@synopackageland/cli 0.9.5 → 0.9.7

package/dist/init.js

@@ -1,19 +1,26 @@
 import { spawnSync } from "node:child_process";
-import { isMap, isScalar, parse, parseDocument, stringify } from "yaml";
+import { isMap, isScalar, parse, parseDocument } from "yaml";
+import { setTopLevel } from "./yaml-edit.js";
 import { capabilityNames, capabilitySettings } from "./capabilities.js";
 import { MOVE_FROM_STAGING } from './runtime/delegate-contract.js';
 import { cpSync, existsSync, mkdirSync, readdirSync, readFileSync, renameSync, rmSync, statSync, writeFileSync } from "node:fs";
-import { basename, join, relative, resolve } from "node:path";
+import { basename, dirname, join, relative, resolve } from "node:path";
 import { SDK_MODULE, SDK_PACKAGE } from "./runtime/sdk-source.js";
 import { templatesRoot } from "./template-paths.js";
-import { borrowedTarget, capabilityOverlays } from "./capability-overlays.js";
+import { borrowedFiles, borrowedTarget, capabilityOverlays, VUE_OVERLAYS } from "./capability-overlays.js";
+import { API_PERMISSIONS_FILE } from "./standalone/api-permissions.js";
 import { resolveMinDsm, assertContainerMinDsm, DEFAULT_MIN_DSM, isDsmAtLeast } from "./build-spk/dsm-version.js";
 import { readSharedFolder } from "./standalone/shared-folder.js";
 const TEMPLATE_NAMES = [
     "compose",
     "binary",
     "native-go",
+    "native-rust",
 ];
+/** Templates built from source with the SDK: capabilities, a Vue or plain UI, a shared folder. */
+const NATIVE_TEMPLATES = ["native-go", "native-rust"];
+const isNativeTemplate = (template) => NATIVE_TEMPLATES.includes(template);
+const BACKEND_KIND = { "native-go": "go", "native-rust": "rust" };
 /** Templates whose App runs through the DSM docker-project resource worker. */
 const CONTAINER_TEMPLATES = [
     "compose",
@@ -38,7 +45,7 @@ export function nativeCapabilitySettings(names) {
     return settings;
 }
 /** Templates whose identity is filled in at init: every generated file may carry a placeholder. */
-const IDENTIFIED = ["native-go", "binary"];
+const IDENTIFIED = [...NATIVE_TEMPLATES, "binary"];
 const PACKAGE_ID = /^[A-Za-z][A-Za-z0-9]{1,63}$/;
 /** npm never publishes files named .gitignore, so templates ship them as `gitignore`. */
 const RENAMED = { gitignore: ".gitignore" };
@@ -67,9 +74,9 @@ function templateFiles(root, dir = root) {
 function targetName(file) {
     return RENAMED[file] ?? file;
 }
-/** native-go defaults to the Vue shell; the CLI and the library entry point agree. */
+/** Native templates default to the Vue shell; the CLI and the library entry point agree. */
 function resolvedUi(template, options) {
-    return template === "native-go" ? options.ui ?? "vue" : options.ui;
+    return isNativeTemplate(template) ? options.ui ?? "vue" : options.ui;
 }
 /**
  * Copy one template tree into a project. A template directory may carry a local
@@ -93,9 +100,9 @@ export function initFromTemplate(template, targetDir, options = {}) {
         throw new Error("[CAPABILITY_COMBINATION_INVALID] delegate 的 install-selected scope 只能在 Vue 面板確認；plain UI 不支援，請改用 --ui vue。");
     if (options.from && template !== "compose")
         throw new Error("[INIT_OPTIONS_UNSUPPORTED] --from 只適用於 compose。");
-    if (caps.length && template !== "native-go")
+    if (caps.length && !isNativeTemplate(template))
         throw new Error("[CAPABILITY_UNSUPPORTED] binary／compose 不支援 --with 能力。");
-    const localSdk = template === "native-go" && process.env.SYNOPKGLAND_SDK_DIR ? resolve(process.env.SYNOPKGLAND_SDK_DIR) : undefined;
+    const localSdk = isNativeTemplate(template) && process.env.SYNOPKGLAND_SDK_DIR ? resolve(process.env.SYNOPKGLAND_SDK_DIR) : undefined;
     if (localSdk)
         assertLocalSdkReady(localSdk, resolvedUi(template, options) === "vue");
     const source = join(templatesRoot(), template);
@@ -112,14 +119,15 @@ export function initFromTemplate(template, targetDir, options = {}) {
     if (rootExample && minDsm !== undefined && !isDsmAtLeast(minDsm, DEFAULT_MIN_DSM)) {
         throw new Error(`[MIN_DSM_INVALID] root templates require DSM ${DEFAULT_MIN_DSM} or later.`);
     }
-    const capability = capabilityOverlays(caps);
-    const overlays = [...(ui === "vue" ? ["native-go-vue"] : []), ...capability.overlays].map(name => join(templatesRoot(), name));
+    const capability = isNativeTemplate(template) ? capabilityOverlays(template, caps) : { overlays: [], borrowed: [], removed: [] };
+    const borrowed = borrowedFiles(templatesRoot(), capability.borrowed);
+    const overlays = [...(ui === "vue" && isNativeTemplate(template) ? VUE_OVERLAYS[template] : []), ...capability.overlays].map(name => join(templatesRoot(), name));
     // Shared legal resources also live in the CLI package; only the template
     // terms are an unconditional part of a generated project.
     const shared = join(templatesRoot(), "_shared");
     const sharedFiles = ["LICENSES/TEMPLATE.txt", "AGENTS.md", "CLAUDE.md"];
     const files = [...templateFiles(source), ...sharedFiles, ...overlays.flatMap(root => templateFiles(root)),
-        ...capability.borrowed.map(borrowedTarget), ...(ui === "vue" ? ["frontend/third-party-notices.mjs"] : [])];
+        ...borrowed.map(borrowedTarget), ...(ui === "vue" ? ["frontend/third-party-notices.mjs"] : [])];
     const collisions = files.map(targetName).filter((file) => existsSync(join(targetDir, file)));
     if (collisions.length > 0) {
         throw new Error(`[INIT_TARGET_NOT_EMPTY] ${targetDir} 已有 ${collisions.join(", ")}；init 不會覆蓋既有檔案。請改用空目錄。`);
@@ -134,12 +142,14 @@ export function initFromTemplate(template, targetDir, options = {}) {
     for (const dir of (ui === "vue" ? ["frontend"] : [])) {
         cpSync(join(shared, "third-party-notices.mjs"), join(targetDir, dir, "third-party-notices.mjs"));
     }
-    for (const path of capability.borrowed)
+    for (const path of borrowed) {
+        mkdirSync(dirname(join(targetDir, borrowedTarget(path))), { recursive: true });
         cpSync(join(templatesRoot(), path), join(targetDir, borrowedTarget(path)));
+    }
     for (const file of capability.removed)
         rmSync(join(targetDir, file));
-    if (caps.includes("delegate")) {
-        const path = join(targetDir, "backend/internal/api/permissions.json");
+    if (caps.includes("delegate") && isNativeTemplate(template)) {
+        const path = join(targetDir, "backend", API_PERMISSIONS_FILE[BACKEND_KIND[template]]);
         const policy = JSON.parse(readFileSync(path, "utf8"));
         policy.methods["app.status"] = "authenticated";
         writeFileSync(path, JSON.stringify(policy, null, 2) + "\n");
@@ -151,8 +161,8 @@ export function initFromTemplate(template, targetDir, options = {}) {
     }
     for (const file of files.map(targetName))
         substitute(join(targetDir, file), substitutions);
-    if (localSdk)
-        useLocalSdk(targetDir, localSdk);
+    if (localSdk && isNativeTemplate(template))
+        useLocalSdk(targetDir, localSdk, BACKEND_KIND[template]);
     if (minDsm) {
         const manifest = join(targetDir, template !== "compose" ? "dsm-package.yaml" : "synology-app.yaml");
         writeFileSync(manifest, readFileSync(manifest, "utf8").replace(/^os_min_ver:.*$/m, `os_min_ver: "${minDsm}"`));
@@ -165,10 +175,9 @@ export function initFromTemplate(template, targetDir, options = {}) {
     if (ui !== "vue")
         rmSync(join(targetDir, "frontend"), { recursive: true, force: true });
     if (template !== "compose") {
+        // Only the capabilities change: the template's comments document the optional fields.
         const path = join(targetDir, "dsm-package.yaml");
-        const raw = parse(readFileSync(path, "utf8"));
-        raw.capabilities = nativeCapabilitySettings(caps);
-        writeFileSync(path, stringify(raw));
+        writeFileSync(path, setTopLevel(readFileSync(path, "utf8"), { capabilities: nativeCapabilitySettings(caps) }));
     }
     if (template === "compose" && options.from)
         importCompose(options.from, targetDir, options);
@@ -236,16 +245,32 @@ function assertLocalSdkReady(sdkDir, vue) {
         throw new Error(`[SDK_DIR_NOT_READY] ${ts} 尚未建置；前端安裝本機 SDK 時 npm 不會替它 build。請先執行 (cd ${ts} && npm ci && npm run build)，SDK 原始碼改動後也要重新 build。`);
     }
 }
-/** SYNOPKGLAND_SDK_DIR: the project builds against a local sdk checkout instead of the released version. */
-function useLocalSdk(targetDir, sdkDir) {
-    const goMod = join(targetDir, "backend/go.mod");
-    writeFileSync(goMod, `${readFileSync(goMod, "utf8")}\nreplace ${SDK_MODULE} => ${sdkDir}\n`);
+/**
+ * SYNOPKGLAND_SDK_DIR: the project builds against a local sdk checkout instead
+ * of the released version. A Rust backend keeps its Cargo files; at build time
+ * git reads the SDK repository from the checkout.
+ */
+function useLocalSdk(targetDir, sdkDir, backend) {
+    if (backend === "go") {
+        const goMod = join(targetDir, "backend/go.mod");
+        writeFileSync(goMod, `${readFileSync(goMod, "utf8")}\nreplace ${SDK_MODULE} => ${sdkDir}\n`);
+    }
     const frontend = join(targetDir, "frontend/package.json");
     if (!existsSync(frontend))
         return;
+    const local = `file:${join(sdkDir, "ts")}`;
     const pkg = JSON.parse(readFileSync(frontend, "utf8"));
-    pkg.dependencies[SDK_PACKAGE] = `file:${join(sdkDir, "ts")}`;
+    pkg.dependencies[SDK_PACKAGE] = local;
     writeFileSync(frontend, JSON.stringify(pkg, null, 2) + "\n");
+    // npm installs what the lockfile records; without the released entry it installs the local package.
+    const lockPath = join(targetDir, "frontend/package-lock.json");
+    if (!existsSync(lockPath))
+        return;
+    const lock = JSON.parse(readFileSync(lockPath, "utf8"));
+    if (lock.packages?.[""]?.dependencies)
+        lock.packages[""].dependencies[SDK_PACKAGE] = local;
+    delete lock.packages?.[`node_modules/${SDK_PACKAGE}`];
+    writeFileSync(lockPath, JSON.stringify(lock, null, 2) + "\n");
 }
 /** Fill the placeholders of one generated file; files without one, or removed by an overlay, stay untouched. */
 function substitute(path, substitutions) {
@@ -258,11 +283,11 @@ function substitute(path, substitutions) {
 }
 function substitutionsFor(template, targetDir, options) {
     const caps = capabilityNames(options.with ?? []);
-    if (options.ui !== undefined && template !== "native-go")
-        throw new Error("[INIT_OPTIONS_UNSUPPORTED] --ui 只適用於 native-go。");
+    if (options.ui !== undefined && !isNativeTemplate(template))
+        throw new Error("[INIT_OPTIONS_UNSUPPORTED] --ui 只適用於 native-go 與 native-rust。");
     if (options.sharedFolder) {
-        if (template !== "native-go")
-            throw new Error("[INIT_SHARED_FOLDER_INVALID] --shared-folder 只適用於 -t native-go。");
+        if (!isNativeTemplate(template))
+            throw new Error("[INIT_SHARED_FOLDER_INVALID] --shared-folder 只適用於 -t native-go 與 native-rust。");
         sharedFolderYaml(options.sharedFolder);
     }
     if (options.ui !== undefined && !["plain", "vue"].includes(options.ui))

package/dist/runtime/executor-build.d.ts

@@ -1,6 +1,6 @@
 import type { NativeArchFamily } from '../build-spk/dsm-arch.js';
 import type { CommandRunner } from '../standalone/build.js';
-import type { StandaloneManifest } from '../standalone/manifest.js';
+import { type StandaloneManifest } from '../standalone/manifest.js';
 import { type ExecutorPolicy } from './executor-policy.js';
 import { type ExecutorPins, type ExecutorTask } from './executor-tasks.js';
 import { type ExecutorDigestTable } from './executor-source.js';

package/dist/runtime/executor-build.js

@@ -1,6 +1,7 @@
 import { mkdirSync, readFileSync } from 'node:fs';
 import { join } from 'node:path';
 import { PINNED_GO_HINT, pinnedGoBuildEnv, pinnedGoProblem } from '../build-spk/go-toolchain.js';
+import { sdkBackend } from '../standalone/manifest.js';
 import { StandaloneBuildError } from '../standalone/spk.js';
 import { checkCgiBinary } from '../standalone/binary.js';
 import { executorPolicy, executorPolicyText, sha256 } from './executor-policy.js';
@@ -23,7 +24,7 @@ export async function buildExecutor(m, arch, work, run, options = {}) {
         return undefined;
     let sdk;
     try {
-        sdk = requiredSdk(m.backend.kind === 'go' ? m.backend.dir : m.root, options.env, options.download);
+        sdk = requiredSdk(sdkBackend(m), options.env, options.download);
     }
     catch (error) {
         throw failure(error);

package/dist/runtime/executor-digests.json

@@ -75,5 +75,27 @@
             "armv7": "b65a14f0fc77a1d3221c7dc6781eb66059aa200956b094d58a62bd1cad10f116"
         },
         "goToolchain": "go1.26.9"
+    },
+    "0.9.7": {
+        "x86_64": "d029ca6129e76cdc5b7016378722af166b511fb346fd1002082e611bec0aef4d",
+        "aarch64": "ac8018a9846a8aaca6f06323f033a27f7abef6705601efde57ea02565105a48d",
+        "armv7": "f7b4ee5fb90c8f2dd2c56ec1eeb7749300ad117a23d9df6da6840d8b2eff83b8",
+        "lifecycle": {
+            "x86_64": "f2f0a6aa83399688441b111adee3958d7df50e9d8e33939e3951da393f013819",
+            "aarch64": "d0f0d42f367093d5c9318afb4719b9ac76b1019574f1db34dd0fcb3aba44945b",
+            "armv7": "02da8b7016abfe00b8f18e27ef2d69bcff1ca376b43e17b8c04983ca6a6ef37d"
+        },
+        "goToolchain": "go1.26.9"
+    },
+    "0.9.8": {
+        "x86_64": "d029ca6129e76cdc5b7016378722af166b511fb346fd1002082e611bec0aef4d",
+        "aarch64": "ac8018a9846a8aaca6f06323f033a27f7abef6705601efde57ea02565105a48d",
+        "armv7": "f7b4ee5fb90c8f2dd2c56ec1eeb7749300ad117a23d9df6da6840d8b2eff83b8",
+        "lifecycle": {
+            "x86_64": "f2f0a6aa83399688441b111adee3958d7df50e9d8e33939e3951da393f013819",
+            "aarch64": "d0f0d42f367093d5c9318afb4719b9ac76b1019574f1db34dd0fcb3aba44945b",
+            "armv7": "02da8b7016abfe00b8f18e27ef2d69bcff1ca376b43e17b8c04983ca6a6ef37d"
+        },
+        "goToolchain": "go1.26.9"
     }
 }

package/dist/runtime/executor-policy.d.ts

@@ -26,6 +26,8 @@ export interface ExecutorPolicy {
     operations: string[];
     /** Below DSM 7.2 the executor registers this Application Portal entry; DSM 7.1 refuses web-config for unsigned packages. */
     portal?: PortalEntry;
+    /** The root op the executor runs at uninstall while the approval is live; a key of root. */
+    purge?: string;
     root: Record<string, string>;
 }
 /** The exact policy file bytes whose sha256 is the policy pin. */
@@ -42,6 +44,11 @@ export declare function executorPolicy(m: {
     portal?: PortalDeclaration;
     os_min_ver?: string;
     displayname?: string;
+    uninstall?: {
+        purge: {
+            root?: string;
+        };
+    };
 }): ExecutorPolicy;
 /** Inventory rejects malformed extensions even if a caller recomputes every pin. */
 export declare function validExecutorPolicy(value: unknown, pkg: string): value is ExecutorPolicy;

package/dist/runtime/executor-policy.js

@@ -44,9 +44,10 @@ export function executorPolicy(m) {
             root[op.name] = sha256(op.body);
     }
     const d = m.capabilities.delegate;
+    const purge = m.capabilities.rootOps ? m.uninstall?.purge.root : undefined;
     return { v: 1, package: m.package, app: `SYNO.SDS.${m.package}.Instance`, ...(m.entry ? { entry: m.entry } : {}), ...(d ? { scope: d.scope } : {}),
         ...(d?.lifetime ? { destinations: [...d.destinations].sort(), lifetime: d.lifetime } : {}),
-        operations: [...new Set(operations)].sort(), ...(portal ? { portal } : {}), root };
+        operations: [...new Set(operations)].sort(), ...(portal ? { portal } : {}), ...(purge ? { purge } : {}), root };
 }
 /** The entry the executor registers: a portal App whose os_min_ver is below DSM 7.2. */
 function executorPortal(m) {
@@ -63,11 +64,12 @@ export function validExecutorPolicy(value, pkg) {
     if (!value || typeof value !== 'object' || Array.isArray(value))
         return false;
     const p = value;
-    if (Object.keys(p).some(key => !['v', 'package', 'app', 'entry', 'scope', 'destinations', 'lifetime', 'operations', 'portal', 'root'].includes(key))
+    if (Object.keys(p).some(key => !['v', 'package', 'app', 'entry', 'scope', 'destinations', 'lifetime', 'operations', 'portal', 'purge', 'root'].includes(key))
         || p.v !== 1 || p.package !== pkg || p.app !== `SYNO.SDS.${pkg}.Instance`
         || 'entry' in p && p.entry !== 'admin-only' && p.entry !== 'app-privilege'
         || !Array.isArray(p.operations) || !p.operations.includes('status') || new Set(p.operations).size !== p.operations.length
-        || !p.root || typeof p.root !== 'object' || Array.isArray(p.root))
+        || !p.root || typeof p.root !== 'object' || Array.isArray(p.root)
+        || 'purge' in p && (typeof p.purge !== 'string' || !Object.hasOwn(p.root, p.purge)))
         return false;
     const base = ['status', 'root.run', 'delegate.create', 'delegate.list', 'delegate.revoke'];
     if (p.operations.some(op => ![...base, ...FILE_OPERATIONS, ...FILE_TASK_OPERATIONS, ...DELEGATE_EXTENSION_OPERATIONS, ...PORTAL_OPERATIONS].includes(op)))

package/dist/runtime/sdk-source.d.ts

@@ -1,6 +1,9 @@
 export declare const SDK_PACKAGE = "@synopackageland/sdk";
 export declare const SDK_MODULE = "github.com/synopackageland/syno-pkg-land-sdk";
 export declare const EXECUTOR_MODULE = "github.com/synopackageland/syno-pkg-land-sdk/executor";
+/** The Rust SDK crate, a git dependency on a release tag of the SDK repository. */
+export declare const SDK_CRATE = "syno-pkg-land-sdk";
+export declare const SDK_GIT_URL = "https://github.com/synopackageland/syno-pkg-land-sdk";
 /** Where one SDK version's Go client and executor sources are read from. */
 export interface SdkSource {
     version: string;
@@ -8,7 +11,16 @@ export interface SdkSource {
     executorDir: string;
     local: boolean;
 }
-/** The SDK version an App requires: `require github.com/synopackageland/syno-pkg-land-sdk vX.Y.Z` in backend/go.mod, the only version source. */
+/** How each backend declares the SDK. */
+export declare const SDK_DEPENDENCY: Record<SdkBackend['kind'], string>;
+/** The App backend whose dependency files name its SDK version. */
+export interface SdkBackend {
+    kind: 'go' | 'rust';
+    dir: string;
+}
+/** The SDK version an App requires, read from its backend's dependency files. */
+export declare function appSdkVersion(backend: SdkBackend): string | undefined;
+/** The SDK version a Go backend requires: `require github.com/synopackageland/syno-pkg-land-sdk vX.Y.Z` in backend/go.mod, its only version source. */
 export declare function sdkRequirement(backendDir: string): string | undefined;
 /** The App's own Go module path, the prefix of every `-X` that targets its packages. */
 export declare function goModulePath(backendDir: string): string | undefined;
@@ -21,7 +33,7 @@ export declare function sdkSource(version: string, env?: NodeJS.ProcessEnv, down
 /** The module cache directory of module@version; the cache is read-only, so builds copy it first. */
 export declare function goModDownload(spec: string, env?: NodeJS.ProcessEnv): string;
 /** The SDK an App builds its executor with; delegate and rootOps cannot build without one. */
-export declare function requiredSdk(backendDir: string, env?: NodeJS.ProcessEnv, download?: (spec: string) => string): SdkSource;
+export declare function requiredSdk(backend: SdkBackend, env?: NodeJS.ProcessEnv, download?: (spec: string) => string): SdkSource;
 /**
  * The SDK repositories are private: Go must fetch them with git, not from
  * proxy.golang.org and sum.golang.org. Says which of the two is missing.

package/dist/runtime/sdk-source.js

@@ -5,7 +5,42 @@ import { join } from 'node:path';
 export const SDK_PACKAGE = '@synopackageland/sdk';
 export const SDK_MODULE = 'github.com/synopackageland/syno-pkg-land-sdk';
 export const EXECUTOR_MODULE = `${SDK_MODULE}/executor`;
-/** The SDK version an App requires: `require github.com/synopackageland/syno-pkg-land-sdk vX.Y.Z` in backend/go.mod, the only version source. */
+/** The Rust SDK crate, a git dependency on a release tag of the SDK repository. */
+export const SDK_CRATE = 'syno-pkg-land-sdk';
+export const SDK_GIT_URL = `https://${SDK_MODULE}`;
+/** How each backend declares the SDK. */
+export const SDK_DEPENDENCY = {
+    go: `add \`require ${SDK_MODULE} v<version>\` to backend/go.mod.`,
+    rust: `add \`${SDK_CRATE} = { git = "${SDK_GIT_URL}", tag = "v<version>" }\` to backend/Cargo.toml and commit Cargo.lock.`,
+};
+/** The SDK version an App requires, read from its backend's dependency files. */
+export function appSdkVersion(backend) {
+    return backend.kind === 'go' ? sdkRequirement(backend.dir) : cargoSdkRequirement(backend.dir);
+}
+/**
+ * The SDK release a Rust backend's Cargo.lock pins: the source
+ * `git+https://github.com/synopackageland/syno-pkg-land-sdk?tag=vX.Y.Z#<commit>`.
+ * A branch, revision, path or registry source is refused, so the executor and
+ * the SDK route policy always come from the same release as the crate.
+ */
+function cargoSdkRequirement(backendDir) {
+    let lock;
+    try {
+        lock = readFileSync(join(backendDir, 'Cargo.lock'), 'utf8');
+    }
+    catch {
+        return undefined;
+    }
+    const sdk = lock.split(/^\[\[package\]\]$/m).filter(entry => /^name = "(.*)"$/m.exec(entry)?.[1] === SDK_CRATE);
+    if (!sdk.length)
+        return undefined;
+    const tag = new RegExp(`^source = "git\\+${SDK_GIT_URL.replaceAll('.', '\\.')}\\?tag=v(\\d+\\.\\d+\\.\\d+)#[0-9a-f]{40}"$`, 'm');
+    const version = sdk.length === 1 ? tag.exec(sdk[0])?.[1] : undefined;
+    if (!version)
+        throw new Error(`[SDK_TAG_REQUIRED] backend/Cargo.lock must pin one ${SDK_CRATE} from a release tag: { git = "${SDK_GIT_URL}", tag = "vX.Y.Z" } in Cargo.toml, then cargo update -p ${SDK_CRATE}.`);
+    return version;
+}
+/** The SDK version a Go backend requires: `require github.com/synopackageland/syno-pkg-land-sdk vX.Y.Z` in backend/go.mod, its only version source. */
 export function sdkRequirement(backendDir) {
     const module = SDK_MODULE.replaceAll('.', '\\.');
     return new RegExp(`^\\s*(?:require\\s+)?${module}\\s+v(\\S+)`, 'm').exec(goMod(backendDir))?.[1];
@@ -54,10 +89,10 @@ export function goModDownload(spec, env = process.env) {
     return info.Dir;
 }
 /** The SDK an App builds its executor with; delegate and rootOps cannot build without one. */
-export function requiredSdk(backendDir, env = process.env, download) {
-    const version = sdkRequirement(backendDir);
+export function requiredSdk(backend, env = process.env, download) {
+    const version = appSdkVersion(backend);
     if (!version)
-        throw new Error(`[SDK_REQUIRED] capabilities.delegate and rootOps need the SDK: add \`require ${SDK_MODULE} v<version>\` to backend/go.mod.`);
+        throw new Error(`[SDK_REQUIRED] capabilities.delegate and rootOps need the SDK: ${SDK_DEPENDENCY[backend.kind]}`);
     return download ? sdkSource(version, env, download) : sdkSource(version, env);
 }
 /**

package/dist/standalone/api-permissions.d.ts

@@ -1,5 +1,7 @@
 import type { Capabilities } from "./manifest.js";
-export declare const API_PERMISSIONS_FILE = "internal/api/permissions.json";
+import { type SdkBackend } from "../runtime/sdk-source.js";
+/** The App route policy inside each backend kind's directory. */
+export declare const API_PERMISSIONS_FILE: Record<SdkBackend["kind"], string>;
 type SdkPermissions = Record<string, Record<string, ApiPermission>>;
 export declare const MAX_PERMISSIONS_BYTES = 65536;
 export declare const MAX_PERMISSION_METHODS = 1024;
@@ -10,7 +12,7 @@ export interface ApiPermissions {
     methods: Record<string, ApiPermission>;
 }
 export declare function parseApiPermissions(raw: Uint8Array): ApiPermissions;
-export declare function readApiPermissions(backendDir: string, capabilities?: Capabilities): {
+export declare function readApiPermissions(backend: SdkBackend, capabilities?: Capabilities): {
     policy: ApiPermissions;
     digest: string;
     sdkDigest: string;

package/dist/standalone/api-permissions.js

@@ -1,9 +1,10 @@
 import { createHash } from "node:crypto";
 import { lstatSync, readFileSync } from "node:fs";
 import { join } from "node:path";
-import { sdkRequirement, sdkSource } from "../runtime/sdk-source.js";
+import { appSdkVersion, sdkSource } from "../runtime/sdk-source.js";
 import { parseDocument } from "yaml";
-export const API_PERMISSIONS_FILE = "internal/api/permissions.json";
+/** The App route policy inside each backend kind's directory. */
+export const API_PERMISSIONS_FILE = { go: "internal/api/permissions.json", rust: "permissions.json" };
 /** SDK-owned routes per capability, in the Go module of the SDK version the App requires. */
 const SDK_PERMISSIONS_FILE = "api/sdk-permissions.json";
 export const MAX_PERMISSIONS_BYTES = 65536;
@@ -32,14 +33,14 @@ export function parseApiPermissions(raw) {
     }
     return value;
 }
-export function readApiPermissions(backendDir, capabilities = {}) {
-    const file = join(backendDir, API_PERMISSIONS_FILE);
+export function readApiPermissions(backend, capabilities = {}) {
+    const file = join(backend.dir, API_PERMISSIONS_FILE[backend.kind]);
     const stat = lstatSync(file);
     if (!stat.isFile() || stat.size > MAX_PERMISSIONS_BYTES)
         throw new Error("permissions must be a regular bounded JSON file");
     const raw = readFileSync(file);
     const policy = parseApiPermissions(raw);
-    const version = sdkRequirement(backendDir);
+    const version = appSdkVersion(backend);
     const sdkRaw = version ? readFileSync(join(sdkSource(version).goDir, SDK_PERMISSIONS_FILE)) : Buffer.from("{}");
     const sdk = JSON.parse(sdkRaw.toString("utf8"));
     for (const methods of Object.values(sdk))

package/dist/standalone/binary.d.ts

@@ -4,7 +4,8 @@ export declare const ELF_MACHINE: Record<NativeArchFamily, number>;
 /**
  * Checks a prebuilt CGI before it is packaged: a regular file inside the
  * project, a little-endian ELF of `arch`'s class and machine, and statically linked
- * (no PT_INTERP), because DSM models ship different libc versions.
+ * (no PT_INTERP), because DSM models ship different libc versions; only a
+ * build that links against a known DSM glibc may name its `interpreter`.
  * Returns undefined when the file is acceptable.
  */
-export declare function checkCgiBinary(projectRoot: string, file: string, arch: NativeArchFamily): StandaloneError | undefined;
+export declare function checkCgiBinary(projectRoot: string, file: string, arch: NativeArchFamily, interpreter?: string): StandaloneError | undefined;

package/dist/standalone/binary.js

@@ -11,10 +11,11 @@ function fail(code, message) {
 /**
  * Checks a prebuilt CGI before it is packaged: a regular file inside the
  * project, a little-endian ELF of `arch`'s class and machine, and statically linked
- * (no PT_INTERP), because DSM models ship different libc versions.
+ * (no PT_INTERP), because DSM models ship different libc versions; only a
+ * build that links against a known DSM glibc may name its `interpreter`.
  * Returns undefined when the file is acceptable.
  */
-export function checkCgiBinary(projectRoot, file, arch) {
+export function checkCgiBinary(projectRoot, file, arch, interpreter) {
     let stat;
     try {
         stat = lstatSync(file);
@@ -32,7 +33,7 @@ export function checkCgiBinary(projectRoot, file, arch) {
     if (stat.size > MAX_BINARY_BYTES) {
         return fail("STANDALONE_BINARY_TOO_LARGE", `${file} 超過 256 MiB。`);
     }
-    return checkElf(readHeader(file), file, arch);
+    return checkElf(readHeader(file), file, arch, interpreter);
 }
 function readHeader(file) {
     const fd = openSync(file, "r");
@@ -58,7 +59,7 @@ function readElfHeader(buf) {
     }
     return undefined;
 }
-function checkElf(buf, file, arch) {
+function checkElf(buf, file, arch, interpreter) {
     const bits = ELF_CLASS64[arch] ? 64 : 32;
     const notElf = fail("STANDALONE_BINARY_NOT_ELF", `${file} 不是 ${arch} 需要的 ${bits}-bit little-endian Linux ELF 執行檔。`);
     const header = readElfHeader(buf);
@@ -73,9 +74,20 @@ function checkElf(buf, file, arch) {
         return notElf;
     }
     for (let i = 0; i < phnum; i++) {
-        if (buf.readUInt32LE(phoff + i * phentsize) === PT_INTERP) {
+        const entry = phoff + i * phentsize;
+        if (buf.readUInt32LE(entry) === PT_INTERP && (interpreter === undefined || interpreterOf(buf, entry, header.class64) !== interpreter)) {
             return fail("STANDALONE_BINARY_DYNAMIC", `${file} 是動態連結執行檔。請改用靜態連結（Go：CGO_ENABLED=0；Rust：*-unknown-linux-musl）。`);
         }
     }
     return undefined;
 }
+/** The path a PT_INTERP program header names, when it lies within the read header bytes. */
+function interpreterOf(buf, entry, class64) {
+    if (entry + (class64 ? 40 : 20) > buf.length)
+        return undefined;
+    const offset = class64 ? Number(buf.readBigUInt64LE(entry + 8)) : buf.readUInt32LE(entry + 4);
+    const size = class64 ? Number(buf.readBigUInt64LE(entry + 32)) : buf.readUInt32LE(entry + 16);
+    if (size < 1 || offset + size > buf.length || buf[offset + size - 1] !== 0)
+        return undefined;
+    return buf.toString("latin1", offset, offset + size - 1);
+}

package/dist/standalone/build.js

@@ -7,6 +7,7 @@ import { goBuildEnv } from "../build-spk/dsm-arch.js";
 import { resolveMinDsm, DEFAULT_MIN_DSM, isDsmAtLeast, PORTAL_EXECUTOR_MIN_DSM, portalByExecutor, portalMinDsmMessage } from "../build-spk/dsm-version.js";
 import { checkCgiBinary } from "./binary.js";
 import { loadStandaloneManifest } from "./manifest.js";
+import { buildRustBackend } from "./rust-build.js";
 import { assembleStandaloneSpk, StandaloneBuildError } from "./spk.js";
 import { buildDaemonControl } from "./daemon.js";
 import { buildExecutor } from "../runtime/executor-build.js";
@@ -102,14 +103,9 @@ export async function buildStandalone(options) {
             const executor = await buildExecutor(manifest, arch, archWork, run);
             executor?.warnings.forEach(warning => warnings.add(warning));
             const builtManifest = executor ? { ...manifest, executor } : manifest;
-            const cgiPath = await backendFor(builtManifest, arch, archWork, run);
-            const problem = checkCgiBinary(manifest.backend.kind === "go" ? archWork : manifest.root, cgiPath, arch);
-            if (problem) {
-                throw new StandaloneBuildError(problem.code, problem.message);
-            }
+            const { cgi: cgiPath, worker: backgroundWorker } = await backendFor(builtManifest, arch, archWork, run);
             const outputPath = join(stage, `${manifest.package}-${manifest.spkVersion}-${arch}.spk`);
             const daemonControl = await buildDaemonControl(manifest, arch, archWork, run);
-            const backgroundWorker = await buildBackgroundWorker(builtManifest, arch, archWork, run);
             await assembleStandaloneSpk({ manifest: builtManifest, arch, cgiPath, outputPath, daemonControl, backgroundWorker, executor });
             return outputPath;
         }));
@@ -133,14 +129,22 @@ async function buildUi(manifest, run) {
         throw new StandaloneBuildError("STANDALONE_UI_BUILD_FAILED", `UI build（${build.command.join(" ")}）失敗。${installHint}\n${result.stderr}`);
     }
 }
+/** The checked CGI of one architecture and, with capabilities.jobs, its fixed worker. */
 async function backendFor(manifest, arch, work, run) {
     const backend = manifest.backend;
-    if (backend.kind === "binary") {
-        return backend.files[arch];
+    if (backend.kind === "rust")
+        return buildRustBackend(manifest, arch, work, run);
+    const cgi = backend.kind === "binary" ? backend.files[arch] : await buildGoCgi(manifest, backend, arch, work, run);
+    const problem = checkCgiBinary(backend.kind === "go" ? work : manifest.root, cgi, arch);
+    if (problem) {
+        throw new StandaloneBuildError(problem.code, problem.message);
     }
+    return { cgi, worker: await buildBackgroundWorker(manifest, arch, work, run) };
+}
+async function buildGoCgi(manifest, backend, arch, work, run) {
     // UI build hooks run after validation. Refuse policy changes rather than
     // compiling CGI permissions different from the launcher metadata snapshot.
-    if (readApiPermissions(backend.dir, manifest.capabilities).digest !== manifest.apiPermissionsDigest || readApiPermissions(backend.dir, manifest.capabilities).sdkDigest !== manifest.apiSDKPermissionsDigest) {
+    if (readApiPermissions(backend, manifest.capabilities).digest !== manifest.apiPermissionsDigest || readApiPermissions(backend, manifest.capabilities).sdkDigest !== manifest.apiSDKPermissionsDigest) {
         throw new StandaloneBuildError("STANDALONE_API_PERMISSIONS_CHANGED", "API permissions changed during build; check and rebuild.");
     }
     const module = goModulePath(backend.dir);

package/dist/standalone/daemon.d.ts

@@ -18,6 +18,12 @@ export interface Daemon {
         uninstall: number;
     };
 }
+/** A fixed argv or env value: only the package's own directories expand. */
+export declare const token: (v: unknown) => v is string;
+/** An application variable that cannot steer the loader, the shell or DSM. */
+export declare const envKey: (k: string) => boolean;
+/** A relative path to a fixed executable, without `.` or `..` parts. */
+export declare const relativeExec: (v: unknown) => v is string;
 export declare function readDaemon(value: unknown, root: string, arches: NativeArchFamily[], fail: (error: StandaloneError) => void): Daemon | undefined;
 export declare function daemonConfig(manifest: StandaloneManifest): string;
 export declare function buildDaemonControl(manifest: StandaloneManifest, arch: NativeArchFamily, work: string, run: CommandRunner): Promise<string | undefined>;

package/dist/standalone/daemon.js

@@ -6,18 +6,22 @@ import { checkCgiBinary } from "./binary.js";
 import { StandaloneBuildError } from "./spk.js";
 const fields = new Set(["exec", "targets", "args", "env", "timeouts", "uninstall_args"]);
 const record = (v) => Boolean(v) && typeof v === "object" && !Array.isArray(v);
-const token = (v) => typeof v === "string" && Buffer.byteLength(v) <= 4096 && !v.includes("\0")
+/** A fixed argv or env value: only the package's own directories expand. */
+export const token = (v) => typeof v === "string" && Buffer.byteLength(v) <= 4096 && !v.includes("\0")
     && !v.replaceAll("${SYNOPKG_PKGDEST}", "").replaceAll("${SYNOPKG_PKGVAR}", "").includes("${");
-const envKey = (k) => /^[A-Z][A-Z0-9_]{0,63}$/.test(k)
+/** An application variable that cannot steer the loader, the shell or DSM. */
+export const envKey = (k) => /^[A-Z][A-Z0-9_]{0,63}$/.test(k)
     && !/^(PATH|HOME|TMPDIR|ENV|BASH_ENV|SHELLOPTS|BASHOPTS|GODEBUG|GOTRACEBACK|LD_.*|DYLD_.*|SYNOPKG_.*)$/.test(k);
+/** A relative path to a fixed executable, without `.` or `..` parts. */
+export const relativeExec = (v) => typeof v === "string" && v.length <= 200
+    && /^[A-Za-z0-9_-]+(?:\/[A-Za-z0-9_.-]+)*$/.test(v) && !v.split("/").some(p => p === "." || p === "..");
 export function readDaemon(value, root, arches, fail) {
     if (value === undefined)
         return undefined;
     const invalid = () => { fail({ code: "STANDALONE_DAEMON_INVALID", message: "daemon 只接受固定 exec、targets、args、env 與 timeouts；路徑須在專案內，環境不接受 loader/shell/system 變數。" }); return undefined; };
     if (!record(value) || Object.keys(value).some(k => !fields.has(k)))
         return invalid();
-    if (typeof value.exec !== "string" || !/^[A-Za-z0-9_-]+(?:\/[A-Za-z0-9_.-]+)*$/.test(value.exec)
-        || value.exec.split("/").some(p => p === "." || p === "..") || value.exec.length > 200)
+    if (!relativeExec(value.exec))
         return invalid();
     if (!record(value.targets) || Object.keys(value.targets).length !== arches.length)
         return invalid();

package/dist/standalone/inspect-spk.d.ts

@@ -1,7 +1,7 @@
 import { type ExecutorInspection } from "../runtime/executor-inspect.js";
 import type { EntryMode } from "./manifest.js";
 import { type UninstallCleanupItem } from "../runtime/uninstall-cleanup.js";
-export type SpkKind = "native-go" | "binary" | "container" | "native-layout";
+export type SpkKind = "native-go" | "native-rust" | "binary" | "container" | "native-layout";
 export interface SpkInspection {
     kind?: SpkKind;
     package?: string;