha256 } from './executor-policy.js';
@@ -23,7 +24,7 @@ export async function buildExecutor(m, arch, work, run, options = {}) {
         return undefined;
     let sdk;
     try {
-        sdk = requiredSdk(m.backend.kind === 'go' ? m.backend.dir : m.root, options.env, options.download);
+        sdk = requiredSdk(sdkBackend(m), options.env, options.download);
     }
     catch (error) {
         throw failure(error);

package/dist/runtime/executor-digests.json

@@ -64,5 +64,27 @@
             "armv7": "b65a14f0fc77a1d3221c7dc6781eb66059aa200956b094d58a62bd1cad10f116"
         },
         "goToolchain": "go1.26.9"
+    },
+    "0.9.6": {
+        "x86_64": "4241dfebd2b819c2566eca062ee0021b99e7f86bbe4703f50833874f79b3cf54",
+        "aarch64": "923514aca8cf6576c6c52c737d53c2c7cc4bfcec40591dcec995005be41add95",
+        "armv7": "df959648ac8e6201f1cf9b86b57730c09ba1afb7ecc151ba2f530ad15dd90ccf",
+        "lifecycle": {
+            "x86_64": "819459580135e016184ad80c258350d57194d6134e8aa4cf1caf5237085b1004",
+            "aarch64": "5abcfc21403e84a0af15d972bcb819ac6fedfd9aaf5898ddc8c4bb06130f9f59",
+            "armv7": "b65a14f0fc77a1d3221c7dc6781eb66059aa200956b094d58a62bd1cad10f116"
+        },
+        "goToolchain": "go1.26.9"
+    },
+    "0.9.7": {
+        "x86_64": "d029ca6129e76cdc5b7016378722af166b511fb346fd1002082e611bec0aef4d",
+        "aarch64": "ac8018a9846a8aaca6f06323f033a27f7abef6705601efde57ea02565105a48d",
+        "armv7": "f7b4ee5fb90c8f2dd2c56ec1eeb7749300ad117a23d9df6da6840d8b2eff83b8",
+        "lifecycle": {
+            "x86_64": "f2f0a6aa83399688441b111adee3958d7df50e9d8e33939e3951da393f013819",
+            "aarch64": "d0f0d42f367093d5c9318afb4719b9ac76b1019574f1db34dd0fcb3aba44945b",
+            "armv7": "02da8b7016abfe00b8f18e27ef2d69bcff1ca376b43e17b8c04983ca6a6ef37d"
+        },
+        "goToolchain": "go1.26.9"
     }
 }

package/dist/runtime/executor-policy.d.ts

@@ -1,8 +1,11 @@
 import type { RootOp } from '../standalone/root-ops.js';
 import type { EntryMode } from '../standalone/manifest.js';
+import { type PortalDeclaration, type PortalEntry } from '../portal/alias.js';
 export declare const FILE_OPERATIONS: readonly ["files.list", "files.info", "files.createFolder", "files.checkPermission", "files.write", "files.read", "files.rename", "files.copy", "files.move", "files.delete"];
 /** Started File Station tasks are followed with these; they are implied, never declared. */
 export declare const FILE_TASK_OPERATIONS: readonly ["files.taskStatus", "files.taskCancel"];
+/** An executor that registers the portal entry serves both, and only with a policy `portal`. */
+export declare const PORTAL_OPERATIONS: readonly ["portal.register", "portal.unregister"];
 export interface DelegateCapability {
     operations: string[];
     scope: string;
@@ -21,6 +24,10 @@ export interface ExecutorPolicy {
     lifetime?: 'until-revoked';
     package: string;
     operations: string[];
+    /** Below DSM 7.2 the executor registers this Application Portal entry; DSM 7.1 refuses web-config for unsigned packages. */
+    portal?: PortalEntry;
+    /** The root op the executor runs at uninstall while the approval is live; a key of root. */
+    purge?: string;
     root: Record<string, string>;
 }
 /** The exact policy file bytes whose sha256 is the policy pin. */
@@ -34,6 +41,14 @@ export declare function executorPolicy(m: {
         rootOps?: true;
     };
     rootOps?: RootOp[];
+    portal?: PortalDeclaration;
+    os_min_ver?: string;
+    displayname?: string;
+    uninstall?: {
+        purge: {
+            root?: string;
+        };
+    };
 }): ExecutorPolicy;
 /** Inventory rejects malformed extensions even if a caller recomputes every pin. */
 export declare function validExecutorPolicy(value: unknown, pkg: string): value is ExecutorPolicy;

package/dist/runtime/executor-policy.js

@@ -1,9 +1,13 @@
 import { createHash } from 'node:crypto';
 import { MOVE_FROM_STAGING, DELEGATE_EXTENSION_OPERATIONS } from './delegate-contract.js';
+import { portalByExecutor } from '../build-spk/dsm-version.js';
+import { portalEntryProblem } from '../portal/alias.js';
 export const FILE_OPERATIONS = ['files.list', 'files.info', 'files.createFolder', 'files.checkPermission', 'files.write', 'files.read', 'files.rename', 'files.copy', 'files.move', 'files.delete'];
 /** Started File Station tasks are followed with these; they are implied, never declared. */
 export const FILE_TASK_OPERATIONS = ['files.taskStatus', 'files.taskCancel'];
 const TASK_STARTING_OPERATIONS = ['files.copy', 'files.move', 'files.delete'];
+/** An executor that registers the portal entry serves both, and only with a policy `portal`. */
+export const PORTAL_OPERATIONS = ['portal.register', 'portal.unregister'];
 export function validDelegate(value) {
     if (!value || typeof value !== 'object' || Array.isArray(value))
         return false;
@@ -24,7 +28,8 @@ export const executorPolicyText = (policy) => JSON.stringify(policy) + '\n';
 export function executorPolicy(m) {
     if (m.capabilities.delegate && !validDelegate(m.capabilities.delegate))
         throw new Error('[EXECUTOR_POLICY] Invalid delegate operations or scope.');
-    const operations = ['status'];
+    const portal = executorPortal(m);
+    const operations = ['status', ...(portal ? PORTAL_OPERATIONS : [])];
     if (m.capabilities.delegate) {
         operations.push('delegate.create', 'delegate.list', 'delegate.revoke', ...m.capabilities.delegate.operations);
         if (m.capabilities.delegate.operations.some(op => TASK_STARTING_OPERATIONS.includes(op)))
@@ -39,23 +44,37 @@ export function executorPolicy(m) {
             root[op.name] = sha256(op.body);
     }
     const d = m.capabilities.delegate;
+    const purge = m.capabilities.rootOps ? m.uninstall?.purge.root : undefined;
     return { v: 1, package: m.package, app: `SYNO.SDS.${m.package}.Instance`, ...(m.entry ? { entry: m.entry } : {}), ...(d ? { scope: d.scope } : {}),
         ...(d?.lifetime ? { destinations: [...d.destinations].sort(), lifetime: d.lifetime } : {}),
-        operations: [...new Set(operations)].sort(), root };
+        operations: [...new Set(operations)].sort(), ...(portal ? { portal } : {}), ...(purge ? { purge } : {}), root };
+}
+/** The entry the executor registers: a portal App whose os_min_ver is below DSM 7.2. */
+function executorPortal(m) {
+    if (!m.portal || !m.os_min_ver || !portalByExecutor(m.os_min_ver))
+        return undefined;
+    const entry = { application: m.displayname ?? '', alias: m.portal.alias };
+    const problem = portalEntryProblem(m.package, entry);
+    if (problem)
+        throw new Error(`[EXECUTOR_POLICY] ${problem}`);
+    return entry;
 }
 /** Inventory rejects malformed extensions even if a caller recomputes every pin. */
 export function validExecutorPolicy(value, pkg) {
     if (!value || typeof value !== 'object' || Array.isArray(value))
         return false;
     const p = value;
-    if (Object.keys(p).some(key => !['v', 'package', 'app', 'entry', 'scope', 'destinations', 'lifetime', 'operations', 'root'].includes(key))
+    if (Object.keys(p).some(key => !['v', 'package', 'app', 'entry', 'scope', 'destinations', 'lifetime', 'operations', 'portal', 'purge', 'root'].includes(key))
         || p.v !== 1 || p.package !== pkg || p.app !== `SYNO.SDS.${pkg}.Instance`
         || 'entry' in p && p.entry !== 'admin-only' && p.entry !== 'app-privilege'
         || !Array.isArray(p.operations) || !p.operations.includes('status') || new Set(p.operations).size !== p.operations.length
-        || !p.root || typeof p.root !== 'object' || Array.isArray(p.root))
+        || !p.root || typeof p.root !== 'object' || Array.isArray(p.root)
+        || 'purge' in p && (typeof p.purge !== 'string' || !Object.hasOwn(p.root, p.purge)))
         return false;
     const base = ['status', 'root.run', 'delegate.create', 'delegate.list', 'delegate.revoke'];
-    if (p.operations.some(op => ![...base, ...FILE_OPERATIONS, ...FILE_TASK_OPERATIONS, ...DELEGATE_EXTENSION_OPERATIONS].includes(op)))
+    if (p.operations.some(op => ![...base, ...FILE_OPERATIONS, ...FILE_TASK_OPERATIONS, ...DELEGATE_EXTENSION_OPERATIONS, ...PORTAL_OPERATIONS].includes(op)))
+        return false;
+    if (!PORTAL_OPERATIONS.every(op => p.operations.includes(op) === (p.portal !== undefined)) || p.portal !== undefined && !validPortalEntry(p.portal, pkg))
         return false;
     const delegated = p.operations.some(op => op.startsWith('files.') || op.startsWith('delegate.'));
     if (!delegated)
@@ -65,5 +84,12 @@ export function validExecutorPolicy(value, pkg) {
     if (!validDelegate(capability))
         return false;
     const expected = executorPolicy({ package: pkg, capabilities: { delegate: capability, ...(p.operations.includes('root.run') ? { rootOps: true } : {}) } }).operations;
-    return expected.length === p.operations.length && expected.every(op => p.operations.includes(op));
+    const declared = p.operations.filter(op => !PORTAL_OPERATIONS.includes(op));
+    return expected.length === declared.length && expected.every(op => declared.includes(op));
+}
+function validPortalEntry(value, pkg) {
+    if (!value || typeof value !== 'object' || Array.isArray(value) || Object.keys(value).some(key => key !== 'application' && key !== 'alias'))
+        return false;
+    const { application, alias } = value;
+    return typeof application === 'string' && typeof alias === 'string' && portalEntryProblem(pkg, { application, alias }) === undefined;
 }

package/dist/runtime/sdk-source.d.ts

@@ -1,6 +1,9 @@
 export declare const SDK_PACKAGE = "@synopackageland/sdk";
 export declare const SDK_MODULE = "github.com/synopackageland/syno-pkg-land-sdk";
 export declare const EXECUTOR_MODULE = "github.com/synopackageland/syno-pkg-land-sdk/executor";
+/** The Rust SDK crate, a git dependency on a release tag of the SDK repository. */
+export declare const SDK_CRATE = "syno-pkg-land-sdk";
+export declare const SDK_GIT_URL = "https://github.com/synopackageland/syno-pkg-land-sdk";
 /** Where one SDK version's Go client and executor sources are read from. */
 export interface SdkSource {
     version: string;
@@ -8,7 +11,16 @@ export interface SdkSource {
     executorDir: string;
     local: boolean;
 }
-/** The SDK version an App requires: `require github.com/synopackageland/syno-pkg-land-sdk vX.Y.Z` in backend/go.mod, the only version source. */
+/** How each backend declares the SDK. */
+export declare const SDK_DEPENDENCY: Record<SdkBackend['kind'], string>;
+/** The App backend whose dependency files name its SDK version. */
+export interface SdkBackend {
+    kind: 'go' | 'rust';
+    dir: string;
+}
+/** The SDK version an App requires, read from its backend's dependency files. */
+export declare function appSdkVersion(backend: SdkBackend): string | undefined;
+/** The SDK version a Go backend requires: `require github.com/synopackageland/syno-pkg-land-sdk vX.Y.Z` in backend/go.mod, its only version source. */
 export declare function sdkRequirement(backendDir: string): string | undefined;
 /** The App's own Go module path, the prefix of every `-X` that targets its packages. */
 export declare function goModulePath(backendDir: string): string | undefined;
@@ -21,7 +33,7 @@ export declare function sdkSource(version: string, env?: NodeJS.ProcessEnv, down
 /** The module cache directory of module@version; the cache is read-only, so builds copy it first. */
 export declare function goModDownload(spec: string, env?: NodeJS.ProcessEnv): string;
 /** The SDK an App builds its executor with; delegate and rootOps cannot build without one. */
-export declare function requiredSdk(backendDir: string, env?: NodeJS.ProcessEnv, download?: (spec: string) => string): SdkSource;
+export declare function requiredSdk(backend: SdkBackend, env?: NodeJS.ProcessEnv, download?: (spec: string) => string): SdkSource;
 /**
  * The SDK repositories are private: Go must fetch them with git, not from
  * proxy.golang.org and sum.golang.org. Says which of the two is missing.

package/dist/runtime/sdk-source.js

@@ -5,7 +5,42 @@ import { join } from 'node:path';
 export const SDK_PACKAGE = '@synopackageland/sdk';
 export const SDK_MODULE = 'github.com/synopackageland/syno-pkg-land-sdk';
 export const EXECUTOR_MODULE = `${SDK_MODULE}/executor`;
-/** The SDK version an App requires: `require github.com/synopackageland/syno-pkg-land-sdk vX.Y.Z` in backend/go.mod, the only version source. */
+/** The Rust SDK crate, a git dependency on a release tag of the SDK repository. */
+export const SDK_CRATE = 'syno-pkg-land-sdk';
+export const SDK_GIT_URL = `https://${SDK_MODULE}`;
+/** How each backend declares the SDK. */
+export const SDK_DEPENDENCY = {
+    go: `add \`require ${SDK_MODULE} v<version>\` to backend/go.mod.`,
+    rust: `add \`${SDK_CRATE} = { git = "${SDK_GIT_URL}", tag = "v<version>" }\` to backend/Cargo.toml and commit Cargo.lock.`,
+};
+/** The SDK version an App requires, read from its backend's dependency files. */
+export function appSdkVersion(backend) {
+    return backend.kind === 'go' ? sdkRequirement(backend.dir) : cargoSdkRequirement(backend.dir);
+}
+/**
+ * The SDK release a Rust backend's Cargo.lock pins: the source
+ * `git+https://github.com/synopackageland/syno-pkg-land-sdk?tag=vX.Y.Z#<commit>`.
+ * A branch, revision, path or registry source is refused, so the executor and
+ * the SDK route policy always come from the same release as the crate.
+ */
+function cargoSdkRequirement(backendDir) {
+    let lock;
+    try {
+        lock = readFileSync(join(backendDir, 'Cargo.lock'), 'utf8');
+    }
+    catch {
+        return undefined;
+    }
+    const sdk = lock.split(/^\[\[package\]\]$/m).filter(entry => /^name = "(.*)"$/m.exec(entry)?.[1] === SDK_CRATE);
+    if (!sdk.length)
+        return undefined;
+    const tag = new RegExp(`^source = "git\\+${SDK_GIT_URL.replaceAll('.', '\\.')}\\?tag=v(\\d+\\.\\d+\\.\\d+)#[0-9a-f]{40}"$`, 'm');
+    const version = sdk.length === 1 ? tag.exec(sdk[0])?.[1] : undefined;
+    if (!version)
+        throw new Error(`[SDK_TAG_REQUIRED] backend/Cargo.lock must pin one ${SDK_CRATE} from a release tag: { git = "${SDK_GIT_URL}", tag = "vX.Y.Z" } in Cargo.toml, then cargo update -p ${SDK_CRATE}.`);
+    return version;
+}
+/** The SDK version a Go backend requires: `require github.com/synopackageland/syno-pkg-land-sdk vX.Y.Z` in backend/go.mod, its only version source. */
 export function sdkRequirement(backendDir) {
     const module = SDK_MODULE.replaceAll('.', '\\.');
     return new RegExp(`^\\s*(?:require\\s+)?${module}\\s+v(\\S+)`, 'm').exec(goMod(backendDir))?.[1];
@@ -54,10 +89,10 @@ export function goModDownload(spec, env = process.env) {
     return info.Dir;
 }
 /** The SDK an App builds its executor with; delegate and rootOps cannot build without one. */
-export function requiredSdk(backendDir, env = process.env, download) {
-    const version = sdkRequirement(backendDir);
+export function requiredSdk(backend, env = process.env, download) {
+    const version = appSdkVersion(backend);
     if (!version)
-        throw new Error(`[SDK_REQUIRED] capabilities.delegate and rootOps need the SDK: add \`require ${SDK_MODULE} v<version>\` to backend/go.mod.`);
+        throw new Error(`[SDK_REQUIRED] capabilities.delegate and rootOps need the SDK: ${SDK_DEPENDENCY[backend.kind]}`);
     return download ? sdkSource(version, env, download) : sdkSource(version, env);
 }
 /**

package/dist/runtime/uninstall-cleanup.d.ts

@@ -9,5 +9,9 @@ export interface UninstallCleanupOptions {
     executor?: boolean;
     /** The App declares a Login Portal alias; only the executor tier can. */
     portal?: boolean;
+    /** Below DSM 7.2 the executor registered the App's Application Portal entry. */
+    portalEntry?: boolean;
 }
-export declare function uninstallCleanup(pkg: string, { executor, portal }?: UninstallCleanupOptions): UninstallCleanupItem[];
+/** The root commands that remove an Application Portal entry the executor could not unregister. */
+export declare function portalEntryCleanupCommands(pkg: string): string[];
+export declare function uninstallCleanup(pkg: string, { executor, portal, portalEntry }?: UninstallCleanupOptions): UninstallCleanupItem[];