@serve.zone/appstore 1.4.2 → 2.1.0

package/ts_client/data.generated.ts

@@ -34,11 +34,12 @@ export const appStorePackageData: IAppStorePackageData = {
       "description": "Multi-node serve.zone control plane for clusters, workload services, domains, and deployments.",
       "category": "Dev Tools",
       "iconName": "server",
-      "latestVersion": "1.1.1",
+      "latestVersion": "1.1.2",
       "versions": [
         "1.0.0",
         "1.1.0",
-        "1.1.1"
+        "1.1.1",
+        "1.1.2"
       ],
       "maintainer": "serve.zone",
       "links": {
@@ -421,6 +422,141 @@ export const appStorePackageData: IAppStorePackageData = {
       },
       "minOneboxVersion": "2.2.0"
     },
+    "apps/cloudly/versions/1.1.2/config.json": {
+      "image": "code.foss.global/serve.zone/cloudly@sha256:de503daed88b058d285bf0d7fd3fc21f1a4b8cd93a50aa1ec32fe92a38b43390",
+      "targetPorts": [
+        {
+          "name": "web",
+          "port": 3000,
+          "protocol": "http",
+          "default": true
+        }
+      ],
+      "envVars": [
+        {
+          "key": "SERVEZONE_ENVIRONMENT",
+          "value": "production",
+          "description": "Cloudly runtime environment.",
+          "required": true
+        },
+        {
+          "key": "SERVEZONE_PUBLIC_ORIGIN",
+          "value": "https://${SERVICE_DOMAIN}",
+          "description": "Canonical public Cloudly origin including protocol and optional public port.",
+          "required": true
+        },
+        {
+          "key": "SERVEZONE_LISTENPORT",
+          "value": "3000",
+          "description": "Internal Cloudly HTTP port inside the container.",
+          "required": true
+        },
+        {
+          "key": "SERVEZONE_SSLMODE",
+          "value": "external",
+          "description": "Use external TLS termination through Onebox or dcrouter.",
+          "required": true
+        },
+        {
+          "key": "MONGODB_URL",
+          "value": "${MONGODB_URI}",
+          "description": "Authenticated MongoDB wire-protocol URL provisioned by Onebox Corestore.",
+          "required": true
+        },
+        {
+          "key": "MONGODB_NAME",
+          "value": "${MONGODB_DATABASE}",
+          "description": "MongoDB wire-protocol database name provisioned by Onebox Corestore.",
+          "required": true
+        },
+        {
+          "key": "MONGODB_USER",
+          "value": "${MONGODB_USERNAME}",
+          "description": "MongoDB wire-protocol username provisioned by Onebox Corestore.",
+          "required": true
+        },
+        {
+          "key": "MONGODB_PASS",
+          "value": "${MONGODB_PASSWORD}",
+          "description": "MongoDB wire-protocol password provisioned by Onebox Corestore.",
+          "required": true
+        },
+        {
+          "key": "S3_ENDPOINT",
+          "value": "onebox-corestore",
+          "description": "S3 endpoint host provisioned by Onebox Corestore.",
+          "required": true
+        },
+        {
+          "key": "S3_PORT",
+          "value": "9000",
+          "description": "S3 endpoint port provisioned by Onebox Corestore.",
+          "required": true
+        },
+        {
+          "key": "S3_USESSL",
+          "value": "false",
+          "description": "Use plain HTTP for internal Corestore S3 traffic on the Onebox network.",
+          "required": true
+        },
+        {
+          "key": "S3_BUCKET",
+          "value": "${S3_BUCKET}",
+          "description": "S3 bucket provisioned by Onebox Corestore for Cloudly's registry.",
+          "required": true
+        },
+        {
+          "key": "S3_ACCESSKEY",
+          "value": "${S3_ACCESS_KEY}",
+          "description": "S3 access key provisioned by Onebox Corestore.",
+          "required": true
+        },
+        {
+          "key": "S3_SECRETKEY",
+          "value": "${S3_SECRET_KEY}",
+          "description": "S3 secret key provisioned by Onebox Corestore.",
+          "required": true
+        }
+      ],
+      "platformRequirements": {
+        "mongodb": true,
+        "s3": true
+      },
+      "platformOidc": {
+        "redirectPath": "/auth/oidc/callback",
+        "roles": [
+          {
+            "id": "admin",
+            "label": "Administrator",
+            "description": "Full Cloudly administration for this hosted instance."
+          },
+          {
+            "id": "user",
+            "label": "User",
+            "description": "Standard authenticated Cloudly access for this hosted instance."
+          }
+        ],
+        "environmentVariables": {
+          "issuerUrl": "SERVEZONE_PLATFORM_OIDC_ISSUER",
+          "clientId": "SERVEZONE_PLATFORM_OIDC_CLIENT_ID",
+          "clientSecret": "SERVEZONE_PLATFORM_OIDC_CLIENT_SECRET",
+          "redirectUri": "SERVEZONE_PLATFORM_OIDC_REDIRECT_URI",
+          "audience": "SERVEZONE_PLATFORM_OIDC_AUDIENCE"
+        },
+        "clientAuthenticationMethod": "client_secret_basic"
+      },
+      "minOneboxVersion": "7.1.0",
+      "changelog": "Upgrade Cloudly to 17.0.0 and run the Onebox-coordinated offline migration from legacy SecretGroup and SecretBundle persistence into the encrypted v2 secret runtime.",
+      "breaking": true,
+      "requiresManualReview": true,
+      "migrationRequired": true,
+      "backupBeforeUpgrade": true,
+      "healthCheck": {
+        "path": "/status",
+        "port": 3000,
+        "expectedStatus": 200
+      }
+    },
     "apps/ghost/app.json": {
       "id": "ghost",
       "name": "Ghost",
@@ -806,24 +942,22 @@ export const appStorePackageData: IAppStorePackageData = {
         },
         {
           "key": "BAO_STATIC_SEAL_KEY",
-          "description": "Cloudly generates 32 random bytes and stores them only in this service's secret bundle.",
+          "description": "Cloudly generates 32 random bytes and delivers them only to the OpenBao static-seal key file.",
           "required": true,
           "secret": true,
+          "delivery": {
+            "type": "file",
+            "targetPath": "/run/secrets/openbao-static-seal-key",
+            "uid": 100,
+            "gid": 1000,
+            "mode": 256
+          },
           "generate": {
-            "type": "randomHex",
+            "encoding": "hex",
             "bytes": 32
           }
         }
       ],
-      "secretFiles": [
-        {
-          "sourceKey": "BAO_STATIC_SEAL_KEY",
-          "targetPath": "/run/secrets/openbao-static-seal-key",
-          "uid": 100,
-          "gid": 1000,
-          "mode": 256
-        }
-      ],
       "volumes": [
         {
           "name": "openbao-data",
@@ -1244,7 +1378,7 @@ export const appStorePackageData: IAppStorePackageData = {
     },
     "appstore.json": {
       "schemaVersion": 1,
-      "updatedAt": "2026-07-25T00:00:00Z",
+      "updatedAt": "2026-08-04T00:00:00Z",
       "apps": [
         {
           "id": "nginx",
@@ -1452,7 +1586,7 @@ export const appStorePackageData: IAppStorePackageData = {
           "description": "Multi-node serve.zone control plane for clusters, workload services, domains, and deployments.",
           "category": "Dev Tools",
           "iconName": "server",
-          "latestVersion": "1.1.1",
+          "latestVersion": "1.1.2",
           "tags": [
             "serve.zone",
             "control-plane",

package/ts_client/storage.ts

@@ -11,7 +11,7 @@ const storageFeatureIds = interfaces.appstore.appStoreStorageFeatureIds;
 const knownStorageFeatureIds = new Set<string>(Object.values(storageFeatureIds));
 const storageClassKeyPattern = /^[A-Za-z][A-Za-z0-9-]{0,62}$/;
 const storageRequestIdPattern = /^[a-z][a-z0-9-]{0,62}$/;
-const environmentKeyPattern = /^[A-Za-z_][A-Za-z0-9_]*$/;
+const environmentKeyPattern = /^[A-Z_][A-Z0-9_]{0,252}$/;
 const capacityPattern = /^([1-9][0-9]*)(KiB|MiB|GiB|TiB)$/;
 const capacityMultipliers = {
   KiB: 1024n,
@@ -26,7 +26,6 @@ const appStoreVersionConfigKeys = [
   'image',
   'port',
   'containerArgs',
-  'secretFiles',
   'targetPorts',
   'domains',
   'publicPortMappings',
@@ -55,6 +54,12 @@ const appStoreVersionConfigKeys = [
 
 type TPlainRecord = Record<string, unknown>;
 
+interface IAppInputDestinations {
+  declaredEnvironmentKeys: Set<string>;
+  runtimeEnvironmentKeys: Set<string>;
+  declaredSecretPaths: Set<string>;
+}
+
 export function parseStorageCapacityQuantity(
   quantityArg: unknown,
   labelArg = 'storage capacity',
@@ -116,6 +121,78 @@ export function normalizeAppStoreStorageConfig(
   return normalized;
 }
 
+function collectAppInputDestinations(
+  configArg: TAppStoreVersionConfig,
+  labelArg: string,
+): IAppInputDestinations {
+  const declaredEnvironmentKeys = new Set<string>();
+  const runtimeEnvironmentOwners = new Map<string, string>();
+  const secretFileOwners = new Map<string, string>();
+
+  const addDestination = (
+    ownersArg: Map<string, string>,
+    destinationArg: string,
+    ownerArg: string,
+    kindArg: 'environment' | 'secret file',
+  ): void => {
+    const existingOwner = ownersArg.get(destinationArg);
+    if (existingOwner) {
+      throw new Error(
+        `Invalid ${labelArg}: ${kindArg} destination '${destinationArg}' is used by both ${existingOwner} and ${ownerArg}`,
+      );
+    }
+    ownersArg.set(destinationArg, ownerArg);
+  };
+
+  for (const declaration of configArg.envVars || []) {
+    declaredEnvironmentKeys.add(declaration.key);
+    const owner = `envVars.${declaration.key}`;
+    if (declaration.secret === true) {
+      if (declaration.delivery.type === 'launcher-environment') {
+        addDestination(
+          runtimeEnvironmentOwners,
+          declaration.delivery.variableName,
+          owner,
+          'environment',
+        );
+      } else {
+        addDestination(
+          secretFileOwners,
+          declaration.delivery.targetPath,
+          owner,
+          'secret file',
+        );
+      }
+    } else {
+      addDestination(runtimeEnvironmentOwners, declaration.key, owner, 'environment');
+    }
+  }
+
+  const platformOidc = configArg.platformOidc as unknown;
+  if (platformOidc && typeof platformOidc === 'object' && !Array.isArray(platformOidc)) {
+    const environmentVariables = (platformOidc as TPlainRecord).environmentVariables;
+    if (environmentVariables && typeof environmentVariables === 'object'
+      && !Array.isArray(environmentVariables)) {
+      for (const [field, destination] of Object.entries(environmentVariables)) {
+        if (typeof destination === 'string') {
+          addDestination(
+            runtimeEnvironmentOwners,
+            destination,
+            `platformOidc.${field}`,
+            'environment',
+          );
+        }
+      }
+    }
+  }
+
+  return {
+    declaredEnvironmentKeys,
+    runtimeEnvironmentKeys: new Set(runtimeEnvironmentOwners.keys()),
+    declaredSecretPaths: new Set(secretFileOwners.keys()),
+  };
+}
+
 function validateAndNormalizeStorageConfig(
   configArg: TAppStoreVersionConfig,
   labelArg: string,
@@ -125,6 +202,13 @@ function validateAndNormalizeStorageConfig(
     appStoreVersionConfigKeys,
     labelArg,
   );
+  const environmentErrors = interfaces.appstore.validateAppStoreEnvironmentDeclarations(
+    configArg.envVars,
+  );
+  if (environmentErrors.length > 0) {
+    throw new Error(`Invalid ${labelArg}: ${environmentErrors.join('; ')}`);
+  }
+  const appInputDestinations = collectAppInputDestinations(configArg, labelArg);
   validatePlatformRequirements(configArg.platformRequirements, labelArg);
   const explicitClassInput = configArg.storageClasses;
   const explicitRequestInput = configArg.storageRequests;
@@ -140,7 +224,7 @@ function validateAndNormalizeStorageConfig(
   const explicitRequests = validateExplicitStorageRequests(
     explicitRequestInput,
     storageClasses,
-    configArg,
+    appInputDestinations,
     labelArg,
   );
   const requiredFeatureIds = validateFeatureDeclaration(configArg, explicitRequests, labelArg);
@@ -227,7 +311,7 @@ function validateAndNormalizeStorageConfig(
       accessMode: 'readWrite',
       reclaimPolicy: 'retain',
       delivery: {
-        type: 'environment',
+        type: 'launcher-environment',
         keys: {
           endpoint: 'S3_ENDPOINT',
           bucket: 'S3_BUCKET',
@@ -247,10 +331,14 @@ function validateAndNormalizeStorageConfig(
     };
   }
 
-  validateAllFilesystemMountsAndSecretTargets(storageRequests, configArg, labelArg);
+  validateAllFilesystemMountsAndSecretTargets(
+    storageRequests,
+    appInputDestinations.declaredSecretPaths,
+    labelArg,
+  );
 
   return {
-    schemaVersion: 1,
+    schemaVersion: 2,
     storageClasses,
     storageRequests,
     requestOrigins: Object.fromEntries(requestOriginEntries),
@@ -290,7 +378,7 @@ function validateStorageClasses(
         if (preferred[requirementKey] !== undefined
           && preferred[requirementKey] !== required[requirementKey]) {
           throw new Error(
-            `Invalid ${classLabel}: preferred.${requirementKey} conflicts with required.${requirementKey}`,
+            `Invalid ${classLabel}: preferred.${String(requirementKey)} conflicts with required.${String(requirementKey)}`,
           );
         }
       }
@@ -349,7 +437,7 @@ function validateClassRequirement(
 function validateExplicitStorageRequests(
   requestsArg: TAppStoreVersionConfig['storageRequests'],
   classesArg: Record<string, interfaces.appstore.IAppStoreStorageClass>,
-  configArg: TAppStoreVersionConfig,
+  appInputDestinationsArg: IAppInputDestinations,
   labelArg: string,
 ): interfaces.appstore.TAppStoreStorageRequest[] {
   if (requestsArg === undefined) return [];
@@ -360,22 +448,12 @@ function validateExplicitStorageRequests(
   const requestIds = new Set<string>();
   const usedClassKeys = new Set<string>();
   const deliveryEnvironmentKeys = new Set<string>();
-  const declaredEnvironmentKeys = new Set<string>();
-  for (const envVar of configArg.envVars || []) {
-    declaredEnvironmentKeys.add(envVar.key);
-  }
-  for (const secretFile of configArg.secretFiles || []) {
-    declaredEnvironmentKeys.add(secretFile.sourceKey);
-  }
-  for (const oidcEnvironmentKey of Object.values(
-    configArg.platformOidc?.environmentVariables || {},
-  )) {
-    declaredEnvironmentKeys.add(oidcEnvironmentKey);
-  }
+  const {
+    declaredEnvironmentKeys,
+    runtimeEnvironmentKeys,
+    declaredSecretPaths,
+  } = appInputDestinationsArg;
   const deliverySecretPaths = new Set<string>();
-  const declaredSecretPaths = new Set((configArg.secretFiles || []).map(
-    (entryArg) => entryArg.targetPath,
-  ));
 
   const requests = requestsArg.map((candidateArg, indexArg) => {
     const requestLabel = `${labelArg} storageRequests[${indexArg}]`;
@@ -462,6 +540,7 @@ function validateExplicitStorageRequests(
       candidate.delivery,
       requestLabel,
       declaredEnvironmentKeys,
+      runtimeEnvironmentKeys,
       deliveryEnvironmentKeys,
       declaredSecretPaths,
       deliverySecretPaths,
@@ -552,13 +631,14 @@ function validateObjectStorageDelivery(
   deliveryArg: unknown,
   requestLabelArg: string,
   declaredEnvironmentKeysArg: Set<string>,
+  runtimeEnvironmentKeysArg: Set<string>,
   deliveryEnvironmentKeysArg: Set<string>,
   declaredSecretPathsArg: Set<string>,
   deliverySecretPathsArg: Set<string>,
 ): interfaces.platform.TObjectStorageDelivery {
   const deliveryLabel = `${requestLabelArg}.delivery`;
   const delivery = assertPlainRecord(deliveryArg, deliveryLabel);
-  if (delivery.type === 'environment') {
+  if (delivery.type === 'launcher-environment') {
     assertExactKeys(delivery, ['type', 'keys'], deliveryLabel);
     const keys = assertPlainRecord(delivery.keys, `${deliveryLabel}.keys`);
     assertExactKeys(keys, [
@@ -578,7 +658,8 @@ function validateObjectStorageDelivery(
       if (localKeys.has(targetKeyArg)) {
         throw new Error(`Invalid ${deliveryLabel}: environment key '${targetKeyArg}' is duplicated`);
       }
-      if (declaredEnvironmentKeysArg.has(targetKeyArg)) {
+      if (declaredEnvironmentKeysArg.has(targetKeyArg)
+        || runtimeEnvironmentKeysArg.has(targetKeyArg)) {
         throw new Error(
           `Invalid ${deliveryLabel}: environment key '${targetKeyArg}' collides with an app runtime input`,
         );
@@ -590,37 +671,49 @@ function validateObjectStorageDelivery(
       deliveryEnvironmentKeysArg.add(targetKeyArg);
     }
     return {
-      type: 'environment',
+      type: 'launcher-environment',
       keys: { ...keys },
-    } as interfaces.platform.IObjectStorageEnvironmentDelivery;
+    } as interfaces.platform.IObjectStorageLauncherEnvironmentDelivery;
   }
 
-  if (delivery.type === 'secretFile') {
-    assertExactKeys(delivery, ['type', 'targetPath', 'format'], deliveryLabel);
+  if (delivery.type === 'file') {
+    assertExactKeys(delivery, ['type', 'targetPath', 'format', 'uid', 'gid', 'mode'], deliveryLabel);
     if (delivery.format !== 'servezone-object-storage-v1') {
       throw new Error(`Invalid ${deliveryLabel}: secret file format is not supported`);
     }
     if (typeof delivery.targetPath !== 'string'
       || interfaces.data.normalizeServiceAbsolutePath(delivery.targetPath) !== delivery.targetPath
-      || !/^\/run\/secrets\/[A-Za-z0-9][A-Za-z0-9._-]{0,127}$/.test(delivery.targetPath)
-      || delivery.targetPath === '/run/secrets/secret.json') {
+      || !/^\/run\/secrets\/[A-Za-z0-9][A-Za-z0-9._-]{0,127}$/.test(delivery.targetPath)) {
       throw new Error(`Invalid ${deliveryLabel}: targetPath must be a unique canonical file below /run/secrets`);
     }
     if (declaredSecretPathsArg.has(delivery.targetPath)) {
-      throw new Error(`Invalid ${deliveryLabel}: targetPath collides with secretFiles`);
+      throw new Error(`Invalid ${deliveryLabel}: targetPath collides with an app secret delivery`);
     }
     if (deliverySecretPathsArg.has(delivery.targetPath)) {
       throw new Error(`Invalid ${deliveryLabel}: targetPath is used by another storage request`);
     }
+    for (const identityField of ['uid', 'gid'] as const) {
+      if (!Number.isSafeInteger(delivery[identityField])
+        || (delivery[identityField] as number) < 0
+        || (delivery[identityField] as number) > 2_147_483_647) {
+        throw new Error(`Invalid ${deliveryLabel}: ${identityField} must be a bounded numeric identity`);
+      }
+    }
+    if (delivery.mode !== 0o400 && delivery.mode !== 0o440) {
+      throw new Error(`Invalid ${deliveryLabel}: mode must be 0400 or 0440`);
+    }
     deliverySecretPathsArg.add(delivery.targetPath);
     return {
-      type: 'secretFile',
+      type: 'file',
       targetPath: delivery.targetPath,
       format: 'servezone-object-storage-v1',
+      uid: delivery.uid as number,
+      gid: delivery.gid as number,
+      mode: delivery.mode as 0o400 | 0o440,
     };
   }
 
-  throw new Error(`Invalid ${deliveryLabel}: type must be environment or secretFile`);
+  throw new Error(`Invalid ${deliveryLabel}: type must be launcher-environment or file`);
 }
 
 function validateFeatureDeclaration(
@@ -630,18 +723,18 @@ function validateFeatureDeclaration(
 ): TAppStoreStorageFeatureId[] {
   const requiredFeatures = new Set<TAppStoreStorageFeatureId>();
   if (explicitRequestsArg.length > 0) {
-    requiredFeatures.add(storageFeatureIds.bindingsV1);
+    requiredFeatures.add(storageFeatureIds.bindingsV2);
   }
   if (explicitRequestsArg.some((requestArg) => requestArg.kind === 'filesystem')) {
     requiredFeatures.add(storageFeatureIds.filesystemV1);
   }
   if (explicitRequestsArg.some((requestArg) => requestArg.kind === 'objectStorage')) {
-    requiredFeatures.add(storageFeatureIds.objectStorageV1);
+    requiredFeatures.add(storageFeatureIds.objectStorageV2);
   }
   if (explicitRequestsArg.some((requestArg) => (
-    requestArg.kind === 'objectStorage' && requestArg.delivery.type === 'secretFile'
+    requestArg.kind === 'objectStorage' && requestArg.delivery.type === 'file'
   ))) {
-    requiredFeatures.add(storageFeatureIds.objectStorageSecretFileV1);
+    requiredFeatures.add(storageFeatureIds.objectStorageFileV2);
   }
 
   const declaredFeatures = configArg.requiresFeatures || [];
@@ -757,7 +850,7 @@ function createLegacyVolumeRequestId(
 
 function validateAllFilesystemMountsAndSecretTargets(
   requestsArg: interfaces.appstore.TAppStoreStorageRequest[],
-  configArg: TAppStoreVersionConfig,
+  declaredSecretPathsArg: Set<string>,
   labelArg: string,
 ): void {
   const mountPaths: string[] = [];
@@ -766,22 +859,15 @@ function validateAllFilesystemMountsAndSecretTargets(
     if (requestArg.kind === 'filesystem') {
       assertNoPathCollision(requestArg.mountPath, mountPaths, `${labelArg} request '${requestArg.id}'`);
       mountPaths.push(requestArg.mountPath);
-    } else if (requestArg.delivery.type === 'secretFile') {
+    } else if (requestArg.delivery.type === 'file') {
       objectSecretPaths.push(requestArg.delivery.targetPath);
     }
   }
-  for (const secretPathArg of objectSecretPaths) {
+  for (const secretPathArg of [...declaredSecretPathsArg, ...objectSecretPaths]) {
     if (mountPaths.some((mountPathArg) => pathsOverlap(secretPathArg, mountPathArg))) {
-      throw new Error(`Invalid ${labelArg}: object-storage secret target '${secretPathArg}' overlaps a filesystem mount`);
+      throw new Error(`Invalid ${labelArg}: secret target '${secretPathArg}' overlaps a filesystem mount`);
     }
   }
-  const secretFileErrors = interfaces.data.validateServiceSecretFiles(
-    configArg.secretFiles,
-    mountPaths,
-  );
-  if (secretFileErrors.length > 0) {
-    throw new Error(`Invalid ${labelArg}: ${secretFileErrors.join('; ')}`);
-  }
 }
 
 function assertNoPathCollision(pathArg: string, pathsArg: string[], labelArg: string): void {

package/ts_client/types.ts

@@ -33,7 +33,7 @@ export interface IAppStoreStorageLegacyCompatibility {
 }
 
 export interface INormalizedAppStoreStorageConfig {
-  schemaVersion: 1;
+  schemaVersion: 2;
   storageClasses: Record<string, TAppStoreStorageClass>;
   storageRequests: TAppStoreStorageRequest[];
   requestOrigins: Record<string, TAppStoreStorageRequestOrigin>;