@synopackageland/cli 0.9.7 → 0.10.0

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@synopackageland/cli",
-  "version": "0.9.7",
+  "version": "0.10.0",
   "description": "Syno Package Land Developer Kit CLI",
   "type": "module",
   "bin": {
@@ -24,7 +24,7 @@
     "prepublishOnly": "npm run build"
   },
   "dependencies": {
-    "@synopackageland/templates": "0.9.7",
+    "@synopackageland/templates": "0.10.0",
     "ajv": "^8.17.1",
     "commander": "^13.1.0",
     "tar": "^7.4.3",

package/schema/bridge-manifest.v1.schema.json

@@ -0,0 +1,86 @@
+{
+  "$schema": "https://json-schema.org/draft/2020-12/schema",
+  "$id": "https://github.com/synopackageland/syno-pkg-land-sdk/spec/bridge/v1/manifest.schema.json",
+  "title": "bridge.json: the App manifest the package build writes and the runtime reads",
+  "type": "object",
+  "additionalProperties": false,
+  "required": ["schema", "runtime", "entry", "mode", "methods"],
+  "properties": {
+    "schema": { "const": 1 },
+    "runtime": { "enum": ["python", "node", "rust"], "$comment": "The App's language. rust: a thin App on the syno-pkg-land-app crate, built for the package's architecture." },
+    "entry": {
+      "type": "string",
+      "minLength": 1,
+      "maxLength": 255,
+      "pattern": "^(?!/)(?!.*(^|/)\\.\\.?(/|$))[A-Za-z0-9._/-]+$",
+      "$comment": "Relative to the App directory, inside it. python: the script, run as <python3> <entry>. node: the module, run as <node> <entry>. rust: the executable, run directly."
+    },
+    "mode": { "const": "exec", "$comment": "One process per call. \"socket\" is reserved for a later version and refused by v1 runtimes." },
+    "methods": {
+      "type": "array",
+      "minItems": 1,
+      "maxItems": 1024,
+      "uniqueItems": true,
+      "items": { "type": "string", "pattern": "^[a-z][a-z0-9_]*(\\.[a-z][a-z0-9_]*)+$" },
+      "$comment": "The App's methods. The App's hello MUST list exactly these. They MUST NOT be SDK methods (api/sdk-permissions.json)."
+    },
+    "access": { "enum": ["admin-only", "app-privilege"], "$comment": "Entry restriction (dsm.NewEntryGate). Absent: permissions.json alone decides." },
+    "timeout_seconds": { "type": "integer", "minimum": 1, "maximum": 3600, "$comment": "Request deadline. Absent: api.DefaultRequestTimeout (60 s). The browser client must wait longer." },
+    "max_request_bytes": { "type": "integer", "minimum": 1, "maximum": 16777216, "$comment": "JSON request body limit. Absent: api.MaxRequestBytes." },
+    "env": {
+      "type": "object",
+      "maxProperties": 64,
+      "propertyNames": { "pattern": "^(?!HTTP_|SYNOPKGLAND_|LD_|DYLD_|PATH$)[A-Z_][A-Z0-9_]{0,63}$" },
+      "additionalProperties": { "type": "string", "maxLength": 4096, "pattern": "^[^\\u0000]*$" },
+      "$comment": "Extra environment for the App, on top of what the runtime sets (README, App manifest). Nothing is inherited from the CGI."
+    },
+    "node": {
+      "type": "object",
+      "additionalProperties": false,
+      "required": ["package"],
+      "properties": {
+        "package": { "type": "string", "pattern": "^Node\\.js_v[0-9]{2}$", "$comment": "Package Center package the SPK depends on; the runtime runs /var/packages/<package>/target/usr/local/bin/node." }
+      },
+      "$comment": "Required when runtime is node, absent otherwise."
+    },
+    "transfers": {
+      "type": "object",
+      "maxProperties": 1024,
+      "propertyNames": { "pattern": "^[a-z][a-z0-9_]*(\\.[a-z][a-z0-9_]*)+$" },
+      "additionalProperties": { "enum": ["upload", "download"] },
+      "$comment": "Added in v1 (additive). Methods of `methods` the browser calls as an HTTP transfer (?method=): upload streams the request body into the spool, download streams the file the App wrote there (README, Transfers)."
+    },
+    "max_upload_bytes": { "type": "integer", "minimum": 1, "maximum": 17179869184, "$comment": "Added in v1 (additive). Upload limit. Absent: 16 GiB (filestation.MaxUploadBytes)." },
+    "capabilities": {
+      "type": "object",
+      "additionalProperties": false,
+      "properties": {
+        "files": { "const": "session", "$comment": "Serves the nas.* File Station routes with the caller's DSM session, and the svc files.*." },
+        "identity": { "const": "standalone", "$comment": "The SDK's App sign-in (identity.*) authenticates instead of DSM." },
+        "portal": { "type": "boolean", "$comment": "true serves portal.status, to the browser and as the svc portal.status." },
+        "jobs": { "type": "boolean", "$comment": "Added in v1 (additive). true offers the svc bg.submit, bg.get and bg.cancel on the package's job store." },
+        "root": { "type": "boolean", "$comment": "Added in v1 (additive). true offers the svc root.run, root.start, root.jobs.list, root.jobs.get and root.jobs.stop: the runtime forwards them to the package's executor with the request's DSM session, and the executor's policy and the App privilege decide." },
+        "delegate": {
+          "type": "object",
+          "additionalProperties": false,
+          "required": ["scope", "destinations", "executor_digest", "policy_digest"],
+          "properties": {
+            "scope": { "type": "string", "pattern": "^(home|install-selected|shared:[^/\\\\:\\u0000-\\u001f]{1,255})$" },
+            "destinations": { "type": "array", "minItems": 1, "maxItems": 64, "uniqueItems": true, "items": { "type": "string", "pattern": "^[a-z][a-z0-9_-]{0,63}$" } },
+            "executor_digest": { "type": "string", "pattern": "^[0-9a-f]{64}$" },
+            "policy_digest": { "type": "string", "pattern": "^[0-9a-f]{64}$" }
+          },
+          "$comment": "Added in v1 (additive). The package's executor integration (lifetime until-revoked, operation files.moveFromStaging): serves the delegate.* routes and the svc delegate.*."
+        }
+      },
+      "$comment": "SDK routes the runtime serves in Go, never through the App. Later versions add capabilities as new members."
+    }
+  },
+  "allOf": [
+    {
+      "if": { "properties": { "runtime": { "const": "node" } } },
+      "then": { "required": ["node"] },
+      "else": { "not": { "required": ["node"] } }
+    }
+  ]
+}

package/skills/reference/create.md

@@ -1,9 +1,10 @@
 # 建立（Create）
 
-先選擇 `native-go`（Go CGI + DSM 視窗）、`binary`（預建服務程式）或 `compose`（上游容器）。`compose` 預設示範 Share 與固定 run-as 使用者，`--from <compose.yaml>` 匯入現有 Compose。
+先選擇 `native-go`（Go CGI + DSM 視窗）、`native-python`／`native-node`／`native-rust`（同一個 App，backend 換成 Python、Node.js（TypeScript）或 Rust）、`binary`（預建服務程式）或 `compose`（上游容器）。`compose` 預設示範 Share 與固定 run-as 使用者，`--from <compose.yaml>` 匯入現有 Compose。
 
 ```sh
 synopkgland init -t native-go --with files,jobs,login --package MyApp my-app
+synopkgland init -t native-python --with jobs,delegate my-py-app
 synopkgland init -t binary service
 synopkgland init -t compose --from ./compose.yaml upstream-app
 ```
@@ -22,7 +23,7 @@ synopkgland init -t compose --from ./compose.yaml upstream-app
 
 執行 check、build、inspect，再看 deploy --dry-run。Go CGI 每包驗證 DSM session，root-ops 能力只提供固定管理員核准工作。容器必須使用已建置映像；不支援的特權 host 存取、secret/config 與 build stanza 會拒絕。
 
-安裝前讀 deploy.md。需要資料或登入時讀 files.md、identity.md；不加入尚未實作的 bridge。
+安裝前讀 deploy.md。需要資料或登入時讀 files.md、identity.md。
 
 ## Schema 2 能力
 
@@ -33,11 +34,84 @@ check、inspect、build、deploy、status 支援 `--json`，stdout 只有單一
 
 rootOps 與 delegate 已共用管理員 PasswordConfirm 核准的 protected executor、boot/control tasks；精確 task readback 與 digest health 一致才 ready；policy（operations、scope、root 腳本）變更須重核准，policy 不變的 executor 更新會自動 repin，install-selected 的 scope 需管理員確認一次。Vue App 只在 SDK 的 ExecutorSettings 核准；plain UI 由 DSM 視窗面板核准，兩者都在面板內輸入密碼並走 PasswordConfirm。native 產品另可明確 opt-in authorization-sdk adapter，不與 generated executor tasks 混用。SDK off stub 與 routes_test.go 的預設 policy scaffold 只有內容仍等於 bundled base 時才會替換；App 自訂版本拒絕。
 
+## Python、Node、Rust App
+
+backend 寫 `runtime: python|node|rust`（`runtime: go` 等同 `kind: go`）。CGI 是 SDK 的 Go runtime（`bridge/cmd/runtime`），它驗證 DSM session、entry 與 `permissions.json` 後，以套件帳號（不是 root）每個請求啟動一次 App。App 放在 ui 以外的目錄，打包成 `target/app/`，build 寫入 `bridge.json`（spec/bridge/v1）並把它與 `permissions.json` 的 sha256 編進 runtime。
+
+```yaml
+backend: {runtime: python, dir: app, entry: main.py, sdk: X.Y.Z}
+backend: {runtime: node, dir: app, entry: main.mjs, sdk: X.Y.Z, node: {package: Node.js_v20}}
+backend: {runtime: rust, dir: app, entry: hello, methods: [hello.greet]}
+```
+
+`init -t native-python|native-node|native-rust` 沿用 native-go 的 UI（`ui/`、`i18n/`，Vue 時是 `frontend/`）、jobs／delegate 的前端與 root-ops 的 `root/whoami.sh`；能力 overlay 換掉 backend 的 stub 模組。`--with jobs` 的範例讀取呼叫者選的檔案，所以同時宣告 `files: session`；delegate 讓登入使用者開啟 App 並存報告（`app.status`、`report.save` 為 `authenticated`）；Rust 的 `backend.methods` 會加上能力的 methods。init 把測試要 import 的 App SDK 放進 `backend/vendor/`（`backend.sdk` 的 release，或 SYNOPKGLAND_SDK_DIR）；build 另外打包它。`--shared-folder` 只適用於 native-go；`add` 仍只支援 Go backend。
+
+- Python：DSM 的 `/usr/bin/python3`；SDK 放進 `app/vendor/synopkgland_app/`，`PYTHONPATH=vendor`。
+- Node：Package Center 的 Node.js_v18／v20／v22 成為 INFO `install_dep_packages`；SDK 的 `package.json` 與 `dist/` 放進 `node_modules/@synopackageland/app`，其他 dependencies 先在 App 目錄 `npm ci --omit=dev`。
+- Rust：Cargo.toml 以 git＋tag 相依 `syno-pkg-land-app`；`cargo zigbuild` 交叉編譯（x86_64／aarch64 musl、armv7 glibc），`panic = "unwind"`；binary 在 `app/bin/<entry>`。需要 rustup 的 cargo、三個 target、cargo-zigbuild 與 zig。
+- methods：沒寫時 build 在建置機執行 `<entry> --describe`；Rust 必須寫。`permissions.json` 只能設定 methods 內的 method。
+- capabilities：`files`、`identity`、`jobs`、`rootOps`、`delegate`（僅 `until-revoked`＋`files.moveFromStaging`＋destinations）與 `portal`；daemon 需要 Go。jobs 或 delegate 時，同一個 runtime 另裝為 `target/background/worker`，DSM 以套件帳號執行 `worker --worker`；rootOps、delegate 附 executor，`bridge.json` 的 delegate digest 必須等於 SPK 的 executor。
+- transfers：`backend.transfers: {<method>: upload|download}`（method 必須在 methods 內），`backend.max_upload_bytes` 上限 16 GiB。
+
+## 請求期限與視窗尺寸
+
+所有 App 的 backend 請求期限預設 60 秒；`backend.timeout_seconds`（1–3600 的整數）改成別的值，go、python、node、rust 都適用。到期時 App 回 `request_timeout`；DSM 視窗把同一值放進 `ctx.requestTimeout`（毫秒），`ctx.call` 與 SDK 的瀏覽器 client 多等 2 秒，讓 backend 的回覆先到。超過期限的工作改用 jobs 或 root job，不要拉長同步請求。
+
+- python、node、rust：build 把它寫進 `bridge.json` 的 `timeout_seconds`；runtime 以它為期限，傳給 App 的 `deadline_ms` 是送出呼叫時剩下的時間。
+- go：build 以 `-X main.requestTimeout=<秒>` 傳入。要寫 `timeout_seconds`，`main.go` 必須讀這個變數，否則 check 回 `STANDALONE_TIMEOUT_UNSUPPORTED`；main 沒有讀它時，CGI 維持 SDK 的 20 秒：
+
+```go
+// Set by synopkgland build through -ldflags -X: backend.timeout_seconds, 60 unless set.
+var requestTimeout = ""
+
+func deadline() api.DeadlineOption {
+	seconds, err := strconv.Atoi(requestTimeout)
+	if err != nil || seconds <= 0 {
+		seconds = 60
+	}
+	return api.Timeout(time.Duration(seconds) * time.Second)
+}
+
+// main: cgi.Serve(api.WithRequestDeadline(handler, deadline()))
+```
+
+- binary：預先建置的 CGI 自己決定期限，不接受 `timeout_seconds`；視窗仍等 62 秒。
+
+DSM 視窗預設 960×640、最小 700×420；`ui.window` 只寫要改的欄位：
+
+```yaml
+backend: {runtime: rust, dir: app, entry: hello, methods: [hello.greet], timeout_seconds: 120}
+ui:
+  dir: ui/dist
+  window: {width: 1100, height: 720}
+```
+
+width、minWidth 是 320–3840，height、minHeight 是 240–2160，最小值不可大於視窗；不合法時 check 與 build 回 `STANDALONE_UI_WINDOW_INVALID`。從 Portal 以 standalone 開啟時，最小寬度仍是 320。DSM 會以使用者上次留下的尺寸重開視窗，並縮進目前畫面。
+
 ## 兩種層級
 
 - 無升權 App（沒有 rootOps、delegate；含所有 Compose App）：安裝、執行、解除安裝都只用套件帳號，任何階段都不用 root。不能宣告 portal（native `STANDALONE_PORTAL_REQUIRES_EXECUTOR`、Compose `CONTRACT_PORTAL_REQUIRES_EXECUTOR`）；需要登入入口別名時由管理員在 DSM 手動設定反向代理。解除安裝後 DSM 保留的「控制台」>「應用程式權限」規則由管理員手動移除，精靈與 cleanup 清單會說明。
 - executor App（rootOps 或 delegate）：解除安裝時 root purge 自動刪除 `SYNO.SDS.<package>.Instance` 的應用程式權限規則，宣告 portal 時在 DSM 移除別名後 reload nginx。精靈說明自動清除；cleanup 清單只在自動清除失敗時（系統日誌 `synopkgland-executor`）才需要管理員處理。
 
+## root 程式
+
+`capabilities.rootOps: true` 時，`root/<名稱>.sh` 是 script；`root/<arch>/<名稱>` 是該架構的 ELF binary（每個 arches 都要有，各架構 SPK 只帶自己的，policy digest 因此依架構不同）。沒有設定的 script 維持 `root.run` 預設；`root` 設定其餘：
+
+```yaml
+root:
+  state: true            # root_state：/volumeN/@synopkgland/<package>，只有 root 可讀，升級保留
+  stop: prepare          # 套件停止與升級時由 executor 執行（stop 或 prepare-upgrade）
+  programs:
+    scan:
+      kind: binary
+      schema: {type: object, additionalProperties: false, properties: {mode: {type: string, enum: [fast, full]}}}
+      run: {timeout_s: 60}                  # root.run：1–120 秒，max_output ≤ 64 MiB
+      job: {timeout_s: 3600, max_concurrent: 1}  # root.start 與 root.jobs.*
+    prepare: {}          # 沒有 run、job：只作為 stop 步驟
+```
+
+schema 是 executor 的封閉子集（每個 object 都要 `additionalProperties: false`，key `[a-z0-9_]`，pattern 為 RE2）。這些設定需要支援它們的 SDK executor（`EXECUTOR_ROOT_PROGRAMS_UNSUPPORTED`）。preupgrade 呼叫 `executor/lifecycle stop --upgrade`；舊 SDK 的 helper 不認得此旗標時改用一般 stop。
+
 ## Permanent destination integration
 
 `init --with delegate` / `add delegate` default to `operations: [files.moveFromStaging]`,

package/skills/reference/ui-json.md

@@ -76,7 +76,8 @@ brings the window to the front; below 600px they are bottom sheets. Reserve
 root sizing for the Vue/host wrapper; only use props exposed by the current JSON
 schema inside the spec. Reserve
 `modalScope: "document"` and `wideLayout: "web"` for whole-page web/Portal apps.
-Let the DSM host set AppWindow `minWidth` to 700px; do not force it through CSS.
+Let the DSM host set AppWindow `minWidth` (700px, or `ui.window.minWidth` in
+dsm-package.yaml); do not force it through CSS.
 Import only `@synopackageland/ui/themes/dsm7-embedded.css` (or its embedded
 reset/theme pair), and assign a unique `app.config.idPrefix` before each mount.
 Follow the existing template's mount, unmount and host subscription lifecycle.

package/skills/reference/ui-vue.md

@@ -45,9 +45,15 @@ do not guess APIs or copy a version-specific component inventory.
   The standalone `theme.css` and `dsm7.css` entrypoints affect the host page.
 - Set a unique `app.config.idPrefix` for every independent Vue app before
   `app.mount`. Preserve the existing template's per-mount prefix generation.
-- Keep `AppLayout wide-layout="window"` in DSM. JSON uses `AppShell` with
-  `wideLayout: "window"`. Let the host set the 700px minimum window width;
-  do not enforce a page-wide minimum in CSS.
+- Keep `AppLayout wide-layout="window"` in a DSM desktop window. JSON uses
+  `AppShell` with `wideLayout: "window"`. Let the host set the minimum window
+  width (700px, or `ui.window.minWidth` in dsm-package.yaml); do not enforce a
+  page-wide minimum in CSS.
+- `ctx.fullPage` is true when DSM launches the App standalone (Portal): the
+  window then owns the page and drops its minimum width to 320px. Use
+  `wide-layout="web"`, call the ui's `ensureDeviceViewport()` (DSM's page has
+  no device-width viewport, so a phone never reaches mobile without it) and
+  pass `ctx.appIcon` and `ctx.displayName` as `brand-icon` / `brand-name`.
 - Reserve `modalScope: "document"` / `modal-scope="document"` and
   `wide-layout="web"` for whole-page web/Portal applications.
 

package/skills/reference/wrap.md

@@ -24,7 +24,7 @@ synopkgland check      # 契約、Compose 意圖與 Web entry 提示
 
 容器路徑跟映像／upstream 的 container target 走，原樣保留；只把 host source 換成 `${NAME}` 這類 install parameter。原有的 upstream named volume mount 與頂層 `volumes:` 宣告也保留，不要為了套模板改成 `/data`。需要既有 Share 時，管理員在安裝時選這台 NAS 的 Share。
 
-修復方式：看 `check` 輸出的 `[錯誤碼]` 與「建議」行，對照 `diagnose.md`。**不要**為了過驗證而亂改 runtime 語意。
+修復方式：看 `check` 輸出的 `[錯誤碼]` 與 `Suggestion:` 行，對照 `diagnose.md`。**不要**為了過驗證而亂改 runtime 語意。
 
 ## 下一步
 

package/dist/standalone/rust-build.d.ts

@@ -1,35 +0,0 @@
-import type { NativeArchFamily } from "../build-spk/dsm-arch.js";
-import type { CommandRunner } from "./build.js";
-import type { StandaloneManifest } from "./manifest.js";
-import { type Toolkit } from "./toolkit.js";
-/** The glibc loader of DSM's ARMv7 models, the one interpreter an armv7 Rust CGI may name. */
-export declare const ARMV7_INTERPRETER = "/lib/ld-linux-armhf.so.3";
-interface RustTarget {
-    triple: string;
-    /** The linker, given the extracted toolkit folder when the target pins one. */
-    linker: (toolkit: string) => string;
-    linkArgs: string[];
-    toolkit?: Toolkit;
-    interpreter?: string;
-}
-/**
- * x86_64 and aarch64 link static musl binaries with rust-lld. armv7 links
- * against the glibc of the DSM 7.0 toolkit, because musl's 64-bit time calls
- * fail on DSM's ARMv7 kernels; that gcc runs on Linux x86_64 only.
- */
-export declare const RUST_TARGETS: Record<NativeArchFamily, RustTarget>;
-/** Go's `-X` values for a Rust App, read with `option_env!`; every one is set, empty when unused. */
-export declare function rustBuildEnv(manifest: StandaloneManifest): Record<string, string>;
-export interface RustBuildDeps {
-    host?: {
-        platform: string;
-        arch: string;
-    };
-    prepareToolkit?: (cwd: string, arch: string, inputs: Toolkit[], run: CommandRunner) => Promise<string>;
-}
-/** Builds the CGI bin, and the worker bin with capabilities.jobs, in one `cargo build` into `work`. */
-export declare function buildRustBackend(manifest: StandaloneManifest, arch: NativeArchFamily, work: string, run: CommandRunner, { host, prepareToolkit: prepare }?: RustBuildDeps): Promise<{
-    cgi: string;
-    worker?: string;
-}>;
-export {};

package/dist/standalone/rust-build.js

@@ -1,127 +0,0 @@
-import { copyFileSync, rmSync } from "node:fs";
-import { homedir } from "node:os";
-import { join } from "node:path";
-import { portalByExecutor } from "../build-spk/dsm-version.js";
-import { SDK_GIT_URL } from "../runtime/sdk-source.js";
-import { checkCgiBinary } from "./binary.js";
-import { StandaloneBuildError } from "./spk.js";
-import { prepareToolkit } from "./toolkit.js";
-/** The glibc loader of DSM's ARMv7 models, the one interpreter an armv7 Rust CGI may name. */
-export const ARMV7_INTERPRETER = "/lib/ld-linux-armhf.so.3";
-const ARMV7_GCC = "usr/local/arm-unknown-linux-gnueabi/bin/arm-unknown-linux-gnueabi-gcc";
-/**
- * x86_64 and aarch64 link static musl binaries with rust-lld. armv7 links
- * against the glibc of the DSM 7.0 toolkit, because musl's 64-bit time calls
- * fail on DSM's ARMv7 kernels; that gcc runs on Linux x86_64 only.
- */
-export const RUST_TARGETS = {
-    x86_64: { triple: "x86_64-unknown-linux-musl", linker: () => "rust-lld", linkArgs: ["--build-id=none"] },
-    aarch64: { triple: "aarch64-unknown-linux-musl", linker: () => "rust-lld", linkArgs: ["--build-id=none"] },
-    armv7: {
-        triple: "armv7-unknown-linux-gnueabihf",
-        linker: (toolkit) => join(toolkit, ARMV7_GCC),
-        linkArgs: ["-Wl,--build-id=none", "-Wl,--discard-all"],
-        toolkit: {
-            url: "https://global.synologydownload.com/download/ToolChain/toolkit/7.0/alpine4k/ds.alpine4k-7.0.env.txz",
-            sha256: "767cb27541e3c2aae5a07bc1078809956992c75a54e6bfca2275fa633e983407",
-        },
-        interpreter: ARMV7_INTERPRETER,
-    },
-};
-/** Go's `-X` values for a Rust App, read with `option_env!`; every one is set, empty when unused. */
-export function rustBuildEnv(manifest) {
-    const { capabilities, executor } = manifest;
-    const delegate = capabilities.delegate;
-    return {
-        SYNOPKGLAND_PACKAGE: manifest.package,
-        SYNOPKGLAND_VERSION: manifest.spkVersion,
-        SYNOPKGLAND_PERMISSIONS_DIGEST: manifest.apiPermissionsDigest ?? "",
-        SYNOPKGLAND_SDK_PERMISSIONS_DIGEST: manifest.apiSDKPermissionsDigest ?? "",
-        SYNOPKGLAND_EXECUTOR_DIGEST: executor?.executorDigest ?? "",
-        SYNOPKGLAND_POLICY_DIGEST: executor?.policyDigest ?? "",
-        SYNOPKGLAND_DELEGATE_SCOPE: delegate?.scope ?? "",
-        SYNOPKGLAND_DELEGATE_OPERATIONS: delegate ? JSON.stringify([...delegate.operations].sort()) : "",
-        SYNOPKGLAND_DELEGATE_DESTINATIONS: delegate ? JSON.stringify(delegate.destinations ? [...delegate.destinations].sort() : []) : "",
-        SYNOPKGLAND_DELEGATE_LIFETIME: delegate?.lifetime ?? "",
-        SYNOPKGLAND_IDENTITY: capabilities.identity ?? "",
-        SYNOPKGLAND_FILE_STATION: capabilities.files || delegate ? "session" : "",
-        SYNOPKGLAND_ENTRY: manifest.entry ?? "",
-        SYNOPKGLAND_PORTAL: manifest.portal ? (portalByExecutor(manifest.os_min_ver) ? "executor" : "on") : "",
-    };
-}
-/** Builds the CGI bin, and the worker bin with capabilities.jobs, in one `cargo build` into `work`. */
-export async function buildRustBackend(manifest, arch, work, run, { host = { platform: process.platform, arch: process.arch }, prepareToolkit: prepare = prepareToolkit } = {}) {
-    const backend = manifest.backend;
-    if (backend.kind !== "rust")
-        throw new Error("buildRustBackend needs backend.kind: rust");
-    const target = RUST_TARGETS[arch];
-    if (target.toolkit && (host.platform !== "linux" || host.arch !== "x64")) {
-        fail(`${arch} links with the gcc of the DSM toolkit, which runs on Linux x86_64 only; build ${arch} on Linux x86_64 (for example in a container).`);
-    }
-    const bins = [backend.bin, ...(manifest.capabilities.jobs ? [backend.worker] : [])];
-    const toolkit = target.toolkit ? await prepare(backend.dir, arch, [target.toolkit], run).catch((error) => fail(`DSM toolkit for ${arch}: ${error.message}`)) : "";
-    try {
-        const result = await run("cargo", [
-            "build", "--release", "--locked", "--target", target.triple, "-p", backend.package,
-            ...bins.flatMap(bin => ["--bin", bin]), "--message-format=json-render-diagnostics",
-        ], { cwd: backend.dir, env: cargoEnv(manifest, backend.dir, target, toolkit), capture: true });
-        if (result.missing)
-            fail("找不到 cargo。請以 rustup 安裝 Rust（https://rustup.rs）；backend/rust-toolchain.toml 會選定版本與 target。");
-        if (result.status !== 0)
-            fail(`cargo build（${arch}）失敗。\n${result.stderr}`);
-        const [cgi, worker] = bins.map((bin, i) => {
-            const out = join(work, i === 0 ? `api-${arch}.cgi` : `background-worker-${arch}`);
-            copyFileSync(artifact(result.stdout ?? "", bin), out);
-            const problem = checkCgiBinary(work, out, arch, target.interpreter);
-            if (problem)
-                throw new StandaloneBuildError(problem.code, problem.message);
-            return out;
-        });
-        return { cgi: cgi, ...(worker ? { worker } : {}) };
-    }
-    finally {
-        if (toolkit)
-            rmSync(toolkit, { recursive: true, force: true });
-    }
-}
-/**
- * The environment of one reproducible cargo build: the CLI's flags replace any
- * inherited RUSTFLAGS, paths are remapped, symbols and build IDs dropped. Cargo
- * fetches the private SDK repository through git, with the user's credentials.
- */
-function cargoEnv(manifest, dir, target, toolkit) {
-    const env = { ...process.env, ...rustBuildEnv(manifest) };
-    delete env.RUSTFLAGS;
-    const cargoHome = env.CARGO_HOME || join(homedir(), ".cargo");
-    env.CARGO_ENCODED_RUSTFLAGS = [
-        `--remap-path-prefix=${dir}=/build`,
-        `--remap-path-prefix=${cargoHome}=/cargo`,
-        "-Cstrip=symbols",
-        ...target.linkArgs.map(arg => `-Clink-arg=${arg}`),
-    ].join("\x1f");
-    env[`CARGO_TARGET_${target.triple.toUpperCase().replaceAll("-", "_")}_LINKER`] = target.linker(toolkit);
-    env.SOURCE_DATE_EPOCH = "0";
-    env.CARGO_NET_GIT_FETCH_WITH_CLI = "true";
-    if (env.SYNOPKGLAND_SDK_DIR) {
-        // Development only: git reads the SDK repository from this checkout, which must hold the locked tag.
-        const n = Number(env.GIT_CONFIG_COUNT ?? 0);
-        env.GIT_CONFIG_COUNT = String(n + 1);
-        env[`GIT_CONFIG_KEY_${n}`] = `url.file://${env.SYNOPKGLAND_SDK_DIR}.insteadOf`;
-        env[`GIT_CONFIG_VALUE_${n}`] = SDK_GIT_URL;
-    }
-    return env;
-}
-/** The executable Cargo reported for `bin`. */
-function artifact(messages, bin) {
-    for (const line of messages.split("\n")) {
-        if (!line.startsWith("{"))
-            continue;
-        const message = JSON.parse(line);
-        if (message.reason === "compiler-artifact" && message.target?.kind?.includes("bin") && message.target.name === bin && message.executable)
-            return message.executable;
-    }
-    return fail(`cargo build 沒有產出 bin ${bin}；確認 backend/src/bin/${bin}.rs 存在。`);
-}
-function fail(message) {
-    throw new StandaloneBuildError("STANDALONE_RUST_BUILD_FAILED", message);
-}