@synopackageland/sdk 0.26.0 → 0.27.1

package/executor-manifest.json

@@ -0,0 +1,16 @@
+{
+  "formatVersion": 1,
+  "sdkVersion": "0.27.1",
+  "executorVersion": "0.27.0",
+  "executorDigests": {
+    "x86_64": "35f760533c133f7ed99d62c11dc4696d06a56fd2d125d53291aa21743d8327cc",
+    "aarch64": "04dff10b52ca4c54e3e6a825c27bac876f296031d8f572f667e6902e18464e31",
+    "armv7": "8789b2663b683ae0a5a457b41ccfcff4d54be4c98dcd3af338622051ad24f943",
+    "lifecycle": {
+      "x86_64": "c6fbb377ecd5ec7ee5b96439f22091d9fa5965dfd616d510ca9445722f436721",
+      "aarch64": "a9ca1750d4d5cff4727dc29789e6eaf0a365cb0e674f1bb796971d82f2d4fa27",
+      "armv7": "6d25fc972eba12e3ac68f8b6a95a45e9e5706ebe19ffc1ff774fc318acbeb90f"
+    },
+    "goToolchain": "go1.26.10"
+  }
+}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@synopackageland/sdk",
-  "version": "0.26.0",
+  "version": "0.27.1",
   "description": "Frontend SDK for DSM packages built with synopkgland: headless client and Vue components",
   "license": "MIT",
   "homepage": "https://github.com/synopackageland/syno-pkg-land-sdk/tree/main/ts#readme",
@@ -30,15 +30,17 @@
       "types": "./dist/src/native.d.ts",
       "import": "./dist/native.js"
     },
-    "./i18n/*": "./dist/i18n/*"
+    "./i18n/*": "./dist/i18n/*",
+    "./executor-manifest.json": "./executor-manifest.json"
   },
   "files": [
     "dist",
-    "spec/protocol"
+    "spec/protocol",
+    "executor-manifest.json"
   ],
   "scripts": {
     "prepack": "test -d node_modules || { echo '@synopackageland/sdk: run npm ci before npm pack' >&2; exit 1; }; npm run build",
-    "build": "vite build && vue-tsc -p tsconfig.build.json && cp -R i18n dist/ && rm -rf spec && cp -R ../spec spec",
+    "build": "node ../scripts/executor-manifest.mjs --check && vite build && vue-tsc -p tsconfig.build.json && cp -R i18n dist/ && rm -rf spec && cp -R ../spec spec",
     "typecheck": "vue-tsc --noEmit",
     "test": "vitest run"
   },
@@ -57,7 +59,7 @@
   },
   "devDependencies": {
     "@lucide/vue": "1.48.0",
-    "@synopackageland/ui": "0.14.3",
+    "@synopackageland/ui": "0.14.8",
     "@types/node": "24.19.2",
     "@vitejs/plugin-vue": "6.0.9",
     "jsdom": "29.1.1",

package/spec/protocol/v1/README.md

@@ -487,3 +487,13 @@ It MUST NOT raise frame limits. Staging MUST be App-owned 0600 under a private
 0700 package directory. The App MUST verify size/hash and unlink after reading.
 Header, execution, spool cleanup and error rules are specified in
 [the raw contract](../../../docs/webapi-raw.md).
+
+### Destination permission observations
+
+`files.checkPermission` also supports an existing until-revoked
+`files.moveFromStaging` destination: omit `job_id`, provide the exact granted
+path and the current owner's session. The approved move policy permits only
+this observation; it cannot widen the destination or grant new authority.
+The executor rechecks current identity, App Privileges, scope, ACL and grant
+fences. Legacy time-limited grants continue to require their `job_id` and
+explicit operation policy. See `docs/dsm-session-transport.md` at the root.

package/spec/protocol/v1/schema/files.checkPermission.json

@@ -2,7 +2,7 @@
   "$schema": "https://json-schema.org/draft/2020-12/schema",
   "$id": "https://github.com/synopackageland/syno-pkg-land-sdk/spec/protocol/v1/schema/files.checkPermission.json",
   "title": "files.checkPermission",
-  "description": "Check write permission for the delegated user.",
+  "description": "Check write permission for the delegated user. A legacy grant requires job_id. An until-revoked moveFromStaging destination omits job_id, requires the current owner session, and permits only its exact destination path; it never creates or widens a grant.",
   "since": "0.9.0",
   "auth": "optional",
   "type": "object",
@@ -24,7 +24,6 @@
   "additionalProperties": false,
   "required": [
     "delegation_id",
-    "job_id",
     "path"
   ]
 }