@ninedeploy/schemas 0.10.6 → 0.16.0

package/dist/secretProviders.d.ts

@@ -0,0 +1,119 @@
+import { z } from 'zod';
+/** Mirrors `secretProviderKind` in `@ninedeploy/db`. */
+export declare const secretProviderKind: z.ZodEnum<{
+    aws: "aws";
+    vault: "vault";
+}>;
+export type SecretProviderKind = z.infer<typeof secretProviderKind>;
+/**
+ * A Vault path relative to the KV v2 mount: segments of `[A-Za-z0-9_.-]+`
+ * joined by `/`, no leading or trailing `/`, and no `.` or `..` segment.
+ */
+export declare const VAULT_PATH_RE: RegExp;
+/** A KV v2 field name. */
+export declare const VAULT_FIELD_RE: RegExp;
+/** An AWS secret name or full ARN. */
+export declare const AWS_SECRET_ID_RE: RegExp;
+export declare const AWS_REGION_RE: RegExp;
+export declare const AWS_ACCESS_KEY_ID_RE: RegExp;
+export declare const vaultPath: z.ZodString;
+export declare const awsSecretId: z.ZodString;
+export declare const vaultAuthMethod: z.ZodEnum<{
+    approle: "approle";
+    token: "token";
+}>;
+export type VaultAuthMethod = z.infer<typeof vaultAuthMethod>;
+export declare const vaultProviderConfig: z.ZodObject<{
+    address: z.ZodPipe<z.ZodPipe<z.ZodString, z.ZodURL>, z.ZodTransform<string, string>>;
+    namespace: z.ZodOptional<z.ZodString>;
+    mount: z.ZodDefault<z.ZodString>;
+    authMethod: z.ZodEnum<{
+        approle: "approle";
+        token: "token";
+    }>;
+    approleMount: z.ZodDefault<z.ZodString>;
+}, z.core.$strict>;
+export type VaultProviderConfig = z.input<typeof vaultProviderConfig>;
+export declare const vaultProviderCredentials: z.ZodObject<{
+    token: z.ZodOptional<z.ZodString>;
+    roleId: z.ZodOptional<z.ZodString>;
+    secretId: z.ZodOptional<z.ZodString>;
+}, z.core.$strict>;
+export type VaultProviderCredentials = z.infer<typeof vaultProviderCredentials>;
+/** PUT /v1/settings/secret-providers/vault. */
+export declare const vaultProviderPut: z.ZodObject<{
+    enabled: z.ZodOptional<z.ZodBoolean>;
+    config: z.ZodObject<{
+        address: z.ZodPipe<z.ZodPipe<z.ZodString, z.ZodURL>, z.ZodTransform<string, string>>;
+        namespace: z.ZodOptional<z.ZodString>;
+        mount: z.ZodDefault<z.ZodString>;
+        authMethod: z.ZodEnum<{
+            approle: "approle";
+            token: "token";
+        }>;
+        approleMount: z.ZodDefault<z.ZodString>;
+    }, z.core.$strict>;
+    credentials: z.ZodOptional<z.ZodObject<{
+        token: z.ZodOptional<z.ZodString>;
+        roleId: z.ZodOptional<z.ZodString>;
+        secretId: z.ZodOptional<z.ZodString>;
+    }, z.core.$strict>>;
+}, z.core.$strict>;
+export type VaultProviderPut = z.input<typeof vaultProviderPut>;
+export declare const awsProviderConfig: z.ZodObject<{
+    region: z.ZodString;
+    endpoint: z.ZodOptional<z.ZodPipe<z.ZodPipe<z.ZodString, z.ZodURL>, z.ZodTransform<string, string>>>;
+    roleArn: z.ZodOptional<z.ZodString>;
+    externalId: z.ZodOptional<z.ZodString>;
+    roleSessionName: z.ZodDefault<z.ZodString>;
+}, z.core.$strict>;
+export type AwsProviderConfig = z.input<typeof awsProviderConfig>;
+export declare const awsProviderCredentials: z.ZodObject<{
+    accessKeyId: z.ZodOptional<z.ZodString>;
+    secretAccessKey: z.ZodOptional<z.ZodString>;
+    sessionToken: z.ZodOptional<z.ZodString>;
+}, z.core.$strict>;
+export type AwsProviderCredentials = z.infer<typeof awsProviderCredentials>;
+/** PUT /v1/settings/secret-providers/aws. */
+export declare const awsProviderPut: z.ZodObject<{
+    enabled: z.ZodOptional<z.ZodBoolean>;
+    config: z.ZodObject<{
+        region: z.ZodString;
+        endpoint: z.ZodOptional<z.ZodPipe<z.ZodPipe<z.ZodString, z.ZodURL>, z.ZodTransform<string, string>>>;
+        roleArn: z.ZodOptional<z.ZodString>;
+        externalId: z.ZodOptional<z.ZodString>;
+        roleSessionName: z.ZodDefault<z.ZodString>;
+    }, z.core.$strict>;
+    credentials: z.ZodOptional<z.ZodObject<{
+        accessKeyId: z.ZodOptional<z.ZodString>;
+        secretAccessKey: z.ZodOptional<z.ZodString>;
+        sessionToken: z.ZodOptional<z.ZodString>;
+    }, z.core.$strict>>;
+}, z.core.$strict>;
+export type AwsProviderPut = z.input<typeof awsProviderPut>;
+/** POST /v1/settings/secret-providers/:kind/test. Both probes are optional. */
+export declare const secretProviderTestRequest: z.ZodObject<{
+    probePath: z.ZodOptional<z.ZodString>;
+    probeSecretId: z.ZodOptional<z.ZodString>;
+}, z.core.$strict>;
+export type SecretProviderTestRequest = z.infer<typeof secretProviderTestRequest>;
+export declare const secretProviderTestResult: z.ZodObject<{
+    ok: z.ZodBoolean;
+    detail: z.ZodString;
+}, z.core.$strip>;
+export type SecretProviderTestResult = z.infer<typeof secretProviderTestResult>;
+/** One element of GET /v1/settings/secret-providers. Never carries a credential. */
+export declare const secretProviderView: z.ZodObject<{
+    kind: z.ZodEnum<{
+        aws: "aws";
+        vault: "vault";
+    }>;
+    configured: z.ZodBoolean;
+    enabled: z.ZodBoolean;
+    config: z.ZodRecord<z.ZodString, z.ZodUnknown>;
+    hasCredential: z.ZodBoolean;
+    lastTestedAt: z.ZodNullable<z.ZodString>;
+    lastTestError: z.ZodNullable<z.ZodString>;
+}, z.core.$strip>;
+export type SecretProviderView = z.infer<typeof secretProviderView>;
+//# sourceMappingURL=secretProviders.d.ts.map

package/dist/secretProviders.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"secretProviders.d.ts","sourceRoot":"","sources":["../src/secretProviders.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAWxB,wDAAwD;AACxD,eAAO,MAAM,kBAAkB;;;EAA2B,CAAC;AAC3D,MAAM,MAAM,kBAAkB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,kBAAkB,CAAC,CAAC;AAIpE;;;GAGG;AACH,eAAO,MAAM,aAAa,QAA8E,CAAC;AACzG,0BAA0B;AAC1B,eAAO,MAAM,cAAc,QAAsB,CAAC;AAClD,sCAAsC;AACtC,eAAO,MAAM,gBAAgB,QAAkC,CAAC;AAChE,eAAO,MAAM,aAAa,QAAgC,CAAC;AAC3D,eAAO,MAAM,oBAAoB,QAA8B,CAAC;AAEhE,eAAO,MAAM,SAAS,aAAkE,CAAC;AACzF,eAAO,MAAM,WAAW,aAA8D,CAAC;AAIvF,eAAO,MAAM,eAAe;;;EAA+B,CAAC;AAC5D,MAAM,MAAM,eAAe,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,eAAe,CAAC,CAAC;AAE9D,eAAO,MAAM,mBAAmB;;;;;;;;;kBASrB,CAAC;AACZ,MAAM,MAAM,mBAAmB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,mBAAmB,CAAC,CAAC;AAItE,eAAO,MAAM,wBAAwB;;;;kBAM1B,CAAC;AACZ,MAAM,MAAM,wBAAwB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,wBAAwB,CAAC,CAAC;AAEhF,+CAA+C;AAC/C,eAAO,MAAM,gBAAgB;;;;;;;;;;;;;;;;;kBAczB,CAAC;AACL,MAAM,MAAM,gBAAgB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,gBAAgB,CAAC,CAAC;AAIhE,eAAO,MAAM,iBAAiB;;;;;;kBAyB1B,CAAC;AACL,MAAM,MAAM,iBAAiB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,iBAAiB,CAAC,CAAC;AAElE,eAAO,MAAM,sBAAsB;;;;kBAMxB,CAAC;AACZ,MAAM,MAAM,sBAAsB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,sBAAsB,CAAC,CAAC;AAE5E,6CAA6C;AAC7C,eAAO,MAAM,cAAc;;;;;;;;;;;;;;kBAMhB,CAAC;AACZ,MAAM,MAAM,cAAc,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,cAAc,CAAC,CAAC;AAI5D,+EAA+E;AAC/E,eAAO,MAAM,yBAAyB;;;kBAO3B,CAAC;AACZ,MAAM,MAAM,yBAAyB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,yBAAyB,CAAC,CAAC;AAElF,eAAO,MAAM,wBAAwB;;;iBAInC,CAAC;AACH,MAAM,MAAM,wBAAwB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,wBAAwB,CAAC,CAAC;AAEhF,oFAAoF;AACpF,eAAO,MAAM,kBAAkB;;;;;;;;;;;iBAS7B,CAAC;AACH,MAAM,MAAM,kBAAkB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,kBAAkB,CAAC,CAAC"}

package/dist/secretProviders.js

@@ -0,0 +1,130 @@
+import { z } from 'zod';
+import { providerBaseUrl } from './common.js';
+// ── Secret managers (0.14) ─────────────────────────────────────────────────
+// Request and response shapes for `/v1/settings/secret-providers`. HashiCorp
+// Vault / OpenBao (KV v2) and AWS Secrets Manager run alongside the existing
+// settings-based Infisical / Doppler provider, which is untouched. Credentials
+// only ever appear in REQUEST shapes; on update an omitted credential field
+// keeps the stored value. The server enforces https (http only with private
+// egress) and proves the settings with a test call. Design: DESIGN.md §4.
+/** Mirrors `secretProviderKind` in `@ninedeploy/db`. */
+export const secretProviderKind = z.enum(['vault', 'aws']);
+// ── Reference grammar pieces (DESIGN §4.1) ─────────────────────────────────
+/**
+ * A Vault path relative to the KV v2 mount: segments of `[A-Za-z0-9_.-]+`
+ * joined by `/`, no leading or trailing `/`, and no `.` or `..` segment.
+ */
+export const VAULT_PATH_RE = /^(?!\.\.?(?:\/|$))[A-Za-z0-9_.-]+(?:\/(?!\.\.?(?:\/|$))[A-Za-z0-9_.-]+)*$/;
+/** A KV v2 field name. */
+export const VAULT_FIELD_RE = /^[A-Za-z0-9_.-]+$/;
+/** An AWS secret name or full ARN. */
+export const AWS_SECRET_ID_RE = /^[A-Za-z0-9/_+=.@:-]{1,2048}$/;
+export const AWS_REGION_RE = /^[a-z]{2}(-gov)?-[a-z]+-\d$/;
+export const AWS_ACCESS_KEY_ID_RE = /^(AKIA|ASIA)[A-Z0-9]{16}$/;
+export const vaultPath = z.string().max(1024).regex(VAULT_PATH_RE, 'invalid Vault path');
+export const awsSecretId = z.string().regex(AWS_SECRET_ID_RE, 'invalid AWS secret id');
+// ── HashiCorp Vault / OpenBao ──────────────────────────────────────────────
+export const vaultAuthMethod = z.enum(['token', 'approle']);
+export const vaultProviderConfig = z
+    .object({
+    address: providerBaseUrl,
+    /** Vault Enterprise / OpenBao namespace (`X-Vault-Namespace`). */
+    namespace: vaultPath.optional(),
+    mount: vaultPath.default('secret'),
+    authMethod: vaultAuthMethod,
+    approleMount: vaultPath.default('approle'),
+})
+    .strict();
+const vaultSecret = z.string().min(1).max(4096);
+export const vaultProviderCredentials = z
+    .object({
+    token: vaultSecret.optional(),
+    roleId: vaultSecret.optional(),
+    secretId: vaultSecret.optional(),
+})
+    .strict();
+/** PUT /v1/settings/secret-providers/vault. */
+export const vaultProviderPut = z
+    .object({
+    enabled: z.boolean().optional(),
+    config: vaultProviderConfig,
+    credentials: vaultProviderCredentials.optional(),
+})
+    .strict()
+    .refine((v) => v.config.authMethod !== 'token' || (v.credentials?.roleId === undefined && v.credentials?.secretId === undefined), {
+    message: 'roleId and secretId belong to authMethod "approle"',
+    path: ['credentials'],
+})
+    .refine((v) => v.config.authMethod !== 'approle' || v.credentials?.token === undefined, {
+    message: 'token belongs to authMethod "token"',
+    path: ['credentials', 'token'],
+});
+// ── AWS Secrets Manager ────────────────────────────────────────────────────
+export const awsProviderConfig = z
+    .object({
+    region: z.string().regex(AWS_REGION_RE, 'invalid AWS region'),
+    /** VPC endpoint or compatible service; https. */
+    endpoint: providerBaseUrl.optional(),
+    roleArn: z
+        .string()
+        .max(2048)
+        .regex(/^arn:aws[a-z-]*:iam::\d{12}:role\/[\w+=,.@/-]{1,512}$/, 'invalid IAM role ARN')
+        .optional(),
+    externalId: z
+        .string()
+        .min(2)
+        .max(1224)
+        .regex(/^[\w+=,.@:/-]+$/, 'invalid external id')
+        .optional(),
+    roleSessionName: z
+        .string()
+        .regex(/^[\w+=,.@-]{2,64}$/, 'invalid role session name')
+        .default('ninedeploy'),
+})
+    .strict()
+    .refine((v) => v.externalId === undefined || v.roleArn !== undefined, {
+    message: 'externalId needs roleArn',
+    path: ['externalId'],
+});
+export const awsProviderCredentials = z
+    .object({
+    accessKeyId: z.string().regex(AWS_ACCESS_KEY_ID_RE, 'invalid access key id').optional(),
+    secretAccessKey: z.string().min(1).max(256).optional(),
+    sessionToken: z.string().min(1).max(4096).optional(),
+})
+    .strict();
+/** PUT /v1/settings/secret-providers/aws. */
+export const awsProviderPut = z
+    .object({
+    enabled: z.boolean().optional(),
+    config: awsProviderConfig,
+    credentials: awsProviderCredentials.optional(),
+})
+    .strict();
+// ── Test and views ─────────────────────────────────────────────────────────
+/** POST /v1/settings/secret-providers/:kind/test. Both probes are optional. */
+export const secretProviderTestRequest = z
+    .object({
+    /** vault: also read this path (relative to the mount). */
+    probePath: vaultPath.optional(),
+    /** aws: also read this secret. */
+    probeSecretId: awsSecretId.optional(),
+})
+    .strict();
+export const secretProviderTestResult = z.object({
+    ok: z.boolean(),
+    /** Redacted; response bodies cut to 200 characters. */
+    detail: z.string(),
+});
+/** One element of GET /v1/settings/secret-providers. Never carries a credential. */
+export const secretProviderView = z.object({
+    kind: secretProviderKind,
+    configured: z.boolean(),
+    enabled: z.boolean(),
+    /** Non-secret settings; `{}` when unconfigured. */
+    config: z.record(z.string(), z.unknown()),
+    hasCredential: z.boolean(),
+    lastTestedAt: z.string().nullable(),
+    lastTestError: z.string().nullable(),
+});
+//# sourceMappingURL=secretProviders.js.map

package/dist/secretProviders.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"secretProviders.js","sourceRoot":"","sources":["../src/secretProviders.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,eAAe,EAAE,MAAM,aAAa,CAAC;AAE9C,8EAA8E;AAC9E,6EAA6E;AAC7E,6EAA6E;AAC7E,+EAA+E;AAC/E,4EAA4E;AAC5E,4EAA4E;AAC5E,0EAA0E;AAE1E,wDAAwD;AACxD,MAAM,CAAC,MAAM,kBAAkB,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC,CAAC;AAG3D,8EAA8E;AAE9E;;;GAGG;AACH,MAAM,CAAC,MAAM,aAAa,GAAG,2EAA2E,CAAC;AACzG,0BAA0B;AAC1B,MAAM,CAAC,MAAM,cAAc,GAAG,mBAAmB,CAAC;AAClD,sCAAsC;AACtC,MAAM,CAAC,MAAM,gBAAgB,GAAG,+BAA+B,CAAC;AAChE,MAAM,CAAC,MAAM,aAAa,GAAG,6BAA6B,CAAC;AAC3D,MAAM,CAAC,MAAM,oBAAoB,GAAG,2BAA2B,CAAC;AAEhE,MAAM,CAAC,MAAM,SAAS,GAAG,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,KAAK,CAAC,aAAa,EAAE,oBAAoB,CAAC,CAAC;AACzF,MAAM,CAAC,MAAM,WAAW,GAAG,CAAC,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC,gBAAgB,EAAE,uBAAuB,CAAC,CAAC;AAEvF,8EAA8E;AAE9E,MAAM,CAAC,MAAM,eAAe,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC,OAAO,EAAE,SAAS,CAAC,CAAC,CAAC;AAG5D,MAAM,CAAC,MAAM,mBAAmB,GAAG,CAAC;KACjC,MAAM,CAAC;IACN,OAAO,EAAE,eAAe;IACxB,kEAAkE;IAClE,SAAS,EAAE,SAAS,CAAC,QAAQ,EAAE;IAC/B,KAAK,EAAE,SAAS,CAAC,OAAO,CAAC,QAAQ,CAAC;IAClC,UAAU,EAAE,eAAe;IAC3B,YAAY,EAAE,SAAS,CAAC,OAAO,CAAC,SAAS,CAAC;CAC3C,CAAC;KACD,MAAM,EAAE,CAAC;AAGZ,MAAM,WAAW,GAAG,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;AAEhD,MAAM,CAAC,MAAM,wBAAwB,GAAG,CAAC;KACtC,MAAM,CAAC;IACN,KAAK,EAAE,WAAW,CAAC,QAAQ,EAAE;IAC7B,MAAM,EAAE,WAAW,CAAC,QAAQ,EAAE;IAC9B,QAAQ,EAAE,WAAW,CAAC,QAAQ,EAAE;CACjC,CAAC;KACD,MAAM,EAAE,CAAC;AAGZ,+CAA+C;AAC/C,MAAM,CAAC,MAAM,gBAAgB,GAAG,CAAC;KAC9B,MAAM,CAAC;IACN,OAAO,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE;IAC/B,MAAM,EAAE,mBAAmB;IAC3B,WAAW,EAAE,wBAAwB,CAAC,QAAQ,EAAE;CACjD,CAAC;KACD,MAAM,EAAE;KACR,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC,UAAU,KAAK,OAAO,IAAI,CAAC,CAAC,CAAC,WAAW,EAAE,MAAM,KAAK,SAAS,IAAI,CAAC,CAAC,WAAW,EAAE,QAAQ,KAAK,SAAS,CAAC,EAAE;IAChI,OAAO,EAAE,oDAAoD;IAC7D,IAAI,EAAE,CAAC,aAAa,CAAC;CACtB,CAAC;KACD,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC,UAAU,KAAK,SAAS,IAAI,CAAC,CAAC,WAAW,EAAE,KAAK,KAAK,SAAS,EAAE;IACtF,OAAO,EAAE,qCAAqC;IAC9C,IAAI,EAAE,CAAC,aAAa,EAAE,OAAO,CAAC;CAC/B,CAAC,CAAC;AAGL,8EAA8E;AAE9E,MAAM,CAAC,MAAM,iBAAiB,GAAG,CAAC;KAC/B,MAAM,CAAC;IACN,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC,aAAa,EAAE,oBAAoB,CAAC;IAC7D,iDAAiD;IACjD,QAAQ,EAAE,eAAe,CAAC,QAAQ,EAAE;IACpC,OAAO,EAAE,CAAC;SACP,MAAM,EAAE;SACR,GAAG,CAAC,IAAI,CAAC;SACT,KAAK,CAAC,uDAAuD,EAAE,sBAAsB,CAAC;SACtF,QAAQ,EAAE;IACb,UAAU,EAAE,CAAC;SACV,MAAM,EAAE;SACR,GAAG,CAAC,CAAC,CAAC;SACN,GAAG,CAAC,IAAI,CAAC;SACT,KAAK,CAAC,iBAAiB,EAAE,qBAAqB,CAAC;SAC/C,QAAQ,EAAE;IACb,eAAe,EAAE,CAAC;SACf,MAAM,EAAE;SACR,KAAK,CAAC,oBAAoB,EAAE,2BAA2B,CAAC;SACxD,OAAO,CAAC,YAAY,CAAC;CACzB,CAAC;KACD,MAAM,EAAE;KACR,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,UAAU,KAAK,SAAS,IAAI,CAAC,CAAC,OAAO,KAAK,SAAS,EAAE;IACpE,OAAO,EAAE,0BAA0B;IACnC,IAAI,EAAE,CAAC,YAAY,CAAC;CACrB,CAAC,CAAC;AAGL,MAAM,CAAC,MAAM,sBAAsB,GAAG,CAAC;KACpC,MAAM,CAAC;IACN,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC,oBAAoB,EAAE,uBAAuB,CAAC,CAAC,QAAQ,EAAE;IACvF,eAAe,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,QAAQ,EAAE;IACtD,YAAY,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,QAAQ,EAAE;CACrD,CAAC;KACD,MAAM,EAAE,CAAC;AAGZ,6CAA6C;AAC7C,MAAM,CAAC,MAAM,cAAc,GAAG,CAAC;KAC5B,MAAM,CAAC;IACN,OAAO,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE;IAC/B,MAAM,EAAE,iBAAiB;IACzB,WAAW,EAAE,sBAAsB,CAAC,QAAQ,EAAE;CAC/C,CAAC;KACD,MAAM,EAAE,CAAC;AAGZ,8EAA8E;AAE9E,+EAA+E;AAC/E,MAAM,CAAC,MAAM,yBAAyB,GAAG,CAAC;KACvC,MAAM,CAAC;IACN,0DAA0D;IAC1D,SAAS,EAAE,SAAS,CAAC,QAAQ,EAAE;IAC/B,kCAAkC;IAClC,aAAa,EAAE,WAAW,CAAC,QAAQ,EAAE;CACtC,CAAC;KACD,MAAM,EAAE,CAAC;AAGZ,MAAM,CAAC,MAAM,wBAAwB,GAAG,CAAC,CAAC,MAAM,CAAC;IAC/C,EAAE,EAAE,CAAC,CAAC,OAAO,EAAE;IACf,uDAAuD;IACvD,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE;CACnB,CAAC,CAAC;AAGH,oFAAoF;AACpF,MAAM,CAAC,MAAM,kBAAkB,GAAG,CAAC,CAAC,MAAM,CAAC;IACzC,IAAI,EAAE,kBAAkB;IACxB,UAAU,EAAE,CAAC,CAAC,OAAO,EAAE;IACvB,OAAO,EAAE,CAAC,CAAC,OAAO,EAAE;IACpB,mDAAmD;IACnD,MAAM,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC;IACzC,aAAa,EAAE,CAAC,CAAC,OAAO,EAAE;IAC1B,YAAY,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IACnC,aAAa,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;CACrC,CAAC,CAAC"}

package/dist/secretScan.js

@@ -83,7 +83,7 @@ export const SECRET_PATTERNS = [
     {
         id: 'private-key',
         description: 'PEM private key block',
-        regex: /-----BEGIN [A-Z ]+PRIVATE KEY-----/,
+        regex: /-----BEGIN [A-Z ]*PRIVATE KEY-----/,
     },
     {
         id: 'jwt-bearer',

package/dist/service.d.ts

@@ -71,9 +71,6 @@ export type CreateService = z.infer<typeof createService>;
  * still applies `.default()` values for absent keys, which would silently
  * rewrite `type` back to 'docker' and `branch` to 'main' on every PATCH. */
 export declare const updateService: z.ZodObject<{
-    tagProjectIds: z.ZodOptional<z.ZodArray<z.ZodNumber>>;
-    tagWorkspaceIds: z.ZodOptional<z.ZodArray<z.ZodNumber>>;
-    tagLabelIds: z.ZodOptional<z.ZodArray<z.ZodNumber>>;
     name: z.ZodOptional<z.ZodString>;
     slug: z.ZodOptional<z.ZodString>;
     type: z.ZodOptional<z.ZodEnum<{
@@ -216,6 +213,8 @@ export declare const service: z.ZodObject<{
     updatedAt: z.ZodString;
 }, z.core.$strip>;
 export type Service = z.infer<typeof service>;
+/** r512: a registry host a `registry` credential may be sent to (`ghcr.io`, `registry.local:5000`). */
+export declare const registryHost: z.ZodString;
 export declare const createSource: z.ZodObject<{
     name: z.ZodString;
     type: z.ZodEnum<{
@@ -229,7 +228,9 @@ export declare const createSource: z.ZodObject<{
     token: z.ZodOptional<z.ZodString>;
     deployKey: z.ZodOptional<z.ZodString>;
     registryUsername: z.ZodOptional<z.ZodString>;
+    registryHosts: z.ZodOptional<z.ZodArray<z.ZodString>>;
     defaultBranch: z.ZodOptional<z.ZodString>;
+    baseUrl: z.ZodOptional<z.ZodPipe<z.ZodPipe<z.ZodString, z.ZodURL>, z.ZodTransform<string, string>>>;
 }, z.core.$strip>;
 export type CreateSourceInput = z.input<typeof createSource>;
 export declare const source: z.ZodObject<{
@@ -239,7 +240,16 @@ export declare const source: z.ZodObject<{
     hasToken: z.ZodBoolean;
     hasDeployKey: z.ZodBoolean;
     registryUsername: z.ZodOptional<z.ZodNullable<z.ZodString>>;
+    registryHosts: z.ZodOptional<z.ZodArray<z.ZodString>>;
     defaultBranch: z.ZodNullable<z.ZodString>;
+    baseUrl: z.ZodOptional<z.ZodNullable<z.ZodString>>;
+    allowOnNodes: z.ZodOptional<z.ZodBoolean>;
+    pinHostKeys: z.ZodOptional<z.ZodBoolean>;
+    pinnedHostKeys: z.ZodOptional<z.ZodArray<z.ZodObject<{
+        host: z.ZodString;
+        type: z.ZodString;
+        fingerprint: z.ZodNullable<z.ZodString>;
+    }, z.core.$strip>>>;
     createdAt: z.ZodString;
     updatedAt: z.ZodOptional<z.ZodString>;
 }, z.core.$strip>;
@@ -362,11 +372,6 @@ export declare const domain: z.ZodObject<{
     updatedAt: z.ZodString;
 }, z.core.$strip>;
 export type Domain = z.infer<typeof domain>;
-export declare const createWebhook: z.ZodObject<{
-    branch: z.ZodOptional<z.ZodString>;
-    watchPaths: z.ZodOptional<z.ZodString>;
-}, z.core.$strip>;
-export type CreateWebhookInput = z.input<typeof createWebhook>;
 export declare const webhook: z.ZodObject<{
     id: z.ZodNumber;
     branch: z.ZodString;
@@ -377,15 +382,17 @@ export declare const webhook: z.ZodObject<{
     createdAt: z.ZodString;
 }, z.core.$strip>;
 export type Webhook = z.infer<typeof webhook>;
-/** Returned once at creation time — the secret is never retrievable again. */
+/**
+ * Returned once at creation time — the secret is never retrievable again.
+ * r334: the create route answers id/branch/active/sourceId/url/secret only;
+ * `watchPaths` and `createdAt` come from `webhooks.list`.
+ */
 export declare const createdWebhook: z.ZodObject<{
     id: z.ZodNumber;
     branch: z.ZodString;
     active: z.ZodBoolean;
-    watchPaths: z.ZodString;
     sourceId: z.ZodOptional<z.ZodNullable<z.ZodNumber>>;
     url: z.ZodString;
-    createdAt: z.ZodString;
     secret: z.ZodString;
 }, z.core.$strip>;
 export type CreatedWebhook = z.infer<typeof createdWebhook>;
@@ -393,6 +400,8 @@ export declare const createDatabase: z.ZodObject<{
     name: z.ZodString;
     engine: z.ZodEnum<{
         clickhouse: "clickhouse";
+        dragonfly: "dragonfly";
+        keydb: "keydb";
         mariadb: "mariadb";
         meilisearch: "meilisearch";
         mongo: "mongo";
@@ -408,14 +417,9 @@ export declare const createDatabase: z.ZodObject<{
     existingVolume: z.ZodOptional<z.ZodString>;
     extensions: z.ZodOptional<z.ZodArray<z.ZodString>>;
     webGuiEnabled: z.ZodOptional<z.ZodBoolean>;
+    serverId: z.ZodOptional<z.ZodNullable<z.ZodNumber>>;
 }, z.core.$strip>;
 export type CreateDatabaseInput = z.input<typeof createDatabase>;
-export declare const databasePatch: z.ZodObject<{
-    name: z.ZodOptional<z.ZodString>;
-    extensions: z.ZodOptional<z.ZodArray<z.ZodString>>;
-    webGuiEnabled: z.ZodOptional<z.ZodBoolean>;
-}, z.core.$strip>;
-export type DatabasePatch = z.input<typeof databasePatch>;
 export declare const managedDatabase: z.ZodObject<{
     id: z.ZodNumber;
     projectId: z.ZodNullable<z.ZodNumber>;
@@ -437,6 +441,9 @@ export declare const managedDatabase: z.ZodObject<{
         name: z.ZodString;
         slug: z.ZodString;
     }, z.core.$strip>>>>;
+    serverId: z.ZodOptional<z.ZodNullable<z.ZodNumber>>;
+    serverName: z.ZodOptional<z.ZodNullable<z.ZodString>>;
+    reachable: z.ZodOptional<z.ZodNullable<z.ZodBoolean>>;
     createdAt: z.ZodString;
     updatedAt: z.ZodString;
 }, z.core.$strip>;

package/dist/service.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"service.d.ts","sourceRoot":"","sources":["../src/service.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAGxB,eAAO,MAAM,WAAW;;;;EAAuC,CAAC;AAChE,eAAO,MAAM,SAAS;;;;;;EAAmE,CAAC;AAK1F,eAAO,MAAM,aAAa;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;iBA0FxB,CAAC;AACH,MAAM,MAAM,aAAa,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,aAAa,CAAC,CAAC;AAE1D;;;4EAG4E;AAC5E,eAAO,MAAM,aAAa;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;iBA2DxB,CAAC;AACH,MAAM,MAAM,aAAa,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,aAAa,CAAC,CAAC;AAE1D,2EAA2E;AAC3E,MAAM,MAAM,kBAAkB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,aAAa,CAAC,CAAC;AAC/D,MAAM,MAAM,kBAAkB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,aAAa,CAAC,CAAC;AAE/D,eAAO,MAAM,OAAO;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;iBA8ElB,CAAC;AACH,MAAM,MAAM,OAAO,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,OAAO,CAAC,CAAC;AAG9C,eAAO,MAAM,YAAY;;;;;;;;;;;;;;iBAQvB,CAAC;AACH,MAAM,MAAM,iBAAiB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,YAAY,CAAC,CAAC;AAE7D,eAAO,MAAM,MAAM;;;;;;;;;;iBAUjB,CAAC;AACH,MAAM,MAAM,MAAM,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,MAAM,CAAC,CAAC;AAE5C,eAAO,MAAM,aAAa;;iBAExB,CAAC;AACH,MAAM,MAAM,aAAa,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,aAAa,CAAC,CAAC;AAE1D,eAAO,MAAM,UAAU;;;;;;;;;;;;;;;;;;iBAUrB,CAAC;AACH,MAAM,MAAM,UAAU,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,UAAU,CAAC,CAAC;AAEpD;;;;;;;GAOG;AACH,eAAO,MAAM,SAAS;;;;;;;;;;;;;;;;;iBAapB,CAAC;AACH,MAAM,MAAM,SAAS,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,SAAS,CAAC,CAAC;AAElD,eAAO,MAAM,aAAa;;;;;;;;;;;;;;;;;;;;;;;;;iBAQxB,CAAC;AACH,MAAM,MAAM,aAAa,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,aAAa,CAAC,CAAC;AAG1D,eAAO,MAAM,YAAY;;;;;;;;;;iBAiBvB,CAAC;AACH,MAAM,MAAM,iBAAiB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,YAAY,CAAC,CAAC;AAE7D,uDAAuD;AACvD,eAAO,MAAM,WAAW;;;;;;;;iBAQtB,CAAC;AACH,MAAM,MAAM,WAAW,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,WAAW,CAAC,CAAC;AAEtD,eAAO,MAAM,MAAM;;;;;;;;;;;;;;;iBAejB,CAAC;AACH,MAAM,MAAM,MAAM,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,MAAM,CAAC,CAAC;AAG5C,eAAO,MAAM,aAAa;;;iBAOxB,CAAC;AACH,MAAM,MAAM,kBAAkB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,aAAa,CAAC,CAAC;AAE/D,eAAO,MAAM,OAAO;;;;;;;;iBAQlB,CAAC;AACH,MAAM,MAAM,OAAO,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,OAAO,CAAC,CAAC;AAE9C,8EAA8E;AAC9E,eAAO,MAAM,cAAc;;;;;;;;;iBAAyC,CAAC;AACrE,MAAM,MAAM,cAAc,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,cAAc,CAAC,CAAC;AAG5D,eAAO,MAAM,cAAc;;;;;;;;;;;;;;;;;;;iBAWzB,CAAC;AACH,MAAM,MAAM,mBAAmB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,cAAc,CAAC,CAAC;AAEjE,eAAO,MAAM,aAAa;;;;iBAIxB,CAAC;AACH,MAAM,MAAM,aAAa,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,aAAa,CAAC,CAAC;AAE1D,eAAO,MAAM,eAAe;;;;;;;;;;;;;;;;;;;;;;;iBAmB1B,CAAC;AACH,MAAM,MAAM,eAAe,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,eAAe,CAAC,CAAC;AAE9D;;uEAEuE;AACvE,eAAO,MAAM,gBAAgB;;;;iBAI3B,CAAC;AACH,MAAM,MAAM,qBAAqB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,gBAAgB,CAAC,CAAC;AAErE,eAAO,MAAM,UAAU;;;;;;;;;iBAKrB,CAAC;AACH,MAAM,MAAM,UAAU,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,UAAU,CAAC,CAAC;AAGpD,eAAO,MAAM,YAAY;;;;;iBAKvB,CAAC;AACH,MAAM,MAAM,iBAAiB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,YAAY,CAAC,CAAC;AAE7D,4EAA4E;AAC5E,eAAO,MAAM,SAAS;;;;iBAIpB,CAAC;AACH,MAAM,MAAM,cAAc,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,SAAS,CAAC,CAAC;AAEvD,eAAO,MAAM,eAAe;;;;;;;iBAI1B,CAAC;AACH,MAAM,MAAM,eAAe,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,eAAe,CAAC,CAAC;AAE9D,eAAO,MAAM,MAAM;;;;;iBAKjB,CAAC;AACH,MAAM,MAAM,MAAM,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,MAAM,CAAC,CAAC;AAO5C;;;mBAGmB;AACnB,eAAO,MAAM,6BAA6B;;;;;;;iBAatC,CAAC;AACL,MAAM,MAAM,kCAAkC,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,6BAA6B,CAAC,CAAC;AAE/F,kFAAkF;AAClF,eAAO,MAAM,6BAA6B;;;iBAOtC,CAAC;AACL,MAAM,MAAM,kCAAkC,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,6BAA6B,CAAC,CAAC;AAE/F,2DAA2D;AAC3D,eAAO,MAAM,uBAAuB;;;;;;;;iBAQlC,CAAC;AACH,MAAM,MAAM,uBAAuB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,uBAAuB,CAAC,CAAC;AAG9E,eAAO,MAAM,SAAS;;;;iBAMpB,CAAC;AACH,MAAM,MAAM,cAAc,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,SAAS,CAAC,CAAC;AAGvD,eAAO,MAAM,QAAQ;;;;;;;iBAOnB,CAAC;AACH,MAAM,MAAM,QAAQ,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,QAAQ,CAAC,CAAC;AAEhD,eAAO,MAAM,aAAa;;;;;;;;;;;;iBASxB,CAAC;AACH,MAAM,MAAM,aAAa,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,aAAa,CAAC,CAAC;AAE1D,eAAO,MAAM,aAAa;;;;;;;;;;;;;;;;;;;;;;iBAGxB,CAAC;AACH,MAAM,MAAM,aAAa,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,aAAa,CAAC,CAAC;AAE1D,eAAO,MAAM,YAAY;;;;;;iBAGvB,CAAC;AACH,MAAM,MAAM,YAAY,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,YAAY,CAAC,CAAC;AAGxD,eAAO,MAAM,aAAa;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;iBA4BxB,CAAC;AACH,MAAM,MAAM,aAAa,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,aAAa,CAAC,CAAC;AAG1D,eAAO,MAAM,MAAM;;;;;;;;;;;;;iBAYjB,CAAC;AACH,MAAM,MAAM,MAAM,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,MAAM,CAAC,CAAC;AAE5C,eAAO,MAAM,YAAY;;;;;;;;;;;;;;iBAAyD,CAAC;AACnF,MAAM,MAAM,YAAY,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,YAAY,CAAC,CAAC;AAExD;oEACoE;AACpE,eAAO,MAAM,kBAAkB;;iBAE7B,CAAC;AACH,MAAM,MAAM,uBAAuB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,kBAAkB,CAAC,CAAC;AAGzE,eAAO,MAAM,eAAe;;;;;;;;;iBAS1B,CAAC;AACH,MAAM,MAAM,eAAe,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,eAAe,CAAC,CAAC;AAE9D,eAAO,MAAM,QAAQ;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;iBA+DnB,CAAC;AACH,MAAM,MAAM,QAAQ,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,QAAQ,CAAC,CAAC;AAEhD;;;;;;;GAOG;AACH,eAAO,MAAM,4BAA4B;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;iBAMvC,CAAC;AACH,MAAM,MAAM,sBAAsB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,4BAA4B,CAAC,CAAC;AAElF,eAAO,MAAM,iCAAiC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;iBAI5C,CAAC;AACH,MAAM,MAAM,2BAA2B,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,iCAAiC,CAAC,CAAC;AAE5F;;;;GAIG;AACH,eAAO,MAAM,cAAc;;;;;;;;;;;;;;;;iBAsBzB,CAAC;AACH,MAAM,MAAM,mBAAmB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,cAAc,CAAC,CAAC;AACjE,MAAM,MAAM,cAAc,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,cAAc,CAAC,CAAC;AAE5D;;;;;;GAMG;AACH,eAAO,MAAM,qBAAqB;;;iBAKhC,CAAC;AACH,MAAM,MAAM,0BAA0B,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,qBAAqB,CAAC,CAAC;AAE/E,eAAO,MAAM,sBAAsB;;;;;;;;;;;;iBAejC,CAAC;AACH,MAAM,MAAM,sBAAsB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,sBAAsB,CAAC,CAAC;AAE5E;;;;;GAKG;AACH,wBAAgB,mBAAmB,CAAC,aAAa,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,GAAG,OAAO,CASpF;AAGD,eAAO,MAAM,WAAW;;;;;;;;;;;;;iBAatB,CAAC;AACH,MAAM,MAAM,WAAW,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,WAAW,CAAC,CAAC;AAEtD,eAAO,MAAM,WAAW;;;;;;;;;;iBAMtB,CAAC;AACH,MAAM,MAAM,WAAW,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,WAAW,CAAC,CAAC;AAGtD,eAAO,MAAM,eAAe;;;;;;;;;iBAM1B,CAAC;AACH,MAAM,MAAM,eAAe,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,eAAe,CAAC,CAAC;AAE9D,eAAO,MAAM,eAAe;;;iBAK1B,CAAC;AACH,MAAM,MAAM,oBAAoB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,eAAe,CAAC,CAAC;AAEnE,eAAO,MAAM,gBAAgB;;iBAE3B,CAAC;AACH,MAAM,MAAM,qBAAqB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,gBAAgB,CAAC,CAAC;AAGrE,eAAO,MAAM,kBAAkB;;;;;;;;;iBAAkB,CAAC;AAClD,MAAM,MAAM,kBAAkB,GAAG,eAAe,CAAC;AAEjD,eAAO,MAAM,kBAAkB;;;iBAAkB,CAAC;AAClD,MAAM,MAAM,uBAAuB,GAAG,oBAAoB,CAAC;AAE3D,eAAO,MAAM,mBAAmB;;iBAAmB,CAAC;AACpD,MAAM,MAAM,wBAAwB,GAAG,qBAAqB,CAAC;AAG7D,eAAO,MAAM,eAAe;;;;;;;;;;;;;;;iBAM1B,CAAC;AACH,MAAM,MAAM,eAAe,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,eAAe,CAAC,CAAC;AAG9D,eAAO,MAAM,YAAY;;;iBAA2E,CAAC;AACrG,MAAM,MAAM,iBAAiB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,YAAY,CAAC,CAAC;AAE7D,eAAO,MAAM,WAAW;;;;;;;iBAOtB,CAAC;AACH,MAAM,MAAM,WAAW,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,WAAW,CAAC,CAAC;AAGtD,eAAO,MAAM,YAAY;;;;;;EAA0D,CAAC;AACpF,MAAM,MAAM,YAAY,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,YAAY,CAAC,CAAC;AAExD,eAAO,MAAM,cAAc;;;;EAAqC,CAAC;AACjE,MAAM,MAAM,cAAc,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,cAAc,CAAC,CAAC;AAE5D,eAAO,MAAM,QAAQ;;;;;;;;;;;;;;;;;;;;;;;iBAanB,CAAC;AACH,MAAM,MAAM,QAAQ,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,QAAQ,CAAC,CAAC;AAEhD,eAAO,MAAM,cAAc;;;;;;;;;;;;;;;;;;;iBASzB,CAAC;AACH,MAAM,MAAM,mBAAmB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,cAAc,CAAC,CAAC;AAEjE,eAAO,MAAM,cAAc;;;;;;;;;;;;;;;;;;;iBAA2B,CAAC;AACvD,MAAM,MAAM,mBAAmB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,cAAc,CAAC,CAAC;AAEjE,eAAO,MAAM,kBAAkB;;;;iBAI7B,CAAC;AACH,MAAM,MAAM,kBAAkB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,kBAAkB,CAAC,CAAC;AAGpE,eAAO,MAAM,eAAe;;;;;;;;iBAQ1B,CAAC;AACH,MAAM,MAAM,eAAe,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,eAAe,CAAC,CAAC;AAE9D,eAAO,MAAM,qBAAqB;;;;;;;;iBAA4B,CAAC;AAC/D,MAAM,MAAM,0BAA0B,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,qBAAqB,CAAC,CAAC;AAE/E,eAAO,MAAM,eAAe;;;;;;;;;;;;;iBAM1B,CAAC;AACH,MAAM,MAAM,eAAe,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,eAAe,CAAC,CAAC;AAE9D,eAAO,MAAM,kBAAkB;;;;;;;;;;iBAU7B,CAAC;AACH,MAAM,MAAM,kBAAkB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,kBAAkB,CAAC,CAAC"}
+{"version":3,"file":"service.d.ts","sourceRoot":"","sources":["../src/service.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAGxB,eAAO,MAAM,WAAW;;;;EAAuC,CAAC;AAChE,eAAO,MAAM,SAAS;;;;;;EAAmE,CAAC;AAK1F,eAAO,MAAM,aAAa;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;iBA0FxB,CAAC;AACH,MAAM,MAAM,aAAa,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,aAAa,CAAC,CAAC;AAE1D;;;4EAG4E;AAC5E,eAAO,MAAM,aAAa;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;iBAyDxB,CAAC;AACH,MAAM,MAAM,aAAa,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,aAAa,CAAC,CAAC;AAE1D,2EAA2E;AAC3E,MAAM,MAAM,kBAAkB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,aAAa,CAAC,CAAC;AAC/D,MAAM,MAAM,kBAAkB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,aAAa,CAAC,CAAC;AAE/D,eAAO,MAAM,OAAO;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;iBA8ElB,CAAC;AACH,MAAM,MAAM,OAAO,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,OAAO,CAAC,CAAC;AAG9C,uGAAuG;AACvG,eAAO,MAAM,YAAY,aAG0G,CAAC;AACpI,eAAO,MAAM,YAAY;;;;;;;;;;;;;;;;iBAgBvB,CAAC;AACH,MAAM,MAAM,iBAAiB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,YAAY,CAAC,CAAC;AAE7D,eAAO,MAAM,MAAM;;;;;;;;;;;;;;;;;;;iBAsBjB,CAAC;AACH,MAAM,MAAM,MAAM,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,MAAM,CAAC,CAAC;AAE5C,eAAO,MAAM,aAAa;;iBAQxB,CAAC;AACH,MAAM,MAAM,aAAa,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,aAAa,CAAC,CAAC;AAE1D,eAAO,MAAM,UAAU;;;;;;;;;;;;;;;;;;iBAUrB,CAAC;AACH,MAAM,MAAM,UAAU,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,UAAU,CAAC,CAAC;AAEpD;;;;;;;GAOG;AACH,eAAO,MAAM,SAAS;;;;;;;;;;;;;;;;;iBAapB,CAAC;AACH,MAAM,MAAM,SAAS,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,SAAS,CAAC,CAAC;AAElD,eAAO,MAAM,aAAa;;;;;;;;;;;;;;;;;;;;;;;;;iBAQxB,CAAC;AACH,MAAM,MAAM,aAAa,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,aAAa,CAAC,CAAC;AAG1D,eAAO,MAAM,YAAY;;;;;;;;;;iBAmBvB,CAAC;AACH,MAAM,MAAM,iBAAiB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,YAAY,CAAC,CAAC;AAE7D,uDAAuD;AACvD,eAAO,MAAM,WAAW;;;;;;;;iBAQtB,CAAC;AACH,MAAM,MAAM,WAAW,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,WAAW,CAAC,CAAC;AAEtD,eAAO,MAAM,MAAM;;;;;;;;;;;;;;;iBAejB,CAAC;AACH,MAAM,MAAM,MAAM,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,MAAM,CAAC,CAAC;AAQ5C,eAAO,MAAM,OAAO;;;;;;;;iBAQlB,CAAC;AACH,MAAM,MAAM,OAAO,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,OAAO,CAAC,CAAC;AAE9C;;;;GAIG;AACH,eAAO,MAAM,cAAc;;;;;;;iBAAqF,CAAC;AACjH,MAAM,MAAM,cAAc,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,cAAc,CAAC,CAAC;AAG5D,eAAO,MAAM,cAAc;;;;;;;;;;;;;;;;;;;;;;iBAiBzB,CAAC;AACH,MAAM,MAAM,mBAAmB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,cAAc,CAAC,CAAC;AAEjE,eAAO,MAAM,eAAe;;;;;;;;;;;;;;;;;;;;;;;;;;iBA2B1B,CAAC;AACH,MAAM,MAAM,eAAe,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,eAAe,CAAC,CAAC;AAE9D;;uEAEuE;AACvE,eAAO,MAAM,gBAAgB;;;;iBAI3B,CAAC;AACH,MAAM,MAAM,qBAAqB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,gBAAgB,CAAC,CAAC;AAErE,eAAO,MAAM,UAAU;;;;;;;;;iBAKrB,CAAC;AACH,MAAM,MAAM,UAAU,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,UAAU,CAAC,CAAC;AAGpD,eAAO,MAAM,YAAY;;;;;iBAOvB,CAAC;AACH,MAAM,MAAM,iBAAiB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,YAAY,CAAC,CAAC;AAE7D,4EAA4E;AAC5E,eAAO,MAAM,SAAS;;;;iBAIpB,CAAC;AACH,MAAM,MAAM,cAAc,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,SAAS,CAAC,CAAC;AAEvD,eAAO,MAAM,eAAe;;;;;;;iBAI1B,CAAC;AACH,MAAM,MAAM,eAAe,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,eAAe,CAAC,CAAC;AAE9D,eAAO,MAAM,MAAM;;;;;iBAKjB,CAAC;AACH,MAAM,MAAM,MAAM,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,MAAM,CAAC,CAAC;AAO5C;;;mBAGmB;AACnB,eAAO,MAAM,6BAA6B;;;;;;;iBAatC,CAAC;AACL,MAAM,MAAM,kCAAkC,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,6BAA6B,CAAC,CAAC;AAE/F,kFAAkF;AAClF,eAAO,MAAM,6BAA6B;;;iBAOtC,CAAC;AACL,MAAM,MAAM,kCAAkC,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,6BAA6B,CAAC,CAAC;AAE/F,2DAA2D;AAC3D,eAAO,MAAM,uBAAuB;;;;;;;;iBAQlC,CAAC;AACH,MAAM,MAAM,uBAAuB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,uBAAuB,CAAC,CAAC;AAG9E,eAAO,MAAM,SAAS;;;;iBAMpB,CAAC;AACH,MAAM,MAAM,cAAc,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,SAAS,CAAC,CAAC;AAGvD,eAAO,MAAM,QAAQ;;;;;;;iBAOnB,CAAC;AACH,MAAM,MAAM,QAAQ,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,QAAQ,CAAC,CAAC;AAEhD,eAAO,MAAM,aAAa;;;;;;;;;;;;iBASxB,CAAC;AACH,MAAM,MAAM,aAAa,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,aAAa,CAAC,CAAC;AAE1D,eAAO,MAAM,aAAa;;;;;;;;;;;;;;;;;;;;;;iBAGxB,CAAC;AACH,MAAM,MAAM,aAAa,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,aAAa,CAAC,CAAC;AAE1D,eAAO,MAAM,YAAY;;;;;;iBAGvB,CAAC;AACH,MAAM,MAAM,YAAY,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,YAAY,CAAC,CAAC;AAGxD,eAAO,MAAM,aAAa;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;iBA4BxB,CAAC;AACH,MAAM,MAAM,aAAa,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,aAAa,CAAC,CAAC;AAG1D,eAAO,MAAM,MAAM;;;;;;;;;;;;;iBAYjB,CAAC;AACH,MAAM,MAAM,MAAM,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,MAAM,CAAC,CAAC;AAE5C,eAAO,MAAM,YAAY;;;;;;;;;;;;;;iBAAyD,CAAC;AACnF,MAAM,MAAM,YAAY,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,YAAY,CAAC,CAAC;AAExD;oEACoE;AACpE,eAAO,MAAM,kBAAkB;;iBAE7B,CAAC;AACH,MAAM,MAAM,uBAAuB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,kBAAkB,CAAC,CAAC;AAGzE,eAAO,MAAM,eAAe;;;;;;;;;iBAS1B,CAAC;AACH,MAAM,MAAM,eAAe,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,eAAe,CAAC,CAAC;AAE9D,eAAO,MAAM,QAAQ;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;iBA+DnB,CAAC;AACH,MAAM,MAAM,QAAQ,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,QAAQ,CAAC,CAAC;AAEhD;;;;;;;GAOG;AACH,eAAO,MAAM,4BAA4B;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;iBAMvC,CAAC;AACH,MAAM,MAAM,sBAAsB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,4BAA4B,CAAC,CAAC;AAElF,eAAO,MAAM,iCAAiC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;iBAI5C,CAAC;AACH,MAAM,MAAM,2BAA2B,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,iCAAiC,CAAC,CAAC;AAE5F;;;;GAIG;AACH,eAAO,MAAM,cAAc;;;;;;;;;;;;;;;;iBAsBzB,CAAC;AACH,MAAM,MAAM,mBAAmB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,cAAc,CAAC,CAAC;AACjE,MAAM,MAAM,cAAc,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,cAAc,CAAC,CAAC;AAE5D;;;;;;GAMG;AACH,eAAO,MAAM,qBAAqB;;;iBAKhC,CAAC;AACH,MAAM,MAAM,0BAA0B,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,qBAAqB,CAAC,CAAC;AAE/E,eAAO,MAAM,sBAAsB;;;;;;;;;;;;iBAejC,CAAC;AACH,MAAM,MAAM,sBAAsB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,sBAAsB,CAAC,CAAC;AAE5E;;;;;GAKG;AACH,wBAAgB,mBAAmB,CAAC,aAAa,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,GAAG,OAAO,CASpF;AAGD,eAAO,MAAM,WAAW;;;;;;;;;;;;;iBAatB,CAAC;AACH,MAAM,MAAM,WAAW,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,WAAW,CAAC,CAAC;AAEtD,eAAO,MAAM,WAAW;;;;;;;;;;iBAMtB,CAAC;AACH,MAAM,MAAM,WAAW,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,WAAW,CAAC,CAAC;AAGtD,eAAO,MAAM,eAAe;;;;;;;;;iBAM1B,CAAC;AACH,MAAM,MAAM,eAAe,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,eAAe,CAAC,CAAC;AAE9D,eAAO,MAAM,eAAe;;;iBAQ1B,CAAC;AACH,MAAM,MAAM,oBAAoB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,eAAe,CAAC,CAAC;AAEnE,eAAO,MAAM,gBAAgB;;iBAE3B,CAAC;AACH,MAAM,MAAM,qBAAqB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,gBAAgB,CAAC,CAAC;AAGrE,eAAO,MAAM,kBAAkB;;;;;;;;;iBAAkB,CAAC;AAClD,MAAM,MAAM,kBAAkB,GAAG,eAAe,CAAC;AAEjD,eAAO,MAAM,kBAAkB;;;iBAAkB,CAAC;AAClD,MAAM,MAAM,uBAAuB,GAAG,oBAAoB,CAAC;AAE3D,eAAO,MAAM,mBAAmB;;iBAAmB,CAAC;AACpD,MAAM,MAAM,wBAAwB,GAAG,qBAAqB,CAAC;AAG7D,eAAO,MAAM,eAAe;;;;;;;;;;;;;;;iBAM1B,CAAC;AACH,MAAM,MAAM,eAAe,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,eAAe,CAAC,CAAC;AAG9D,eAAO,MAAM,YAAY;;;iBAA2E,CAAC;AACrG,MAAM,MAAM,iBAAiB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,YAAY,CAAC,CAAC;AAE7D,eAAO,MAAM,WAAW;;;;;;;iBAOtB,CAAC;AACH,MAAM,MAAM,WAAW,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,WAAW,CAAC,CAAC;AAGtD,eAAO,MAAM,YAAY;;;;;;EAA0D,CAAC;AACpF,MAAM,MAAM,YAAY,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,YAAY,CAAC,CAAC;AAExD,eAAO,MAAM,cAAc;;;;EAAqC,CAAC;AACjE,MAAM,MAAM,cAAc,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,cAAc,CAAC,CAAC;AAE5D,eAAO,MAAM,QAAQ;;;;;;;;;;;;;;;;;;;;;;;iBAanB,CAAC;AACH,MAAM,MAAM,QAAQ,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,QAAQ,CAAC,CAAC;AAEhD,eAAO,MAAM,cAAc;;;;;;;;;;;;;;;;;;;iBASzB,CAAC;AACH,MAAM,MAAM,mBAAmB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,cAAc,CAAC,CAAC;AAEjE,eAAO,MAAM,cAAc;;;;;;;;;;;;;;;;;;;iBAA2B,CAAC;AACvD,MAAM,MAAM,mBAAmB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,cAAc,CAAC,CAAC;AAEjE,eAAO,MAAM,kBAAkB;;;;iBAI7B,CAAC;AACH,MAAM,MAAM,kBAAkB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,kBAAkB,CAAC,CAAC;AAGpE,eAAO,MAAM,eAAe;;;;;;;;iBAQ1B,CAAC;AACH,MAAM,MAAM,eAAe,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,eAAe,CAAC,CAAC;AAE9D,eAAO,MAAM,qBAAqB;;;;;;;;iBAA4B,CAAC;AAC/D,MAAM,MAAM,0BAA0B,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,qBAAqB,CAAC,CAAC;AAE/E,eAAO,MAAM,eAAe;;;;;;;;;;;;;iBAM1B,CAAC;AACH,MAAM,MAAM,eAAe,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,eAAe,CAAC,CAAC;AAE9D,eAAO,MAAM,kBAAkB;;;;;;;;;;iBAU7B,CAAC;AACH,MAAM,MAAM,kBAAkB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,kBAAkB,CAAC,CAAC"}

package/dist/service.js

@@ -1,5 +1,5 @@
 import { z } from 'zod';
-import { containerPath, dockerVolumeName, envVarName, gitBranch, gitRepoUrl, httpPath, repoBaseDir, repoRelativePath, slug } from './common.js';
+import { containerPath, dockerVolumeName, envVarName, gitBranch, gitRepoUrl, httpPath, providerBaseUrl, repoBaseDir, repoRelativePath, slug } from './common.js';
 export const serviceType = z.enum(['pm2', 'docker', 'compose']);
 export const buildPack = z.enum(['auto', 'nixpacks', 'dockerfile', 'railpack', 'static']);
 /** Optional project/workspace/label tag IDs for new service creation. */
@@ -101,12 +101,10 @@ export const createService = z.object({
  * still applies `.default()` values for absent keys, which would silently
  * rewrite `type` back to 'docker' and `branch` to 'main' on every PATCH. */
 export const updateService = z.object({
-    // Tag updates are usually handled by `PUT /v1/services/:id/tags`; these
-    // convenience fields let a single PATCH reassign tags together with other
-    // service edits without an extra round-trip.
-    tagProjectIds: tagIds,
-    tagWorkspaceIds: tagIds,
-    tagLabelIds: tagIds,
+    // r335: no tag fields. Tags change only through `PUT /v1/services/:id/tags`
+    // (admin-gated, with the r156 foreign-link rules). The PATCH route used to
+    // accept tagProjectIds/tagWorkspaceIds/tagLabelIds here and then silently
+    // drop them; it now answers 400 `tags_via_put` when a body carries them.
     name: z.string().min(1).max(100).optional(),
     slug: slug.optional(),
     type: serviceType.optional(),
@@ -240,6 +238,11 @@ export const service = z.object({
     updatedAt: z.string().datetime(),
 });
 // ── Sources (private repo credentials) ─────────────────────────────────────
+/** r512: a registry host a `registry` credential may be sent to (`ghcr.io`, `registry.local:5000`). */
+export const registryHost = z
+    .string()
+    .max(255)
+    .regex(/^[A-Za-z0-9]([A-Za-z0-9.-]*[A-Za-z0-9])?(:\d{1,5})?$/, 'Expected a registry host such as ghcr.io or registry.local:5000');
 export const createSource = z.object({
     name: z.string().min(1).max(100),
     type: z.enum(['github', 'gitlab', 'gitea', 'bitbucket', 'custom', 'registry']),
@@ -247,7 +250,15 @@ export const createSource = z.object({
     deployKey: z.string().optional(),
     // Registry-type sources: username for `docker login` (token = password).
     registryUsername: z.string().max(255).optional(),
+    /** r512: registry hosts this credential may be sent to (Docker Hub = docker.io). */
+    registryHosts: z.array(registryHost).max(20).optional(),
     defaultBranch: z.string().optional(),
+    /**
+     * 0.13: self-hosted provider base (Gitea), e.g. `https://git.example.com`.
+     * The server refuses `http:` unless private egress is allowed.
+     * `github_app` is deliberately NOT in `type`: only installation sync creates those sources.
+     */
+    baseUrl: providerBaseUrl.optional(),
 });
 export const source = z.object({
     id: z.number().int(),
@@ -256,11 +267,29 @@ export const source = z.object({
     hasToken: z.boolean(),
     hasDeployKey: z.boolean(),
     registryUsername: z.string().nullable().optional(),
+    /** r512: hosts a registry credential is bound to (registry sources only). */
+    registryHosts: z.array(z.string()).optional(),
     defaultBranch: z.string().nullable(),
+    /** 0.13: self-hosted provider base URL (Gitea); null/absent = not set. */
+    baseUrl: z.string().nullable().optional(),
+    // ── 0.16 T8 surfaces ── multi-node (0.15.2, additive): this PAT or deploy key
+    // may be sent to a node for one clone. Absent on older panels.
+    allowOnNodes: z.boolean().optional(),
+    // ── end 0.16 T8 ──
+    /** 0.15.8: the panel pins this source's git host SSH keys (absent on older panels). */
+    pinHostKeys: z.boolean().optional(),
+    /** 0.15.8: what the pin holds, as fingerprints only. */
+    pinnedHostKeys: z.array(z.object({ host: z.string(), type: z.string(), fingerprint: z.string().nullable() })).optional(),
     createdAt: z.string().datetime(),
     updatedAt: z.string().datetime().optional(),
 });
 export const triggerDeploy = z.object({
+    /**
+     * @deprecated r334: IGNORED by `POST /v1/services/:id/deploys` — a manual
+     * trigger always builds the configured branch head. Pinning a commit here
+     * was never wired (the route reads no body). To redeploy an exact commit,
+     * use `deploys.promote` (another lane's running SHA) or `deploys.rollback`.
+     */
     commitSha: z.string().optional(),
 });
 export const deployment = z.object({
@@ -308,7 +337,9 @@ export const queueResponse = z.object({
 // ── Domains (Traefik routing) ─────────────────────────────────────────────
 export const createDomain = z.object({
     hostname: z.string().min(3).max(253),
-    path: z.string().default('/'),
+    // r473: aligned with the manifest's route.path rule — the consumer strips
+    // it downstream anyway, but the boundary should not depend on that.
+    path: z.string().min(1).max(200).regex(/^\/.*$/).default('/'),
     // Default matches the DB column default and the CLI (`ssl !== false`):
     // HTTPS everywhere unless explicitly disabled.
     ssl: z.boolean().default(true),
@@ -351,14 +382,10 @@ export const domain = z.object({
     updatedAt: z.string().datetime(),
 });
 // ── Webhooks (auto-deploy) ────────────────────────────────────────────────
-export const createWebhook = z.object({
-    branch: gitBranch.optional(),
-    /** Newline/comma-separated globs — deploy only when a changed file matches. */
-    watchPaths: z.string().max(1024).refine((raw) => {
-        const patterns = raw.split(/[\n,]/).map((pattern) => pattern.trim()).filter(Boolean);
-        return patterns.length <= 32 && patterns.every((pattern) => pattern.length <= 256 && (pattern.match(/\*\*/g) ?? []).length <= 4 && (pattern.match(/[?*]/g) ?? []).length <= 16);
-    }, 'watchPaths contains an unsafe glob pattern').optional(),
-});
+// Webhook CREATION is validated by `webhookCreate` in management.ts (the
+// route's schema). The former duplicate here (r473: `createWebhook`) was used
+// by no route and had drifted from the live one — removed rather than left
+// as a trap for someone "hardening" the wrong twin.
 export const webhook = z.object({
     id: z.number().int(),
     branch: z.string(),
@@ -368,12 +395,16 @@ export const webhook = z.object({
     url: z.string(),
     createdAt: z.string().datetime(),
 });
-/** Returned once at creation time — the secret is never retrievable again. */
-export const createdWebhook = webhook.extend({ secret: z.string() });
+/**
+ * Returned once at creation time — the secret is never retrievable again.
+ * r334: the create route answers id/branch/active/sourceId/url/secret only;
+ * `watchPaths` and `createdAt` come from `webhooks.list`.
+ */
+export const createdWebhook = webhook.omit({ watchPaths: true, createdAt: true }).extend({ secret: z.string() });
 // ── Managed databases ─────────────────────────────────────────────────────
 export const createDatabase = z.object({
     name: z.string().min(1).max(100),
-    engine: z.enum(['postgres', 'mysql', 'mariadb', 'redis', 'mongo', 'valkey', 'clickhouse', 'meilisearch', 'rabbitmq']),
+    engine: z.enum(['postgres', 'mysql', 'mariadb', 'redis', 'mongo', 'valkey', 'clickhouse', 'meilisearch', 'rabbitmq', 'keydb', 'dragonfly']),
     version: z.string().optional(),
     projectId: z.number().int().optional(),
     /** Hub/template provisioning is retryable: resume a matching database owned
@@ -382,11 +413,12 @@ export const createDatabase = z.object({
     existingVolume: z.string().optional(),
     extensions: z.array(z.string()).optional(),
     webGuiEnabled: z.boolean().optional(),
-});
-export const databasePatch = z.object({
-    name: z.string().min(1).max(100).optional(),
-    extensions: z.array(z.string()).optional(),
-    webGuiEnabled: z.boolean().optional(),
+    /**
+     * Multi-node (additive): the node to run the database on. null or absent =
+     * the panel host (today). Operator only when non-null; placement is fixed
+     * at create time.
+     */
+    serverId: z.number().int().positive().nullable().optional(),
 });
 export const managedDatabase = z.object({
     id: z.number().int(),
@@ -405,6 +437,14 @@ export const managedDatabase = z.object({
     webGuiPort: z.number().int().nullable().optional(),
     extensions: z.array(z.string()).optional().default([]),
     attachedServices: z.array(z.object({ id: z.number().int(), name: z.string(), slug: z.string() })).optional().default([]),
+    // ── 0.16 T8 surfaces: the node fields the 0.15.3 routes return (additive) ──
+    /** The node the database runs on; null = the panel host. Absent before 0.15.3. */
+    serverId: z.number().int().nullable().optional(),
+    /** That node's name; null for a panel-host database. */
+    serverName: z.string().nullable().optional(),
+    /** The node's last reachability probe; null for a panel-host database or a node not probed yet. */
+    reachable: z.boolean().nullable().optional(),
+    // ── end 0.16 T8 ──
     createdAt: z.string().datetime(),
     updatedAt: z.string().datetime(),
 });
@@ -425,7 +465,9 @@ export const attachment = z.object({
 // ── Environment variables ──────────────────────────────────────────────────
 export const upsertEnvVar = z.object({
     key: envVarName.max(100),
-    value: z.string(),
+    // r473: same 32 KB cap the Hub deployTemplate path applies — the sink
+    // escapes newlines either way, but the twins should not disagree.
+    value: z.string().max(32 * 1024),
     isSecret: z.boolean().optional(),
     overwriteExisting: z.boolean().optional(),
 });
@@ -770,7 +812,10 @@ export const volumeFileWrite = z.object({
     /** Relative path inside the volume. */
     path: z.string().min(1).max(1024),
     /** Base64-encoded file content (schemas validate; argv never sees it). */
-    contentBase64: z.string().max(8 * 1024 * 1024),
+    contentBase64: z.string().max(8 * 1024 * 1024).refine((value) => {
+        const compact = value.replace(/\s/g, '');
+        return compact.length % 4 === 0 && /^[A-Za-z0-9+/]*={0,2}$/.test(compact);
+    }, { message: 'must be valid base64 content' }),
 });
 export const volumePathCreate = z.object({
     path: z.string().min(1).max(1024),