@synopackageland/cli 0.8.0 → 0.9.0

package/templates/native-go-delegate/backend/internal/delegate/transient_contract_test.go

@@ -1,137 +0,0 @@
-package delegate
-
-import (
-	"context"
-	"dsmapp/internal/background"
-	"fmt"
-	"io/fs"
-	"os"
-	"path/filepath"
-	"syscall"
-	"testing"
-	"time"
-
-	"golang.org/x/sys/unix"
-)
-
-// A producer must know from the code alone whether repeating the same params
-// is safe: retryable codes never wrote anything a retry could duplicate, and
-// terminal codes need the package or administrator to repair the spool first.
-func TestJobErrorSeparatesRetryableFromTerminalSpoolFailures(t *testing.T) {
-	for _, tc := range []struct {
-		err  error
-		want string
-	}{
-		{background.ErrBusy, "jobs_busy"},
-		{context.DeadlineExceeded, "canceled"},
-		{context.Canceled, "canceled"},
-		{fmt.Errorf("journal: %w", context.DeadlineExceeded), "canceled"},
-		{&fs.PathError{Op: "write", Path: "journal.json", Err: syscall.EIO}, "jobs_unavailable"},
-		{background.ErrUnsafeSpool, "spool_unsafe"},
-		{background.ErrJournalUnreadable, "journal_corrupt"},
-		{background.ErrJournalSchema, "journal_corrupt"},
-	} {
-		code(t, jobError(tc.err), tc.want)
-	}
-}
-
-// holdJournal keeps the spool lock as another process would, until release.
-func holdJournal(t *testing.T, s *Service) (release func()) {
-	t.Helper()
-	lock, err := os.OpenFile(filepath.Join(filepath.Dir(s.StagingDir), "background", "lock"), os.O_RDWR, 0o600)
-	if err != nil {
-		t.Fatal(err)
-	}
-	if err = unix.Flock(int(lock.Fd()), unix.LOCK_EX|unix.LOCK_NB); err != nil {
-		t.Fatal(err)
-	}
-	return func() { unix.Flock(int(lock.Fd()), unix.LOCK_UN); lock.Close() }
-}
-
-func commit(e *dedupExecutor, in MoveParams) {
-	e.mu.Lock()
-	defer e.mu.Unlock()
-	e.ops[in.JobID] = OperationResult{JobID: in.JobID, State: "committed", Receipt: &Receipt{Path: "/home/" + in.Name, Size: in.Size}}
-}
-
-// t-0183 C3: a caller deadline spent waiting for the journal is retryable, and
-// the same params later converge on the original committed operation.
-func TestJournalDeadlineIsRetryableAndConvergesOnTheOriginalOperation(t *testing.T) {
-	s, in, e, _ := recoveringService(t)
-	if out, err := s.MoveFromStaging(context.Background(), in); err != nil || out.State != "queued" {
-		t.Fatal(out, err)
-	}
-	release := holdJournal(t, s)
-	ctx, cancel := context.WithTimeout(context.Background(), 50*time.Millisecond)
-	_, err := s.MoveFromStaging(ctx, in)
-	cancel()
-	release()
-	code(t, err, "canceled")
-	commit(e, in)
-	if out, err := s.MoveFromStaging(context.Background(), in); err != nil || out.State != "committed" {
-		t.Fatal(out, err)
-	}
-	if moves, created := e.counts(); moves != 1 || created != 1 {
-		t.Fatal("same tuple admitted again", moves, created)
-	}
-}
-
-func TestFirstAdmissionUnderJournalDeadlineSendsNothingUntilRetried(t *testing.T) {
-	s, in, e, _ := recoveringService(t)
-	if _, err := s.Store.PendingMoves(context.Background()); err != nil {
-		t.Fatal(err)
-	}
-	release := holdJournal(t, s)
-	ctx, cancel := context.WithTimeout(context.Background(), 50*time.Millisecond)
-	_, err := s.MoveFromStaging(ctx, in)
-	cancel()
-	release()
-	code(t, err, "canceled")
-	if moves, _ := e.counts(); moves != 0 {
-		t.Fatal("admitted without a durable reservation", moves)
-	}
-	if out, err := s.MoveFromStaging(context.Background(), in); err != nil || out.State != "queued" {
-		t.Fatal(out, err)
-	}
-	if moves, created := e.counts(); moves != 1 || created != 1 {
-		t.Fatal(moves, created)
-	}
-}
-
-// A busy journal must not hide a committed receipt: the same ref answers from
-// the executor's original operation, read-only, without a new admission.
-func TestCommittedRefAnswersItsReceiptWhileTheJournalIsBusy(t *testing.T) {
-	s, in, e, _ := recoveringService(t)
-	if _, err := s.MoveFromStaging(context.Background(), in); err != nil {
-		t.Fatal(err)
-	}
-	commit(e, in)
-	s.Store = background.NewRequestStore(filepath.Join(filepath.Dir(s.StagingDir), "background"))
-	release := holdJournal(t, s)
-	defer release()
-	if out, err := s.MoveFromStaging(context.Background(), in); err != nil || out.State != "committed" {
-		t.Fatal(out, err)
-	}
-	ref := OperationRef{in.DelegationID, in.JobID}
-	if out, err := s.OperationStatus(context.Background(), nil, ref); err != nil || out.State != "committed" || out.Receipt == nil || out.Receipt.Size != in.Size {
-		t.Fatal(out, err)
-	}
-	if moves, created := e.counts(); moves != 1 || created != 1 {
-		t.Fatal(moves, created)
-	}
-}
-
-func TestUnknownRefStaysRetryableWhileTheJournalIsBusy(t *testing.T) {
-	s, in, e, _ := recoveringService(t)
-	if _, err := s.Store.PendingMoves(context.Background()); err != nil {
-		t.Fatal(err)
-	}
-	s.Store = background.NewRequestStore(filepath.Join(filepath.Dir(s.StagingDir), "background"))
-	release := holdJournal(t, s)
-	defer release()
-	_, err := s.MoveFromStaging(context.Background(), in)
-	code(t, err, "jobs_busy")
-	if moves, _ := e.counts(); moves != 0 {
-		t.Fatal(moves)
-	}
-}

package/templates/native-go-delegate/backend/internal/delegate/wait_cancel_test.go

@@ -1,101 +0,0 @@
-package delegate
-
-import (
-	"context"
-	"dsmapp/internal/background"
-	"errors"
-	"os"
-	"path/filepath"
-	"testing"
-	"time"
-)
-
-func TestWaitingCancellationRevocationAndOtherOwnerAccess(t *testing.T) {
-	for _, action := range []string{"cancel", "revoke", "parent-stop"} {
-		t.Run(action, func(t *testing.T) {
-			s := service(t, absentExecutor(t))
-			id := retryJob(t, s, time.Now().Add(time.Hour))
-			bob := background.Submitter{User: "bob", UID: "1206"}
-			other, _, err := s.Store.Submit(context.Background(), background.SubmitRequest{Key: "other", Name: "other", Data: []byte("other"), Submitter: bob})
-			if err != nil {
-				t.Fatal(err)
-			}
-			cgi := &Service{Client: s.Client, Store: background.NewRequestStore(filepath.Join(filepath.Dir(s.StagingDir), "background")), LookupUID: func(user string) string {
-				if user == "bob" {
-					return "1206"
-				}
-				return "1205"
-			}}
-			waiting := make(chan struct{})
-			s.wait = func(ctx context.Context, _ time.Duration) error { close(waiting); <-ctx.Done(); return ctx.Err() }
-			ctx, stop := context.WithCancel(context.Background())
-			defer stop()
-			done := make(chan error, 1)
-			go func() { done <- s.RunOnce(ctx) }()
-			select {
-			case <-waiting:
-			case <-time.After(3 * time.Second):
-				t.Fatal("worker did not wait")
-			}
-			// A separate CGI store/process shares the same lock file with the worker.
-			accessDone := make(chan error, 1)
-			go func() {
-				list, e := cgi.Store.ListFor(context.Background(), background.Access{Owner: bob})
-				if e != nil {
-					accessDone <- e
-					return
-				}
-				if len(list) != 1 || list[0].ID != other.ID {
-					accessDone <- errors.New("owner list leaked waiting job")
-					return
-				}
-				_, e = cgi.Store.CancelFor(context.Background(), other.ID, background.Access{Owner: bob})
-				accessDone <- e
-			}()
-			select {
-			case e := <-accessDone:
-				if e != nil {
-					t.Fatal(e)
-				}
-			case <-time.After(time.Second):
-				t.Fatal("executor timer holds journal lock")
-			}
-			denied := rpc(t, cgi, "bob", "delegate.jobs.cancel", `{"id":"`+id+`"}`)
-			if denied["success"] != false {
-				t.Fatal("other owner canceled waiting job", denied)
-			}
-			switch action {
-			case "cancel":
-				out := rpc(t, cgi, "alice", "delegate.jobs.cancel", `{"id":"`+id+`"}`)
-				if out["success"] != true || out["data"].(map[string]any)["revocation_pending"] != true {
-					t.Fatal(out)
-				}
-			case "revoke":
-				out := rpc(t, cgi, "alice", "delegate.revoke", `{"delegation_id":"grant"}`)
-				if out["success"] != false {
-					t.Fatal("absent executor falsely acknowledged revocation", out)
-				}
-			case "parent-stop":
-				stop()
-			}
-			select {
-			case <-done:
-			case <-time.After(time.Second):
-				t.Fatal("waiting worker ignored cancellation")
-			}
-			if action == "parent-stop" {
-				assertJob(t, s, id, background.StateInterrupted, "worker-stopped")
-			} else {
-				assertJob(t, s, id, background.StateCanceled, "")
-			}
-			pending, e := s.Store.DelegationCleanup(context.Background())
-			if e != nil || len(pending) != 1 || pending[0].JobID != id {
-				t.Fatalf("cleanup not durable: %v %v", pending, e)
-			}
-			entries, e := os.ReadDir(s.StagingDir)
-			if e != nil || len(entries) != 0 {
-				t.Fatalf("cancellation leaked staging: %v %v", entries, e)
-			}
-		})
-	}
-}

package/templates/native-go-delegate/backend/internal/delegate/worker.go

@@ -1,225 +0,0 @@
-package delegate
-
-import (
-	"bytes"
-	"context"
-	"dsmapp/internal/api"
-	"dsmapp/internal/background"
-	"encoding/json"
-	"errors"
-	"io"
-	"log"
-	"net"
-	"net/http"
-	"os"
-	"sync"
-	"time"
-)
-
-const DownloadTimeout = 60 * time.Second
-
-func downloadClient() *http.Client {
-	return &http.Client{Timeout: DownloadTimeout, Transport: &http.Transport{Proxy: nil, DisableKeepAlives: true, DialContext: (&net.Dialer{Timeout: 5 * time.Second}).DialContext, ResponseHeaderTimeout: 10 * time.Second, MaxResponseHeaderBytes: 32 << 10, DisableCompression: true}, CheckRedirect: func(*http.Request, []*http.Request) error { return http.ErrUseLastResponse }}
-}
-func (s *Service) download(parent context.Context, in DownloadInput, job JobContext) error {
-	if !validDownload(in) {
-		return fail("invalid-request")
-	}
-	ctx, cancel := context.WithTimeout(parent, DownloadTimeout)
-	defer cancel()
-	request, e := http.NewRequestWithContext(ctx, "GET", in.URL, nil)
-	if e != nil {
-		return fail("invalid-request")
-	}
-	client := s.HTTP
-	if client == nil {
-		client = downloadClient()
-	}
-	response, e := client.Do(request)
-	if e != nil {
-		if ctx.Err() != nil {
-			return fail("timeout")
-		}
-		return fail("download_failed")
-	}
-	defer response.Body.Close()
-	if response.StatusCode != http.StatusOK {
-		return fail("download_failed")
-	}
-	if response.ContentLength > MaxDownloadBytes {
-		return fail("limit-exceeded")
-	}
-	if e = os.MkdirAll(job.StagingDir, 0700); e != nil {
-		return fail("STAGING_UNAVAILABLE")
-	}
-	info, e := os.Lstat(job.StagingDir)
-	if e != nil || !info.IsDir() || info.Mode().Perm()&0077 != 0 {
-		return fail("STAGING_UNAVAILABLE")
-	}
-	tmp, e := os.CreateTemp(job.StagingDir, "download-")
-	if e != nil {
-		return fail("STAGING_UNAVAILABLE")
-	}
-	defer os.Remove(tmp.Name())
-	defer tmp.Close()
-	n, e := io.Copy(tmp, io.LimitReader(contextReader{ctx, response.Body}, MaxDownloadBytes+1))
-	if e != nil {
-		return fail("download_failed")
-	}
-	if n > MaxDownloadBytes {
-		return fail("limit-exceeded")
-	}
-	if _, e = tmp.Seek(0, io.SeekStart); e != nil {
-		return fail("STAGING_UNAVAILABLE")
-	}
-	return job.Files().Write(parent, in.Dest, in.Name, tmp, n)
-}
-func (s *Service) Recover(ctx context.Context) error {
-	if e := s.Store.Recover(ctx); e != nil {
-		return e
-	}
-	return s.Sweep(ctx)
-}
-
-// RunOnce processes either the original SHA256 worker or the fixed delegated
-// download worker. No registry or operation ID comes from HTTP input.
-func (s *Service) RunOnce(parent context.Context) error {
-	job, e := s.Store.Claim(parent)
-	if e != nil || job == nil {
-		return e
-	}
-	ctx, cancel := context.WithCancel(parent)
-	if job.Worker != background.WorkerDownloadV1 {
-		cancel()
-		ctx, cancel = context.WithTimeout(parent, background.JobTimeout)
-	}
-	defer cancel()
-	watched := make(chan struct{})
-	go func() {
-		defer close(watched)
-		ticker := time.NewTicker(100 * time.Millisecond)
-		defer ticker.Stop()
-		for {
-			select {
-			case <-ctx.Done():
-				return
-			case <-ticker.C:
-				state, e := s.Store.Get(ctx, job.ID)
-				if e == nil && (state.CancelRequested || state.State != background.StateRunning) {
-					cancel()
-					return
-				}
-			}
-		}
-	}()
-	outcome := background.Outcome{State: background.StateSucceeded}
-	input, e := s.Store.OpenInput(job.ID)
-	if e == nil {
-		switch job.Worker {
-		case background.WorkerDownloadV1:
-			var in DownloadInput
-			data, readErr := io.ReadAll(io.LimitReader(input, background.MaxInputBytes+1))
-			if readErr != nil || json.Unmarshal(data, &in) != nil {
-				e = fail("invalid-request")
-			} else {
-				// Verify immutable input before contacting any remote host or executor.
-				hash, e2 := background.SHA256V1(ctx, bytes.NewReader(data))
-				if e2 != nil || hash.SHA256 != job.InputDigest || hash.Bytes != job.InputBytes {
-					e = fail("input-changed")
-				} else {
-					binding, e2 := s.Store.Delegation(ctx, job.ID)
-					e = e2
-					if e == nil {
-						e = s.download(ctx, in, JobContext{Client: s.Client, JobID: job.ID, DelegationID: binding.DelegationID, StagingDir: s.StagingDir, callExecutor: func(ctx context.Context, op string, params map[string]any, out any) error {
-							return s.callWaitingExecutor(ctx, job.ID, binding.ExpiresAt, op, params, out)
-						}})
-					}
-				}
-			}
-		case background.WorkerSHA256V1:
-			result, e2 := background.SHA256V1(ctx, io.LimitReader(input, background.MaxInputBytes+1))
-			e = e2
-			if e == nil && (result.SHA256 != job.InputDigest || result.Bytes != job.InputBytes) {
-				e = fail("input-changed")
-			}
-			outcome.Result = &result
-		default:
-			e = fail("unsupported")
-		}
-		input.Close()
-	}
-	if e != nil {
-		outcome = background.Outcome{State: background.StateFailed, ErrorCode: "worker-error"}
-		outcome.ErrorCode = errorCode(e)
-	}
-	if parent.Err() != nil {
-		outcome = background.Outcome{State: background.StateInterrupted, ErrorCode: "worker-stopped"}
-	} else if ctx.Err() == context.DeadlineExceeded {
-		outcome = background.Outcome{State: background.StateFailed, ErrorCode: "timeout"}
-	}
-	cancel()
-	<-watched
-	finish, done := context.WithTimeout(context.Background(), 20*time.Second)
-	defer done()
-	if e = s.Store.Finish(finish, job.ID, outcome); e != nil {
-		return e
-	}
-	return s.Sweep(finish)
-}
-func (s *Service) Run(ctx context.Context, info background.WorkerInfo) error {
-	if e := background.RefuseRoot(info.UID); e != nil {
-		return e
-	}
-	if e := s.Store.Recover(ctx); e != nil {
-		return e
-	}
-	ctx, stop := context.WithCancel(ctx)
-	var heartbeat sync.WaitGroup
-	heartbeat.Add(1)
-	go func() {
-		defer heartbeat.Done()
-		beat := time.NewTicker(5 * time.Second)
-		defer beat.Stop()
-		for {
-			select {
-			case <-ctx.Done():
-				return
-			case <-beat.C:
-				if e := s.Store.Heartbeat(ctx, info); e != nil && ctx.Err() == nil {
-					log.Print("worker heartbeat unavailable")
-				}
-			}
-		}
-	}()
-	defer func() { stop(); heartbeat.Wait() }()
-	ticker := time.NewTicker(500 * time.Millisecond)
-	defer ticker.Stop()
-	for ctx.Err() == nil {
-		if e := s.Store.Heartbeat(ctx, info); e != nil {
-			return e
-		}
-		if e := s.Sweep(ctx); e != nil {
-			log.Printf("delegation cleanup pending: %s", errorCode(e))
-		}
-		if e := s.Store.Tick(ctx); e != nil {
-			log.Print("schedule tick unavailable")
-		}
-		if e := s.RunOnce(ctx); e != nil && ctx.Err() == nil {
-			log.Printf("worker operation: %s", errorCode(e))
-		}
-		select {
-		case <-ctx.Done():
-			return nil
-		case <-ticker.C:
-		}
-	}
-	return nil
-}
-
-func errorCode(e error) string {
-	var a *api.Error
-	if errors.As(e, &a) {
-		return a.Code
-	}
-	return "unavailable"
-}

package/templates/native-go-delegate/backend/internal/filestation/files.go

@@ -1,43 +0,0 @@
-package filestation
-
-import (
-	"context"
-	"dsmapp/internal/api"
-	"io"
-	"net/http"
-)
-
-// Files is the operation set shared by live requests and delegated jobs.
-// Construct a RequestContext at the authenticated CGI boundary; never persist it.
-type Files interface {
-	List(context.Context, string, ListOptions) (Page, error)
-	Info(context.Context, string) (Entry, error)
-	CreateFolder(context.Context, string, string) error
-	CheckPermission(context.Context, string) error
-	Write(context.Context, string, string, io.Reader, int64) error
-}
-type RequestContext struct {
-	Caller  api.Caller
-	Request *http.Request
-	Service *Service
-}
-
-func (r RequestContext) Files() Files { return sessionFiles{r} }
-
-type sessionFiles struct{ RequestContext }
-
-func (s sessionFiles) List(ctx context.Context, p string, o ListOptions) (Page, error) {
-	return s.Service.List(ctx, s.Caller, s.Request, p, o)
-}
-func (s sessionFiles) Info(ctx context.Context, p string) (Entry, error) {
-	return s.Service.Info(ctx, s.Caller, s.Request, p)
-}
-func (s sessionFiles) CreateFolder(ctx context.Context, p, n string) error {
-	return s.Service.CreateFolder(ctx, s.Caller, s.Request, p, n)
-}
-func (s sessionFiles) Write(ctx context.Context, p, n string, r io.Reader, size int64) error {
-	return s.Service.Upload(ctx, s.Caller, s.Request, p, n, r, size)
-}
-func (s sessionFiles) CheckPermission(ctx context.Context, p string) error {
-	return s.Service.CheckPermission(ctx, s.Caller, s.Request, p)
-}

package/templates/native-go-delegate/backend/internal/filestation/files_test.go

@@ -1,59 +0,0 @@
-package filestation
-
-import (
-	"context"
-	"dsmapp/internal/api"
-	"fmt"
-	"net/http"
-	"testing"
-)
-
-func TestRequestFilesCheckUsesCurrentSessionAndRefusesMismatchedSubject(t *testing.T) {
-	checks := 0
-	client := fakeClient(t, func(w http.ResponseWriter, r *http.Request) {
-		r.ParseForm()
-		if r.Header.Get("Cookie") != "id=test-session" {
-			t.Error("cookie changed")
-		}
-		if r.Form.Get("api") == "SYNO.Core.NormalUser" {
-			fmt.Fprint(w, `{"success":true,"data":{"username":"alice"}}`)
-			return
-		}
-		checks++
-		if r.Form.Get("api") != "SYNO.FileStation.CheckPermission" || r.Form.Get("method") != "write" || r.Form.Get("path") != "/home" {
-			t.Error(r.Form)
-		}
-		fmt.Fprint(w, `{"success":false,"error":{"code":407}}`)
-	})
-	files := RequestContext{Service: NewService(client), Request: sessionRequest(), Caller: callerFor(t, "alice")}.Files()
-	if e := files.CheckPermission(context.Background(), "/home"); e == nil {
-		t.Fatal("DSM refusal lost")
-	}
-	files = RequestContext{Service: NewService(client), Request: sessionRequest(), Caller: callerFor(t, "bob")}.Files()
-	if e := files.CheckPermission(context.Background(), "/home"); e == nil {
-		t.Fatal("mismatched subject accepted")
-	}
-	if checks != 1 {
-		t.Fatal("mismatched request reached DSM file operation")
-	}
-	var _ Files = RequestContext{Caller: api.Caller{}}.Files()
-}
-
-func TestCheckPermissionRequiresExplicitNonSkipResult(t *testing.T) {
-	for _, data := range []string{`{}`, `{"blSkip":true}`} {
-		client := fakeClient(t, func(w http.ResponseWriter, r *http.Request) { fmt.Fprintf(w, `{"success":true,"data":%s}`, data) })
-		if e := client.CheckPermission(context.Background(), sessionRequest(), "/home"); e == nil {
-			t.Fatal("permission inferred from success:true")
-		}
-	}
-	client := fakeClient(t, func(w http.ResponseWriter, r *http.Request) {
-		r.ParseForm()
-		if r.Form.Get("filename") != ".synopkgland-permission-probe" || r.Form.Get("overwrite") != "false" || r.Form.Get("size") != "0" {
-			t.Error("missing fixed permission probe fields")
-		}
-		fmt.Fprint(w, `{"success":true,"data":{"blSkip":false}}`)
-	})
-	if e := client.CheckPermission(context.Background(), sessionRequest(), "/home"); e != nil {
-		t.Fatal(e)
-	}
-}

package/templates/native-go-delegate/frontend/src/CapabilityPanels.vue

@@ -1,37 +0,0 @@
-<script setup lang="ts">
-import {computed,onBeforeUnmount,onMounted,ref} from 'vue'
-import {Button,Callout} from '@synopackageland/ui'
-import type {Context} from './context'
-import ExecutorSettings from './delegate/ExecutorSettings.vue'
-import DelegatePanel from './delegate/DelegatePanel.vue'
-import BackgroundSavePanel from './delegate/BackgroundSavePanel.vue'
-import {createBackgroundSaveFacade} from './delegate/facade'
-import {createBackgroundPickerProvider} from './background/picker-provider'
-import {saveCopy} from './delegate/save-copy'
-const props=defineProps<{ctx:Context;admin:boolean}>()
-const mode=ref<'loading'|'long'|'legacy'|'unavailable'>(props.ctx.delegate?'long':'loading')
-const keys=ref<string[]>([]),copy=computed(()=>saveCopy(props.ctx.locale))
-const revision=ref(0)
-const sdk=props.ctx.delegate??createBackgroundSaveFacade(props.ctx),provider=createBackgroundPickerProvider(props.ctx)
-let disposed=false
-async function detect(){
- mode.value='loading'
- try{
-  const out=await props.ctx.call<{lifetime?:string;destinations?:string[]}>('delegate.status')
-  if(disposed)return
-  if(out.lifetime==='until-revoked'){
-   if(!Array.isArray(out.destinations)||!out.destinations.length||out.destinations.some(key=>typeof key!=='string'||!key))throw {code:'EXECUTOR_PROTOCOL'}
-   keys.value=out.destinations;mode.value='long'
-  }else mode.value='legacy'
- }catch{if(!disposed)mode.value='unavailable'}
-}
-onMounted(()=>{if(!props.ctx.delegate)void detect()})
-onBeforeUnmount(()=>{disposed=true;provider.dispose()})
-</script>
-<template>
- <ExecutorSettings :admin="admin" :locale="ctx.locale" :ctx="ctx" @confirmed="revision++;detect()" />
- <BackgroundSavePanel v-if="mode==='long'" :key="revision" :sdk="sdk" :admin="admin" :locale="ctx.locale" :picker="{provider,keys}" />
- <DelegatePanel v-else-if="mode==='legacy'" :ctx="ctx" />
- <p v-else-if="mode==='loading'" role="status">{{ copy.loading }}</p>
- <Callout v-else tone="danger" role="alert">{{ copy.error }} <Button variant="secondary" @click="detect">{{ copy.refresh }}</Button></Callout>
-</template>