@synopackageland/cli 0.9.5 → 0.9.6

package/dist/standalone/rust-build.js

@@ -0,0 +1,127 @@
+import { copyFileSync, rmSync } from "node:fs";
+import { homedir } from "node:os";
+import { join } from "node:path";
+import { portalByExecutor } from "../build-spk/dsm-version.js";
+import { SDK_GIT_URL } from "../runtime/sdk-source.js";
+import { checkCgiBinary } from "./binary.js";
+import { StandaloneBuildError } from "./spk.js";
+import { prepareToolkit } from "./toolkit.js";
+/** The glibc loader of DSM's ARMv7 models, the one interpreter an armv7 Rust CGI may name. */
+export const ARMV7_INTERPRETER = "/lib/ld-linux-armhf.so.3";
+const ARMV7_GCC = "usr/local/arm-unknown-linux-gnueabi/bin/arm-unknown-linux-gnueabi-gcc";
+/**
+ * x86_64 and aarch64 link static musl binaries with rust-lld. armv7 links
+ * against the glibc of the DSM 7.0 toolkit, because musl's 64-bit time calls
+ * fail on DSM's ARMv7 kernels; that gcc runs on Linux x86_64 only.
+ */
+export const RUST_TARGETS = {
+    x86_64: { triple: "x86_64-unknown-linux-musl", linker: () => "rust-lld", linkArgs: ["--build-id=none"] },
+    aarch64: { triple: "aarch64-unknown-linux-musl", linker: () => "rust-lld", linkArgs: ["--build-id=none"] },
+    armv7: {
+        triple: "armv7-unknown-linux-gnueabihf",
+        linker: (toolkit) => join(toolkit, ARMV7_GCC),
+        linkArgs: ["-Wl,--build-id=none", "-Wl,--discard-all"],
+        toolkit: {
+            url: "https://global.synologydownload.com/download/ToolChain/toolkit/7.0/alpine4k/ds.alpine4k-7.0.env.txz",
+            sha256: "767cb27541e3c2aae5a07bc1078809956992c75a54e6bfca2275fa633e983407",
+        },
+        interpreter: ARMV7_INTERPRETER,
+    },
+};
+/** Go's `-X` values for a Rust App, read with `option_env!`; every one is set, empty when unused. */
+export function rustBuildEnv(manifest) {
+    const { capabilities, executor } = manifest;
+    const delegate = capabilities.delegate;
+    return {
+        SYNOPKGLAND_PACKAGE: manifest.package,
+        SYNOPKGLAND_VERSION: manifest.spkVersion,
+        SYNOPKGLAND_PERMISSIONS_DIGEST: manifest.apiPermissionsDigest ?? "",
+        SYNOPKGLAND_SDK_PERMISSIONS_DIGEST: manifest.apiSDKPermissionsDigest ?? "",
+        SYNOPKGLAND_EXECUTOR_DIGEST: executor?.executorDigest ?? "",
+        SYNOPKGLAND_POLICY_DIGEST: executor?.policyDigest ?? "",
+        SYNOPKGLAND_DELEGATE_SCOPE: delegate?.scope ?? "",
+        SYNOPKGLAND_DELEGATE_OPERATIONS: delegate ? JSON.stringify([...delegate.operations].sort()) : "",
+        SYNOPKGLAND_DELEGATE_DESTINATIONS: delegate ? JSON.stringify(delegate.destinations ? [...delegate.destinations].sort() : []) : "",
+        SYNOPKGLAND_DELEGATE_LIFETIME: delegate?.lifetime ?? "",
+        SYNOPKGLAND_IDENTITY: capabilities.identity ?? "",
+        SYNOPKGLAND_FILE_STATION: capabilities.files || delegate ? "session" : "",
+        SYNOPKGLAND_ENTRY: manifest.entry ?? "",
+        SYNOPKGLAND_PORTAL: manifest.portal ? (portalByExecutor(manifest.os_min_ver) ? "executor" : "on") : "",
+    };
+}
+/** Builds the CGI bin, and the worker bin with capabilities.jobs, in one `cargo build` into `work`. */
+export async function buildRustBackend(manifest, arch, work, run, { host = { platform: process.platform, arch: process.arch }, prepareToolkit: prepare = prepareToolkit } = {}) {
+    const backend = manifest.backend;
+    if (backend.kind !== "rust")
+        throw new Error("buildRustBackend needs backend.kind: rust");
+    const target = RUST_TARGETS[arch];
+    if (target.toolkit && (host.platform !== "linux" || host.arch !== "x64")) {
+        fail(`${arch} links with the gcc of the DSM toolkit, which runs on Linux x86_64 only; build ${arch} on Linux x86_64 (for example in a container).`);
+    }
+    const bins = [backend.bin, ...(manifest.capabilities.jobs ? [backend.worker] : [])];
+    const toolkit = target.toolkit ? await prepare(backend.dir, arch, [target.toolkit], run).catch((error) => fail(`DSM toolkit for ${arch}: ${error.message}`)) : "";
+    try {
+        const result = await run("cargo", [
+            "build", "--release", "--locked", "--target", target.triple, "-p", backend.package,
+            ...bins.flatMap(bin => ["--bin", bin]), "--message-format=json-render-diagnostics",
+        ], { cwd: backend.dir, env: cargoEnv(manifest, backend.dir, target, toolkit), capture: true });
+        if (result.missing)
+            fail("找不到 cargo。請以 rustup 安裝 Rust（https://rustup.rs）；backend/rust-toolchain.toml 會選定版本與 target。");
+        if (result.status !== 0)
+            fail(`cargo build（${arch}）失敗。\n${result.stderr}`);
+        const [cgi, worker] = bins.map((bin, i) => {
+            const out = join(work, i === 0 ? `api-${arch}.cgi` : `background-worker-${arch}`);
+            copyFileSync(artifact(result.stdout ?? "", bin), out);
+            const problem = checkCgiBinary(work, out, arch, target.interpreter);
+            if (problem)
+                throw new StandaloneBuildError(problem.code, problem.message);
+            return out;
+        });
+        return { cgi: cgi, ...(worker ? { worker } : {}) };
+    }
+    finally {
+        if (toolkit)
+            rmSync(toolkit, { recursive: true, force: true });
+    }
+}
+/**
+ * The environment of one reproducible cargo build: the CLI's flags replace any
+ * inherited RUSTFLAGS, paths are remapped, symbols and build IDs dropped. Cargo
+ * fetches the private SDK repository through git, with the user's credentials.
+ */
+function cargoEnv(manifest, dir, target, toolkit) {
+    const env = { ...process.env, ...rustBuildEnv(manifest) };
+    delete env.RUSTFLAGS;
+    const cargoHome = env.CARGO_HOME || join(homedir(), ".cargo");
+    env.CARGO_ENCODED_RUSTFLAGS = [
+        `--remap-path-prefix=${dir}=/build`,
+        `--remap-path-prefix=${cargoHome}=/cargo`,
+        "-Cstrip=symbols",
+        ...target.linkArgs.map(arg => `-Clink-arg=${arg}`),
+    ].join("\x1f");
+    env[`CARGO_TARGET_${target.triple.toUpperCase().replaceAll("-", "_")}_LINKER`] = target.linker(toolkit);
+    env.SOURCE_DATE_EPOCH = "0";
+    env.CARGO_NET_GIT_FETCH_WITH_CLI = "true";
+    if (env.SYNOPKGLAND_SDK_DIR) {
+        // Development only: git reads the SDK repository from this checkout, which must hold the locked tag.
+        const n = Number(env.GIT_CONFIG_COUNT ?? 0);
+        env.GIT_CONFIG_COUNT = String(n + 1);
+        env[`GIT_CONFIG_KEY_${n}`] = `url.file://${env.SYNOPKGLAND_SDK_DIR}.insteadOf`;
+        env[`GIT_CONFIG_VALUE_${n}`] = SDK_GIT_URL;
+    }
+    return env;
+}
+/** The executable Cargo reported for `bin`. */
+function artifact(messages, bin) {
+    for (const line of messages.split("\n")) {
+        if (!line.startsWith("{"))
+            continue;
+        const message = JSON.parse(line);
+        if (message.reason === "compiler-artifact" && message.target?.kind?.includes("bin") && message.target.name === bin && message.executable)
+            return message.executable;
+    }
+    return fail(`cargo build 沒有產出 bin ${bin}；確認 backend/src/bin/${bin}.rs 存在。`);
+}
+function fail(message) {
+    throw new StandaloneBuildError("STANDALONE_RUST_BUILD_FAILED", message);
+}

package/dist/standalone/sdk-check.d.ts

@@ -1,9 +1,11 @@
+import { type SdkBackend } from "../runtime/sdk-source.js";
 export interface SdkProblem {
     code: string;
     message: string;
 }
 /**
- * backend/go.mod names the App's SDK version; the frontend package and this
- * CLI must agree with it. `needsSdk`: the App declares delegate or rootOps.
+ * The backend's dependency files name the App's SDK version; the frontend
+ * package and this CLI must agree with it. `needsSdk`: the App declares
+ * delegate or rootOps.
  */
-export declare function sdkProblems(backendDir: string, frontendDir: string | undefined, needsSdk: boolean, cliVersion?: string): SdkProblem[];
+export declare function sdkProblems(backend: SdkBackend, frontendDir: string | undefined, needsSdk: boolean, cliVersion?: string): SdkProblem[];

package/dist/standalone/sdk-check.js

@@ -1,24 +1,37 @@
 import { readFileSync } from "node:fs";
 import { join, resolve } from "node:path";
 import { CLI_VERSION } from "../cli-version.js";
-import { SDK_MODULE, SDK_PACKAGE, sdkRequirement } from "../runtime/sdk-source.js";
+import { appSdkVersion, SDK_DEPENDENCY, SDK_PACKAGE } from "../runtime/sdk-source.js";
 const minorLine = (version) => version.split(".").slice(0, 2).join(".");
+/** The file that names each backend kind's SDK version. */
+const SDK_VERSION_FILE = { go: "backend/go.mod", rust: "backend/Cargo.lock" };
 /**
- * backend/go.mod names the App's SDK version; the frontend package and this
- * CLI must agree with it. `needsSdk`: the App declares delegate or rootOps.
+ * The backend's dependency files name the App's SDK version; the frontend
+ * package and this CLI must agree with it. `needsSdk`: the App declares
+ * delegate or rootOps.
  */
-export function sdkProblems(backendDir, frontendDir, needsSdk, cliVersion = CLI_VERSION) {
-    const version = sdkRequirement(backendDir);
+export function sdkProblems(backend, frontendDir, needsSdk, cliVersion = CLI_VERSION) {
+    let version;
+    try {
+        version = appSdkVersion(backend);
+    }
+    catch (error) {
+        const tag = /^\[SDK_TAG_REQUIRED\] ([\s\S]*)$/.exec(error.message);
+        if (tag)
+            return [{ code: "SDK_TAG_REQUIRED", message: tag[1] }];
+        throw error;
+    }
     if (!version) {
-        return needsSdk ? [{ code: "SDK_REQUIRED", message: `capabilities.delegate 與 rootOps 需要 SDK：在 backend/go.mod 加入 require ${SDK_MODULE} v${minorLine(cliVersion)}.x。` }] : [];
+        return needsSdk ? [{ code: "SDK_REQUIRED", message: `capabilities.delegate 與 rootOps 需要 SDK（${minorLine(cliVersion)}.x）：${SDK_DEPENDENCY[backend.kind]}` }] : [];
     }
+    const file = SDK_VERSION_FILE[backend.kind];
     const problems = [];
     if (minorLine(version) !== minorLine(cliVersion)) {
-        problems.push({ code: "SDK_UNSUPPORTED", message: `backend/go.mod 要求 SDK ${version}；CLI ${cliVersion} 只支援 SDK ${minorLine(cliVersion)}.x。請改用對應的 CLI，或把 SDK 升到 ${minorLine(cliVersion)}.x。` });
+        problems.push({ code: "SDK_UNSUPPORTED", message: `${file} 要求 SDK ${version}；CLI ${cliVersion} 只支援 SDK ${minorLine(cliVersion)}.x。請改用對應的 CLI，或把 SDK 升到 ${minorLine(cliVersion)}.x。` });
     }
     const frontend = frontendDir === undefined ? undefined : frontendSdkVersion(frontendDir);
     if (frontend && frontend.version !== version) {
-        problems.push({ code: "SDK_VERSION_MISMATCH", message: `frontend/package.json 的 ${SDK_PACKAGE} 是 ${frontend.spec}（${frontend.version ?? "讀不到版本"}），backend/go.mod 要求 ${version}；兩者必須相同。` });
+        problems.push({ code: "SDK_VERSION_MISMATCH", message: `frontend/package.json 的 ${SDK_PACKAGE} 是 ${frontend.spec}（${frontend.version ?? "讀不到版本"}），${file} 要求 ${version}；兩者必須相同。` });
     }
     return problems;
 }

package/dist/standalone/spk.js

@@ -27,6 +27,7 @@ import { PORTAL_JSON_RELPATH, PORTAL_MUSTACHE_RELPATH, renderPortalJson, renderP
 import { executorPlan } from "../runtime/executor-build.js";
 import { EXECUTOR_ANCHOR } from "../runtime/executor-inspect.js";
 import { renderSharedFolderUpgradeWizardFiles, sharedFolderInstallSteps } from "./shared-folder.js";
+import { stateItemTexts, uninstallExecProblem, uninstallRecord } from "./uninstall.js";
 const FILE_MODE = 0o644;
 const EXEC_MODE = 0o755;
 const MAX_UI_BYTES = 64 * 1024 * 1024;
@@ -84,7 +85,10 @@ export async function assembleStandaloneSpk(options) {
             copyFileSync(options.backgroundWorker, worker);
             chmodSync(worker, EXEC_MODE);
         }
-        copyStandaloneNotices(manifest.root, manifest.ui.dir, join(staging, 'package'), manifest.backend.kind === 'go' || Boolean(manifest.daemon), manifest.backend.kind === 'go' ? manifest.backend.dir : undefined);
+        const backend = manifest.backend;
+        // A daemon is a Go program of the project's backend directory.
+        const sdk = backend.kind !== 'binary' ? backend : manifest.daemon ? { kind: 'go', dir: join(manifest.root, 'backend') } : undefined;
+        copyStandaloneNotices(manifest.root, manifest.ui.dir, join(staging, 'package'), { go: backend.kind === 'go' || Boolean(manifest.daemon), rust: backend.kind === 'rust', sdk });
         if (manifest.daemon)
             copyFileSync(new URL('../../assets/licenses/TEMPLATE.txt', import.meta.url), join(staging, 'package', 'LICENSES', 'DAEMON-LICENSE.txt'));
         const portal = nativePortal(manifest);
@@ -104,11 +108,14 @@ export async function assembleStandaloneSpk(options) {
             for (const op of manifest.rootOps ?? [])
                 writeFile(join(staging, "package", "root", op.name + ".sh"), op.body);
         }
+        const hook = manifest.uninstall && uninstallExecProblem(join(staging, "package"), manifest.uninstall.purge);
+        if (hook)
+            throw new StandaloneBuildError(hook.code, hook.message);
         const packageTgz = join(staging, "package.tgz");
         await createReproducibleTar(join(staging, "package"), packageTgz, { gzip: true });
         rmSync(join(staging, "package"), { recursive: true, force: true });
         const checksum = createHash("md5").update(readFileSync(packageTgz)).digest("hex");
-        writeFile(join(staging, "sdk-package.json"), JSON.stringify({ schema: 2, backend: manifest.backend.kind, capabilities: Object.keys(manifest.capabilities).sort(), ...(manifest.entry ? { entry: manifest.entry } : {}) }));
+        writeFile(join(staging, "sdk-package.json"), JSON.stringify({ schema: 2, backend: manifest.backend.kind, capabilities: Object.keys(manifest.capabilities).sort(), ...(manifest.entry ? { entry: manifest.entry } : {}), ...(manifest.uninstall ? { uninstall: uninstallRecord(manifest.uninstall, manifest.i18n?.catalogs) } : {}) }));
         writeFile(join(staging, "INFO"), renderInfo(manifest, options.arch, checksum, options.executor?.executorDigest));
         mkdirSync(join(staging, "conf"));
         writeFile(join(staging, "conf", "privilege"), renderNativePrivilege());
@@ -132,7 +139,11 @@ export async function assembleStandaloneSpk(options) {
             ...install.static,
             ...install.dynamic,
             ...(folder ? renderSharedFolderUpgradeWizardFiles(manifest.package, folder) : {}),
-            ...renderUninstallWizardFiles(manifest.package, "native", { executor: Boolean(options.executor), portal: Boolean(portal), portalEntry: Boolean(manifest.portal && portalByExecutor(manifest.os_min_ver)) }),
+            ...renderUninstallWizardFiles(manifest.package, "native", {
+                executor: Boolean(options.executor), portal: Boolean(portal), portalEntry: Boolean(manifest.portal && portalByExecutor(manifest.os_min_ver)),
+                rootPurge: Boolean(manifest.uninstall?.purge.root),
+                ...(manifest.uninstall?.state ? { state: { items: (locale) => stateItemTexts(manifest.uninstall, manifest.i18n?.catalogs, locale) } } : {}),
+            }),
         });
         writePackageCenterIcons(staging, icons);
         mkdirSync(dirname(options.outputPath), { recursive: true });

package/dist/standalone/toolkit.d.ts

@@ -0,0 +1,10 @@
+import type { CommandRunner } from './build.js';
+export type Toolkit = {
+    url: string;
+    sha256: string;
+};
+export declare function verifyToolkitArchive(path: string, expected: string): void;
+/** One cache per user, shared by every project and worktree; archives are checked against sha256 on every use. */
+export declare function toolkitCacheDir(env: Record<string, string | undefined>, platform: string, home: string): string;
+/** Extracts the checksum-pinned toolkit archives of one architecture into a fresh folder the caller removes; '' without archives. */
+export declare function prepareToolkit(cwd: string, arch: string, inputs: Toolkit[], run: CommandRunner): Promise<string>;

package/dist/standalone/toolkit.js

@@ -0,0 +1,101 @@
+/** Checksum-pinned toolkit archives: one private download cache per user, re-extracted from verified bytes on every build. */
+import { createHash } from 'node:crypto';
+import { existsSync, lstatSync, mkdirSync, mkdtempSync, readFileSync, renameSync, rmSync } from 'node:fs';
+import { homedir } from 'node:os';
+import { isAbsolute, join, resolve } from 'node:path';
+function fail(message) { throw Object.assign(new Error(`NATIVE_LAYOUT_INVALID: ${message}`), { code: 'NATIVE_LAYOUT_INVALID' }); }
+const digest = (bytes) => createHash('sha256').update(bytes).digest('hex');
+export function verifyToolkitArchive(path, expected) {
+    if (!lstatSync(path).isFile() || digest(readFileSync(path)) !== expected)
+        fail('toolkit checksum mismatch');
+}
+/** One cache per user, shared by every project and worktree; archives are checked against sha256 on every use. */
+export function toolkitCacheDir(env, platform, home) {
+    if (env.SYNOPKGLAND_CACHE_DIR)
+        return resolve(env.SYNOPKGLAND_CACHE_DIR);
+    if (platform === 'darwin')
+        return join(home, 'Library', 'Caches', 'synopkgland');
+    const xdg = env.XDG_CACHE_HOME;
+    return join(xdg && isAbsolute(xdg) ? xdg : join(home, '.cache'), 'synopkgland');
+}
+// Concurrent architectures that pin the same archive share one download.
+const downloads = new Map();
+async function download(cwd, cache, input, archive, run) {
+    const tmp = mkdtempSync(join(cache, '.download-'));
+    try {
+        const out = join(tmp, 'archive');
+        const r = await run('curl', ['--fail', '--location', '--proto', '=https', '--proto-redir', '=https', '--retry', '2', '--retry-all-errors', '--connect-timeout', '20', '--max-time', '600', '--output', out, input.url], { cwd, env: { ...process.env } });
+        if (r.status !== 0)
+            fail('toolkit download failed');
+        // Rename is atomic, so another build process sees either no archive or a verified one.
+        verifyToolkitArchive(out, input.sha256);
+        renameSync(out, archive);
+    }
+    finally {
+        rmSync(tmp, { recursive: true, force: true });
+    }
+}
+/** Extracts the checksum-pinned toolkit archives of one architecture into a fresh folder the caller removes; '' without archives. */
+export async function prepareToolkit(cwd, arch, inputs, run) {
+    if (!inputs.length)
+        return '';
+    const cache = toolkitCacheDir(process.env, process.platform, homedir());
+    mkdirSync(cache, { recursive: true, mode: 0o700 });
+    if (lstatSync(cache).isSymbolicLink() || (lstatSync(cache).mode & 0o022))
+        fail('toolkit cache must be owned and private');
+    const archives = [];
+    for (const input of inputs) {
+        const archive = join(cache, `${input.sha256}.txz`);
+        if (!existsSync(archive)) {
+            let pending = downloads.get(archive);
+            if (!pending) {
+                pending = download(cwd, cache, input, archive, run).finally(() => downloads.delete(archive));
+                downloads.set(archive, pending);
+            }
+            await pending;
+        }
+        verifyToolkitArchive(archive, input.sha256);
+        archives.push(archive);
+    }
+    // Re-extract verified bytes: a package-writable marker never authenticates an extracted tree.
+    const stage = mkdtempSync(join(cache, `toolkit-${arch}-`));
+    try {
+        const flavor = await tarFlavor(cwd, run);
+        for (const archive of archives) {
+            if (flavor === 'bsdtar')
+                await refuseEscapingMembers(cwd, archive, run);
+            const r = await run('tar', flavor === 'gnu' ? ['-xJf', archive, '-C', stage, '--keep-directory-symlink'] : ['-xPJf', archive, '-C', stage], { cwd, env: { ...process.env } });
+            if (r.status !== 0)
+                fail('toolkit extraction failed');
+        }
+        return stage;
+    }
+    catch (e) {
+        rmSync(stage, { recursive: true, force: true });
+        throw e;
+    }
+}
+/**
+ * A later toolkit archive may write through a directory symlink an earlier one
+ * created. GNU tar keeps such a symlink only with --keep-directory-symlink;
+ * bsdtar only with -P, which also allows absolute and .. members, so those are
+ * refused from the listing first.
+ */
+async function tarFlavor(cwd, run) {
+    const r = await run('tar', ['--version'], { cwd, env: { ...process.env }, capture: true });
+    const version = r.status === 0 ? r.stdout ?? '' : '';
+    if (/\bGNU tar\b/.test(version))
+        return 'gnu';
+    if (/\bbsdtar\b/.test(version))
+        return 'bsdtar';
+    throw Object.assign(new Error(`NATIVE_TOOLKIT_TAR_UNSUPPORTED: extracting native.toolkits needs GNU tar or bsdtar as \`tar\`; found ${r.missing ? 'no tar' : JSON.stringify(version.split('\n')[0] ?? '')}`), { code: 'NATIVE_TOOLKIT_TAR_UNSUPPORTED' });
+}
+async function refuseEscapingMembers(cwd, archive, run) {
+    const r = await run('tar', ['-tJf', archive], { cwd, env: { ...process.env }, capture: true });
+    if (r.status !== 0)
+        fail('toolkit extraction failed');
+    for (const member of (r.stdout ?? '').split('\n').filter(Boolean)) {
+        if (member.startsWith('/') || member.split('/').includes('..'))
+            fail(`toolkit member escapes the toolkit folder: ${member}`);
+    }
+}

package/dist/standalone/uninstall-hook.d.ts

@@ -0,0 +1,10 @@
+import type { StandaloneManifest } from "./manifest.js";
+/** The syslog tag of a failed or timed-out App uninstall hook. */
+export declare const UNINSTALL_SYSLOG_TAG = "synopkgland-uninstall";
+/**
+ * `synopkgland_uninstall_hook`: runs `uninstall.purge` as the package account
+ * with a fixed environment and the wizard's two answers, within its timeout.
+ * A failure is logged and never blocks the uninstall. It sets
+ * `synopkgland_purge_args` for the executor purge request.
+ */
+export declare function renderUninstallHook(manifest: StandaloneManifest): string;

package/dist/standalone/uninstall-hook.js

@@ -0,0 +1,71 @@
+/** The syslog tag of a failed or timed-out App uninstall hook. */
+export const UNINSTALL_SYSLOG_TAG = "synopkgland-uninstall";
+const TRUE_VALUES = "true|True|TRUE|yes|1";
+/** A fixed token in single quotes; only the package's own directories expand. */
+function word(value) {
+    return `'${value.replaceAll("'", "'\\''")}'`
+        .replaceAll("${SYNOPKG_PKGDEST}", `'"$hook_dest"'`)
+        .replaceAll("${SYNOPKG_PKGVAR}", `'"$hook_var"'`);
+}
+function wizardFlag(variable, keys) {
+    const values = keys.flatMap(key => [`"\${${key}:-}"`, `"\${wizard_${key}:-}"`]).join(" ");
+    return `  for flag in ${values}; do\n    case "$flag" in\n      ${TRUE_VALUES}) ${variable}=1 ;;\n    esac\n  done\n`;
+}
+/**
+ * `synopkgland_uninstall_hook`: runs `uninstall.purge` as the package account
+ * with a fixed environment and the wizard's two answers, within its timeout.
+ * A failure is logged and never blocks the uninstall. It sets
+ * `synopkgland_purge_args` for the executor purge request.
+ */
+export function renderUninstallHook(manifest) {
+    const purge = manifest.uninstall?.purge;
+    if (!purge)
+        return "";
+    const pkg = manifest.package;
+    const env = [
+        "PATH=/usr/bin:/bin", 'HOME="$hook_var"', 'TMPDIR="$hook_var/tmp"',
+        ...Object.entries(purge.env).map(([key, value]) => `${key}=${word(value)}`),
+        'SYNOPKGLAND_DELETE_STATE="$delete_state"', 'SYNOPKGLAND_REMOVE_DATA="$remove_data"',
+    ].join(" ");
+    const argv = [`"$hook_dest"/${word(purge.exec)}`, ...purge.args.map(word)].join(" ");
+    const failed = `${pkg} uninstall hook failed: $hook_failure`;
+    const logged = `${failed}; output in $hook_var/uninstall-hook.log`;
+    return `synopkgland_purge_args=
+synopkgland_uninstall_hook() {
+  delete_state=0
+  remove_data=0
+${manifest.uninstall?.state ? wizardFlag("delete_state", ["pkgwizard_delete_state"]) : ""}${wizardFlag("remove_data", ["pkgwizard_remove_additional", "delete_app_data"])}  [ "$delete_state" -eq 0 ] || synopkgland_purge_args=--delete-state
+  hook_dest="\${SYNOPKG_PKGDEST:-/var/packages/${pkg}/target}"
+  hook_var="\${SYNOPKG_PKGVAR:-/var/packages/${pkg}/var}"
+  mkdir -p "$hook_var/tmp" 2>/dev/null || true
+  # Its own process group, so a timeout stops the hook's children too; its
+  # output goes to a file, so a lingering child cannot hold DSM's pipe open.
+  set -m
+  (cd "$hook_var" 2>/dev/null || cd /; exec /usr/bin/env -i ${env} ${argv}) </dev/null >"$hook_var/uninstall-hook.log" 2>&1 &
+  hook_pid=$!
+  set +m
+  hook_waited=0
+  while kill -0 "$hook_pid" 2>/dev/null && [ "$hook_waited" -lt ${purge.timeout} ]; do
+    sleep 1
+    hook_waited=$((hook_waited + 1))
+  done
+  hook_failure=
+  if kill -0 "$hook_pid" 2>/dev/null; then
+    kill -TERM -"$hook_pid" 2>/dev/null || kill -TERM "$hook_pid" 2>/dev/null
+    sleep 1
+    kill -KILL -"$hook_pid" 2>/dev/null || kill -KILL "$hook_pid" 2>/dev/null
+    wait "$hook_pid" 2>/dev/null
+    hook_failure="timeout after ${purge.timeout} s"
+  else
+    wait "$hook_pid"
+    hook_status=$?
+    [ "$hook_status" -eq 0 ] || hook_failure="exit $hook_status"
+  fi
+  if [ -n "$hook_failure" ]; then
+    echo "${logged}" >&2
+    logger -t ${UNINSTALL_SYSLOG_TAG} "${logged}" 2>/dev/null || true
+  fi
+  return 0
+}
+`;
+}

package/dist/standalone/uninstall.d.ts

@@ -0,0 +1,53 @@
+import { type Catalog, type Catalogs, type Locale } from "./i18n.js";
+import type { StandaloneError } from "./manifest.js";
+import { type RootOp } from "./root-ops.js";
+/**
+ * `uninstall`: the App's own hook on a real uninstall, run as the package
+ * account before the executor purge, and the state it deletes when the
+ * administrator ticks the uninstall wizard's "delete state" box.
+ */
+export interface Uninstall {
+    purge: UninstallPurge;
+    state?: {
+        items: Array<{
+            key: string;
+        }>;
+    };
+}
+export interface UninstallPurge {
+    /** A package-relative executable, outside executor/ and root/. */
+    exec: string;
+    args: string[];
+    env: Record<string, string>;
+    /** Seconds, 2..120. */
+    timeout: number;
+    /** A root/<name>.sh the executor runs at uninstall, only while its approval is live. */
+    root?: string;
+}
+/** The two flags the generated preuninst hands the hook. */
+export declare const UNINSTALL_FLAGS: readonly ["SYNOPKGLAND_DELETE_STATE", "SYNOPKGLAND_REMOVE_DATA"];
+export interface UninstallContext {
+    rootOps: boolean;
+    ops?: RootOp[];
+    /** The App's English catalog; each state item needs `uninstall.state.<key>`. */
+    en?: Catalog;
+}
+export declare function stateTextKey(key: string): string;
+export declare function readUninstall(value: unknown, context: UninstallContext, fail: (error: StandaloneError) => void): Uninstall | undefined;
+/** The hook in the staged package: a regular executable that does not try to become root. */
+export declare function uninstallExecProblem(packageDir: string, purge: UninstallPurge): StandaloneError | undefined;
+/** Each state item's text in this locale's catalog, English when the App does not ship it. */
+export declare function stateItemTexts(uninstall: Uninstall, catalogs: Catalogs | undefined, locale: Locale): string[];
+/**
+ * sdk-package.json's `uninstall`: the hook and the state item texts per
+ * locale, from which inspect renders the same preuninst and wizard again.
+ */
+export interface UninstallRecord extends Uninstall {
+    texts?: Catalogs;
+}
+export declare function uninstallRecord(uninstall: Uninstall, catalogs: Catalogs | undefined): UninstallRecord;
+/** The record read back and checked as the manifest's `uninstall` is; undefined when it does not hold. */
+export declare function readUninstallRecord(value: unknown, rootOps: boolean): {
+    uninstall: Uninstall;
+    catalogs?: Catalogs;
+} | undefined;

package/dist/standalone/uninstall.js

@@ -0,0 +1,136 @@
+import { lstatSync, readFileSync } from "node:fs";
+import { join } from "node:path";
+import { LOCALES } from "./i18n.js";
+import { ROOT_SCRIPT_HINTS } from "./root-ops.js";
+import { envKey, relativeExec, token } from "./daemon.js";
+/** The two flags the generated preuninst hands the hook. */
+export const UNINSTALL_FLAGS = ["SYNOPKGLAND_DELETE_STATE", "SYNOPKGLAND_REMOVE_DATA"];
+const FIELDS = new Set(["purge", "state"]);
+const PURGE_FIELDS = new Set(["exec", "args", "env", "timeout", "root"]);
+const STATE_KEY = /^[a-z][A-Za-z0-9_-]{0,31}$/;
+const record = (v) => Boolean(v) && typeof v === "object" && !Array.isArray(v);
+export function stateTextKey(key) {
+    return `uninstall.state.${key}`;
+}
+export function readUninstall(value, context, fail) {
+    if (value === undefined)
+        return undefined;
+    const invalid = () => {
+        fail({ code: "UNINSTALL_INVALID", message: "uninstall 只接受 purge {exec, args, env, timeout, root} 與 state {items: [{key}]}；exec 須是套件內固定執行檔（不可在 executor/ 或 root/），timeout 為 2–120 秒整數。" });
+        return undefined;
+    };
+    if (!record(value) || Object.keys(value).some(k => !FIELDS.has(k)))
+        return invalid();
+    if (value.purge === undefined) {
+        if (value.state === undefined)
+            return invalid();
+        fail({ code: "UNINSTALL_STATE_REQUIRES_PURGE", message: "uninstall.state 需要 uninstall.purge：只有 App 自己知道狀態存在哪裡。" });
+        return undefined;
+    }
+    const purge = readPurge(value.purge, context, fail);
+    if (purge === "invalid")
+        return invalid();
+    const state = value.state === undefined ? undefined : readState(value.state);
+    if (state === "invalid")
+        return invalid();
+    const missing = (state?.items ?? []).map(item => stateTextKey(item.key)).filter(key => context.en?.[key] === undefined);
+    if (missing.length) {
+        fail({ code: "UNINSTALL_STATE_TEXT_MISSING", message: `uninstall.state 的項目需要 i18n en.json 文字：${missing.join(", ")}。` });
+        return undefined;
+    }
+    return purge && { purge, ...(state ? { state } : {}) };
+}
+function readPurge(value, context, fail) {
+    if (!record(value) || Object.keys(value).some(k => !PURGE_FIELDS.has(k)))
+        return "invalid";
+    const top = typeof value.exec === "string" ? value.exec.split("/")[0] : "";
+    if (!relativeExec(value.exec) || top === "executor" || top === "root")
+        return "invalid";
+    const args = value.args ?? [];
+    if (!Array.isArray(args) || args.length > 64 || !args.every(token))
+        return "invalid";
+    const env = value.env ?? {};
+    if (!record(env) || Object.keys(env).length > 64
+        || Object.entries(env).some(([k, v]) => !envKey(k) || k.startsWith("SYNOPKGLAND_") || !token(v)))
+        return "invalid";
+    const timeout = value.timeout ?? 60;
+    if (!Number.isInteger(timeout) || timeout < 2 || timeout > 120)
+        return "invalid";
+    const root = value.root;
+    if (root !== undefined) {
+        if (typeof root !== "string")
+            return "invalid";
+        if (!context.rootOps) {
+            fail({ code: "UNINSTALL_ROOT_REQUIRES_ROOT_OPS", message: "uninstall.purge.root 需要 capabilities.rootOps: true。" });
+            return undefined;
+        }
+        if (context.ops && !context.ops.some(op => op.name === root)) {
+            fail({ code: "UNINSTALL_ROOT_OP_MISSING", message: `uninstall.purge.root「${root}」需要 root/${root}.sh。` });
+            return undefined;
+        }
+    }
+    return {
+        exec: value.exec,
+        args: args,
+        env: Object.fromEntries(Object.keys(env).sort().map(key => [key, env[key]])),
+        timeout: timeout,
+        ...(root === undefined ? {} : { root }),
+    };
+}
+function readState(value) {
+    if (!record(value) || Object.keys(value).some(k => k !== "items") || !Array.isArray(value.items))
+        return "invalid";
+    const items = value.items;
+    if (items.length === 0 || items.length > 16)
+        return "invalid";
+    const keys = items.map(item => record(item) && Object.keys(item).length === 1 && typeof item.key === "string" && STATE_KEY.test(item.key) ? item.key : undefined);
+    if (keys.some(key => key === undefined) || new Set(keys).size !== keys.length)
+        return "invalid";
+    return { items: keys.map(key => ({ key: key })) };
+}
+/** The hook in the staged package: a regular executable that does not try to become root. */
+export function uninstallExecProblem(packageDir, purge) {
+    const path = join(packageDir, purge.exec);
+    let stat;
+    try {
+        stat = lstatSync(path);
+    }
+    catch {
+        stat = undefined;
+    }
+    if (!stat?.isFile() || (stat.mode & 0o111) === 0) {
+        return { code: "UNINSTALL_EXEC_MISSING", message: `uninstall.purge.exec「${purge.exec}」不是套件內可執行的一般檔案。` };
+    }
+    const text = readFileSync(path).toString("latin1");
+    if (text.startsWith("#!") && ROOT_SCRIPT_HINTS.some(hint => hint.test(text))) {
+        return { code: "UNINSTALL_EXEC_UNSAFE", message: `uninstall.purge.exec「${purge.exec}」嘗試取得 root（sudo、chown root 或 setuid）；root 只能經 uninstall.purge.root。` };
+    }
+    return undefined;
+}
+/** Each state item's text in this locale's catalog, English when the App does not ship it. */
+export function stateItemTexts(uninstall, catalogs, locale) {
+    return (uninstall.state?.items ?? []).map(({ key }) => catalogs?.[locale]?.[stateTextKey(key)] ?? catalogs?.en[stateTextKey(key)] ?? key);
+}
+export function uninstallRecord(uninstall, catalogs) {
+    if (!uninstall.state)
+        return uninstall;
+    const keys = uninstall.state.items.map(item => stateTextKey(item.key));
+    const texts = Object.fromEntries(LOCALES.flatMap(locale => {
+        const catalog = catalogs?.[locale];
+        const found = Object.fromEntries(keys.filter(key => catalog?.[key] !== undefined).map(key => [key, catalog[key]]));
+        return Object.keys(found).length ? [[locale, found]] : [];
+    }));
+    return { ...uninstall, texts: texts };
+}
+/** The record read back and checked as the manifest's `uninstall` is; undefined when it does not hold. */
+export function readUninstallRecord(value, rootOps) {
+    if (!record(value))
+        return undefined;
+    const { texts, ...rest } = value;
+    if (texts !== undefined && (!record(texts) || Object.entries(texts).some(([locale, catalog]) => !LOCALES.includes(locale) || !record(catalog) || Object.values(catalog).some(text => typeof text !== "string"))))
+        return undefined;
+    let failed = false;
+    const catalogs = texts;
+    const uninstall = readUninstall(rest, { rootOps, en: catalogs?.en }, () => { failed = true; });
+    return uninstall && !failed ? { uninstall, ...(catalogs ? { catalogs } : {}) } : undefined;
+}

package/dist/types.d.ts

@@ -56,4 +56,4 @@ export interface ComposeDocument {
     secrets?: Record<string, unknown>;
     [key: string]: unknown;
 }
-export type TemplateName = "compose" | "binary" | "native-go";
+export type TemplateName = "compose" | "binary" | "native-go" | "native-rust";

package/dist/yaml-edit.d.ts

@@ -0,0 +1,6 @@
+/**
+ * Sets top-level keys of a YAML mapping in its source text: each named key's
+ * entry is rewritten, a missing one is appended, and every other line,
+ * comments and formatting included, stays as written.
+ */
+export declare function setTopLevel(text: string, values: Record<string, unknown>): string;