@synopackageland/cli 0.22.0 → 0.23.0

package/CHANGELOG.md

@@ -1,5 +1,10 @@
 # Changelog
 
+## 0.23.0 (2026-10-21)
+
+- Validate the explicit OIDC `browser_redirect` contract before packaging and pin templates/SDK 0.23.0.
+- Reuse executor/v0.20.0 with unchanged executor and lifecycle payloads.
+
 ## 0.22.0 (2026-10-21)
 
 - Support SDK/App 0.22.x and pin templates 0.22.0 with published UI 0.12.5.

package/dist/error-registry.js

@@ -2,7 +2,7 @@ import { COMPOSE_ERRORS } from "./standalone/compose-errors.js";
 export const ERROR_REGISTRY = {
     ...COMPOSE_ERRORS,
     INSTALL_SETTINGS_INVALID: { "code": "INSTALL_SETTINGS_INVALID", "description": "The installation setting declaration is invalid.", "suggestion": "Declare 1–32 lowercase identifier keys in install.settings, each with type https-origin, a plain label and an explicit boolean required; omit defaults and values." },
-    SDK_INSTALL_SETTINGS_UNSUPPORTED: { "code": "SDK_INSTALL_SETTINGS_UNSUPPORTED", "description": "The selected SDK does not provide native installation settings.", "suggestion": "Pin SDK 0.22.0 or a matching supported release with installsettings/cmd/control, then rebuild with the matching CLI." },
+    SDK_INSTALL_SETTINGS_UNSUPPORTED: { "code": "SDK_INSTALL_SETTINGS_UNSUPPORTED", "description": "The selected SDK does not provide native installation settings.", "suggestion": "Pin SDK 0.23.0 or a matching supported release with installsettings/cmd/control, then rebuild with the matching CLI." },
     SDK_INSTALL_SETTINGS_BUILD_FAILED: { "code": "SDK_INSTALL_SETTINGS_BUILD_FAILED", "description": "The SDK installation settings controller could not be built.", "suggestion": "Install the pinned Go toolchain, inspect the compiler diagnostics and rebuild with a complete matching SDK release." },
     INIT_HEALTH_INVALID: { code: "INIT_HEALTH_INVALID", description: "The Compose readiness selection is invalid.", suggestion: "Supply both --health-path and --health-status with the actual endpoint and expected 2xx response; redirects are not followed." },
     INIT_UPSTREAM_IMAGE_REQUIRED: { code: "INIT_UPSTREAM_IMAGE_REQUIRED", description: "The official upstream image repository was not selected.", suggestion: "Use init --upstream-fork --upstream-image <official-repository> for Compose." },

package/dist/runtime/executor-digests.json

@@ -1,5 +1,5 @@
 {
-    "0.22.0": {
+    "0.23.0": {
         "x86_64": "e27cfeb85fed221b06f9c58166f02c0f701a724308cd17c96a43a843a0b5c4aa",
         "aarch64": "908db00cbd37d072f6ffc339e7bca24da5efb8cddd4befcbad02c7398beb7191",
         "armv7": "a0f35d62ec80a1bf3fb49f5e2d1a5f7576eda569a6fd0695084cec6cb8e100bc",

package/dist/runtime/sdk-source.js

@@ -76,7 +76,7 @@ function goMod(backendDir) {
     }
 }
 /** SDK releases that reuse an immutable executor release with identical payload bytes. */
-const EXECUTOR_RELEASES = { '0.21.0': '0.20.0', '0.21.1': '0.20.0', '0.22.0': '0.20.0' };
+const EXECUTOR_RELEASES = { '0.21.0': '0.20.0', '0.21.1': '0.20.0', '0.22.0': '0.20.0', '0.23.0': '0.20.0' };
 /**
  * The module directories of one SDK version. SYNOPKGLAND_SDK_DIR names a
  * local sdk checkout (development and gates only); otherwise modules come from

package/dist/standalone/identity-gateway.d.ts

@@ -59,6 +59,10 @@ export interface IdentityGateway {
     roles?: GatewayRoles;
     headers?: Partial<Record<"user" | "email" | "name" | "groups" | "uid", string>>;
     oidc?: {
+        browser_redirect?: {
+            html_paths?: string[];
+            same_origin_referrer?: boolean;
+        };
         native_login?: boolean;
         issuer_port: number;
         browser?: GatewayBrowser;

package/dist/standalone/identity-gateway.js

@@ -291,7 +291,7 @@ export function readIdentityGateway(value, daemon, fail, packagedPayload = false
     if (v.mode === "oidc") {
         const o = v.oidc;
         if (!record(o) ||
-            !only(o, ["issuer_port", "clients", "rewrite_json", "browser", "native_login"]) ||
+            !only(o, ["issuer_port", "clients", "rewrite_json", "browser", "native_login", "browser_redirect"]) ||
             (o.native_login !== undefined && typeof o.native_login !== "boolean") ||
             !port(o.issuer_port) ||
             !Array.isArray(o.clients) ||
@@ -312,6 +312,14 @@ export function readIdentityGateway(value, daemon, fail, packagedPayload = false
                 name(r.field))) {
             return invalid("oidc.rewrite_json entries are { method, path, field }.");
         }
+        const br = o.browser_redirect;
+        if (br !== undefined) {
+            const path = (p) => localPath(p) && p.length <= 512 && !/[%\s]/.test(p) && !p.startsWith("/_sso");
+            if (!record(br) || !only(br, ["html_paths", "same_origin_referrer"]) ||
+                (br.same_origin_referrer !== undefined && typeof br.same_origin_referrer !== "boolean") ||
+                (br.html_paths !== undefined && (!strings(br.html_paths, path, 16) || new Set(br.html_paths).size !== br.html_paths.length)))
+                return invalid("oidc.browser_redirect accepts only optional exact html_paths outside /_sso and same_origin_referrer.");
+        }
         const b = o.browser;
         if (b !== undefined) {
             const [major, minor] = v.sdk.split(".").map(Number);
@@ -334,6 +342,7 @@ export function readIdentityGateway(value, daemon, fail, packagedPayload = false
                 return invalid("oidc.browser needs fixed local start, login_paths and callback_paths outside /_sso.");
         }
         gateway.oidc = {
+            ...(br !== undefined ? { browser_redirect: br } : {}),
             ...(o.native_login !== undefined ? { native_login: o.native_login } : {}),
             issuer_port: o.issuer_port,
             ...(b !== undefined ? { browser: b } : {}),
@@ -481,6 +490,11 @@ export async function buildIdentityGateway(m, arch, work, run) {
         throw new StandaloneBuildError("SDK_DOWNLOAD_FAILED", error.message.replace(/^\[[A-Z_]+\] /, ""));
     }
     runtimeBudgetSource(sdk.goDir, m);
+    if (m.identityGateway.oidc?.browser_redirect) {
+        const capability = join(sdk.goDir, "idgateway/browser_redirect.go");
+        if (!existsSync(capability) || !/const BrowserRedirectVersion = 2\b/.test(readFileSync(capability, "utf8")))
+            throw new StandaloneBuildError("STANDALONE_IDENTITY_GATEWAY_INVALID", "The selected SDK lacks per-request OIDC browser redirect support; use a matching SDK release or an explicit development source override.");
+    }
     if (m.identityGateway.upstream_access === "public") {
         const capability = join(sdk.goDir, "idgateway/provider_only.go");
         if (!existsSync(capability) || !/const ProviderOnlyOIDCVersion = 1\b/.test(readFileSync(capability, "utf8")))

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@synopackageland/cli",
-  "version": "0.22.0",
+  "version": "0.23.0",
   "description": "Syno Package Land Developer Kit CLI",
   "type": "module",
   "bin": {
@@ -27,7 +27,7 @@
   },
   "dependencies": {
     "@napi-rs/keyring": "^2.1.1",
-    "@synopackageland/templates": "0.22.0",
+    "@synopackageland/templates": "0.23.0",
     "ajv": "^8.17.1",
     "commander": "^13.1.0",
     "json-canonicalize": "^3.0.1",

package/skills/reference/identity-gateway.md

@@ -1,11 +1,42 @@
 # Wrap an OSS app with DSM accounts
 
+## Per-request OIDC browser origins (development)
+
+`oidc.browser_redirect: {}` opts into per-request browser origins for SDK/CLI
+0.23. Optional `html_paths` and `same_origin_referrer` configure HTML behavior.
+No host list is accepted or stored in the SPK: users can open the same install
+by IP, hostname, DDNS or a new DNS alias. Each request must use a syntactically
+valid IP/DNS authority and the declared gateway scheme/port; forwarding headers
+cannot select the destination. DSM native ingress uses its HTTPS port.
+Host selects only this browser response's navigation URL, never an upstream
+dial target or an authorization decision. DSM admission, transaction origin
+and browser binding, exact redirect registration and PKCE remain required.
+Gateway cookies are host-only. This does not make public upstream routes a
+network security boundary; upstream retains its authentication/CSRF duties.
+Use trusted DNS and TLS, as a user signing in on an attacker-controlled origin
+exposes that origin's session to its owner. Rewritten responses use no-store
+and remove validators/digests; issuer/discovery never depend on Host.
+
+Location and existing `rewrite_json` rules already map the loopback authorization
+endpoint. For clients returning it in HTML, add `html_paths: ["/auth/redirect"]`:
+only those exact GET/200 HTML responses are rewritten, up to 1 MiB using identity
+encoding, with raw/escaped/percent-encoded URL support. Query bytes and upstream
+CSP stay intact; inline CSP hashes over modified scripts are incompatible.
+If an upstream native form uses `no-referrer` and browsers send `Origin: null`,
+explicit `same_origin_referrer: true` restores same-origin metadata only on
+the declared HTML paths. Include the form's page in that list. Referrers never
+go to other origins; null/foreign Origin checks are not relaxed.
+Issuer/ID token `iss`, discovery, token, userinfo and JWKS remain on loopback.
+Redirect registration, PKCE and DSM browser binding are unchanged. This needs
+matching SDK/CLI support; builds reject an SDK without the capability, including
+old releases selected without a development source override.
+
 ## Provider-only OIDC
 
 For an upstream with native authentication for browsers and native clients,
 declare `mode: oidc`, `upstream_access: public`, and retain `access: dsm-users`,
 `dsm-admins` or `dsm-groups` for the issuer. This capability requires
-SDK/CLI 0.22.0 or later. A build with an old SDK
+SDK/CLI 0.23.0 or later. A build with an old SDK
 without that capability fails rather than claiming support.
 
 The gateway does not require DSM cookies or browser Origin on upstream requests.