@synopackageland/cli 0.9.7 → 0.10.1

package/dist/standalone/background.js

@@ -13,7 +13,7 @@ export function readBackground(value, fail) {
     const ok = typeof value === "object" && value !== null && !Array.isArray(value)
         && Object.keys(value).length === 1 && value.worker === "sha256-v1";
     if (!ok) {
-        fail({ code: "STANDALONE_BACKGROUND_INVALID", message: "background 只接受 { worker: sha256-v1 }；背景程序固定以套件帳號執行，不能指定使用者、指令或權限。" });
+        fail({ code: "STANDALONE_BACKGROUND_INVALID", message: "background accepts only { worker: sha256-v1 }; background processes always run as the package account and cannot specify a user, command or privileges." });
         return undefined;
     }
     return { worker: "sha256-v1" };
@@ -22,13 +22,15 @@ export function readBackground(value, fail) {
 export function renderBackgroundResource() {
     return JSON.stringify({ "systemd-user-unit": {} });
 }
-export function renderBackgroundUnit(pkg) {
+/** The worker's arguments: none for a Go App's own worker, `--worker` for the bridge runtime (spec/bridge/v1). */
+export const BRIDGE_WORKER_ARGS = ["--worker"];
+export function renderBackgroundUnit(pkg, args = []) {
     return `[Unit]
 Description=${pkg} background worker
 
 [Service]
 Type=simple
-ExecStart=/var/packages/${pkg}/target/${BACKGROUND_WORKER_PAYLOAD}
+ExecStart=${[`/var/packages/${pkg}/target/${BACKGROUND_WORKER_PAYLOAD}`, ...args].join(" ")}
 UMask=0077
 KillMode=control-group
 TimeoutStopSec=10
@@ -80,7 +82,9 @@ export function renderUserManagerRecovery() {
     echo "package user manager $pid has no socket in /run/user/$uid; stopping it so DSM starts a fresh one" >&2
     kill -TERM "$pid" || return 1
     i=0
-    while kill -0 "$pid" 2>/dev/null; do
+    # DSM's bash logs a failed kill to syslog even with 2>/dev/null, so the
+    # exit is looked up in /proc.
+    while [ -d "/proc/$pid" ]; do
       [ "$i" -lt 100 ] || { echo "package user manager $pid did not exit" >&2; return 1; }
       sleep 0.1; i=$((i + 1))
     done

package/dist/standalone/binary.js

@@ -21,17 +21,17 @@ export function checkCgiBinary(projectRoot, file, arch, interpreter) {
         stat = lstatSync(file);
     }
     catch {
-        return fail("STANDALONE_BINARY_MISSING", `找不到 ${arch} 的 backend 執行檔：${file}`);
+        return fail("STANDALONE_BINARY_MISSING", `Backend executable for ${arch} not found: ${file}`);
     }
     if (!stat.isFile()) {
-        return fail("STANDALONE_BINARY_NOT_REGULAR", `${file} 必須是一般檔案（不可是 symlink 或目錄）。`);
+        return fail("STANDALONE_BINARY_NOT_REGULAR", `${file} must be a regular file (not a symlink or directory).`);
     }
     const rel = relative(realpathSync(projectRoot), realpathSync(file));
     if (rel.startsWith("..")) {
-        return fail("STANDALONE_PATH_OUTSIDE_PROJECT", `${file} 實際位於專案目錄之外。`);
+        return fail("STANDALONE_PATH_OUTSIDE_PROJECT", `${file} actually lives outside the project directory.`);
     }
     if (stat.size > MAX_BINARY_BYTES) {
-        return fail("STANDALONE_BINARY_TOO_LARGE", `${file} 超過 256 MiB。`);
+        return fail("STANDALONE_BINARY_TOO_LARGE", `${file} exceeds 256 MiB.`);
     }
     return checkElf(readHeader(file), file, arch, interpreter);
 }
@@ -61,14 +61,14 @@ function readElfHeader(buf) {
 }
 function checkElf(buf, file, arch, interpreter) {
     const bits = ELF_CLASS64[arch] ? 64 : 32;
-    const notElf = fail("STANDALONE_BINARY_NOT_ELF", `${file} 不是 ${arch} 需要的 ${bits}-bit little-endian Linux ELF 執行檔。`);
+    const notElf = fail("STANDALONE_BINARY_NOT_ELF", `${file} is not the ${bits}-bit little-endian Linux ELF executable ${arch} needs.`);
     const header = readElfHeader(buf);
     if (!header || header.class64 !== ELF_CLASS64[arch]) {
         return notElf;
     }
     const { machine, phoff, phentsize, phnum } = header;
     if (machine !== ELF_MACHINE[arch]) {
-        return fail("STANDALONE_BINARY_ARCH_MISMATCH", `${file} 的 ELF machine 是 ${machine}，不是 ${arch}。`);
+        return fail("STANDALONE_BINARY_ARCH_MISMATCH", `The ELF machine of ${file} is ${machine}, not ${arch}.`);
     }
     if (phentsize < 4 || phoff + phentsize * phnum > buf.length) {
         return notElf;
@@ -76,7 +76,7 @@ function checkElf(buf, file, arch, interpreter) {
     for (let i = 0; i < phnum; i++) {
         const entry = phoff + i * phentsize;
         if (buf.readUInt32LE(entry) === PT_INTERP && (interpreter === undefined || interpreterOf(buf, entry, header.class64) !== interpreter)) {
-            return fail("STANDALONE_BINARY_DYNAMIC", `${file} 是動態連結執行檔。請改用靜態連結（Go：CGO_ENABLED=0；Rust：*-unknown-linux-musl）。`);
+            return fail("STANDALONE_BINARY_DYNAMIC", `${file} is a dynamically linked executable. Link statically (Go: CGO_ENABLED=0; Rust: *-unknown-linux-musl).`);
         }
     }
     return undefined;

package/dist/standalone/bridge-app.d.ts

@@ -0,0 +1,23 @@
+import { type StandaloneManifest } from "./manifest.js";
+/** The Node SDK's package name, which the CLI places in the App's node_modules. */
+export declare const NODE_SDK_PACKAGE = "@synopackageland/app";
+export interface StagedApp {
+    /** target/app without bridge.json: the App's files and its SDK. */
+    dir: string;
+    methods: string[];
+}
+/**
+ * Python and Node Apps are the same on every architecture: copy the App
+ * directory once, add the SDK from the App's SDK release, and take the methods
+ * from the manifest or, when it lists none, from the App's `--describe`.
+ */
+export declare function stageScriptApp(m: StandaloneManifest, work: string): Promise<StagedApp>;
+/**
+ * Reads `--describe`: one JSON line `{"sdk","versions","methods"}` and exit 0
+ * (spec/bridge/v1 SDKs). Returns the methods, sorted.
+ */
+export declare function describeMethods(command: string, args: string[], cwd: string, env: Record<string, string>, timeoutMs?: number): Promise<string[]>;
+/** The Node SDK as npm would install it: its package.json and its compiled dist/. */
+export declare function copyNodeSdk(source: string, target: string): void;
+/** Copies an App tree: regular files and directories only, without dot entries and Python bytecode. */
+export declare function copyAppTree(source: string, target: string, skip?: readonly string[]): void;

package/dist/standalone/bridge-app.js

@@ -0,0 +1,141 @@
+import { spawn } from "node:child_process";
+import { chmodSync, copyFileSync, existsSync, lstatSync, mkdirSync, readdirSync, readFileSync, rmSync } from "node:fs";
+import { join } from "node:path";
+import { requiredSdk } from "../runtime/sdk-source.js";
+import { METHOD } from "./bridge-backend.js";
+import { PYTHON_VENDOR_DIR } from "./bridge-json.js";
+import { sdkBackend } from "./manifest.js";
+import { StandaloneBuildError } from "./spk.js";
+/** The Node SDK's package name, which the CLI places in the App's node_modules. */
+export const NODE_SDK_PACKAGE = "@synopackageland/app";
+const PYTHON_SDK = "synopkgland_app";
+const MAX_APP_BYTES = 256 * 1024 * 1024;
+const DESCRIBE_TIMEOUT_MS = 10_000;
+/**
+ * Python and Node Apps are the same on every architecture: copy the App
+ * directory once, add the SDK from the App's SDK release, and take the methods
+ * from the manifest or, when it lists none, from the App's `--describe`.
+ */
+export async function stageScriptApp(m, work) {
+    const backend = m.backend;
+    const sdk = requiredSdk(sdkBackend(m));
+    const dir = join(work, "app");
+    copyAppTree(backend.dir, dir);
+    if (backend.kind === "python") {
+        const vendor = join(dir, PYTHON_VENDOR_DIR, PYTHON_SDK);
+        rmSync(vendor, { recursive: true, force: true });
+        copyAppTree(join(sdk.goDir, "python", PYTHON_SDK), vendor);
+    }
+    else {
+        const modules = join(dir, "node_modules", NODE_SDK_PACKAGE);
+        rmSync(modules, { recursive: true, force: true });
+        copyNodeSdk(join(sdk.goDir, "node"), modules);
+        checkNodeDependencies(dir);
+    }
+    return { dir, methods: backend.methods ?? await describe(m, dir) };
+}
+/** Runs `<entry> --describe` on the build machine, from the staged directory, with the SDK it ships. */
+async function describe(m, dir) {
+    const backend = m.backend;
+    const env = { PATH: process.env.PATH ?? "/usr/local/bin:/usr/bin:/bin", SYNOPKGLAND_PACKAGE: m.package };
+    if (backend.kind === "python") {
+        Object.assign(env, { PYTHONPATH: PYTHON_VENDOR_DIR, PYTHONUTF8: "1", PYTHONDONTWRITEBYTECODE: "1", PYTHONNOUSERSITE: "1" });
+        return describeMethods("python3", [backend.entry, "--describe"], dir, env);
+    }
+    return describeMethods("node", [backend.entry, "--describe"], dir, env);
+}
+/**
+ * Reads `--describe`: one JSON line `{"sdk","versions","methods"}` and exit 0
+ * (spec/bridge/v1 SDKs). Returns the methods, sorted.
+ */
+export function describeMethods(command, args, cwd, env, timeoutMs = DESCRIBE_TIMEOUT_MS) {
+    const shown = [command, ...args].join(" ");
+    const fail = (why) => new StandaloneBuildError("STANDALONE_BRIDGE_DESCRIBE_FAILED", `There is no backend.methods, so build reads the App's methods with ${shown}, but ${why}`);
+    return new Promise((resolve, reject) => {
+        const child = spawn(command, args, { cwd, env, stdio: ["ignore", "pipe", "pipe"], detached: true });
+        let stdout = "", stderr = "", done = false;
+        const finish = (error, methods) => {
+            if (done)
+                return;
+            done = true;
+            clearTimeout(timer);
+            try {
+                process.kill(-child.pid, "SIGKILL");
+            }
+            catch { /* already gone */ }
+            if (error)
+                reject(error);
+            else
+                resolve(methods);
+        };
+        const timer = setTimeout(() => finish(fail(` it did not finish within ${timeoutMs} ms.\n${stderr}`)), timeoutMs);
+        child.on("error", (error) => finish(fail(error.code === "ENOENT" ? `${command} was not found; install it, or list backend.methods in dsm-package.yaml.` : error.message)));
+        child.stderr.setEncoding("utf8").on("data", (chunk) => { stderr += chunk; });
+        child.stdout.setEncoding("utf8").on("data", (chunk) => { stdout += chunk; });
+        child.on("close", (code) => {
+            if (code !== 0)
+                return finish(fail(`exit ${code}; the SDK version must support --describe, otherwise list backend.methods.\n${stderr}`));
+            const line = stdout.split("\n")[0];
+            let described;
+            try {
+                described = JSON.parse(line);
+            }
+            catch {
+                return finish(fail(`the output is not JSON: ${line}`));
+            }
+            const methods = described.methods;
+            if (!Array.isArray(described.versions) || !described.versions.includes(1) || !Array.isArray(methods) || !methods.every(name => typeof name === "string" && METHOD.test(name))) {
+                return finish(fail(`the output is not a v1 describe: ${line}`));
+            }
+            finish(undefined, [...methods].sort());
+        });
+    });
+}
+/** The Node SDK as npm would install it: its package.json and its compiled dist/. */
+export function copyNodeSdk(source, target) {
+    if (!existsSync(join(source, "dist/index.js"))) {
+        throw new StandaloneBuildError("STANDALONE_NODE_SDK_NOT_BUILT", `The Node SDK has no dist/: ${source}. Run npm ci && npm run build in node/ of the SYNOPKGLAND_SDK_DIR checkout first; a release SDK must contain node/dist.`);
+    }
+    mkdirSync(target, { recursive: true });
+    copyFileSync(join(source, "package.json"), join(target, "package.json"));
+    chmodSync(join(target, "package.json"), 0o644);
+    copyAppTree(join(source, "dist"), join(target, "dist"));
+}
+/** Every package.json dependency must be installed in the App's node_modules; the SDK itself comes from the CLI. */
+function checkNodeDependencies(dir) {
+    const manifest = join(dir, "package.json");
+    if (!existsSync(manifest))
+        return;
+    const dependencies = JSON.parse(readFileSync(manifest, "utf8")).dependencies ?? {};
+    const missing = Object.keys(dependencies).filter(name => name !== NODE_SDK_PACKAGE && !existsSync(join(dir, "node_modules", name, "package.json")));
+    if (missing.length) {
+        throw new StandaloneBuildError("STANDALONE_NODE_DEPENDENCY_MISSING", `The package.json dependencies are not installed in the App's node_modules: ${missing.join(", ")}. Run npm ci --omit=dev in the App directory and build again.`);
+    }
+}
+/** Copies an App tree: regular files and directories only, without dot entries and Python bytecode. */
+export function copyAppTree(source, target, skip = []) {
+    let total = 0;
+    const walk = (from, to) => {
+        mkdirSync(to, { recursive: true });
+        chmodSync(to, 0o755);
+        for (const name of readdirSync(from).sort()) {
+            if (name.startsWith(".") || name === "__pycache__" || skip.includes(name))
+                continue;
+            const src = join(from, name);
+            const stat = lstatSync(src);
+            if (stat.isDirectory())
+                walk(src, join(to, name));
+            else if (stat.isFile()) {
+                total += stat.size;
+                if (total > MAX_APP_BYTES)
+                    throw new StandaloneBuildError("STANDALONE_BRIDGE_APP_INVALID", `The App directory exceeds 256 MiB: ${source}`);
+                copyFileSync(src, join(to, name));
+                chmodSync(join(to, name), stat.mode & 0o111 ? 0o755 : 0o644);
+            }
+            else {
+                throw new StandaloneBuildError("STANDALONE_BRIDGE_APP_INVALID", `The App directory may contain only regular files and directories (no symlinks): ${src}`);
+            }
+        }
+    };
+    walk(source, target);
+}

package/dist/standalone/bridge-backend.d.ts

@@ -0,0 +1,40 @@
+/**
+ * A backend in another language behind the SDK's Go runtime (spec/bridge/v1):
+ * the CLI builds the runtime as the package CGI and ships the App in target/app.
+ */
+export declare const BRIDGE_RUNTIMES: readonly ["python", "node", "rust"];
+export type BridgeRuntime = (typeof BRIDGE_RUNTIMES)[number];
+/** The Package Center Node.js packages an App may depend on. */
+export declare const NODE_PACKAGES: readonly ["Node.js_v18", "Node.js_v20", "Node.js_v22"];
+export interface BridgeBackend {
+    kind: BridgeRuntime;
+    /** The App's sources: python and node ship this directory, rust is a Cargo project. */
+    dir: string;
+    /** python: the script; node: the module, both relative to dir; rust: the Cargo binary. */
+    entry: string;
+    /** The App's methods; absent (python and node only), the build reads them from the App's hello. */
+    methods?: string[];
+    /** python and node: the SDK release the runtime and the vendored SDK come from; rust reads Cargo.lock. */
+    sdk?: string;
+    node?: {
+        package: (typeof NODE_PACKAGES)[number];
+    };
+    /** Methods the browser calls as an HTTP upload or download (spec/bridge/v1 Transfers). */
+    transfers?: Record<string, "upload" | "download">;
+    /** The upload limit; absent, the runtime's 16 GiB. */
+    maxUploadBytes?: number;
+    /** The request deadline in seconds; absent, DEFAULT_REQUEST_TIMEOUT_SECONDS. */
+    timeoutSeconds?: number;
+}
+export declare function isBridgeBackend(backend: {
+    kind: string;
+}): backend is BridgeBackend;
+export declare const METHOD: RegExp;
+/** filestation.MaxUploadBytes, the runtime's default and ceiling. */
+export declare const MAX_UPLOAD_BYTES: number;
+type Raw = Record<string, unknown>;
+/** Reads a python, node or rust backend; `dir` resolves a project-relative path, or reports and returns undefined. */
+export declare function readBridgeBackend(value: Raw, dir: (value: unknown) => string | undefined, fail: (code: string, message: string) => undefined): BridgeBackend | undefined;
+/** Whether one directory is the other or holds it. */
+export declare function overlaps(a: string, b: string): boolean;
+export {};

package/dist/standalone/bridge-backend.js

@@ -0,0 +1,95 @@
+import { existsSync, lstatSync } from "node:fs";
+import { isAbsolute, join, relative } from "node:path";
+import { TIMEOUT_USAGE, validTimeoutSeconds } from "./request-timeout.js";
+/**
+ * A backend in another language behind the SDK's Go runtime (spec/bridge/v1):
+ * the CLI builds the runtime as the package CGI and ships the App in target/app.
+ */
+export const BRIDGE_RUNTIMES = ["python", "node", "rust"];
+/** The Package Center Node.js packages an App may depend on. */
+export const NODE_PACKAGES = ["Node.js_v18", "Node.js_v20", "Node.js_v22"];
+export function isBridgeBackend(backend) {
+    return BRIDGE_RUNTIMES.includes(backend.kind);
+}
+/** spec/bridge/v1 manifest.schema.json: entry and method names. */
+const ENTRY = /^(?!\/)(?!.*(^|\/)\.\.?(\/|$))[A-Za-z0-9._/-]{1,255}$/;
+export const METHOD = /^[a-z][a-z0-9_]*(\.[a-z][a-z0-9_]*)+$/;
+const CARGO_NAME = /^[A-Za-z][A-Za-z0-9_-]{0,63}$/;
+const VERSION = /^\d+\.\d+\.\d+$/;
+const TRANSFER_FIELDS = ["transfers", "max_upload_bytes", "timeout_seconds"];
+const FIELDS = {
+    python: ["runtime", "dir", "entry", "methods", "sdk", ...TRANSFER_FIELDS],
+    node: ["runtime", "dir", "entry", "methods", "sdk", "node", ...TRANSFER_FIELDS],
+    rust: ["runtime", "dir", "entry", "methods", ...TRANSFER_FIELDS],
+};
+/** filestation.MaxUploadBytes, the runtime's default and ceiling. */
+export const MAX_UPLOAD_BYTES = 16 * 1024 ** 3;
+const USAGE = {
+    python: "backend.runtime: python needs dir, entry (a .py inside the App directory) and sdk (the SDK version), with optional methods.",
+    node: "backend.runtime: node needs dir, entry (a module inside the App directory), sdk (the SDK version) and node.package (Node.js_v18, Node.js_v20 or Node.js_v22), with optional methods.",
+    rust: "backend.runtime: rust needs dir (a Cargo project), entry (the Cargo binary name) and methods (a cross-compiled binary cannot run on the build machine).",
+};
+/** Reads a python, node or rust backend; `dir` resolves a project-relative path, or reports and returns undefined. */
+export function readBridgeBackend(value, dir, fail) {
+    const runtime = value.runtime;
+    const invalid = (why = "") => fail("STANDALONE_BACKEND_INVALID", `${USAGE[runtime]}${why}`);
+    const unknown = Object.keys(value).filter(key => !FIELDS[runtime].includes(key));
+    if (unknown.length)
+        return invalid(`Unsupported ${unknown.map(key => `backend.${key}`).join(", ")}.`);
+    const entry = value.entry;
+    if (typeof entry !== "string" || !(runtime === "rust" ? CARGO_NAME : ENTRY).test(entry))
+        return invalid();
+    const methods = value.methods;
+    if (methods !== undefined && !(Array.isArray(methods) && methods.length > 0 && methods.length <= 1024
+        && methods.every(method => typeof method === "string" && METHOD.test(method)) && new Set(methods).size === methods.length)) {
+        return invalid("methods must be unique API method names (for example hello.greet), 1-1024 of them.");
+    }
+    if (runtime === "rust" && methods === undefined)
+        return invalid();
+    const sdk = value.sdk;
+    if (runtime !== "rust" && (typeof sdk !== "string" || !VERSION.test(sdk)))
+        return invalid();
+    const node = value.node;
+    if (runtime === "node" && !(node && typeof node === "object" && Object.keys(node).join() === "package" && NODE_PACKAGES.includes(node.package)))
+        return invalid();
+    const transfers = value.transfers;
+    if (transfers !== undefined && !(transfers && typeof transfers === "object" && !Array.isArray(transfers) && Object.keys(transfers).length > 0
+        && Object.entries(transfers).every(([method, use]) => METHOD.test(method) && (use === "upload" || use === "download") && (!methods || methods.includes(method))))) {
+        return invalid("transfers is keyed by a method in methods, with the value upload or download.");
+    }
+    const maxUpload = value.max_upload_bytes;
+    if (maxUpload !== undefined && !(Number.isSafeInteger(maxUpload) && maxUpload >= 1 && maxUpload <= MAX_UPLOAD_BYTES)) {
+        return invalid("max_upload_bytes is an integer from 1 to 17179869184 (16 GiB).");
+    }
+    const timeout = value.timeout_seconds;
+    if (timeout !== undefined && !validTimeoutSeconds(timeout))
+        return invalid(TIMEOUT_USAGE);
+    const root = dir(value.dir);
+    if (!root)
+        return undefined;
+    if (runtime !== "rust" && !isFileInside(root, entry))
+        return invalid(`entry not found: ${entry}.`);
+    return {
+        kind: runtime,
+        dir: root,
+        entry,
+        ...(runtime !== "rust" ? { sdk: sdk } : {}),
+        ...(methods ? { methods: methods } : {}),
+        ...(runtime === "node" ? { node: { package: node.package } } : {}),
+        ...(transfers ? { transfers: transfers } : {}),
+        ...(maxUpload !== undefined ? { maxUploadBytes: maxUpload } : {}),
+        ...(timeout !== undefined ? { timeoutSeconds: timeout } : {}),
+    };
+}
+function isFileInside(root, entry) {
+    const path = join(root, entry);
+    return existsSync(path) && lstatSync(path).isFile();
+}
+/** Whether one directory is the other or holds it. */
+export function overlaps(a, b) {
+    const inside = (outer, inner) => {
+        const rel = relative(outer, inner);
+        return !rel.startsWith("..") && !isAbsolute(rel);
+    };
+    return inside(a, b) || inside(b, a);
+}

package/dist/standalone/bridge-build.d.ts

@@ -0,0 +1,21 @@
+import type { NativeArchFamily } from "../build-spk/dsm-arch.js";
+import type { CommandRunner } from "./build.js";
+import { type StandaloneManifest } from "./manifest.js";
+/** What every architecture shares: the methods and, for Python and Node, the staged App directory. */
+export interface PreparedBridge {
+    methods: string[];
+    staged?: string;
+}
+/** Stages a Python or Node App once; a Rust App is compiled per architecture in `buildBridge`. */
+export declare function prepareBridge(m: StandaloneManifest, work: string): Promise<PreparedBridge | undefined>;
+/**
+ * The runtime CGI of one architecture and the target/app directory whose
+ * digests it binds. bridge.json is per architecture: delegate pins the
+ * architecture's executor. With capabilities.jobs (delegate implies it) the
+ * same runtime is also the background worker, run with --worker.
+ */
+export declare function buildBridge(m: StandaloneManifest, prepared: PreparedBridge, arch: NativeArchFamily, work: string, run: CommandRunner): Promise<{
+    cgi: string;
+    app: string;
+    worker?: string;
+}>;

package/dist/standalone/bridge-build.js

@@ -0,0 +1,62 @@
+import { copyFileSync, writeFileSync } from "node:fs";
+import { createHash } from "node:crypto";
+import { join } from "node:path";
+import { API_PERMISSIONS_FILE, readApiPermissions } from "./api-permissions.js";
+import { copyAppTree, stageScriptApp } from "./bridge-app.js";
+import { isBridgeBackend } from "./bridge-backend.js";
+import { BRIDGE_JSON, bridgeManifestProblems, renderBridgeJson } from "./bridge-json.js";
+import { buildRustApp } from "./bridge-rust.js";
+import { buildBridgeRuntime } from "./bridge-runtime.js";
+import { bridgeMethodProblems, sdkBackend } from "./manifest.js";
+import { StandaloneBuildError } from "./spk.js";
+/** Stages a Python or Node App once; a Rust App is compiled per architecture in `buildBridge`. */
+export async function prepareBridge(m, work) {
+    const backend = m.backend;
+    if (!isBridgeBackend(backend))
+        return undefined;
+    if (backend.kind === "rust")
+        return { methods: backend.methods };
+    const staged = await stageScriptApp(m, work);
+    return { methods: staged.methods, staged: staged.dir };
+}
+/**
+ * The runtime CGI of one architecture and the target/app directory whose
+ * digests it binds. bridge.json is per architecture: delegate pins the
+ * architecture's executor. With capabilities.jobs (delegate implies it) the
+ * same runtime is also the background worker, run with --worker.
+ */
+export async function buildBridge(m, prepared, arch, work, run) {
+    let app;
+    if (prepared.staged) {
+        app = join(work, "app");
+        copyAppTree(prepared.staged, app);
+    }
+    else {
+        app = await buildRustApp(m, arch, work, run);
+    }
+    const digests = finishApp(m, app, prepared.methods);
+    const cgi = await buildBridgeRuntime(m, arch, work, run, digests);
+    return { cgi, app, ...(m.capabilities.jobs ? { worker: cgi } : {}) };
+}
+/** Adds permissions.json and bridge.json to a staged App directory and returns the digests the runtime binds. */
+function finishApp(m, dir, methods) {
+    const backend = m.backend;
+    const permissions = readApiPermissions(sdkBackend(m), m.capabilities);
+    // UI build hooks run after validation; the runtime must bind the policy the manifest checked.
+    if (permissions.digest !== m.apiPermissionsDigest)
+        throw new StandaloneBuildError("STANDALONE_API_PERMISSIONS_CHANGED", "API permissions changed during build; check and rebuild.");
+    const transfers = Object.keys(backend.transfers ?? {}).filter(method => !methods.includes(method));
+    const problems = [
+        ...bridgeMethodProblems(methods, permissions, API_PERMISSIONS_FILE[backend.kind]),
+        ...(transfers.length ? [`backend.transfers lists methods the App does not have: ${transfers.join(", ")}.`] : []),
+    ];
+    if (problems.length)
+        throw new StandaloneBuildError("STANDALONE_BRIDGE_METHODS_MISMATCH", problems.join("\n"));
+    copyFileSync(join(backend.dir, API_PERMISSIONS_FILE[backend.kind]), join(dir, "permissions.json"));
+    const bridge = renderBridgeJson(m, methods);
+    const invalid = bridgeManifestProblems(bridge);
+    if (invalid.length)
+        throw new StandaloneBuildError("STANDALONE_BRIDGE_MANIFEST_INVALID", invalid.join("\n"));
+    writeFileSync(join(dir, BRIDGE_JSON), bridge, { mode: 0o644 });
+    return { manifest: createHash("sha256").update(bridge).digest("hex"), permissions: permissions.digest };
+}

package/dist/standalone/bridge-json.d.ts

@@ -0,0 +1,16 @@
+import type { StandaloneManifest } from "./manifest.js";
+import type { BridgeBackend } from "./bridge-backend.js";
+/** The App manifest the runtime reads: spec/bridge/v1 bridge.json, in target/app. */
+export declare const BRIDGE_JSON = "bridge.json";
+/** A copy of the SDK's frozen spec/bridge/v1/manifest.schema.json. */
+export declare const BRIDGE_SCHEMA_PATH: string;
+/** The vendored Python SDK's directory in target/app, the runtime's working directory, so PYTHONPATH is relative. */
+export declare const PYTHON_VENDOR_DIR = "vendor";
+/** Where a Rust App's binary goes in target/app. */
+export declare const RUST_BIN_DIR = "bin";
+/** bridge.json's entry: the script or module for python and node, `bin/<name>` for rust. */
+export declare const bridgeEntry: (backend: BridgeBackend) => string;
+/** bridge.json for these methods: sorted, two-space JSON, so the digest the runtime binds is reproducible. */
+export declare function renderBridgeJson(m: Pick<StandaloneManifest, "package" | "capabilities" | "entry" | "backend" | "portal" | "executor">, methods: readonly string[]): string;
+/** Why bridge.json would not validate against manifest.schema.json; empty when it does. */
+export declare function bridgeManifestProblems(text: string): string[];

package/dist/standalone/bridge-json.js

@@ -0,0 +1,59 @@
+import { Ajv2020 } from "ajv/dist/2020.js";
+import { readFileSync } from "node:fs";
+import { fileURLToPath } from "node:url";
+import { requestTimeoutSeconds } from "./request-timeout.js";
+/** The App manifest the runtime reads: spec/bridge/v1 bridge.json, in target/app. */
+export const BRIDGE_JSON = "bridge.json";
+/** A copy of the SDK's frozen spec/bridge/v1/manifest.schema.json. */
+export const BRIDGE_SCHEMA_PATH = fileURLToPath(new URL("../../schema/bridge-manifest.v1.schema.json", import.meta.url));
+/** The vendored Python SDK's directory in target/app, the runtime's working directory, so PYTHONPATH is relative. */
+export const PYTHON_VENDOR_DIR = "vendor";
+/** Where a Rust App's binary goes in target/app. */
+export const RUST_BIN_DIR = "bin";
+/** bridge.json's entry: the script or module for python and node, `bin/<name>` for rust. */
+export const bridgeEntry = (backend) => backend.kind === "rust" ? `${RUST_BIN_DIR}/${backend.entry}` : backend.entry;
+/** bridge.json for these methods: sorted, two-space JSON, so the digest the runtime binds is reproducible. */
+export function renderBridgeJson(m, methods) {
+    const { backend, capabilities } = m;
+    const delegate = capabilities.delegate;
+    const sdkRoutes = {
+        ...(capabilities.files ? { files: "session" } : {}),
+        ...(capabilities.identity ? { identity: "standalone" } : {}),
+        ...(m.portal ? { portal: true } : {}),
+        ...(capabilities.jobs ? { jobs: true } : {}),
+        ...(capabilities.rootOps ? { root: true } : {}),
+        ...(delegate ? { delegate: {
+                scope: delegate.scope,
+                destinations: [...delegate.destinations ?? []].sort(),
+                executor_digest: m.executor?.executorDigest,
+                policy_digest: m.executor?.policyDigest,
+            } } : {}),
+    };
+    return `${JSON.stringify({
+        schema: 1,
+        runtime: backend.kind,
+        entry: bridgeEntry(backend),
+        mode: "exec",
+        methods: [...methods].sort(),
+        ...(m.entry ? { access: m.entry } : {}),
+        timeout_seconds: requestTimeoutSeconds(backend),
+        ...(backend.kind === "python" ? { env: { PYTHONPATH: PYTHON_VENDOR_DIR } } : {}),
+        ...(backend.node ? { node: { package: backend.node.package } } : {}),
+        ...(backend.transfers ? { transfers: Object.fromEntries(Object.entries(backend.transfers).sort(([a], [b]) => a < b ? -1 : 1)) } : {}),
+        ...(backend.maxUploadBytes ? { max_upload_bytes: backend.maxUploadBytes } : {}),
+        ...(Object.keys(sdkRoutes).length ? { capabilities: sdkRoutes } : {}),
+    }, null, 2)}\n`;
+}
+let validator;
+/** Why bridge.json would not validate against manifest.schema.json; empty when it does. */
+export function bridgeManifestProblems(text) {
+    let value;
+    try {
+        value = JSON.parse(text);
+    }
+    catch (error) {
+        return [`${BRIDGE_JSON} is not JSON: ${error.message}`];
+    }
+    validator ??= new Ajv2020({ allErrors: true, strict: false }).compile(JSON.parse(readFileSync(BRIDGE_SCHEMA_PATH, "utf8")));
+    return validator(value) ? [] : (validator.errors ?? []).map(e => `${BRIDGE_JSON}${e.instancePath || ""} ${e.message ?? e.keyword}`);
+}

package/dist/standalone/bridge-runtime.d.ts

@@ -0,0 +1,16 @@
+import type { NativeArchFamily } from "../build-spk/dsm-arch.js";
+import type { CommandRunner } from "./build.js";
+import { type StandaloneManifest } from "./manifest.js";
+/** The SDK's package CGI for an App in another language (spec/bridge/v1). */
+export declare const RUNTIME_MAIN = "./bridge/cmd/runtime";
+/** SHA-256 (hex) of the two files the runtime reads from target/app and refuses when they differ. */
+export interface BridgeDigests {
+    manifest: string;
+    permissions: string;
+}
+/**
+ * Builds the runtime from the App's SDK release for one architecture, inside
+ * the SDK module (go build writes nothing there), with the pinned Go and the
+ * CLI's flags, so the same release and digests give the same bytes.
+ */
+export declare function buildBridgeRuntime(m: StandaloneManifest, arch: NativeArchFamily, work: string, run: CommandRunner, digests: BridgeDigests): Promise<string>;

package/dist/standalone/bridge-runtime.js

@@ -0,0 +1,46 @@
+import { join } from "node:path";
+import { PINNED_GO_HINT, pinnedGoBuildEnv, pinnedGoProblem } from "../build-spk/go-toolchain.js";
+import { requiredSdk, SDK_MODULE } from "../runtime/sdk-source.js";
+import { checkCgiBinary } from "./binary.js";
+import { sdkBackend } from "./manifest.js";
+import { StandaloneBuildError } from "./spk.js";
+/** The SDK's package CGI for an App in another language (spec/bridge/v1). */
+export const RUNTIME_MAIN = "./bridge/cmd/runtime";
+/**
+ * Builds the runtime from the App's SDK release for one architecture, inside
+ * the SDK module (go build writes nothing there), with the pinned Go and the
+ * CLI's flags, so the same release and digests give the same bytes.
+ */
+export async function buildBridgeRuntime(m, arch, work, run, digests) {
+    let sdk;
+    try {
+        sdk = requiredSdk(sdkBackend(m));
+    }
+    catch (error) {
+        throw new StandaloneBuildError("SDK_REQUIRED", error.message.replace(/^\[[A-Z_]+\] /, ""));
+    }
+    const out = join(work, `api-${arch}.cgi`);
+    const ldflags = [
+        "-s", "-w", "-buildid=",
+        `-X main.packageID=${m.package}`,
+        `-X main.manifestDigest=${digests.manifest}`,
+        `-X main.permissionsDigest=${digests.permissions}`,
+        `-X ${SDK_MODULE}/api.expectedSDKPermissionsDigest=${m.apiSDKPermissionsDigest}`,
+    ].join(" ");
+    const result = await run("go", ["build", "-trimpath", "-buildvcs=false", "-ldflags", ldflags, "-o", out, RUNTIME_MAIN], {
+        cwd: sdk.goDir,
+        env: { ...process.env, ...pinnedGoBuildEnv(arch) },
+    });
+    if (result.missing)
+        throw new StandaloneBuildError("STANDALONE_GO_MISSING", "The go command was not found. The Python, Node and Rust App runtime is compiled from the SDK's Go source; install Go 1.21 or later (https://go.dev/dl/).");
+    if (result.status !== 0) {
+        throw new StandaloneBuildError("STANDALONE_RUNTIME_BUILD_FAILED", `runtime (SDK ${sdk.version} ${RUNTIME_MAIN}, ${arch}) build failed; that SDK version must contain the bridge runtime. ${PINNED_GO_HINT}\n${result.stderr}`);
+    }
+    const problem = checkCgiBinary(work, out, arch);
+    if (problem)
+        throw new StandaloneBuildError(problem.code, problem.message);
+    const toolchain = pinnedGoProblem(out);
+    if (toolchain)
+        throw new StandaloneBuildError("STANDALONE_RUNTIME_BUILD_FAILED", toolchain);
+    return out;
+}

package/dist/standalone/bridge-rust.d.ts

@@ -0,0 +1,16 @@
+import type { NativeArchFamily } from "../build-spk/dsm-arch.js";
+import type { CommandRunner } from "./build.js";
+import type { StandaloneManifest } from "./manifest.js";
+/** The glibc loader of DSM's ARMv7 models, the one interpreter an armv7 Rust App may name. */
+export declare const ARMV7_INTERPRETER = "/lib/ld-linux-armhf.so.3";
+/**
+ * x86_64 and aarch64 are static musl binaries. armv7 links against glibc
+ * (2.17, older than any DSM 7), because musl's 64-bit time calls fail on
+ * DSM's ARMv7 kernels; zig provides both, so any host can build all three.
+ */
+export declare const RUST_TARGETS: Record<NativeArchFamily, {
+    triple: string;
+    interpreter?: string;
+}>;
+/** Cross-compiles the App's binary for one architecture into `work/app-<arch>/bin`; returns that App directory. */
+export declare function buildRustApp(m: StandaloneManifest, arch: NativeArchFamily, work: string, run: CommandRunner): Promise<string>;