@synopackageland/cli 0.9.4 → 0.9.6

package/dist/standalone/portal-window.js

@@ -4,17 +4,22 @@ export const PORTAL_MESSAGES = {
     title: { en: "Application Portal", "zh-TW": "應用程式入口", "zh-CN": "应用程序门户", ja: "アプリケーションポータル", ko: "응용 프로그램 포털", de: "Anwendungsportal", fr: "Portail d'application", es: "Portal de aplicaciones", it: "Portale applicazioni" },
     link: { en: "Direct link after DSM sign-in:", "zh-TW": "DSM 登入後的直接連結：", "zh-CN": "DSM 登录后的直接链接：", ja: "DSM サインイン後の直接リンク：", ko: "DSM 로그인 후 바로 가기 링크:", de: "Direkter Link nach der DSM-Anmeldung:", fr: "Lien direct après connexion à DSM :", es: "Enlace directo tras iniciar sesión en DSM:", it: "Link diretto dopo l'accesso a DSM:" },
     inactive: { en: "Not active. Apply an alias to let users open this app directly after DSM sign-in.", "zh-TW": "尚未啟用。套用別名後，使用者可在 DSM 登入後直接開啟這個 App。", "zh-CN": "尚未启用。应用别名后，用户可在 DSM 登录后直接打开此应用。", ja: "無効です。エイリアスを適用すると、DSM サインイン後にこのアプリを直接開けます。", ko: "비활성 상태입니다. 별칭을 적용하면 DSM 로그인 후 이 앱을 바로 열 수 있습니다.", de: "Nicht aktiv. Wenden Sie einen Alias an, damit Benutzer diese App nach der DSM-Anmeldung direkt öffnen können.", fr: "Inactif. Appliquez un alias pour ouvrir cette application directement après connexion à DSM.", es: "Inactivo. Aplique un alias para abrir esta aplicación directamente tras iniciar sesión en DSM.", it: "Non attivo. Applica un alias per aprire questa app direttamente dopo l'accesso a DSM." },
-    askAdmin: { en: "Ask an administrator to set this up", "zh-TW": "請管理員設定", "zh-CN": "请管理员设置", ja: "管理者に設定を依頼してください", ko: "관리자에게 설정을 요청하세요", de: "Bitten Sie einen Administrator, dies einzurichten", fr: "Demandez à un administrateur de le configurer", es: "Pida a un administrador que lo configure", it: "Chiedi a un amministratore di configurarlo" },
+    askAdmin: { en: "Ask an administrator to set this up", "zh-TW": "請管理員設定", "zh-CN": "请管理员设置", ja: "管理者に設定を依頼してください", ko: "관리자에게 설정을 요청하십시오", de: "Bitten Sie einen Administrator, dies einzurichten", fr: "Demandez à un administrateur de le configurer", es: "Pida a un administrador que lo configure", it: "Chiedi a un amministratore di configurarlo" },
     alias: { en: "Alias", "zh-TW": "別名", "zh-CN": "别名", ja: "エイリアス", ko: "별칭", de: "Alias", fr: "Alias", es: "Alias", it: "Alias" },
     apply: { en: "Apply", "zh-TW": "套用", "zh-CN": "应用", ja: "適用", ko: "적용", de: "Übernehmen", fr: "Appliquer", es: "Aplicar", it: "Applica" },
     disable: { en: "Turn off", "zh-TW": "停用", "zh-CN": "停用", ja: "無効にする", ko: "끄기", de: "Ausschalten", fr: "Désactiver", es: "Desactivar", it: "Disattiva" },
     advanced: { en: "Advanced settings in Control Panel", "zh-TW": "在控制台進行進階設定", "zh-CN": "在控制面板中进行高级设置", ja: "コントロールパネルの詳細設定", ko: "제어판의 고급 설정", de: "Erweiterte Einstellungen in der Systemsteuerung", fr: "Paramètres avancés dans le Panneau de configuration", es: "Ajustes avanzados en el Panel de control", it: "Impostazioni avanzate nel Pannello di controllo" },
     controlPanel: { en: "Open Control Panel Application Portal", "zh-TW": "開啟控制台 Application Portal", "zh-CN": "打开控制面板 Application Portal", ja: "コントロールパネルの Application Portal を開く", ko: "제어판 Application Portal 열기", de: "Application Portal in der Systemsteuerung öffnen", fr: "Ouvrir Application Portal dans le Panneau de configuration", es: "Abrir Application Portal en el Panel de control", it: "Apri Application Portal nel Pannello di controllo" },
-    portal_alias_invalid: { en: "Use 1-64 lowercase letters, digits or hyphens, not starting or ending with a hyphen.", "zh-TW": "請使用 1–64 個小寫英文字母、數字或連字號，且不可以連字號開頭或結尾。", "zh-CN": "请使用 1–64 个小写英文字母、数字或连字符，且不能以连字符开头或结尾。", ja: "1～64 文字の小文字英字・数字・ハイフンを使用し、先頭と末尾にハイフンは使えません。", ko: "1~64자의 영문 소문자, 숫자 또는 하이픈을 사용하고 하이픈으로 시작하거나 끝나지 않게 하세요.", de: "Verwenden Sie 1–64 Kleinbuchstaben, Ziffern oder Bindestriche, ohne Bindestrich am Anfang oder Ende.", fr: "Utilisez 1 à 64 lettres minuscules, chiffres ou tirets, sans tiret au début ni à la fin.", es: "Use de 1 a 64 letras minúsculas, dígitos o guiones, sin guion al principio ni al final.", it: "Usa da 1 a 64 lettere minuscole, cifre o trattini, senza trattino all'inizio o alla fine." },
-    portal_alias_reserved: { en: "DSM already uses this alias. Choose another one.", "zh-TW": "DSM 已使用這個別名，請改用其他別名。", "zh-CN": "DSM 已使用此别名，请改用其他别名。", ja: "このエイリアスは DSM で使用されています。別のものを選んでください。", ko: "DSM에서 이미 사용하는 별칭입니다. 다른 별칭을 선택하세요.", de: "DSM verwendet diesen Alias bereits. Wählen Sie einen anderen.", fr: "DSM utilise déjà cet alias. Choisissez-en un autre.", es: "DSM ya usa este alias. Elija otro.", it: "DSM usa già questo alias. Scegline un altro." },
-    portal_alias_in_use: { en: "Another app already uses this alias. Choose another one.", "zh-TW": "另一個 App 已使用這個別名，請改用其他別名。", "zh-CN": "另一个应用已使用此别名，请改用其他别名。", ja: "別のアプリがこのエイリアスを使用しています。別のものを選んでください。", ko: "다른 앱이 이미 이 별칭을 사용합니다. 다른 별칭을 선택하세요.", de: "Eine andere App verwendet diesen Alias bereits. Wählen Sie einen anderen.", fr: "Une autre application utilise déjà cet alias. Choisissez-en un autre.", es: "Otra aplicación ya usa este alias. Elija otro.", it: "Un'altra app usa già questo alias. Scegline un altro." },
+    entryOff: { en: "This app has no Application Portal entry yet. Enable the entry so that an alias can open it after DSM sign-in.", "zh-TW": "這個 App 尚未加入應用程式入口。啟用入口後，即可用別名在 DSM 登入後直接開啟。", "zh-CN": "此应用尚未加入应用程序门户。启用入口后，即可用别名在 DSM 登录后直接打开。", ja: "このアプリはまだアプリケーションポータルに登録されていません。エントリを有効にすると、DSM サインイン後にエイリアスで直接開けます。", ko: "이 앱은 아직 응용 프로그램 포털에 등록되지 않았습니다. 항목을 활성화하면 DSM 로그인 후 별칭으로 바로 열 수 있습니다.", de: "Diese App hat noch keinen Eintrag im Anwendungsportal. Aktivieren Sie den Eintrag, damit ein Alias sie nach der DSM-Anmeldung öffnet.", fr: "Cette application n'a pas encore d'entrée dans le Portail d'application. Activez l'entrée pour qu'un alias l'ouvre après connexion à DSM.", es: "Esta aplicación aún no tiene una entrada en el Portal de aplicaciones. Active la entrada para que un alias la abra tras iniciar sesión en DSM.", it: "Questa app non ha ancora una voce nel Portale applicazioni. Attivare la voce per aprirla con un alias dopo l'accesso a DSM." },
+    cleanupRequired: { en: "The Application Portal entry was not fully removed. Remove the entry again.", "zh-TW": "應用程式入口未完全移除。請再移除一次入口。", "zh-CN": "应用程序门户入口未完全移除。请再移除一次入口。", ja: "アプリケーションポータルのエントリが完全に削除されていません。もう一度エントリを削除してください。", ko: "응용 프로그램 포털 항목이 완전히 제거되지 않았습니다. 항목을 다시 제거하십시오.", de: "Der Eintrag im Anwendungsportal wurde nicht vollständig entfernt. Entfernen Sie den Eintrag erneut.", fr: "L'entrée du Portail d'application n'a pas été entièrement supprimée. Supprimez de nouveau l'entrée.", es: "La entrada del Portal de aplicaciones no se eliminó por completo. Elimine la entrada de nuevo.", it: "La voce del Portale applicazioni non è stata rimossa completamente. Rimuovere di nuovo la voce." },
+    register: { en: "Enable entry", "zh-TW": "啟用入口", "zh-CN": "启用入口", ja: "エントリを有効にする", ko: "항목 활성화", de: "Eintrag aktivieren", fr: "Activer l'entrée", es: "Activar entrada", it: "Attiva voce" },
+    unregister: { en: "Remove entry", "zh-TW": "移除入口", "zh-CN": "移除入口", ja: "エントリを削除", ko: "항목 제거", de: "Eintrag entfernen", fr: "Supprimer l'entrée", es: "Eliminar entrada", it: "Rimuovi voce" },
+    portal_alias_invalid: { en: "Use 1-64 lowercase letters, digits or hyphens, not starting or ending with a hyphen.", "zh-TW": "請使用 1–64 個小寫英文字母、數字或連字號，且不可以連字號開頭或結尾。", "zh-CN": "请使用 1–64 个小写英文字母、数字或连字符，且不能以连字符开头或结尾。", ja: "1～64 文字の小文字英字・数字・ハイフンを使用し、先頭と末尾にハイフンは使えません。", ko: "1~64자의 영문 소문자, 숫자 또는 하이픈을 사용하고 하이픈으로 시작하거나 끝나지 않게 하십시오.", de: "Verwenden Sie 1–64 Kleinbuchstaben, Ziffern oder Bindestriche, ohne Bindestrich am Anfang oder Ende.", fr: "Utilisez 1 à 64 lettres minuscules, chiffres ou tirets, sans tiret au début ni à la fin.", es: "Use de 1 a 64 letras minúsculas, dígitos o guiones, sin guion al principio ni al final.", it: "Usa da 1 a 64 lettere minuscole, cifre o trattini, senza trattino all'inizio o alla fine." },
+    portal_alias_reserved: { en: "DSM already uses this alias. Choose another one.", "zh-TW": "DSM 已使用這個別名，請改用其他別名。", "zh-CN": "DSM 已使用此别名，请改用其他别名。", ja: "このエイリアスは DSM で使用されています。別のものを選んでください。", ko: "DSM에서 이미 사용하는 별칭입니다. 다른 별칭을 선택하십시오.", de: "DSM verwendet diesen Alias bereits. Wählen Sie einen anderen.", fr: "DSM utilise déjà cet alias. Choisissez-en un autre.", es: "DSM ya usa este alias. Elija otro.", it: "DSM usa già questo alias. Scegline un altro." },
+    portal_alias_in_use: { en: "Another app already uses this alias. Choose another one.", "zh-TW": "另一個 App 已使用這個別名，請改用其他別名。", "zh-CN": "另一个应用已使用此别名，请改用其他别名。", ja: "別のアプリがこのエイリアスを使用しています。別のものを選んでください。", ko: "다른 앱이 이미 이 별칭을 사용합니다. 다른 별칭을 선택하십시오.", de: "Eine andere App verwendet diesen Alias bereits. Wählen Sie einen anderen.", fr: "Une autre application utilise déjà cet alias. Choisissez-en un autre.", es: "Otra aplicación ya usa este alias. Elija otro.", it: "Un'altra app usa già questo alias. Scegline un altro." },
     admin_required: { en: "Only a DSM administrator can change this.", "zh-TW": "只有 DSM 管理員可以變更這項設定。", "zh-CN": "只有 DSM 管理员可以更改此设置。", ja: "これを変更できるのは DSM 管理者のみです。", ko: "DSM 관리자만 변경할 수 있습니다.", de: "Nur ein DSM-Administrator kann dies ändern.", fr: "Seul un administrateur DSM peut modifier ce paramètre.", es: "Solo un administrador de DSM puede cambiar esto.", it: "Solo un amministratore DSM può modificarlo." },
-    portal_unavailable: { en: "DSM did not accept the change. Try again or use Control Panel.", "zh-TW": "DSM 未接受變更。請再試一次或改用控制台。", "zh-CN": "DSM 未接受更改。请重试或改用控制面板。", ja: "DSM は変更を受け付けませんでした。再試行するか、コントロールパネルを使用してください。", ko: "DSM이 변경을 받아들이지 않았습니다. 다시 시도하거나 제어판을 사용하세요.", de: "DSM hat die Änderung nicht übernommen. Versuchen Sie es erneut oder verwenden Sie die Systemsteuerung.", fr: "DSM n'a pas accepté la modification. Réessayez ou utilisez le Panneau de configuration.", es: "DSM no aceptó el cambio. Inténtelo de nuevo o use el Panel de control.", it: "DSM non ha accettato la modifica. Riprova o usa il Pannello di controllo." },
+    portal_unavailable: { en: "DSM did not accept the change. Try again or use Control Panel.", "zh-TW": "DSM 未接受變更。請再試一次或改用控制台。", "zh-CN": "DSM 未接受更改。请重试或改用控制面板。", ja: "DSM は変更を受け付けませんでした。再試行するか、コントロールパネルを使用してください。", ko: "DSM이 변경을 받아들이지 않았습니다. 다시 시도하거나 제어판을 사용하십시오.", de: "DSM hat die Änderung nicht übernommen. Versuchen Sie es erneut oder verwenden Sie die Systemsteuerung.", fr: "DSM n'a pas accepté la modification. Réessayez ou utilisez le Panneau de configuration.", es: "DSM no aceptó el cambio. Inténtelo de nuevo o use el Panel de control.", it: "DSM non ha accettato la modifica. Riprova o usa il Pannello di controllo." },
+    PORTAL_FAILED: { en: "DSM did not accept the Application Portal change. Try again.", "zh-TW": "DSM 未接受應用程式入口的變更。請再試一次。", "zh-CN": "DSM 未接受应用程序门户的更改。请重试。", ja: "DSM はアプリケーションポータルの変更を受け付けませんでした。再試行してください。", ko: "DSM이 응용 프로그램 포털 변경을 받아들이지 않았습니다. 다시 시도하십시오.", de: "DSM hat die Änderung am Anwendungsportal nicht übernommen. Versuchen Sie es erneut.", fr: "DSM n'a pas accepté la modification du Portail d'application. Réessayez.", es: "DSM no aceptó el cambio en el Portal de aplicaciones. Inténtelo de nuevo.", it: "DSM non ha accettato la modifica al Portale applicazioni. Riprovare." },
 };
 function localizedMessages() {
     const out = {};
@@ -35,8 +40,10 @@ function localizedMessages() {
  * Control Panel shortcut.
  *
  * `status()` resolves `{state, alias?, url?, canManage, controlPanel,
- * defaultAlias}`; `apply(alias)` and `disable()` resolve the new status or
- * reject `{code}`; `openControlPanel()` opens Login Portal > Applications.
+ * defaultAlias, entry?}`; `apply(alias)` and `disable()` resolve the new
+ * status or reject `{code}`. With `options.entry` (below DSM 7.2) the
+ * backend's `portal.status` also reports the executor's entry, and
+ * administrators get `register()` and `unregister()`; `openControlPanel()` opens Login Portal > Applications.
  * `messages` is the panel text in the window's locale; `mountPanel(element)`
  * renders a plain panel for UIs without their own.
  */
@@ -46,6 +53,7 @@ export const PORTAL_RUNTIME = `function createPortalAccess(options) {
   var LINKABLE = /^[A-Za-z0-9][A-Za-z0-9_-]{0,63}$/;
   var CATALOGS = ${JSON.stringify(localizedMessages())};
   var messages = CATALOGS[options.locale] || CATALOGS.en;
+  var ENTRIES = ["registered", "unregistered", "cleanup-required"];
   var ERRORS = { dsm_4100: "portal_alias_invalid", dsm_4102: "portal_alias_reserved", dsm_4103: "portal_alias_in_use", dsm_105: "admin_required" };
   function result(state, alias, managed) {
     var out = { state: state, canManage: managed === true, controlPanel: managed !== undefined, defaultAlias: options.defaultAlias };
@@ -55,11 +63,12 @@ export const PORTAL_RUNTIME = `function createPortalAccess(options) {
     }
     return out;
   }
+  function readBackend(data) {
+    if (data && data.state === "active" && typeof data.alias === "string" && LINKABLE.test(data.alias)) return result("active", data.alias);
+    return result(data && data.state === "inactive" ? "inactive" : "unavailable");
+  }
   function fromBackend() {
-    return options.call("portal.status", {}).then(function (data) {
-      if (data && data.state === "active" && typeof data.alias === "string" && LINKABLE.test(data.alias)) return result("active", data.alias);
-      return result(data && data.state === "inactive" ? "inactive" : "unavailable");
-    }, function () {
+    return options.call("portal.status", {}).then(readBackend, function () {
       return result("unavailable");
     });
   }
@@ -79,9 +88,33 @@ export const PORTAL_RUNTIME = `function createPortalAccess(options) {
       return result("unavailable", undefined, false);
     });
   }
+  function withEntry(out, entry) {
+    out.entry = entry;
+    return out;
+  }
+  // Below DSM 7.2 the executor registers the entry; DSM lists the App only while it is registered.
+  function fromEntry() {
+    return options.call("portal.status", {}).then(function (data) {
+      var entry = data && ENTRIES.indexOf(data.entry) >= 0 ? data.entry : "";
+      if (!options.isAdmin()) return readBackend(data);
+      if (entry === "registered") return fromDsm().then(function (out) { return withEntry(out, entry); });
+      if (!entry) return result("unavailable", undefined, false);
+      var read = readBackend(data);
+      return withEntry(result(entry === "unregistered" ? "inactive" : read.state, read.alias, true), entry);
+    }, function () {
+      return options.isAdmin() ? result("unavailable", undefined, false) : result("unavailable");
+    });
+  }
   function status() {
+    if (options.entry) return fromEntry();
     return options.isAdmin() ? fromDsm() : fromBackend();
   }
+  function change(method) {
+    if (!options.isAdmin()) return Promise.reject({ code: "admin_required" });
+    return options.call(method, {}).then(status, function (error) {
+      throw { code: error && error.code === "ADMIN_REQUIRED" ? "admin_required" : "PORTAL_FAILED" };
+    });
+  }
   function set(alias) {
     if (!options.isAdmin()) return Promise.reject({ code: "admin_required" });
     return options.send("SYNO.Core.AppPortal", "set", 2, { id: options.appId, alias: alias }).then(status, function (error) {
@@ -106,6 +139,10 @@ export const PORTAL_RUNTIME = `function createPortalAccess(options) {
       return mountPanel(element);
     }
   };
+  if (options.entry) {
+    access.register = function () { return change("portal.register"); };
+    access.unregister = function () { return change("portal.unregister"); };
+  }
   function node(tag, attrs, children) {
     var out = document.createElement(tag);
     for (var key in attrs) {
@@ -129,7 +166,11 @@ export const PORTAL_RUNTIME = `function createPortalAccess(options) {
       if (current.state === "active") {
         parts.push(node("p", {}, [node("span", { text: messages.link + " " }), node("a", { href: current.url, target: "_blank", rel: "noopener", text: current.url })]));
       }
-      if (current.canManage) {
+      if (current.canManage && current.entry && current.entry !== "registered") {
+        var off = current.entry === "unregistered";
+        parts.push(node("p", { text: off ? messages.entryOff : messages.cleanupRequired }));
+        parts.push(off ? button(messages.register, function () { settle(access.register()); }) : button(messages.unregister, function () { settle(access.unregister()); }));
+      } else if (current.canManage) {
         if (current.state !== "active") parts.push(node("p", { text: messages.inactive }));
         var input = node("input", { type: "text", maxlength: "64", autocomplete: "off", "aria-label": messages.alias });
         input.value = current.alias || current.defaultAlias;
@@ -137,6 +178,7 @@ export const PORTAL_RUNTIME = `function createPortalAccess(options) {
         form.addEventListener("submit", function (event) { event.preventDefault(); settle(access.apply(input.value)); });
         if (current.state === "active") form.appendChild(button(messages.disable, function () { settle(access.disable()); }));
         parts.push(form, button(messages.advanced, access.openControlPanel));
+        if (current.entry) parts.push(button(messages.unregister, function () { settle(access.unregister()); }));
       } else if (current.controlPanel) {
         parts.push(button(messages.controlPanel, access.openControlPanel));
       } else if (current.state !== "active") {

package/dist/standalone/portal.d.ts

@@ -1,4 +1,7 @@
 import type { StandaloneManifest } from "./manifest.js";
 import type { PortalPackage } from "../portal/package.js";
-/** A native portal opens the package's own DSM window. */
+/**
+ * A native portal registered through DSM's web-config resource; it opens the
+ * package's own DSM window. Below DSM 7.2 the executor registers it instead.
+ */
 export declare function nativePortal(manifest: StandaloneManifest): PortalPackage | undefined;

package/dist/standalone/portal.js

@@ -1,4 +1,10 @@
-/** A native portal opens the package's own DSM window. */
+import { portalByExecutor } from "../build-spk/dsm-version.js";
+/**
+ * A native portal registered through DSM's web-config resource; it opens the
+ * package's own DSM window. Below DSM 7.2 the executor registers it instead.
+ */
 export function nativePortal(manifest) {
-    return manifest.portal && { appId: `SYNO.SDS.${manifest.package}.Instance`, application: manifest.displayname, alias: manifest.portal.alias };
+    if (!manifest.portal || portalByExecutor(manifest.os_min_ver))
+        return undefined;
+    return { appId: `SYNO.SDS.${manifest.package}.Instance`, application: manifest.displayname, alias: manifest.portal.alias };
 }

package/dist/standalone/root-ops.d.ts

@@ -12,4 +12,6 @@ export type RootOpsResult = {
     errors: StandaloneError[];
 };
 export declare const ROOT_OPS_DIR = "root";
+/** Shell that tries to become root: sudo, chown root or setuid/setgid modes. */
+export declare const ROOT_SCRIPT_HINTS: RegExp[];
 export declare function loadRootOps(dir: string): RootOpsResult;

package/dist/standalone/root-ops.js

@@ -1,6 +1,8 @@
 import { existsSync, lstatSync, readdirSync, readFileSync } from "node:fs";
 import { join } from "node:path";
 export const ROOT_OPS_DIR = "root";
+/** Shell that tries to become root: sudo, chown root or setuid/setgid modes. */
+export const ROOT_SCRIPT_HINTS = [/\bsudo\b/, /\bchown\s+(-\w+\s+)*root\b/, /chmod\s+[ugo]*\+s\b/, /chmod\s+[2467][0-7]{3}\b/];
 const MAX_ROOT_OP_BYTES = 16 * 1024;
 const OP_FILE = /^([a-z][a-z0-9_]{0,31})\.sh$/;
 export function loadRootOps(dir) {

package/dist/standalone/rust-build.d.ts

@@ -0,0 +1,35 @@
+import type { NativeArchFamily } from "../build-spk/dsm-arch.js";
+import type { CommandRunner } from "./build.js";
+import type { StandaloneManifest } from "./manifest.js";
+import { type Toolkit } from "./toolkit.js";
+/** The glibc loader of DSM's ARMv7 models, the one interpreter an armv7 Rust CGI may name. */
+export declare const ARMV7_INTERPRETER = "/lib/ld-linux-armhf.so.3";
+interface RustTarget {
+    triple: string;
+    /** The linker, given the extracted toolkit folder when the target pins one. */
+    linker: (toolkit: string) => string;
+    linkArgs: string[];
+    toolkit?: Toolkit;
+    interpreter?: string;
+}
+/**
+ * x86_64 and aarch64 link static musl binaries with rust-lld. armv7 links
+ * against the glibc of the DSM 7.0 toolkit, because musl's 64-bit time calls
+ * fail on DSM's ARMv7 kernels; that gcc runs on Linux x86_64 only.
+ */
+export declare const RUST_TARGETS: Record<NativeArchFamily, RustTarget>;
+/** Go's `-X` values for a Rust App, read with `option_env!`; every one is set, empty when unused. */
+export declare function rustBuildEnv(manifest: StandaloneManifest): Record<string, string>;
+export interface RustBuildDeps {
+    host?: {
+        platform: string;
+        arch: string;
+    };
+    prepareToolkit?: (cwd: string, arch: string, inputs: Toolkit[], run: CommandRunner) => Promise<string>;
+}
+/** Builds the CGI bin, and the worker bin with capabilities.jobs, in one `cargo build` into `work`. */
+export declare function buildRustBackend(manifest: StandaloneManifest, arch: NativeArchFamily, work: string, run: CommandRunner, { host, prepareToolkit: prepare }?: RustBuildDeps): Promise<{
+    cgi: string;
+    worker?: string;
+}>;
+export {};

package/dist/standalone/rust-build.js

@@ -0,0 +1,127 @@
+import { copyFileSync, rmSync } from "node:fs";
+import { homedir } from "node:os";
+import { join } from "node:path";
+import { portalByExecutor } from "../build-spk/dsm-version.js";
+import { SDK_GIT_URL } from "../runtime/sdk-source.js";
+import { checkCgiBinary } from "./binary.js";
+import { StandaloneBuildError } from "./spk.js";
+import { prepareToolkit } from "./toolkit.js";
+/** The glibc loader of DSM's ARMv7 models, the one interpreter an armv7 Rust CGI may name. */
+export const ARMV7_INTERPRETER = "/lib/ld-linux-armhf.so.3";
+const ARMV7_GCC = "usr/local/arm-unknown-linux-gnueabi/bin/arm-unknown-linux-gnueabi-gcc";
+/**
+ * x86_64 and aarch64 link static musl binaries with rust-lld. armv7 links
+ * against the glibc of the DSM 7.0 toolkit, because musl's 64-bit time calls
+ * fail on DSM's ARMv7 kernels; that gcc runs on Linux x86_64 only.
+ */
+export const RUST_TARGETS = {
+    x86_64: { triple: "x86_64-unknown-linux-musl", linker: () => "rust-lld", linkArgs: ["--build-id=none"] },
+    aarch64: { triple: "aarch64-unknown-linux-musl", linker: () => "rust-lld", linkArgs: ["--build-id=none"] },
+    armv7: {
+        triple: "armv7-unknown-linux-gnueabihf",
+        linker: (toolkit) => join(toolkit, ARMV7_GCC),
+        linkArgs: ["-Wl,--build-id=none", "-Wl,--discard-all"],
+        toolkit: {
+            url: "https://global.synologydownload.com/download/ToolChain/toolkit/7.0/alpine4k/ds.alpine4k-7.0.env.txz",
+            sha256: "767cb27541e3c2aae5a07bc1078809956992c75a54e6bfca2275fa633e983407",
+        },
+        interpreter: ARMV7_INTERPRETER,
+    },
+};
+/** Go's `-X` values for a Rust App, read with `option_env!`; every one is set, empty when unused. */
+export function rustBuildEnv(manifest) {
+    const { capabilities, executor } = manifest;
+    const delegate = capabilities.delegate;
+    return {
+        SYNOPKGLAND_PACKAGE: manifest.package,
+        SYNOPKGLAND_VERSION: manifest.spkVersion,
+        SYNOPKGLAND_PERMISSIONS_DIGEST: manifest.apiPermissionsDigest ?? "",
+        SYNOPKGLAND_SDK_PERMISSIONS_DIGEST: manifest.apiSDKPermissionsDigest ?? "",
+        SYNOPKGLAND_EXECUTOR_DIGEST: executor?.executorDigest ?? "",
+        SYNOPKGLAND_POLICY_DIGEST: executor?.policyDigest ?? "",
+        SYNOPKGLAND_DELEGATE_SCOPE: delegate?.scope ?? "",
+        SYNOPKGLAND_DELEGATE_OPERATIONS: delegate ? JSON.stringify([...delegate.operations].sort()) : "",
+        SYNOPKGLAND_DELEGATE_DESTINATIONS: delegate ? JSON.stringify(delegate.destinations ? [...delegate.destinations].sort() : []) : "",
+        SYNOPKGLAND_DELEGATE_LIFETIME: delegate?.lifetime ?? "",
+        SYNOPKGLAND_IDENTITY: capabilities.identity ?? "",
+        SYNOPKGLAND_FILE_STATION: capabilities.files || delegate ? "session" : "",
+        SYNOPKGLAND_ENTRY: manifest.entry ?? "",
+        SYNOPKGLAND_PORTAL: manifest.portal ? (portalByExecutor(manifest.os_min_ver) ? "executor" : "on") : "",
+    };
+}
+/** Builds the CGI bin, and the worker bin with capabilities.jobs, in one `cargo build` into `work`. */
+export async function buildRustBackend(manifest, arch, work, run, { host = { platform: process.platform, arch: process.arch }, prepareToolkit: prepare = prepareToolkit } = {}) {
+    const backend = manifest.backend;
+    if (backend.kind !== "rust")
+        throw new Error("buildRustBackend needs backend.kind: rust");
+    const target = RUST_TARGETS[arch];
+    if (target.toolkit && (host.platform !== "linux" || host.arch !== "x64")) {
+        fail(`${arch} links with the gcc of the DSM toolkit, which runs on Linux x86_64 only; build ${arch} on Linux x86_64 (for example in a container).`);
+    }
+    const bins = [backend.bin, ...(manifest.capabilities.jobs ? [backend.worker] : [])];
+    const toolkit = target.toolkit ? await prepare(backend.dir, arch, [target.toolkit], run).catch((error) => fail(`DSM toolkit for ${arch}: ${error.message}`)) : "";
+    try {
+        const result = await run("cargo", [
+            "build", "--release", "--locked", "--target", target.triple, "-p", backend.package,
+            ...bins.flatMap(bin => ["--bin", bin]), "--message-format=json-render-diagnostics",
+        ], { cwd: backend.dir, env: cargoEnv(manifest, backend.dir, target, toolkit), capture: true });
+        if (result.missing)
+            fail("找不到 cargo。請以 rustup 安裝 Rust（https://rustup.rs）；backend/rust-toolchain.toml 會選定版本與 target。");
+        if (result.status !== 0)
+            fail(`cargo build（${arch}）失敗。\n${result.stderr}`);
+        const [cgi, worker] = bins.map((bin, i) => {
+            const out = join(work, i === 0 ? `api-${arch}.cgi` : `background-worker-${arch}`);
+            copyFileSync(artifact(result.stdout ?? "", bin), out);
+            const problem = checkCgiBinary(work, out, arch, target.interpreter);
+            if (problem)
+                throw new StandaloneBuildError(problem.code, problem.message);
+            return out;
+        });
+        return { cgi: cgi, ...(worker ? { worker } : {}) };
+    }
+    finally {
+        if (toolkit)
+            rmSync(toolkit, { recursive: true, force: true });
+    }
+}
+/**
+ * The environment of one reproducible cargo build: the CLI's flags replace any
+ * inherited RUSTFLAGS, paths are remapped, symbols and build IDs dropped. Cargo
+ * fetches the private SDK repository through git, with the user's credentials.
+ */
+function cargoEnv(manifest, dir, target, toolkit) {
+    const env = { ...process.env, ...rustBuildEnv(manifest) };
+    delete env.RUSTFLAGS;
+    const cargoHome = env.CARGO_HOME || join(homedir(), ".cargo");
+    env.CARGO_ENCODED_RUSTFLAGS = [
+        `--remap-path-prefix=${dir}=/build`,
+        `--remap-path-prefix=${cargoHome}=/cargo`,
+        "-Cstrip=symbols",
+        ...target.linkArgs.map(arg => `-Clink-arg=${arg}`),
+    ].join("\x1f");
+    env[`CARGO_TARGET_${target.triple.toUpperCase().replaceAll("-", "_")}_LINKER`] = target.linker(toolkit);
+    env.SOURCE_DATE_EPOCH = "0";
+    env.CARGO_NET_GIT_FETCH_WITH_CLI = "true";
+    if (env.SYNOPKGLAND_SDK_DIR) {
+        // Development only: git reads the SDK repository from this checkout, which must hold the locked tag.
+        const n = Number(env.GIT_CONFIG_COUNT ?? 0);
+        env.GIT_CONFIG_COUNT = String(n + 1);
+        env[`GIT_CONFIG_KEY_${n}`] = `url.file://${env.SYNOPKGLAND_SDK_DIR}.insteadOf`;
+        env[`GIT_CONFIG_VALUE_${n}`] = SDK_GIT_URL;
+    }
+    return env;
+}
+/** The executable Cargo reported for `bin`. */
+function artifact(messages, bin) {
+    for (const line of messages.split("\n")) {
+        if (!line.startsWith("{"))
+            continue;
+        const message = JSON.parse(line);
+        if (message.reason === "compiler-artifact" && message.target?.kind?.includes("bin") && message.target.name === bin && message.executable)
+            return message.executable;
+    }
+    return fail(`cargo build 沒有產出 bin ${bin}；確認 backend/src/bin/${bin}.rs 存在。`);
+}
+function fail(message) {
+    throw new StandaloneBuildError("STANDALONE_RUST_BUILD_FAILED", message);
+}

package/dist/standalone/sdk-check.d.ts

@@ -1,9 +1,11 @@
+import { type SdkBackend } from "../runtime/sdk-source.js";
 export interface SdkProblem {
     code: string;
     message: string;
 }
 /**
- * backend/go.mod names the App's SDK version; the frontend package and this
- * CLI must agree with it. `needsSdk`: the App declares delegate or rootOps.
+ * The backend's dependency files name the App's SDK version; the frontend
+ * package and this CLI must agree with it. `needsSdk`: the App declares
+ * delegate or rootOps.
  */
-export declare function sdkProblems(backendDir: string, frontendDir: string | undefined, needsSdk: boolean, cliVersion?: string): SdkProblem[];
+export declare function sdkProblems(backend: SdkBackend, frontendDir: string | undefined, needsSdk: boolean, cliVersion?: string): SdkProblem[];

package/dist/standalone/sdk-check.js

@@ -1,24 +1,37 @@
 import { readFileSync } from "node:fs";
 import { join, resolve } from "node:path";
 import { CLI_VERSION } from "../cli-version.js";
-import { SDK_MODULE, SDK_PACKAGE, sdkRequirement } from "../runtime/sdk-source.js";
+import { appSdkVersion, SDK_DEPENDENCY, SDK_PACKAGE } from "../runtime/sdk-source.js";
 const minorLine = (version) => version.split(".").slice(0, 2).join(".");
+/** The file that names each backend kind's SDK version. */
+const SDK_VERSION_FILE = { go: "backend/go.mod", rust: "backend/Cargo.lock" };
 /**
- * backend/go.mod names the App's SDK version; the frontend package and this
- * CLI must agree with it. `needsSdk`: the App declares delegate or rootOps.
+ * The backend's dependency files name the App's SDK version; the frontend
+ * package and this CLI must agree with it. `needsSdk`: the App declares
+ * delegate or rootOps.
  */
-export function sdkProblems(backendDir, frontendDir, needsSdk, cliVersion = CLI_VERSION) {
-    const version = sdkRequirement(backendDir);
+export function sdkProblems(backend, frontendDir, needsSdk, cliVersion = CLI_VERSION) {
+    let version;
+    try {
+        version = appSdkVersion(backend);
+    }
+    catch (error) {
+        const tag = /^\[SDK_TAG_REQUIRED\] ([\s\S]*)$/.exec(error.message);
+        if (tag)
+            return [{ code: "SDK_TAG_REQUIRED", message: tag[1] }];
+        throw error;
+    }
     if (!version) {
-        return needsSdk ? [{ code: "SDK_REQUIRED", message: `capabilities.delegate 與 rootOps 需要 SDK：在 backend/go.mod 加入 require ${SDK_MODULE} v${minorLine(cliVersion)}.x。` }] : [];
+        return needsSdk ? [{ code: "SDK_REQUIRED", message: `capabilities.delegate 與 rootOps 需要 SDK（${minorLine(cliVersion)}.x）：${SDK_DEPENDENCY[backend.kind]}` }] : [];
     }
+    const file = SDK_VERSION_FILE[backend.kind];
     const problems = [];
     if (minorLine(version) !== minorLine(cliVersion)) {
-        problems.push({ code: "SDK_UNSUPPORTED", message: `backend/go.mod 要求 SDK ${version}；CLI ${cliVersion} 只支援 SDK ${minorLine(cliVersion)}.x。請改用對應的 CLI，或把 SDK 升到 ${minorLine(cliVersion)}.x。` });
+        problems.push({ code: "SDK_UNSUPPORTED", message: `${file} 要求 SDK ${version}；CLI ${cliVersion} 只支援 SDK ${minorLine(cliVersion)}.x。請改用對應的 CLI，或把 SDK 升到 ${minorLine(cliVersion)}.x。` });
     }
     const frontend = frontendDir === undefined ? undefined : frontendSdkVersion(frontendDir);
     if (frontend && frontend.version !== version) {
-        problems.push({ code: "SDK_VERSION_MISMATCH", message: `frontend/package.json 的 ${SDK_PACKAGE} 是 ${frontend.spec}（${frontend.version ?? "讀不到版本"}），backend/go.mod 要求 ${version}；兩者必須相同。` });
+        problems.push({ code: "SDK_VERSION_MISMATCH", message: `frontend/package.json 的 ${SDK_PACKAGE} 是 ${frontend.spec}（${frontend.version ?? "讀不到版本"}），${file} 要求 ${version}；兩者必須相同。` });
     }
     return problems;
 }

package/dist/standalone/spk.js

@@ -22,10 +22,12 @@ import { copyDaemonPayload } from "./daemon.js";
 import { BACKGROUND_UNIT_DIR, BACKGROUND_WORKER_PAYLOAD, backgroundUnitName, renderBackgroundUnit } from "./background.js";
 import { renderStandaloneResource } from "./resource.js";
 import { nativePortal } from "./portal.js";
+import { portalByExecutor } from "../build-spk/dsm-version.js";
 import { PORTAL_JSON_RELPATH, PORTAL_MUSTACHE_RELPATH, renderPortalJson, renderPortalMustache, renderPortalWizardStep } from "../portal/package.js";
 import { executorPlan } from "../runtime/executor-build.js";
 import { EXECUTOR_ANCHOR } from "../runtime/executor-inspect.js";
 import { renderSharedFolderUpgradeWizardFiles, sharedFolderInstallSteps } from "./shared-folder.js";
+import { stateItemTexts, uninstallExecProblem, uninstallRecord } from "./uninstall.js";
 const FILE_MODE = 0o644;
 const EXEC_MODE = 0o755;
 const MAX_UI_BYTES = 64 * 1024 * 1024;
@@ -83,7 +85,10 @@ export async function assembleStandaloneSpk(options) {
             copyFileSync(options.backgroundWorker, worker);
             chmodSync(worker, EXEC_MODE);
         }
-        copyStandaloneNotices(manifest.root, manifest.ui.dir, join(staging, 'package'), manifest.backend.kind === 'go' || Boolean(manifest.daemon), manifest.backend.kind === 'go' ? manifest.backend.dir : undefined);
+        const backend = manifest.backend;
+        // A daemon is a Go program of the project's backend directory.
+        const sdk = backend.kind !== 'binary' ? backend : manifest.daemon ? { kind: 'go', dir: join(manifest.root, 'backend') } : undefined;
+        copyStandaloneNotices(manifest.root, manifest.ui.dir, join(staging, 'package'), { go: backend.kind === 'go' || Boolean(manifest.daemon), rust: backend.kind === 'rust', sdk });
         if (manifest.daemon)
             copyFileSync(new URL('../../assets/licenses/TEMPLATE.txt', import.meta.url), join(staging, 'package', 'LICENSES', 'DAEMON-LICENSE.txt'));
         const portal = nativePortal(manifest);
@@ -103,11 +108,14 @@ export async function assembleStandaloneSpk(options) {
             for (const op of manifest.rootOps ?? [])
                 writeFile(join(staging, "package", "root", op.name + ".sh"), op.body);
         }
+        const hook = manifest.uninstall && uninstallExecProblem(join(staging, "package"), manifest.uninstall.purge);
+        if (hook)
+            throw new StandaloneBuildError(hook.code, hook.message);
         const packageTgz = join(staging, "package.tgz");
         await createReproducibleTar(join(staging, "package"), packageTgz, { gzip: true });
         rmSync(join(staging, "package"), { recursive: true, force: true });
         const checksum = createHash("md5").update(readFileSync(packageTgz)).digest("hex");
-        writeFile(join(staging, "sdk-package.json"), JSON.stringify({ schema: 2, backend: manifest.backend.kind, capabilities: Object.keys(manifest.capabilities).sort(), ...(manifest.entry ? { entry: manifest.entry } : {}) }));
+        writeFile(join(staging, "sdk-package.json"), JSON.stringify({ schema: 2, backend: manifest.backend.kind, capabilities: Object.keys(manifest.capabilities).sort(), ...(manifest.entry ? { entry: manifest.entry } : {}), ...(manifest.uninstall ? { uninstall: uninstallRecord(manifest.uninstall, manifest.i18n?.catalogs) } : {}) }));
         writeFile(join(staging, "INFO"), renderInfo(manifest, options.arch, checksum, options.executor?.executorDigest));
         mkdirSync(join(staging, "conf"));
         writeFile(join(staging, "conf", "privilege"), renderNativePrivilege());
@@ -131,7 +139,11 @@ export async function assembleStandaloneSpk(options) {
             ...install.static,
             ...install.dynamic,
             ...(folder ? renderSharedFolderUpgradeWizardFiles(manifest.package, folder) : {}),
-            ...renderUninstallWizardFiles(manifest.package, "native", { executor: Boolean(options.executor), portal: Boolean(portal) }),
+            ...renderUninstallWizardFiles(manifest.package, "native", {
+                executor: Boolean(options.executor), portal: Boolean(portal), portalEntry: Boolean(manifest.portal && portalByExecutor(manifest.os_min_ver)),
+                rootPurge: Boolean(manifest.uninstall?.purge.root),
+                ...(manifest.uninstall?.state ? { state: { items: (locale) => stateItemTexts(manifest.uninstall, manifest.i18n?.catalogs, locale) } } : {}),
+            }),
         });
         writePackageCenterIcons(staging, icons);
         mkdirSync(dirname(options.outputPath), { recursive: true });

package/dist/standalone/toolkit.d.ts

@@ -0,0 +1,10 @@
+import type { CommandRunner } from './build.js';
+export type Toolkit = {
+    url: string;
+    sha256: string;
+};
+export declare function verifyToolkitArchive(path: string, expected: string): void;
+/** One cache per user, shared by every project and worktree; archives are checked against sha256 on every use. */
+export declare function toolkitCacheDir(env: Record<string, string | undefined>, platform: string, home: string): string;
+/** Extracts the checksum-pinned toolkit archives of one architecture into a fresh folder the caller removes; '' without archives. */
+export declare function prepareToolkit(cwd: string, arch: string, inputs: Toolkit[], run: CommandRunner): Promise<string>;

package/dist/standalone/toolkit.js

@@ -0,0 +1,101 @@
+/** Checksum-pinned toolkit archives: one private download cache per user, re-extracted from verified bytes on every build. */
+import { createHash } from 'node:crypto';
+import { existsSync, lstatSync, mkdirSync, mkdtempSync, readFileSync, renameSync, rmSync } from 'node:fs';
+import { homedir } from 'node:os';
+import { isAbsolute, join, resolve } from 'node:path';
+function fail(message) { throw Object.assign(new Error(`NATIVE_LAYOUT_INVALID: ${message}`), { code: 'NATIVE_LAYOUT_INVALID' }); }
+const digest = (bytes) => createHash('sha256').update(bytes).digest('hex');
+export function verifyToolkitArchive(path, expected) {
+    if (!lstatSync(path).isFile() || digest(readFileSync(path)) !== expected)
+        fail('toolkit checksum mismatch');
+}
+/** One cache per user, shared by every project and worktree; archives are checked against sha256 on every use. */
+export function toolkitCacheDir(env, platform, home) {
+    if (env.SYNOPKGLAND_CACHE_DIR)
+        return resolve(env.SYNOPKGLAND_CACHE_DIR);
+    if (platform === 'darwin')
+        return join(home, 'Library', 'Caches', 'synopkgland');
+    const xdg = env.XDG_CACHE_HOME;
+    return join(xdg && isAbsolute(xdg) ? xdg : join(home, '.cache'), 'synopkgland');
+}
+// Concurrent architectures that pin the same archive share one download.
+const downloads = new Map();
+async function download(cwd, cache, input, archive, run) {
+    const tmp = mkdtempSync(join(cache, '.download-'));
+    try {
+        const out = join(tmp, 'archive');
+        const r = await run('curl', ['--fail', '--location', '--proto', '=https', '--proto-redir', '=https', '--retry', '2', '--retry-all-errors', '--connect-timeout', '20', '--max-time', '600', '--output', out, input.url], { cwd, env: { ...process.env } });
+        if (r.status !== 0)
+            fail('toolkit download failed');
+        // Rename is atomic, so another build process sees either no archive or a verified one.
+        verifyToolkitArchive(out, input.sha256);
+        renameSync(out, archive);
+    }
+    finally {
+        rmSync(tmp, { recursive: true, force: true });
+    }
+}
+/** Extracts the checksum-pinned toolkit archives of one architecture into a fresh folder the caller removes; '' without archives. */
+export async function prepareToolkit(cwd, arch, inputs, run) {
+    if (!inputs.length)
+        return '';
+    const cache = toolkitCacheDir(process.env, process.platform, homedir());
+    mkdirSync(cache, { recursive: true, mode: 0o700 });
+    if (lstatSync(cache).isSymbolicLink() || (lstatSync(cache).mode & 0o022))
+        fail('toolkit cache must be owned and private');
+    const archives = [];
+    for (const input of inputs) {
+        const archive = join(cache, `${input.sha256}.txz`);
+        if (!existsSync(archive)) {
+            let pending = downloads.get(archive);
+            if (!pending) {
+                pending = download(cwd, cache, input, archive, run).finally(() => downloads.delete(archive));
+                downloads.set(archive, pending);
+            }
+            await pending;
+        }
+        verifyToolkitArchive(archive, input.sha256);
+        archives.push(archive);
+    }
+    // Re-extract verified bytes: a package-writable marker never authenticates an extracted tree.
+    const stage = mkdtempSync(join(cache, `toolkit-${arch}-`));
+    try {
+        const flavor = await tarFlavor(cwd, run);
+        for (const archive of archives) {
+            if (flavor === 'bsdtar')
+                await refuseEscapingMembers(cwd, archive, run);
+            const r = await run('tar', flavor === 'gnu' ? ['-xJf', archive, '-C', stage, '--keep-directory-symlink'] : ['-xPJf', archive, '-C', stage], { cwd, env: { ...process.env } });
+            if (r.status !== 0)
+                fail('toolkit extraction failed');
+        }
+        return stage;
+    }
+    catch (e) {
+        rmSync(stage, { recursive: true, force: true });
+        throw e;
+    }
+}
+/**
+ * A later toolkit archive may write through a directory symlink an earlier one
+ * created. GNU tar keeps such a symlink only with --keep-directory-symlink;
+ * bsdtar only with -P, which also allows absolute and .. members, so those are
+ * refused from the listing first.
+ */
+async function tarFlavor(cwd, run) {
+    const r = await run('tar', ['--version'], { cwd, env: { ...process.env }, capture: true });
+    const version = r.status === 0 ? r.stdout ?? '' : '';
+    if (/\bGNU tar\b/.test(version))
+        return 'gnu';
+    if (/\bbsdtar\b/.test(version))
+        return 'bsdtar';
+    throw Object.assign(new Error(`NATIVE_TOOLKIT_TAR_UNSUPPORTED: extracting native.toolkits needs GNU tar or bsdtar as \`tar\`; found ${r.missing ? 'no tar' : JSON.stringify(version.split('\n')[0] ?? '')}`), { code: 'NATIVE_TOOLKIT_TAR_UNSUPPORTED' });
+}
+async function refuseEscapingMembers(cwd, archive, run) {
+    const r = await run('tar', ['-tJf', archive], { cwd, env: { ...process.env }, capture: true });
+    if (r.status !== 0)
+        fail('toolkit extraction failed');
+    for (const member of (r.stdout ?? '').split('\n').filter(Boolean)) {
+        if (member.startsWith('/') || member.split('/').includes('..'))
+            fail(`toolkit member escapes the toolkit folder: ${member}`);
+    }
+}

package/dist/standalone/uninstall-hook.d.ts

@@ -0,0 +1,10 @@
+import type { StandaloneManifest } from "./manifest.js";
+/** The syslog tag of a failed or timed-out App uninstall hook. */
+export declare const UNINSTALL_SYSLOG_TAG = "synopkgland-uninstall";
+/**
+ * `synopkgland_uninstall_hook`: runs `uninstall.purge` as the package account
+ * with a fixed environment and the wizard's two answers, within its timeout.
+ * A failure is logged and never blocks the uninstall. It sets
+ * `synopkgland_purge_args` for the executor purge request.
+ */
+export declare function renderUninstallHook(manifest: StandaloneManifest): string;