@synopackageland/sdk 0.50.0 → 0.50.2

package/README.md

@@ -17,7 +17,7 @@ App's `backend/go.mod`.
 
 `createDsmSession({read, write, fetch})` provides DSM session carriers for a
 desktop window or an Application Portal page. `ready()` returns the desktop's
-current token, or makes one shared, five-second, same-origin request to
+current token, or makes one shared, bounded, same-origin request to
 `webman/login.cgi?enable_syno_token=yes`. `token()` reads the current carrier.
 The optional `write` updates DSM's in-memory session for its own WebAPI client.
 Nothing is persisted. Recovery failure leaves the backend's existing
@@ -25,6 +25,23 @@ Nothing is persisted. Recovery failure leaves the backend's existing
 both the cookie and token. The CLI embeds this factory from the selected SDK
 into every generated native window, including Go-only Apps.
 
+An old page can retain a rejected token after another tab signs in again.
+`refresh(rejectedToken)` forces same-origin recovery while sharing concurrent
+requests. `createClient({sessionRetry: {session, operations}})` opts in to one
+retry for trusted `effect: read`, `kind: rpc` operations only. Writes, AI,
+streams and batches never replay; the default remains off because the client
+cannot infer operation effects. Existing `ctx.call` is not automatically wrapped.
+See [HTTPS and session recovery](../docs/https-and-session-recovery.md) for the
+API, cancellation/deadline behavior and the CLI skill link.
+
+Many Apps can use HTTP. Only Apps needing secure context, pairing or a strict
+HTTPS Origin policy should require it. Opt-in Go `api.RequireSecureOrigin`
+returns `https_required`; render `identityCopy(locale).httpsTitle` and
+`errors.https_required` with instructions to reopen through HTTPS.
+`readDsmHttpsURL(ctx, location.href)` discovers `dms_https` through
+`readDsmPorts` only for an administrator. Ordinary/unknown users get no
+PortInfo request and should see instructions only. No port is guessed.
+
 ## DSM WebAPI
 
 Every CLI-generated DSM window provides
@@ -48,7 +65,8 @@ native download form, which cannot set a header, puts it in its same-origin
 query.
 
 `readDsmPorts(ctx)` already prefers this channel and returns `[]` on refusal,
-unavailable data or its five-second deadline. It uses a same-origin token
+unavailable data or its request deadline. Call it only for an administrator;
+PortInfo can refuse ordinary sessions or close their DSM window. It uses a same-origin token
 request only without a window channel. `createNasProvider(ctx)` and executor
 scope selection also use `ctx.webApi` for File Station JSON calls, retaining
 App admission, validation, cancellation and deadlines. A channel refusal never
@@ -176,8 +194,7 @@ const ctx = createStandaloneContext({locale: 'zh-TW', call: (method, params) =>
 
 The default logo and app name return to the first entry in `pages` (including a
 hidden entry) through `v-model`. With no pages, activation changes no selection.
-This needs UI 0.14.3 or later; older supported
-UI versions keep their static brand. Pointer, Enter and Space share the same
+Use a matching UI release with brand activation support. Pointer, Enter and Space share the same
 native button action; the phone drawer closes on activation.
 
 `@brand` receives the original `MouseEvent`. To replace the default selection,
@@ -271,9 +288,8 @@ tested on its own provides `PageInfoTarget` as it does `PageActionsTarget`.
 horizontal bar in web and DSM window layouts. The `sidebar-footer` slot (or
 the account supplied by `ctx`) follows the navigation; mobile keeps its drawer.
 Omit `navigation` to keep the installed UI's default sidebar, or pass
-`navigation="sidebar"` explicitly. Top navigation requires
-**@synopackageland/ui 0.13.1 or later**; older supported UI peers keep their
-existing layout. Sidebar width and collapse preferences are unused in top mode.
+`navigation="sidebar"` explicitly. Use a matching `@synopackageland/ui` release
+with top navigation support. Sidebar width and collapse preferences are unused in top mode.
 
 ```vue
 <AppShell v-model="page" :locale="ctx.locale" :ctx="ctx" :pages="pages" navigation="top" />
@@ -291,9 +307,8 @@ surface at every width (web, DSM window and mobile):
 <AppShell v-model="page" :locale="ctx.locale" :ctx="ctx" :pages="pages" page-surface="none" />
 ```
 
-`none` requires **@synopackageland/ui 0.12.5 or later**. The SDK still accepts
-older UI peers and forwards the value unchanged, but those releases do not
-provide the no-surface/no-horizontal-gutter behavior. Other shell spacing,
+`none` requires a matching `@synopackageland/ui` release with no-surface support.
+Other shell spacing,
 including the body bottom padding, stays unchanged.
 
 Moving to another page starts it at the top; `keep-scroll` keeps the
@@ -547,8 +562,8 @@ differ provides its adapter there, and the dialog reads as its settings
 page does.
 
 A full page, or a window DSM left open, keeps running the UI it loaded across
-a package upgrade until the page reloads (CLI 0.33.2+ windows opened after
-the upgrade load the new UI themselves). The CLI's DSM window (CLI 0.33.2+) gives `ctx.uiUpdate`: its `check()` reads the package's `ui/config`
+a package upgrade until the page reloads; windows opened after
+the upgrade load the new UI themselves. The CLI's DSM window gives `ctx.uiUpdate`: its `check()` reads the package's `ui/config`
 without the browser cache and answers whether the installed build replaced
 the window this page loaded. `AppShell` given that `ctx` shows
 `UiUpdateNotice` above every page once it answers yes: one line, Updated.