@synopackageland/cli 0.18.0 → 0.19.0

package/CHANGELOG.md

@@ -1,5 +1,11 @@
 # Changelog
 
+## 0.19.0 (2026-10-20)
+
+- Align the CLI SDK minor line and templates at 0.19.0; retain UI 0.12.5.
+- Support native DSM OIDC login without a browser bridge for compatible clients.
+- Refresh canonical executor setup fixtures and all three executor/lifecycle architecture pins for SDK 0.19.0. Rebuilt executor Apps require one administrator reapproval after upgrading.
+
 ## 0.18.0 (2026-10-20)
 
 - Support the SDK 0.18.x minor line and pin templates 0.18.0 with SDK/App 0.18.0 and UI 0.12.5.

package/dist/runtime/executor-digests.json

@@ -1,8 +1,8 @@
 {
-    "0.18.0": {
-        "x86_64": "6d9d5a12ac4c990639b31c555560a1b6e49cbe1c267c626a23b91833dcc4452e",
-        "aarch64": "efbed582ce1249fed09de72b7bbe553510a55553e44ccf76fa93c684864e8bb8",
-        "armv7": "670f83c3349497263c96b0244ec142153c094d5e223dae091c9c8614c0ea04b6",
+    "0.19.0": {
+        "x86_64": "3b23252a4d2ad188e8920aee3c022d054a85f31797dfb9f34a576449f8b08f41",
+        "aarch64": "024a8a01977324645b475330371afb8b8c8387eac6a11ec3d9d30a4a0e445174",
+        "armv7": "fae3266f65863815f1417332a3c73d12507941029077e0ddc118da8461e8cff3",
         "lifecycle": {
             "x86_64": "9bb53301670b43cdcd6e21cebac99ab7abd82962d874f32423a81e6cb49d4972",
             "aarch64": "38fe873c86eb102c850baa1f304114a83a31d1df72defd22792bc37610fec9bb",

package/dist/standalone/dsm-window.js

@@ -379,7 +379,7 @@ ${ns}.prepareFullPage = function (title) {
   favicon.href = ${ns}.appIcon;
 };
 
-${manifest.identityGateway?.oidc?.browser ? `${ns}.resumeOIDC = ${oidcResumeRuntime(pkg, Object.values(manifest.identityGateway.listen).filter((p) => typeof p === "number"))};` : ""}
+${(manifest.identityGateway?.oidc?.native_login || manifest.identityGateway?.oidc?.browser) ? `${ns}.resumeOIDC = ${oidcResumeRuntime(pkg, Object.values(manifest.identityGateway.listen).filter((p) => typeof p === "number"))};` : ""}
 
 // DSM reopens a window at the size it was last left at, even one saved on a
 // larger screen, and only moves a window that does not fit: keep it inside.
@@ -408,7 +408,7 @@ Ext.define(${JSON.stringify(`${ns}.MainWindow`)}, {
   },
   onOpen: function (param) {
     this.callParent(arguments);
-    ${manifest.identityGateway?.oidc?.browser ? `if (${ns}.resumeOIDC(param)) return;` : ""}
+    ${(manifest.identityGateway?.oidc?.native_login || manifest.identityGateway?.oidc?.browser) ? `if (${ns}.resumeOIDC(param)) return;` : ""}
     var me = this;
     if (me.mounted) {
       me.reopenEvents.emit();
@@ -471,7 +471,7 @@ ${root ? root.mount : ""}    ${ns}.loadApp(function (app) {
   // with that launch's param. Before the App mounts, it mounts with the latest.
   onRequest: function (param) {
     this.callParent(arguments);
-    ${manifest.identityGateway?.oidc?.browser ? `if (${ns}.resumeOIDC(param)) return;` : ""}
+    ${(manifest.identityGateway?.oidc?.native_login || manifest.identityGateway?.oidc?.browser) ? `if (${ns}.resumeOIDC(param)) return;` : ""}
     var params = ${ns}.launchParams(param);
     if (!this.mounted) {
       if (this.mountPending && Object.keys(params).length) this.launchParams = params;

package/dist/standalone/identity-gateway.d.ts

@@ -55,6 +55,7 @@ export interface IdentityGateway {
     roles?: GatewayRoles;
     headers?: Partial<Record<"user" | "email" | "name" | "groups" | "uid", string>>;
     oidc?: {
+        native_login?: boolean;
         issuer_port: number;
         browser?: GatewayBrowser;
         clients: GatewayClient[];

package/dist/standalone/identity-gateway.js

@@ -270,7 +270,8 @@ export function readIdentityGateway(value, daemon, fail, packagedPayload = false
     if (v.mode === "oidc") {
         const o = v.oidc;
         if (!record(o) ||
-            !only(o, ["issuer_port", "clients", "rewrite_json", "browser"]) ||
+            !only(o, ["issuer_port", "clients", "rewrite_json", "browser", "native_login"]) ||
+            (o.native_login !== undefined && typeof o.native_login !== "boolean") ||
             !port(o.issuer_port) ||
             !Array.isArray(o.clients) ||
             !o.clients.length ||
@@ -312,6 +313,7 @@ export function readIdentityGateway(value, daemon, fail, packagedPayload = false
                 return invalid("oidc.browser needs fixed local start, login_paths and callback_paths outside /_sso.");
         }
         gateway.oidc = {
+            ...(o.native_login !== undefined ? { native_login: o.native_login } : {}),
             issuer_port: o.issuer_port,
             ...(b !== undefined ? { browser: b } : {}),
             clients: clients,

package/dist/standalone/oidc-resume.js

@@ -1,6 +1,18 @@
 /** No caller-provided URL reaches location: only a transaction and a declared port. */
 export function oidcResumeRuntime(pkg, ports) {
     return `(function(param) {
+  if (typeof param === 'string') {
+    if (param.length > 512) return false;
+    try { param = JSON.parse(param); }
+    catch (_) {
+      try {
+        var query = new URLSearchParams(param);
+        if (Array.from(query.keys()).length !== 1 || query.getAll('ssoResume').length !== 1) return false;
+        param = {ssoResume:query.get('ssoResume')};
+      } catch (_) { return false; }
+    }
+  }
+  if (!param || typeof param !== 'object' || Array.isArray(param)) return false;
   var value = param && param.ssoResume;
   if (typeof value !== 'string') return false;
   var parts = /^([A-Za-z0-9_-]{1,128}):([0-9]{1,5})$/.exec(value);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@synopackageland/cli",
-  "version": "0.18.0",
+  "version": "0.19.0",
   "description": "Syno Package Land Developer Kit CLI",
   "type": "module",
   "bin": {
@@ -27,7 +27,7 @@
   },
   "dependencies": {
     "@napi-rs/keyring": "^2.1.1",
-    "@synopackageland/templates": "0.18.0",
+    "@synopackageland/templates": "0.19.0",
     "ajv": "^8.17.1",
     "commander": "^13.1.0",
     "json-canonicalize": "^3.0.1",

package/skills/reference/identity-gateway.md

@@ -121,3 +121,14 @@ URL is accepted as the return destination. The transaction expires in five minut
 
 This declares navigation only; upstream account provisioning/role mapping must
 use that upstream's supported configuration APIs and be tested independently.
+
+## Server-managed OIDC navigation (development)
+
+For an upstream that automatically starts OIDC (for example a native web-server
+authentication module), leave `oidc.browser` unset and declare
+`oidc.native_login: true`. This reuses native DSM cold-login/resume without
+injecting an HTML/SPA bridge into the upstream. It requires the matching SDK
+capability; released SDK 0.18.0 does not yet implement this field. Native Compose
+URL entries resume only a bounded transaction and declared public gateway port.
+Normal menu entry remains the classless SDK CGI. Existing browser consumers keep
+their previous behavior. Never invent fake login paths just to enable DSM login.