@truenas/api-client 3.0.3 → 3.0.5

package/dist/index.d.cts

@@ -12460,6 +12460,16 @@ declare class TrueNasSocket {
     complete(): void;
 }
 
+/**
+ * The scheme used to reach the appliance, in `location.protocol` form.
+ *
+ * Colon included, so a caller served *by the appliance* can pass
+ * `location.protocol` unchanged. That equivalence only holds same-origin: this
+ * value is spliced onto the hostname the client connects to, so a page served
+ * from somewhere else must say what the appliance uses, not what it uses.
+ */
+type ApplianceProtocol = 'http:' | 'https:';
+
 interface ActiveConnection {
     ws: TrueNasSocket;
     hostname: string;
@@ -12482,6 +12492,7 @@ declare class TrueNasConnection {
     readonly retryDelay: number;
     readonly maxRetry: number;
     readonly logger: Logger;
+    readonly protocol: ApplianceProtocol;
     opened: BehaviorSubject<boolean>;
     closed: Subject<void>;
     hostname: BehaviorSubject<string>;
@@ -12544,7 +12555,7 @@ declare class TrueNasConnection {
      * observable which always emits messages from the current socket.
      */
     messages$: Observable<TrueNasMessage>;
-    constructor(initialEnabled: boolean, hostnames: string[], systemUuid: string, websocketPath: string, systemName?: string | undefined, retryDelay?: number, maxRetry?: number, logger?: Logger);
+    constructor(initialEnabled: boolean, hostnames: string[], systemUuid: string, websocketPath: string, systemName?: string | undefined, retryDelay?: number, maxRetry?: number, logger?: Logger, protocol?: ApplianceProtocol);
     /**
      * whether the connection has exhausted its retries — the **cumulative** snapshot, read
      * synchronously. (Formerly `hasConnectionError()`; renamed to disambiguate it from the
@@ -12787,6 +12798,49 @@ declare class TrueNasApi<D extends ApiDirectoryShape = BaseApiDirectory> {
     private initializeJobEventsSubscription;
 }
 
+/**
+ * Response from the /api/versions endpoint
+ * Returns an array of version strings directly
+ * Example: ["v25.10.0", "v25.10.1", "v26.0.0"]
+ */
+type ApiVersionResponse = string[];
+/**
+ * Parsed API version information
+ *
+ * Version format:
+ * - Legacy (v25.x): vYY.MM.PATCH (e.g., v25.10.0 = October 2025, patch 0)
+ * - New (v26+): vYY.MINOR.PATCH (e.g., v26.0.0 = 2026, minor 0, patch 0)
+ *
+ * Note: The second segment has different semantics based on the year:
+ * - Year 25: month (1-12)
+ * - Year 26+: minor version (0-99)
+ */
+interface ApiVersion {
+    /** Full version string (e.g., "v26.0.0") */
+    version: string;
+    /** Two-digit year (e.g., 26 = 2026) */
+    year: number;
+    /**
+     * Second version segment (semantics depend on year):
+     * - For v25.x: month (1-12, e.g., 10 = October)
+     * - For v26+: minor version (0-99)
+     */
+    minor: number;
+    /** Patch version number (e.g., 0, 1, 2) */
+    patch: number;
+    /** WebSocket path for this version (e.g., "/api/v26.0.0") */
+    websocketPath: string;
+}
+/**
+ * Version compatibility status
+ */
+declare enum VersionCompatibility {
+    Compatible = "compatible",
+    TooOld = "too-old",
+    TooNew = "too-new",
+    Invalid = "invalid"
+}
+
 interface ApiKeyCreate {
     id: number;
     key: string;
@@ -12813,6 +12867,24 @@ interface AuthResponse {
     response_type: AuthResponseType;
     username?: string;
     authenticator?: 'LEVEL_1' | 'LEVEL_2' | 'LEVEL_3';
+    /**
+     * A token for re-authenticating without credentials.
+     *
+     * Absent below v26: `AuthRespSuccess` there declares only `response_type`,
+     * `user_info` and `authenticator`. From v26 it is always present and is
+     * `null` when no token was minted — because none was asked for, or because
+     * the session cannot have one. Middleware refuses for a session authenticated
+     * by a one-time *password* (`auth.generate_onetime_password`), which is not
+     * the same thing as 2FA despite this codebase spelling 2FA "OTP" throughout.
+     *
+     * A 2FA account gets `null` for a different reason, and it is this client's
+     * doing rather than the server's: the password request carrying the option is
+     * answered `OTP_REQUIRED` before anything is minted, and `loginWithOtp` does
+     * not send `login_options` on the second step. Middleware would honour it
+     * there — `auth.login_ex_continue` re-enters `login_ex`, and a 2FA session
+     * may hold a token — so this is a gap to close, not a limit to work around.
+     */
+    reconnect_token?: string | null;
     max_session_age?: number;
     max_inactivity?: number;
     urls?: string[];
@@ -12866,6 +12938,7 @@ interface AuthResponse {
  */
 declare class TrueNasAuthenticator {
     private connection;
+    private readonly version?;
     static readonly DefaultSessionLifetime = 300;
     /**
      * whether or not the system is currently authenticated and accessible.
@@ -12885,9 +12958,54 @@ declare class TrueNasAuthenticator {
         key: string;
     };
     sessionLifetime: number;
-    constructor(connection: TrueNasConnection);
+    constructor(connection: TrueNasConnection, version?: ApiVersion | undefined);
+    /**
+     * `login_options` asking for a reconnect token, when the server understands it.
+     *
+     * Omitted below v26. `AuthCommonOptions` is `additionalProperties: false`
+     * there and has only `user_info`, so sending the member is a validation
+     * error, not an ignored field — it would fail login outright on the oldest
+     * version this client supports.
+     */
+    /**
+     * Two things this does not do, both deliberate and both worth knowing.
+     *
+     * There is no way for a consumer to decline: every v26+ password login now
+     * mints a single-use credential carrying that session's roles, whether or not
+     * the caller wants one. And the auto-relogin in the constructor subscribes
+     * with no observer, so the token it mints is dropped — a caller reconnecting
+     * repeatedly holds an ageing token while the appliance mints fresh ones
+     * nobody reads. Tokens are single-use with a 600s TTL, so that is the
+     * reconnect case the feature is named for.
+     */
+    private reconnectTokenOption;
     loginWithUserPass(username: string, password: string): rxjs.Observable<AuthResponse>;
     loginWithOtp(code: string): rxjs.Observable<AuthResponse>;
+    /**
+     * Re-authenticate with a token from a previous login's `reconnect_token`.
+     *
+     * This is what lets a second connection to the same appliance authenticate
+     * without asking the user for a password again — middleware sessions are
+     * per-connection, so a second socket has its own to establish.
+     *
+     * The token is single-use and short-lived. On v26+ a successful login mints
+     * another on the response, so a caller keeping a session alive across
+     * reconnects stores the newest each time; below v26 nothing is minted and
+     * there is no chain to keep.
+     *
+     * Re-login is the caller's to drive. A token session is not covered by the
+     * automatic reconnect this class does for password and api-key sessions,
+     * which is deliberate — the token is single-use — but it means a dropped
+     * socket needs the stored token spending explicitly. Middleware holds tokens
+     * in memory, so a `middlewared` restart voids them, and that is a common
+     * reason the socket dropped in the first place.
+     */
+    loginWithToken(token: string): rxjs.Observable<AuthResponse>;
+    /**
+     * No reconnect token is requested here, though v26+ would mint one: an
+     * api-key session already reconnects without a prompt, since the key is held
+     * and replayed. The token exists for the credential that cannot be.
+     */
     loginWithApiKey(credentials: {
         username: string;
         key: string;
@@ -12896,49 +13014,6 @@ declare class TrueNasAuthenticator {
     logout(): rxjs.Observable<boolean>;
 }
 
-/**
- * Response from the /api/versions endpoint
- * Returns an array of version strings directly
- * Example: ["v25.10.0", "v25.10.1", "v26.0.0"]
- */
-type ApiVersionResponse = string[];
-/**
- * Parsed API version information
- *
- * Version format:
- * - Legacy (v25.x): vYY.MM.PATCH (e.g., v25.10.0 = October 2025, patch 0)
- * - New (v26+): vYY.MINOR.PATCH (e.g., v26.0.0 = 2026, minor 0, patch 0)
- *
- * Note: The second segment has different semantics based on the year:
- * - Year 25: month (1-12)
- * - Year 26+: minor version (0-99)
- */
-interface ApiVersion {
-    /** Full version string (e.g., "v26.0.0") */
-    version: string;
-    /** Two-digit year (e.g., 26 = 2026) */
-    year: number;
-    /**
-     * Second version segment (semantics depend on year):
-     * - For v25.x: month (1-12, e.g., 10 = October)
-     * - For v26+: minor version (0-99)
-     */
-    minor: number;
-    /** Patch version number (e.g., 0, 1, 2) */
-    patch: number;
-    /** WebSocket path for this version (e.g., "/api/v26.0.0") */
-    websocketPath: string;
-}
-/**
- * Version compatibility status
- */
-declare enum VersionCompatibility {
-    Compatible = "compatible",
-    TooOld = "too-old",
-    TooNew = "too-new",
-    Invalid = "invalid"
-}
-
 /**
  * The state `Container.status` is narrowed to.
  *
@@ -13192,7 +13267,8 @@ declare abstract class TrueNasApiClient<D extends ApiDirectoryShape = BaseApiDir
     protected readonly systemName: string | undefined;
     /** Logger forwarded to the connection (defaults to a no-op). */
     protected readonly logger: Logger;
-    constructor(uuid: string, hostnames: string[], version: ApiVersion, enabled: boolean, systemName?: string, logger?: Logger);
+    protected readonly protocol: ApplianceProtocol;
+    constructor(uuid: string, hostnames: string[], version: ApiVersion, enabled: boolean, systemName?: string, logger?: Logger, protocol?: ApplianceProtocol);
     /**
      * Get current connection status.
      * @returns true if WebSocket is connected
@@ -27604,6 +27680,28 @@ interface CreateClientOptions {
      * without the caller asserting it through a type parameter.
      */
     version?: SupportedApiVersion;
+    /**
+     * The scheme to reach the appliance on, in `location.protocol` form.
+     *
+     * Selects both halves of the transport: `https:` gives `https` discovery and
+     * a `wss` socket, `http:` gives `http` and `ws`. Defaults to `https:`, which
+     * is what an appliance serves and what Connect uses.
+     *
+     * This describes the *appliance*, not the page. Passing
+     * `location.protocol` is correct when the appliance serves the page — the
+     * same-origin case this exists for — and wrong otherwise. A page on
+     * `http://localhost:5173` talking to an https appliance gets both halves
+     * wrong, but only one of them says so: `fetch` follows the redirect and
+     * discovery appears to work, while the WebSocket has no such tolerance and
+     * fails the handshake without naming the scheme.
+     *
+     * Omitting it against a plaintext appliance is the quieter failure and the
+     * likelier one, since it is the case this option exists for. Discovery tries
+     * `https`, `fetch` rejects, and that is indistinguishable from the CORS block
+     * v25.10.0 has on `/api/versions` — so the fallback fires and the caller gets
+     * a client pinned to v25.10.0, warned about only in the log.
+     */
+    protocol?: ApplianceProtocol;
 }
 /**
  * Creates a version-specific TrueNAS API client.
@@ -27883,12 +27981,14 @@ declare class TrueNasApiClientV27 extends TrueNasApiClient<ApiDirectory> {
  */
 declare class VersionDiscovery {
     private readonly logger;
+    private readonly protocol;
     private versionCache;
-    constructor(logger?: Logger);
+    constructor(logger?: Logger, protocol?: ApplianceProtocol);
+    private versionsUrl;
     /**
      * Discovers the API version for a given hostname.
      *
-     * Makes a GET request to `https://{hostname}/api/versions` and returns the latest
+     * Makes a GET request to `{protocol}//{hostname}/api/versions` and returns the latest
      * compatible version. Results are cached per hostname; the cache entry is removed
      * on failure so the next call retries.
      *
@@ -28007,6 +28107,7 @@ declare enum AuthErrorCode {
     PasswordAuthFailed = "PASSWORD_AUTH_FAILED",
     OtpAuthFailed = "OTP_AUTH_FAILED",
     ApiKeyAuthFailed = "API_KEY_AUTH_FAILED",
+    TokenAuthFailed = "TOKEN_AUTH_FAILED",
     FullAdminRequired = "FULL_ADMIN_REQUIRED"
 }
 declare class AuthError extends Error {
@@ -28067,4 +28168,4 @@ type ApiError = JsonRpcError | TrueNasError;
  */
 declare function getApiErrorMessage(error: unknown, fallback?: string): string;
 
-export { type ApiCallDirectory$7 as ApiCallDirectoryV25_10_0, type ApiCallDirectory$6 as ApiCallDirectoryV25_10_1, type ApiCallDirectory$5 as ApiCallDirectoryV25_10_2, type ApiCallDirectory$4 as ApiCallDirectoryV25_10_3, type ApiCallDirectory$3 as ApiCallDirectoryV25_10_4, type ApiCallDirectory$2 as ApiCallDirectoryV25_10_5, type ApiCallDirectory$1 as ApiCallDirectoryV26_0_0, type ApiCallDirectory as ApiCallDirectoryV27_0_0, type ApiDirectoryByVersion, type ApiDirectoryShape, type ApiDirectory$7 as ApiDirectoryV25_10_0, type ApiDirectory$6 as ApiDirectoryV25_10_1, type ApiDirectory$5 as ApiDirectoryV25_10_2, type ApiDirectory$4 as ApiDirectoryV25_10_3, type ApiDirectory$3 as ApiDirectoryV25_10_4, type ApiDirectory$2 as ApiDirectoryV25_10_5, type ApiDirectory$1 as ApiDirectoryV26_0_0, type ApiDirectory as ApiDirectoryV27_0_0, type ApiError, type ApiEventDirectory$7 as ApiEventDirectoryV25_10_0, type ApiEventDirectory$6 as ApiEventDirectoryV25_10_1, type ApiEventDirectory$5 as ApiEventDirectoryV25_10_2, type ApiEventDirectory$4 as ApiEventDirectoryV25_10_3, type ApiEventDirectory$3 as ApiEventDirectoryV25_10_4, type ApiEventDirectory$2 as ApiEventDirectoryV25_10_5, type ApiEventDirectory$1 as ApiEventDirectoryV26_0_0, type ApiEventDirectory as ApiEventDirectoryV27_0_0, type ApiJobDirectory$7 as ApiJobDirectoryV25_10_0, type ApiJobDirectory$6 as ApiJobDirectoryV25_10_1, type ApiJobDirectory$5 as ApiJobDirectoryV25_10_2, type ApiJobDirectory$4 as ApiJobDirectoryV25_10_3, type ApiJobDirectory$3 as ApiJobDirectoryV25_10_4, type ApiJobDirectory$2 as ApiJobDirectoryV25_10_5, type ApiJobDirectory$1 as ApiJobDirectoryV26_0_0, type ApiJobDirectory as ApiJobDirectoryV27_0_0, type ApiKeyCreate, type ApiVersion, type ApiVersionResponse, AppState, type ArgsOf, AuthError, AuthErrorCode, type AuthResponse, type BaseApiDirectory, type CallMethod, type CallParams, type CallResponse, type Container, type CreateClientOptions, type DefaultApiDirectory, type EventKind, type EventName, type EventUnion, InvalidVersionResponseError, type Job, type JobMethod, type JobParams, type JobProgress, type JobResult, JobState, type Logger, NoCompatibleVersionsError, type OperationMappings, type QueryDirectory, type QueryEntity, type QueryListOptions, type QueryMethod, type QuerySingleOptions, SUPPORTED_API_VERSIONS, type SupportedApiVersion, TrueNasApiClient, TrueNasApiClientV2510, TrueNasApiClientV26, TrueNasApiClientV27, TrueNasAuthMechanism, type TrueNasDate, VersionCompatibility, VersionDiscovery, VersionDiscoveryError, VersionDiscoveryNetworkError, VersionDiscoveryTimeoutError, VersionEndpointNotFoundError, VersionTooNewError, VersionTooOldError, consoleLogger, createTrueNasClient, getApiErrorMessage, isJobFinished, noopLogger, index$7 as v25_10_0, index$6 as v25_10_1, index$5 as v25_10_2, index$4 as v25_10_3, index$3 as v25_10_4, index$2 as v25_10_5, index$1 as v26_0_0, index as v27_0_0 };
+export { type ApiCallDirectory$7 as ApiCallDirectoryV25_10_0, type ApiCallDirectory$6 as ApiCallDirectoryV25_10_1, type ApiCallDirectory$5 as ApiCallDirectoryV25_10_2, type ApiCallDirectory$4 as ApiCallDirectoryV25_10_3, type ApiCallDirectory$3 as ApiCallDirectoryV25_10_4, type ApiCallDirectory$2 as ApiCallDirectoryV25_10_5, type ApiCallDirectory$1 as ApiCallDirectoryV26_0_0, type ApiCallDirectory as ApiCallDirectoryV27_0_0, type ApiDirectoryByVersion, type ApiDirectoryShape, type ApiDirectory$7 as ApiDirectoryV25_10_0, type ApiDirectory$6 as ApiDirectoryV25_10_1, type ApiDirectory$5 as ApiDirectoryV25_10_2, type ApiDirectory$4 as ApiDirectoryV25_10_3, type ApiDirectory$3 as ApiDirectoryV25_10_4, type ApiDirectory$2 as ApiDirectoryV25_10_5, type ApiDirectory$1 as ApiDirectoryV26_0_0, type ApiDirectory as ApiDirectoryV27_0_0, type ApiError, type ApiEventDirectory$7 as ApiEventDirectoryV25_10_0, type ApiEventDirectory$6 as ApiEventDirectoryV25_10_1, type ApiEventDirectory$5 as ApiEventDirectoryV25_10_2, type ApiEventDirectory$4 as ApiEventDirectoryV25_10_3, type ApiEventDirectory$3 as ApiEventDirectoryV25_10_4, type ApiEventDirectory$2 as ApiEventDirectoryV25_10_5, type ApiEventDirectory$1 as ApiEventDirectoryV26_0_0, type ApiEventDirectory as ApiEventDirectoryV27_0_0, type ApiJobDirectory$7 as ApiJobDirectoryV25_10_0, type ApiJobDirectory$6 as ApiJobDirectoryV25_10_1, type ApiJobDirectory$5 as ApiJobDirectoryV25_10_2, type ApiJobDirectory$4 as ApiJobDirectoryV25_10_3, type ApiJobDirectory$3 as ApiJobDirectoryV25_10_4, type ApiJobDirectory$2 as ApiJobDirectoryV25_10_5, type ApiJobDirectory$1 as ApiJobDirectoryV26_0_0, type ApiJobDirectory as ApiJobDirectoryV27_0_0, type ApiKeyCreate, type ApiVersion, type ApiVersionResponse, AppState, type ApplianceProtocol, type ArgsOf, AuthError, AuthErrorCode, type AuthResponse, type BaseApiDirectory, type CallMethod, type CallParams, type CallResponse, type Container, type CreateClientOptions, type DefaultApiDirectory, type EventKind, type EventName, type EventUnion, InvalidVersionResponseError, type Job, type JobMethod, type JobParams, type JobProgress, type JobResult, JobState, type Logger, NoCompatibleVersionsError, type OperationMappings, type QueryDirectory, type QueryEntity, type QueryListOptions, type QueryMethod, type QuerySingleOptions, SUPPORTED_API_VERSIONS, type SupportedApiVersion, TrueNasApiClient, TrueNasApiClientV2510, TrueNasApiClientV26, TrueNasApiClientV27, TrueNasAuthMechanism, type TrueNasDate, VersionCompatibility, VersionDiscovery, VersionDiscoveryError, VersionDiscoveryNetworkError, VersionDiscoveryTimeoutError, VersionEndpointNotFoundError, VersionTooNewError, VersionTooOldError, consoleLogger, createTrueNasClient, getApiErrorMessage, isJobFinished, noopLogger, index$7 as v25_10_0, index$6 as v25_10_1, index$5 as v25_10_2, index$4 as v25_10_3, index$3 as v25_10_4, index$2 as v25_10_5, index$1 as v26_0_0, index as v27_0_0 };

package/dist/index.d.ts

@@ -12460,6 +12460,16 @@ declare class TrueNasSocket {
     complete(): void;
 }
 
+/**
+ * The scheme used to reach the appliance, in `location.protocol` form.
+ *
+ * Colon included, so a caller served *by the appliance* can pass
+ * `location.protocol` unchanged. That equivalence only holds same-origin: this
+ * value is spliced onto the hostname the client connects to, so a page served
+ * from somewhere else must say what the appliance uses, not what it uses.
+ */
+type ApplianceProtocol = 'http:' | 'https:';
+
 interface ActiveConnection {
     ws: TrueNasSocket;
     hostname: string;
@@ -12482,6 +12492,7 @@ declare class TrueNasConnection {
     readonly retryDelay: number;
     readonly maxRetry: number;
     readonly logger: Logger;
+    readonly protocol: ApplianceProtocol;
     opened: BehaviorSubject<boolean>;
     closed: Subject<void>;
     hostname: BehaviorSubject<string>;
@@ -12544,7 +12555,7 @@ declare class TrueNasConnection {
      * observable which always emits messages from the current socket.
      */
     messages$: Observable<TrueNasMessage>;
-    constructor(initialEnabled: boolean, hostnames: string[], systemUuid: string, websocketPath: string, systemName?: string | undefined, retryDelay?: number, maxRetry?: number, logger?: Logger);
+    constructor(initialEnabled: boolean, hostnames: string[], systemUuid: string, websocketPath: string, systemName?: string | undefined, retryDelay?: number, maxRetry?: number, logger?: Logger, protocol?: ApplianceProtocol);
     /**
      * whether the connection has exhausted its retries — the **cumulative** snapshot, read
      * synchronously. (Formerly `hasConnectionError()`; renamed to disambiguate it from the
@@ -12787,6 +12798,49 @@ declare class TrueNasApi<D extends ApiDirectoryShape = BaseApiDirectory> {
     private initializeJobEventsSubscription;
 }
 
+/**
+ * Response from the /api/versions endpoint
+ * Returns an array of version strings directly
+ * Example: ["v25.10.0", "v25.10.1", "v26.0.0"]
+ */
+type ApiVersionResponse = string[];
+/**
+ * Parsed API version information
+ *
+ * Version format:
+ * - Legacy (v25.x): vYY.MM.PATCH (e.g., v25.10.0 = October 2025, patch 0)
+ * - New (v26+): vYY.MINOR.PATCH (e.g., v26.0.0 = 2026, minor 0, patch 0)
+ *
+ * Note: The second segment has different semantics based on the year:
+ * - Year 25: month (1-12)
+ * - Year 26+: minor version (0-99)
+ */
+interface ApiVersion {
+    /** Full version string (e.g., "v26.0.0") */
+    version: string;
+    /** Two-digit year (e.g., 26 = 2026) */
+    year: number;
+    /**
+     * Second version segment (semantics depend on year):
+     * - For v25.x: month (1-12, e.g., 10 = October)
+     * - For v26+: minor version (0-99)
+     */
+    minor: number;
+    /** Patch version number (e.g., 0, 1, 2) */
+    patch: number;
+    /** WebSocket path for this version (e.g., "/api/v26.0.0") */
+    websocketPath: string;
+}
+/**
+ * Version compatibility status
+ */
+declare enum VersionCompatibility {
+    Compatible = "compatible",
+    TooOld = "too-old",
+    TooNew = "too-new",
+    Invalid = "invalid"
+}
+
 interface ApiKeyCreate {
     id: number;
     key: string;
@@ -12813,6 +12867,24 @@ interface AuthResponse {
     response_type: AuthResponseType;
     username?: string;
     authenticator?: 'LEVEL_1' | 'LEVEL_2' | 'LEVEL_3';
+    /**
+     * A token for re-authenticating without credentials.
+     *
+     * Absent below v26: `AuthRespSuccess` there declares only `response_type`,
+     * `user_info` and `authenticator`. From v26 it is always present and is
+     * `null` when no token was minted — because none was asked for, or because
+     * the session cannot have one. Middleware refuses for a session authenticated
+     * by a one-time *password* (`auth.generate_onetime_password`), which is not
+     * the same thing as 2FA despite this codebase spelling 2FA "OTP" throughout.
+     *
+     * A 2FA account gets `null` for a different reason, and it is this client's
+     * doing rather than the server's: the password request carrying the option is
+     * answered `OTP_REQUIRED` before anything is minted, and `loginWithOtp` does
+     * not send `login_options` on the second step. Middleware would honour it
+     * there — `auth.login_ex_continue` re-enters `login_ex`, and a 2FA session
+     * may hold a token — so this is a gap to close, not a limit to work around.
+     */
+    reconnect_token?: string | null;
     max_session_age?: number;
     max_inactivity?: number;
     urls?: string[];
@@ -12866,6 +12938,7 @@ interface AuthResponse {
  */
 declare class TrueNasAuthenticator {
     private connection;
+    private readonly version?;
     static readonly DefaultSessionLifetime = 300;
     /**
      * whether or not the system is currently authenticated and accessible.
@@ -12885,9 +12958,54 @@ declare class TrueNasAuthenticator {
         key: string;
     };
     sessionLifetime: number;
-    constructor(connection: TrueNasConnection);
+    constructor(connection: TrueNasConnection, version?: ApiVersion | undefined);
+    /**
+     * `login_options` asking for a reconnect token, when the server understands it.
+     *
+     * Omitted below v26. `AuthCommonOptions` is `additionalProperties: false`
+     * there and has only `user_info`, so sending the member is a validation
+     * error, not an ignored field — it would fail login outright on the oldest
+     * version this client supports.
+     */
+    /**
+     * Two things this does not do, both deliberate and both worth knowing.
+     *
+     * There is no way for a consumer to decline: every v26+ password login now
+     * mints a single-use credential carrying that session's roles, whether or not
+     * the caller wants one. And the auto-relogin in the constructor subscribes
+     * with no observer, so the token it mints is dropped — a caller reconnecting
+     * repeatedly holds an ageing token while the appliance mints fresh ones
+     * nobody reads. Tokens are single-use with a 600s TTL, so that is the
+     * reconnect case the feature is named for.
+     */
+    private reconnectTokenOption;
     loginWithUserPass(username: string, password: string): rxjs.Observable<AuthResponse>;
     loginWithOtp(code: string): rxjs.Observable<AuthResponse>;
+    /**
+     * Re-authenticate with a token from a previous login's `reconnect_token`.
+     *
+     * This is what lets a second connection to the same appliance authenticate
+     * without asking the user for a password again — middleware sessions are
+     * per-connection, so a second socket has its own to establish.
+     *
+     * The token is single-use and short-lived. On v26+ a successful login mints
+     * another on the response, so a caller keeping a session alive across
+     * reconnects stores the newest each time; below v26 nothing is minted and
+     * there is no chain to keep.
+     *
+     * Re-login is the caller's to drive. A token session is not covered by the
+     * automatic reconnect this class does for password and api-key sessions,
+     * which is deliberate — the token is single-use — but it means a dropped
+     * socket needs the stored token spending explicitly. Middleware holds tokens
+     * in memory, so a `middlewared` restart voids them, and that is a common
+     * reason the socket dropped in the first place.
+     */
+    loginWithToken(token: string): rxjs.Observable<AuthResponse>;
+    /**
+     * No reconnect token is requested here, though v26+ would mint one: an
+     * api-key session already reconnects without a prompt, since the key is held
+     * and replayed. The token exists for the credential that cannot be.
+     */
     loginWithApiKey(credentials: {
         username: string;
         key: string;
@@ -12896,49 +13014,6 @@ declare class TrueNasAuthenticator {
     logout(): rxjs.Observable<boolean>;
 }
 
-/**
- * Response from the /api/versions endpoint
- * Returns an array of version strings directly
- * Example: ["v25.10.0", "v25.10.1", "v26.0.0"]
- */
-type ApiVersionResponse = string[];
-/**
- * Parsed API version information
- *
- * Version format:
- * - Legacy (v25.x): vYY.MM.PATCH (e.g., v25.10.0 = October 2025, patch 0)
- * - New (v26+): vYY.MINOR.PATCH (e.g., v26.0.0 = 2026, minor 0, patch 0)
- *
- * Note: The second segment has different semantics based on the year:
- * - Year 25: month (1-12)
- * - Year 26+: minor version (0-99)
- */
-interface ApiVersion {
-    /** Full version string (e.g., "v26.0.0") */
-    version: string;
-    /** Two-digit year (e.g., 26 = 2026) */
-    year: number;
-    /**
-     * Second version segment (semantics depend on year):
-     * - For v25.x: month (1-12, e.g., 10 = October)
-     * - For v26+: minor version (0-99)
-     */
-    minor: number;
-    /** Patch version number (e.g., 0, 1, 2) */
-    patch: number;
-    /** WebSocket path for this version (e.g., "/api/v26.0.0") */
-    websocketPath: string;
-}
-/**
- * Version compatibility status
- */
-declare enum VersionCompatibility {
-    Compatible = "compatible",
-    TooOld = "too-old",
-    TooNew = "too-new",
-    Invalid = "invalid"
-}
-
 /**
  * The state `Container.status` is narrowed to.
  *
@@ -13192,7 +13267,8 @@ declare abstract class TrueNasApiClient<D extends ApiDirectoryShape = BaseApiDir
     protected readonly systemName: string | undefined;
     /** Logger forwarded to the connection (defaults to a no-op). */
     protected readonly logger: Logger;
-    constructor(uuid: string, hostnames: string[], version: ApiVersion, enabled: boolean, systemName?: string, logger?: Logger);
+    protected readonly protocol: ApplianceProtocol;
+    constructor(uuid: string, hostnames: string[], version: ApiVersion, enabled: boolean, systemName?: string, logger?: Logger, protocol?: ApplianceProtocol);
     /**
      * Get current connection status.
      * @returns true if WebSocket is connected
@@ -27604,6 +27680,28 @@ interface CreateClientOptions {
      * without the caller asserting it through a type parameter.
      */
     version?: SupportedApiVersion;
+    /**
+     * The scheme to reach the appliance on, in `location.protocol` form.
+     *
+     * Selects both halves of the transport: `https:` gives `https` discovery and
+     * a `wss` socket, `http:` gives `http` and `ws`. Defaults to `https:`, which
+     * is what an appliance serves and what Connect uses.
+     *
+     * This describes the *appliance*, not the page. Passing
+     * `location.protocol` is correct when the appliance serves the page — the
+     * same-origin case this exists for — and wrong otherwise. A page on
+     * `http://localhost:5173` talking to an https appliance gets both halves
+     * wrong, but only one of them says so: `fetch` follows the redirect and
+     * discovery appears to work, while the WebSocket has no such tolerance and
+     * fails the handshake without naming the scheme.
+     *
+     * Omitting it against a plaintext appliance is the quieter failure and the
+     * likelier one, since it is the case this option exists for. Discovery tries
+     * `https`, `fetch` rejects, and that is indistinguishable from the CORS block
+     * v25.10.0 has on `/api/versions` — so the fallback fires and the caller gets
+     * a client pinned to v25.10.0, warned about only in the log.
+     */
+    protocol?: ApplianceProtocol;
 }
 /**
  * Creates a version-specific TrueNAS API client.
@@ -27883,12 +27981,14 @@ declare class TrueNasApiClientV27 extends TrueNasApiClient<ApiDirectory> {
  */
 declare class VersionDiscovery {
     private readonly logger;
+    private readonly protocol;
     private versionCache;
-    constructor(logger?: Logger);
+    constructor(logger?: Logger, protocol?: ApplianceProtocol);
+    private versionsUrl;
     /**
      * Discovers the API version for a given hostname.
      *
-     * Makes a GET request to `https://{hostname}/api/versions` and returns the latest
+     * Makes a GET request to `{protocol}//{hostname}/api/versions` and returns the latest
      * compatible version. Results are cached per hostname; the cache entry is removed
      * on failure so the next call retries.
      *
@@ -28007,6 +28107,7 @@ declare enum AuthErrorCode {
     PasswordAuthFailed = "PASSWORD_AUTH_FAILED",
     OtpAuthFailed = "OTP_AUTH_FAILED",
     ApiKeyAuthFailed = "API_KEY_AUTH_FAILED",
+    TokenAuthFailed = "TOKEN_AUTH_FAILED",
     FullAdminRequired = "FULL_ADMIN_REQUIRED"
 }
 declare class AuthError extends Error {
@@ -28067,4 +28168,4 @@ type ApiError = JsonRpcError | TrueNasError;
  */
 declare function getApiErrorMessage(error: unknown, fallback?: string): string;
 
-export { type ApiCallDirectory$7 as ApiCallDirectoryV25_10_0, type ApiCallDirectory$6 as ApiCallDirectoryV25_10_1, type ApiCallDirectory$5 as ApiCallDirectoryV25_10_2, type ApiCallDirectory$4 as ApiCallDirectoryV25_10_3, type ApiCallDirectory$3 as ApiCallDirectoryV25_10_4, type ApiCallDirectory$2 as ApiCallDirectoryV25_10_5, type ApiCallDirectory$1 as ApiCallDirectoryV26_0_0, type ApiCallDirectory as ApiCallDirectoryV27_0_0, type ApiDirectoryByVersion, type ApiDirectoryShape, type ApiDirectory$7 as ApiDirectoryV25_10_0, type ApiDirectory$6 as ApiDirectoryV25_10_1, type ApiDirectory$5 as ApiDirectoryV25_10_2, type ApiDirectory$4 as ApiDirectoryV25_10_3, type ApiDirectory$3 as ApiDirectoryV25_10_4, type ApiDirectory$2 as ApiDirectoryV25_10_5, type ApiDirectory$1 as ApiDirectoryV26_0_0, type ApiDirectory as ApiDirectoryV27_0_0, type ApiError, type ApiEventDirectory$7 as ApiEventDirectoryV25_10_0, type ApiEventDirectory$6 as ApiEventDirectoryV25_10_1, type ApiEventDirectory$5 as ApiEventDirectoryV25_10_2, type ApiEventDirectory$4 as ApiEventDirectoryV25_10_3, type ApiEventDirectory$3 as ApiEventDirectoryV25_10_4, type ApiEventDirectory$2 as ApiEventDirectoryV25_10_5, type ApiEventDirectory$1 as ApiEventDirectoryV26_0_0, type ApiEventDirectory as ApiEventDirectoryV27_0_0, type ApiJobDirectory$7 as ApiJobDirectoryV25_10_0, type ApiJobDirectory$6 as ApiJobDirectoryV25_10_1, type ApiJobDirectory$5 as ApiJobDirectoryV25_10_2, type ApiJobDirectory$4 as ApiJobDirectoryV25_10_3, type ApiJobDirectory$3 as ApiJobDirectoryV25_10_4, type ApiJobDirectory$2 as ApiJobDirectoryV25_10_5, type ApiJobDirectory$1 as ApiJobDirectoryV26_0_0, type ApiJobDirectory as ApiJobDirectoryV27_0_0, type ApiKeyCreate, type ApiVersion, type ApiVersionResponse, AppState, type ArgsOf, AuthError, AuthErrorCode, type AuthResponse, type BaseApiDirectory, type CallMethod, type CallParams, type CallResponse, type Container, type CreateClientOptions, type DefaultApiDirectory, type EventKind, type EventName, type EventUnion, InvalidVersionResponseError, type Job, type JobMethod, type JobParams, type JobProgress, type JobResult, JobState, type Logger, NoCompatibleVersionsError, type OperationMappings, type QueryDirectory, type QueryEntity, type QueryListOptions, type QueryMethod, type QuerySingleOptions, SUPPORTED_API_VERSIONS, type SupportedApiVersion, TrueNasApiClient, TrueNasApiClientV2510, TrueNasApiClientV26, TrueNasApiClientV27, TrueNasAuthMechanism, type TrueNasDate, VersionCompatibility, VersionDiscovery, VersionDiscoveryError, VersionDiscoveryNetworkError, VersionDiscoveryTimeoutError, VersionEndpointNotFoundError, VersionTooNewError, VersionTooOldError, consoleLogger, createTrueNasClient, getApiErrorMessage, isJobFinished, noopLogger, index$7 as v25_10_0, index$6 as v25_10_1, index$5 as v25_10_2, index$4 as v25_10_3, index$3 as v25_10_4, index$2 as v25_10_5, index$1 as v26_0_0, index as v27_0_0 };
+export { type ApiCallDirectory$7 as ApiCallDirectoryV25_10_0, type ApiCallDirectory$6 as ApiCallDirectoryV25_10_1, type ApiCallDirectory$5 as ApiCallDirectoryV25_10_2, type ApiCallDirectory$4 as ApiCallDirectoryV25_10_3, type ApiCallDirectory$3 as ApiCallDirectoryV25_10_4, type ApiCallDirectory$2 as ApiCallDirectoryV25_10_5, type ApiCallDirectory$1 as ApiCallDirectoryV26_0_0, type ApiCallDirectory as ApiCallDirectoryV27_0_0, type ApiDirectoryByVersion, type ApiDirectoryShape, type ApiDirectory$7 as ApiDirectoryV25_10_0, type ApiDirectory$6 as ApiDirectoryV25_10_1, type ApiDirectory$5 as ApiDirectoryV25_10_2, type ApiDirectory$4 as ApiDirectoryV25_10_3, type ApiDirectory$3 as ApiDirectoryV25_10_4, type ApiDirectory$2 as ApiDirectoryV25_10_5, type ApiDirectory$1 as ApiDirectoryV26_0_0, type ApiDirectory as ApiDirectoryV27_0_0, type ApiError, type ApiEventDirectory$7 as ApiEventDirectoryV25_10_0, type ApiEventDirectory$6 as ApiEventDirectoryV25_10_1, type ApiEventDirectory$5 as ApiEventDirectoryV25_10_2, type ApiEventDirectory$4 as ApiEventDirectoryV25_10_3, type ApiEventDirectory$3 as ApiEventDirectoryV25_10_4, type ApiEventDirectory$2 as ApiEventDirectoryV25_10_5, type ApiEventDirectory$1 as ApiEventDirectoryV26_0_0, type ApiEventDirectory as ApiEventDirectoryV27_0_0, type ApiJobDirectory$7 as ApiJobDirectoryV25_10_0, type ApiJobDirectory$6 as ApiJobDirectoryV25_10_1, type ApiJobDirectory$5 as ApiJobDirectoryV25_10_2, type ApiJobDirectory$4 as ApiJobDirectoryV25_10_3, type ApiJobDirectory$3 as ApiJobDirectoryV25_10_4, type ApiJobDirectory$2 as ApiJobDirectoryV25_10_5, type ApiJobDirectory$1 as ApiJobDirectoryV26_0_0, type ApiJobDirectory as ApiJobDirectoryV27_0_0, type ApiKeyCreate, type ApiVersion, type ApiVersionResponse, AppState, type ApplianceProtocol, type ArgsOf, AuthError, AuthErrorCode, type AuthResponse, type BaseApiDirectory, type CallMethod, type CallParams, type CallResponse, type Container, type CreateClientOptions, type DefaultApiDirectory, type EventKind, type EventName, type EventUnion, InvalidVersionResponseError, type Job, type JobMethod, type JobParams, type JobProgress, type JobResult, JobState, type Logger, NoCompatibleVersionsError, type OperationMappings, type QueryDirectory, type QueryEntity, type QueryListOptions, type QueryMethod, type QuerySingleOptions, SUPPORTED_API_VERSIONS, type SupportedApiVersion, TrueNasApiClient, TrueNasApiClientV2510, TrueNasApiClientV26, TrueNasApiClientV27, TrueNasAuthMechanism, type TrueNasDate, VersionCompatibility, VersionDiscovery, VersionDiscoveryError, VersionDiscoveryNetworkError, VersionDiscoveryTimeoutError, VersionEndpointNotFoundError, VersionTooNewError, VersionTooOldError, consoleLogger, createTrueNasClient, getApiErrorMessage, isJobFinished, noopLogger, index$7 as v25_10_0, index$6 as v25_10_1, index$5 as v25_10_2, index$4 as v25_10_3, index$3 as v25_10_4, index$2 as v25_10_5, index$1 as v26_0_0, index as v27_0_0 };