jpkg: complete binary package setup

ober

e3e54d93ae0fec1043271191c03387ec9e6c2830

diff --git a/.gitignore b/.gitignore
index 39c6104..1bc2402 100644
--- a/.gitignore
+++ b/.gitignore
@@ -46,3 +46,4 @@ support/ffi-symbols.gen
 
 # Release evidence generated by make release-evidence
 /dist/
+.jpkg/
diff --git a/.jerbuild b/.jerbuild
index 61bb9a7..3b1f1a6 100644
--- a/.jerbuild
+++ b/.jerbuild
@@ -3,7 +3,8 @@
 ;; jerbuild bundles Chez Scheme + the jerboa stdlib + the jerboa-native Rust
 ;; crate, so this needs only jerbuild + a C compiler + cargo (with the
 ;; wasm32-unknown-unknown target for the sandbox payloads). No jerboa source
-;; checkout. jerboa-native is built with just the wasm sandbox feature.
+;; checkout. The generated FFI table also includes the TLS and crypto surface
+;; pulled in by the server, so all three feature groups are linked statically.
 
 (entry "bin/jdns.ss")
 (output "jdns")
@@ -13,5 +14,5 @@
 (pre-build "sh wasm/build.sh")
 (rust-crates
   ("@bundle/jerboa-native-rs/Cargo.toml"
-   features: "wasm"
+   features: "tls,crypto,wasm"
    no-default-features: #t))
diff --git a/jpkg.lock b/jpkg.lock
new file mode 100644
index 0000000..6035213
--- /dev/null
+++ b/jpkg.lock
@@ -0,0 +1,2 @@
+;; jpkg.lock — generated by jpkg; records the exact resolved dependency graph. Do not edit by hand.
+(lock (version 1) (packages ()) )
diff --git a/jpkg.policy.sexp b/jpkg.policy.sexp
new file mode 100644
index 0000000..3f95f7f
--- /dev/null
+++ b/jpkg.policy.sexp
@@ -0,0 +1,3 @@
+(policy
+  (mode dev)
+  (allow (native-build) (ffi)))
diff --git a/jpkg.sexp b/jpkg.sexp
index c186f15..3206602 100644
--- a/jpkg.sexp
+++ b/jpkg.sexp
@@ -8,4 +8,6 @@
   (modules ((root "lib")))
   (dependencies ())
   (dev-dependencies ())
-  (capabilities ()))
+  (capabilities ((native-code reason: "Wasm and Rust FFI build support")
+                 (ffi libraries: ())
+                 (executables ("jdns")))))