@synopackageland/cli 0.29.0 → 0.31.0

package/CHANGELOG.md

@@ -1,5 +1,19 @@
 # Changelog
 
+## 0.31.0 (2026-10-25)
+
+- Pin templates 0.31.x and SDK/App 0.31.0 defaults, including the hardened executor payloads. Rebuild Apps and obtain administrator approval for changed system-access payloads.
+
+- A bare host name now resolves to `https://host:5001` instead of `http://host:5000`; pass a full URL to keep plain HTTP.
+- JSON input duplicate-key detection is now linear-time, so large inputs no longer stall the parser.
+- The CLI's own `.env` loading now sets only `DSM_*` and `SYNOPKGLAND_*` variables; set other variables (for example `GOCACHE` or `PATH`) in the shell.
+- Harden the DSM curl fallback (headers and form fields go through a private curl config; form text is sent literally), human-readable output (control characters are escaped), `ctl` examples and package versions, the UI directory (must resolve inside the project), and standalone inspect (INFO `package` must be an SDK package id).
+
+## 0.30.0 (2026-10-24)
+
+- Package and forward `identity_gateway.external_access.single_origin`; use SDK 0.30.0 for one-URL Apps, provider-aware DSM menu launches and launch probes.
+- Pin templates 0.30.x and its SDK/App 0.30.0 defaults; keep immutable executor/v0.27.0.
+
 ## 0.29.0 (2026-10-24)
 
 - Depend on templates `~0.29.0` with SDK/App 0.29.0 and UI 0.14.10. SDK 0.29.0 reuses executor/v0.27.0 through executor manifest format 1; no executor digests change.

package/README.md

@@ -66,7 +66,7 @@ CLI-only patch releases can differ from the SDK patch. Compose import and SDK de
 read the SDK pin from the installed templates; explicit App SDK declarations take precedence.
 
 `init` and `add` read their templates from the locally installed
-`@synopackageland/templates`. CLI 0.29.0 depends on `~0.29.0`: npm installation or
+`@synopackageland/templates`. CLI 0.31.0 depends on `~0.31.0`: npm installation or
 update can select the latest templates patch in the 0.29 minor line. Templates
 patches need only a templates release; update the npm installation to receive them.
 The CLI never fetches templates at runtime, so offline use works after installation;
@@ -308,7 +308,8 @@ and default to `external_access: {connect: optional, origin_change: none}`.
 Declare `identity_gateway.external_access.connect: none` to ignore Connect's
 public URL projection; manual URLs remain available without Connect. Use
 `origin_change: confirm` for Apps that need confirmation when their public
-origin changes. `connect: required` is rejected, and declaring `external_access`
+origin changes, and `single_origin: true` (SDK 0.30.0+) for an upstream that
+works on one URL only. `connect: required` is rejected, and declaring `external_access`
 with SDK older than 0.29.0 is rejected. Compose and gateway SDK pins must match.
 See [external access configuration](skills/reference/identity-gateway.md#external-access)
 for the manifest, settings entry, URL rules and cold-login handoff.
@@ -338,7 +339,10 @@ DSM readiness; inspect lists explicit acceptance blockers.
 ## Control installed Apps
 
 Use `synopkgland ctl host add nas --url https://nas.example:5001 --username alice`
-to register and authenticate a NAS in OS secure storage. `ctl host list --json`
+to register and authenticate a NAS in OS secure storage. A bare host name uses
+`https://<host>:5001`; provide a full URL for a different scheme or port.
+The CLI loads only `DSM_*` and `SYNOPKGLAND_*` variables from `.env`; set other
+process variables in the shell. `ctl host list --json`
 checks sessions; `ctl list --host nas --json` discovers all approved task-level
 commands and their schemas. Run the listed alias/command with typed flags,
 `--help` and `--dry-run`; writes require `--yes`. There is no mutable current

package/dist/bin.js

@@ -1,10 +1,11 @@
 #!/usr/bin/env node
 import { loadDotEnv } from "./load-env.js";
 import { runCli } from "./cli.js";
+import { terminalSafe } from "./terminal-text.js";
 loadDotEnv();
 // Package deployment is explicit; this CLI does not publish releases.
 // Successful completion leaves Node's default 0 or the command's exitCode intact.
 runCli(process.argv).catch((error) => {
-    console.error(error instanceof Error ? error.message : String(error));
+    console.error(terminalSafe(error instanceof Error ? error.message : String(error)));
     process.exit(1);
 });

package/dist/cli.js

@@ -36,6 +36,7 @@ import { checkJobs, commitOutputs, forEachArch, } from "./standalone/arch-jobs.j
 import { checkReproducible } from "./reproducible.js";
 import { spkApprovalDiff, formatApprovalDiff } from "./runtime/approval-diff.js";
 import { inspectAnySpk } from "./spk/inspect.js";
+import { terminalSafe } from "./terminal-text.js";
 function failure(code, message, hint = "Fix the configuration and retry; use --help to see command usage.") {
     return Object.assign(new Error(codedMessage(code, message)), { code, hint });
 }
@@ -295,7 +296,7 @@ export async function runCli(argv) {
     const json = argv.includes("--json");
     const stdout = console.log.bind(console);
     const progress = console.log;
-    const emit = (command, data, text) => json ? stdout(JSON.stringify({ ok: true, command, data })) : stdout(text);
+    const emit = (command, data, text) => json ? stdout(JSON.stringify({ ok: true, command, data })) : stdout(terminalSafe(text));
     const program = new Command()
         .name("synopkgland")
         .description("Syno Package Land Developer Kit CLI")

package/dist/ctl/cli.js

@@ -52,7 +52,7 @@ function q(value) { return "'" + value.replaceAll("'", "'\\''") + "'"; }
 function example(host, app, op) {
     const base = `synopkgland ctl ${app.payload.aliases[0] ?? app.payload.package.id} ${op.cli.join(' ')} --host ${host}`;
     return (op.examples?.length ? op.examples : [{}]).map(params => {
-        const simple = op.paramsSchema && Object.entries(params).every(([key, value]) => ['string', 'number', 'boolean'].includes(typeof value) && !RESERVED_FLAGS.has(flagName(key)) && op.paramsSchema?.properties?.[key]);
+        const simple = op.paramsSchema && Object.entries(params).every(([key, value]) => ['string', 'number', 'boolean'].includes(typeof value) && /^[A-Za-z][A-Za-z0-9_]*$/.test(key) && !RESERVED_FLAGS.has(flagName(key)) && op.paramsSchema?.properties?.[key]);
         if (simple)
             return base + Object.entries(params).map(([key, value]) => ' --' + flagName(key) + ' ' + q(String(value))).join('') + (op.effect === 'read' ? '' : ' --yes');
         return `printf '%s' ${q(JSON.stringify(params))} | ${base} --input -` + (op.effect === 'read' ? '' : ' --yes');

package/dist/ctl/json.js

@@ -1,9 +1,43 @@
 import { openSync, closeSync, readSync } from 'node:fs';
-import { parseDocument } from 'yaml';
+/** Linear duplicate-key scan over text that JSON.parse already accepted (yaml's uniqueKeys check is quadratic). */
+function hasDuplicateKeys(text) {
+    const stack = [];
+    let expectKey = false;
+    for (let i = 0; i < text.length; i++) {
+        const c = text[i];
+        if (c === '"') {
+            let j = i + 1;
+            while (text[j] !== '"')
+                j += text[j] === '\\' ? 2 : 1;
+            const top = stack[stack.length - 1];
+            if (top && expectKey) {
+                const key = JSON.parse(text.slice(i, j + 1));
+                if (top.has(key))
+                    return true;
+                top.add(key);
+                expectKey = false;
+            }
+            i = j;
+        }
+        else if (c === '{') {
+            stack.push(new Set());
+            expectKey = true;
+        }
+        else if (c === '[') {
+            stack.push(null);
+        }
+        else if (c === '}' || c === ']') {
+            stack.pop();
+        }
+        else if (c === ',' && stack[stack.length - 1])
+            expectKey = true;
+    }
+    return false;
+}
 export function strictJson(raw) {
     const text = typeof raw === 'string' ? raw : new TextDecoder('utf-8', { fatal: true }).decode(raw);
     const value = JSON.parse(text);
-    if (parseDocument(text, { uniqueKeys: true }).errors.length)
+    if (hasDuplicateKeys(text))
         throw Error('Duplicate JSON properties');
     const check = (v, depth) => { if (depth > 32)
         throw Error('JSON too deep'); if (typeof v === 'number' && !Number.isFinite(v))

package/dist/ctl/service.js

@@ -37,7 +37,7 @@ export class CtlClient {
         const entries = response.data?.packages;
         if (!Array.isArray(entries) || response.data.total !== entries.length || entries.length > 4096)
             throw new CtlError('CTL_INVENTORY_INVALID', 'Incomplete installed-package inventory.', 'Check the DSM version and permissions.', 5);
-        return entries.map((p) => { if (typeof p.id !== 'string' || !/^[A-Za-z][A-Za-z0-9_.+-]{0,127}$/.test(p.id) || typeof p.version !== 'string')
+        return entries.map((p) => { if (typeof p.id !== 'string' || !/^[A-Za-z][A-Za-z0-9_.+-]{0,127}$/.test(p.id) || typeof p.version !== 'string' || !/^[A-Za-z0-9][A-Za-z0-9._+~-]{0,63}$/.test(p.version))
             throw new CtlError('CTL_INVENTORY_INVALID', 'Invalid package identity.', 'Check the DSM response.', 5); return { id: p.id, version: p.version, state: p.additional?.status }; });
     }
     async discover(options = {}) {

package/dist/error-registry.js

@@ -365,7 +365,7 @@ export const ERROR_REGISTRY = {
         STANDALONE_IDENTITY_GATEWAY_EXTERNAL_INVALID: {
             code: "STANDALONE_IDENTITY_GATEWAY_EXTERNAL_INVALID",
             description: "The external access declaration does not match the gateway contract.",
-            suggestion: "Set identity_gateway.external_access.connect to optional or none, and origin_change to none or confirm; required is not supported.",
+            suggestion: "Set identity_gateway.external_access.connect to optional or none, origin_change to none or confirm, and single_origin to a boolean; required is not supported.",
         },
         STANDALONE_IDENTITY_GATEWAY_EXTERNAL_SDK_REQUIRED: {
             code: "STANDALONE_IDENTITY_GATEWAY_EXTERNAL_SDK_REQUIRED",

package/dist/host/credentials.js

@@ -56,7 +56,7 @@ function fromEnv(urlOverride) {
     if (urlOverride) {
         dsmOrigin = urlOverride.startsWith("http://") || urlOverride.startsWith("https://")
             ? urlOverride
-            : `http://${urlOverride}:5000`;
+            : `https://${urlOverride}:5001`;
     }
     const password = process.env.DSM_PASSWORD;
     const username = process.env.DSM_USERNAME ?? "admin";

package/dist/host/dsm-http.js

@@ -52,30 +52,44 @@ export async function dsmFetch(url, init = {}) {
         return curlFetch(url, init);
     }
 }
+function curlConfigString(value) {
+    const escapes = { "\\": "\\\\", '"': '\\"', "\t": "\\t", "\n": "\\n", "\r": "\\r", "\v": "\\v" };
+    return `"${value.replace(/[\\"\t\n\r\v]/g, (c) => escapes[c])}"`;
+}
 async function curlFetch(url, init) {
     const staging = mkdtempSync(join(tmpdir(), "synopkgland-dsm-http-"));
     const headerFile = join(staging, "headers");
     const bodyFile = join(staging, "body");
     try {
-        const args = ["-sS", "-D", headerFile, "-o", bodyFile, "-w", "%{http_code}", "-X", init.method ?? "GET"];
+        const configFile = join(staging, "config");
+        const args = ["-sS", "-D", headerFile, "-o", bodyFile, "-w", "%{http_code}", "-X", init.method ?? "GET", "-K", configFile];
+        // Headers and form text go through a private config file, not argv, and
+        // form text is sent literally (curl -F would read "@file" and "<file").
+        const config = [];
         const headers = headerRecord(init.headers);
         for (const [name, value] of Object.entries(headers)) {
             if (name.toLowerCase() === "content-type" && init.body instanceof FormData) {
                 continue;
             }
-            args.push("-H", `${name}: ${value}`);
+            if (/[\r\n\0]/.test(name + value)) {
+                throw new Error(`Invalid header value: ${name}`);
+            }
+            config.push(`header = ${curlConfigString(`${name}: ${value}`)}`);
         }
         let stdin;
         if (init.body instanceof FormData) {
             for (const [name, value] of init.body.entries()) {
                 if (typeof value === "string") {
-                    args.push("-F", `${name}=${value}`);
+                    if (/[=\0]/.test(name) || value.includes("\0")) {
+                        throw new Error(`Invalid form field: ${name}`);
+                    }
+                    config.push(`form-string = ${curlConfigString(`${name}=${value}`)}`);
                     continue;
                 }
                 const filename = "name" in value && typeof value.name === "string" ? value.name : "upload.bin";
                 const partPath = join(staging, filename);
                 writeFileSync(partPath, Buffer.from(await value.arrayBuffer()));
-                args.push("-F", `${name}=@${partPath};filename=${filename}`);
+                config.push(`form = ${curlConfigString(`${name}=@${partPath};filename=${filename}`)}`);
             }
         }
         else if (typeof init.body === "string") {
@@ -86,6 +100,7 @@ async function curlFetch(url, init) {
             stdin = Buffer.from(await new Response(init.body).arrayBuffer());
             args.push("--data-binary", "@-");
         }
+        writeFileSync(configFile, config.map((line) => line + "\n").join(""), { mode: 0o600 });
         args.push(url);
         const result = spawnSync("curl", args, { encoding: "utf8", input: stdin });
         if (result.status !== 0) {

package/dist/load-env.js

@@ -1,5 +1,8 @@
 import { existsSync, readFileSync } from "node:fs";
 import { dirname, join, resolve } from "node:path";
+// A project .env may only supply the CLI's own settings, never variables that
+// change how child tools (go, docker, curl, tar) run.
+const DOTENV_KEY = /^(?:DSM|SYNOPKGLAND)_[A-Z0-9_]+$/;
 export function loadDotEnv(fromDir = process.cwd()) {
     let current = resolve(fromDir);
     while (true) {
@@ -16,7 +19,7 @@ export function loadDotEnv(fromDir = process.cwd()) {
                 }
                 const key = trimmed.slice(0, eq).trim();
                 const value = trimmed.slice(eq + 1).trim();
-                if (process.env[key] === undefined) {
+                if (DOTENV_KEY.test(key) && process.env[key] === undefined) {
                     process.env[key] = value;
                 }
             }

package/dist/standalone/identity-gateway.d.ts

@@ -16,6 +16,8 @@ export type GatewayMode = "none" | "oidc" | "header" | "token";
 export interface GatewayExternalAccess {
     connect: "optional" | "none";
     origin_change: "none" | "confirm";
+    /** One-URL upstream: DSM launch and local navigations go to the primary external origin. */
+    single_origin?: true;
 }
 export declare const EXTERNAL_ACCESS_MIN_SDK = "0.29.0";
 /** SDK 0.28 has the diagnostic ping only; older gateways reject external JSON. */

package/dist/standalone/identity-gateway.js

@@ -167,13 +167,14 @@ export function readIdentityGateway(value, daemon, fail, packagedPayload = false
     let externalAccess;
     if (v.external_access !== undefined) {
         const external = v.external_access;
-        if (!record(external) || !only(external, ["connect", "origin_change"]) ||
+        if (!record(external) || !only(external, ["connect", "origin_change", "single_origin"]) ||
             (external.connect !== undefined && external.connect !== "optional" && external.connect !== "none") ||
-            (external.origin_change !== undefined && external.origin_change !== "none" && external.origin_change !== "confirm")) {
-            fail({ code: "STANDALONE_IDENTITY_GATEWAY_EXTERNAL_INVALID", message: "identity_gateway.external_access accepts only connect (optional or none) and origin_change (none or confirm); required is not supported." });
+            (external.origin_change !== undefined && external.origin_change !== "none" && external.origin_change !== "confirm") ||
+            (external.single_origin !== undefined && typeof external.single_origin !== "boolean")) {
+            fail({ code: "STANDALONE_IDENTITY_GATEWAY_EXTERNAL_INVALID", message: "identity_gateway.external_access accepts only connect (optional or none), origin_change (none or confirm) and single_origin (boolean); required is not supported." });
             return undefined;
         }
-        externalAccess = { connect: external.connect ?? "optional", origin_change: external.origin_change ?? "none" };
+        externalAccess = { connect: external.connect ?? "optional", origin_change: external.origin_change ?? "none", ...(external.single_origin ? { single_origin: true } : {}) };
     }
     if (v.launch_path !== undefined) {
         try {
@@ -531,6 +532,10 @@ export async function buildIdentityGateway(m, arch, work, run) {
         if (!existsSync(config) || !/`json:"external(?:,omitempty)?"`/.test(readFileSync(config, "utf8")) ||
             !existsSync(main) || !/["']\/?settings\.cgi["']/.test(readFileSync(main, "utf8")))
             throw new StandaloneBuildError("STANDALONE_IDENTITY_GATEWAY_EXTERNAL_SDK_REQUIRED", `The selected SDK source lacks external access or settings.cgi support; use SDK ${EXTERNAL_ACCESS_MIN_SDK} or later with matching sources.`);
+        const external = join(sdk.goDir, "idgateway/external.go");
+        if (gatewayExternalAccess(m.identityGateway)?.single_origin &&
+            (!existsSync(external) || !/`json:"single_origin(?:,omitempty)?"`/.test(readFileSync(external, "utf8"))))
+            throw new StandaloneBuildError("STANDALONE_IDENTITY_GATEWAY_EXTERNAL_SDK_REQUIRED", "The selected SDK source lacks external_access.single_origin support; use a matching SDK release or an explicit development source override.");
     }
     if (m.identityGateway.oidc?.browser_redirect) {
         const capability = join(sdk.goDir, "idgateway/browser_redirect.go");

package/dist/standalone/inspect-spk.js

@@ -1037,6 +1037,11 @@ function readInfo(path, findings, kind, compose = false, daemonNode) {
             findings.push(`INFO is missing ${key}`);
         }
     }
+    // Every SDK build writes this package grammar; inspect renders paths and
+    // configs from it, so anything else is not an SDK-built package.
+    if (info.package && !/^[A-Za-z][A-Za-z0-9]{1,63}$/.test(info.package)) {
+        findings.push("INFO package is not a valid SDK package id");
+    }
     if (kind !== "container" &&
         (info.thirdparty !== "yes" || info.dsmuidir !== "ui")) {
         findings.push('INFO must have thirdparty="yes" and dsmuidir="ui" for DSM to serve /webman/3rdparty/<package>/');
@@ -1135,8 +1140,9 @@ async function inspectExternalGateway(dir, paths, payload, saved, findings) {
             return;
         const external = saved;
         if (!external || typeof external !== "object" || Array.isArray(external) ||
-            Object.keys(external).length !== 2 || (external.connect !== "optional" && external.connect !== "none") ||
+            Object.keys(external).length !== (external.single_origin === undefined ? 2 : 3) || (external.connect !== "optional" && external.connect !== "none") ||
             (external.origin_change !== "none" && external.origin_change !== "confirm") ||
+            (external.single_origin !== undefined && external.single_origin !== true) ||
             !isDeepStrictEqual(cfg.external, external) || cfg.package !== info.package)
             throw new Error("external configuration differs from its package declaration");
         const arch = info.arch.split(/\s+/).map(familyOfArchToken).find(Boolean) ?? "x86_64";

package/dist/standalone/spk.js

@@ -6,9 +6,9 @@ import { resolvedSdkLaunch } from "../contract/app-launch.js";
 import { gatewayAdmissionPolicy } from "./identity-gateway.js";
 import { metadataInfoFields } from "../package-metadata.js";
 import { createHash } from "node:crypto";
-import { chmodSync, copyFileSync, existsSync, lstatSync, mkdirSync, mkdtempSync, readdirSync, readFileSync, rmSync, writeFileSync, } from "node:fs";
+import { chmodSync, copyFileSync, existsSync, lstatSync, mkdirSync, mkdtempSync, readdirSync, readFileSync, rmSync, writeFileSync, realpathSync, } from "node:fs";
 import { tmpdir } from "node:os";
-import { dirname, join } from "node:path";
+import { dirname, join, sep } from "node:path";
 import { infoArchValue } from "../build-spk/dsm-arch.js";
 import { packageIcons, writeDsmWindowIcons, writePackageCenterIcons, } from "../build-spk/dsm-icons.js";
 import { renderNativePrivilege } from "../build-spk/native-lifecycle.js";
@@ -78,7 +78,7 @@ export async function assembleStandaloneSpk(options) {
         const uiRoot = join(staging, "package", "ui");
         const appDir = join(uiRoot, "app");
         if (hasSdkWindow(manifest))
-            copyUiTree(manifest.ui.dir, appDir);
+            copyUiTree(manifest.ui.dir, appDir, manifest.root);
         else
             mkdirSync(appDir, { recursive: true });
         const assetVersion = digestTree(appDir).slice(0, 12);
@@ -386,12 +386,17 @@ export function renderInfo(manifest, arch, checksum, executorDigest) {
         fields.push(['startstop_restart_services', 'nginx.service']);
     return portalInfoFields(fields, Boolean(manifest.portal) || nginx).map(([key, value]) => `${key}=${quote(value)}\n`).join("");
 }
-function copyUiTree(source, target) {
+function copyUiTree(source, target, root) {
     for (const entry of ["app.js", "app.css"]) {
         if (!existsSync(join(source, entry))) {
             throw new StandaloneBuildError("STANDALONE_UI_ENTRY_MISSING", `The UI directory is missing ${entry}: ${source}`);
         }
     }
+    const real = realpathSync(source);
+    const realRoot = realpathSync(root);
+    if (real !== realRoot && !real.startsWith(realRoot + sep)) {
+        throw new StandaloneBuildError("STANDALONE_UI_SYMLINK", `The UI directory must resolve inside the project: ${source}`);
+    }
     let total = 0;
     const walk = (from, to) => {
         mkdirSync(to, { recursive: true });

package/dist/terminal-text.d.ts

@@ -0,0 +1 @@
+export declare function terminalSafe(text: string): string;

package/dist/terminal-text.js

@@ -0,0 +1,5 @@
+// Package-supplied strings (INFO fields, file names, DSM data) reach human
+// output; show control characters as escapes so they cannot drive the terminal.
+export function terminalSafe(text) {
+    return text.replace(/[\u0000-\u0008\u000b-\u001f\u007f-\u009f]/g, (c) => `\\x${c.charCodeAt(0).toString(16).padStart(2, "0")}`);
+}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@synopackageland/cli",
-  "version": "0.29.0",
+  "version": "0.31.0",
   "description": "Syno Package Land Developer Kit CLI",
   "type": "module",
   "bin": {
@@ -27,7 +27,7 @@
   },
   "dependencies": {
     "@napi-rs/keyring": "^2.1.1",
-    "@synopackageland/templates": "~0.29.0",
+    "@synopackageland/templates": "~0.31.0",
     "ajv": "^8.17.1",
     "commander": "^13.1.0",
     "json-canonicalize": "^3.0.1",

package/skills/reference/identity-gateway.md

@@ -2,15 +2,16 @@
 
 ## External access
 
-Use SDK 0.29.0 or later with matching gateway sources. Add this to the existing
+Use SDK 0.30.0 or later with matching gateway sources. Add this to the existing
 complete gateway declaration; keep the App's upstream, listener and auth policy:
 
 ```yaml
 identity_gateway:
-  sdk: 0.29.0
+  sdk: 0.30.0
   external_access:
     connect: optional    # optional | none
     origin_change: none # none | confirm
+    single_origin: false # true for an upstream that works on one URL only
 ```
 
 Omitting the block or either member uses `connect: optional` and
@@ -38,11 +39,18 @@ installation. It edits only `manual_origin` and `dsm_origin` in private
 URL fields.
 
 Public origins must use HTTPS and a DNS hostname. Port 443 is normalized;
-other ports, IP addresses, paths, queries and user information are rejected,
+other ports (except a single-origin App's `manual_origin`), IP addresses, paths, queries and user information are rejected,
 as is an origin equal to the DSM origin. Manual takes precedence, then the
 Connect projection when `connect: optional`; the first effective origin is
 primary. `connect: none` ignores that projection. Private URLs are display-only.
 Use `origin_change: confirm` for an App that must confirm public-origin changes.
+Declare `single_origin: true` (with `origin_change: confirm`) for an App whose
+upstream sign-in works on one fixed URL, such as Vaultwarden's `DOMAIN`. While
+an external origin is set, the DSM launcher opens the primary origin and local
+browser navigations redirect to it; the settings page says that only that
+address can sign in. Without an external origin nothing changes. The generated
+`external` object then carries `"single_origin":true`, and build rejects a
+development SDK source without `single_origin` support.
 
 Cold DSM login preserves external resume tokens
 `<txn>:x<n>:<r1>.<r2>` in the fixed `authorize.cgi?resume=<encoded token>`
@@ -260,3 +268,5 @@ control characters are rejected. Caller query values cannot override it.
 Use the upstream's supported entry route; this does not modify upstream UI,
 produce an App session, or unlock encrypted data. HTTPS and App-specific
 fragment/query semantics still require deployment acceptance.
+
+Single-origin Apps require SDK 0.30.0 or later. Their `manual_origin` may include an explicit HTTPS port (for example, `https://example.ts.net:29443`). The DSM launcher resolves the destination for the provider used to open DSM, probes `/_spl/ping` for up to eight seconds, and offers **Open anyway** if the probe fails. A single-origin App always uses its configured primary origin. Other Apps and the `external-origin` install setting continue to require HTTPS DNS origins on port 443.