@synopackageland/cli 0.5.3 → 0.6.1

package/templates/native-go-vue/frontend/src/files/files.test.ts

@@ -0,0 +1,93 @@
+// @vitest-environment jsdom
+import {afterEach,expect,test,vi} from 'vitest'
+import {createApp,h,nextTick,ref} from 'vue'
+import {AppRoot} from '@synopackageland/ui'
+import FileBrowser from './FileBrowser.vue'
+import NasPicker from '../nas/NasPicker.vue'
+import {createNasProvider} from '../nas/provider'
+import {nasCopy} from '../nas/locale'
+
+async function settle(){for(let i=0;i<30;i++){await Promise.resolve();await nextTick()}await new Promise(r=>setTimeout(r,20))}
+const cleanup:Array<()=>void>=[]
+afterEach(()=>{cleanup.splice(0).forEach(fn=>fn())})
+const folder=(path:string)=>({path,name:path.split('/').at(-1)!,isdir:true})
+const file=(path:string)=>({path,name:path.split('/').at(-1)!,isdir:false,additional:{size:2}})
+function mount(component:any,call:any,extra:Record<string,unknown>={}){
+ const root=document.createElement('div');document.body.append(root)
+ const app=createApp({render:()=>h(AppRoot,{},()=>h(component,{provider:createNasProvider({call}),locale:'en',...extra}))})
+ app.mount(root);cleanup.push(()=>{app.unmount();root.remove()});return root
+}
+function button(root:HTMLElement,label:string){const node=Array.from(root.querySelectorAll('button')).find(n=>n.textContent?.trim()===label||n.getAttribute('aria-label')===label);expect(node,label).toBeTruthy();return node!}
+function fixture(){
+ return vi.fn(async(method:string,params:any)=>{
+  if(method==='nas.files.shares')return {shares:[folder('/homes'),folder('/shared')],offset:0,total:2}
+  if(method==='nas.files.list')return {files:params.path==='/homes'?[folder('/homes/sub'),file('/homes/a.txt')]:[],offset:params.offset??0,total:params.path==='/homes'?2:0}
+  throw {code:'unknown_method'}
+ })
+}
+test('tree loads roots only and loads children on first expansion, including DSM-returned homes',async()=>{
+ const call=fixture(),root=mount(FileBrowser,call);await settle()
+ expect(call.mock.calls.map(([m])=>m)).toEqual(['nas.files.shares'])
+ expect(root.textContent).toContain('homes')
+ button(root,'Expand homes').click();await settle()
+ expect(call.mock.calls.filter(([m])=>m==='nas.files.list')).toHaveLength(1)
+ expect(root.textContent).toContain('sub')
+ button(root,'Collapse homes').click();await settle();button(root,'Expand homes').click();await settle()
+ expect(call.mock.calls.filter(([m])=>m==='nas.files.list')).toHaveLength(1)
+})
+test.each(['folder','file'] as const)('picker returns a DSM path in %s mode without creating grants',async(mode)=>{
+ const call=fixture(),selected=vi.fn(),root=mount(NasPicker,call,{open:true,mode,onSelected:selected});await settle()
+ button(root,'Open homes').click();await settle()
+ if(mode==='file')button(root,'Select a.txt').click()
+ else button(root,'Select homes').click()
+ await settle();button(root,nasCopy('en').confirm).click();await settle()
+ expect(selected).toHaveBeenCalledWith(mode==='file'?'/homes/a.txt':'/homes')
+ expect(call.mock.calls.every(([m])=>!m.includes('grants'))).toBe(true)
+})
+test.each([407,408,'denied'])('permission error %s is visible and suppresses misleading empty state',async(code)=>{
+ const call=vi.fn(async()=>{throw {code,message:'secret SID'}}),root=mount(FileBrowser,call);await settle()
+ expect(root.querySelector('[role="alert"]')?.textContent).toContain(nasCopy('en').errorDenied)
+ expect(root.textContent).not.toContain('secret SID')
+ expect(root.textContent).not.toContain(nasCopy('en').emptyFolder)
+ expect(button(root,nasCopy('en').refresh).disabled).toBe(false)
+})
+test('folder navigation clears selection when permissions are lost',async()=>{
+ const call=fixture(),root=mount(FileBrowser,call,{mode:'file'});await settle()
+ button(root,'Open homes').click();await settle();button(root,'Select a.txt').click();await settle()
+ call.mockRejectedValue({code:'denied'});button(root,nasCopy('en').refresh).click();await settle()
+ expect(root.querySelector('[role="alert"]')).toBeTruthy()
+ expect(root.textContent).not.toContain('a.txt')
+})
+
+test('lazy tree follows full DSM page cursors even when a page contains only files',async()=>{
+ const call=vi.fn(async(method:string,params:any)=>{
+  if(method==='nas.files.shares')return {shares:[folder('/team')],offset:0,total:1}
+  if(params.offset===0)return {files:[file('/team/a.txt')],offset:0,total:2}
+  return {files:[folder('/team/later')],offset:1,total:2}
+ })
+ const root=mount(FileBrowser,call);await settle();button(root,'Expand team').click();await settle()
+ expect(call.mock.calls.filter(([m])=>m==='nas.files.list').map(([,p])=>p.offset)).toEqual([0,1])
+ expect(root.textContent).toContain('later')
+})
+test('reopening picker clears the old path and reloads current DSM visibility',async()=>{
+ const call=fixture(),open=ref(true),selected=vi.fn(),root=document.createElement('div');document.body.append(root)
+ const provider=createNasProvider({call:call as any})
+ const app=createApp({render:()=>h(AppRoot,{},()=>h(NasPicker,{provider,locale:'en',mode:'folder',open:open.value,onSelected:selected,'onUpdate:open':v=>{open.value=v}}))})
+ app.mount(root);cleanup.push(()=>{app.unmount();root.remove()})
+ await settle();button(root,'Select homes').click();await settle();button(root,nasCopy('en').confirm).click();await settle()
+ expect(selected).toHaveBeenCalledWith('/homes')
+ open.value=true;await settle()
+ expect(button(root,nasCopy('en').confirm).disabled).toBe(true)
+ expect(call.mock.calls.filter(([m])=>m==='nas.files.shares')).toHaveLength(2)
+})
+
+test('file browser downloads selected files and streams uploads to the current folder',async()=>{
+ const call=fixture(),provider=createNasProvider({call:call as any}),upload=vi.fn(async()=>{}),download=vi.fn(),info=vi.fn(async()=>({name:'a.txt',path:'/homes/a.txt',isDir:false}))
+ const root=mount(FileBrowser,call,{transfers:true,provider:{...provider,upload,download,info}});await settle()
+ button(root,'Open homes').click();await settle();button(root,'Select a.txt').click();await settle()
+ button(root,nasCopy('en').download).click();await settle();expect(info).toHaveBeenCalledWith('/homes/a.txt',expect.any(AbortSignal));expect(download).toHaveBeenCalledWith('/homes/a.txt')
+ const picker=root.querySelector<HTMLInputElement>('input[type=file]')!;expect(picker).toBeTruthy()
+ const file=new File(['payload'],'upload.txt');Object.defineProperty(picker,'files',{value:[file],configurable:true});picker.dispatchEvent(new Event('change',{bubbles:true}));await settle()
+ button(root,nasCopy('en').upload).click();await settle()
+ expect(upload).toHaveBeenCalledWith('/homes',file,expect.any(AbortSignal));expect(root.textContent).toContain(nasCopy('en').uploaded)
+})

package/templates/native-go-vue/frontend/src/files/provider.test.ts

@@ -0,0 +1,48 @@
+import {expect,test,vi} from 'vitest'
+import {createNasProvider} from '../nas/provider'
+import {nasCatalogs,nasCopy,nasErrorCopy} from '../nas/locale'
+const signal=()=>new AbortController().signal
+
+test('provider forwards pagination/sorting and preserves every DSM-returned path',async()=>{
+ const call=vi.fn(async()=>({files:[{name:'outside homes',path:'/team/outside homes',isdir:false,additional:{size:12}}],offset:100,total:102}))
+ const p=createNasProvider({call:call as any})
+ const page=await p.list('/team',{offset:100,limit:1,sortBy:'size',sortDirection:'DESC'},signal())
+ expect(call).toHaveBeenCalledWith('nas.files.list',{path:'/team',offset:100,limit:1,sortBy:'size',sortDirection:'DESC'})
+ expect(page.entries[0]?.path).toBe('/team/outside homes');expect(page.nextOffset).toBe(101)
+})
+test.each([
+ {},{files:[],offset:0,total:1},{files:[],offset:-1,total:0},
+ {files:[{name:'x',path:'/x',isdir:true}],offset:0,total:0},
+ {files:[{name:'x',path:'/x',isdir:'true'}],offset:0,total:1},
+])('malformed or stalled page fails visibly: %j',async(value)=>{
+ const p=createNasProvider({call:vi.fn(async()=>value) as any})
+ await expect(p.shares(0,signal())).rejects.toEqual({code:'unavailable'})
+})
+test('canceling or disposing observation rejects late results and stops subsequent calls',async()=>{
+ let resolve!:(v:unknown)=>void
+ const call=vi.fn(()=>new Promise(r=>{resolve=r})),p=createNasProvider({call:call as any}),abort=new AbortController()
+ const pending=p.shares(0,abort.signal);abort.abort()
+ await expect(pending).rejects.toEqual({code:'canceled'})
+ resolve({shares:[],offset:0,total:0});p.dispose()
+ await expect(p.shares(0,signal())).rejects.toEqual({code:'canceled'})
+ expect(call).toHaveBeenCalledTimes(1)
+})
+test('lost mutation response stays uncertain and sensitive error details are discarded',async()=>{
+ const p=createNasProvider({call:vi.fn(async()=>{throw {message:'SID=secret',code:'transport_error'}})})
+ await expect(p.createFolder('/team','new',signal())).rejects.toEqual({code:'commit-uncertain'})
+})
+test('all supported locales share copy keys, aliases and explicit permission errors',()=>{
+ const keys=Object.keys(nasCopy('en')).sort()
+ for(const copy of Object.values(nasCatalogs)){
+  expect(Object.keys(copy).sort()).toEqual(keys)
+  expect(nasErrorCopy({code:'denied',message:'SID=secret'},copy)).toBe(copy.errorDenied)
+ }
+ expect(nasCopy('cht')).toBe(nasCopy('zh-TW'))
+ expect(nasCopy('unknown')).toBe(nasCopy('en'))
+})
+
+test('App-only file errors retain a DSM-login recovery hint',async()=>{
+ const p=createNasProvider({call:vi.fn(async()=>{throw {code:'dsm_session_required'}})})
+ await expect(p.shares(0,signal())).rejects.toEqual({code:'dsm_session_required'})
+ expect(nasErrorCopy({code:'dsm_session_required'},nasCopy('en'))).toContain('DSM')
+})

package/templates/native-go-vue/frontend/src/files/transfers.test.ts

@@ -0,0 +1,27 @@
+// @vitest-environment jsdom
+import {expect,test,vi,afterEach} from 'vitest'
+import {createFileTransfers} from './transfers'
+afterEach(()=>vi.unstubAllGlobals())
+test('upload passes the File itself with caller credentials and a header token',async()=>{
+ const fetch=vi.fn(async()=>({json:async()=>({success:true,data:{uploaded:true}})}));vi.stubGlobal('fetch',fetch)
+ const file=new File(['payload'],'\u5831\u544a.txt'),signal=new AbortController().signal
+ await createFileTransfers({endpoint:'/cgi/api.cgi',token:()=> 'caller-token'}).upload('/home',file,signal)
+ const [url,request]=fetch.mock.calls[0] as any
+ expect(url).toContain('method=nas.files.upload');expect(url).toContain('parent=%2Fhome')
+ expect(request.body).toBe(file);expect(request.signal).toBe(signal);expect(request.credentials).toBe('same-origin');expect(request.headers['X-SYNO-TOKEN']).toBe('caller-token')
+})
+test('native download sends the caller token in a POST body, never a URL',()=>{
+ let action='',method='',token=''
+ const submit=vi.spyOn(HTMLFormElement.prototype,'submit').mockImplementation(function(this:HTMLFormElement){action=this.action;method=this.method;token=(this.elements.namedItem('SynoToken') as HTMLInputElement).value})
+ const transfers=createFileTransfers({endpoint:'/cgi/api.cgi',token:()=> 'secret'})
+ transfers.download('/home/\u5831\u544a.txt')
+ expect(action).toContain('method=nas.files.download');expect(action).not.toContain('secret');expect(method).toBe('post');expect(token).toBe('secret')
+ expect(document.querySelector('form')).toBeNull();transfers.dispose();expect(document.querySelector('iframe')).toBeNull();submit.mockRestore()
+})
+test('lost upload response is uncertain and server DSM refusal stays actionable',async()=>{
+ vi.stubGlobal('fetch',vi.fn(async()=>{throw Error('offline')}))
+ const t=createFileTransfers({endpoint:'/cgi/api.cgi'}),file=new File(['a'],'a')
+ await expect(t.upload('/home',file,new AbortController().signal)).rejects.toEqual({code:'commit-uncertain'})
+ vi.stubGlobal('fetch',vi.fn(async()=>({json:async()=>({success:false,error:{code:'dsm_session_required'}})})))
+ await expect(t.upload('/home',file,new AbortController().signal)).rejects.toEqual({code:'dsm_session_required'})
+})

package/templates/native-go-vue/frontend/src/files/transfers.ts

@@ -0,0 +1,25 @@
+export interface FileTransport {endpoint:string;token?:()=>string|undefined}
+export function createFileTransfers(transport:FileTransport){
+ const url=(method:string,params:Record<string,string>)=>`${transport.endpoint}?${new URLSearchParams({method,...params})}`
+ const frames=new Set<HTMLIFrameElement>()
+ return {
+  download(path:string):void{
+   const frame=document.createElement('iframe'),form=document.createElement('form'),input=document.createElement('input')
+   frame.name=`spl-download-${crypto.getRandomValues(new Uint32Array(4)).join('-')}`;frame.hidden=true
+   frames.add(frame);document.body.append(frame)
+   form.method='POST';form.action=url('nas.files.download',{path});form.target=frame.name;form.hidden=true
+   input.type='hidden';input.name='SynoToken';input.value=transport.token?.()??'';form.append(input);document.body.append(form)
+   try{form.submit()}finally{input.value='';form.remove()}
+  },
+  dispose(){for(const frame of frames)frame.remove();frames.clear()},
+  async upload(parent:string,file:File,signal:AbortSignal):Promise<void>{
+   if(file.size>16*1024**3)throw {code:'upload_size_required'}
+   const headers:Record<string,string>={'Content-Type':'application/octet-stream'},token=transport.token?.()
+   if(token)headers['X-SYNO-TOKEN']=token
+   let body:any
+   try{const response=await fetch(url('nas.files.upload',{parent,name:file.name}),{method:'POST',credentials:'same-origin',headers,body:file,signal});body=await response.json()}
+   catch{throw {code:'commit-uncertain'}}
+   if(body?.success!==true)throw {code:typeof body?.error?.code==='string'?body.error.code:'commit-uncertain'}
+  },
+ }
+}

package/templates/native-go-vue/frontend/src/identity/DESIGN.md

@@ -0,0 +1,46 @@
+---
+name: Native DSM identity surface
+description: Synology account sign-in within the inherited embedded DSM theme.
+---
+
+# Design System: Identity
+
+## Overview
+
+This Operate surface inherits the frontend design system and public
+`@synopackageland/ui` controls with `themes/dsm7-embedded.css`. It introduces no
+new palette, global tokens or decorative identity. The task is signing in to the
+app with an account on this NAS.
+
+## Layout
+
+The centered form has a maximum width of 36rem, theme spacing and vertical
+overflow. Keep `Form` in automatic direction: labels stack below 520px of
+container width. Actions follow the fields and retain the library's responsive
+layout and keyboard focus treatment.
+
+## Components
+
+Account stays visible with `autocomplete="username"`; password is masked with
+`autocomplete="current-password"`. HTTPS is required and insecure-page sign-in
+controls are disabled.
+
+When DSM requests OTP, the verification field visually replaces the password
+field. The password remains only in component memory for verification; success,
+restart, other errors and unmount clear it. OTP uses numeric input hints and
+`autocomplete="one-time-code"`. Focus moves to OTP after busy clears and the
+field renders.
+
+Busy state disables competing actions and shows “Signing in…”. Danger callouts
+provide safe errors and retry guidance; “Use another account” restarts OTP.
+“Continue with DSM” attempts the browser session. Session expiry returns to
+sign-in with a notice; expiry and successful sign-out clear loaded app data,
+greeting text and feedback.
+
+## Do's and Don'ts
+
+Use inherited controls and theme semantics. Local HTTPS fixture captures at
+1100 by 740 and 390 by 640 pixels verify credential and OTP layout. Keyboard
+submission, enabled OTP focus, app data loading and sign-out were exercised
+locally. The finish review disposition is Ship, with the OTP focus finding
+resolved. This evidence does not establish NAS visual acceptance.

package/templates/native-go-vue/frontend/src/identity/LoginPage.vue

@@ -0,0 +1,76 @@
+<script setup lang="ts">
+import {computed, nextTick, onUnmounted, ref} from 'vue'
+import {Button, Callout, Form, FormActions, FormItem, Input, SettingsSection} from '@synopackageland/ui'
+import type {IdentitySession} from './session'
+const props = defineProps<{session: IdentitySession}>()
+const account = ref('')
+const password = ref('')
+const otp = ref('')
+const needsOTP = ref(false)
+const busy = ref(false)
+const error = ref('')
+const otpField = ref<HTMLElement>()
+const secure = computed(() => window.location.protocol === 'https:')
+let disposed = false
+function message(e: unknown) {
+ const code = (e as {code?: string})?.code
+ return ({rate_limited: 'Too many sign-in attempts. Wait one minute and try again.', https_required: 'Open this app using HTTPS to sign in.', auth_unavailable: 'DSM sign-in is unavailable. Try again.', session_required: 'Sign in to DSM in this browser, then try again.'} as Record<string, string>)[code || ''] || 'Sign-in could not be completed. Check your credentials or contact your administrator.'
+}
+async function submit() {
+ if (busy.value || !secure.value || !account.value || !password.value || (needsOTP.value && !otp.value)) return
+ busy.value = true; error.value = ''
+ try {
+  await props.session.login(account.value, password.value, otp.value)
+  password.value = ''; otp.value = ''
+ } catch (e) {
+  if (disposed) return
+  otp.value = ''
+  if ((e as {code?: string})?.code === 'otp_required') {
+   needsOTP.value = true
+  } else {error.value = message(e); password.value = ''; needsOTP.value = false}
+ } finally {
+  if (!disposed) {
+   busy.value = false
+   if (needsOTP.value) {await nextTick(); if (!disposed) otpField.value?.querySelector('input')?.focus()}
+  }
+ }
+}
+async function useDSM() {
+ if (busy.value) return
+ busy.value = true; error.value = ''
+ try {await props.session.bootstrap()}
+ catch (e) {if (!disposed) error.value = message(e)}
+ finally {if (!disposed) busy.value = false}
+}
+function restart() {password.value = ''; otp.value = ''; needsOTP.value = false; error.value = ''}
+onUnmounted(() => {disposed = true; password.value = ''; otp.value = ''})
+</script>
+
+<template>
+ <main class="identity-login" :aria-busy="busy">
+  <SettingsSection title="Sign in with your Synology account" :collapsible="false">
+   <p>Use your account on this NAS to sign in to the app.</p>
+   <Callout v-if="!secure" tone="warning" title="HTTPS required">Open this app using HTTPS to sign in.</Callout>
+   <p v-if="session.notice.value" role="status">{{ session.notice.value }}</p>
+   <Callout v-if="error" tone="danger" title="Sign-in failed"><span role="alert">{{ error }}</span></Callout>
+   <Form @submit.prevent="submit">
+    <FormItem label="Account"><Input v-model="account" autocomplete="username" :disabled="busy || needsOTP || !secure" /></FormItem>
+    <FormItem v-if="!needsOTP" label="Password"><Input v-model="password" type="password" autocomplete="current-password" :disabled="busy || !secure" /></FormItem>
+    <template v-else>
+     <p role="status">Enter the verification code from your authenticator app.</p>
+     <div ref="otpField"><FormItem label="Verification code"><Input v-model="otp" inputmode="numeric" autocomplete="one-time-code" :disabled="busy" /></FormItem></div>
+    </template>
+    <FormActions>
+     <Button type="submit" variant="primary" :disabled="busy || !secure || !account || !password || (needsOTP && !otp)">{{ busy ? 'Signing in…' : needsOTP ? 'Verify and sign in' : 'Sign in' }}</Button>
+     <Button v-if="needsOTP" variant="secondary" :disabled="busy" @click="restart">Use another account</Button>
+     <Button v-else variant="secondary" :disabled="busy || !secure" @click="useDSM">Continue with DSM</Button>
+    </FormActions>
+   </Form>
+  </SettingsSection>
+ </main>
+</template>
+
+<style scoped>
+.identity-login {max-width: 36rem; margin-inline: auto; padding: var(--ui-space-4, 16px); overflow: auto; max-height: 100%; color: var(--ui-text); font-family: var(--ui-font-sans); font-size: 13px; line-height: 1.5;}
+.identity-login p {margin-block: var(--ui-space-4, 16px); overflow-wrap: anywhere;}
+</style>

package/templates/native-go-vue/frontend/src/identity/login.test.ts

@@ -0,0 +1,32 @@
+// @vitest-environment jsdom
+// @vitest-environment-options {"url":"https://nas.test"}
+import {expect, test, vi} from 'vitest'
+import {nextTick} from 'vue'
+import {mount} from '../main'
+import type {Context} from '../context'
+async function settle(){for(let i=0;i<20;i++){await Promise.resolve();await nextTick()}}
+function fill(root: HTMLElement, selector: string, value: string){const field=root.querySelector<HTMLInputElement>(selector)!;field.value=value;field.dispatchEvent(new Event('input',{bubbles:true}))}
+function button(root: HTMLElement, text: string){return Array.from(root.querySelectorAll<HTMLButtonElement>('button')).find(b=>b.textContent?.trim()===text)!}
+test('OTP focuses the enabled code field and successful login loads app data',async()=>{
+ let signedIn=false
+ const call=vi.fn(async(method: string, params?: Record<string, unknown>)=>{
+  if(method==='identity.status')return {enabled:true}
+  if(method==='identity.session')throw {code:'session_required'}
+  if(method==='identity.login') {if(!params?.otp)throw {code:'otp_required'};signedIn=true;return {user:'alice',uid:'1205',expiresAt:new Date(Date.now()+900000).toISOString()}}
+  if(method==='identity.logout'){signedIn=false;return {loggedOut:true}}
+  if(!signedIn)throw {code:'session_required'}
+  if(method==='app.status')return {package:'Test package',version:'1',user:'alice',admin:false}
+  if(method==='greeting.get')return {text:'Hello Alice'}
+  return {}
+ })
+ const ctx={locale:'en',call,reopen(){return ()=>{}}} as unknown as Context
+ const root=document.createElement('div');document.body.append(root);const app=mount(root,ctx)
+ try{
+  await settle();fill(root,'input[autocomplete="username"]','alice');fill(root,'input[type="password"]','password');await settle();button(root,'Sign in').click();await settle()
+  const otp=root.querySelector<HTMLInputElement>('input[autocomplete="one-time-code"]')!
+  expect(otp.disabled).toBe(false);expect(document.activeElement).toBe(otp)
+  fill(root,'input[autocomplete="one-time-code"]','123456');await settle();button(root,'Verify and sign in').click();await settle()
+  expect(root.textContent).toContain('Test package');expect(root.querySelector('textarea')).toBeNull();expect(call).not.toHaveBeenCalledWith('greeting.get',undefined)
+  button(root,'Sign out').click();await settle();expect(root.querySelector('textarea')).toBeNull();expect(root.textContent).not.toContain('alice');expect(root.querySelector<HTMLInputElement>('input[type="password"]')?.value).toBe('')
+ }finally{app.unmount();root.remove()}
+})

package/templates/native-go-vue/frontend/src/identity/session.test.ts

@@ -0,0 +1,29 @@
+// @vitest-environment jsdom
+import {afterEach, expect, test, vi} from 'vitest'
+import {createSession} from './session'
+import type {Context} from '../context'
+afterEach(()=>vi.useRealTimers())
+function context(call: Context['call']){return {call} as Context}
+test('discovers disabled identity without changing existing transport',async()=>{
+ const call=vi.fn().mockRejectedValue({code:'unknown_method'})
+ const session=createSession(context(call));await session.start();expect(session.enabled.value).toBe(false);expect(session.ready.value).toBe(true);session.dispose()
+})
+test('bootstraps, expires and returns to login after a business rejection',async()=>{
+ vi.useFakeTimers();const expiresAt=new Date(Date.now()+60000).toISOString()
+ const call=vi.fn().mockResolvedValueOnce({enabled:true}).mockResolvedValueOnce({user:'alice',uid:'1205',expiresAt})
+ const session=createSession(context(call));await session.start();expect(session.subject.value?.user).toBe('alice')
+ call.mockRejectedValueOnce({code:'session_required'})
+ await expect(session.call('greeting.get')).rejects.toEqual({code:'session_required'});expect(session.subject.value).toBeUndefined()
+ call.mockResolvedValueOnce({user:'alice',uid:'1205',expiresAt});await session.login('alice','password','123456');expect(session.subject.value?.user).toBe('alice')
+ await vi.advanceTimersByTimeAsync(60000);expect(session.subject.value).toBeUndefined();session.dispose()
+})
+test('disposal ignores pending session responses and cancels timers',async()=>{
+ let resolve: (value:unknown)=>void=()=>{};const call=vi.fn().mockResolvedValueOnce({enabled:true}).mockImplementationOnce(()=>new Promise(r=>{resolve=r}))
+ const session=createSession(context(call));const pending=session.start();await Promise.resolve();session.dispose();resolve({user:'alice',expiresAt:new Date(Date.now()+60000).toISOString()});await pending;expect(session.subject.value).toBeUndefined()
+})
+test('OTP errors remain actionable and logout clears the identity',async()=>{
+ const call=vi.fn().mockResolvedValueOnce({enabled:true}).mockRejectedValueOnce({code:'session_required'})
+ const session=createSession(context(call));await session.start();call.mockRejectedValueOnce({code:'otp_required'})
+ await expect(session.login('alice','p','')).rejects.toEqual({code:'otp_required'});expect(session.subject.value).toBeUndefined()
+ call.mockResolvedValueOnce({user:'alice',expiresAt:new Date(Date.now()+60000).toISOString()});await session.login('alice','p','123456');call.mockResolvedValueOnce({loggedOut:true});await session.logout();expect(session.subject.value).toBeUndefined();session.dispose()
+})

package/templates/native-go-vue/frontend/src/identity/session.ts

@@ -0,0 +1,73 @@
+import {ref} from 'vue'
+import type {Context} from '../context'
+
+export interface SessionSubject {user: string; uid: string; expiresAt: string}
+export function createSession(ctx: Context) {
+ const enabled = ref(false)
+ const ready = ref(false)
+ const subject = ref<SessionSubject>()
+ const notice = ref('')
+ let disposed = false
+ let revision = 0
+ let expiry: ReturnType<typeof setTimeout> | undefined
+ let poll: ReturnType<typeof setTimeout> | undefined
+ function cancelTimers() {clearTimeout(expiry); clearTimeout(poll)}
+ function clear(message = '') {revision++; cancelTimers(); subject.value = undefined; notice.value = message}
+ function accept(value: SessionSubject) {
+  if (disposed) return
+  const remaining = Date.parse(value.expiresAt) - Date.now()
+  if (!Number.isFinite(remaining) || remaining <= 0) {clear('Your session expired. Sign in again.'); return}
+  cancelTimers(); subject.value = value; notice.value = ''
+  expiry = setTimeout(() => clear('Your session expired. Sign in again.'), remaining)
+  const current = revision
+  poll = setTimeout(async () => {
+   try {const next = await ctx.call<SessionSubject>('identity.session'); if (!disposed && revision === current) accept(next)}
+   catch {if (!disposed && revision === current) clear('Your session expired. Sign in again.')}
+  }, Math.min(60000, remaining))
+ }
+ async function start() {
+  try {
+   const status = await ctx.call<{enabled: boolean}>('identity.status')
+   if (disposed) return
+   enabled.value = status.enabled === true
+   if (enabled.value) {
+    try {accept(await ctx.call<SessionSubject>('identity.session', {bootstrap: true}))}
+    catch {if (!disposed) clear()}
+   }
+  } catch (e) {
+   // Existing templates have no identity transport and retain their DSM shell.
+   const code = (e as {code?: string})?.code
+   enabled.value = !['unknown_method', 'admin_required', 'session_required'].includes(code || '')
+   if (enabled.value) notice.value = 'Sign-in is unavailable. Refresh to try again.'
+  } finally {if (!disposed) ready.value = true}
+ }
+ async function call<T = unknown>(method: string, params?: Record<string, unknown>): Promise<T> {
+  const current = revision
+  try {
+   const result = await ctx.call<T>(method, params)
+   if (disposed || (enabled.value && current !== revision)) throw {code: 'session_required'}
+   return result
+  }
+  catch (e) {
+   const code = (e as {code?: string})?.code
+   if (!disposed && current === revision && enabled.value && ['session_required', 'session_revalidation_required'].includes(code || '')) {
+    clear(code === 'session_revalidation_required' ? 'Sign in to DSM in this browser, then choose Continue with DSM.' : 'Your session expired. Sign in again.')
+   }
+   throw e
+  }
+ }
+ async function login(account: string, password: string, otp: string) {
+  const value = await ctx.call<SessionSubject>('identity.login', {account, password, otp})
+  if (!disposed) {revision++; accept(value)}
+ }
+ async function bootstrap() {
+  const value = await ctx.call<SessionSubject>('identity.session', {bootstrap: true})
+  if (!disposed) {revision++; accept(value)}
+ }
+ async function logout() {
+  await ctx.call('identity.logout'); if (!disposed) clear()
+ }
+ function dispose() {disposed = true; clear()}
+ return {enabled, ready, subject, notice, start, call, login, bootstrap, logout, dispose}
+}
+export type IdentitySession = ReturnType<typeof createSession>

package/templates/native-go-vue/frontend/src/main.ts

@@ -1,15 +1,18 @@
 import {createApp} from 'vue'
 import App from './App.vue'
+import {ExecutorSetupKey} from './delegate/executor-setup'
 import type {Context} from './context'
-import {NasProviderKey, type NasProvider} from './nas/provider'
 import '@synopackageland/ui/themes/dsm7-embedded.css'
 import './style.css'
 
 let mountSequence = 0
-export function mount(root: HTMLElement, ctx: Context, options: {nasProvider?: NasProvider} = {}) {
+export function mount(root: HTMLElement, ctx: Context) {
  const app = createApp(App, {ctx})
- // The shipped strict-S1 build never installs a NAS provider. Preview is dev/mock only.
- if(import.meta.env.DEV && options.nasProvider?.mode === 'mock') app.provide(NasProviderKey, options.nasProvider)
+ app.provide(ExecutorSetupKey, ctx.executor ?? {
+  async status() {return {state: 'unsupported'}},
+  async authorize() {return {state: 'unsupported'}},
+  async control() {return {state: 'unsupported'}},
+ })
  // Include the generated package ID, an instance counter and randomness even
  // across separately loaded bundles. getRandomValues also works on DSM HTTP.
  app.config.idPrefix = `__PACKAGE__-${++mountSequence}-${crypto.getRandomValues(new Uint32Array(4)).join('-')}`

package/templates/native-go-vue/frontend/src/nas/NasPicker.vue

@@ -0,0 +1,23 @@
+<script setup lang="ts">
+import {computed,ref,watch} from 'vue'
+import {Button,Dialog} from '@synopackageland/ui'
+import FileBrowser from '../files/FileBrowser.vue'
+import type {NasProvider} from './contract'
+import {nasCopy} from './locale'
+const props=defineProps<{open:boolean;locale:string;provider:NasProvider;mode:'folder'|'file';title?:string;description?:string}>()
+const emit=defineEmits<{'update:open':[value:boolean];selected:[path:string]}>()
+const selected=ref<string>(),copy=computed(()=>nasCopy(props.locale))
+watch(()=>props.open,()=>{selected.value=undefined})
+function close(){selected.value=undefined;emit('update:open',false)}
+function confirm(){if(selected.value){emit('selected',selected.value);close()}}
+</script>
+<template>
+ <Dialog :open="open" :title="title??(mode==='folder'?copy.choose:copy.chooseFile)" :close-label="copy.close" width="800px" @update:open="value=>{if(!value)close()}">
+  <p v-if="description">{{ description }}</p>
+  <div class="nas-picker-content"><FileBrowser v-if="open" :provider="provider" :locale="locale" :mode="mode" @selected="selected=$event" /></div>
+  <template #footer><Button variant="secondary" @click="close">{{ copy.cancel }}</Button><Button variant="primary" :disabled="!selected" @click="confirm">{{ copy.confirm }}</Button></template>
+ </Dialog>
+</template>
+<style scoped>
+.nas-picker-content { max-height: 65vh; overflow: auto; }
+</style>

package/templates/native-go-vue/frontend/src/nas/contract.ts

@@ -0,0 +1,12 @@
+export interface NasEntry {name:string; path:string; isDir:boolean; bytes?:number}
+export interface NasPage {entries:NasEntry[]; total:number; offset:number; nextOffset?:number}
+export interface ListOptions {offset?:number;limit?:number;sortBy?:'name'|'size'|'type'|'mtime';sortDirection?:'ASC'|'DESC'}
+export interface NasProvider {
+ download?(path:string):void
+ upload?(parent:string,file:File,signal:AbortSignal):Promise<void>
+ shares(offset:number,signal:AbortSignal):Promise<NasPage>
+ list(path:string,options:ListOptions,signal:AbortSignal):Promise<NasPage>
+ info(path:string,signal:AbortSignal):Promise<NasEntry>
+ createFolder(parent:string,name:string,signal:AbortSignal):Promise<void>
+ dispose():void
+}

package/templates/native-go-vue/frontend/src/nas/i18n/files/de.json

@@ -0,0 +1,41 @@
+{
+  "title": "NAS-Ordner — File Station",
+  "ownPermissions": "Aktionen verwenden Ihre eigene DSM-Sitzung und die aktuellen File-Station-Rechte.",
+  "choose": "Ordner auswählen",
+  "confirm": "Auswahl bestätigen",
+  "refresh": "Ordner aktualisieren",
+  "loading": "Wird geladen…",
+  "emptyFolder": "Dieser Ordner ist leer.",
+  "roots": "Ordner",
+  "back": "Zurück",
+  "select": "{name} auswählen",
+  "open": "{name} öffnen",
+  "selected": "Ausgewählt: {name}",
+  "cancel": "Abbrechen",
+  "close": "Schließen",
+  "loadMore": "Mehr laden",
+  "errorSession": "DSM-Sitzung abgelaufen. Melden Sie sich erneut bei DSM an und aktualisieren Sie die Ordner.",
+  "errorDenied": "Sie haben keine Berechtigung für diese Datei oder diesen Ordner. Wählen Sie einen anderen Ordner.",
+  "errorNotFound": "Datei oder Ordner nicht mehr vorhanden. Aktualisieren Sie die Liste.",
+  "errorConflict": "Dieser Name existiert bereits. Wählen Sie einen anderen Namen.",
+  "errorUncertain": "Die Aktion wurde möglicherweise ausgeführt. Aktualisieren Sie Auswahl oder Ziel und prüfen Sie das Ergebnis vor einer erneuten Übermittlung.",
+  "errorInvalid": "Ungültiger Ordner, Dateiname oder Aufruf. Prüfen Sie die Eingabe.",
+  "errorUnavailable": "File Station ist nicht verfügbar oder der Sitzungsadapter fehlt. Aktualisieren Sie später.",
+  "errorCanceled": "Aufruf abgebrochen. Aktualisieren Sie vor dem Fortfahren.",
+  "errorTimeout": "Zeitüberschreitung. Aktualisieren Sie die Liste vor dem Fortfahren.",
+  "metadata": "Metadaten",
+  "fileKind": "Datei",
+  "directoryKind": "Ordner",
+  "nameColumn": "Name",
+  "kindColumn": "Typ",
+  "sizeColumn": "Bytes",
+  "selectAction": "Auswählen",
+  "chooseFile": "Datei auswählen",
+  "expand": "{name} erweitern",
+  "collapse": "{name} reduzieren",
+  "upload": "Hochladen",
+  "download": "Herunterladen",
+  "uploaded": "Datei hochgeladen.",
+  "errorDSM": "Melden Sie sich unter diesem Hostnamen bei DSM an, um auf NAS-Dateien zuzugreifen. Eine App-Anmeldung allein erlaubt keinen Zugriff auf File Station.",
+  "errorUploadSize": "Wählen Sie eine Datei mit höchstens 16 GiB."
+}

package/templates/native-go-vue/frontend/src/nas/i18n/files/en.json

@@ -0,0 +1,41 @@
+{
+  "title": "NAS folders — File Station",
+  "ownPermissions": "Operations use your own DSM session and current File Station permissions.",
+  "choose": "Choose folder",
+  "confirm": "Confirm selection",
+  "refresh": "Refresh folders",
+  "loading": "Loading…",
+  "emptyFolder": "This folder is empty.",
+  "roots": "Folders",
+  "back": "Back",
+  "select": "Select {name}",
+  "open": "Open {name}",
+  "selected": "Selected: {name}",
+  "cancel": "Cancel",
+  "close": "Close",
+  "loadMore": "Load more",
+  "errorSession": "Your DSM session expired. Sign in to DSM again, then refresh folders.",
+  "errorDenied": "You do not have permission to access this file or folder. Choose another folder.",
+  "errorNotFound": "The file or folder no longer exists. Refresh the listing.",
+  "errorConflict": "A file or folder with that name already exists. Choose another name.",
+  "errorUncertain": "The operation may have completed. Refresh selections or the destination and inspect the result before submitting again.",
+  "errorInvalid": "Invalid folder, filename or request. Check the input and try again.",
+  "errorUnavailable": "File Station is unavailable or this package lacks the session adapter. Refresh later.",
+  "errorCanceled": "Request canceled. Refresh before continuing.",
+  "errorTimeout": "The request timed out. Refresh the listing before continuing.",
+  "metadata": "Metadata",
+  "fileKind": "File",
+  "directoryKind": "Folder",
+  "nameColumn": "Name",
+  "kindColumn": "Type",
+  "sizeColumn": "Bytes",
+  "selectAction": "Select",
+  "chooseFile": "Choose file",
+  "expand": "Expand {name}",
+  "collapse": "Collapse {name}",
+  "upload": "Upload",
+  "download": "Download",
+  "uploaded": "File uploaded.",
+  "errorDSM": "Sign in to DSM on this hostname to access NAS files. An App login alone cannot access File Station.",
+  "errorUploadSize": "Choose one file up to 16 GiB."
+}