fix: release DeckOps 4.0.1 — browser runtime fixes

[iguangfei]

Summary

Patch release from runtime checks of the installed 4.0.0 browser entry in platform-slide-editor (45 checks against the fixture with fault injection: 43 passed, 2 SDK defects, 3 improvements).

Fixes

• Shared uploads (SDK-1). When two calls on one client converted/extracted the same File, the second inherited the first call's end: if the first was cancelled with its own reason or timed out, the second failed at once with the first's error. A joined upload that fails for any reason now leaves the caller to upload for itself; the caller ends only by its own signal or timeout, also while it waits.
• SSE network failures (SDK-2, M7). A task's event stream that failed at the network layer (no HTTP status) was retried every 5 s for up to 100 attempts, so a finished task was never seen. Waiting now falls back to polling on any stream failure at once; tasks.subscribe keeps reconnecting by default.

Improvements

• Late 401s (M1). A 401 for a request sent before a shared refresh finished retries once with the new token instead of calling onUnauthorized again. Found while testing it: a refresh that returned a bare token rewrote the retried request into the client's default space, so a call with its own spaceId created its task in the wrong space. That is fixed too.
• 402 message (M14). A 402 now rejects with the server's message instead of a generic checkout text; the body stays in details.
• Device id. authUuid, localStorage df_uuid and the Node device id accept any 1–100 visible ASCII characters (the server hashes the value and stores it in a 100-character column), so an app's nanoid df_uuid is reused instead of overwritten.

Known limitations (unchanged, documented in the CHANGELOG): axios registers a window message listener at import in browser-like environments; createClient() reads/writes df_uuid right after construction; a single signed PUT reports progress only at completion.

Verification

• Each fix has a test that fails on 4.0.0 and passes here: two shared-upload failover cases (custom abort reason, owner timeout) plus a joined call ending by its own signal; an injected SSE TypeError('Failed to fetch') with the task finishing at 300 ms, which now resolves in under 1 s; a late 401 refreshing once; a call-level space surviving a refresh; the server's 402 message; nanoid authUuid and df_uuid.
• pnpm check: 13 files / 219 tests, typecheck, build, browser export (39,239 bytes gzip, budget 43,163 = measured + 10 %), boundaries, built CLI contract. Also run in a clean worktree without local samples.
• pnpm check:package: tarball 363 KiB; --omit=optional install 4.43 MiB; default install 9.00 MiB with probe; cold start P95 59 ms.

🤖 Generated with Claude Code