@synopackageland/cli 0.9.5 → 0.9.7

package/dist/standalone/inspect-spk.js

@@ -10,6 +10,9 @@ import { CONTAINER_MIN_DSM, isDsmAtLeast, PORTAL_EXECUTOR_MIN_DSM, PORTAL_MIN_DS
 import { ELF_MACHINE } from "./binary.js";
 import { CGI_PAYLOAD_PATH, entryLauncherAccess } from "./dsm-window.js";
 import { daemonConfig, readDaemon } from "./daemon.js";
+import { ROOT_SCRIPT_HINTS } from "./root-ops.js";
+import { DELETE_STATE_KEY } from "../build-spk/uninstall-wizard.js";
+import { readUninstallRecord, stateItemTexts } from "./uninstall.js";
 import { BACKGROUND_UNIT_DIR, BACKGROUND_WORKER_PAYLOAD, backgroundUnitName, renderBackgroundUnit } from "./background.js";
 import { renderStandaloneResource } from "./resource.js";
 import { recoverSharedFolder, renderSharedFolderUpgradeWizardFiles, sharedFolderInstallSteps, SHARED_FOLDER_MARKER } from "./shared-folder.js";
@@ -23,7 +26,6 @@ import { PORTAL_JSON_RELPATH, PORTAL_MUSTACHE_RELPATH, renderPortalJson, renderP
 import { isPortalAlias } from "../portal/alias.js";
 import { defaultPackageIcons, MAX_ICON_BYTES } from "../build-spk/dsm-icons.js";
 import { decodePng } from "../build-spk/png.js";
-const ROOT_SCRIPT_HINTS = [/\bsudo\b/, /\bchown\s+(-\w+\s+)*root\b/, /chmod\s+[ugo]*\+s\b/, /chmod\s+[2467][0-7]{3}\b/];
 /** Reads an SPK without installing it and reports how it would run on DSM. */
 export async function inspectStandaloneSpk(spkPath) {
     return inspectSpk(spkPath, "native-go");
@@ -55,7 +57,7 @@ export async function inspectSpk(spkPath, expectedKind) {
         if (metadataText !== undefined) {
             try {
                 const raw = JSON.parse(metadataText);
-                if (raw.schema !== 2 || !["go", "binary"].includes(raw.backend) || !Array.isArray(raw.capabilities) || raw.capabilities.some((name) => !["files", "jobs", "identity", "rootOps", "delegate"].includes(String(name))) || new Set(raw.capabilities).size !== raw.capabilities.length || (raw.entry !== undefined && !["admin-only", "app-privilege"].includes(raw.entry)))
+                if (raw.schema !== 2 || !["go", "rust", "binary"].includes(raw.backend) || !Array.isArray(raw.capabilities) || raw.capabilities.some((name) => !["files", "jobs", "identity", "rootOps", "delegate"].includes(String(name))) || new Set(raw.capabilities).size !== raw.capabilities.length || (raw.entry !== undefined && !["admin-only", "app-privilege"].includes(raw.entry)))
                     throw new Error();
                 metadata = raw;
             }
@@ -63,12 +65,18 @@ export async function inspectSpk(spkPath, expectedKind) {
                 findings.push("sdk-package.json 不符合 schema 2 capability inventory。");
             }
         }
+        const uninstallHook = metadata.uninstall === undefined ? undefined : readUninstallRecord(metadata.uninstall, metadata.capabilities?.includes("rootOps") === true);
+        if (metadata.uninstall !== undefined && !uninstallHook)
+            findings.push("UNINSTALL_RECORD_INVALID sdk-package.json 的 uninstall 不是 synopkgland build 寫出的 uninstall 設定。");
         const binaryBackend = metadata.backend === "binary";
-        const kind = expectedKind ?? (paths.has("compose.yaml") ? "container" : binaryBackend ? "binary" : "native-go");
-        const standalone = kind === "native-go" || kind === "binary";
+        // A strict standalone inspection names the language the CGI was built from.
+        const compiled = metadata.backend === "rust" ? "native-rust" : "native-go";
+        const kind = (expectedKind === "native-go" ? compiled : expectedKind) ?? (paths.has("compose.yaml") ? "container" : binaryBackend ? "binary" : compiled);
+        const compiledKind = kind === "native-go" || kind === "native-rust";
+        const standalone = compiledKind || kind === "binary";
         const info = readInfo(join(dir, "INFO"), findings, kind);
         await checkArch(dir, info, kind, paths.has(CGI_PAYLOAD_PATH), findings);
-        const background = kind === "native-go" && paths.has(BACKGROUND_WORKER_PAYLOAD);
+        const background = compiledKind && paths.has(BACKGROUND_WORKER_PAYLOAD);
         const sharedFolder = standalone ? recoverSharedFolder(readOptional(join(dir, "scripts/postinst"))) : undefined;
         // A Compose App has no executor, so its SPK never carries a portal.
         const portal = standalone ? await recoverPortal(dir, info, `SYNO.SDS.${info.package}.Instance`, paths, payload, findings) : undefined;
@@ -99,18 +107,20 @@ export async function inspectSpk(spkPath, expectedKind) {
             if (executor?.policy.portal && info.os_min_ver && OS_MIN_VER.test(info.os_min_ver) && !isDsmAtLeast(info.os_min_ver, PORTAL_EXECUTOR_MIN_DSM)) {
                 findings.push(`INFO os_min_ver「${info.os_min_ver}」低於 executor 註冊 portal 需要的 DSM ${PORTAL_EXECUTOR_MIN_DSM}`);
             }
+            if (executor && executor.policy.purge !== uninstallHook?.uninstall.purge.root)
+                findings.push(`UNINSTALL_ROOT_POLICY_MISMATCH executor policy 的 purge「${executor.policy.purge ?? ""}」與 uninstall.purge.root「${uninstallHook?.uninstall.purge.root ?? ""}」不同。`);
             if (payload.find(p => p.path === "executor/executor")?.mode !== "0755")
                 findings.push("Executor must be executable.");
             if (payload.find(p => p.path === "executor/lifecycle")?.mode !== "0755")
                 findings.push("Executor lifecycle helper must be executable.");
             if (![...paths].some(path => path.startsWith("daemon/"))) {
-                const lifecycleManifest = { package: info.package, capabilities: { rootOps: true, ...(background ? { jobs: { worker: "sha256-v1" } } : {}) } };
+                const lifecycleManifest = { package: info.package, capabilities: { rootOps: true, ...(background ? { jobs: { worker: "sha256-v1" } } : {}) }, ...(uninstallHook ? { uninstall: uninstallHook.uninstall } : {}) };
                 for (const hook of ["preuninst", "preupgrade", "start-stop-status"]) {
                     if (readOptional(join(dir, "scripts", hook)) !== renderStandaloneScript(hook, lifecycleManifest))
                         findings.push(`Executor scripts/${hook} differs from fixed lifecycle.`);
                 }
             }
-            for (const [name, text] of Object.entries(renderUninstallWizardFiles(info.package, "native", { executor: true, portal: Boolean(portal), portalEntry: Boolean(executor?.policy.portal) }))) {
+            for (const [name, text] of Object.entries(renderUninstallWizardFiles(info.package, "native", { executor: true, portal: Boolean(portal), portalEntry: Boolean(executor?.policy.portal), ...uninstallWizardOptions(uninstallHook) }))) {
                 if (readOptional(join(dir, "WIZARD_UIFILES", name)) !== text)
                     findings.push(`Executor WIZARD_UIFILES/${name} is missing cleanup guidance.`);
             }
@@ -471,10 +481,10 @@ function checkScripts(dir, findings) {
 const DATA_KEYS = ["pkgwizard_remove_additional", "delete_app_data"];
 const DELETE_COMMAND = /\brm\s+-[a-zA-Z]*[rR]|\bfind\b[^\n]*(-delete|-exec\s+rm)/;
 const UPGRADE_GUARD = /SYNOPKG_PKG_STATUS[^\n]*!=\s*"?UPGRADE"?/;
-function uninstallBoxes(file) {
+function uninstallBoxes(file, keys) {
     try {
         const steps = JSON.parse(readFileSync(file, "utf8"));
-        return steps.flatMap(step => step.items ?? []).flatMap(item => item.subitems ?? []).filter(box => DATA_KEYS.includes(box.key));
+        return steps.flatMap(step => step.items ?? []).flatMap(item => item.subitems ?? []).filter(box => keys.includes(box.key));
     }
     catch {
         return [];
@@ -486,6 +496,13 @@ function uninstallBoxes(file) {
  * package's own `/volumeN/@app*` directories; the wizard and the script must
  * agree on the box that asks for it.
  */
+/** The wizard texts of the App's uninstall hook, as build rendered them. */
+function uninstallWizardOptions(hook) {
+    if (!hook)
+        return {};
+    const { uninstall, catalogs } = hook;
+    return { rootPurge: Boolean(uninstall.purge.root), ...(uninstall.state ? { state: { items: (locale) => stateItemTexts(uninstall, catalogs, locale) } } : {}) };
+}
 function checkUninstall(dir, findings) {
     const script = join(dir, "scripts", "postuninst");
     if (!existsSync(script))
@@ -493,7 +510,8 @@ function checkUninstall(dir, findings) {
     const body = readFileSync(script, "utf8");
     const wizardDir = join(dir, "WIZARD_UIFILES");
     const wizards = existsSync(wizardDir) ? readdirSync(wizardDir).filter(name => name === "uninstall_uifile" || name.startsWith("uninstall_uifile_")).sort() : [];
-    const boxes = wizards.flatMap(name => uninstallBoxes(join(wizardDir, name)).map(box => ({ ...box, name })));
+    const boxes = wizards.flatMap(name => uninstallBoxes(join(wizardDir, name), DATA_KEYS).map(box => ({ ...box, name })));
+    checkStateBoxes(dir, wizards.flatMap(name => uninstallBoxes(join(wizardDir, name), [DELETE_STATE_KEY]).map(box => ({ ...box, name }))), findings);
     const deletes = DELETE_COMMAND.test(body);
     if (deletes) {
         if (!UPGRADE_GUARD.test(body))
@@ -514,6 +532,17 @@ function checkUninstall(dir, findings) {
             findings.push(`UNINSTALL_WIZARD_NOT_HONOURED WIZARD_UIFILES/${box.name} 提供 ${box.key} 勾選框，但 scripts/postuninst 沒有讀它`);
     }
 }
+/** The App's delete-state box keeps the state by default, and preuninst hands its answer to the App hook. */
+function checkStateBoxes(dir, boxes, findings) {
+    const script = join(dir, "scripts", "preuninst");
+    const body = existsSync(script) ? readFileSync(script, "utf8") : "";
+    for (const box of boxes) {
+        if (box.defaultValue !== false)
+            findings.push(`UNINSTALL_STATE_DEFAULT_CHECKED WIZARD_UIFILES/${box.name} 的 ${box.key} 預設必須不勾（保留 App 狀態）`);
+        if (!body.includes(box.key))
+            findings.push(`UNINSTALL_STATE_NOT_HONOURED WIZARD_UIFILES/${box.name} 提供 ${box.key} 勾選框，但 scripts/preuninst 沒有讀它`);
+    }
+}
 export async function listPayload(packageTgz, findings) {
     if (!existsSync(packageTgz)) {
         findings.push("缺少 package.tgz");

package/dist/standalone/lifecycle.js

@@ -4,6 +4,8 @@ import { renderSharedFolderScript } from "./shared-folder.js";
 import { renderDelegateInstallDraft } from '../build-spk/delegate-scope.js';
 import { renderPortalLifecycle } from "../portal/package.js";
 import { nativePortal } from "./portal.js";
+import { renderUninstallHook } from "./uninstall-hook.js";
+const UNINSTALL_ONLY = '[ "${SYNOPKG_PKG_STATUS:-}" = UPGRADE ] || synopkgland_uninstall_hook\n';
 /** Package-account lifecycle hooks for CGI, daemon and background packages. */
 export function renderStandaloneScript(name, manifest) {
     const portal = nativePortal(manifest);
@@ -43,12 +45,16 @@ function renderStandaloneScriptBody(name, manifest) {
             const stopDaemon = manifest.daemon ? `"/var/packages/${manifest.package}/target/daemon/control" stop "\${SYNOPKG_PKGDEST:-/var/packages/${manifest.package}/target}" "\${SYNOPKG_PKGVAR:-/var/packages/${manifest.package}/var}" || exit $?\n` : "";
             return normal.replace("#!/bin/sh\n", `#!/bin/sh\n${workerStop}if [ "$1" = start ]; then\n${request("start")}fi\nif [ "$1" = stop ]; then\n${stopWorker}${stopDaemon}${request("stop")}${workerResult}fi\n`);
         }
-        const action = name === "preuninst" ? '"$action"' : "stop";
-        const choose = name === "preuninst" ? 'action=purge\n[ "${SYNOPKG_PKG_STATUS:-}" != UPGRADE ] || action=stop\n' : "";
-        return `#!/bin/sh\n${workerStop}${stopWorker}${choose}${request(action)}${manifest.daemon ? renderDaemonScript(name, manifest).replace("#!/bin/sh\n", "") : workerResult}`;
+        if (name === "preuninst")
+            return renderExecutorPreuninst(manifest, workerStop, stopWorker, workerResult, request);
+        return `#!/bin/sh\n${workerStop}${stopWorker}${request("stop")}${manifest.daemon ? renderDaemonScript(name, manifest).replace("#!/bin/sh\n", "") : workerResult}`;
     }
     if (name === "postuninst")
         return renderPackagePostuninst(manifest.package);
+    if (name === "preuninst" && manifest.uninstall) {
+        const body = manifest.daemon ? renderDaemonPreuninst(manifest) : `${UNINSTALL_ONLY}exit 0\n`;
+        return `#!/bin/sh\n${renderUninstallHook(manifest)}${body}`;
+    }
     if ((manifest.capabilities?.rootOps || manifest.capabilities?.delegate) && ["postinst", "postupgrade"].includes(name)) {
         const normal = renderCapabilityScript(name, { ...manifest, capabilities: { ...manifest.capabilities, rootOps: undefined, delegate: undefined } });
         return normal.replace("#!/bin/sh\n", `#!/bin/sh\n"\${SYNOPKG_PKGDEST:-/var/packages/${manifest.package}/target}/executor/lifecycle" start --package ${manifest.package} || exit $?\n`);
@@ -84,7 +90,11 @@ function renderDelegatedDaemonScript(name, manifest) {
     if (name !== 'start-stop-status') {
         if (name === 'preupgrade')
             return `#!/bin/sh\n${workerStop}${stop('stop', 'stop')}`;
-        return `#!/bin/sh\n${workerStop}if [ "\${SYNOPKG_PKG_STATUS:-}" = UPGRADE ]; then\n${stop('stop', 'stop')}fi\n${stop(manifest.daemon?.uninstall_args ? 'uninstall' : 'stop', 'purge')}`;
+        const purge = manifest.uninstall
+            ? stop(manifest.daemon?.uninstall_args ? 'uninstall' : 'stop', 'purge $synopkgland_purge_args')
+                .replace(executor('purge $synopkgland_purge_args'), () => `synopkgland_uninstall_hook\n${executor('purge $synopkgland_purge_args')}`)
+            : stop(manifest.daemon?.uninstall_args ? 'uninstall' : 'stop', 'purge');
+        return `#!/bin/sh\n${workerStop}${renderUninstallHook(manifest)}if [ "\${SYNOPKG_PKG_STATUS:-}" = UPGRADE ]; then\n${stop('stop', 'stop')}fi\n${purge}`;
     }
     return `#!/bin/sh
 ${workerStop}${renderUserManagerRecovery()}${renderBackgroundWorkerStart(pkg)}case "$1" in
@@ -143,3 +153,27 @@ case "$1" in
 esac
 `;
 }
+/**
+ * A real uninstall stops the daemon, runs the App hook, then asks the
+ * executor to purge; an upgrade only stops both.
+ */
+function renderExecutorPreuninst(manifest, workerStop, stopWorker, workerResult, request) {
+    const pkg = manifest.package;
+    const choose = 'action=purge\n[ "${SYNOPKG_PKG_STATUS:-}" != UPGRADE ] || action=stop\n';
+    const hook = manifest.uninstall ? '[ "$action" = stop ] || synopkgland_uninstall_hook\n' : "";
+    const purge = request(manifest.uninstall ? '"$action" $synopkgland_purge_args' : '"$action"');
+    if (!manifest.daemon)
+        return `#!/bin/sh\n${workerStop}${renderUninstallHook(manifest)}${stopWorker}${choose}${hook}${purge}${workerResult}`;
+    const control = `"/var/packages/${pkg}/target/daemon/control"`;
+    const paths = `"\${SYNOPKG_PKGDEST:-/var/packages/${pkg}/target}" "\${SYNOPKG_PKGVAR:-/var/packages/${pkg}/var}"`;
+    const daemonAction = manifest.daemon.uninstall_args ? 'daemon_action=stop\n[ "$action" = stop ] || daemon_action=uninstall\n' : "daemon_action=stop\n";
+    return `#!/bin/sh\n${workerStop}${renderUninstallHook(manifest)}${stopWorker}${choose}${daemonAction}daemon_result=0\n${control} "$daemon_action" ${paths} || daemon_result=$?\n${hook}${purge}exit "$daemon_result"\n`;
+}
+/** The daemon stops (or uninstalls) first; the App hook follows on a real uninstall. */
+function renderDaemonPreuninst(manifest) {
+    const pkg = manifest.package;
+    const control = `"/var/packages/${pkg}/target/daemon/control"`;
+    const paths = `"\${SYNOPKG_PKGDEST:-/var/packages/${pkg}/target}" "\${SYNOPKG_PKGVAR:-/var/packages/${pkg}/var}"`;
+    return `if [ "\${SYNOPKG_PKG_STATUS:-}" = UPGRADE ]; then\n  exec ${control} stop ${paths}\nfi\n`
+        + `${control} ${manifest.daemon?.uninstall_args ? "uninstall" : "stop"} ${paths}\ndaemon_result=$?\nsynopkgland_uninstall_hook\nexit "$daemon_result"\n`;
+}

package/dist/standalone/manifest.d.ts

@@ -6,10 +6,12 @@ import { type Catalogs, type InfoTranslations } from "./i18n.js";
 export type { InfoText } from "./i18n.js";
 import { type RootOp } from "./root-ops.js";
 import { type Daemon } from "./daemon.js";
+import { type Uninstall } from "./uninstall.js";
 import { type Background } from "./background.js";
 import { type SharedFolder } from "./shared-folder.js";
 import { type ApiPermissions } from "./api-permissions.js";
 import { type PortalDeclaration } from "../portal/alias.js";
+import { type SdkBackend } from "../runtime/sdk-source.js";
 /**
  * `dsm-package.yaml`: a Standalone Package, i.e. an unsigned native SPK that
  * runs as its own DSM package account with a CGI backend and a DSM window UI.
@@ -19,6 +21,12 @@ export type StandaloneBackend = {
     kind: "go";
     dir: string;
     main: string;
+} | {
+    kind: "rust";
+    dir: string;
+    package: string;
+    bin: string;
+    worker: string;
 } | {
     kind: "binary";
     files: Partial<Record<NativeArchFamily, string>>;
@@ -63,6 +71,8 @@ export interface StandaloneManifest {
         tasks: ExecutorTask[];
     };
     daemon?: Daemon;
+    /** `uninstall`: the App's own purge hook and the state the wizard may delete. */
+    uninstall?: Uninstall;
     /** `install.sharedFolder`: the Shared Folder the install wizard selects or `data-share` creates. */
     sharedFolder?: SharedFolder;
     /** Who may use the app at all; absent keeps the route policy alone. */
@@ -97,6 +107,8 @@ export type ManifestResult = {
 };
 export declare const KNOWN_FIELDS: Set<string>;
 export declare function loadStandaloneManifest(root: string): ManifestResult;
+/** Where an App's SDK version is declared: its Go or Rust backend; a prebuilt binary declares it in the project's go.mod. */
+export declare function sdkBackend(m: Pick<StandaloneManifest, "backend" | "root">): SdkBackend;
 /**
  * The nearest directory at or above `start` that holds dsm-package.yaml,
  * unless a Managed Profile project (synology-app.yaml) is found first.

package/dist/standalone/manifest.js

@@ -7,14 +7,15 @@ import { isNativeArchFamily } from "../build-spk/dsm-arch.js";
 import { checkGlossary, loadCatalogs, readInfoTranslations } from "./i18n.js";
 import { loadRootOps, ROOT_OPS_DIR } from "./root-ops.js";
 import { readDaemon } from "./daemon.js";
+import { readUninstall } from "./uninstall.js";
 import { readBackground } from "./background.js";
 import { DEFAULT_MIN_DSM, isDsmAtLeast, PORTAL_EXECUTOR_MIN_DSM, portalByExecutor, portalMinDsmMessage } from "../build-spk/dsm-version.js";
 import { readSharedFolder } from "./shared-folder.js";
-import { floorAtAdministrators, permitsOrdinaryUsers, readApiPermissions } from "./api-permissions.js";
+import { API_PERMISSIONS_FILE, floorAtAdministrators, permitsOrdinaryUsers, readApiPermissions } from "./api-permissions.js";
 import { PORTAL_REQUIRES_EXECUTOR, portalEntryProblem, readPortalDeclaration } from "../portal/alias.js";
 import { renderPackageIcons } from "../build-spk/dsm-icons.js";
 import { validateReproducible } from "../reproducible-config.js";
-import { SDK_MODULE, sdkRequirement } from "../runtime/sdk-source.js";
+import { appSdkVersion, SDK_CRATE, SDK_MODULE } from "../runtime/sdk-source.js";
 import { sdkProblems } from "./sdk-check.js";
 /**
  * `dsm-package.yaml`: a Standalone Package, i.e. an unsigned native SPK that
@@ -23,13 +24,15 @@ import { sdkProblems } from "./sdk-check.js";
 export const STANDALONE_MANIFEST = "dsm-package.yaml";
 export const KNOWN_FIELDS = new Set([
     "schema", "package", "version", "build", "displayname", "description",
-    "metadata", "maintainer", "os_min_ver", "arches", "backend", "ui", "capabilities", "i18n", "daemon", "install", "entry", "portal", "icon", "reproducible",
+    "metadata", "maintainer", "os_min_ver", "arches", "backend", "ui", "capabilities", "i18n", "daemon", "install", "uninstall", "entry", "portal", "icon", "reproducible",
 ]);
 const I18N_FIELDS = new Set(["messages", "glossary", "info"]);
 const PACKAGE_ID = /^[A-Za-z][A-Za-z0-9]{1,63}$/;
 const VERSION = /^\d+(\.\d+){0,3}$/;
 const OS_MIN_VER = /^\d+\.\d+(\.\d+)?-\d+$/;
 const GO_MAIN = /^\.\/[A-Za-z0-9_./-]*$/;
+/** A Cargo package or binary name. */
+const CARGO_NAME = /^[A-Za-z][A-Za-z0-9_-]{0,63}$/;
 function isRecord(value) {
     return typeof value === "object" && value !== null && !Array.isArray(value);
 }
@@ -132,17 +135,19 @@ function readManifest(raw, c) {
     const arches = readArches(raw.arches, c);
     const backend = arches && readBackend(raw.backend, arches, c);
     let permissions;
-    if (backend?.kind === "go") {
+    if (backend && backend.kind !== "binary") {
         try {
-            permissions = readApiPermissions(backend.dir, capabilities);
+            permissions = readApiPermissions(backend, capabilities);
         }
         catch (error) {
-            // The SDK's own routes come from its module; a failed download is not a policy problem.
-            const download = /^\[SDK_DOWNLOAD_FAILED\] ([\s\S]*)$/.exec(error.message);
+            // The SDK's own routes come from its module; a failed download or an
+            // untagged SDK (reported by sdkProblems) is not a policy problem.
+            const message = error.message;
+            const download = /^\[SDK_DOWNLOAD_FAILED\] ([\s\S]*)$/.exec(message);
             if (download)
                 c.fail("SDK_DOWNLOAD_FAILED", download[1]);
-            else
-                c.fail("STANDALONE_API_PERMISSIONS_INVALID", `backend/internal/api/permissions.json must define the centralized API policy: ${String(error)}`);
+            else if (!message.startsWith("[SDK_TAG_REQUIRED]"))
+                c.fail("STANDALONE_API_PERMISSIONS_INVALID", `backend/${API_PERMISSIONS_FILE[backend.kind]} must define the centralized API policy: ${String(error)}`);
         }
     }
     const daemon = arches && readDaemon(raw.daemon, c.root, arches, e => c.fail(e.code, e.message));
@@ -169,12 +174,13 @@ function readManifest(raw, c) {
         c.fail("CAPABILITY_COMBINATION_INVALID", "capabilities.identity 需要獨立登入頁；plain UI 不支援，請改用 vue UI（init --ui vue）。");
     if (capabilities.delegate?.scope === "install-selected" && ui && !ui.build)
         c.fail("CAPABILITY_COMBINATION_INVALID", "delegate scope install-selected 只能在 Vue 面板確認；plain UI 不支援，請改用 vue UI（init --ui vue）。");
-    if (backend?.kind === "go") {
-        for (const problem of sdkProblems(backend.dir, ui?.build?.cwd, Boolean(capabilities.delegate || capabilities.rootOps)))
+    if (backend && backend.kind !== "binary") {
+        for (const problem of sdkProblems(backend, ui?.build?.cwd, Boolean(capabilities.delegate || capabilities.rootOps)))
             c.fail(problem.code, problem.message);
     }
     const i18n = raw.i18n === undefined ? undefined : readI18n(raw.i18n, c);
     const icon = raw.icon === undefined ? undefined : readIcon(raw.icon, c);
+    const uninstall = readUninstall(raw.uninstall, { rootOps: capabilities.rootOps === true, ops: rootOps, en: i18n?.catalogs?.en }, e => c.fail(e.code, e.message));
     const portal = raw.portal === undefined || !packageId ? undefined : readPortalDeclaration(raw.portal, packageId)
         ?? c.fail("STANDALONE_PORTAL_INVALID", "portal 必須是 {} 或 { alias: <小寫英數與 -，1–64 字，不可為 DSM 保留路徑> }。");
     if (portal && !capabilities.rootOps && !capabilities.delegate) {
@@ -210,12 +216,17 @@ function readManifest(raw, c) {
         capabilities,
         ...(rootOps ? { rootOps } : {}),
         ...(daemon ? { daemon } : {}),
+        ...(uninstall ? { uninstall } : {}),
         ...(sharedFolder ? { sharedFolder } : {}),
         ...(entry ? { entry } : {}),
         ...(portal ? { portal } : {}),
         ...(icon ? { icon } : {}),
     };
 }
+/** Where an App's SDK version is declared: its Go or Rust backend; a prebuilt binary declares it in the project's go.mod. */
+export function sdkBackend(m) {
+    return m.backend.kind === "binary" ? { kind: "go", dir: m.root } : m.backend;
+}
 function readIcon(value, c) {
     const path = c.path(value, "icon");
     if (!path)
@@ -228,6 +239,20 @@ function readIcon(value, c) {
         return c.fail("STANDALONE_ICON_INVALID", `icon：${error.message}`);
     }
 }
+/** Where each backend kind's CGI main wraps its authenticator in the SDK entry gate. */
+const ENTRY_GATE = {
+    go: { main: b => b.kind === "go" ? join(b.dir, b.main, "main.go") : "", call: "dsm.NewEntryGate(", sdk: `backend/go.mod 要 require ${SDK_MODULE}` },
+    rust: { main: b => b.kind === "rust" ? join(b.dir, "src/bin", `${b.bin}.rs`) : "", call: "new_entry_gate(", sdk: `backend/Cargo.toml 要以 release tag 相依 ${SDK_CRATE}` },
+};
+/** The SDK version, or none when the backend has none or pins it wrongly (reported by sdkProblems). */
+function sdkVersionOrUndefined(backend) {
+    try {
+        return appSdkVersion(backend);
+    }
+    catch {
+        return undefined;
+    }
+}
 /**
  * The CGI enforces the entry mode only when the project's backend carries the
  * SDK gate and main wires it; `-X main.entry` on an older main would be
@@ -239,11 +264,12 @@ function readEntry(value, backend, policy, c) {
     }
     if (!backend)
         return undefined;
-    const main = backend.kind === "go" ? join(backend.dir, backend.main, "main.go") : "";
-    if (backend.kind !== "go" || !sdkRequirement(backend.dir)
-        || !existsSync(main) || !readFileSync(main, "utf8").includes("dsm.NewEntryGate(")) {
+    const gate = ENTRY_GATE[backend.kind];
+    const main = gate?.main(backend) ?? "";
+    if (!gate || !sdkVersionOrUndefined(backend)
+        || !existsSync(main) || !readFileSync(main, "utf8").includes(gate.call)) {
         const shown = main ? relative(c.root, main) : "backend.main 的 main.go";
-        return c.fail("STANDALONE_ENTRY_UNSUPPORTED", `entry 需要 SDK 的 entry gate：backend/go.mod 要 require ${SDK_MODULE}，並在 ${shown} 以 dsm.NewEntryGate 包住 authenticator。`);
+        return c.fail("STANDALONE_ENTRY_UNSUPPORTED", `entry 需要 SDK 的 entry gate：${gate?.sdk ?? `backend/go.mod 要 require ${SDK_MODULE}`}，並在 ${shown} 以 ${gate?.call.slice(0, -1) ?? "dsm.NewEntryGate"} 包住 authenticator。`);
     }
     if (value === "app-privilege" && !permitsOrdinaryUsers(policy)) {
         return c.fail("STANDALONE_ENTRY_INVALID", "entry: app-privilege 需要至少一個 permissions.json 標為 authenticated 的 route，一般使用者才有功能可用。");
@@ -274,9 +300,11 @@ function readArches(value, c) {
         : c.fail("STANDALONE_ARCHES_INVALID", "arches 必須是不重複的 x86_64／aarch64／armv7 清單，至少一個。");
 }
 function readBackend(value, arches, c) {
-    if (!isRecord(value) || !["go", "binary"].includes(String(value.kind))) {
-        return c.fail("STANDALONE_BACKEND_INVALID", "backend.kind 必須是 go 或 binary。");
+    if (!isRecord(value) || !["go", "rust", "binary"].includes(String(value.kind))) {
+        return c.fail("STANDALONE_BACKEND_INVALID", "backend.kind 必須是 go、rust 或 binary。");
     }
+    if (value.kind === "rust")
+        return readRustBackend(value, c);
     if (value.kind === "go") {
         if (Object.keys(value).some(key => !["kind", "dir", "main"].includes(key)) || (value.main !== undefined && (typeof value.main !== "string" || !GO_MAIN.test(value.main) || value.main.includes("..")))) {
             return c.fail("STANDALONE_BACKEND_INVALID", "backend.kind: go 需要 dir，可選 main（預設 ./cmd/app）。");
@@ -303,6 +331,16 @@ function readBackend(value, arches, c) {
     }
     return Object.values(files).every(Boolean) ? { kind: "binary", files } : undefined;
 }
+function readRustBackend(value, c) {
+    const { package: pkg, bin = "api", worker = "background-worker" } = value;
+    const names = [pkg, bin, worker];
+    if (Object.keys(value).some(key => !["kind", "dir", "package", "bin", "worker"].includes(key))
+        || !names.every(name => typeof name === "string" && CARGO_NAME.test(name)) || bin === worker) {
+        return c.fail("STANDALONE_BACKEND_INVALID", "backend.kind: rust 需要 dir 與 package（Cargo package），可選 bin（CGI，預設 api）與 worker（背景程序，預設 background-worker），兩者不可相同。");
+    }
+    const dir = c.path(value.dir, "backend.dir");
+    return dir ? { kind: "rust", dir, package: pkg, bin: bin, worker: worker } : undefined;
+}
 function readUi(value, c) {
     if (!isRecord(value)) {
         return c.fail("STANDALONE_UI_INVALID", "ui 必須包含 dir。");

package/dist/standalone/native-layout.d.ts

@@ -1,5 +1,6 @@
 import { type PackageMetadata } from "../package-metadata.js";
 import type { CommandRunner } from './build.js';
+import { type Toolkit } from './toolkit.js';
 import { type PortalDeclaration } from '../portal/alias.js';
 export declare const LAYOUT_ARCHES: {
     readonly x86_64: readonly [2, 62];
@@ -13,10 +14,6 @@ type Hook = {
     cwd: string;
     env: Record<string, string>;
 };
-type Toolkit = {
-    url: string;
-    sha256: string;
-};
 type Binary = {
     path: string;
     linkage: 'static' | 'dynamic';
@@ -65,9 +62,6 @@ export declare function loadNativeLayout(root: string): {
         message: string;
     }[];
 };
-export declare function verifyToolkitArchive(path: string, expected: string): void;
-/** One cache per user, shared by every project and worktree; archives are checked against sha256 on every use. */
-export declare function toolkitCacheDir(env: Record<string, string | undefined>, platform: string, home: string): string;
 export declare function layoutFiles(root: string): Array<{
     path: string;
     mode: number;

package/dist/standalone/native-layout.js

@@ -1,13 +1,14 @@
 import { validateMetadata, metadataInfoFields } from "../package-metadata.js";
 /** Existing native products: the CLI owns archives/INFO, the project owns its layout. */
 import { createHash } from 'node:crypto';
-import { chmodSync, copyFileSync, existsSync, lstatSync, mkdirSync, mkdtempSync, readFileSync, readdirSync, realpathSync, renameSync, rmSync, writeFileSync } from 'node:fs';
-import { homedir, tmpdir } from 'node:os';
+import { chmodSync, copyFileSync, existsSync, lstatSync, mkdirSync, mkdtempSync, readFileSync, readdirSync, realpathSync, rmSync, writeFileSync } from 'node:fs';
+import { tmpdir } from 'node:os';
 import { dirname, isAbsolute, join, relative, resolve } from 'node:path';
 import { parse } from 'yaml';
 import { createReproducibleTar } from '../build-spk/reproducible-archive.js';
 import { runCommand, runnerFor } from './build.js';
 import { checkJobs, commitOutputs, forEachArch } from './arch-jobs.js';
+import { prepareToolkit } from './toolkit.js';
 import { validateReproducible } from '../reproducible-config.js';
 import { isDsmAtLeast, PORTAL_EXECUTOR_MIN_DSM, resolveMinDsm } from '../build-spk/dsm-version.js';
 import { portalEntryProblem, readPortalDeclaration } from '../portal/alias.js';
@@ -164,100 +165,6 @@ export function loadNativeLayout(root) {
         return { ok: false, errors: [{ code: 'NATIVE_LAYOUT_INVALID', message: String(error) }] };
     }
 }
-export function verifyToolkitArchive(path, expected) {
-    if (!lstatSync(path).isFile() || digest(readFileSync(path)) !== expected)
-        fail('toolkit checksum mismatch');
-}
-/** One cache per user, shared by every project and worktree; archives are checked against sha256 on every use. */
-export function toolkitCacheDir(env, platform, home) {
-    if (env.SYNOPKGLAND_CACHE_DIR)
-        return resolve(env.SYNOPKGLAND_CACHE_DIR);
-    if (platform === 'darwin')
-        return join(home, 'Library', 'Caches', 'synopkgland');
-    const xdg = env.XDG_CACHE_HOME;
-    return join(xdg && isAbsolute(xdg) ? xdg : join(home, '.cache'), 'synopkgland');
-}
-// Concurrent architectures that pin the same archive share one download.
-const downloads = new Map();
-async function download(m, cache, input, archive, run) {
-    const tmp = mkdtempSync(join(cache, '.download-'));
-    try {
-        const out = join(tmp, 'archive');
-        const r = await run('curl', ['--fail', '--location', '--proto', '=https', '--proto-redir', '=https', '--retry', '2', '--retry-all-errors', '--connect-timeout', '20', '--max-time', '600', '--output', out, input.url], { cwd: m.root, env: { ...process.env } });
-        if (r.status !== 0)
-            fail('toolkit download failed');
-        // Rename is atomic, so another build process sees either no archive or a verified one.
-        verifyToolkitArchive(out, input.sha256);
-        renameSync(out, archive);
-    }
-    finally {
-        rmSync(tmp, { recursive: true, force: true });
-    }
-}
-async function toolkitFor(m, arch, run) {
-    const inputs = m.native.toolkits[arch] ?? [];
-    if (!inputs.length)
-        return '';
-    const cache = toolkitCacheDir(process.env, process.platform, homedir());
-    mkdirSync(cache, { recursive: true, mode: 0o700 });
-    if (lstatSync(cache).isSymbolicLink() || (lstatSync(cache).mode & 0o022))
-        fail('toolkit cache must be owned and private');
-    const archives = [];
-    for (const input of inputs) {
-        const archive = join(cache, `${input.sha256}.txz`);
-        if (!existsSync(archive)) {
-            let pending = downloads.get(archive);
-            if (!pending) {
-                pending = download(m, cache, input, archive, run).finally(() => downloads.delete(archive));
-                downloads.set(archive, pending);
-            }
-            await pending;
-        }
-        verifyToolkitArchive(archive, input.sha256);
-        archives.push(archive);
-    }
-    // Re-extract verified bytes: a package-writable marker never authenticates an extracted tree.
-    const stage = mkdtempSync(join(cache, `toolkit-${arch}-`));
-    try {
-        const flavor = await tarFlavor(m, run);
-        for (const archive of archives) {
-            if (flavor === 'bsdtar')
-                await refuseEscapingMembers(m, archive, run);
-            const r = await run('tar', flavor === 'gnu' ? ['-xJf', archive, '-C', stage, '--keep-directory-symlink'] : ['-xPJf', archive, '-C', stage], { cwd: m.root, env: { ...process.env } });
-            if (r.status !== 0)
-                fail('toolkit extraction failed');
-        }
-        return stage;
-    }
-    catch (e) {
-        rmSync(stage, { recursive: true, force: true });
-        throw e;
-    }
-}
-/**
- * A later toolkit archive may write through a directory symlink an earlier one
- * created. GNU tar keeps such a symlink only with --keep-directory-symlink;
- * bsdtar only with -P, which also allows absolute and .. members, so those are
- * refused from the listing first.
- */
-async function tarFlavor(m, run) {
-    const r = await run('tar', ['--version'], { cwd: m.root, env: { ...process.env }, capture: true });
-    const version = r.status === 0 ? r.stdout ?? '' : '';
-    if (/\bGNU tar\b/.test(version))
-        return 'gnu';
-    if (/\bbsdtar\b/.test(version))
-        return 'bsdtar';
-    throw Object.assign(new Error(`NATIVE_TOOLKIT_TAR_UNSUPPORTED: extracting native.toolkits needs GNU tar or bsdtar as \`tar\`; found ${r.missing ? 'no tar' : JSON.stringify(version.split('\n')[0] ?? '')}`), { code: 'NATIVE_TOOLKIT_TAR_UNSUPPORTED' });
-}
-async function refuseEscapingMembers(m, archive, run) {
-    const r = await run('tar', ['-tJf', archive], { cwd: m.root, env: { ...process.env }, capture: true });
-    if (r.status !== 0)
-        fail('toolkit extraction failed');
-    for (const member of (r.stdout ?? '').split('\n').filter(Boolean)) {
-        if (member.startsWith('/') || member.split('/').includes('..'))
-            fail(`toolkit member escapes the toolkit folder: ${member}`);
-    }
-}
 async function runHook(m, h, env, run) {
     const [cmd, ...args] = h.command;
     const r = await run(cmd, args, { cwd: inside(m.root, h.cwd), env: { ...process.env, ...h.env, ...env } });
@@ -396,7 +303,7 @@ export async function buildNativeLayout(options) {
         await runHook(m, m.native.prepare, env, options.run ?? runCommand);
     const outputs = await commitOutputs(options.outDir ?? join(m.root, 'dist'), (outDir) => forEachArch(arches, jobs, async (arch) => {
         const run = runnerFor(options.run, jobs, arch);
-        const toolkit = await toolkitFor(m, arch, run);
+        const toolkit = await prepareToolkit(m.root, arch, m.native.toolkits[arch] ?? [], run);
         const stage = mkdtempSync(join(tmpdir(), 'synopkgland-layout-'));
         const work = mkdtempSync(join(tmpdir(), 'synopkgland-work-'));
         try {

package/dist/standalone/root-ops.d.ts

@@ -12,4 +12,6 @@ export type RootOpsResult = {
     errors: StandaloneError[];
 };
 export declare const ROOT_OPS_DIR = "root";
+/** Shell that tries to become root: sudo, chown root or setuid/setgid modes. */
+export declare const ROOT_SCRIPT_HINTS: RegExp[];
 export declare function loadRootOps(dir: string): RootOpsResult;

package/dist/standalone/root-ops.js

@@ -1,6 +1,8 @@
 import { existsSync, lstatSync, readdirSync, readFileSync } from "node:fs";
 import { join } from "node:path";
 export const ROOT_OPS_DIR = "root";
+/** Shell that tries to become root: sudo, chown root or setuid/setgid modes. */
+export const ROOT_SCRIPT_HINTS = [/\bsudo\b/, /\bchown\s+(-\w+\s+)*root\b/, /chmod\s+[ugo]*\+s\b/, /chmod\s+[2467][0-7]{3}\b/];
 const MAX_ROOT_OP_BYTES = 16 * 1024;
 const OP_FILE = /^([a-z][a-z0-9_]{0,31})\.sh$/;
 export function loadRootOps(dir) {

package/dist/standalone/rust-build.d.ts

@@ -0,0 +1,35 @@
+import type { NativeArchFamily } from "../build-spk/dsm-arch.js";
+import type { CommandRunner } from "./build.js";
+import type { StandaloneManifest } from "./manifest.js";
+import { type Toolkit } from "./toolkit.js";
+/** The glibc loader of DSM's ARMv7 models, the one interpreter an armv7 Rust CGI may name. */
+export declare const ARMV7_INTERPRETER = "/lib/ld-linux-armhf.so.3";
+interface RustTarget {
+    triple: string;
+    /** The linker, given the extracted toolkit folder when the target pins one. */
+    linker: (toolkit: string) => string;
+    linkArgs: string[];
+    toolkit?: Toolkit;
+    interpreter?: string;
+}
+/**
+ * x86_64 and aarch64 link static musl binaries with rust-lld. armv7 links
+ * against the glibc of the DSM 7.0 toolkit, because musl's 64-bit time calls
+ * fail on DSM's ARMv7 kernels; that gcc runs on Linux x86_64 only.
+ */
+export declare const RUST_TARGETS: Record<NativeArchFamily, RustTarget>;
+/** Go's `-X` values for a Rust App, read with `option_env!`; every one is set, empty when unused. */
+export declare function rustBuildEnv(manifest: StandaloneManifest): Record<string, string>;
+export interface RustBuildDeps {
+    host?: {
+        platform: string;
+        arch: string;
+    };
+    prepareToolkit?: (cwd: string, arch: string, inputs: Toolkit[], run: CommandRunner) => Promise<string>;
+}
+/** Builds the CGI bin, and the worker bin with capabilities.jobs, in one `cargo build` into `work`. */
+export declare function buildRustBackend(manifest: StandaloneManifest, arch: NativeArchFamily, work: string, run: CommandRunner, { host, prepareToolkit: prepare }?: RustBuildDeps): Promise<{
+    cgi: string;
+    worker?: string;
+}>;
+export {};