@truenas/api-client 3.0.4 → 3.0.6

package/dist/index.d.cts

@@ -12798,6 +12798,49 @@ declare class TrueNasApi<D extends ApiDirectoryShape = BaseApiDirectory> {
     private initializeJobEventsSubscription;
 }
 
+/**
+ * Response from the /api/versions endpoint
+ * Returns an array of version strings directly
+ * Example: ["v25.10.0", "v25.10.1", "v26.0.0"]
+ */
+type ApiVersionResponse = string[];
+/**
+ * Parsed API version information
+ *
+ * Version format:
+ * - Legacy (v25.x): vYY.MM.PATCH (e.g., v25.10.0 = October 2025, patch 0)
+ * - New (v26+): vYY.MINOR.PATCH (e.g., v26.0.0 = 2026, minor 0, patch 0)
+ *
+ * Note: The second segment has different semantics based on the year:
+ * - Year 25: month (1-12)
+ * - Year 26+: minor version (0-99)
+ */
+interface ApiVersion {
+    /** Full version string (e.g., "v26.0.0") */
+    version: string;
+    /** Two-digit year (e.g., 26 = 2026) */
+    year: number;
+    /**
+     * Second version segment (semantics depend on year):
+     * - For v25.x: month (1-12, e.g., 10 = October)
+     * - For v26+: minor version (0-99)
+     */
+    minor: number;
+    /** Patch version number (e.g., 0, 1, 2) */
+    patch: number;
+    /** WebSocket path for this version (e.g., "/api/v26.0.0") */
+    websocketPath: string;
+}
+/**
+ * Version compatibility status
+ */
+declare enum VersionCompatibility {
+    Compatible = "compatible",
+    TooOld = "too-old",
+    TooNew = "too-new",
+    Invalid = "invalid"
+}
+
 interface ApiKeyCreate {
     id: number;
     key: string;
@@ -12808,6 +12851,20 @@ interface ApiKeyCreate {
 declare enum UserRole {
     FullAdmin = "FULL_ADMIN"
 }
+/**
+ * A role as middleware reports it.
+ *
+ * `UserRole` names only the role this client itself had a use for. Middleware
+ * defines many more — `SHARING_ADMIN`, `READONLY_ADMIN` and so on — and this
+ * client does not enumerate them, because it no longer makes any decision from
+ * a role and would only be maintaining a second copy of someone else's list.
+ *
+ * Widened to `string` so a consumer can compare against the roles it cares
+ * about without a cast, while `UserRole` still autocompletes. Consumers are
+ * where role policy lives now, so the type they are handed has to admit the
+ * roles they will actually test for.
+ */
+type UserRoleName = UserRole | (string & {});
 
 interface UserPreferences {
     language: string;
@@ -12824,6 +12881,24 @@ interface AuthResponse {
     response_type: AuthResponseType;
     username?: string;
     authenticator?: 'LEVEL_1' | 'LEVEL_2' | 'LEVEL_3';
+    /**
+     * A token for re-authenticating without credentials.
+     *
+     * Absent below v26: `AuthRespSuccess` there declares only `response_type`,
+     * `user_info` and `authenticator`. From v26 it is always present and is
+     * `null` when no token was minted — because none was asked for, or because
+     * the session cannot have one. Middleware refuses for a session authenticated
+     * by a one-time *password* (`auth.generate_onetime_password`), which is not
+     * the same thing as 2FA despite this codebase spelling 2FA "OTP" throughout.
+     *
+     * A 2FA account gets `null` for a different reason, and it is this client's
+     * doing rather than the server's: the password request carrying the option is
+     * answered `OTP_REQUIRED` before anything is minted, and `loginWithOtp` does
+     * not send `login_options` on the second step. Middleware would honour it
+     * there — `auth.login_ex_continue` re-enters `login_ex`, and a 2FA session
+     * may hold a token — so this is a gap to close, not a limit to work around.
+     */
+    reconnect_token?: string | null;
     max_session_age?: number;
     max_inactivity?: number;
     urls?: string[];
@@ -12835,7 +12910,7 @@ interface AuthResponse {
         groups: number[];
         privilege: {
             roles: {
-                $set: UserRole[];
+                $set: UserRoleName[];
             };
         };
         two_factor_auth_configured: boolean;
@@ -12874,9 +12949,17 @@ interface AuthResponse {
  * TrueNAS authenticator using the JSON-RPC 2.0 protocol.
  *
  * It handles authentication using the JSON-RPC 2.0 message format.
+ *
+ * Authentication only: any credential middleware accepts logs in here, whatever
+ * roles it carries. No path checks privilege, and that is the design — the
+ * appliance authorizes every privileged call on its own, and which roles a given
+ * product requires is that product's policy, not this client's. Consumers who
+ * need one read `user_info.privilege.roles` off the response and enforce it
+ * themselves; embedding a rule here would impose it on every consumer at once.
  */
 declare class TrueNasAuthenticator {
     private connection;
+    private readonly version?;
     static readonly DefaultSessionLifetime = 300;
     /**
      * whether or not the system is currently authenticated and accessible.
@@ -12896,9 +12979,94 @@ declare class TrueNasAuthenticator {
         key: string;
     };
     sessionLifetime: number;
-    constructor(connection: TrueNasConnection);
+    /**
+     * Claimed by each login when it sends and checked when its answer lands: a
+     * difference means another login or a logout was issued in between, so this
+     * answer is stale and must not write session state. Responses on one socket
+     * are not ordered, which is why arrival is not enough to make an answer
+     * current.
+     *
+     * `logout()` bumps it without claiming one. It has no answer to guard —
+     * it settles its own state at the call — and bumping is what invalidates the
+     * logins already on the wire that a logout is meant to override.
+     */
+    private authEpoch;
+    /**
+     * Caller-issued logins still awaiting an answer, keyed by the epoch each
+     * claimed. The value is whether its frame has been written to a socket yet.
+     *
+     * The auto-relogin below defers while any entry exists. It is this class
+     * retrying a cached credential, not a request anyone made, so it must never
+     * outrank an explicit login — and it would: `TrueNasConnection.send` holds a
+     * frame through an outage rather than dropping it, so a login submitted while
+     * the socket is down is still pending when `opened` fires, and a relogin
+     * claiming the newer epoch has that login answered `LoginSuperseded` while the
+     * client authenticates as the previously cached account.
+     *
+     * Keyed rather than counted, because a count cannot say *which* login a
+     * removal belongs to: a login torn down by its caller would retire a slot
+     * belonging to a different login that is still waiting, and the retry would
+     * overtake it again. Identity also makes a double-subscribed login harmless.
+     */
+    private liveCallerLogins;
+    /** True only while the constructor's relogin is being constructed. */
+    private reloginInProgress;
+    constructor(connection: TrueNasConnection, version?: ApiVersion | undefined);
+    /**
+     * `login_options` asking for a reconnect token, when the server understands it.
+     *
+     * Omitted below v26. `AuthCommonOptions` is `additionalProperties: false`
+     * there and has only `user_info`, so sending the member is a validation
+     * error, not an ignored field — it would fail login outright on the oldest
+     * version this client supports.
+     */
+    /**
+     * Two things this does not do, both deliberate and both worth knowing.
+     *
+     * There is no way for a consumer to decline: every v26+ password login now
+     * mints a single-use credential carrying that session's roles, whether or not
+     * the caller wants one. And the auto-relogin in the constructor subscribes
+     * with no observer, so the token it mints is dropped — a caller reconnecting
+     * repeatedly holds an ageing token while the appliance mints fresh ones
+     * nobody reads. Tokens are single-use with a 600s TTL, so that is the
+     * reconnect case the feature is named for.
+     */
+    private reconnectTokenOption;
+    /**
+     * Throws when another login or a logout was issued after this one was sent,
+     * so a stale answer cannot be reported to its caller as a successful login.
+     */
+    private assertNotSuperseded;
+    /** Claim the next epoch for a login, and record it if a caller asked for it. */
+    private beginLogin;
+    private endLogin;
     loginWithUserPass(username: string, password: string): rxjs.Observable<AuthResponse>;
     loginWithOtp(code: string): rxjs.Observable<AuthResponse>;
+    /**
+     * Re-authenticate with a token from a previous login's `reconnect_token`.
+     *
+     * This is what lets a second connection to the same appliance authenticate
+     * without asking the user for a password again — middleware sessions are
+     * per-connection, so a second socket has its own to establish.
+     *
+     * The token is single-use and short-lived. On v26+ a successful login mints
+     * another on the response, so a caller keeping a session alive across
+     * reconnects stores the newest each time; below v26 nothing is minted and
+     * there is no chain to keep.
+     *
+     * Re-login is the caller's to drive. A token session is not covered by the
+     * automatic reconnect this class does for password and api-key sessions,
+     * which is deliberate — the token is single-use — but it means a dropped
+     * socket needs the stored token spending explicitly. Middleware holds tokens
+     * in memory, so a `middlewared` restart voids them, and that is a common
+     * reason the socket dropped in the first place.
+     */
+    loginWithToken(token: string): rxjs.Observable<AuthResponse>;
+    /**
+     * No reconnect token is requested here, though v26+ would mint one: an
+     * api-key session already reconnects without a prompt, since the key is held
+     * and replayed. The token exists for the credential that cannot be.
+     */
     loginWithApiKey(credentials: {
         username: string;
         key: string;
@@ -12907,49 +13075,6 @@ declare class TrueNasAuthenticator {
     logout(): rxjs.Observable<boolean>;
 }
 
-/**
- * Response from the /api/versions endpoint
- * Returns an array of version strings directly
- * Example: ["v25.10.0", "v25.10.1", "v26.0.0"]
- */
-type ApiVersionResponse = string[];
-/**
- * Parsed API version information
- *
- * Version format:
- * - Legacy (v25.x): vYY.MM.PATCH (e.g., v25.10.0 = October 2025, patch 0)
- * - New (v26+): vYY.MINOR.PATCH (e.g., v26.0.0 = 2026, minor 0, patch 0)
- *
- * Note: The second segment has different semantics based on the year:
- * - Year 25: month (1-12)
- * - Year 26+: minor version (0-99)
- */
-interface ApiVersion {
-    /** Full version string (e.g., "v26.0.0") */
-    version: string;
-    /** Two-digit year (e.g., 26 = 2026) */
-    year: number;
-    /**
-     * Second version segment (semantics depend on year):
-     * - For v25.x: month (1-12, e.g., 10 = October)
-     * - For v26+: minor version (0-99)
-     */
-    minor: number;
-    /** Patch version number (e.g., 0, 1, 2) */
-    patch: number;
-    /** WebSocket path for this version (e.g., "/api/v26.0.0") */
-    websocketPath: string;
-}
-/**
- * Version compatibility status
- */
-declare enum VersionCompatibility {
-    Compatible = "compatible",
-    TooOld = "too-old",
-    TooNew = "too-new",
-    Invalid = "invalid"
-}
-
 /**
  * The state `Container.status` is narrowed to.
  *
@@ -28043,6 +28168,19 @@ declare enum AuthErrorCode {
     PasswordAuthFailed = "PASSWORD_AUTH_FAILED",
     OtpAuthFailed = "OTP_AUTH_FAILED",
     ApiKeyAuthFailed = "API_KEY_AUTH_FAILED",
+    TokenAuthFailed = "TOKEN_AUTH_FAILED",
+    /**
+     * A login was overtaken by a logout, or by a later login, while its response
+     * was in flight. The server may well have accepted it; this client discarded
+     * the result rather than authenticate a session the caller had moved on from.
+     */
+    LoginSuperseded = "LOGIN_SUPERSEDED",
+    /**
+     * @deprecated Nothing throws this. The authenticator no longer refuses a
+     * login for want of a role — see `TrueNasAuthenticator`. Kept so consumers
+     * still narrowing on the code keep compiling; removing it would be a breaking
+     * change for a member that can no longer occur.
+     */
     FullAdminRequired = "FULL_ADMIN_REQUIRED"
 }
 declare class AuthError extends Error {
@@ -28103,4 +28241,4 @@ type ApiError = JsonRpcError | TrueNasError;
  */
 declare function getApiErrorMessage(error: unknown, fallback?: string): string;
 
-export { type ApiCallDirectory$7 as ApiCallDirectoryV25_10_0, type ApiCallDirectory$6 as ApiCallDirectoryV25_10_1, type ApiCallDirectory$5 as ApiCallDirectoryV25_10_2, type ApiCallDirectory$4 as ApiCallDirectoryV25_10_3, type ApiCallDirectory$3 as ApiCallDirectoryV25_10_4, type ApiCallDirectory$2 as ApiCallDirectoryV25_10_5, type ApiCallDirectory$1 as ApiCallDirectoryV26_0_0, type ApiCallDirectory as ApiCallDirectoryV27_0_0, type ApiDirectoryByVersion, type ApiDirectoryShape, type ApiDirectory$7 as ApiDirectoryV25_10_0, type ApiDirectory$6 as ApiDirectoryV25_10_1, type ApiDirectory$5 as ApiDirectoryV25_10_2, type ApiDirectory$4 as ApiDirectoryV25_10_3, type ApiDirectory$3 as ApiDirectoryV25_10_4, type ApiDirectory$2 as ApiDirectoryV25_10_5, type ApiDirectory$1 as ApiDirectoryV26_0_0, type ApiDirectory as ApiDirectoryV27_0_0, type ApiError, type ApiEventDirectory$7 as ApiEventDirectoryV25_10_0, type ApiEventDirectory$6 as ApiEventDirectoryV25_10_1, type ApiEventDirectory$5 as ApiEventDirectoryV25_10_2, type ApiEventDirectory$4 as ApiEventDirectoryV25_10_3, type ApiEventDirectory$3 as ApiEventDirectoryV25_10_4, type ApiEventDirectory$2 as ApiEventDirectoryV25_10_5, type ApiEventDirectory$1 as ApiEventDirectoryV26_0_0, type ApiEventDirectory as ApiEventDirectoryV27_0_0, type ApiJobDirectory$7 as ApiJobDirectoryV25_10_0, type ApiJobDirectory$6 as ApiJobDirectoryV25_10_1, type ApiJobDirectory$5 as ApiJobDirectoryV25_10_2, type ApiJobDirectory$4 as ApiJobDirectoryV25_10_3, type ApiJobDirectory$3 as ApiJobDirectoryV25_10_4, type ApiJobDirectory$2 as ApiJobDirectoryV25_10_5, type ApiJobDirectory$1 as ApiJobDirectoryV26_0_0, type ApiJobDirectory as ApiJobDirectoryV27_0_0, type ApiKeyCreate, type ApiVersion, type ApiVersionResponse, AppState, type ApplianceProtocol, type ArgsOf, AuthError, AuthErrorCode, type AuthResponse, type BaseApiDirectory, type CallMethod, type CallParams, type CallResponse, type Container, type CreateClientOptions, type DefaultApiDirectory, type EventKind, type EventName, type EventUnion, InvalidVersionResponseError, type Job, type JobMethod, type JobParams, type JobProgress, type JobResult, JobState, type Logger, NoCompatibleVersionsError, type OperationMappings, type QueryDirectory, type QueryEntity, type QueryListOptions, type QueryMethod, type QuerySingleOptions, SUPPORTED_API_VERSIONS, type SupportedApiVersion, TrueNasApiClient, TrueNasApiClientV2510, TrueNasApiClientV26, TrueNasApiClientV27, TrueNasAuthMechanism, type TrueNasDate, VersionCompatibility, VersionDiscovery, VersionDiscoveryError, VersionDiscoveryNetworkError, VersionDiscoveryTimeoutError, VersionEndpointNotFoundError, VersionTooNewError, VersionTooOldError, consoleLogger, createTrueNasClient, getApiErrorMessage, isJobFinished, noopLogger, index$7 as v25_10_0, index$6 as v25_10_1, index$5 as v25_10_2, index$4 as v25_10_3, index$3 as v25_10_4, index$2 as v25_10_5, index$1 as v26_0_0, index as v27_0_0 };
+export { type ApiCallDirectory$7 as ApiCallDirectoryV25_10_0, type ApiCallDirectory$6 as ApiCallDirectoryV25_10_1, type ApiCallDirectory$5 as ApiCallDirectoryV25_10_2, type ApiCallDirectory$4 as ApiCallDirectoryV25_10_3, type ApiCallDirectory$3 as ApiCallDirectoryV25_10_4, type ApiCallDirectory$2 as ApiCallDirectoryV25_10_5, type ApiCallDirectory$1 as ApiCallDirectoryV26_0_0, type ApiCallDirectory as ApiCallDirectoryV27_0_0, type ApiDirectoryByVersion, type ApiDirectoryShape, type ApiDirectory$7 as ApiDirectoryV25_10_0, type ApiDirectory$6 as ApiDirectoryV25_10_1, type ApiDirectory$5 as ApiDirectoryV25_10_2, type ApiDirectory$4 as ApiDirectoryV25_10_3, type ApiDirectory$3 as ApiDirectoryV25_10_4, type ApiDirectory$2 as ApiDirectoryV25_10_5, type ApiDirectory$1 as ApiDirectoryV26_0_0, type ApiDirectory as ApiDirectoryV27_0_0, type ApiError, type ApiEventDirectory$7 as ApiEventDirectoryV25_10_0, type ApiEventDirectory$6 as ApiEventDirectoryV25_10_1, type ApiEventDirectory$5 as ApiEventDirectoryV25_10_2, type ApiEventDirectory$4 as ApiEventDirectoryV25_10_3, type ApiEventDirectory$3 as ApiEventDirectoryV25_10_4, type ApiEventDirectory$2 as ApiEventDirectoryV25_10_5, type ApiEventDirectory$1 as ApiEventDirectoryV26_0_0, type ApiEventDirectory as ApiEventDirectoryV27_0_0, type ApiJobDirectory$7 as ApiJobDirectoryV25_10_0, type ApiJobDirectory$6 as ApiJobDirectoryV25_10_1, type ApiJobDirectory$5 as ApiJobDirectoryV25_10_2, type ApiJobDirectory$4 as ApiJobDirectoryV25_10_3, type ApiJobDirectory$3 as ApiJobDirectoryV25_10_4, type ApiJobDirectory$2 as ApiJobDirectoryV25_10_5, type ApiJobDirectory$1 as ApiJobDirectoryV26_0_0, type ApiJobDirectory as ApiJobDirectoryV27_0_0, type ApiKeyCreate, type ApiVersion, type ApiVersionResponse, AppState, type ApplianceProtocol, type ArgsOf, AuthError, AuthErrorCode, type AuthResponse, type BaseApiDirectory, type CallMethod, type CallParams, type CallResponse, type Container, type CreateClientOptions, type DefaultApiDirectory, type EventKind, type EventName, type EventUnion, InvalidVersionResponseError, type Job, type JobMethod, type JobParams, type JobProgress, type JobResult, JobState, type Logger, NoCompatibleVersionsError, type OperationMappings, type QueryDirectory, type QueryEntity, type QueryListOptions, type QueryMethod, type QuerySingleOptions, SUPPORTED_API_VERSIONS, type SupportedApiVersion, TrueNasApiClient, TrueNasApiClientV2510, TrueNasApiClientV26, TrueNasApiClientV27, TrueNasAuthMechanism, type TrueNasDate, UserRole, type UserRoleName, VersionCompatibility, VersionDiscovery, VersionDiscoveryError, VersionDiscoveryNetworkError, VersionDiscoveryTimeoutError, VersionEndpointNotFoundError, VersionTooNewError, VersionTooOldError, consoleLogger, createTrueNasClient, getApiErrorMessage, isJobFinished, noopLogger, index$7 as v25_10_0, index$6 as v25_10_1, index$5 as v25_10_2, index$4 as v25_10_3, index$3 as v25_10_4, index$2 as v25_10_5, index$1 as v26_0_0, index as v27_0_0 };

package/dist/index.d.ts

@@ -12798,6 +12798,49 @@ declare class TrueNasApi<D extends ApiDirectoryShape = BaseApiDirectory> {
     private initializeJobEventsSubscription;
 }
 
+/**
+ * Response from the /api/versions endpoint
+ * Returns an array of version strings directly
+ * Example: ["v25.10.0", "v25.10.1", "v26.0.0"]
+ */
+type ApiVersionResponse = string[];
+/**
+ * Parsed API version information
+ *
+ * Version format:
+ * - Legacy (v25.x): vYY.MM.PATCH (e.g., v25.10.0 = October 2025, patch 0)
+ * - New (v26+): vYY.MINOR.PATCH (e.g., v26.0.0 = 2026, minor 0, patch 0)
+ *
+ * Note: The second segment has different semantics based on the year:
+ * - Year 25: month (1-12)
+ * - Year 26+: minor version (0-99)
+ */
+interface ApiVersion {
+    /** Full version string (e.g., "v26.0.0") */
+    version: string;
+    /** Two-digit year (e.g., 26 = 2026) */
+    year: number;
+    /**
+     * Second version segment (semantics depend on year):
+     * - For v25.x: month (1-12, e.g., 10 = October)
+     * - For v26+: minor version (0-99)
+     */
+    minor: number;
+    /** Patch version number (e.g., 0, 1, 2) */
+    patch: number;
+    /** WebSocket path for this version (e.g., "/api/v26.0.0") */
+    websocketPath: string;
+}
+/**
+ * Version compatibility status
+ */
+declare enum VersionCompatibility {
+    Compatible = "compatible",
+    TooOld = "too-old",
+    TooNew = "too-new",
+    Invalid = "invalid"
+}
+
 interface ApiKeyCreate {
     id: number;
     key: string;
@@ -12808,6 +12851,20 @@ interface ApiKeyCreate {
 declare enum UserRole {
     FullAdmin = "FULL_ADMIN"
 }
+/**
+ * A role as middleware reports it.
+ *
+ * `UserRole` names only the role this client itself had a use for. Middleware
+ * defines many more — `SHARING_ADMIN`, `READONLY_ADMIN` and so on — and this
+ * client does not enumerate them, because it no longer makes any decision from
+ * a role and would only be maintaining a second copy of someone else's list.
+ *
+ * Widened to `string` so a consumer can compare against the roles it cares
+ * about without a cast, while `UserRole` still autocompletes. Consumers are
+ * where role policy lives now, so the type they are handed has to admit the
+ * roles they will actually test for.
+ */
+type UserRoleName = UserRole | (string & {});
 
 interface UserPreferences {
     language: string;
@@ -12824,6 +12881,24 @@ interface AuthResponse {
     response_type: AuthResponseType;
     username?: string;
     authenticator?: 'LEVEL_1' | 'LEVEL_2' | 'LEVEL_3';
+    /**
+     * A token for re-authenticating without credentials.
+     *
+     * Absent below v26: `AuthRespSuccess` there declares only `response_type`,
+     * `user_info` and `authenticator`. From v26 it is always present and is
+     * `null` when no token was minted — because none was asked for, or because
+     * the session cannot have one. Middleware refuses for a session authenticated
+     * by a one-time *password* (`auth.generate_onetime_password`), which is not
+     * the same thing as 2FA despite this codebase spelling 2FA "OTP" throughout.
+     *
+     * A 2FA account gets `null` for a different reason, and it is this client's
+     * doing rather than the server's: the password request carrying the option is
+     * answered `OTP_REQUIRED` before anything is minted, and `loginWithOtp` does
+     * not send `login_options` on the second step. Middleware would honour it
+     * there — `auth.login_ex_continue` re-enters `login_ex`, and a 2FA session
+     * may hold a token — so this is a gap to close, not a limit to work around.
+     */
+    reconnect_token?: string | null;
     max_session_age?: number;
     max_inactivity?: number;
     urls?: string[];
@@ -12835,7 +12910,7 @@ interface AuthResponse {
         groups: number[];
         privilege: {
             roles: {
-                $set: UserRole[];
+                $set: UserRoleName[];
             };
         };
         two_factor_auth_configured: boolean;
@@ -12874,9 +12949,17 @@ interface AuthResponse {
  * TrueNAS authenticator using the JSON-RPC 2.0 protocol.
  *
  * It handles authentication using the JSON-RPC 2.0 message format.
+ *
+ * Authentication only: any credential middleware accepts logs in here, whatever
+ * roles it carries. No path checks privilege, and that is the design — the
+ * appliance authorizes every privileged call on its own, and which roles a given
+ * product requires is that product's policy, not this client's. Consumers who
+ * need one read `user_info.privilege.roles` off the response and enforce it
+ * themselves; embedding a rule here would impose it on every consumer at once.
  */
 declare class TrueNasAuthenticator {
     private connection;
+    private readonly version?;
     static readonly DefaultSessionLifetime = 300;
     /**
      * whether or not the system is currently authenticated and accessible.
@@ -12896,9 +12979,94 @@ declare class TrueNasAuthenticator {
         key: string;
     };
     sessionLifetime: number;
-    constructor(connection: TrueNasConnection);
+    /**
+     * Claimed by each login when it sends and checked when its answer lands: a
+     * difference means another login or a logout was issued in between, so this
+     * answer is stale and must not write session state. Responses on one socket
+     * are not ordered, which is why arrival is not enough to make an answer
+     * current.
+     *
+     * `logout()` bumps it without claiming one. It has no answer to guard —
+     * it settles its own state at the call — and bumping is what invalidates the
+     * logins already on the wire that a logout is meant to override.
+     */
+    private authEpoch;
+    /**
+     * Caller-issued logins still awaiting an answer, keyed by the epoch each
+     * claimed. The value is whether its frame has been written to a socket yet.
+     *
+     * The auto-relogin below defers while any entry exists. It is this class
+     * retrying a cached credential, not a request anyone made, so it must never
+     * outrank an explicit login — and it would: `TrueNasConnection.send` holds a
+     * frame through an outage rather than dropping it, so a login submitted while
+     * the socket is down is still pending when `opened` fires, and a relogin
+     * claiming the newer epoch has that login answered `LoginSuperseded` while the
+     * client authenticates as the previously cached account.
+     *
+     * Keyed rather than counted, because a count cannot say *which* login a
+     * removal belongs to: a login torn down by its caller would retire a slot
+     * belonging to a different login that is still waiting, and the retry would
+     * overtake it again. Identity also makes a double-subscribed login harmless.
+     */
+    private liveCallerLogins;
+    /** True only while the constructor's relogin is being constructed. */
+    private reloginInProgress;
+    constructor(connection: TrueNasConnection, version?: ApiVersion | undefined);
+    /**
+     * `login_options` asking for a reconnect token, when the server understands it.
+     *
+     * Omitted below v26. `AuthCommonOptions` is `additionalProperties: false`
+     * there and has only `user_info`, so sending the member is a validation
+     * error, not an ignored field — it would fail login outright on the oldest
+     * version this client supports.
+     */
+    /**
+     * Two things this does not do, both deliberate and both worth knowing.
+     *
+     * There is no way for a consumer to decline: every v26+ password login now
+     * mints a single-use credential carrying that session's roles, whether or not
+     * the caller wants one. And the auto-relogin in the constructor subscribes
+     * with no observer, so the token it mints is dropped — a caller reconnecting
+     * repeatedly holds an ageing token while the appliance mints fresh ones
+     * nobody reads. Tokens are single-use with a 600s TTL, so that is the
+     * reconnect case the feature is named for.
+     */
+    private reconnectTokenOption;
+    /**
+     * Throws when another login or a logout was issued after this one was sent,
+     * so a stale answer cannot be reported to its caller as a successful login.
+     */
+    private assertNotSuperseded;
+    /** Claim the next epoch for a login, and record it if a caller asked for it. */
+    private beginLogin;
+    private endLogin;
     loginWithUserPass(username: string, password: string): rxjs.Observable<AuthResponse>;
     loginWithOtp(code: string): rxjs.Observable<AuthResponse>;
+    /**
+     * Re-authenticate with a token from a previous login's `reconnect_token`.
+     *
+     * This is what lets a second connection to the same appliance authenticate
+     * without asking the user for a password again — middleware sessions are
+     * per-connection, so a second socket has its own to establish.
+     *
+     * The token is single-use and short-lived. On v26+ a successful login mints
+     * another on the response, so a caller keeping a session alive across
+     * reconnects stores the newest each time; below v26 nothing is minted and
+     * there is no chain to keep.
+     *
+     * Re-login is the caller's to drive. A token session is not covered by the
+     * automatic reconnect this class does for password and api-key sessions,
+     * which is deliberate — the token is single-use — but it means a dropped
+     * socket needs the stored token spending explicitly. Middleware holds tokens
+     * in memory, so a `middlewared` restart voids them, and that is a common
+     * reason the socket dropped in the first place.
+     */
+    loginWithToken(token: string): rxjs.Observable<AuthResponse>;
+    /**
+     * No reconnect token is requested here, though v26+ would mint one: an
+     * api-key session already reconnects without a prompt, since the key is held
+     * and replayed. The token exists for the credential that cannot be.
+     */
     loginWithApiKey(credentials: {
         username: string;
         key: string;
@@ -12907,49 +13075,6 @@ declare class TrueNasAuthenticator {
     logout(): rxjs.Observable<boolean>;
 }
 
-/**
- * Response from the /api/versions endpoint
- * Returns an array of version strings directly
- * Example: ["v25.10.0", "v25.10.1", "v26.0.0"]
- */
-type ApiVersionResponse = string[];
-/**
- * Parsed API version information
- *
- * Version format:
- * - Legacy (v25.x): vYY.MM.PATCH (e.g., v25.10.0 = October 2025, patch 0)
- * - New (v26+): vYY.MINOR.PATCH (e.g., v26.0.0 = 2026, minor 0, patch 0)
- *
- * Note: The second segment has different semantics based on the year:
- * - Year 25: month (1-12)
- * - Year 26+: minor version (0-99)
- */
-interface ApiVersion {
-    /** Full version string (e.g., "v26.0.0") */
-    version: string;
-    /** Two-digit year (e.g., 26 = 2026) */
-    year: number;
-    /**
-     * Second version segment (semantics depend on year):
-     * - For v25.x: month (1-12, e.g., 10 = October)
-     * - For v26+: minor version (0-99)
-     */
-    minor: number;
-    /** Patch version number (e.g., 0, 1, 2) */
-    patch: number;
-    /** WebSocket path for this version (e.g., "/api/v26.0.0") */
-    websocketPath: string;
-}
-/**
- * Version compatibility status
- */
-declare enum VersionCompatibility {
-    Compatible = "compatible",
-    TooOld = "too-old",
-    TooNew = "too-new",
-    Invalid = "invalid"
-}
-
 /**
  * The state `Container.status` is narrowed to.
  *
@@ -28043,6 +28168,19 @@ declare enum AuthErrorCode {
     PasswordAuthFailed = "PASSWORD_AUTH_FAILED",
     OtpAuthFailed = "OTP_AUTH_FAILED",
     ApiKeyAuthFailed = "API_KEY_AUTH_FAILED",
+    TokenAuthFailed = "TOKEN_AUTH_FAILED",
+    /**
+     * A login was overtaken by a logout, or by a later login, while its response
+     * was in flight. The server may well have accepted it; this client discarded
+     * the result rather than authenticate a session the caller had moved on from.
+     */
+    LoginSuperseded = "LOGIN_SUPERSEDED",
+    /**
+     * @deprecated Nothing throws this. The authenticator no longer refuses a
+     * login for want of a role — see `TrueNasAuthenticator`. Kept so consumers
+     * still narrowing on the code keep compiling; removing it would be a breaking
+     * change for a member that can no longer occur.
+     */
     FullAdminRequired = "FULL_ADMIN_REQUIRED"
 }
 declare class AuthError extends Error {
@@ -28103,4 +28241,4 @@ type ApiError = JsonRpcError | TrueNasError;
  */
 declare function getApiErrorMessage(error: unknown, fallback?: string): string;
 
-export { type ApiCallDirectory$7 as ApiCallDirectoryV25_10_0, type ApiCallDirectory$6 as ApiCallDirectoryV25_10_1, type ApiCallDirectory$5 as ApiCallDirectoryV25_10_2, type ApiCallDirectory$4 as ApiCallDirectoryV25_10_3, type ApiCallDirectory$3 as ApiCallDirectoryV25_10_4, type ApiCallDirectory$2 as ApiCallDirectoryV25_10_5, type ApiCallDirectory$1 as ApiCallDirectoryV26_0_0, type ApiCallDirectory as ApiCallDirectoryV27_0_0, type ApiDirectoryByVersion, type ApiDirectoryShape, type ApiDirectory$7 as ApiDirectoryV25_10_0, type ApiDirectory$6 as ApiDirectoryV25_10_1, type ApiDirectory$5 as ApiDirectoryV25_10_2, type ApiDirectory$4 as ApiDirectoryV25_10_3, type ApiDirectory$3 as ApiDirectoryV25_10_4, type ApiDirectory$2 as ApiDirectoryV25_10_5, type ApiDirectory$1 as ApiDirectoryV26_0_0, type ApiDirectory as ApiDirectoryV27_0_0, type ApiError, type ApiEventDirectory$7 as ApiEventDirectoryV25_10_0, type ApiEventDirectory$6 as ApiEventDirectoryV25_10_1, type ApiEventDirectory$5 as ApiEventDirectoryV25_10_2, type ApiEventDirectory$4 as ApiEventDirectoryV25_10_3, type ApiEventDirectory$3 as ApiEventDirectoryV25_10_4, type ApiEventDirectory$2 as ApiEventDirectoryV25_10_5, type ApiEventDirectory$1 as ApiEventDirectoryV26_0_0, type ApiEventDirectory as ApiEventDirectoryV27_0_0, type ApiJobDirectory$7 as ApiJobDirectoryV25_10_0, type ApiJobDirectory$6 as ApiJobDirectoryV25_10_1, type ApiJobDirectory$5 as ApiJobDirectoryV25_10_2, type ApiJobDirectory$4 as ApiJobDirectoryV25_10_3, type ApiJobDirectory$3 as ApiJobDirectoryV25_10_4, type ApiJobDirectory$2 as ApiJobDirectoryV25_10_5, type ApiJobDirectory$1 as ApiJobDirectoryV26_0_0, type ApiJobDirectory as ApiJobDirectoryV27_0_0, type ApiKeyCreate, type ApiVersion, type ApiVersionResponse, AppState, type ApplianceProtocol, type ArgsOf, AuthError, AuthErrorCode, type AuthResponse, type BaseApiDirectory, type CallMethod, type CallParams, type CallResponse, type Container, type CreateClientOptions, type DefaultApiDirectory, type EventKind, type EventName, type EventUnion, InvalidVersionResponseError, type Job, type JobMethod, type JobParams, type JobProgress, type JobResult, JobState, type Logger, NoCompatibleVersionsError, type OperationMappings, type QueryDirectory, type QueryEntity, type QueryListOptions, type QueryMethod, type QuerySingleOptions, SUPPORTED_API_VERSIONS, type SupportedApiVersion, TrueNasApiClient, TrueNasApiClientV2510, TrueNasApiClientV26, TrueNasApiClientV27, TrueNasAuthMechanism, type TrueNasDate, VersionCompatibility, VersionDiscovery, VersionDiscoveryError, VersionDiscoveryNetworkError, VersionDiscoveryTimeoutError, VersionEndpointNotFoundError, VersionTooNewError, VersionTooOldError, consoleLogger, createTrueNasClient, getApiErrorMessage, isJobFinished, noopLogger, index$7 as v25_10_0, index$6 as v25_10_1, index$5 as v25_10_2, index$4 as v25_10_3, index$3 as v25_10_4, index$2 as v25_10_5, index$1 as v26_0_0, index as v27_0_0 };
+export { type ApiCallDirectory$7 as ApiCallDirectoryV25_10_0, type ApiCallDirectory$6 as ApiCallDirectoryV25_10_1, type ApiCallDirectory$5 as ApiCallDirectoryV25_10_2, type ApiCallDirectory$4 as ApiCallDirectoryV25_10_3, type ApiCallDirectory$3 as ApiCallDirectoryV25_10_4, type ApiCallDirectory$2 as ApiCallDirectoryV25_10_5, type ApiCallDirectory$1 as ApiCallDirectoryV26_0_0, type ApiCallDirectory as ApiCallDirectoryV27_0_0, type ApiDirectoryByVersion, type ApiDirectoryShape, type ApiDirectory$7 as ApiDirectoryV25_10_0, type ApiDirectory$6 as ApiDirectoryV25_10_1, type ApiDirectory$5 as ApiDirectoryV25_10_2, type ApiDirectory$4 as ApiDirectoryV25_10_3, type ApiDirectory$3 as ApiDirectoryV25_10_4, type ApiDirectory$2 as ApiDirectoryV25_10_5, type ApiDirectory$1 as ApiDirectoryV26_0_0, type ApiDirectory as ApiDirectoryV27_0_0, type ApiError, type ApiEventDirectory$7 as ApiEventDirectoryV25_10_0, type ApiEventDirectory$6 as ApiEventDirectoryV25_10_1, type ApiEventDirectory$5 as ApiEventDirectoryV25_10_2, type ApiEventDirectory$4 as ApiEventDirectoryV25_10_3, type ApiEventDirectory$3 as ApiEventDirectoryV25_10_4, type ApiEventDirectory$2 as ApiEventDirectoryV25_10_5, type ApiEventDirectory$1 as ApiEventDirectoryV26_0_0, type ApiEventDirectory as ApiEventDirectoryV27_0_0, type ApiJobDirectory$7 as ApiJobDirectoryV25_10_0, type ApiJobDirectory$6 as ApiJobDirectoryV25_10_1, type ApiJobDirectory$5 as ApiJobDirectoryV25_10_2, type ApiJobDirectory$4 as ApiJobDirectoryV25_10_3, type ApiJobDirectory$3 as ApiJobDirectoryV25_10_4, type ApiJobDirectory$2 as ApiJobDirectoryV25_10_5, type ApiJobDirectory$1 as ApiJobDirectoryV26_0_0, type ApiJobDirectory as ApiJobDirectoryV27_0_0, type ApiKeyCreate, type ApiVersion, type ApiVersionResponse, AppState, type ApplianceProtocol, type ArgsOf, AuthError, AuthErrorCode, type AuthResponse, type BaseApiDirectory, type CallMethod, type CallParams, type CallResponse, type Container, type CreateClientOptions, type DefaultApiDirectory, type EventKind, type EventName, type EventUnion, InvalidVersionResponseError, type Job, type JobMethod, type JobParams, type JobProgress, type JobResult, JobState, type Logger, NoCompatibleVersionsError, type OperationMappings, type QueryDirectory, type QueryEntity, type QueryListOptions, type QueryMethod, type QuerySingleOptions, SUPPORTED_API_VERSIONS, type SupportedApiVersion, TrueNasApiClient, TrueNasApiClientV2510, TrueNasApiClientV26, TrueNasApiClientV27, TrueNasAuthMechanism, type TrueNasDate, UserRole, type UserRoleName, VersionCompatibility, VersionDiscovery, VersionDiscoveryError, VersionDiscoveryNetworkError, VersionDiscoveryTimeoutError, VersionEndpointNotFoundError, VersionTooNewError, VersionTooOldError, consoleLogger, createTrueNasClient, getApiErrorMessage, isJobFinished, noopLogger, index$7 as v25_10_0, index$6 as v25_10_1, index$5 as v25_10_2, index$4 as v25_10_3, index$3 as v25_10_4, index$2 as v25_10_5, index$1 as v26_0_0, index as v27_0_0 };