@serve.zone/appstore 2.6.0 → 2.8.0

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@serve.zone/appstore",
-  "version": "2.6.0",
+  "version": "2.8.0",
   "private": false,
   "description": "serve.zone App Store metadata, parser, and resolver client.",
   "type": "module",
@@ -15,9 +15,9 @@
   },
   "devDependencies": {
     "@git.zone/tsbuild": "^4.4.2",
-    "@git.zone/tsdoc": "^2.1.1",
+    "@git.zone/tsdoc": "2.2.0",
     "@git.zone/tstest": "^4.0.0",
-    "@types/node": "^26.4.1"
+    "@types/node": "26.4.0"
   },
   "files": [
     "apps/**/*",

package/readme.md

@@ -31,7 +31,7 @@ The App Store currently lists 21 app templates.
 | App ID | Name | App Store category | Image | Port |
 | --- | --- | --- | --- | --- |
 | `adminer` | Adminer | Dev Tools | `adminer:latest` | `8080` |
-| `cloudly` | Cloudly | Dev Tools | `code.foss.global/serve.zone/cloudly@sha256:948b72927d177b8f73be0596017df78437cbaa0e96b5f2ce246590aebbab05e9` | `3000` |
+| `cloudly` | Cloudly | Dev Tools | `code.foss.global/serve.zone/cloudly@sha256:2d5380d82e75e737ecf6701d50c9c4246998fde4252c32fc211af6619ae7b634` | `3000` |
 | `ghost` | Ghost | CMS | `ghost:latest` | `2368` |
 | `gitea` | Gitea | Dev Tools | `gitea/gitea:latest` | `3000` |
 | `gitops` | GitOps | Dev Tools | `code.foss.global/serve.zone/gitops:2.13.0` | `3000` |
@@ -58,7 +58,7 @@ Some templates ask Onebox to provision local platform services and inject connec
 
 | App ID | Requirements | Notes |
 | --- | --- | --- |
-| `cloudly` | MongoDB, S3 | Version `1.1.7` pins Cloudly `25.1.0` and requires Onebox `7.14.0`. The operator-approved WorkloadInit release authority is a required encrypted input delivered only as a root-readable file; the public environment contains its fixed file path, never its value. Onebox must complete its fenced retarget, zero-blocker diagnostics, allocation-fenced scratch rehearsal, receipt-bound production preparation, and mount verification before applying the held target. Rollback remains full-restore-only. |
+| `cloudly` | MongoDB, S3 | Version `1.1.9` pins Cloudly `25.3.0` and requires Onebox `8.3.3`. It adds scoped Corestore grant bootstrap and sealed credential publication while preserving the `1.1.8` runtime contract and existing storage identities. Both the existing Secrets v2 keyring and operator-approved WorkloadInit authority are required encrypted inputs delivered as separate root-owned `0400` files; the public environment contains only their fixed paths. Complete cutover retirement and verify a fresh restorable checkpoint before upgrading. Rollback remains full-restore-only. |
 | `ghost` | MariaDB | Uses MySQL-style `database__connection__*` environment variables. |
 | `gitea` | MariaDB | Uses Gitea database environment variables with `${MARIADB_*}` placeholders. |
 | `nextcloud` | MariaDB, Valkey | Uses MySQL-compatible database variables. Valkey is declared as a platform requirement. |

package/ts_client/data.generated.ts

@@ -34,7 +34,7 @@ export const appStorePackageData: IAppStorePackageData = {
       "description": "Multi-node serve.zone control plane for clusters, workload services, domains, and deployments.",
       "category": "Dev Tools",
       "iconName": "server",
-      "latestVersion": "1.1.7",
+      "latestVersion": "1.1.9",
       "versions": [
         "1.0.0",
         "1.1.0",
@@ -44,7 +44,9 @@ export const appStorePackageData: IAppStorePackageData = {
         "1.1.4",
         "1.1.5",
         "1.1.6",
-        "1.1.7"
+        "1.1.7",
+        "1.1.8",
+        "1.1.9"
       ],
       "maintainer": "serve.zone",
       "links": {
@@ -1294,6 +1296,352 @@ export const appStorePackageData: IAppStorePackageData = {
         "expectedStatus": 200
       }
     },
+    "apps/cloudly/versions/1.1.8/config.json": {
+      "image": "code.foss.global/serve.zone/cloudly@sha256:1ebfebd84d7b8d5a65aba7afda3481fce54d57999d2d9c0ec3716ee969bc47ed",
+      "targetPorts": [
+        {
+          "name": "web",
+          "port": 3000,
+          "protocol": "http",
+          "default": true
+        }
+      ],
+      "envVars": [
+        {
+          "key": "SERVEZONE_ENVIRONMENT",
+          "value": "production",
+          "description": "Cloudly runtime environment.",
+          "required": true
+        },
+        {
+          "key": "SERVEZONE_PUBLIC_ORIGIN",
+          "value": "https://${SERVICE_DOMAIN}",
+          "description": "Canonical public Cloudly origin including protocol and optional public port.",
+          "required": true
+        },
+        {
+          "key": "SERVEZONE_LISTENPORT",
+          "value": "3000",
+          "description": "Internal Cloudly HTTP port inside the container.",
+          "required": true
+        },
+        {
+          "key": "SERVEZONE_SSLMODE",
+          "value": "external",
+          "description": "Use external TLS termination through Onebox or dcrouter.",
+          "required": true
+        },
+        {
+          "key": "SERVEZONE_SECRET_KEYRING_PATH",
+          "value": "/run/secrets/cloudly-secrets-v2-keyring.json",
+          "description": "Path to the Cloudly Secrets v2 keyring mounted by Onebox; the keyring value is never placed in the public environment.",
+          "required": true
+        },
+        {
+          "key": "SERVEZONE_SECRET_KEYRING_FILE",
+          "description": "Existing Cloudly Secrets v2 keyring. Onebox stores it encrypted and mounts it only as a root-readable file; retain the existing keyring when upgrading.",
+          "required": true,
+          "secret": true,
+          "delivery": {
+            "type": "file",
+            "targetPath": "/run/secrets/cloudly-secrets-v2-keyring.json",
+            "uid": 0,
+            "gid": 0,
+            "mode": 256
+          }
+        },
+        {
+          "key": "SERVEZONE_WORKLOADINIT_APPROVAL_PATH",
+          "value": "/run/secrets/cloudly-workloadinit-approval.json",
+          "description": "Private WorkloadInit release-approval artifact mounted by Onebox for Coreflow secret-runtime registration.",
+          "required": true
+        },
+        {
+          "key": "SERVEZONE_WORKLOADINIT_APPROVAL_FILE",
+          "description": "Operator-approved WorkloadInit release authority. Onebox stores it encrypted and mounts it only as a root-readable file.",
+          "required": true,
+          "secret": true,
+          "delivery": {
+            "type": "file",
+            "targetPath": "/run/secrets/cloudly-workloadinit-approval.json",
+            "uid": 0,
+            "gid": 0,
+            "mode": 256
+          }
+        },
+        {
+          "key": "MONGODB_URL",
+          "value": "${MONGODB_URI}",
+          "description": "Authenticated MongoDB wire-protocol URL provisioned by Onebox Corestore.",
+          "required": true
+        },
+        {
+          "key": "MONGODB_NAME",
+          "value": "${MONGODB_DATABASE}",
+          "description": "MongoDB wire-protocol database name provisioned by Onebox Corestore.",
+          "required": true
+        },
+        {
+          "key": "MONGODB_USER",
+          "value": "${MONGODB_USERNAME}",
+          "description": "MongoDB wire-protocol username provisioned by Onebox Corestore.",
+          "required": true
+        },
+        {
+          "key": "MONGODB_PASS",
+          "value": "${MONGODB_PASSWORD}",
+          "description": "MongoDB wire-protocol password provisioned by Onebox Corestore.",
+          "required": true
+        },
+        {
+          "key": "S3_ENDPOINT",
+          "value": "onebox-corestore",
+          "description": "S3 endpoint host provisioned by Onebox Corestore.",
+          "required": true
+        },
+        {
+          "key": "S3_PORT",
+          "value": "9000",
+          "description": "S3 endpoint port provisioned by Onebox Corestore.",
+          "required": true
+        },
+        {
+          "key": "S3_USESSL",
+          "value": "false",
+          "description": "Use plain HTTP for internal Corestore S3 traffic on the Onebox network.",
+          "required": true
+        },
+        {
+          "key": "S3_BUCKET",
+          "value": "${S3_BUCKET}",
+          "description": "S3 bucket provisioned by Onebox Corestore for Cloudly's registry.",
+          "required": true
+        },
+        {
+          "key": "S3_ACCESSKEY",
+          "value": "${S3_ACCESS_KEY}",
+          "description": "S3 access key provisioned by Onebox Corestore.",
+          "required": true
+        },
+        {
+          "key": "S3_SECRETKEY",
+          "value": "${S3_SECRET_KEY}",
+          "description": "S3 secret key provisioned by Onebox Corestore.",
+          "required": true
+        }
+      ],
+      "platformRequirements": {
+        "mongodb": true,
+        "s3": true
+      },
+      "platformOidc": {
+        "redirectPath": "/auth/oidc/callback",
+        "roles": [
+          {
+            "id": "admin",
+            "label": "Administrator",
+            "description": "Full Cloudly administration for this hosted instance."
+          },
+          {
+            "id": "user",
+            "label": "User",
+            "description": "Standard authenticated Cloudly access for this hosted instance."
+          }
+        ],
+        "environmentVariables": {
+          "issuerUrl": "SERVEZONE_PLATFORM_OIDC_ISSUER",
+          "clientId": "SERVEZONE_PLATFORM_OIDC_CLIENT_ID",
+          "clientSecret": "SERVEZONE_PLATFORM_OIDC_CLIENT_SECRET",
+          "redirectUri": "SERVEZONE_PLATFORM_OIDC_REDIRECT_URI",
+          "audience": "SERVEZONE_PLATFORM_OIDC_AUDIENCE"
+        },
+        "clientAuthenticationMethod": "client_secret_basic"
+      },
+      "minOneboxVersion": "8.3.3",
+      "changelog": "Move Cloudly to 25.2.0 with ledger-backed startup migrations and authenticated legacy tombstone cleanup. Requires completed Secrets v2 cutover retirement and a fresh verified restorable checkpoint. Preserve the encrypted keyring and WorkloadInit approval as dedicated root-readable files. Rollback requires a full restore.",
+      "breaking": true,
+      "requiresManualReview": true,
+      "migrationRequired": true,
+      "backupBeforeUpgrade": true,
+      "healthCheck": {
+        "path": "/status",
+        "port": 3000,
+        "expectedStatus": 200
+      }
+    },
+    "apps/cloudly/versions/1.1.9/config.json": {
+      "image": "code.foss.global/serve.zone/cloudly@sha256:2d5380d82e75e737ecf6701d50c9c4246998fde4252c32fc211af6619ae7b634",
+      "targetPorts": [
+        {
+          "name": "web",
+          "port": 3000,
+          "protocol": "http",
+          "default": true
+        }
+      ],
+      "envVars": [
+        {
+          "key": "SERVEZONE_ENVIRONMENT",
+          "value": "production",
+          "description": "Cloudly runtime environment.",
+          "required": true
+        },
+        {
+          "key": "SERVEZONE_PUBLIC_ORIGIN",
+          "value": "https://${SERVICE_DOMAIN}",
+          "description": "Canonical public Cloudly origin including protocol and optional public port.",
+          "required": true
+        },
+        {
+          "key": "SERVEZONE_LISTENPORT",
+          "value": "3000",
+          "description": "Internal Cloudly HTTP port inside the container.",
+          "required": true
+        },
+        {
+          "key": "SERVEZONE_SSLMODE",
+          "value": "external",
+          "description": "Use external TLS termination through Onebox or dcrouter.",
+          "required": true
+        },
+        {
+          "key": "SERVEZONE_SECRET_KEYRING_PATH",
+          "value": "/run/secrets/cloudly-secrets-v2-keyring.json",
+          "description": "Path to the Cloudly Secrets v2 keyring mounted by Onebox; the keyring value is never placed in the public environment.",
+          "required": true
+        },
+        {
+          "key": "SERVEZONE_SECRET_KEYRING_FILE",
+          "description": "Existing Cloudly Secrets v2 keyring. Onebox stores it encrypted and mounts it only as a root-readable file; retain the existing keyring when upgrading.",
+          "required": true,
+          "secret": true,
+          "delivery": {
+            "type": "file",
+            "targetPath": "/run/secrets/cloudly-secrets-v2-keyring.json",
+            "uid": 0,
+            "gid": 0,
+            "mode": 256
+          }
+        },
+        {
+          "key": "SERVEZONE_WORKLOADINIT_APPROVAL_PATH",
+          "value": "/run/secrets/cloudly-workloadinit-approval.json",
+          "description": "Private WorkloadInit release-approval artifact mounted by Onebox for Coreflow secret-runtime registration.",
+          "required": true
+        },
+        {
+          "key": "SERVEZONE_WORKLOADINIT_APPROVAL_FILE",
+          "description": "Operator-approved WorkloadInit release authority. Onebox stores it encrypted and mounts it only as a root-readable file.",
+          "required": true,
+          "secret": true,
+          "delivery": {
+            "type": "file",
+            "targetPath": "/run/secrets/cloudly-workloadinit-approval.json",
+            "uid": 0,
+            "gid": 0,
+            "mode": 256
+          }
+        },
+        {
+          "key": "MONGODB_URL",
+          "value": "${MONGODB_URI}",
+          "description": "Authenticated MongoDB wire-protocol URL provisioned by Onebox Corestore.",
+          "required": true
+        },
+        {
+          "key": "MONGODB_NAME",
+          "value": "${MONGODB_DATABASE}",
+          "description": "MongoDB wire-protocol database name provisioned by Onebox Corestore.",
+          "required": true
+        },
+        {
+          "key": "MONGODB_USER",
+          "value": "${MONGODB_USERNAME}",
+          "description": "MongoDB wire-protocol username provisioned by Onebox Corestore.",
+          "required": true
+        },
+        {
+          "key": "MONGODB_PASS",
+          "value": "${MONGODB_PASSWORD}",
+          "description": "MongoDB wire-protocol password provisioned by Onebox Corestore.",
+          "required": true
+        },
+        {
+          "key": "S3_ENDPOINT",
+          "value": "onebox-corestore",
+          "description": "S3 endpoint host provisioned by Onebox Corestore.",
+          "required": true
+        },
+        {
+          "key": "S3_PORT",
+          "value": "9000",
+          "description": "S3 endpoint port provisioned by Onebox Corestore.",
+          "required": true
+        },
+        {
+          "key": "S3_USESSL",
+          "value": "false",
+          "description": "Use plain HTTP for internal Corestore S3 traffic on the Onebox network.",
+          "required": true
+        },
+        {
+          "key": "S3_BUCKET",
+          "value": "${S3_BUCKET}",
+          "description": "S3 bucket provisioned by Onebox Corestore for Cloudly's registry.",
+          "required": true
+        },
+        {
+          "key": "S3_ACCESSKEY",
+          "value": "${S3_ACCESS_KEY}",
+          "description": "S3 access key provisioned by Onebox Corestore.",
+          "required": true
+        },
+        {
+          "key": "S3_SECRETKEY",
+          "value": "${S3_SECRET_KEY}",
+          "description": "S3 secret key provisioned by Onebox Corestore.",
+          "required": true
+        }
+      ],
+      "platformRequirements": {
+        "mongodb": true,
+        "s3": true
+      },
+      "platformOidc": {
+        "redirectPath": "/auth/oidc/callback",
+        "roles": [
+          {
+            "id": "admin",
+            "label": "Administrator",
+            "description": "Full Cloudly administration for this hosted instance."
+          },
+          {
+            "id": "user",
+            "label": "User",
+            "description": "Standard authenticated Cloudly access for this hosted instance."
+          }
+        ],
+        "environmentVariables": {
+          "issuerUrl": "SERVEZONE_PLATFORM_OIDC_ISSUER",
+          "clientId": "SERVEZONE_PLATFORM_OIDC_CLIENT_ID",
+          "clientSecret": "SERVEZONE_PLATFORM_OIDC_CLIENT_SECRET",
+          "redirectUri": "SERVEZONE_PLATFORM_OIDC_REDIRECT_URI",
+          "audience": "SERVEZONE_PLATFORM_OIDC_AUDIENCE"
+        },
+        "clientAuthenticationMethod": "client_secret_basic"
+      },
+      "minOneboxVersion": "8.3.3",
+      "changelog": "Move Cloudly to 25.3.0 with scoped Corestore grant bootstrap and sealed credential publication. Requires completed Secrets v2 cutover retirement and a fresh verified restorable checkpoint. Preserve existing storage identities, the encrypted keyring and WorkloadInit approval as dedicated root-readable files. Rollback requires a full restore.",
+      "breaking": true,
+      "requiresManualReview": true,
+      "migrationRequired": true,
+      "backupBeforeUpgrade": true,
+      "healthCheck": {
+        "path": "/status",
+        "port": 3000,
+        "expectedStatus": 200
+      }
+    },
     "apps/ghost/app.json": {
       "id": "ghost",
       "name": "Ghost",
@@ -2115,7 +2463,7 @@ export const appStorePackageData: IAppStorePackageData = {
     },
     "appstore.json": {
       "schemaVersion": 1,
-      "updatedAt": "2026-09-02T00:00:00Z",
+      "updatedAt": "2026-09-07T00:00:00Z",
       "apps": [
         {
           "id": "nginx",
@@ -2323,7 +2671,7 @@ export const appStorePackageData: IAppStorePackageData = {
           "description": "Multi-node serve.zone control plane for clusters, workload services, domains, and deployments.",
           "category": "Dev Tools",
           "iconName": "server",
-          "latestVersion": "1.1.7",
+          "latestVersion": "1.1.9",
           "tags": [
             "serve.zone",
             "control-plane",