@synopackageland/cli 0.29.0 → 0.30.0

package/CHANGELOG.md

@@ -1,5 +1,14 @@
 # Changelog
 
+## 0.30.0 (2026-10-24)
+
+- Package and forward `identity_gateway.external_access.single_origin`; use SDK 0.30.0 for one-URL Apps, provider-aware DSM menu launches and launch probes.
+- Pin templates 0.30.x and its SDK/App 0.30.0 defaults; keep immutable executor/v0.27.0.
+
+## Unreleased
+
+- Accept and package `identity_gateway.external_access.single_origin` (boolean) for one-URL upstreams. Build requires SDK sources with `single_origin` support, and inspect accepts the packaged `single_origin: true` declaration.
+
 ## 0.29.0 (2026-10-24)
 
 - Depend on templates `~0.29.0` with SDK/App 0.29.0 and UI 0.14.10. SDK 0.29.0 reuses executor/v0.27.0 through executor manifest format 1; no executor digests change.

package/README.md

@@ -66,7 +66,7 @@ CLI-only patch releases can differ from the SDK patch. Compose import and SDK de
 read the SDK pin from the installed templates; explicit App SDK declarations take precedence.
 
 `init` and `add` read their templates from the locally installed
-`@synopackageland/templates`. CLI 0.29.0 depends on `~0.29.0`: npm installation or
+`@synopackageland/templates`. CLI 0.30.0 depends on `~0.30.0`: npm installation or
 update can select the latest templates patch in the 0.29 minor line. Templates
 patches need only a templates release; update the npm installation to receive them.
 The CLI never fetches templates at runtime, so offline use works after installation;
@@ -308,7 +308,8 @@ and default to `external_access: {connect: optional, origin_change: none}`.
 Declare `identity_gateway.external_access.connect: none` to ignore Connect's
 public URL projection; manual URLs remain available without Connect. Use
 `origin_change: confirm` for Apps that need confirmation when their public
-origin changes. `connect: required` is rejected, and declaring `external_access`
+origin changes, and `single_origin: true` (SDK 0.30.0+) for an upstream that
+works on one URL only. `connect: required` is rejected, and declaring `external_access`
 with SDK older than 0.29.0 is rejected. Compose and gateway SDK pins must match.
 See [external access configuration](skills/reference/identity-gateway.md#external-access)
 for the manifest, settings entry, URL rules and cold-login handoff.

package/dist/error-registry.js

@@ -365,7 +365,7 @@ export const ERROR_REGISTRY = {
         STANDALONE_IDENTITY_GATEWAY_EXTERNAL_INVALID: {
             code: "STANDALONE_IDENTITY_GATEWAY_EXTERNAL_INVALID",
             description: "The external access declaration does not match the gateway contract.",
-            suggestion: "Set identity_gateway.external_access.connect to optional or none, and origin_change to none or confirm; required is not supported.",
+            suggestion: "Set identity_gateway.external_access.connect to optional or none, origin_change to none or confirm, and single_origin to a boolean; required is not supported.",
         },
         STANDALONE_IDENTITY_GATEWAY_EXTERNAL_SDK_REQUIRED: {
             code: "STANDALONE_IDENTITY_GATEWAY_EXTERNAL_SDK_REQUIRED",

package/dist/standalone/identity-gateway.d.ts

@@ -16,6 +16,8 @@ export type GatewayMode = "none" | "oidc" | "header" | "token";
 export interface GatewayExternalAccess {
     connect: "optional" | "none";
     origin_change: "none" | "confirm";
+    /** One-URL upstream: DSM launch and local navigations go to the primary external origin. */
+    single_origin?: true;
 }
 export declare const EXTERNAL_ACCESS_MIN_SDK = "0.29.0";
 /** SDK 0.28 has the diagnostic ping only; older gateways reject external JSON. */

package/dist/standalone/identity-gateway.js

@@ -167,13 +167,14 @@ export function readIdentityGateway(value, daemon, fail, packagedPayload = false
     let externalAccess;
     if (v.external_access !== undefined) {
         const external = v.external_access;
-        if (!record(external) || !only(external, ["connect", "origin_change"]) ||
+        if (!record(external) || !only(external, ["connect", "origin_change", "single_origin"]) ||
             (external.connect !== undefined && external.connect !== "optional" && external.connect !== "none") ||
-            (external.origin_change !== undefined && external.origin_change !== "none" && external.origin_change !== "confirm")) {
-            fail({ code: "STANDALONE_IDENTITY_GATEWAY_EXTERNAL_INVALID", message: "identity_gateway.external_access accepts only connect (optional or none) and origin_change (none or confirm); required is not supported." });
+            (external.origin_change !== undefined && external.origin_change !== "none" && external.origin_change !== "confirm") ||
+            (external.single_origin !== undefined && typeof external.single_origin !== "boolean")) {
+            fail({ code: "STANDALONE_IDENTITY_GATEWAY_EXTERNAL_INVALID", message: "identity_gateway.external_access accepts only connect (optional or none), origin_change (none or confirm) and single_origin (boolean); required is not supported." });
             return undefined;
         }
-        externalAccess = { connect: external.connect ?? "optional", origin_change: external.origin_change ?? "none" };
+        externalAccess = { connect: external.connect ?? "optional", origin_change: external.origin_change ?? "none", ...(external.single_origin ? { single_origin: true } : {}) };
     }
     if (v.launch_path !== undefined) {
         try {
@@ -531,6 +532,10 @@ export async function buildIdentityGateway(m, arch, work, run) {
         if (!existsSync(config) || !/`json:"external(?:,omitempty)?"`/.test(readFileSync(config, "utf8")) ||
             !existsSync(main) || !/["']\/?settings\.cgi["']/.test(readFileSync(main, "utf8")))
             throw new StandaloneBuildError("STANDALONE_IDENTITY_GATEWAY_EXTERNAL_SDK_REQUIRED", `The selected SDK source lacks external access or settings.cgi support; use SDK ${EXTERNAL_ACCESS_MIN_SDK} or later with matching sources.`);
+        const external = join(sdk.goDir, "idgateway/external.go");
+        if (gatewayExternalAccess(m.identityGateway)?.single_origin &&
+            (!existsSync(external) || !/`json:"single_origin(?:,omitempty)?"`/.test(readFileSync(external, "utf8"))))
+            throw new StandaloneBuildError("STANDALONE_IDENTITY_GATEWAY_EXTERNAL_SDK_REQUIRED", "The selected SDK source lacks external_access.single_origin support; use a matching SDK release or an explicit development source override.");
     }
     if (m.identityGateway.oidc?.browser_redirect) {
         const capability = join(sdk.goDir, "idgateway/browser_redirect.go");

package/dist/standalone/inspect-spk.js

@@ -1135,8 +1135,9 @@ async function inspectExternalGateway(dir, paths, payload, saved, findings) {
             return;
         const external = saved;
         if (!external || typeof external !== "object" || Array.isArray(external) ||
-            Object.keys(external).length !== 2 || (external.connect !== "optional" && external.connect !== "none") ||
+            Object.keys(external).length !== (external.single_origin === undefined ? 2 : 3) || (external.connect !== "optional" && external.connect !== "none") ||
             (external.origin_change !== "none" && external.origin_change !== "confirm") ||
+            (external.single_origin !== undefined && external.single_origin !== true) ||
             !isDeepStrictEqual(cfg.external, external) || cfg.package !== info.package)
             throw new Error("external configuration differs from its package declaration");
         const arch = info.arch.split(/\s+/).map(familyOfArchToken).find(Boolean) ?? "x86_64";

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@synopackageland/cli",
-  "version": "0.29.0",
+  "version": "0.30.0",
   "description": "Syno Package Land Developer Kit CLI",
   "type": "module",
   "bin": {
@@ -27,7 +27,7 @@
   },
   "dependencies": {
     "@napi-rs/keyring": "^2.1.1",
-    "@synopackageland/templates": "~0.29.0",
+    "@synopackageland/templates": "~0.30.0",
     "ajv": "^8.17.1",
     "commander": "^13.1.0",
     "json-canonicalize": "^3.0.1",

package/skills/reference/identity-gateway.md

@@ -2,15 +2,16 @@
 
 ## External access
 
-Use SDK 0.29.0 or later with matching gateway sources. Add this to the existing
+Use SDK 0.30.0 or later with matching gateway sources. Add this to the existing
 complete gateway declaration; keep the App's upstream, listener and auth policy:
 
 ```yaml
 identity_gateway:
-  sdk: 0.29.0
+  sdk: 0.30.0
   external_access:
     connect: optional    # optional | none
     origin_change: none # none | confirm
+    single_origin: false # true for an upstream that works on one URL only
 ```
 
 Omitting the block or either member uses `connect: optional` and
@@ -38,11 +39,18 @@ installation. It edits only `manual_origin` and `dsm_origin` in private
 URL fields.
 
 Public origins must use HTTPS and a DNS hostname. Port 443 is normalized;
-other ports, IP addresses, paths, queries and user information are rejected,
+other ports (except a single-origin App's `manual_origin`), IP addresses, paths, queries and user information are rejected,
 as is an origin equal to the DSM origin. Manual takes precedence, then the
 Connect projection when `connect: optional`; the first effective origin is
 primary. `connect: none` ignores that projection. Private URLs are display-only.
 Use `origin_change: confirm` for an App that must confirm public-origin changes.
+Declare `single_origin: true` (with `origin_change: confirm`) for an App whose
+upstream sign-in works on one fixed URL, such as Vaultwarden's `DOMAIN`. While
+an external origin is set, the DSM launcher opens the primary origin and local
+browser navigations redirect to it; the settings page says that only that
+address can sign in. Without an external origin nothing changes. The generated
+`external` object then carries `"single_origin":true`, and build rejects a
+development SDK source without `single_origin` support.
 
 Cold DSM login preserves external resume tokens
 `<txn>:x<n>:<r1>.<r2>` in the fixed `authorize.cgi?resume=<encoded token>`
@@ -260,3 +268,5 @@ control characters are rejected. Caller query values cannot override it.
 Use the upstream's supported entry route; this does not modify upstream UI,
 produce an App session, or unlock encrypted data. HTTPS and App-specific
 fragment/query semantics still require deployment acceptance.
+
+Single-origin Apps require SDK 0.30.0 or later. Their `manual_origin` may include an explicit HTTPS port (for example, `https://example.ts.net:29443`). The DSM launcher resolves the destination for the provider used to open DSM, probes `/_spl/ping` for up to eight seconds, and offers **Open anyway** if the probe fails. A single-origin App always uses its configured primary origin. Other Apps and the `external-origin` install setting continue to require HTTPS DNS origins on port 443.