@synopackageland/sdk 0.31.5 → 0.32.0

package/README.md

@@ -7,7 +7,7 @@ App's `backend/go.mod`.
 | Import | Contents |
 |---|---|
 | `@synopackageland/sdk` | Headless: `Context` and the other types, `createBackgroundSaveFacade`, `createNasProvider`, `scopedPicker`, `createPortalAccess`, copy catalogs (`uiLocale`, `saveCopy`, …). Never imports Vue. |
-| `@synopackageland/sdk/vue` | Everything above plus the components (`AppShell`, `PageActions`, `PageInfo`, `FilesPage`, `NasPicker`, `LoginPage`, `PortalSettings`, `BackgroundPanel`, `ExecutorSettings`, `ExecutorApproval`, `ExecutorNotice`, `UiUpdateNotice`, `DelegatePanel`, `BackgroundSavePanel`, `BackgroundSaveSettings`, `AuthorizationGate`, `AuthorizationSettings`) and composables (`createSession`, `useExecutorSetup`, `ExecutorSetupKey`, `useAuthorization`). |
+| `@synopackageland/sdk/vue` | Everything above plus the components (`AppShell`, `PageActions`, `PageInfo`, `FilesPage`, `NasPicker`, `LoginPage`, `PortalSettings`, `BackgroundPanel`, `ExecutorSettings`, `ExecutorApproval`, `ExecutorNotice`, `UiUpdateNotice`, `DelegatePanel`, `BackgroundSavePanel`, `BackgroundSaveSettings`, `AuthorizationGate`, `AuthorizationSettings`, `EntryGuard`) and composables (`createSession`, `useExecutorSetup`, `ExecutorSetupKey`, `useAuthorization`). |
 | `@synopackageland/sdk/vue/style.css` | The component stylesheet. Import it once next to `@synopackageland/ui`'s theme in the App entry. |
 | `@synopackageland/sdk/native` | For a native product with its own pinned root tasks: `ROOT_RUNTIME` (`createRootAccess`) and `AUTHORIZATION_RUNTIME` (`createAuthorizationAccess`), plain ES5 source the product renders into its own DSM window; `AuthorizationGate` shows the result. Generated Apps use the executor instead. Never imports Vue. |
 | `@synopackageland/sdk/i18n/<capability>/<locale>.json` | Copy in `en`, `zh-TW`, `zh-CN`, `ja`, `ko`, `de`, `fr`, `es`, `it`. |
@@ -237,8 +237,9 @@ otherwise picks the first page the sidebar shows. A router drives the shell
 through `v-model`:
 `:model-value="route.name" @update:model-value="name => router.push({name})"`.
 
-Render the shell as soon as the entry gate passes and pass `loading` while
-startup reads run. The sidebar and title show immediately; the page body shows
+Render the shell immediately, with [`EntryGuard`](../docs/app-entry.md) checking
+session/admin access in the background, and pass `loading` while startup reads
+run. The sidebar and title show immediately; the page body shows
 its loading area and the actions slot waits. With the current CLI/SDK, use
 `ctx.batch` for independent startup reads so they share one HTTP request and
 App process:

package/dist/index.js

@@ -4308,7 +4308,7 @@ const KO = {
   "too-many-tasks": { kind: "refusal", retryable: !0, httpStatus: 429 },
   /** The executor operation queue is full. */
   "queue-full": { kind: "refusal", retryable: !0, httpStatus: 429 },
-  /** The file is larger than max_bytes, or root output is larger than its policy max_output. */
+  /** The file is larger than max_bytes (files.read) or 100 MiB (files.write), or root output is larger than its policy max_output. */
   "limit-exceeded": { kind: "refusal", retryable: !1, httpStatus: 413 },
   /** The operation was canceled; reason says why. */
   OPERATION_CANCELED: { kind: "outcome", retryable: !1, httpStatus: 409 },
@@ -4399,6 +4399,31 @@ function C6(e) {
   const a = t.code;
   return (KO[a]?.kind !== "refusal" || typeof t.message != "string") && M(), { ok: !1, code: a, message: t.message };
 }
+function P6(e, t, a) {
+  const n = new AbortController();
+  let o;
+  async function i() {
+    let s;
+    try {
+      const r = await e.call("app.status", {}, { signal: n.signal });
+      !r || typeof r.user != "string" || !r.user || typeof r.admin != "boolean" ? s = { code: "auth_unavailable" } : t === "admin-only" && !r.admin && (s = { code: "admin_required" });
+    } catch (r) {
+      const c = r?.code;
+      s = { code: c === "session_required" || c === "admin_required" || c === "app_privilege_denied" ? c : "auth_unavailable" };
+    }
+    n.signal.aborted || a(s);
+  }
+  return {
+    check() {
+      return n.signal.aborted ? Promise.resolve() : (o || (o = i().finally(() => {
+        o = void 0;
+      })), o);
+    },
+    dispose() {
+      n.abort();
+    }
+  };
+}
 function YO(e) {
   return function(a, n) {
     return !Array.isArray(a) || a.length < 1 || a.length > 8 || a.some(function(o) {
@@ -4417,7 +4442,7 @@ function YO(e) {
     });
   };
 }
-function P6(e) {
+function M6(e) {
   const t = e.fetch ?? globalThis.fetch;
   async function a(n, o) {
     const i = new AbortController(), s = { code: "request_canceled", message: "request canceled" };
@@ -4445,7 +4470,7 @@ function P6(e) {
   }
   return { call: (n, o, i) => a({ method: n, params: o ?? {} }, i), batch: YO(a) };
 }
-async function M6(e) {
+async function q6(e) {
   let t;
   const a = new AbortController();
   try {
@@ -4517,9 +4542,10 @@ export {
   I as clientTimeout,
   c6 as createBackgroundPickerProvider,
   o6 as createBackgroundSaveFacade,
-  P6 as createClient,
+  M6 as createClient,
   oe as createDsmFileStation,
   be as createDsmSession,
+  P6 as createEntryCheck,
   Ue as createFileTransfers,
   Ne as createNasProvider,
   y6 as createPortalAccess,
@@ -4555,7 +4581,7 @@ export {
   KO as protocolCodes,
   w6 as protocolOps,
   GO as protocolSchemas,
-  M6 as readDsmPorts,
+  q6 as readDsmPorts,
   d6 as requestKey,
   ge as saveCatalogs,
   B4 as saveCopy,

package/dist/src/entry/EntryGuard.vue.d.ts

@@ -0,0 +1,27 @@
+import type { Context } from '../context';
+import { type EntryMode } from './check';
+type __VLS_Props = {
+    ctx: Pick<Context, 'call'> & Partial<Pick<Context, 'reopen' | 'displayName'>>;
+    mode: EntryMode;
+    locale?: string;
+    messages?: {
+        title: string;
+        session: string;
+        unavailable: string;
+        retry: string;
+        dismiss: string;
+    };
+};
+declare var __VLS_1: {};
+type __VLS_Slots = {} & {
+    default?: (props: typeof __VLS_1) => any;
+};
+declare const __VLS_base: import("vue").DefineComponent<__VLS_Props, {}, {}, {}, {}, import("vue").ComponentOptionsMixin, import("vue").ComponentOptionsMixin, {}, string, import("vue").PublicProps, Readonly<__VLS_Props> & Readonly<{}>, {}, {}, {}, {}, string, import("vue").ComponentProvideOptions, false, {}, any>;
+declare const __VLS_export: __VLS_WithSlots<typeof __VLS_base, __VLS_Slots>;
+declare const _default: typeof __VLS_export;
+export default _default;
+type __VLS_WithSlots<T, S> = T & {
+    new (): {
+        $slots: S;
+    };
+};

package/dist/src/entry/check.d.ts

@@ -0,0 +1,13 @@
+import type { Context } from '../context';
+export type EntryMode = 'admin-only' | 'app-privilege';
+export type EntryFailure = {
+    code: 'session_required' | 'admin_required' | 'app_privilege_denied' | 'auth_unavailable';
+};
+export interface EntryCheck {
+    check(): Promise<void>;
+    dispose(): void;
+}
+/** A background presentation check. The CGI's EntryGate is the authority.
+ * A fresh app.status traverses its session and entry checks; ctx.user is
+ * display metadata and cannot establish the current session's privileges. */
+export declare function createEntryCheck(ctx: Pick<Context, 'call'>, mode: EntryMode, onResult: (failure: EntryFailure | undefined) => void): EntryCheck;

package/dist/src/index.d.ts

@@ -37,5 +37,6 @@ export { createSharedFolderAccess, sharedFolderAccessFor, type SharedFolderOptio
 export * from './protocol/v1';
 export { encodeRequest, decodeResponse, type ProtocolAuth, type ProtocolResponse } from './protocol/codec';
 export { appDenial, appRefusal, type AppDenial } from './authorization/refusal';
+export { createEntryCheck, type EntryCheck, type EntryFailure, type EntryMode } from './entry/check';
 export { createClient, type Batch, type BatchCall, type BatchResult, type ClientOptions } from './client';
 export { readDsmPorts, type DsmPort, type DsmPortRange } from './dsm/service-ports';

package/dist/src/protocol/v1.d.ts

@@ -276,7 +276,7 @@ export declare const protocolCodes: {
         readonly retryable: true;
         readonly httpStatus: 429;
     };
-    /** The file is larger than max_bytes, or root output is larger than its policy max_output. */
+    /** The file is larger than max_bytes (files.read) or 100 MiB (files.write), or root output is larger than its policy max_output. */
     readonly "limit-exceeded": {
         readonly kind: "refusal";
         readonly retryable: false;
@@ -518,7 +518,7 @@ export interface FilesTaskStatusParams {
     job_id: string;
     task_id: string;
 }
-/** files.write: Publish a staged file synchronously. Since 0.9.0. */
+/** files.write: Publish a staged file synchronously. The staged file may be at most 104857600 bytes (100 MiB); a larger one is refused with limit-exceeded. Since 0.9.0. */
 export interface FilesWriteParams {
     delegation_id: string;
     job_id: string;

package/dist/src/vue.d.ts

@@ -26,3 +26,4 @@ export { default as BackgroundSaveSettings } from './delegate/BackgroundSaveSett
 export { default as AuthorizationGate } from './authorization/AuthorizationGate.vue';
 export { useAuthorization, type AuthorizationControl, type AuthorizationGateState } from './authorization/use-authorization';
 export { default as AuthorizationSettings } from './authorization/AuthorizationSettings.vue';
+export { default as EntryGuard } from './entry/EntryGuard.vue';