@synopackageland/templates 0.9.7 → 0.9.8

package/README.md

@@ -36,7 +36,7 @@ Vue shell from `native-go-vue` (then `native-rust-vue`), `frontend/` of
 `native-rust-root-ops`'s `root_routes.rs`, the executor shell Go borrows as
 `executor.go`. `scripts/assemble.sh --language rust` does exactly this.
 
-`backend/go.mod` requires `github.com/synopackageland/syno-pkg-land-sdk v0.9.8`; that line is
+`backend/go.mod` requires `github.com/synopackageland/syno-pkg-land-sdk v0.9.9`; that line is
 the single source of the SDK version and `frontend/package.json` pins
 `@synopackageland/sdk` to the same version. A Rust project takes it from the
 `tag` of the `syno-pkg-land-sdk` git dependency in `backend/Cargo.toml`, which

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@synopackageland/templates",
-  "version": "0.9.7",
+  "version": "0.9.8",
   "description": "Project templates for synopkgland init: native-go and native-rust (plain or Vue, with jobs, delegate and root-ops overlays), binary and compose.",
   "license": "MIT",
   "repository": {"type": "git", "url": "git+https://github.com/synopackageland/syno-pkg-land-templates.git"},

package/templates/native-go/backend/THIRD_PARTY_NOTICES.txt

@@ -1,6 +1,6 @@
 Native Go package build dependencies
 
-github.com/synopackageland/syno-pkg-land-sdk v0.9.8 (MIT)
+github.com/synopackageland/syno-pkg-land-sdk v0.9.9 (MIT)
 
 Copyright (c) 2026 synopkgland
 

package/templates/native-go/backend/go.mod

@@ -4,6 +4,6 @@ go 1.25.0
 
 toolchain go1.26.9
 
-require github.com/synopackageland/syno-pkg-land-sdk v0.9.8
+require github.com/synopackageland/syno-pkg-land-sdk v0.9.9
 
 require golang.org/x/sys v0.44.0 // indirect

package/templates/native-go/backend/go.sum

@@ -1,4 +1,4 @@
-github.com/synopackageland/syno-pkg-land-sdk v0.9.8 h1:V59KMPcCcnwmQI10U0fDRIbCNhjJkysJ/HzdIr1kH+I=
-github.com/synopackageland/syno-pkg-land-sdk v0.9.8/go.mod h1:hlsvaVuH2wsAoR8jzI1Rg/NeejQSFpAaN6zpIWsVbjI=
+github.com/synopackageland/syno-pkg-land-sdk v0.9.9 h1:TUsblZtIwlBO0DpBTUOj6gd8+xTi60Y0CwkKNb+OR3M=
+github.com/synopackageland/syno-pkg-land-sdk v0.9.9/go.mod h1:hlsvaVuH2wsAoR8jzI1Rg/NeejQSFpAaN6zpIWsVbjI=
 golang.org/x/sys v0.44.0 h1:ildZl3J4uzeKP07r2F++Op7E9B29JRUy+a27EibtBTQ=
 golang.org/x/sys v0.44.0/go.mod h1:4GL1E5IUh+htKOUEOaiffhrAeqysfVGipDYzABqnCmw=

package/templates/native-go/backend/internal/app/background_test.go

@@ -63,6 +63,7 @@ func (e *bgEnv) call(auth api.Authenticator, method, params string) (string, map
 	}
 	req := httptest.NewRequest(http.MethodPost, "/api.cgi", strings.NewReader(`{"method":"`+method+`","params":`+params+`}`))
 	req.Header.Set("Content-Type", "application/json")
+	req.Header.Set("Sec-Fetch-Site", "same-origin")
 	rec := httptest.NewRecorder()
 	srv.ServeHTTP(rec, req)
 	var out map[string]any

package/templates/native-go/backend/internal/app/routes_test.go

@@ -67,6 +67,8 @@ func apiRequest(method, params string) *http.Request {
 	body := `{"method":"` + method + `","params":` + params + `}`
 	req := httptest.NewRequest(http.MethodPost, "/api.cgi", strings.NewReader(body))
 	req.Header.Set("Content-Type", "application/json")
+	// A browser says which page sent a POST; the SDK refuses one that does not.
+	req.Header.Set("Sec-Fetch-Site", "same-origin")
 	return req
 }
 

package/templates/native-go/i18n/messages/de.json

@@ -8,6 +8,7 @@
   "error.bad_request": "Überprüfen Sie den eingegebenen Wert und versuchen Sie es erneut.",
   "error.bad_response": "Dieser Vorgang kann nicht ausgeführt werden. Bitte versuchen Sie es später erneut.",
   "error.cross_origin": "Dieser Vorgang kann nicht ausgeführt werden. Bitte versuchen Sie es später erneut.",
+  "error.origin_required": "Die Anfrage wurde abgelehnt: Der Browser hat nicht angegeben, dass sie von der Seite dieser App stammt. Öffnen Sie die App in einem aktuellen Browser erneut.",
   "error.internal": "Dieser Vorgang kann nicht ausgeführt werden. Bitte versuchen Sie es später erneut.",
   "error.json_required": "Dieser Vorgang kann nicht ausgeführt werden. Bitte versuchen Sie es später erneut.",
   "error.method_not_allowed": "Dieser Vorgang kann nicht ausgeführt werden. Bitte versuchen Sie es später erneut.",

package/templates/native-go/i18n/messages/en.json

@@ -8,6 +8,7 @@
   "error.bad_request": "Check the entered value and try again.",
   "error.bad_response": "Unable to perform this operation. Please try again later.",
   "error.cross_origin": "Unable to perform this operation. Please try again later.",
+  "error.origin_required": "The request was refused: the browser did not show that it came from this App's page. Open the App again in a current browser.",
   "error.internal": "Unable to perform this operation. Please try again later.",
   "error.json_required": "Unable to perform this operation. Please try again later.",
   "error.method_not_allowed": "Unable to perform this operation. Please try again later.",

package/templates/native-go/i18n/messages/es.json

@@ -8,6 +8,7 @@
   "error.bad_request": "Compruebe el valor introducido y vuelva a intentarlo.",
   "error.bad_response": "No se puede realizar esta operación. Vuelva a intentarlo más tarde.",
   "error.cross_origin": "No se puede realizar esta operación. Vuelva a intentarlo más tarde.",
+  "error.origin_required": "Se rechazó la solicitud: el navegador no indicó que procediera de la página de esta App. Vuelva a abrir la App en un navegador actual.",
   "error.internal": "No se puede realizar esta operación. Vuelva a intentarlo más tarde.",
   "error.json_required": "No se puede realizar esta operación. Vuelva a intentarlo más tarde.",
   "error.method_not_allowed": "No se puede realizar esta operación. Vuelva a intentarlo más tarde.",

package/templates/native-go/i18n/messages/fr.json

@@ -8,6 +8,7 @@
   "error.bad_request": "Vérifiez la valeur saisie et réessayez.",
   "error.bad_response": "Impossible d'effectuer cette opération. Veuillez réessayer ultérieurement.",
   "error.cross_origin": "Impossible d'effectuer cette opération. Veuillez réessayer ultérieurement.",
+  "error.origin_required": "La requête a été refusée : le navigateur n’a pas indiqué qu’elle provenait de la page de cette App. Rouvrez l’App dans un navigateur récent.",
   "error.internal": "Impossible d'effectuer cette opération. Veuillez réessayer ultérieurement.",
   "error.json_required": "Impossible d'effectuer cette opération. Veuillez réessayer ultérieurement.",
   "error.method_not_allowed": "Impossible d'effectuer cette opération. Veuillez réessayer ultérieurement.",

package/templates/native-go/i18n/messages/it.json

@@ -8,6 +8,7 @@
   "error.bad_request": "Controllare il valore inserito e riprovare.",
   "error.bad_response": "Impossibile eseguire questa operazione. Riprovare più tardi.",
   "error.cross_origin": "Impossibile eseguire questa operazione. Riprovare più tardi.",
+  "error.origin_required": "La richiesta è stata rifiutata: il browser non ha indicato che proviene dalla pagina di questa App. Riaprire l’App in un browser aggiornato.",
   "error.internal": "Impossibile eseguire questa operazione. Riprovare più tardi.",
   "error.json_required": "Impossibile eseguire questa operazione. Riprovare più tardi.",
   "error.method_not_allowed": "Impossibile eseguire questa operazione. Riprovare più tardi.",

package/templates/native-go/i18n/messages/ja.json

@@ -8,6 +8,7 @@
   "error.bad_request": "入力した値を確認して、もう一度お試しください。",
   "error.bad_response": "この操作は実行できません。後でもう一度お試しください。",
   "error.cross_origin": "この操作は実行できません。後でもう一度お試しください。",
+  "error.origin_required": "リクエストは拒否されました。ブラウザーがこの App のページからのリクエストであることを示しませんでした。最新のブラウザーで App を開き直してください。",
   "error.internal": "この操作は実行できません。後でもう一度お試しください。",
   "error.json_required": "この操作は実行できません。後でもう一度お試しください。",
   "error.method_not_allowed": "この操作は実行できません。後でもう一度お試しください。",

package/templates/native-go/i18n/messages/ko.json

@@ -8,6 +8,7 @@
   "error.bad_request": "입력한 값을 확인한 후 다시 시도하십시오.",
   "error.bad_response": "이 작업을 수행할 수 없습니다. 나중에 다시 시도하십시오.",
   "error.cross_origin": "이 작업을 수행할 수 없습니다. 나중에 다시 시도하십시오.",
+  "error.origin_required": "요청이 거부되었습니다. 브라우저가 이 App 페이지에서 보낸 요청임을 알리지 않았습니다. 최신 브라우저에서 App을 다시 여십시오.",
   "error.internal": "이 작업을 수행할 수 없습니다. 나중에 다시 시도하십시오.",
   "error.json_required": "이 작업을 수행할 수 없습니다. 나중에 다시 시도하십시오.",
   "error.method_not_allowed": "이 작업을 수행할 수 없습니다. 나중에 다시 시도하십시오.",

package/templates/native-go/i18n/messages/zh-CN.json

@@ -8,6 +8,7 @@
   "error.bad_request": "请检查输入的值后重试。",
   "error.bad_response": "无法执行此操作。请稍后再试。",
   "error.cross_origin": "无法执行此操作。请稍后再试。",
+  "error.origin_required": "请求已被拒绝：浏览器没有表明它来自此 App 的页面。请使用新版浏览器重新打开 App。",
   "error.internal": "无法执行此操作。请稍后再试。",
   "error.json_required": "无法执行此操作。请稍后再试。",
   "error.method_not_allowed": "无法执行此操作。请稍后再试。",

package/templates/native-go/i18n/messages/zh-TW.json

@@ -8,6 +8,7 @@
   "error.bad_request": "請檢查輸入的值後再試一次。",
   "error.bad_response": "無法執行此操作。請稍後再試。",
   "error.cross_origin": "無法執行此操作。請稍後再試。",
+  "error.origin_required": "要求已被拒絕：瀏覽器沒有表明它來自這個 App 的頁面。請使用新版瀏覽器重新開啟 App。",
   "error.internal": "無法執行此操作。請稍後再試。",
   "error.json_required": "無法執行此操作。請稍後再試。",
   "error.method_not_allowed": "無法執行此操作。請稍後再試。",

package/templates/native-go-delegate/frontend/src/CapabilityPanels.vue

@@ -1,6 +1,6 @@
 <script setup lang="ts">
 import {computed,onBeforeUnmount,onMounted,ref} from 'vue'
-import {Button,Callout} from '@synopackageland/ui'
+import {Button,Callout,SectionSkeleton} from '@synopackageland/ui'
 import type {Context} from '@synopackageland/sdk'
 import {BackgroundSavePanel, DelegatePanel, ExecutorSettings, createBackgroundPickerProvider, createBackgroundSaveFacade, saveCopy} from '@synopackageland/sdk/vue'
 const props=defineProps<{ctx:Context;admin:boolean}>()
@@ -20,13 +20,15 @@ async function detect(){
   }else mode.value='legacy'
  }catch{if(!disposed)mode.value='unavailable'}
 }
+const executor=ref<{refresh():unknown}>(),panel=ref<{refresh():unknown}>()
+defineExpose({refresh(){void executor.value?.refresh();void panel.value?.refresh()}})
 onMounted(()=>{if(!props.ctx.delegate)void detect()})
 onBeforeUnmount(()=>{disposed=true;provider.dispose()})
 </script>
 <template>
- <ExecutorSettings :admin="admin" :locale="ctx.locale" :ctx="ctx" @confirmed="revision++;detect()" />
- <BackgroundSavePanel v-if="mode==='long'" :key="revision" :sdk="sdk" :admin="admin" :locale="ctx.locale" :picker="{provider,keys}" />
- <DelegatePanel v-else-if="mode==='legacy'" :ctx="ctx" />
- <p v-else-if="mode==='loading'" role="status">{{ copy.loading }}</p>
- <Callout v-else tone="danger" role="alert">{{ copy.error }} <Button variant="secondary" @click="detect">{{ copy.refresh }}</Button></Callout>
+ <ExecutorSettings ref="executor" :admin="admin" :locale="ctx.locale" :ctx="ctx" @confirmed="revision++;detect()" />
+ <BackgroundSavePanel v-if="mode==='long'" ref="panel" :key="revision" :sdk="sdk" :admin="admin" :locale="ctx.locale" :picker="{provider,keys}" sample-save />
+ <DelegatePanel v-else-if="mode==='legacy'" ref="panel" :ctx="ctx" />
+ <SectionSkeleton v-else-if="mode==='loading'" />
+ <Callout v-else tone="danger" role="alert">{{ copy.error }} <Button variant="secondary" @click="detect">{{ copy.retry }}</Button></Callout>
 </template>

package/templates/native-go-delegate/frontend/test/capability-panels.test.ts

@@ -33,21 +33,25 @@ test('the capability surface uses an explicit long-running facade without legacy
 test('the default surface binds the real routes and the session-only picker',async()=>{
  const grant={id:'g1',key:'save',path:'/home',username:'normal1',lifetime:'until-revoked'}
  let selected=false
- const call=vi.fn(async(method:string)=>{
+ const call=vi.fn(async(method:string,params?:unknown)=>{
   if(method==='delegate.status')return {state:'ready',disabled:false,lifetime:'until-revoked',destinations:['save']}
   if(method==='delegate.destination')return {key:'save',selection:{scope:'home',root:'/home',generation:0},destination:selected?grant:null,status:selected?'active':'missing'}
   if(method==='delegate.list')return {delegations:selected?[{delegation_id:'g1',destination:'save',path:'/home',subject:{username:'normal1'},lifetime:'until-revoked',revoked:false}]:[]}
   if(method==='delegate.operations.list')return {operations:[]}
   if(method==='bg.browse')return {shares:[{name:'home',path:'/home',isdir:true}],offset:0,total:1}
   if(method==='delegate.select_destination'){selected=true;return grant}
+  if(method==='delegate.example.export')return {delegation_id:'g1',job_id:(params as {job_id:string}).job_id}
   throw {code:'unexpected'}
  })
  const root=render({call,locale:'en'});await settle()
- button(root,'Choose save destination (save)').click();await settle()
+ button(root,'Choose save destination').click();await settle()
  // The SDK picker selects a folder with a row click.
  const row=root.querySelector<HTMLElement>('tr[data-row-key="/home"]')!;expect(row).toBeTruthy();row.dispatchEvent(new MouseEvent('click',{bubbles:true}));await settle()
  button(root,'Confirm selection').click();await settle()
  expect(call).toHaveBeenCalledWith('delegate.select_destination',{key:'save',path:'/home'})
+ // The template demonstrates the save flow; SDK 0.9.9 shows it only on request.
+ button(root,'Save example file').click();await settle()
+ expect(call).toHaveBeenCalledWith('delegate.example.export',expect.objectContaining({key:'save'}))
 })
 test('the app mount forwards ctx.executor to administrator setup only',async()=>{
  for(const admin of [true,false]){
@@ -76,3 +80,25 @@ test('the app mount forwards ctx.executor to administrator setup only',async()=>
   }
  }
 })
+test('the header Refresh reloads the save destinations',async()=>{
+ const call=vi.fn(async(method:string)=>{
+  if(method==='app.status')return {package:'DelegateApp',version:'1',user:'alice',admin:false}
+  if(method==='delegate.status')return {state:'ready',disabled:false,lifetime:'until-revoked',destinations:['save']}
+  if(method==='delegate.destination')return {key:'save',selection:{scope:'home',root:'/home',generation:0},destination:null,status:'missing'}
+  if(method==='delegate.list')return {delegations:[]}
+  if(method==='delegate.operations.list')return {operations:[]}
+   throw {code:'unknown_method'}
+ })
+ const root=document.createElement('div');document.body.append(root)
+ const app=mount(root,{locale:'en',call,reopen:()=>()=>{}} as any)
+ cleanup.push(()=>{app.unmount();root.remove()});await settle()
+ const reads=()=>call.mock.calls.filter(([method])=>method==='delegate.destination').length
+ const before=reads();expect(before).toBeGreaterThan(0)
+ button(root,'Refresh').click();await settle()
+ expect(reads()).toBeGreaterThan(before)
+})
+test('the panels show a skeleton while the delegate status loads',async()=>{
+ const call=vi.fn(async(method:string)=>{if(method==='delegate.status')return new Promise(()=>{});throw {code:'unexpected'}})
+ const root=render({call,locale:'en'});await settle()
+ expect(root.querySelector('[data-ui-skeleton-line]')).not.toBeNull()
+})

package/templates/native-go-jobs/backend/internal/app/background_routes_test.go

@@ -83,6 +83,7 @@ func TestBackgroundRequestSubmitBusyAndProductionConstruction(t *testing.T) {
 	}
 	r := httptest.NewRequest("POST", "/api.cgi", strings.NewReader(`{"method":"bg.jobs.list","params":{}}`))
 	r.Header.Set("Content-Type", "application/json")
+	r.Header.Set("Sec-Fetch-Site", "same-origin")
 	w := httptest.NewRecorder()
 	srv.ServeHTTP(w, r)
 	if !strings.Contains(w.Body.String(), `"jobs_busy"`) {

package/templates/native-go-jobs/frontend/test/background-page.test.ts

@@ -39,3 +39,21 @@ test('the background panel pauses a running job and resumes a paused one',async(
   expect(call).toHaveBeenCalledWith('bg.jobs.resume',{id:'held'})
  }finally{app.unmount();root.remove()}
 })
+test('the header Refresh reloads the background panel',async()=>{
+ const call=vi.fn(async(method:string):Promise<unknown>=>{
+  if(method==='app.status')return {package:'Jobs',version:'1',user:'alice',admin:false}
+  if(method==='bg.status')return {owner:{user:'alice',uid:'1024'},admin:false,revision:1,worker:{username:'pkg',alive:true},limits:{maxInputBytes:1024,maxQueued:8,maxOwnerPending:4,maxOwnerBytes:4096,jobTimeoutSeconds:60}}
+  if(method==='bg.jobs.list')return {jobs:[]}
+  if(method==='bg.schedules.list')return {schedules:[]}
+  return {}
+ })
+ const root=document.createElement('div');document.body.append(root)
+ const app=mount(root,{locale:'en',call,reopen:()=>()=>{}} as unknown as Context)
+ const reads=()=>call.mock.calls.filter(([method])=>method==='bg.jobs.list').length
+ try{
+  await settle();const before=reads()
+  // The header button comes first; the panels below may have their own.
+  ;(Array.from(root.querySelectorAll('button')).find(b=>b.textContent==='Refresh') as HTMLButtonElement).click();await settle()
+  expect(reads()).toBeGreaterThan(before)
+ }finally{app.unmount();root.remove()}
+})

package/templates/native-go-vue/frontend/package-lock.json

@@ -7,8 +7,8 @@
       "name": "native-dsm-vue-app",
       "dependencies": {
         "@lucide/vue": "1.48.0",
-        "@synopackageland/sdk": "0.9.8",
-        "@synopackageland/ui": "0.9.2",
+        "@synopackageland/sdk": "0.9.9",
+        "@synopackageland/ui": "0.9.3",
         "vue": "3.5.43"
       },
       "devDependencies": {
@@ -1148,13 +1148,13 @@
       }
     },
     "node_modules/@synopackageland/sdk": {
-      "version": "0.9.8",
-      "resolved": "https://registry.npmjs.org/@synopackageland/sdk/-/sdk-0.9.8.tgz",
-      "integrity": "sha512-MYqEpy8/3A4z3hvffXHvNJxYw8HcIGtCKoUUx+hsG5buK+jUnFCPKrzsGuSs6mggQGZbBD/E7HdNJ00xKFQpyA==",
+      "version": "0.9.9",
+      "resolved": "https://registry.npmjs.org/@synopackageland/sdk/-/sdk-0.9.9.tgz",
+      "integrity": "sha512-O73D+s+yJPmYLfZ2l261S1izqa5lAc9hgbuBScE4uoKyydUDfWEhAmb7CUM6Er25wY8nYqG480GMcyfLuESFGw==",
       "license": "MIT",
       "peerDependencies": {
         "@lucide/vue": "^1.48.0",
-        "@synopackageland/ui": "^0.9.1",
+        "@synopackageland/ui": "^0.9.3",
         "vue": "^3.5.0"
       },
       "peerDependenciesMeta": {
@@ -1167,9 +1167,9 @@
       }
     },
     "node_modules/@synopackageland/ui": {
-      "version": "0.9.2",
-      "resolved": "https://registry.npmjs.org/@synopackageland/ui/-/ui-0.9.2.tgz",
-      "integrity": "sha512-GXYs6oVed0tIb4J5D5aDYoLJMs7haq0DBWKrPP1cLU6QKUQ6EKaIwqWHv0sVdu530FCARjcB1PrWwWVS9WOsvA==",
+      "version": "0.9.3",
+      "resolved": "https://registry.npmjs.org/@synopackageland/ui/-/ui-0.9.3.tgz",
+      "integrity": "sha512-CcCpSiQ2y4GJnbWjBxRrPO6QzLboMdEzqgbMdpXGaEI3IaTrxwS6zy8yXuuMBQHuqAcfBf3jL7fmcL9A58oVqw==",
       "license": "MIT",
       "dependencies": {
         "@internationalized/date": "3.12.4",
@@ -2538,9 +2538,9 @@
       "license": "MIT"
     },
     "node_modules/zod": {
-      "version": "4.6.6",
-      "resolved": "https://registry.npmjs.org/zod/-/zod-4.6.6.tgz",
-      "integrity": "sha512-4UmzQUF5fxvfcYHlbjBmejU+w+hbDnWFx4aS8kBx7nPBHcO2SqPbpAG8snbdg+Xse4pRefR98hgjFgIMCI/UhA==",
+      "version": "4.6.7",
+      "resolved": "https://registry.npmjs.org/zod/-/zod-4.6.7.tgz",
+      "integrity": "sha512-g8W2D2kU6a8untc053fX1uVBKzM7yqAxW/3zwk83+6RyF2+SKOuV+c0wBDhUwzV1PaGapmZH+rmcUzPf+3CGwg==",
       "license": "MIT",
       "funding": {
         "url": "https://github.com/sponsors/colinhacks"

package/templates/native-go-vue/frontend/package.json

@@ -8,8 +8,8 @@
   },
   "dependencies": {
     "@lucide/vue": "1.48.0",
-    "@synopackageland/sdk": "0.9.8",
-    "@synopackageland/ui": "0.9.2",
+    "@synopackageland/sdk": "0.9.9",
+    "@synopackageland/ui": "0.9.3",
     "vue": "3.5.43"
   },
   "devDependencies": {

package/templates/native-go-vue/frontend/src/App.vue

@@ -45,6 +45,14 @@ async function refresh() {
  } catch(e) {if(!disposed && !(early && login.enabled.value)) error.value = message(e)}
  finally {if(!disposed) {busy.value=false; if(again) {again=false; void refresh()}}}
 }
+// The header Refresh also reloads the panels below and reads the portal again.
+const panels = ref<{refresh(): unknown}>()
+const background = ref<{refresh(): unknown}>()
+const portalReads = ref(0)
+const portalKey = computed(() => `${app.value?.user}:${portalReads.value}`)
+function refreshAll() {
+ void refresh(); void panels.value?.refresh(); void background.value?.refresh(); portalReads.value++
+}
 async function save() {
  if(disposed || busy.value) return
  busy.value = true; error.value='';notice.value=''
@@ -72,27 +80,26 @@ onUnmounted(()=>{disposed=true;unsubscribe?.();login.dispose();text.value=''})
   <ConfigProvider :locale="uiLocale(ctx.locale)">
   <LoginPage v-if="login.ready.value && login.enabled.value && !login.subject.value" :session="login" :locale="ctx.locale" />
   <AppShell v-else v-model="page" :locale="ctx.locale" :pages="pages" :description="subtitle">
-   <template #actions><Button variant="secondary" :disabled="busy" @click="refresh">{{ copy.refresh }}</Button><Button v-if="login.enabled.value" variant="secondary" :disabled="busy" @click="signOut">{{ copy.signOut }}</Button></template>
+   <template #actions><Button variant="secondary" :disabled="busy" @click="refreshAll">{{ copy.refresh }}</Button><Button v-if="login.enabled.value" variant="secondary" :disabled="busy" @click="signOut">{{ copy.signOut }}</Button></template>
    <div class="integration-app" :aria-busy="busy" :aria-label="copy.settings">
-    <p v-if="busy" role="status">{{ copy.loading }}</p>
     <Callout v-if="error" tone="danger" :title="copy.actionRequired"><span role="alert">{{ error }}</span></Callout>
     <p v-if="notice" role="status">{{ notice }}</p>
     <div data-page="status" v-show="page==='status'">
-     <SettingsSection :title="copy.statusTitle" :collapsible="false">
+     <SettingsSection :title="copy.statusTitle" :collapsible="false" :loading="busy && !app">
       <p v-if="app">{{ app.package }} · {{ app.user }} · {{ app.version }}</p>
       <p v-else-if="error" role="status">{{ copy.statusError }}</p>
      </SettingsSection>
-     <PortalSettings v-if="ctx.portal && app" :key="app.user" :portal="ctx.portal" />
+     <PortalSettings v-if="ctx.portal && app" :key="portalKey" :portal="ctx.portal" />
      <SettingsSection v-if="app?.admin" :title="copy.greeting" :collapsible="false">
-      <Form @submit.prevent="save"><FormItem :label="copy.greeting"><Textarea v-model="text" :disabled="busy" /></FormItem>
+      <Form direction="vertical" @submit.prevent="save"><FormItem :label="copy.greeting"><Textarea v-model="text" :disabled="busy" /></FormItem>
        <FormActions><Button variant="primary" :disabled="busy || !text.trim()" @click="save">{{ copy.save }}</Button></FormActions>
       </Form>
      </SettingsSection>
     </div>
-    <CapabilityPanels v-if="app" :key="app.user" :ctx="ctx" :admin="app.admin" />
+    <CapabilityPanels v-if="app" ref="panels" :key="app.user" :ctx="ctx" :admin="app.admin" />
     <FilesPage v-if="page==='status'" :ctx="ctx" />
     <div data-page="background" v-show="page==='background'">
-     <BackgroundPanel v-if="backgroundEnabled && app" :key="app.user" :ctx="ctx" />
+     <BackgroundPanel v-if="backgroundEnabled && app" ref="background" :key="app.user" :ctx="ctx" />
     </div>
    </div>
   </AppShell>

package/templates/native-go-vue/frontend/src/CapabilityPanels.vue

@@ -1,6 +1,9 @@
 <script setup lang="ts">
+import {ref} from 'vue'
 import type {Context} from '@synopackageland/sdk'
 import {ExecutorSettings} from '@synopackageland/sdk/vue'
 defineProps<{ctx:Context;admin:boolean}>()
+const executor=ref<{refresh():unknown}>()
+defineExpose({refresh:()=>void executor.value?.refresh()})
 </script>
-<template><ExecutorSettings v-if="ctx.executor" :admin="admin" :locale="ctx.locale" /></template>
+<template><ExecutorSettings v-if="ctx.executor" ref="executor" :admin="admin" :locale="ctx.locale" /></template>

package/templates/native-go-vue/frontend/src/i18n/de.json

@@ -2,7 +2,6 @@
   "refresh": "Aktualisieren",
   "signOut": "Abmelden",
   "settings": "Paketeinstellungen",
-  "loading": "Paketdaten werden geladen…",
   "actionRequired": "Aktion erforderlich",
   "statusTitle": "Paketstatus",
   "statusError": "Der Status konnte nicht geladen werden. Aktualisieren Sie die Ansicht und versuchen Sie es erneut.",

package/templates/native-go-vue/frontend/src/i18n/en.json

@@ -2,7 +2,6 @@
   "refresh": "Refresh",
   "signOut": "Sign out",
   "settings": "Package settings",
-  "loading": "Loading package data…",
   "actionRequired": "Action required",
   "statusTitle": "Package status",
   "statusError": "Status could not be loaded. Refresh to try again.",

package/templates/native-go-vue/frontend/src/i18n/es.json

@@ -2,7 +2,6 @@
   "refresh": "Actualizar",
   "signOut": "Cerrar sesión",
   "settings": "Configuración del paquete",
-  "loading": "Cargando datos del paquete…",
   "actionRequired": "Acción necesaria",
   "statusTitle": "Estado del paquete",
   "statusError": "No se pudo cargar el estado. Actualice e inténtelo de nuevo.",

package/templates/native-go-vue/frontend/src/i18n/fr.json

@@ -2,7 +2,6 @@
   "refresh": "Actualiser",
   "signOut": "Se déconnecter",
   "settings": "Paramètres du paquet",
-  "loading": "Chargement des données du paquet…",
   "actionRequired": "Action requise",
   "statusTitle": "État du paquet",
   "statusError": "Impossible de charger l’état. Actualisez et réessayez.",

package/templates/native-go-vue/frontend/src/i18n/it.json

@@ -2,7 +2,6 @@
   "refresh": "Aggiorna",
   "signOut": "Disconnetti",
   "settings": "Impostazioni del pacchetto",
-  "loading": "Caricamento dei dati del pacchetto…",
   "actionRequired": "Azione richiesta",
   "statusTitle": "Stato del pacchetto",
   "statusError": "Impossibile caricare lo stato. Aggiornare e riprovare.",

package/templates/native-go-vue/frontend/src/i18n/ja.json

@@ -2,7 +2,6 @@
   "refresh": "最新の情報に更新",
   "signOut": "サインアウト",
   "settings": "パッケージ設定",
-  "loading": "パッケージデータを読み込み中…",
   "actionRequired": "対応が必要です",
   "statusTitle": "パッケージの状態",
   "statusError": "状態を読み込めませんでした。最新の情報に更新してから、もう一度お試しください。",

package/templates/native-go-vue/frontend/src/i18n/ko.json

@@ -2,7 +2,6 @@
   "refresh": "새로 고침",
   "signOut": "로그아웃",
   "settings": "패키지 설정",
-  "loading": "패키지 데이터를 불러오는 중…",
   "actionRequired": "조치 필요",
   "statusTitle": "패키지 상태",
   "statusError": "상태를 불러올 수 없습니다. 새로 고친 후 다시 시도하십시오.",

package/templates/native-go-vue/frontend/src/i18n/zh-CN.json

@@ -2,7 +2,6 @@
   "refresh": "刷新",
   "signOut": "注销",
   "settings": "套件设置",
-  "loading": "正在加载套件数据…",
   "actionRequired": "需要处理",
   "statusTitle": "套件状态",
   "statusError": "无法加载状态，请刷新后重试。",

package/templates/native-go-vue/frontend/src/i18n/zh-TW.json

@@ -2,7 +2,6 @@
   "refresh": "重新整理",
   "signOut": "登出",
   "settings": "套件設定",
-  "loading": "正在載入套件資料…",
   "actionRequired": "需要處理",
   "statusTitle": "套件狀態",
   "statusError": "無法載入狀態，請重新整理後再試。",

package/templates/native-go-vue/frontend/test/apps.test.ts

@@ -55,6 +55,22 @@ test('a portal app shows the Application Portal section on the status page',asyn
   app.unmount()
  }finally{without.close();f.root.remove()}
 })
+test('the header Refresh reads the portal and executor status again',async()=>{
+ const f=fixture('Portal')
+ try{
+  await settle();f.app.unmount()
+  const status={state:'active',alias:'portal',url:'https://nas.example/portal/',canManage:false,controlPanel:false,defaultAlias:'portal'} as const
+  const portal=vi.fn(async()=>status),executor=vi.fn(async()=>({state:'ready' as const}))
+  f.ctx.portal={messages:{title:'Application Portal',link:'Direct link:'},status:portal,apply:vi.fn(),disable:vi.fn(),openControlPanel:vi.fn(),mountPanel:vi.fn()}
+  f.ctx.executor={status:executor,authorize:vi.fn(),control:vi.fn()} as unknown as Context['executor']
+  const app=mount(f.root,f.ctx);await settle()
+  const [portalReads,executorReads]=[portal.mock.calls.length,executor.mock.calls.length]
+  ;[...f.root.querySelectorAll('button')].find(n=>n.textContent==='Refresh')!.click();await settle()
+  expect(portal.mock.calls.length).toBeGreaterThan(portalReads)
+  expect(executor.mock.calls.length).toBeGreaterThan(executorReads)
+  app.unmount()
+ }finally{f.root.remove()}
+})
 test('the app renders and loads status while the session check is still pending',async()=>{
  const call=vi.fn(async(method:string)=>{
   if(method==='identity.status')return new Promise(()=>{})
@@ -129,3 +145,24 @@ test('outside a DSM window dialogs stay inside the app',async()=>{
   try{await settle();expect(document.querySelector('[data-ui-floating]')).toBeNull()}finally{f.close()}
  }
 })
+test('the status page follows the UI layout rules',async()=>{
+ let answer:(value:unknown)=>void=()=>{}
+ const call=vi.fn(async(method:string)=>{
+  if(method==='app.status')return new Promise(resolve=>{answer=resolve})
+  if(method==='greeting.get')return {text:'Hello'}
+  throw {code:'unknown_method'}
+ })
+ const root=document.createElement('div');document.body.append(root)
+ const app=mount(root,{locale:'en',call,reopen:()=>()=>{}} as unknown as Context)
+ try{
+  await settle()
+  // A loading section keeps its title and shows a skeleton, not a sentence.
+  expect(root.textContent).toContain('Package status')
+  expect(root.querySelector('[data-ui-skeleton-line]')).not.toBeNull()
+  expect(root.textContent).not.toContain('Loading package data')
+  answer({package:'Pkg',version:'1',user:'admin',admin:true});await settle()
+  expect(root.querySelector('[data-ui-skeleton-line]')).toBeNull()
+  // Labels sit above their fields.
+  expect(root.querySelector('textarea')!.closest('[data-form-item]')!.getAttribute('data-direction')).toBe('vertical')
+ }finally{app.unmount();root.remove()}
+})

package/templates/native-go-vue/frontend/test/native-controls.test.ts

@@ -10,12 +10,12 @@ const uses=(file:string,tag:string)=>new RegExp(`<${tag}[\\s>/]`).test(template(
 test.each(['select','option','textarea','label','input','a'])('no vue template renders a native <%s>',tag=>{
  expect(sources(root).filter(file=>uses(file,tag))).toEqual([])
 })
-// Form direction and the control id come from the UI: `direction="auto"` stacks labels in a
-// narrow package window, and a control inside a FormItem binds its id/ARIA by itself.
-test('FormItem controls rely on the UI auto layout and id binding',()=>{
+// UI layout rules: labels sit above their controls, so a page Form is vertical; a control
+// inside a FormItem binds its id/ARIA by itself.
+test('FormItem labels sit above their controls and the UI binds the control id',()=>{
  const items=sources(root).filter(file=>uses(file,'FormItem'))
  expect(items.length).toBeGreaterThan(0)
- expect(items.filter(file=>/direction="vertical"|field\.controlId|#default="\{field\}"/.test(template(file)))).toEqual([])
+ expect(items.filter(file=>/<Form(?![^>]*direction="vertical")[\s>]|field\.controlId|#default="\{field\}"/.test(template(file)))).toEqual([])
 })
 // UI built-in text follows the Provider locale (nine locales), so every app root sets it once and no
 // component repeats a per-control locale or download label.

package/templates/native-rust/backend/Cargo.lock

@@ -104,8 +104,8 @@ dependencies = [
 
 [[package]]
 name = "syno-pkg-land-sdk"
-version = "0.9.8"
-source = "git+https://github.com/synopackageland/syno-pkg-land-sdk?tag=v0.9.8#af09d3ee156e631edc81025561dcbb6e120fef32"
+version = "0.9.9"
+source = "git+https://github.com/synopackageland/syno-pkg-land-sdk?tag=v0.9.9#28da1726b0c06f4428153555314d33c7a3ca8a8b"
 dependencies = [
  "libc",
  "serde",

package/templates/native-rust/backend/Cargo.toml

@@ -17,7 +17,7 @@ libc = "0.2"
 serde = { version = "1", features = ["derive"] }
 serde_json = "1"
 # The SDK version is the tag; `synopkgland check` reads it from Cargo.lock.
-syno-pkg-land-sdk = { git = "https://github.com/synopackageland/syno-pkg-land-sdk", tag = "v0.9.8" }
+syno-pkg-land-sdk = { git = "https://github.com/synopackageland/syno-pkg-land-sdk", tag = "v0.9.9" }
 
 [profile.release]
 # A handler panic becomes an "internal" reply (api::Server); abort would end the CGI instead.

package/templates/native-rust/backend/THIRD_PARTY_NOTICES.txt

@@ -1,6 +1,6 @@
 Native Rust package build dependencies (crates linked into the backend binaries)
 
-syno-pkg-land-sdk v0.9.8 (MIT)
+syno-pkg-land-sdk v0.9.9 (MIT)
 
 MIT License
 

package/templates/native-rust/backend/src/app/test_support.rs

@@ -130,6 +130,8 @@ pub fn api_request(method: &str, params: &str) -> Request {
     let body = format!(r#"{{"method":"{method}","params":{params}}}"#);
     let mut req = Request::new("POST", "/api.cgi").with_body(body);
     req.header.set("Content-Type", "application/json");
+    // A browser says which page sent a POST; the SDK refuses one that does not.
+    req.header.set("Sec-Fetch-Site", "same-origin");
     req
 }
 

package/templates/native-rust/i18n/messages/de.json

@@ -8,6 +8,7 @@
   "error.bad_request": "Überprüfen Sie den eingegebenen Wert und versuchen Sie es erneut.",
   "error.bad_response": "Dieser Vorgang kann nicht ausgeführt werden. Bitte versuchen Sie es später erneut.",
   "error.cross_origin": "Dieser Vorgang kann nicht ausgeführt werden. Bitte versuchen Sie es später erneut.",
+  "error.origin_required": "Die Anfrage wurde abgelehnt: Der Browser hat nicht angegeben, dass sie von der Seite dieser App stammt. Öffnen Sie die App in einem aktuellen Browser erneut.",
   "error.internal": "Dieser Vorgang kann nicht ausgeführt werden. Bitte versuchen Sie es später erneut.",
   "error.json_required": "Dieser Vorgang kann nicht ausgeführt werden. Bitte versuchen Sie es später erneut.",
   "error.method_not_allowed": "Dieser Vorgang kann nicht ausgeführt werden. Bitte versuchen Sie es später erneut.",

package/templates/native-rust/i18n/messages/en.json

@@ -8,6 +8,7 @@
   "error.bad_request": "Check the entered value and try again.",
   "error.bad_response": "Unable to perform this operation. Please try again later.",
   "error.cross_origin": "Unable to perform this operation. Please try again later.",
+  "error.origin_required": "The request was refused: the browser did not show that it came from this App's page. Open the App again in a current browser.",
   "error.internal": "Unable to perform this operation. Please try again later.",
   "error.json_required": "Unable to perform this operation. Please try again later.",
   "error.method_not_allowed": "Unable to perform this operation. Please try again later.",

package/templates/native-rust/i18n/messages/es.json

@@ -8,6 +8,7 @@
   "error.bad_request": "Compruebe el valor introducido y vuelva a intentarlo.",
   "error.bad_response": "No se puede realizar esta operación. Vuelva a intentarlo más tarde.",
   "error.cross_origin": "No se puede realizar esta operación. Vuelva a intentarlo más tarde.",
+  "error.origin_required": "Se rechazó la solicitud: el navegador no indicó que procediera de la página de esta App. Vuelva a abrir la App en un navegador actual.",
   "error.internal": "No se puede realizar esta operación. Vuelva a intentarlo más tarde.",
   "error.json_required": "No se puede realizar esta operación. Vuelva a intentarlo más tarde.",
   "error.method_not_allowed": "No se puede realizar esta operación. Vuelva a intentarlo más tarde.",

package/templates/native-rust/i18n/messages/fr.json

@@ -8,6 +8,7 @@
   "error.bad_request": "Vérifiez la valeur saisie et réessayez.",
   "error.bad_response": "Impossible d'effectuer cette opération. Veuillez réessayer ultérieurement.",
   "error.cross_origin": "Impossible d'effectuer cette opération. Veuillez réessayer ultérieurement.",
+  "error.origin_required": "La requête a été refusée : le navigateur n’a pas indiqué qu’elle provenait de la page de cette App. Rouvrez l’App dans un navigateur récent.",
   "error.internal": "Impossible d'effectuer cette opération. Veuillez réessayer ultérieurement.",
   "error.json_required": "Impossible d'effectuer cette opération. Veuillez réessayer ultérieurement.",
   "error.method_not_allowed": "Impossible d'effectuer cette opération. Veuillez réessayer ultérieurement.",

package/templates/native-rust/i18n/messages/it.json

@@ -8,6 +8,7 @@
   "error.bad_request": "Controllare il valore inserito e riprovare.",
   "error.bad_response": "Impossibile eseguire questa operazione. Riprovare più tardi.",
   "error.cross_origin": "Impossibile eseguire questa operazione. Riprovare più tardi.",
+  "error.origin_required": "La richiesta è stata rifiutata: il browser non ha indicato che proviene dalla pagina di questa App. Riaprire l’App in un browser aggiornato.",
   "error.internal": "Impossibile eseguire questa operazione. Riprovare più tardi.",
   "error.json_required": "Impossibile eseguire questa operazione. Riprovare più tardi.",
   "error.method_not_allowed": "Impossibile eseguire questa operazione. Riprovare più tardi.",

package/templates/native-rust/i18n/messages/ja.json

@@ -8,6 +8,7 @@
   "error.bad_request": "入力した値を確認して、もう一度お試しください。",
   "error.bad_response": "この操作は実行できません。後でもう一度お試しください。",
   "error.cross_origin": "この操作は実行できません。後でもう一度お試しください。",
+  "error.origin_required": "リクエストは拒否されました。ブラウザーがこの App のページからのリクエストであることを示しませんでした。最新のブラウザーで App を開き直してください。",
   "error.internal": "この操作は実行できません。後でもう一度お試しください。",
   "error.json_required": "この操作は実行できません。後でもう一度お試しください。",
   "error.method_not_allowed": "この操作は実行できません。後でもう一度お試しください。",

package/templates/native-rust/i18n/messages/ko.json

@@ -8,6 +8,7 @@
   "error.bad_request": "입력한 값을 확인한 후 다시 시도하십시오.",
   "error.bad_response": "이 작업을 수행할 수 없습니다. 나중에 다시 시도하십시오.",
   "error.cross_origin": "이 작업을 수행할 수 없습니다. 나중에 다시 시도하십시오.",
+  "error.origin_required": "요청이 거부되었습니다. 브라우저가 이 App 페이지에서 보낸 요청임을 알리지 않았습니다. 최신 브라우저에서 App을 다시 여십시오.",
   "error.internal": "이 작업을 수행할 수 없습니다. 나중에 다시 시도하십시오.",
   "error.json_required": "이 작업을 수행할 수 없습니다. 나중에 다시 시도하십시오.",
   "error.method_not_allowed": "이 작업을 수행할 수 없습니다. 나중에 다시 시도하십시오.",

package/templates/native-rust/i18n/messages/zh-CN.json

@@ -8,6 +8,7 @@
   "error.bad_request": "请检查输入的值后重试。",
   "error.bad_response": "无法执行此操作。请稍后再试。",
   "error.cross_origin": "无法执行此操作。请稍后再试。",
+  "error.origin_required": "请求已被拒绝：浏览器没有表明它来自此 App 的页面。请使用新版浏览器重新打开 App。",
   "error.internal": "无法执行此操作。请稍后再试。",
   "error.json_required": "无法执行此操作。请稍后再试。",
   "error.method_not_allowed": "无法执行此操作。请稍后再试。",

package/templates/native-rust/i18n/messages/zh-TW.json

@@ -8,6 +8,7 @@
   "error.bad_request": "請檢查輸入的值後再試一次。",
   "error.bad_response": "無法執行此操作。請稍後再試。",
   "error.cross_origin": "無法執行此操作。請稍後再試。",
+  "error.origin_required": "要求已被拒絕：瀏覽器沒有表明它來自這個 App 的頁面。請使用新版瀏覽器重新開啟 App。",
   "error.internal": "無法執行此操作。請稍後再試。",
   "error.json_required": "無法執行此操作。請稍後再試。",
   "error.method_not_allowed": "無法執行此操作。請稍後再試。",