@synopackageland/sdk 0.50.0 → 0.50.1

package/dist/src/client.d.ts

@@ -1,4 +1,5 @@
 import { type CallOptions } from './context';
+import type { createDsmSession } from './dsm/session.js';
 export interface BatchCall {
     method: string;
     params?: Record<string, unknown>;
@@ -14,12 +15,23 @@ export type BatchResult<T = unknown> = {
     };
 };
 export type Batch = <T = unknown>(calls: readonly BatchCall[], options?: CallOptions) => Promise<BatchResult<T>[]>;
+/** Trusted App metadata, never inferred from method names or request params.
+ * Copy effect from the operation registry; classify AI and streaming explicitly. */
+export interface SessionRetryOperation {
+    effect: 'read' | 'write' | 'destructive';
+    kind: 'rpc' | 'ai' | 'stream';
+}
+export interface SessionRetryOptions {
+    session: ReturnType<typeof createDsmSession>;
+    operations: Readonly<Record<string, SessionRetryOperation>>;
+}
 export interface ClientOptions {
     endpoint: string;
     token?: () => string | undefined;
     ready?: () => Promise<unknown>;
     fetch?: typeof globalThis.fetch;
     requestTimeout?: number;
+    sessionRetry?: SessionRetryOptions;
 }
 /** A same-origin JSON client. Batch results stay independent and ordered. */
 export declare function createClient(options: ClientOptions): {

package/dist/src/dsm/https.d.ts

@@ -0,0 +1,6 @@
+import type { Context } from '../context';
+/** Optional link for an App's https_required page. PortInfo is administrator
+ * only: unknown and ordinary subjects never start discovery. The result opens
+ * DSM, not an App route; no query, fragment or credentials are carried across.
+ * No result means show instructions, never guess a configured port. */
+export declare function readDsmHttpsURL(ctx: Pick<Context, 'user' | 'files' | 'webApi' | 'requestTimeout'>, pageURL: string, signal?: AbortSignal): Promise<string | undefined>;

package/dist/src/dsm/session.d.ts

@@ -3,7 +3,7 @@
  * This plain JavaScript factory is also embedded by the CLI into DSM's
  * generated window, so Go-only Apps need no frontend build toolchain.
  * @param {{read: () => string | undefined, write?: (token: string) => void, fetch: typeof globalThis.fetch}} options
- * @returns {{token: () => string | undefined, ready: () => Promise<string | undefined>}}
+ * @returns {{token: () => string | undefined, ready: () => Promise<string | undefined>, refresh: (rejected?: string) => Promise<string | undefined>}}
  */
 export function createDsmSession(options: {
     read: () => string | undefined;
@@ -12,4 +12,5 @@ export function createDsmSession(options: {
 }): {
     token: () => string | undefined;
     ready: () => Promise<string | undefined>;
+    refresh: (rejected?: string) => Promise<string | undefined>;
 };

package/dist/src/index.d.ts

@@ -38,5 +38,6 @@ export * from './protocol/v1';
 export { encodeRequest, decodeResponse, type ProtocolAuth, type ProtocolResponse } from './protocol/codec';
 export { appDenial, appRefusal, type AppDenial } from './authorization/refusal';
 export { createEntryCheck, type EntryCheck, type EntryFailure, type EntryMode } from './entry/check';
-export { createClient, type Batch, type BatchCall, type BatchResult, type ClientOptions } from './client';
+export { createClient, type Batch, type BatchCall, type BatchResult, type ClientOptions, type SessionRetryOptions, type SessionRetryOperation } from './client';
 export { readDsmPorts, type DsmPort, type DsmPortRange } from './dsm/service-ports';
+export { readDsmHttpsURL } from './dsm/https';

package/dist/vue.js

@@ -1,7 +1,7 @@
 import { D as dt, i as Ba } from "./context-DWEbBTIr.js";
 import { c as So } from "./context-DWEbBTIr.js";
 import { appRefusal as va, appDenial as He, delegateCopy as Ue, createDsmFileStation as ct, appLifecycle as Pe, lifecycleRetryDelay as Ca, joinSentences as Oa, lifecycleCopy as Fe, shellCopy as oa, uiLocale as Fa, format as Ge, nasCopy as Ve, nasErrorCopy as qa, saveCopy as $a, saveError as ia, createNasProvider as Ma, labelSeparator as Sa, identityCopy as Ka, backgroundCopy as vt, createBackgroundPickerProvider as ft, backgroundErrorCopy as pt, requestKey as _a, lifecycleRefusal as mt, errorCopy as yt, scopedPicker as bt, authorizationCopy as Ha, createEntryCheck as gt } from "./index.js";
-import { FILE_STATION_APP as Po, LIFECYCLE_RETRY_MAX_MS as To, LIFECYCLE_STARTING_RETRY_MAX_MS as Ao, MAX_LAUNCH_ROUTE as zo, activePage as Ro, authorizationCatalogs as Io, backgroundCatalogs as Uo, bridgeCatalogs as Do, bridgeErrorCopy as Lo, catalogs as No, createBackgroundSaveFacade as Vo, createClient as Bo, createDsmSession as Oo, createFileTransfers as Fo, createPortalAccess as qo, createSharedFolderAccess as Mo, createSharedFolderPermission as Ko, createStandaloneContext as Ho, createStandaloneHost as Xo, decodeResponse as Go, delegateCatalogs as Wo, dsmLaunchURL as Jo, encodeRequest as Yo, fileStationPath as Qo, followLaunchRoute as Zo, identityCatalogs as jo, launchRoute as ei, mergeCatalogs as ai, nasCatalogs as ti, openFileInFileStation as li, openFolderInFileStation as ni, portalCatalogs as si, portalMessages as oi, protocolCodes as ii, protocolOps as ui, protocolSchemas as ri, readDsmPorts as di, saveCatalogs as ci, sharedFolderAccessFor as vi, sharedFolderCatalogs as fi, sharedFolderMessages as pi, sharedFolderPermissionMessage as mi, shellCatalogs as yi, shellPages as bi, uiLocales as gi } from "./index.js";
+import { FILE_STATION_APP as Po, LIFECYCLE_RETRY_MAX_MS as To, LIFECYCLE_STARTING_RETRY_MAX_MS as Ao, MAX_LAUNCH_ROUTE as zo, activePage as Ro, authorizationCatalogs as Io, backgroundCatalogs as Uo, bridgeCatalogs as Do, bridgeErrorCopy as Lo, catalogs as No, createBackgroundSaveFacade as Vo, createClient as Bo, createDsmSession as Oo, createFileTransfers as Fo, createPortalAccess as qo, createSharedFolderAccess as Mo, createSharedFolderPermission as Ko, createStandaloneContext as Ho, createStandaloneHost as Xo, decodeResponse as Go, delegateCatalogs as Wo, dsmLaunchURL as Jo, encodeRequest as Yo, fileStationPath as Qo, followLaunchRoute as Zo, identityCatalogs as jo, launchRoute as ei, mergeCatalogs as ai, nasCatalogs as ti, openFileInFileStation as li, openFolderInFileStation as ni, portalCatalogs as si, portalMessages as oi, protocolCodes as ii, protocolOps as ui, protocolSchemas as ri, readDsmHttpsURL as di, readDsmPorts as ci, saveCatalogs as vi, sharedFolderAccessFor as fi, sharedFolderCatalogs as pi, sharedFolderMessages as mi, sharedFolderPermissionMessage as yi, shellCatalogs as bi, shellPages as gi, uiLocales as hi } from "./index.js";
 import { inject as ze, ref as y, computed as x, onBeforeUnmount as ke, Comment as ht, Text as kt, Fragment as ee, watch as We, onMounted as xe, defineComponent as ve, openBlock as n, createElementBlock as w, createElementVNode as $, toDisplayString as o, createCommentVNode as b, renderList as me, normalizeClass as Re, createVNode as p, unref as e, createTextVNode as h, createBlock as g, renderSlot as ge, withCtx as s, resolveDynamicComponent as je, normalizeProps as ua, mergeProps as Ea, withModifiers as Je, isRef as ra, provide as Xe, useTemplateRef as Ne, watchEffect as la, useSlots as Xa, guardReactiveProps as za, createSlots as fa, Teleport as Ga, markRaw as _t, h as wt, useId as xt, shallowRef as Ct, onUnmounted as Wa, nextTick as $t } from "vue";
 import { Timer as St, Info as Et, ShieldCheck as Ja, ChevronRight as Ya, LogOut as Pt, ChevronLeft as Tt, RotateCw as At } from "@lucide/vue";
 import { SettingsSection as we, Callout as j, Button as N, SettingsRow as $e, Skeleton as Be, Badge as ea, PathDisplay as Oe, Form as Ye, FormItem as Te, Select as Pa, Input as Ie, Dialog as qe, ensureDeviceViewport as zt, AppRoot as Rt, ConfigProvider as It, PageContent as Ra, PageHeader as Ia, AppLayout as Ut, LoadingArea as Qa, AppSidebar as Dt, AppSidebarUser as Lt, IconButton as sa, AppToolbar as Nt, InfoTip as Za, FileTypeIcon as ha, Breadcrumb as Vt, FilePicker as Bt, TreeView as Ot, DataGrid as Ft, Link as wa, FormActions as pa, Card as Ua, Checkbox as qt, ListItem as Da } from "@synopackageland/ui";
@@ -4359,21 +4359,22 @@ export {
   ii as protocolCodes,
   ui as protocolOps,
   ri as protocolSchemas,
-  di as readDsmPorts,
+  di as readDsmHttpsURL,
+  ci as readDsmPorts,
   _a as requestKey,
-  ci as saveCatalogs,
+  vi as saveCatalogs,
   $a as saveCopy,
   ia as saveError,
   bt as scopedPicker,
-  vi as sharedFolderAccessFor,
-  fi as sharedFolderCatalogs,
-  pi as sharedFolderMessages,
-  mi as sharedFolderPermissionMessage,
-  yi as shellCatalogs,
+  fi as sharedFolderAccessFor,
+  pi as sharedFolderCatalogs,
+  mi as sharedFolderMessages,
+  yi as sharedFolderPermissionMessage,
+  bi as shellCatalogs,
   oa as shellCopy,
-  bi as shellPages,
+  gi as shellPages,
   Fa as uiLocale,
-  gi as uiLocales,
+  hi as uiLocales,
   Gs as useAuthorization,
   Mt as useExecutorPreload,
   et as useExecutorSetup,

package/executor-manifest.json

@@ -1,6 +1,6 @@
 {
   "formatVersion": 1,
-  "sdkVersion": "0.50.0",
+  "sdkVersion": "0.50.1",
   "executorVersion": "0.49.5",
   "executorDigests": {
     "x86_64": "1a2dbb1c93a5d7cf5c4d5cafd2526c152e1cc21611649875db8e1c23837c2874",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@synopackageland/sdk",
-  "version": "0.50.0",
+  "version": "0.50.1",
   "description": "Frontend SDK for DSM packages built with synopkgland: headless client and Vue components",
   "license": "MIT",
   "homepage": "https://github.com/synopackageland/syno-pkg-land-sdk/tree/main/ts#readme",

package/spec/protocol/v1/README.md

@@ -1,6 +1,6 @@
 # Executor protocol v1
 
-Since 0.9.0. The key words MUST, MUST NOT, REQUIRED, SHALL, SHALL NOT, SHOULD,
+The key words MUST, MUST NOT, REQUIRED, SHALL, SHALL NOT, SHOULD,
 SHOULD NOT, RECOMMENDED, MAY and OPTIONAL are to be interpreted as described in
 RFC 2119.
 
@@ -30,7 +30,7 @@ the executor against the vectors here.
 
 ## Timeouts
 
-Since 0.10.3. Every layer between the browser and a root program waits
+Every layer between the browser and a root program waits
 longer than the layer it calls, so the inner answer, or the inner refusal,
 arrives before the outer layer gives up. The margin is 10 seconds between
 the executor and its client and between the client and the request; the
@@ -61,13 +61,13 @@ reasons are recorded in `scripts/timeout-allowlist.json`.
 - `op` MUST be one of the ops with a schema in `schema/`. An unknown op is
   `UNKNOWN_OP`; an op outside the approved policy is `POLICY_DENIED`.
 - `auth` is OPTIONAL. When present it MUST contain only `dsm_cookie`,
-  `dsm_synotoken` and `remote_addr` (since 0.9.4), the browser's address
+  `dsm_synotoken` and `remote_addr`, the browser's address
   (REMOTE_ADDR). DSM's Application Privileges are evaluated for that address;
   an op that checks them MUST be refused with `APP_DENIED` when a present
   `auth` has no usable `remote_addr`. A grant records the `remote_addr` of the
   `delegate.create` that made it (creating it again records the new one), and
-  an operation records the address of its `files.moveFromStaging` (since
-  0.9.6). A request without `auth` under a grant, and the operation's
+  an operation records the address of its `files.moveFromStaging`. A request
+  without `auth` under a grant, and the operation's
   background revalidation, are checked from that recorded address; work with no
   recorded address is checked as coming from 127.0.0.1. A present `auth` is
   always treated as caller authentication, never ignored, even when empty. Ops whose schema says
@@ -112,7 +112,7 @@ reasons are recorded in `scripts/timeout-allowlist.json`.
 ## Status
 
 `status` answers `version` (`"1"`), `ready`, `disabled`, `executor_digest`
-and `policy_digest`. With `auth` (since 0.9.6) it also answers `allowed`:
+and `policy_digest`. With `auth` it also answers `allowed`:
 whether DSM's Application Privileges let the caller use the App and File
 Station from `remote_addr`, the check `delegate.create` makes; an invalid
 session is `AUTH_DENIED`. A CGI sends the caller's `auth` so an App the
@@ -136,7 +136,7 @@ the tasks back itself.
 
 ## Application Portal
 
-Since 0.9.6. A policy MAY carry `"portal": {"application": "<display name>",
+A policy MAY carry `"portal": {"application": "<display name>",
 "alias": "<default alias>"}` together with both `portal.register` and
 `portal.unregister`; a policy with only some of the three is invalid. The
 executor then registers the App's Application Portal entry the way DSM's
@@ -169,7 +169,7 @@ packages.
 
 ## Root programs
 
-Since 0.10.0. Each `root` entry pins a program by its SHA-256 digest; a bare
+Each `root` entry pins a program by its SHA-256 digest; a bare
 digest is a script `root.run` may run with the defaults. The object form is
 `{"digest", "kind", "schema", "run"}`: `kind` `script` (`root/<name>.sh`) or
 `binary` (`root/<name>`), `schema` a closed JSON Schema subset for its params,
@@ -223,7 +223,7 @@ Every root program, whatever starts it:
 
 ## Root jobs
 
-Since 0.10.0. `root.start`, `root.jobs.list`, `root.jobs.get` and
+`root.start`, `root.jobs.list`, `root.jobs.get` and
 `root.jobs.stop` come together in `operations`. Each requires an administrator
 session whose Application Privileges allow the App, like `root.run`; any such
 administrator sees and stops every job of the package.
@@ -299,7 +299,7 @@ The job reports on fd 5 and is told to stop on fd 4; both are pipes.
 
 ## Package stop step
 
-Since 0.10.0. A policy MAY carry `"stop": "<name>"`, naming a `root` entry the
+A policy MAY carry `"stop": "<name>"`, naming a `root` entry the
 executor runs when the package stops, after its jobs ended, with no session.
 Its argument is `prepare-upgrade` when the package account wrote `upgrade`
 to `var/executor/stop-reason` before the stop request (the
@@ -315,7 +315,7 @@ entry, which may pin the same digest under another name.
 
 ## Package start step
 
-Since 0.10.3. A policy MAY carry `"start": "<name>"`, naming a `root` entry
+A policy MAY carry `"start": "<name>"`, naming a `root` entry
 the executor runs once after each install or upgrade, with no session:
 
 - The executor MUST run it at the first start of a package version (the
@@ -353,7 +353,7 @@ MUST NOT expect its result. The App reads it from `status`.
 
 ## Root state directory
 
-Since 0.10.0. A policy with `"root_state": true` gives its root programs a
+A policy with `"root_state": true` gives its root programs a
 directory only root can read: `/volumeN/@synopkgland/<package>`, root:root
 0700, on the volume that holds the package's `var` (DSM's
 `/volumeN/@appdata/<package>`); `/volumeN/@synopkgland` is root:root 0755.
@@ -366,7 +366,7 @@ the step the executor deletes it for `delete-state` and keeps it for
 
 ## Uninstall purge step
 
-Since 0.9.7. A policy MAY carry `"purge": "<name>"`, naming one of its `root`
+A policy MAY carry `"purge": "<name>"`, naming one of its `root`
 ops as the App's root step at uninstall; any other value makes the policy
 invalid. Approving that policy is the administrator's consent that the op
 runs as root at uninstall, with no session.
@@ -398,8 +398,8 @@ runs as root at uninstall, with no session.
   Application Privileges, scope, directory identity and write permission
   against DSM. A failure the user or an administrator can undo MUST fail only
   that operation and MUST keep the grant: `PERMISSION_DENIED` (the ACL refuses
-  the write), `not-found` (the granted folder is not at its path) and, since
-  0.9.6, `APP_DENIED` (an Application Privileges rule refuses the account from
+  the write), `not-found` (the granted folder is not at its path) and
+  `APP_DENIED` (an Application Privileges rule refuses the account from
   the checked address). Once the cause is fixed, a new operation under the same
   grant succeeds. Any other revalidation failure (`DELEGATION_DENIED`,
   `INELIGIBLE`, `SCOPE_DENIED`, including a different folder at the granted
@@ -448,7 +448,7 @@ administrator). Their `dsm_cookie` is the user name and `dsm_synotoken` is
 New ops and members are added with a `since` of the SDK release. The protocol
 `v` changes only for an incompatible envelope change.
 
-## JSON WebAPI grants (since 0.11.0)
+## JSON WebAPI grants
 
 `webapi.call` MUST execute only an exact API/method/version in the grant's named
 `webapi` policy profile, with `runner` fixed to its owner. A profile has `purpose`
@@ -475,7 +475,7 @@ cannot be confirmed MUST answer `WEBAPI_UNCERTAIN` (nonretryable); client
 transport failure MAY also hide a completed operation. Binary/streaming replies
 MUST be refused. These bounds and semantics also apply to until-revoked grants.
 
-## Raw WebAPI extension (since 0.12.1)
+## Raw WebAPI extension
 
 The JSON-only restriction above applies to the default response mode. An explicit
 `response_type:"raw"` MUST require a positive, approved profile `raw_max_bytes`