@synopackageland/templates 0.37.0 → 0.38.1

package/README.md

@@ -22,7 +22,7 @@ daemon:
     window_seconds: 300
 ```
 
-Templates 0.37.0 pin UI 0.19.1 and SDK 0.41.1 in native and Compose projects.
+Templates 0.38.0 pin UI 0.19.1 and SDK 0.43.0 in native and Compose projects.
 Use a CLI that supports executor manifest format 1. The Vue `AppShell` shows a
 non-blocking **Reload** notice when an upgrade replaced the UI an open page
 loaded. Go Apps select
@@ -87,15 +87,15 @@ the single source of the SDK version and `frontend/package.json` pins
 `@synopackageland/sdk` to the same version. Python and Node.js name it in
 `backend.sdk`, Rust in the `syno-pkg-land-app` tag of `backend/Cargo.toml`
 (and `Cargo.lock`); all of them pin 0.41.1. The Vue frontend pins
-`@synopackageland/ui` 0.19.1. SDK 0.41.1 accepts UI `>=0.10.1 <0.20.0`,
+`@synopackageland/ui` 0.19.1. SDK 0.43.0 accepts UI `>=0.10.1 <0.20.0`,
 so no UI peer override is needed. Tests use jsdom 30 for UI floating-layer styles.
 
 Interactive NAS file operations use same-origin browser calls.
 Custom file handlers use the SDK's
 [session transport migration](https://github.com/synopackageland/syno-pkg-land-sdk/blob/v0.41.1/docs/dsm-session-transport.md).
-The CLI reads SDK 0.41.1's release manifest, which names immutable
+The CLI reads SDK 0.43.0's release manifest, which names immutable
 executor/v0.39.0 and its executor digests. CLI distributions must resolve
-templates 0.37.x before default scaffolds use this release; a `~0.36.0`
+templates 0.38.x before default scaffolds use this release; a `~0.36.0`
 templates dependency remains on the older minor.
 
 Every App method must appear in the permissions table, including methods whose
@@ -110,7 +110,7 @@ Keep punctuation between sentences and intentional loading ellipses.
 
 ## Request deadlines and background work
 
-SDK/App 0.41.1 defaults to 300 seconds for cooperative requests and 302 seconds
+SDK/App 0.43.0 defaults to 300 seconds for cooperative requests and 302 seconds
 for the TS client and generated DSM window. The CLI reads the selected SDK's
 timeout spec; `backend.timeout_seconds` explicitly overrides it for native
 backends, and an earlier parent deadline still wins. Go assembly should fall
@@ -304,7 +304,7 @@ The bridge examples expose submission, lookup and cancellation through
 
 ## External access
 
-With a compatible CLI and SDK 0.41.1, a gateway App may declare `identity_gateway.external_access: {connect: optional, origin_change: confirm, single_origin: true}` for an upstream that signs in on one fixed URL. The policy is forwarded to the packaged gateway. A single-origin App's `manual_origin` accepts an explicit HTTPS port; the `external-origin` installation setting remains restricted to port 443. The DSM launcher selects a provider destination, probes `/_spl/ping` for up to eight seconds, and explains failures before offering **Open anyway**. A configured single-origin App always opens its primary external origin.
+With a compatible CLI and SDK 0.43.0, a gateway App may declare `identity_gateway.external_access: {connect: optional, origin_change: confirm, single_origin: true}` for an upstream that signs in on one fixed URL. The policy is forwarded to the packaged gateway. A single-origin App's `manual_origin` accepts an explicit HTTPS port; the `external-origin` installation setting remains restricted to port 443. The DSM launcher selects a provider destination, probes `/_spl/ping` for up to eight seconds, and explains failures before offering **Open anyway**. A configured single-origin App always opens its primary external origin.
 
 
 Compose templates declare an app-named dedicated shared folder by default. DSM
@@ -349,3 +349,8 @@ grants get different sources. A newly created report refused with
 `DELEGATION_DENIED` is removed. An ambiguous transport failure keeps the source
 for retry because the executor may already have admitted it. Other settled
 sources use the SDK's explicit discard operation when the App deletes the job.
+
+An opt-in [DSM path ingress migration guide](examples/path-ingress/README.md)
+explains the default `/synopkgland/<package>/` on the DSM origin and opt-in
+custom lowercase paths for upstreams with a fixed base. Root `/` is unsupported;
+installation checks route ownership before DSM registers the resource.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@synopackageland/templates",
-  "version": "0.37.0",
+  "version": "0.38.1",
   "description": "Project templates for synopkgland init: native-go, native-python, native-node and native-rust (plain or Vue, with jobs, delegate and root-ops overlays), binary and compose.",
   "license": "MIT",
   "repository": {

package/templates/compose/dsm-package.yaml

@@ -23,7 +23,7 @@ compose:
   web: {service: web, port: 8080, health: {path: /, status: 200}}
   network: {egress: isolated}
 identity_gateway:
-  sdk: 0.41.1
+  sdk: 0.43.0
   mode: none
   listen: {http: 28000}
 # Web Apps default to new-page through the shared app-launch resolver.

package/templates/native-go/README.md

@@ -17,7 +17,7 @@ DSM main menu → DSM window (ui/app.js)
 
 ## Requests and long work
 
-SDK/App 0.41.1 defaults to 300-second requests and a 302-second browser wait.
+SDK/App 0.43.0 defaults to 300-second requests and a 302-second browser wait.
 Explicit `backend.timeout_seconds` and earlier parent deadlines still apply;
 rebuild the App to use the new SDK. For long NAS work, enable the existing jobs
 capability: return admission and the original job ID promptly, execute in the
@@ -27,7 +27,7 @@ last queued/running state intact. After a lost admission reply, reuse the same
 idempotency key and input instead of replaying a mutation with a new key.
 Jobs default to 30 minutes; approved executor limits remain separate. ctl keeps
 its 62-second transport default; use an explicit `--timeout` or an existing
-nonblocking job. See the SDK's [request deadline contract](https://github.com/synopackageland/syno-pkg-land-sdk/blob/v0.41.1/docs/request-deadlines.md).
+nonblocking job. See the SDK's [request deadline contract](https://github.com/synopackageland/syno-pkg-land-sdk/blob/v0.43.0/docs/request-deadlines.md).
 
 ## Quick start
 

package/templates/native-go/backend/THIRD_PARTY_NOTICES.txt

@@ -1,6 +1,6 @@
 Native Go package build dependencies
 
-github.com/synopackageland/syno-pkg-land-sdk v0.41.1 (MIT)
+github.com/synopackageland/syno-pkg-land-sdk v0.43.0 (MIT)
 
 Copyright (c) 2026 synopkgland
 

package/templates/native-go/backend/go.mod

@@ -4,6 +4,6 @@ go 1.25.0
 
 toolchain go1.26.10
 
-require github.com/synopackageland/syno-pkg-land-sdk v0.41.1
+require github.com/synopackageland/syno-pkg-land-sdk v0.43.0
 
 require golang.org/x/sys v0.44.0 // indirect

package/templates/native-go/backend/go.sum

@@ -1,4 +1,4 @@
-github.com/synopackageland/syno-pkg-land-sdk v0.41.1 h1:DnNgIOz08eG9xh1rJjGreHkGdba6ABFtxxG+7PgWMzs=
-github.com/synopackageland/syno-pkg-land-sdk v0.41.1/go.mod h1:8GwREGbczc8mAk4Gv8FUHaukXXCUstjzkovQrNV59Cc=
+github.com/synopackageland/syno-pkg-land-sdk v0.43.0 h1:SgUaOxjyOeiZE44Z+JAmZXtoy+idkgVF74N7palFH4k=
+github.com/synopackageland/syno-pkg-land-sdk v0.43.0/go.mod h1:8GwREGbczc8mAk4Gv8FUHaukXXCUstjzkovQrNV59Cc=
 golang.org/x/sys v0.44.0 h1:ildZl3J4uzeKP07r2F++Op7E9B29JRUy+a27EibtBTQ=
 golang.org/x/sys v0.44.0/go.mod h1:4GL1E5IUh+htKOUEOaiffhrAeqysfVGipDYzABqnCmw=

package/templates/native-go-vue/frontend/package-lock.json

@@ -7,7 +7,7 @@
       "name": "native-dsm-vue-app",
       "dependencies": {
         "@lucide/vue": "1.48.0",
-        "@synopackageland/sdk": "0.41.1",
+        "@synopackageland/sdk": "0.43.0",
         "@synopackageland/ui": "0.19.1",
         "vue": "3.5.43"
       },
@@ -1177,9 +1177,9 @@
       }
     },
     "node_modules/@synopackageland/sdk": {
-      "version": "0.41.1",
-      "resolved": "https://registry.npmjs.org/@synopackageland/sdk/-/sdk-0.41.1.tgz",
-      "integrity": "sha512-Xfv4PhLyGkFekjBPer+SbqkJKwr4vXXfi9lzJYBiPF8uzGhu3n2WpusxfNnFffHPsF+MHZvIfQD7aKjKIPpT7g==",
+      "version": "0.43.0",
+      "resolved": "https://registry.npmjs.org/@synopackageland/sdk/-/sdk-0.43.0.tgz",
+      "integrity": "sha512-i/HbHkk50SEbzs1rNS7IEuS3ydLK3cMZb9wJqr6aGOjNROiGTy3nBo9MkpKmXYoksTuYkBt94gSP3Q7DfKFHBw==",
       "license": "MIT",
       "peerDependencies": {
         "@lucide/vue": "^1.48.0",

package/templates/native-go-vue/frontend/package.json

@@ -8,16 +8,16 @@
   },
   "dependencies": {
     "@lucide/vue": "1.48.0",
-    "@synopackageland/sdk": "0.41.1",
+    "@synopackageland/sdk": "0.43.0",
     "@synopackageland/ui": "0.19.1",
     "vue": "3.5.43"
   },
   "devDependencies": {
     "@vitejs/plugin-vue": "6.0.9",
-    "vite": "7.3.6",
+    "jsdom": "30.1.1",
     "typescript": "5.9.3",
-    "vue-tsc": "3.3.11",
+    "vite": "7.3.6",
     "vitest": "4.1.11",
-    "jsdom": "30.1.1"
+    "vue-tsc": "3.3.11"
   }
 }

package/templates/native-node/README.md

@@ -17,7 +17,7 @@ DSM main menu → DSM window (ui/app.js)
 
 ## Requests and long work
 
-SDK/App 0.41.1 defaults to 300-second requests and a 302-second browser wait.
+SDK/App 0.43.0 defaults to 300-second requests and a 302-second browser wait.
 Explicit `backend.timeout_seconds` and earlier parent deadlines still apply;
 rebuild the App to use the new SDK. For long NAS work, enable the existing jobs
 capability: return admission and the original job ID promptly, execute in the
@@ -27,7 +27,7 @@ last queued/running state intact. After a lost admission reply, reuse the same
 idempotency key and input instead of replaying a mutation with a new key.
 Jobs default to 30 minutes; approved executor limits remain separate. ctl keeps
 its 62-second transport default; use an explicit `--timeout` or an existing
-nonblocking job. See the SDK's [request deadline contract](https://github.com/synopackageland/syno-pkg-land-sdk/blob/v0.41.1/docs/request-deadlines.md).
+nonblocking job. See the SDK's [request deadline contract](https://github.com/synopackageland/syno-pkg-land-sdk/blob/v0.43.0/docs/request-deadlines.md).
 
 ## Quick start
 

package/templates/native-node/backend/package-lock.json

@@ -49,7 +49,7 @@
       "license": "MIT"
     },
     "vendor/@synopackageland/app": {
-      "version": "0.41.1",
+      "version": "0.43.0",
       "license": "MIT",
       "engines": {
         "node": ">=22"

package/templates/native-node/dsm-package.yaml

@@ -49,7 +49,7 @@ backend:
   runtime: node
   dir: backend/app
   entry: main.js
-  sdk: 0.41.1
+  sdk: 0.43.0
   node: { package: Node.js_v22 }
 
 ui:

package/templates/native-python/README.md

@@ -17,7 +17,7 @@ DSM main menu → DSM window (ui/app.js)
 
 ## Requests and long work
 
-SDK/App 0.41.1 defaults to 300-second requests and a 302-second browser wait.
+SDK/App 0.43.0 defaults to 300-second requests and a 302-second browser wait.
 Explicit `backend.timeout_seconds` and earlier parent deadlines still apply;
 rebuild the App to use the new SDK. For long NAS work, enable the existing jobs
 capability: return admission and the original job ID promptly, execute in the
@@ -27,7 +27,7 @@ last queued/running state intact. After a lost admission reply, reuse the same
 idempotency key and input instead of replaying a mutation with a new key.
 Jobs default to 30 minutes; approved executor limits remain separate. ctl keeps
 its 62-second transport default; use an explicit `--timeout` or an existing
-nonblocking job. See the SDK's [request deadline contract](https://github.com/synopackageland/syno-pkg-land-sdk/blob/v0.41.1/docs/request-deadlines.md).
+nonblocking job. See the SDK's [request deadline contract](https://github.com/synopackageland/syno-pkg-land-sdk/blob/v0.43.0/docs/request-deadlines.md).
 
 ## Quick start
 

package/templates/native-python/dsm-package.yaml

@@ -47,7 +47,7 @@ backend:
   runtime: python
   dir: backend/app
   entry: main.py
-  sdk: 0.41.1
+  sdk: 0.43.0
 
 ui:
   # Non-UI-SDK frontends open a full page; Portal is a separate opt-in.

package/templates/native-rust/README.md

@@ -17,7 +17,7 @@ DSM main menu → DSM window (ui/app.js)
 
 ## Requests and long work
 
-SDK/App 0.41.1 defaults to 300-second requests and a 302-second browser wait.
+SDK/App 0.43.0 defaults to 300-second requests and a 302-second browser wait.
 Explicit `backend.timeout_seconds` and earlier parent deadlines still apply;
 rebuild the App to use the new SDK. For long NAS work, enable the existing jobs
 capability: return admission and the original job ID promptly, execute in the
@@ -27,7 +27,7 @@ last queued/running state intact. After a lost admission reply, reuse the same
 idempotency key and input instead of replaying a mutation with a new key.
 Jobs default to 30 minutes; approved executor limits remain separate. ctl keeps
 its 62-second transport default; use an explicit `--timeout` or an existing
-nonblocking job. See the SDK's [request deadline contract](https://github.com/synopackageland/syno-pkg-land-sdk/blob/v0.41.1/docs/request-deadlines.md).
+nonblocking job. See the SDK's [request deadline contract](https://github.com/synopackageland/syno-pkg-land-sdk/blob/v0.43.0/docs/request-deadlines.md).
 
 ## Quick start
 

package/templates/native-rust/backend/Cargo.lock

@@ -104,8 +104,8 @@ dependencies = [
 
 [[package]]
 name = "syno-pkg-land-app"
-version = "0.41.1"
-source = "git+https://github.com/synopackageland/syno-pkg-land-sdk?tag=v0.41.1#c2a15fca3f623f6ad25551877ed5097db1df3c25"
+version = "0.43.0"
+source = "git+https://github.com/synopackageland/syno-pkg-land-sdk?tag=v0.43.0#263d2a4fbab040756d406b76dd8272bca9db9707"
 dependencies = [
  "libc",
  "serde",

package/templates/native-rust/backend/Cargo.toml

@@ -9,7 +9,7 @@ libc = "0.2"
 serde = { version = "1", features = ["derive"] }
 serde_json = "1"
 # The SDK version is the tag; `synopkgland check` reads it from Cargo.lock.
-syno-pkg-land-app = { git = "https://github.com/synopackageland/syno-pkg-land-sdk", tag = "v0.41.1" }
+syno-pkg-land-app = { git = "https://github.com/synopackageland/syno-pkg-land-sdk", tag = "v0.43.0" }
 
 [profile.release]
 # A handler panic becomes an "internal" reply; abort would end the App without one.

package/templates/native-rust-delegate/backend/Cargo.lock

@@ -170,8 +170,8 @@ dependencies = [
 
 [[package]]
 name = "syno-pkg-land-app"
-version = "0.41.1"
-source = "git+https://github.com/synopackageland/syno-pkg-land-sdk?tag=v0.41.1#c2a15fca3f623f6ad25551877ed5097db1df3c25"
+version = "0.43.0"
+source = "git+https://github.com/synopackageland/syno-pkg-land-sdk?tag=v0.43.0#263d2a4fbab040756d406b76dd8272bca9db9707"
 dependencies = [
  "libc",
  "serde",

package/templates/native-rust-delegate/backend/Cargo.toml

@@ -10,7 +10,7 @@ libc = "0.2"
 serde = { version = "1", features = ["derive"] }
 serde_json = "1"
 # The SDK version is the tag; `synopkgland check` reads it from Cargo.lock.
-syno-pkg-land-app = { git = "https://github.com/synopackageland/syno-pkg-land-sdk", tag = "v0.41.1" }
+syno-pkg-land-app = { git = "https://github.com/synopackageland/syno-pkg-land-sdk", tag = "v0.43.0" }
 
 [profile.release]
 # A handler panic becomes an "internal" reply; abort would end the App without one.