@synopackageland/templates 0.9.4 → 0.9.6

package/templates/native-rust-jobs/backend/src/app/background_routes.rs

@@ -0,0 +1,109 @@
+use std::sync::Arc;
+
+use syno_pkg_land_sdk::api::Route;
+
+#[cfg(test)]
+use super::test_support::{Sample, sample};
+use super::{BackgroundApi, Config, system_uid_lookup};
+
+impl Config {
+    /// Serves the owner-scoped background job API. Jobs run in the
+    /// package-user worker unit (conf/systemd), never as root.
+    pub(super) fn background_routes(self: &Arc<Self>) -> Vec<Route> {
+        let uid_lookup = self.uid_lookup.clone().unwrap_or_else(system_uid_lookup);
+        BackgroundApi::production(&self.data_dir, uid_lookup).routes()
+    }
+}
+
+/// Valid params for every background route. The fixture has no DSM cookie, so
+/// import is refused before reading a file, and its fresh data directory has
+/// no jobs or schedules.
+#[cfg(test)]
+pub(super) fn samples() -> Vec<Sample> {
+    let id = r#"{"id":"missing"}"#;
+    vec![
+        sample(
+            "bg.jobs.purge",
+            r#"{"owner":{"user":"missing","uid":"9999"}}"#,
+            "",
+        ),
+        sample("bg.schedules.list", "{}", ""),
+        sample(
+            "bg.schedules.create",
+            r#"{"key":"schedule","jobId":"missing","intervalSeconds":3600,"consent":true}"#,
+            "not_found",
+        ),
+        sample("bg.schedules.disable", id, "not_found"),
+        sample("bg.schedules.delete", id, "not_found"),
+        sample(
+            "bg.schedules.enable",
+            r#"{"id":"missing","consent":true}"#,
+            "not_found",
+        ),
+        sample("bg.status", "{}", ""),
+        sample("bg.browse", "{}", "session_required"),
+        sample(
+            "bg.jobs.submit",
+            r#"{"key":"k1","folder":"/share","relative":"a.bin"}"#,
+            "session_required",
+        ),
+        sample("bg.jobs.list", "{}", ""),
+        sample("bg.jobs.get", id, "not_found"),
+        sample("bg.jobs.cancel", id, "not_found"),
+        sample("bg.jobs.pause", id, "not_found"),
+        sample("bg.jobs.resume", id, "not_found"),
+        sample("bg.jobs.result", id, "not_found"),
+    ]
+}
+
+#[cfg(test)]
+mod tests {
+    use std::time::{Duration, Instant};
+
+    use syno_pkg_land_sdk::background::{REQUEST_LOCK_TIMEOUT, Store};
+    use syno_pkg_land_sdk::ctx::Context;
+
+    use super::super::test_support::*;
+
+    /// Holds the spool's journal lock, as a busy worker does.
+    struct Flock(std::fs::File);
+
+    impl Flock {
+        fn exclusive(path: &std::path::Path) -> Flock {
+            use std::os::fd::AsRawFd;
+            let file = std::fs::OpenOptions::new()
+                .read(true)
+                .write(true)
+                .open(path)
+                .unwrap();
+            // SAFETY: the descriptor is open for the file's lifetime.
+            let rc = unsafe { libc::flock(file.as_raw_fd(), libc::LOCK_EX | libc::LOCK_NB) };
+            assert_eq!(rc, 0, "{}", std::io::Error::last_os_error());
+            Flock(file)
+        }
+    }
+
+    impl Drop for Flock {
+        fn drop(&mut self) {
+            use std::os::fd::AsRawFd;
+            // SAFETY: the descriptor is open for the file's lifetime.
+            unsafe { libc::flock(self.0.as_raw_fd(), libc::LOCK_UN) };
+        }
+    }
+
+    #[test]
+    fn a_busy_spool_is_reported_within_the_request_budget() {
+        let fixture = Fixture::new();
+        let dir = fixture.cfg.data_dir.join("background");
+        // The first read creates the spool and its lock.
+        Store::new_request(&dir)
+            .list(&Context::background())
+            .unwrap();
+        let _held = Flock::exclusive(&dir.join("lock"));
+
+        let start = Instant::now();
+        let (code, out) = call(&fixture.cfg, &alice(), "bg.jobs.list", "{}");
+        assert_eq!(code, "jobs_busy", "{out}");
+        assert!(start.elapsed() < REQUEST_LOCK_TIMEOUT + Duration::from_secs(1));
+    }
+}

package/templates/native-rust-root-ops/backend/src/app/root_routes.rs

@@ -0,0 +1,475 @@
+use std::io::Read;
+use std::os::unix::fs::DirBuilderExt;
+use std::sync::Arc;
+use std::time::Duration;
+
+use serde::Deserialize;
+use serde_json::Value;
+use syno_pkg_land_sdk::BoxError;
+use syno_pkg_land_sdk::api::{self, Caller, Route};
+use syno_pkg_land_sdk::ctx::Context;
+use syno_pkg_land_sdk::delegate::{
+    self, Auth, CODE_EXECUTOR_UNAVAILABLE, CODE_POLICY_DENIED, Client, ExecutorClient,
+    ExecutorStatus,
+};
+use syno_pkg_land_sdk::http::Request;
+use syno_pkg_land_sdk::jsonx::Empty;
+
+use super::Config;
+use super::routes::{decode_params, write_file_atomic};
+#[cfg(test)]
+use super::test_support::{Sample, sample};
+
+impl Config {
+    pub(super) fn root_routes(self: &Arc<Self>) -> Vec<Route> {
+        vec![
+            self.handle("executor.control", Config::executor_control),
+            self.handle("executor.status", Config::executor_status),
+            self.handle_request("root.run", Config::executor_root_run),
+        ]
+    }
+
+    /// API permissions default to administrators for unlisted methods. Check
+    /// here too: control mutates the fixed package-owned control file before
+    /// DSM runs it.
+    fn executor_control(
+        &self,
+        _: &Context,
+        caller: &Caller,
+        raw: &[u8],
+    ) -> Result<Value, BoxError> {
+        api::require_admin(caller)?;
+        #[derive(Default, Deserialize)]
+        #[serde(deny_unknown_fields)]
+        struct Params {
+            #[serde(default)]
+            action: String,
+        }
+        let params: Params = decode_params(raw)?;
+        if !["start", "stop", "purge"].contains(&params.action.as_str()) {
+            return Err(api::Error::bad_request("executor_control_invalid").into());
+        }
+        let dir = self.data_dir.join("executor");
+        std::fs::DirBuilder::new()
+            .recursive(true)
+            .mode(0o700)
+            .create(&dir)?;
+        let info = std::fs::symlink_metadata(&dir)?;
+        if !info.is_dir() || info.file_type().is_symlink() {
+            return Err("executor_control_directory_invalid".into());
+        }
+        write_file_atomic(&dir.join("control"), params.action.as_bytes())?;
+        Ok(serde_json::json!({"written": true}))
+    }
+
+    /// The executor closes its socket while paused: the package is stopped,
+    /// or an upgrade changed the pins and awaits administrator approval.
+    fn executor_status(&self, ctx: &Context, _: &Caller, _: &[u8]) -> Result<Value, BoxError> {
+        match delegate::call::<_, Value>(&*self.executor(), ctx, "status", &Auth::new(), &Empty {})
+        {
+            Err(err)
+                if api::find_error::<api::Error>(&*err)
+                    .is_some_and(|refusal| refusal.code == CODE_EXECUTOR_UNAVAILABLE) =>
+            {
+                let next = if self.start_requested() {
+                    "The package is running: an administrator approves background access again in Administrator setup; the executor log names the cause."
+                } else {
+                    "Start the package."
+                };
+                Ok(serde_json::json!({
+                    "ready": false, "state": "paused",
+                    "reason": "executor_not_listening", "next": next,
+                }))
+            }
+            status => status,
+        }
+    }
+
+    /// Package start and stop write the lifecycle mailbox; its last request
+    /// tells a stopped package from a running one whose executor stays paused.
+    fn start_requested(&self) -> bool {
+        let Ok(mut file) = std::fs::File::open(self.data_dir.join("executor").join("control"))
+        else {
+            return false;
+        };
+        let mut buf = [0u8; 16];
+        let n = file.read(&mut buf).unwrap_or(0);
+        String::from_utf8_lossy(&buf[..n]).trim() == "start"
+    }
+
+    fn executor_root_run(
+        &self,
+        ctx: &Context,
+        caller: &Caller,
+        req: &Request,
+        raw: &[u8],
+    ) -> Result<Value, BoxError> {
+        api::require_admin(caller)?;
+        #[derive(Default, Deserialize)]
+        #[serde(deny_unknown_fields)]
+        struct Params {
+            #[serde(default)]
+            name: String,
+        }
+        let params: Params = decode_params(raw)?;
+        // The executor independently verifies both session values and the
+        // administrator identity.
+        let auth = api::dsm_session(req)?;
+        self.executor_holds_this_build(ctx)?;
+        delegate::call(
+            &*self.executor(),
+            ctx,
+            "root.run",
+            &auth,
+            &serde_json::json!({"name": params.name}),
+        )
+    }
+
+    /// Refuses, as delegate does, an executor pinned to another build's
+    /// policy or executor: its approved scripts are not this build's.
+    fn executor_holds_this_build(&self, ctx: &Context) -> Result<(), BoxError> {
+        let pins: ExecutorStatus =
+            delegate::call(&*self.executor(), ctx, "status", &Auth::new(), &Empty {})?;
+        if (!self.executor_digest.is_empty() && pins.executor_digest != self.executor_digest)
+            || (!self.policy_digest.is_empty() && pins.policy_digest != self.policy_digest)
+        {
+            return Err(api::Error::new(
+                CODE_POLICY_DENIED,
+                "the executor holds another build's approved policy; an administrator approves this build in Administrator setup",
+            )
+            .into());
+        }
+        Ok(())
+    }
+
+    /// Keeps the executor's protocol v1 refusal codes (POLICY_DENIED,
+    /// EXECUTOR_UNAVAILABLE, ...) as the API error code.
+    fn executor(&self) -> Arc<dyn ExecutorClient> {
+        self.executor.clone().unwrap_or_else(|| {
+            Arc::new(Client {
+                timeout: Duration::from_secs(30),
+                ..Client::local(&self.package_id)
+            })
+        })
+    }
+}
+
+/// Valid params for the root routes. root.run needs a DSM session the
+/// fixture does not have.
+#[cfg(test)]
+pub(super) fn samples() -> Vec<Sample> {
+    vec![
+        sample("executor.control", r#"{"action":"stop"}"#, ""),
+        sample("executor.status", "{}", ""),
+        sample("root.run", r#"{"name":"whoami"}"#, "session_required"),
+    ]
+}
+
+#[cfg(test)]
+mod tests {
+    use std::io::{BufRead, BufReader, Write};
+    use std::os::unix::net::UnixListener;
+    use std::path::PathBuf;
+    use std::sync::Mutex;
+    use std::sync::atomic::{AtomicBool, AtomicU64, Ordering};
+
+    use super::super::test_support::*;
+    use super::*;
+    use crate::permissions::permissions;
+
+    /// Unix socket paths are limited to about 100 bytes, so the executor's
+    /// fake lives in a short directory under /tmp.
+    struct SocketBase(PathBuf);
+
+    impl SocketBase {
+        fn new() -> Self {
+            static NEXT: AtomicU64 = AtomicU64::new(0);
+            let base = PathBuf::from(format!(
+                "/tmp/exec-{}-{}",
+                std::process::id(),
+                NEXT.fetch_add(1, Ordering::SeqCst)
+            ));
+            let _ = std::fs::remove_dir_all(&base);
+            std::fs::create_dir_all(&base).unwrap();
+            SocketBase(base)
+        }
+
+        fn socket(&self, cfg: &Config) -> PathBuf {
+            let dir = self.0.join(&cfg.package_id);
+            std::fs::create_dir_all(&dir).unwrap();
+            dir.join("executor.sock")
+        }
+
+        /// Points cfg at an executor under this base.
+        fn attach(&self, cfg: &mut Config) {
+            cfg.executor = Some(Arc::new(Client {
+                socket: self.socket(cfg).to_string_lossy().into_owned(),
+                timeout: Duration::from_secs(5),
+            }));
+        }
+    }
+
+    impl Drop for SocketBase {
+        fn drop(&mut self) {
+            let _ = std::fs::remove_dir_all(&self.0);
+        }
+    }
+
+    /// Answers each v1 request with replies[op] and records the ops.
+    struct FakeExecutor {
+        ops: Arc<Mutex<Vec<String>>>,
+        stop: Arc<AtomicBool>,
+        socket: PathBuf,
+    }
+
+    impl FakeExecutor {
+        fn start(base: &SocketBase, cfg: &mut Config, replies: &[(&str, String)]) -> Self {
+            base.attach(cfg);
+            let socket = base.socket(cfg);
+            let listener = UnixListener::bind(&socket).unwrap();
+            let replies: Vec<(String, String)> = replies
+                .iter()
+                .map(|(op, reply)| (op.to_string(), reply.clone()))
+                .collect();
+            let ops = Arc::new(Mutex::new(Vec::new()));
+            let stop = Arc::new(AtomicBool::new(false));
+            let (seen, done) = (ops.clone(), stop.clone());
+            std::thread::spawn(move || {
+                for conn in listener.incoming() {
+                    if done.load(Ordering::SeqCst) {
+                        return;
+                    }
+                    let Ok(mut conn) = conn else { return };
+                    let mut line = String::new();
+                    let _ = BufReader::new(&conn).read_line(&mut line);
+                    let request: Value = serde_json::from_str(&line).unwrap_or_default();
+                    let op = request["op"].as_str().unwrap_or("").to_string();
+                    let reply = replies
+                        .iter()
+                        .find(|(name, _)| *name == op)
+                        .map(|(_, reply)| reply.clone())
+                        .unwrap_or_default();
+                    seen.lock().unwrap().push(op);
+                    let _ = writeln!(conn, "{reply}");
+                }
+            });
+            FakeExecutor { ops, stop, socket }
+        }
+
+        fn received(&self) -> Vec<String> {
+            self.ops.lock().unwrap().clone()
+        }
+    }
+
+    impl Drop for FakeExecutor {
+        fn drop(&mut self) {
+            self.stop.store(true, Ordering::SeqCst);
+            let _ = std::os::unix::net::UnixStream::connect(&self.socket);
+        }
+    }
+
+    fn data(out: &Value) -> &Value {
+        &out["data"]
+    }
+
+    #[test]
+    fn executor_control_accepts_only_fixed_actions() {
+        let fixture = Fixture::new();
+        let cfg = &fixture.cfg;
+        for action in ["start", "stop", "purge"] {
+            let (code, out) = call(
+                cfg,
+                &alice(),
+                "executor.control",
+                &format!(r#"{{"action":"{action}"}}"#),
+            );
+            assert_eq!(code, "", "{action}: {out}");
+            let written = std::fs::read_to_string(cfg.data_dir.join("executor/control")).unwrap();
+            assert_eq!(written, action);
+        }
+        for raw in [
+            r#"{"action":"start;id"}"#,
+            r#"{"action":"start\nstop"}"#,
+            r#"{"action":""}"#,
+            r#"{"action":"stop","path":"/etc/passwd"}"#,
+        ] {
+            assert_eq!(
+                call(cfg, &alice(), "executor.control", raw).0,
+                "bad_request",
+                "{raw}"
+            );
+        }
+    }
+
+    #[test]
+    fn executor_control_rejects_a_symlinked_directory() {
+        let fixture = Fixture::new();
+        let outside = fixture.scratch();
+        std::os::unix::fs::symlink(&outside, fixture.cfg.data_dir.join("executor")).unwrap();
+        let (code, _) = call(
+            &fixture.cfg,
+            &alice(),
+            "executor.control",
+            r#"{"action":"stop"}"#,
+        );
+        assert_ne!(code, "", "accepted symlink");
+        assert!(
+            !outside.join("control").exists(),
+            "wrote outside data directory"
+        );
+    }
+
+    #[test]
+    fn root_run_requires_the_current_dsm_cookie() {
+        let fixture = Fixture::new();
+        let (code, _) = call(&fixture.cfg, &alice(), "root.run", r#"{"name":"whoami"}"#);
+        assert_ne!(code, "", "root.run accepted an absent DSM cookie");
+    }
+
+    /// The executor closes its listener while paused (package stopped, or pins
+    /// awaiting administrator approval). Status then answers, not "internal".
+    #[test]
+    fn executor_status_reports_a_paused_executor() {
+        let mut fixture = Fixture::new();
+        let base = SocketBase::new();
+        base.attach(&mut fixture.cfg);
+        let check = |name: &str| {
+            let (code, out) = call(&fixture.cfg, &alice(), "executor.status", "{}");
+            let d = data(&out);
+            assert_eq!(code, "", "{name}: {out}");
+            assert_eq!(d["ready"], false, "{name}: {out}");
+            assert_eq!(d["state"], "paused", "{name}: {out}");
+            assert_eq!(d["reason"], "executor_not_listening", "{name}: {out}");
+            assert!(
+                !d["next"].as_str().unwrap_or("").is_empty(),
+                "{name}: {out}"
+            );
+        };
+        check("no socket");
+        let (code, _) = call(&fixture.cfg, &bob(), "executor.status", "{}");
+        assert_eq!(
+            code, "",
+            "an authenticated user cannot read a paused status"
+        );
+        drop(UnixListener::bind(base.socket(&fixture.cfg)).unwrap());
+        check("closed listener");
+    }
+
+    /// next follows the last lifecycle request: a running package needs
+    /// approval again, not a start.
+    #[test]
+    fn executor_status_next_follows_the_lifecycle_request() {
+        let mut fixture = Fixture::new();
+        let base = SocketBase::new();
+        base.attach(&mut fixture.cfg);
+        let next = || {
+            let (_, out) = call(&fixture.cfg, &alice(), "executor.status", "{}");
+            data(&out)["next"].as_str().unwrap_or("").to_string()
+        };
+        assert!(
+            next().starts_with("Start the package."),
+            "no request: {}",
+            next()
+        );
+        let mailbox = fixture.cfg.data_dir.join("executor");
+        std::fs::create_dir_all(&mailbox).unwrap();
+        for (request, start) in [("stop\n", true), ("start\n", false), ("start", false)] {
+            std::fs::write(mailbox.join("control"), request).unwrap();
+            let got = next();
+            assert_eq!(
+                got.starts_with("Start the package"),
+                start,
+                "{request:?}: {got}"
+            );
+            assert!(!got.is_empty());
+        }
+    }
+
+    const READY: &str = r#"{"ok":true,"result":{"executor_digest":"e1","policy_digest":"p1","ready":true,"disabled":false,"version":"1"}}"#;
+    const WHOAMI: &str = r#"{"ok":true,"result":{"output":"0\n"}}"#;
+
+    fn pinned() -> Fixture {
+        let mut fixture = Fixture::new();
+        fixture.cfg.executor_digest = "e1".into();
+        fixture.cfg.policy_digest = "p1".into();
+        fixture
+    }
+
+    /// root.run as an administrator with a current DSM session.
+    fn root_run(cfg: &Config, name: &str) -> (String, Value) {
+        let mut req = api_request("root.run", &format!(r#"{{"name":"{name}"}}"#));
+        req.header.set("Cookie", "id=session");
+        req.header.set("X-SYNO-TOKEN", "token");
+        serve(cfg, &alice(), req, permissions().unwrap())
+    }
+
+    #[test]
+    fn root_run_runs_when_the_executor_holds_this_builds_pins() {
+        let mut fixture = pinned();
+        let base = SocketBase::new();
+        let _executor = FakeExecutor::start(
+            &base,
+            &mut fixture.cfg,
+            &[("status", READY.into()), ("root.run", WHOAMI.into())],
+        );
+        let (code, out) = root_run(&fixture.cfg, "whoami");
+        assert_eq!(code, "", "{out}");
+        assert_eq!(data(&out)["output"], "0\n");
+    }
+
+    /// Like delegate: an executor pinned to another build's policy or
+    /// executor refuses the operation, it does not run it.
+    #[test]
+    fn root_run_refuses_an_executor_pinned_to_another_build() {
+        for (name, status) in [
+            ("policy", READY.replacen("\"p1\"", "\"p2\"", 1)),
+            ("executor", READY.replacen("\"e1\"", "\"e2\"", 1)),
+        ] {
+            let mut fixture = pinned();
+            let base = SocketBase::new();
+            let executor = FakeExecutor::start(
+                &base,
+                &mut fixture.cfg,
+                &[("status", status), ("root.run", WHOAMI.into())],
+            );
+            let (code, out) = root_run(&fixture.cfg, "whoami");
+            assert_eq!(code, "POLICY_DENIED", "{name} digest mismatch: {out}");
+            assert!(
+                !executor.received().contains(&"root.run".to_string()),
+                "{name} digest mismatch: root.run reached the executor"
+            );
+        }
+    }
+
+    /// Refusals keep the protocol v1 code (spec/protocol/v1/errors.json),
+    /// never "internal".
+    #[test]
+    fn root_run_reports_the_executors_refusal_code() {
+        let mut fixture = pinned();
+        let base = SocketBase::new();
+        base.attach(&mut fixture.cfg);
+        let (code, _) = root_run(&fixture.cfg, "whoami");
+        assert_eq!(
+            code, "EXECUTOR_UNAVAILABLE",
+            "paused or awaiting approval (no socket)"
+        );
+        for refusal in [
+            "POLICY_DENIED",
+            "INVALID_REQUEST",
+            "EXECUTOR_PAUSED",
+            "ROOT_FAILED",
+            "ADMIN_REQUIRED",
+        ] {
+            let mut fixture = pinned();
+            let base = SocketBase::new();
+            let reply = format!(r#"{{"ok":false,"code":"{refusal}","message":"refused"}}"#);
+            let _executor = FakeExecutor::start(
+                &base,
+                &mut fixture.cfg,
+                &[("status", READY.into()), ("root.run", reply)],
+            );
+            let (code, out) = root_run(&fixture.cfg, "whoami");
+            assert_eq!(code, refusal, "{out}");
+        }
+    }
+}

package/templates/native-rust-vue/README.md

@@ -0,0 +1,55 @@
+# Native Rust with Vue
+
+Edit `frontend/src/App.vue` and `main.ts` to build a DSM-window app with the
+public `@synopackageland/ui` components and embedded theme. The shell, sign-in,
+files, portal, jobs and delegate components come from `@synopackageland/sdk/vue`
+(types from `@synopackageland/sdk`); its version must equal the
+`syno-pkg-land-sdk` tag in `backend/Cargo.toml`. See
+<https://github.com/synopackageland/syno-pkg-land-sdk> for the components and their props.
+
+```sh
+cd frontend
+npm ci
+npm test
+npm run build
+```
+
+The base app reads package status and edits the package greeting through
+`ctx.call`. Each window has its own Vue mount, request state and host
+subscriptions; unmount disposes subscriptions and ignores late responses.
+
+`--with root-ops` adds the existing DSM approval gate for fixed `root/*.sh`
+operations. `--with jobs` adds package-account jobs and schedules; it combines with root-ops and files. `--with files` enables current-session File Station access,
+and the background picker uses the retained session provider.
+
+With `portal:` declared (`synopkgland add portal`, executor Apps only), the status page shows
+the SDK's `PortalSettings`: the DSM Application Portal link, the alias form
+for administrators, and the Control Panel shortcut.
+
+Use public library controls, the embedded theme, per-app modal scope and unique
+Vue ID prefixes. Backend route permissions and DSM checks remain authoritative.
+Generated build and unit tests do not establish NAS runtime acceptance.
+
+The manifest is dsm-package.yaml schema 2: backend.kind: rust and capabilities.files: session, jobs: true, identity: standalone, rootOps: true. Use --with login to declare standalone identity. Existing projects use synopkgland add <cap>...; app entrypoints stay app-owned, SDK conflicts are refused. check, inspect, build, deploy and status accept --json.
+
+Use the installed `@synopackageland/ui`; package.json pins its version.
+`AppRoot` defaults to app modal scope and stays bounded at `height: 100%`;
+`AppLayout wide-layout="window"` keeps the DSM shell in window mode even when
+maximized. Only whole-page web/Portal apps should opt into document scope or
+`wide-layout="web"`. The DSM host sets the 700px minimum window width.
+In a DSM window (`ctx.host.platform().host === 'dsm'`) `AppRoot` takes
+`dialog-bounds="viewport"`, so Dialogs can be dragged out of the window, and
+its `activate` event calls `ctx.host.activateWindow()` to bring the window to
+the front. Elsewhere Dialogs stay inside the App.
+Import `themes/dsm7-embedded.css` and assign each mount a unique
+`app.config.idPrefix` before mounting.
+
+Start with AGENTS.md, `synopkgland skill list` and `synopkgland skill path`.
+Read `synopkgland skill show ui-vue` for direct Vue component work and
+`synopkgland skill show ui-json` for optional declarative specs and their
+validate/render workflow. The existing host/backend lifecycle remains in place.
+
+For UI discovery, run `npx --no syno-pkg-land-ui catalog --json` and
+`npx --no syno-pkg-land-ui describe Button --json` from the installed frontend.
+Read its prompt and exported Vue docs/types before choosing component APIs.
+Use `syno-pkg-land-ui` directly in npm scripts; keep AI guidance version-independent.

package/templates/native-rust-vue/gitignore

@@ -0,0 +1,3 @@
+dist/
+node_modules/
+backend/target/