@synopackageland/sdk 0.11.0 → 0.12.1

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@synopackageland/sdk",
-  "version": "0.11.0",
+  "version": "0.12.1",
   "description": "Frontend SDK for DSM packages built with synopkgland: headless client and Vue components",
   "license": "MIT",
   "homepage": "https://github.com/synopackageland/syno-pkg-land-sdk/tree/main/ts#readme",
@@ -44,7 +44,7 @@
   },
   "peerDependencies": {
     "@lucide/vue": "^1.48.0",
-    "@synopackageland/ui": "^0.9.10",
+    "@synopackageland/ui": "^0.10.1",
     "vue": "^3.5.0"
   },
   "peerDependenciesMeta": {
@@ -57,7 +57,7 @@
   },
   "devDependencies": {
     "@lucide/vue": "1.48.0",
-    "@synopackageland/ui": "0.9.10",
+    "@synopackageland/ui": "0.10.1",
     "@types/node": "24.19.2",
     "@vitejs/plugin-vue": "6.0.9",
     "jsdom": "27.4.0",

package/spec/protocol/v1/README.md

@@ -474,3 +474,16 @@ mutation retries are permitted. A dispatched call whose execution/reply/audit
 cannot be confirmed MUST answer `WEBAPI_UNCERTAIN` (nonretryable); client
 transport failure MAY also hide a completed operation. Binary/streaming replies
 MUST be refused. These bounds and semantics also apply to until-revoked grants.
+
+## Raw WebAPI extension (since 0.12.1)
+
+The JSON-only restriction above applies to the default response mode. An explicit
+`response_type:"raw"` MUST require a positive, approved profile `raw_max_bytes`
+(1..67108864), pinned by policy and user consent. The executor MUST parse bounded
+CGI headers, refuse redirects, enforce the body limit without truncation, and
+return `response_type`, `content_type`, `size`, `sha256` and exactly one of
+base64 `body` (at most 32768 bytes decoded) or a package-private `staging` handle.
+It MUST NOT raise frame limits. Staging MUST be App-owned 0600 under a private
+0700 package directory. The App MUST verify size/hash and unlink after reading.
+Header, execution, spool cleanup and error rules are specified in
+[the raw contract](../../../docs/webapi-raw.md).

package/spec/protocol/v1/schema/webapi.call.json

@@ -2,11 +2,16 @@
   "$schema": "https://json-schema.org/draft/2020-12/schema",
   "$id": "https://github.com/synopackageland/syno-pkg-land-sdk/spec/protocol/v1/schema/webapi.call.json",
   "title": "webapi.call",
-  "description": "Call an exact approved JSON WebAPI as the profile grant owner. Never retried; the result is the full DSM success/error envelope.",
+  "description": "Call an exact approved WebAPI as the profile grant owner. JSON returns the DSM envelope; raw (since 0.12.1) requires profile raw_max_bytes and returns content_type, size, sha256 and base64 body or private staging handle. Never retried.",
   "since": "0.11.0",
   "auth": "optional",
   "type": "object",
   "properties": {
+    "response_type": {
+      "type": "string",
+      "enum": ["json", "raw"],
+      "description": "Defaults to json. Raw requires an explicitly approved raw_max_bytes profile."
+    },
     "delegation_id": {
       "type": "string",
       "pattern": "^[a-f0-9]{64}$"

package/spec/protocol/v1/vectors/webapi.jsonl

@@ -1,3 +1,4 @@
 {"name":"timed","request":{"v":1,"op":"delegate.create","auth":{"dsm_cookie":"alice","dsm_synotoken":"contract-token","remote_addr":"192.0.2.1"},"params":{"ops":["webapi.call"],"scope":"calendar","job_id":"j1","ttl_seconds":60}},"policy":{"v":1,"package":"contract","app":"app","operations":["status","delegate.create","delegate.list","delegate.revoke","webapi.call"],"webapi":{"calendar":{"purpose":"Create calendar reminders","apis":{"SYNO.Cal.Event":{"list":[6],"create":[6],"delete":[6]}}}}},"state":{},"expect":{"ok":true,"result":{"delegation_id":"<any>","scope":"calendar"}}}
 {"name":"until-revoked","request":{"v":1,"op":"delegate.create","auth":{"dsm_cookie":"alice","dsm_synotoken":"contract-token","remote_addr":"192.0.2.1"},"params":{"ops":["webapi.call"],"scope":"calendar","lifetime":"until-revoked"}},"policy":{"v":1,"package":"contract","app":"app","operations":["status","delegate.create","delegate.list","delegate.revoke","webapi.call"],"webapi":{"calendar":{"purpose":"Create calendar reminders","apis":{"SYNO.Cal.Event":{"list":[6],"create":[6],"delete":[6]}}}}},"state":{},"expect":{"ok":true,"result":{"delegation_id":"<any>","scope":"calendar"}}}
 {"name":"reject-files-mix","request":{"v":1,"op":"delegate.create","auth":{"dsm_cookie":"alice","dsm_synotoken":"contract-token","remote_addr":"192.0.2.1"},"params":{"ops":["webapi.call","files.list"],"scope":"calendar","job_id":"j1","ttl_seconds":60}},"policy":{"v":1,"package":"contract","app":"app","operations":["status","delegate.create","delegate.list","delegate.revoke","webapi.call"],"webapi":{"calendar":{"purpose":"Create calendar reminders","apis":{"SYNO.Cal.Event":{"list":[6],"create":[6],"delete":[6]}}}}},"state":{},"expect":{"ok":false,"code":"INVALID_REQUEST"}}
+{"name":"raw-profile-until-revoked","request":{"v":1,"op":"delegate.create","auth":{"dsm_cookie":"alice","dsm_synotoken":"contract-token","remote_addr":"192.0.2.1"},"params":{"ops":["webapi.call"],"scope":"calendar","lifetime":"until-revoked"}},"policy":{"v":1,"package":"contract","app":"app","operations":["status","delegate.create","delegate.list","delegate.revoke","webapi.call"],"webapi":{"calendar":{"purpose":"Create calendar reminders","apis":{"SYNO.Cal.Event":{"list":[6],"create":[6],"delete":[6]}},"raw_max_bytes":26214400}}},"state":{},"expect":{"ok":true,"result":{"delegation_id":"<any>","scope":"calendar"}}}