@synopackageland/cli 0.9.4 → 0.9.6

package/dist/runtime/uninstall-cleanup.js

@@ -1,5 +1,14 @@
+/** The root commands that remove an Application Portal entry the executor could not unregister. */
+export function portalEntryCleanupCommands(pkg) {
+    return [
+        `rm -f /usr/syno/etc/www/app.d/${pkg}.json /usr/syno/etc/www/app.d/${pkg}.mustache /usr/syno/etc/packages/${pkg}/AppPortal.json`,
+        `for c in dsm www alias .alias; do n=$c.syno-app-portal.${pkg}.conf; synow3tool --disable-nginx-confd=$n; synow3tool --unreg-nginx-confd=$n; done`,
+        `for c in server .server; do n=$c.syno-app-portal.${pkg}.conf; synow3tool --disable-nginx-sites=$n; synow3tool --unreg-nginx-sites=$n; done`,
+        'nginx -t && synow3tool --nginx=reload',
+    ];
+}
 const AUTOMATIC_FAILED = 'Only if automatic cleanup failed after uninstall; see the system log entry synopkgland-executor.';
-export function uninstallCleanup(pkg, { executor = false, portal = false } = {}) {
+export function uninstallCleanup(pkg, { executor = false, portal = false, portalEntry = false } = {}) {
     const items = [
         { target: `@appdata/${pkg}, @appconf/${pkg}, @apphome/${pkg}`, condition: 'After uninstall, if retained data or empty DSM directories are no longer needed.', action: 'Back up retained data; an administrator may remove only these package-specific directories. The delete-data checkbox empties their contents and preserves DSM directory roots.' },
         { target: `@appshare/${pkg}, /usr/syno/etc/packages/${pkg}`, condition: 'After uninstall, if DSM leaves package infrastructure or a package-config symlink.', action: 'Administrator: inspect these package-specific paths and remove unused infrastructure; do not follow the symlink to delete shared data.' },
@@ -8,6 +17,7 @@ export function uninstallCleanup(pkg, { executor = false, portal = false } = {})
             ? { target: `SYNO.SDS.${pkg}.Instance rules in Application Privileges`, condition: AUTOMATIC_FAILED, action: 'The root executor removes these rules automatically through the Application Privileges API on uninstall. Administrator: remove surviving rules in Control Panel > Application Privileges; DSM would apply them again to a later install under the same name.' }
             : { target: `SYNO.SDS.${pkg}.Instance rules in Application Privileges`, condition: 'After uninstall, if this package will not be reinstalled.', action: 'DSM keeps these rules in /etc/synoappprivilege.db and applies them again to a later install under the same name. Administrator: remove them in Control Panel > Application Privileges.' },
         ...(executor && portal ? [{ target: `${pkg} Login Portal alias`, condition: AUTOMATIC_FAILED, action: 'DSM removes the alias configuration without reloading its web server; the root executor then reloads the web server automatically. Administrator: if the alias still opens a DSM page, save an application alias in Control Panel > Login Portal > Applications to reload it, or restart the NAS.' }] : []),
+        ...(executor && portalEntry ? [{ target: `${pkg} Application Portal entry`, condition: 'After uninstall, if the executor was not running or was never approved, so it could not remove the entry.', action: `Administrator, as root: ${portalEntryCleanupCommands(pkg).join('; ')}` }] : []),
         { target: `${pkg} package account/group`, condition: 'After uninstall, only if this package will not be reinstalled and the identity is unused.', action: 'Administrator: review DSM internal account/group and associated ACLs before cleanup. Package scripts do not delete system identities.' },
     ];
     if (executor)

package/dist/standalone/api-permissions.d.ts

@@ -1,5 +1,7 @@
 import type { Capabilities } from "./manifest.js";
-export declare const API_PERMISSIONS_FILE = "internal/api/permissions.json";
+import { type SdkBackend } from "../runtime/sdk-source.js";
+/** The App route policy inside each backend kind's directory. */
+export declare const API_PERMISSIONS_FILE: Record<SdkBackend["kind"], string>;
 type SdkPermissions = Record<string, Record<string, ApiPermission>>;
 export declare const MAX_PERMISSIONS_BYTES = 65536;
 export declare const MAX_PERMISSION_METHODS = 1024;
@@ -10,7 +12,7 @@ export interface ApiPermissions {
     methods: Record<string, ApiPermission>;
 }
 export declare function parseApiPermissions(raw: Uint8Array): ApiPermissions;
-export declare function readApiPermissions(backendDir: string, capabilities?: Capabilities): {
+export declare function readApiPermissions(backend: SdkBackend, capabilities?: Capabilities): {
     policy: ApiPermissions;
     digest: string;
     sdkDigest: string;

package/dist/standalone/api-permissions.js

@@ -1,9 +1,10 @@
 import { createHash } from "node:crypto";
 import { lstatSync, readFileSync } from "node:fs";
 import { join } from "node:path";
-import { sdkRequirement, sdkSource } from "../runtime/sdk-source.js";
+import { appSdkVersion, sdkSource } from "../runtime/sdk-source.js";
 import { parseDocument } from "yaml";
-export const API_PERMISSIONS_FILE = "internal/api/permissions.json";
+/** The App route policy inside each backend kind's directory. */
+export const API_PERMISSIONS_FILE = { go: "internal/api/permissions.json", rust: "permissions.json" };
 /** SDK-owned routes per capability, in the Go module of the SDK version the App requires. */
 const SDK_PERMISSIONS_FILE = "api/sdk-permissions.json";
 export const MAX_PERMISSIONS_BYTES = 65536;
@@ -32,14 +33,14 @@ export function parseApiPermissions(raw) {
     }
     return value;
 }
-export function readApiPermissions(backendDir, capabilities = {}) {
-    const file = join(backendDir, API_PERMISSIONS_FILE);
+export function readApiPermissions(backend, capabilities = {}) {
+    const file = join(backend.dir, API_PERMISSIONS_FILE[backend.kind]);
     const stat = lstatSync(file);
     if (!stat.isFile() || stat.size > MAX_PERMISSIONS_BYTES)
         throw new Error("permissions must be a regular bounded JSON file");
     const raw = readFileSync(file);
     const policy = parseApiPermissions(raw);
-    const version = sdkRequirement(backendDir);
+    const version = appSdkVersion(backend);
     const sdkRaw = version ? readFileSync(join(sdkSource(version).goDir, SDK_PERMISSIONS_FILE)) : Buffer.from("{}");
     const sdk = JSON.parse(sdkRaw.toString("utf8"));
     for (const methods of Object.values(sdk))

package/dist/standalone/binary.d.ts

@@ -4,7 +4,8 @@ export declare const ELF_MACHINE: Record<NativeArchFamily, number>;
 /**
  * Checks a prebuilt CGI before it is packaged: a regular file inside the
  * project, a little-endian ELF of `arch`'s class and machine, and statically linked
- * (no PT_INTERP), because DSM models ship different libc versions.
+ * (no PT_INTERP), because DSM models ship different libc versions; only a
+ * build that links against a known DSM glibc may name its `interpreter`.
  * Returns undefined when the file is acceptable.
  */
-export declare function checkCgiBinary(projectRoot: string, file: string, arch: NativeArchFamily): StandaloneError | undefined;
+export declare function checkCgiBinary(projectRoot: string, file: string, arch: NativeArchFamily, interpreter?: string): StandaloneError | undefined;

package/dist/standalone/binary.js

@@ -11,10 +11,11 @@ function fail(code, message) {
 /**
  * Checks a prebuilt CGI before it is packaged: a regular file inside the
  * project, a little-endian ELF of `arch`'s class and machine, and statically linked
- * (no PT_INTERP), because DSM models ship different libc versions.
+ * (no PT_INTERP), because DSM models ship different libc versions; only a
+ * build that links against a known DSM glibc may name its `interpreter`.
  * Returns undefined when the file is acceptable.
  */
-export function checkCgiBinary(projectRoot, file, arch) {
+export function checkCgiBinary(projectRoot, file, arch, interpreter) {
     let stat;
     try {
         stat = lstatSync(file);
@@ -32,7 +33,7 @@ export function checkCgiBinary(projectRoot, file, arch) {
     if (stat.size > MAX_BINARY_BYTES) {
         return fail("STANDALONE_BINARY_TOO_LARGE", `${file} 超過 256 MiB。`);
     }
-    return checkElf(readHeader(file), file, arch);
+    return checkElf(readHeader(file), file, arch, interpreter);
 }
 function readHeader(file) {
     const fd = openSync(file, "r");
@@ -58,7 +59,7 @@ function readElfHeader(buf) {
     }
     return undefined;
 }
-function checkElf(buf, file, arch) {
+function checkElf(buf, file, arch, interpreter) {
     const bits = ELF_CLASS64[arch] ? 64 : 32;
     const notElf = fail("STANDALONE_BINARY_NOT_ELF", `${file} 不是 ${arch} 需要的 ${bits}-bit little-endian Linux ELF 執行檔。`);
     const header = readElfHeader(buf);
@@ -73,9 +74,20 @@ function checkElf(buf, file, arch) {
         return notElf;
     }
     for (let i = 0; i < phnum; i++) {
-        if (buf.readUInt32LE(phoff + i * phentsize) === PT_INTERP) {
+        const entry = phoff + i * phentsize;
+        if (buf.readUInt32LE(entry) === PT_INTERP && (interpreter === undefined || interpreterOf(buf, entry, header.class64) !== interpreter)) {
             return fail("STANDALONE_BINARY_DYNAMIC", `${file} 是動態連結執行檔。請改用靜態連結（Go：CGO_ENABLED=0；Rust：*-unknown-linux-musl）。`);
         }
     }
     return undefined;
 }
+/** The path a PT_INTERP program header names, when it lies within the read header bytes. */
+function interpreterOf(buf, entry, class64) {
+    if (entry + (class64 ? 40 : 20) > buf.length)
+        return undefined;
+    const offset = class64 ? Number(buf.readBigUInt64LE(entry + 8)) : buf.readUInt32LE(entry + 4);
+    const size = class64 ? Number(buf.readBigUInt64LE(entry + 32)) : buf.readUInt32LE(entry + 16);
+    if (size < 1 || offset + size > buf.length || buf[offset + size - 1] !== 0)
+        return undefined;
+    return buf.toString("latin1", offset, offset + size - 1);
+}

package/dist/standalone/build.js

@@ -4,9 +4,10 @@ import { existsSync, mkdirSync, mkdtempSync, rmSync } from "node:fs";
 import { tmpdir } from "node:os";
 import { join } from "node:path";
 import { goBuildEnv } from "../build-spk/dsm-arch.js";
-import { resolveMinDsm, DEFAULT_MIN_DSM, isDsmAtLeast, PORTAL_MIN_DSM, portalMinDsmMessage } from "../build-spk/dsm-version.js";
+import { resolveMinDsm, DEFAULT_MIN_DSM, isDsmAtLeast, PORTAL_EXECUTOR_MIN_DSM, portalByExecutor, portalMinDsmMessage } from "../build-spk/dsm-version.js";
 import { checkCgiBinary } from "./binary.js";
 import { loadStandaloneManifest } from "./manifest.js";
+import { buildRustBackend } from "./rust-build.js";
 import { assembleStandaloneSpk, StandaloneBuildError } from "./spk.js";
 import { buildDaemonControl } from "./daemon.js";
 import { buildExecutor } from "../runtime/executor-build.js";
@@ -80,7 +81,7 @@ export async function buildStandalone(options) {
     if (manifest.capabilities.rootOps === true && !isDsmAtLeast(manifest.os_min_ver, DEFAULT_MIN_DSM)) {
         throw new StandaloneBuildError("STANDALONE_OS_MIN_VER_INVALID", `root templates require DSM ${DEFAULT_MIN_DSM} or later.`);
     }
-    if (manifest.portal && !isDsmAtLeast(manifest.os_min_ver, PORTAL_MIN_DSM)) {
+    if (manifest.portal && !isDsmAtLeast(manifest.os_min_ver, PORTAL_EXECUTOR_MIN_DSM)) {
         throw new StandaloneBuildError("STANDALONE_PORTAL_MIN_DSM", `[STANDALONE_PORTAL_MIN_DSM] ${portalMinDsmMessage(manifest.os_min_ver, "portal")}`);
     }
     const jobs = checkJobs(options.jobs);
@@ -102,14 +103,9 @@ export async function buildStandalone(options) {
             const executor = await buildExecutor(manifest, arch, archWork, run);
             executor?.warnings.forEach(warning => warnings.add(warning));
             const builtManifest = executor ? { ...manifest, executor } : manifest;
-            const cgiPath = await backendFor(builtManifest, arch, archWork, run);
-            const problem = checkCgiBinary(manifest.backend.kind === "go" ? archWork : manifest.root, cgiPath, arch);
-            if (problem) {
-                throw new StandaloneBuildError(problem.code, problem.message);
-            }
+            const { cgi: cgiPath, worker: backgroundWorker } = await backendFor(builtManifest, arch, archWork, run);
             const outputPath = join(stage, `${manifest.package}-${manifest.spkVersion}-${arch}.spk`);
             const daemonControl = await buildDaemonControl(manifest, arch, archWork, run);
-            const backgroundWorker = await buildBackgroundWorker(builtManifest, arch, archWork, run);
             await assembleStandaloneSpk({ manifest: builtManifest, arch, cgiPath, outputPath, daemonControl, backgroundWorker, executor });
             return outputPath;
         }));
@@ -133,14 +129,22 @@ async function buildUi(manifest, run) {
         throw new StandaloneBuildError("STANDALONE_UI_BUILD_FAILED", `UI build（${build.command.join(" ")}）失敗。${installHint}\n${result.stderr}`);
     }
 }
+/** The checked CGI of one architecture and, with capabilities.jobs, its fixed worker. */
 async function backendFor(manifest, arch, work, run) {
     const backend = manifest.backend;
-    if (backend.kind === "binary") {
-        return backend.files[arch];
+    if (backend.kind === "rust")
+        return buildRustBackend(manifest, arch, work, run);
+    const cgi = backend.kind === "binary" ? backend.files[arch] : await buildGoCgi(manifest, backend, arch, work, run);
+    const problem = checkCgiBinary(backend.kind === "go" ? work : manifest.root, cgi, arch);
+    if (problem) {
+        throw new StandaloneBuildError(problem.code, problem.message);
     }
+    return { cgi, worker: await buildBackgroundWorker(manifest, arch, work, run) };
+}
+async function buildGoCgi(manifest, backend, arch, work, run) {
     // UI build hooks run after validation. Refuse policy changes rather than
     // compiling CGI permissions different from the launcher metadata snapshot.
-    if (readApiPermissions(backend.dir, manifest.capabilities).digest !== manifest.apiPermissionsDigest || readApiPermissions(backend.dir, manifest.capabilities).sdkDigest !== manifest.apiSDKPermissionsDigest) {
+    if (readApiPermissions(backend, manifest.capabilities).digest !== manifest.apiPermissionsDigest || readApiPermissions(backend, manifest.capabilities).sdkDigest !== manifest.apiSDKPermissionsDigest) {
         throw new StandaloneBuildError("STANDALONE_API_PERMISSIONS_CHANGED", "API permissions changed during build; check and rebuild.");
     }
     const module = goModulePath(backend.dir);
@@ -160,7 +164,7 @@ async function backendFor(manifest, arch, work, run) {
         ...(manifest.capabilities.identity ? [`-X main.identity=${manifest.capabilities.identity}`] : []),
         ...(manifest.capabilities.files || manifest.capabilities.delegate ? [`-X main.fileStation=session`] : []),
         ...(manifest.entry ? [`-X main.entry=${manifest.entry}`] : []),
-        ...(manifest.portal ? ["-X main.portal=on"] : []),
+        ...(manifest.portal ? [`-X main.portal=${portalByExecutor(manifest.os_min_ver) ? "executor" : "on"}`] : []),
     ].join(" ");
     const result = await run("go", ["build", "-trimpath", "-buildvcs=false", "-ldflags", ldflags, "-o", out, backend.main], {
         cwd: backend.dir,

package/dist/standalone/daemon.d.ts

@@ -18,6 +18,12 @@ export interface Daemon {
         uninstall: number;
     };
 }
+/** A fixed argv or env value: only the package's own directories expand. */
+export declare const token: (v: unknown) => v is string;
+/** An application variable that cannot steer the loader, the shell or DSM. */
+export declare const envKey: (k: string) => boolean;
+/** A relative path to a fixed executable, without `.` or `..` parts. */
+export declare const relativeExec: (v: unknown) => v is string;
 export declare function readDaemon(value: unknown, root: string, arches: NativeArchFamily[], fail: (error: StandaloneError) => void): Daemon | undefined;
 export declare function daemonConfig(manifest: StandaloneManifest): string;
 export declare function buildDaemonControl(manifest: StandaloneManifest, arch: NativeArchFamily, work: string, run: CommandRunner): Promise<string | undefined>;

package/dist/standalone/daemon.js

@@ -6,18 +6,22 @@ import { checkCgiBinary } from "./binary.js";
 import { StandaloneBuildError } from "./spk.js";
 const fields = new Set(["exec", "targets", "args", "env", "timeouts", "uninstall_args"]);
 const record = (v) => Boolean(v) && typeof v === "object" && !Array.isArray(v);
-const token = (v) => typeof v === "string" && Buffer.byteLength(v) <= 4096 && !v.includes("\0")
+/** A fixed argv or env value: only the package's own directories expand. */
+export const token = (v) => typeof v === "string" && Buffer.byteLength(v) <= 4096 && !v.includes("\0")
     && !v.replaceAll("${SYNOPKG_PKGDEST}", "").replaceAll("${SYNOPKG_PKGVAR}", "").includes("${");
-const envKey = (k) => /^[A-Z][A-Z0-9_]{0,63}$/.test(k)
+/** An application variable that cannot steer the loader, the shell or DSM. */
+export const envKey = (k) => /^[A-Z][A-Z0-9_]{0,63}$/.test(k)
     && !/^(PATH|HOME|TMPDIR|ENV|BASH_ENV|SHELLOPTS|BASHOPTS|GODEBUG|GOTRACEBACK|LD_.*|DYLD_.*|SYNOPKG_.*)$/.test(k);
+/** A relative path to a fixed executable, without `.` or `..` parts. */
+export const relativeExec = (v) => typeof v === "string" && v.length <= 200
+    && /^[A-Za-z0-9_-]+(?:\/[A-Za-z0-9_.-]+)*$/.test(v) && !v.split("/").some(p => p === "." || p === "..");
 export function readDaemon(value, root, arches, fail) {
     if (value === undefined)
         return undefined;
     const invalid = () => { fail({ code: "STANDALONE_DAEMON_INVALID", message: "daemon 只接受固定 exec、targets、args、env 與 timeouts；路徑須在專案內，環境不接受 loader/shell/system 變數。" }); return undefined; };
     if (!record(value) || Object.keys(value).some(k => !fields.has(k)))
         return invalid();
-    if (typeof value.exec !== "string" || !/^[A-Za-z0-9_-]+(?:\/[A-Za-z0-9_.-]+)*$/.test(value.exec)
-        || value.exec.split("/").some(p => p === "." || p === "..") || value.exec.length > 200)
+    if (!relativeExec(value.exec))
         return invalid();
     if (!record(value.targets) || Object.keys(value.targets).length !== arches.length)
         return invalid();

package/dist/standalone/dsm-window.js

@@ -4,6 +4,7 @@ import { PASSWORD_CONFIRM, ROOT_PANEL, ROOT_RUNTIME, rootPanelCatalogs } from ".
 import { HOST_ADAPTER_RUNTIME } from "./host-adapter.js";
 import { permitsOrdinaryUsers } from "./api-permissions.js";
 import { PORTAL_RUNTIME } from "./portal-window.js";
+import { portalByExecutor } from "../build-spk/dsm-version.js";
 import { uiTitleFields } from "../build-spk/ui-texts.js";
 /** Same path the generated wrapper POSTs to, and the payload location of the CGI. */
 export const CGI_PAYLOAD_PATH = "ui/cgi/api.cgi";
@@ -172,6 +173,15 @@ ${root ? root.definitions : ""}${manifest.portal ? renderPortalDefinition(ns) :
   document.head.appendChild(js);
 };
 
+// DSM reopens a window at the size it was last left at, even one saved on a
+// larger screen, and only moves a window that does not fit: keep it inside.
+${ns}.fitDesktop = function (size) {
+  var taskbar = SYNO.SDS.TaskBar ? SYNO.SDS.TaskBar.height() : 0;
+  size.width = Math.min(size.width, Ext.lib.Dom.getViewWidth());
+  size.height = Math.min(size.height, Ext.lib.Dom.getViewHeight() - taskbar);
+  return size;
+};
+
 Ext.define(${JSON.stringify(`${ns}.Instance`)}, {
   extend: "SYNO.SDS.AppInstance",
   appWindowName: ${JSON.stringify(`${ns}.MainWindow`)}
@@ -180,10 +190,13 @@ Ext.define(${JSON.stringify(`${ns}.Instance`)}, {
 Ext.define(${JSON.stringify(`${ns}.MainWindow`)}, {
   extend: "SYNO.SDS.AppWindow",
   constructor: function (config) {
-    this.callParent([Ext.apply({
+    this.callParent([${ns}.fitDesktop(Ext.apply({
       width: 960, height: 640, minWidth: 700, minHeight: 420, layout: "fit",
       ${root ? root.html : `html: '<div class="dsmapp-root" style="height:100%"></div>'`}
-    }, config)]);
+    }, config))]);
+  },
+  getRestoreSizePos: function (config) {
+    return ${ns}.fitDesktop(Ext.apply({ width: config.width, height: config.height }, this.callParent(arguments)));
   },
   onOpen: function () {
     this.callParent(arguments);
@@ -267,7 +280,7 @@ ${PORTAL_RUNTIME}
 function renderPortalAccess(ns, manifest) {
     return `${ns}.createPortalAccess({
             appId: ${JSON.stringify(`${ns}.Instance`)},
-            defaultAlias: ${JSON.stringify(manifest.portal.alias)},
+            defaultAlias: ${JSON.stringify(manifest.portal.alias)},${portalByExecutor(manifest.os_min_ver) ? "\n            entry: true," : ""}
             isAdmin: function () { return ${ns}.sessionUser().isAdmin; },
             send: ${ns}.webApi(me),
             call: ${ns}.call,

package/dist/standalone/inspect-spk.d.ts

@@ -1,7 +1,7 @@
 import { type ExecutorInspection } from "../runtime/executor-inspect.js";
 import type { EntryMode } from "./manifest.js";
 import { type UninstallCleanupItem } from "../runtime/uninstall-cleanup.js";
-export type SpkKind = "native-go" | "binary" | "container" | "native-layout";
+export type SpkKind = "native-go" | "native-rust" | "binary" | "container" | "native-layout";
 export interface SpkInspection {
     kind?: SpkKind;
     package?: string;

package/dist/standalone/inspect-spk.js

@@ -6,10 +6,13 @@ import { tmpdir } from "node:os";
 import { join } from "node:path";
 import * as tar from "tar";
 import { familyOfArchToken, NATIVE_ARCH_FAMILIES } from "../build-spk/dsm-arch.js";
-import { CONTAINER_MIN_DSM, isDsmAtLeast, PORTAL_MIN_DSM } from "../build-spk/dsm-version.js";
+import { CONTAINER_MIN_DSM, isDsmAtLeast, PORTAL_EXECUTOR_MIN_DSM, PORTAL_MIN_DSM, PORTAL_MIN_DSM_REASON } from "../build-spk/dsm-version.js";
 import { ELF_MACHINE } from "./binary.js";
 import { CGI_PAYLOAD_PATH, entryLauncherAccess } from "./dsm-window.js";
 import { daemonConfig, readDaemon } from "./daemon.js";
+import { ROOT_SCRIPT_HINTS } from "./root-ops.js";
+import { DELETE_STATE_KEY } from "../build-spk/uninstall-wizard.js";
+import { readUninstallRecord, stateItemTexts } from "./uninstall.js";
 import { BACKGROUND_UNIT_DIR, BACKGROUND_WORKER_PAYLOAD, backgroundUnitName, renderBackgroundUnit } from "./background.js";
 import { renderStandaloneResource } from "./resource.js";
 import { recoverSharedFolder, renderSharedFolderUpgradeWizardFiles, sharedFolderInstallSteps, SHARED_FOLDER_MARKER } from "./shared-folder.js";
@@ -23,7 +26,6 @@ import { PORTAL_JSON_RELPATH, PORTAL_MUSTACHE_RELPATH, renderPortalJson, renderP
 import { isPortalAlias } from "../portal/alias.js";
 import { defaultPackageIcons, MAX_ICON_BYTES } from "../build-spk/dsm-icons.js";
 import { decodePng } from "../build-spk/png.js";
-const ROOT_SCRIPT_HINTS = [/\bsudo\b/, /\bchown\s+(-\w+\s+)*root\b/, /chmod\s+[ugo]*\+s\b/, /chmod\s+[2467][0-7]{3}\b/];
 /** Reads an SPK without installing it and reports how it would run on DSM. */
 export async function inspectStandaloneSpk(spkPath) {
     return inspectSpk(spkPath, "native-go");
@@ -55,7 +57,7 @@ export async function inspectSpk(spkPath, expectedKind) {
         if (metadataText !== undefined) {
             try {
                 const raw = JSON.parse(metadataText);
-                if (raw.schema !== 2 || !["go", "binary"].includes(raw.backend) || !Array.isArray(raw.capabilities) || raw.capabilities.some((name) => !["files", "jobs", "identity", "rootOps", "delegate"].includes(String(name))) || new Set(raw.capabilities).size !== raw.capabilities.length || (raw.entry !== undefined && !["admin-only", "app-privilege"].includes(raw.entry)))
+                if (raw.schema !== 2 || !["go", "rust", "binary"].includes(raw.backend) || !Array.isArray(raw.capabilities) || raw.capabilities.some((name) => !["files", "jobs", "identity", "rootOps", "delegate"].includes(String(name))) || new Set(raw.capabilities).size !== raw.capabilities.length || (raw.entry !== undefined && !["admin-only", "app-privilege"].includes(raw.entry)))
                     throw new Error();
                 metadata = raw;
             }
@@ -63,17 +65,23 @@ export async function inspectSpk(spkPath, expectedKind) {
                 findings.push("sdk-package.json 不符合 schema 2 capability inventory。");
             }
         }
+        const uninstallHook = metadata.uninstall === undefined ? undefined : readUninstallRecord(metadata.uninstall, metadata.capabilities?.includes("rootOps") === true);
+        if (metadata.uninstall !== undefined && !uninstallHook)
+            findings.push("UNINSTALL_RECORD_INVALID sdk-package.json 的 uninstall 不是 synopkgland build 寫出的 uninstall 設定。");
         const binaryBackend = metadata.backend === "binary";
-        const kind = expectedKind ?? (paths.has("compose.yaml") ? "container" : binaryBackend ? "binary" : "native-go");
-        const standalone = kind === "native-go" || kind === "binary";
+        // A strict standalone inspection names the language the CGI was built from.
+        const compiled = metadata.backend === "rust" ? "native-rust" : "native-go";
+        const kind = (expectedKind === "native-go" ? compiled : expectedKind) ?? (paths.has("compose.yaml") ? "container" : binaryBackend ? "binary" : compiled);
+        const compiledKind = kind === "native-go" || kind === "native-rust";
+        const standalone = compiledKind || kind === "binary";
         const info = readInfo(join(dir, "INFO"), findings, kind);
         await checkArch(dir, info, kind, paths.has(CGI_PAYLOAD_PATH), findings);
-        const background = kind === "native-go" && paths.has(BACKGROUND_WORKER_PAYLOAD);
+        const background = compiledKind && paths.has(BACKGROUND_WORKER_PAYLOAD);
         const sharedFolder = standalone ? recoverSharedFolder(readOptional(join(dir, "scripts/postinst"))) : undefined;
         // A Compose App has no executor, so its SPK never carries a portal.
         const portal = standalone ? await recoverPortal(dir, info, `SYNO.SDS.${info.package}.Instance`, paths, payload, findings) : undefined;
         if (portal && info.os_min_ver && OS_MIN_VER.test(info.os_min_ver) && !isDsmAtLeast(info.os_min_ver, PORTAL_MIN_DSM)) {
-            findings.push(`INFO os_min_ver「${info.os_min_ver}」低於 portal 需要的 DSM ${PORTAL_MIN_DSM}；DSM 7.1.1 以錯誤 320 拒裝帶 web-config app-portal 的未簽章套件，7.2 未驗證`);
+            findings.push(`INFO os_min_ver「${info.os_min_ver}」低於 portal 需要的 DSM ${PORTAL_MIN_DSM}；${PORTAL_MIN_DSM_REASON}`);
         }
         checkConf(dir, findings, kind, background, sharedFolder, info.package, portal);
         checkScripts(dir, findings);
@@ -96,18 +104,23 @@ export async function inspectSpk(spkPath, expectedKind) {
             executor = inspected.executor;
             if (executor)
                 findings.push(...inspectExecutorAnchor(readFileSync(join(dir, "INFO"), "utf8"), executor.executorDigest));
+            if (executor?.policy.portal && info.os_min_ver && OS_MIN_VER.test(info.os_min_ver) && !isDsmAtLeast(info.os_min_ver, PORTAL_EXECUTOR_MIN_DSM)) {
+                findings.push(`INFO os_min_ver「${info.os_min_ver}」低於 executor 註冊 portal 需要的 DSM ${PORTAL_EXECUTOR_MIN_DSM}`);
+            }
+            if (executor && executor.policy.purge !== uninstallHook?.uninstall.purge.root)
+                findings.push(`UNINSTALL_ROOT_POLICY_MISMATCH executor policy 的 purge「${executor.policy.purge ?? ""}」與 uninstall.purge.root「${uninstallHook?.uninstall.purge.root ?? ""}」不同。`);
             if (payload.find(p => p.path === "executor/executor")?.mode !== "0755")
                 findings.push("Executor must be executable.");
             if (payload.find(p => p.path === "executor/lifecycle")?.mode !== "0755")
                 findings.push("Executor lifecycle helper must be executable.");
             if (![...paths].some(path => path.startsWith("daemon/"))) {
-                const lifecycleManifest = { package: info.package, capabilities: { rootOps: true, ...(background ? { jobs: { worker: "sha256-v1" } } : {}) } };
+                const lifecycleManifest = { package: info.package, capabilities: { rootOps: true, ...(background ? { jobs: { worker: "sha256-v1" } } : {}) }, ...(uninstallHook ? { uninstall: uninstallHook.uninstall } : {}) };
                 for (const hook of ["preuninst", "preupgrade", "start-stop-status"]) {
                     if (readOptional(join(dir, "scripts", hook)) !== renderStandaloneScript(hook, lifecycleManifest))
                         findings.push(`Executor scripts/${hook} differs from fixed lifecycle.`);
                 }
             }
-            for (const [name, text] of Object.entries(renderUninstallWizardFiles(info.package, "native", { executor: true, portal: Boolean(portal) }))) {
+            for (const [name, text] of Object.entries(renderUninstallWizardFiles(info.package, "native", { executor: true, portal: Boolean(portal), portalEntry: Boolean(executor?.policy.portal), ...uninstallWizardOptions(uninstallHook) }))) {
                 if (readOptional(join(dir, "WIZARD_UIFILES", name)) !== text)
                     findings.push(`Executor WIZARD_UIFILES/${name} is missing cleanup guidance.`);
             }
@@ -132,8 +145,9 @@ export async function inspectSpk(spkPath, expectedKind) {
             icon,
             ...(executor ? { executor } : {}),
             ...(portal ? { portal: { appId: portal.appId, alias: portal.alias } } : {}),
+            ...(executor?.policy.portal ? { portal: { appId: executor.policy.app, alias: executor.policy.portal.alias } } : {}),
             ...(metadata.entry ? { entry: metadata.entry } : {}),
-            ...(standalone ? { uninstallCleanup: uninstallCleanup(info.package, { executor: hasExecutor, portal: Boolean(portal) }) } : {}),
+            ...(standalone ? { uninstallCleanup: uninstallCleanup(info.package, { executor: hasExecutor, portal: Boolean(portal), portalEntry: Boolean(executor?.policy.portal) }) } : {}),
             package: info.package,
             version: info.version,
             arch: info.arch,
@@ -467,10 +481,10 @@ function checkScripts(dir, findings) {
 const DATA_KEYS = ["pkgwizard_remove_additional", "delete_app_data"];
 const DELETE_COMMAND = /\brm\s+-[a-zA-Z]*[rR]|\bfind\b[^\n]*(-delete|-exec\s+rm)/;
 const UPGRADE_GUARD = /SYNOPKG_PKG_STATUS[^\n]*!=\s*"?UPGRADE"?/;
-function uninstallBoxes(file) {
+function uninstallBoxes(file, keys) {
     try {
         const steps = JSON.parse(readFileSync(file, "utf8"));
-        return steps.flatMap(step => step.items ?? []).flatMap(item => item.subitems ?? []).filter(box => DATA_KEYS.includes(box.key));
+        return steps.flatMap(step => step.items ?? []).flatMap(item => item.subitems ?? []).filter(box => keys.includes(box.key));
     }
     catch {
         return [];
@@ -482,6 +496,13 @@ function uninstallBoxes(file) {
  * package's own `/volumeN/@app*` directories; the wizard and the script must
  * agree on the box that asks for it.
  */
+/** The wizard texts of the App's uninstall hook, as build rendered them. */
+function uninstallWizardOptions(hook) {
+    if (!hook)
+        return {};
+    const { uninstall, catalogs } = hook;
+    return { rootPurge: Boolean(uninstall.purge.root), ...(uninstall.state ? { state: { items: (locale) => stateItemTexts(uninstall, catalogs, locale) } } : {}) };
+}
 function checkUninstall(dir, findings) {
     const script = join(dir, "scripts", "postuninst");
     if (!existsSync(script))
@@ -489,7 +510,8 @@ function checkUninstall(dir, findings) {
     const body = readFileSync(script, "utf8");
     const wizardDir = join(dir, "WIZARD_UIFILES");
     const wizards = existsSync(wizardDir) ? readdirSync(wizardDir).filter(name => name === "uninstall_uifile" || name.startsWith("uninstall_uifile_")).sort() : [];
-    const boxes = wizards.flatMap(name => uninstallBoxes(join(wizardDir, name)).map(box => ({ ...box, name })));
+    const boxes = wizards.flatMap(name => uninstallBoxes(join(wizardDir, name), DATA_KEYS).map(box => ({ ...box, name })));
+    checkStateBoxes(dir, wizards.flatMap(name => uninstallBoxes(join(wizardDir, name), [DELETE_STATE_KEY]).map(box => ({ ...box, name }))), findings);
     const deletes = DELETE_COMMAND.test(body);
     if (deletes) {
         if (!UPGRADE_GUARD.test(body))
@@ -510,6 +532,17 @@ function checkUninstall(dir, findings) {
             findings.push(`UNINSTALL_WIZARD_NOT_HONOURED WIZARD_UIFILES/${box.name} 提供 ${box.key} 勾選框，但 scripts/postuninst 沒有讀它`);
     }
 }
+/** The App's delete-state box keeps the state by default, and preuninst hands its answer to the App hook. */
+function checkStateBoxes(dir, boxes, findings) {
+    const script = join(dir, "scripts", "preuninst");
+    const body = existsSync(script) ? readFileSync(script, "utf8") : "";
+    for (const box of boxes) {
+        if (box.defaultValue !== false)
+            findings.push(`UNINSTALL_STATE_DEFAULT_CHECKED WIZARD_UIFILES/${box.name} 的 ${box.key} 預設必須不勾（保留 App 狀態）`);
+        if (!body.includes(box.key))
+            findings.push(`UNINSTALL_STATE_NOT_HONOURED WIZARD_UIFILES/${box.name} 提供 ${box.key} 勾選框，但 scripts/preuninst 沒有讀它`);
+    }
+}
 export async function listPayload(packageTgz, findings) {
     if (!existsSync(packageTgz)) {
         findings.push("缺少 package.tgz");

package/dist/standalone/lifecycle.js

@@ -4,6 +4,8 @@ import { renderSharedFolderScript } from "./shared-folder.js";
 import { renderDelegateInstallDraft } from '../build-spk/delegate-scope.js';
 import { renderPortalLifecycle } from "../portal/package.js";
 import { nativePortal } from "./portal.js";
+import { renderUninstallHook } from "./uninstall-hook.js";
+const UNINSTALL_ONLY = '[ "${SYNOPKG_PKG_STATUS:-}" = UPGRADE ] || synopkgland_uninstall_hook\n';
 /** Package-account lifecycle hooks for CGI, daemon and background packages. */
 export function renderStandaloneScript(name, manifest) {
     const portal = nativePortal(manifest);
@@ -43,12 +45,16 @@ function renderStandaloneScriptBody(name, manifest) {
             const stopDaemon = manifest.daemon ? `"/var/packages/${manifest.package}/target/daemon/control" stop "\${SYNOPKG_PKGDEST:-/var/packages/${manifest.package}/target}" "\${SYNOPKG_PKGVAR:-/var/packages/${manifest.package}/var}" || exit $?\n` : "";
             return normal.replace("#!/bin/sh\n", `#!/bin/sh\n${workerStop}if [ "$1" = start ]; then\n${request("start")}fi\nif [ "$1" = stop ]; then\n${stopWorker}${stopDaemon}${request("stop")}${workerResult}fi\n`);
         }
-        const action = name === "preuninst" ? '"$action"' : "stop";
-        const choose = name === "preuninst" ? 'action=purge\n[ "${SYNOPKG_PKG_STATUS:-}" != UPGRADE ] || action=stop\n' : "";
-        return `#!/bin/sh\n${workerStop}${stopWorker}${choose}${request(action)}${manifest.daemon ? renderDaemonScript(name, manifest).replace("#!/bin/sh\n", "") : workerResult}`;
+        if (name === "preuninst")
+            return renderExecutorPreuninst(manifest, workerStop, stopWorker, workerResult, request);
+        return `#!/bin/sh\n${workerStop}${stopWorker}${request("stop")}${manifest.daemon ? renderDaemonScript(name, manifest).replace("#!/bin/sh\n", "") : workerResult}`;
     }
     if (name === "postuninst")
         return renderPackagePostuninst(manifest.package);
+    if (name === "preuninst" && manifest.uninstall) {
+        const body = manifest.daemon ? renderDaemonPreuninst(manifest) : `${UNINSTALL_ONLY}exit 0\n`;
+        return `#!/bin/sh\n${renderUninstallHook(manifest)}${body}`;
+    }
     if ((manifest.capabilities?.rootOps || manifest.capabilities?.delegate) && ["postinst", "postupgrade"].includes(name)) {
         const normal = renderCapabilityScript(name, { ...manifest, capabilities: { ...manifest.capabilities, rootOps: undefined, delegate: undefined } });
         return normal.replace("#!/bin/sh\n", `#!/bin/sh\n"\${SYNOPKG_PKGDEST:-/var/packages/${manifest.package}/target}/executor/lifecycle" start --package ${manifest.package} || exit $?\n`);
@@ -84,7 +90,11 @@ function renderDelegatedDaemonScript(name, manifest) {
     if (name !== 'start-stop-status') {
         if (name === 'preupgrade')
             return `#!/bin/sh\n${workerStop}${stop('stop', 'stop')}`;
-        return `#!/bin/sh\n${workerStop}if [ "\${SYNOPKG_PKG_STATUS:-}" = UPGRADE ]; then\n${stop('stop', 'stop')}fi\n${stop(manifest.daemon?.uninstall_args ? 'uninstall' : 'stop', 'purge')}`;
+        const purge = manifest.uninstall
+            ? stop(manifest.daemon?.uninstall_args ? 'uninstall' : 'stop', 'purge $synopkgland_purge_args')
+                .replace(executor('purge $synopkgland_purge_args'), () => `synopkgland_uninstall_hook\n${executor('purge $synopkgland_purge_args')}`)
+            : stop(manifest.daemon?.uninstall_args ? 'uninstall' : 'stop', 'purge');
+        return `#!/bin/sh\n${workerStop}${renderUninstallHook(manifest)}if [ "\${SYNOPKG_PKG_STATUS:-}" = UPGRADE ]; then\n${stop('stop', 'stop')}fi\n${purge}`;
     }
     return `#!/bin/sh
 ${workerStop}${renderUserManagerRecovery()}${renderBackgroundWorkerStart(pkg)}case "$1" in
@@ -143,3 +153,27 @@ case "$1" in
 esac
 `;
 }
+/**
+ * A real uninstall stops the daemon, runs the App hook, then asks the
+ * executor to purge; an upgrade only stops both.
+ */
+function renderExecutorPreuninst(manifest, workerStop, stopWorker, workerResult, request) {
+    const pkg = manifest.package;
+    const choose = 'action=purge\n[ "${SYNOPKG_PKG_STATUS:-}" != UPGRADE ] || action=stop\n';
+    const hook = manifest.uninstall ? '[ "$action" = stop ] || synopkgland_uninstall_hook\n' : "";
+    const purge = request(manifest.uninstall ? '"$action" $synopkgland_purge_args' : '"$action"');
+    if (!manifest.daemon)
+        return `#!/bin/sh\n${workerStop}${renderUninstallHook(manifest)}${stopWorker}${choose}${hook}${purge}${workerResult}`;
+    const control = `"/var/packages/${pkg}/target/daemon/control"`;
+    const paths = `"\${SYNOPKG_PKGDEST:-/var/packages/${pkg}/target}" "\${SYNOPKG_PKGVAR:-/var/packages/${pkg}/var}"`;
+    const daemonAction = manifest.daemon.uninstall_args ? 'daemon_action=stop\n[ "$action" = stop ] || daemon_action=uninstall\n' : "daemon_action=stop\n";
+    return `#!/bin/sh\n${workerStop}${renderUninstallHook(manifest)}${stopWorker}${choose}${daemonAction}daemon_result=0\n${control} "$daemon_action" ${paths} || daemon_result=$?\n${hook}${purge}exit "$daemon_result"\n`;
+}
+/** The daemon stops (or uninstalls) first; the App hook follows on a real uninstall. */
+function renderDaemonPreuninst(manifest) {
+    const pkg = manifest.package;
+    const control = `"/var/packages/${pkg}/target/daemon/control"`;
+    const paths = `"\${SYNOPKG_PKGDEST:-/var/packages/${pkg}/target}" "\${SYNOPKG_PKGVAR:-/var/packages/${pkg}/var}"`;
+    return `if [ "\${SYNOPKG_PKG_STATUS:-}" = UPGRADE ]; then\n  exec ${control} stop ${paths}\nfi\n`
+        + `${control} ${manifest.daemon?.uninstall_args ? "uninstall" : "stop"} ${paths}\ndaemon_result=$?\nsynopkgland_uninstall_hook\nexit "$daemon_result"\n`;
+}

package/dist/standalone/manifest.d.ts

@@ -6,10 +6,12 @@ import { type Catalogs, type InfoTranslations } from "./i18n.js";
 export type { InfoText } from "./i18n.js";
 import { type RootOp } from "./root-ops.js";
 import { type Daemon } from "./daemon.js";
+import { type Uninstall } from "./uninstall.js";
 import { type Background } from "./background.js";
 import { type SharedFolder } from "./shared-folder.js";
 import { type ApiPermissions } from "./api-permissions.js";
 import { type PortalDeclaration } from "../portal/alias.js";
+import { type SdkBackend } from "../runtime/sdk-source.js";
 /**
  * `dsm-package.yaml`: a Standalone Package, i.e. an unsigned native SPK that
  * runs as its own DSM package account with a CGI backend and a DSM window UI.
@@ -19,6 +21,12 @@ export type StandaloneBackend = {
     kind: "go";
     dir: string;
     main: string;
+} | {
+    kind: "rust";
+    dir: string;
+    package: string;
+    bin: string;
+    worker: string;
 } | {
     kind: "binary";
     files: Partial<Record<NativeArchFamily, string>>;
@@ -63,6 +71,8 @@ export interface StandaloneManifest {
         tasks: ExecutorTask[];
     };
     daemon?: Daemon;
+    /** `uninstall`: the App's own purge hook and the state the wizard may delete. */
+    uninstall?: Uninstall;
     /** `install.sharedFolder`: the Shared Folder the install wizard selects or `data-share` creates. */
     sharedFolder?: SharedFolder;
     /** Who may use the app at all; absent keeps the route policy alone. */
@@ -97,6 +107,8 @@ export type ManifestResult = {
 };
 export declare const KNOWN_FIELDS: Set<string>;
 export declare function loadStandaloneManifest(root: string): ManifestResult;
+/** Where an App's SDK version is declared: its Go or Rust backend; a prebuilt binary declares it in the project's go.mod. */
+export declare function sdkBackend(m: Pick<StandaloneManifest, "backend" | "root">): SdkBackend;
 /**
  * The nearest directory at or above `start` that holds dsm-package.yaml,
  * unless a Managed Profile project (synology-app.yaml) is found first.