@serve.zone/appstore 32.1.0 → 32.1.1

package/apps/cloudly/versions/1.2.0/config.json

@@ -159,8 +159,8 @@
     },
     "clientAuthenticationMethod": "client_secret_basic"
   },
-  "minOneboxVersion": "32.5.0",
-  "changelog": "Move Cloudly to 32.9.0. Startup migrates the data to 0.20.0, from 0.17.0 on Cloudly 32.2 or from 0.10.0 on the 1.1.10 image; the last three steps bind runtime sessions to their cluster, keep one service runtime target per service and cluster, and remove cluster relay registrations that name no authority, so a live relay registers again. Requires Onebox 32.5.0, completed Secrets v2 cutover retirement and a fresh verified restorable checkpoint. Preserve existing user and storage identities, OIDC bindings, the encrypted keyring and WorkloadInit approval as dedicated root-readable files. Rollback requires a full restore.",
+  "minOneboxVersion": "32.4.0",
+  "changelog": "Move Cloudly to 32.9.0. Startup migrates the data to 0.20.0, from 0.17.0 on Cloudly 32.2 or from 0.10.0 on the 1.1.10 image; the last three steps bind runtime sessions to their cluster, keep one service runtime target per service and cluster, and remove cluster relay registrations that name no authority, so a live relay registers again. Requires Onebox 32.4.0, completed Secrets v2 cutover retirement and a fresh verified restorable checkpoint. Preserve existing user and storage identities, OIDC bindings, the encrypted keyring and WorkloadInit approval as dedicated root-readable files. Rollback requires a full restore.",
   "breaking": true,
   "requiresManualReview": true,
   "migrationRequired": true,

package/changelog.md

@@ -1,5 +1,16 @@
 # Changelog
 
+## 2026-09-23 - 32.1.1
+
+### Fixes
+
+- require Onebox 32.4.0 for the Cloudly 1.2.0 template (cloudly)
+  - 32.1.0 set `minOneboxVersion` 32.5.0, the next Onebox release, which bundles the template. Onebox refuses a template whose `minOneboxVersion` is above its own version when it prepares an upgrade, so Onebox could not prepare or test the 1.1.10 to 1.2.0 upgrade before cutting that release. The 1.2.0 runtime contract is unchanged from 1.1.10, and Onebox 32.4.0 runs Cloudly 32 in production, so 32.4.0 is the lowest Onebox verified to support the template.
+
+### Maintenance
+
+- raise `@git.zone/tsbuild` to 4.6.0 (tooling)
+
 ## 2026-09-23 - 32.1.0
 
 ### Features

package/dist_ts_client/data.generated.js

@@ -1975,8 +1975,8 @@ export const appStorePackageData = {
                 },
                 "clientAuthenticationMethod": "client_secret_basic"
             },
-            "minOneboxVersion": "32.5.0",
-            "changelog": "Move Cloudly to 32.9.0. Startup migrates the data to 0.20.0, from 0.17.0 on Cloudly 32.2 or from 0.10.0 on the 1.1.10 image; the last three steps bind runtime sessions to their cluster, keep one service runtime target per service and cluster, and remove cluster relay registrations that name no authority, so a live relay registers again. Requires Onebox 32.5.0, completed Secrets v2 cutover retirement and a fresh verified restorable checkpoint. Preserve existing user and storage identities, OIDC bindings, the encrypted keyring and WorkloadInit approval as dedicated root-readable files. Rollback requires a full restore.",
+            "minOneboxVersion": "32.4.0",
+            "changelog": "Move Cloudly to 32.9.0. Startup migrates the data to 0.20.0, from 0.17.0 on Cloudly 32.2 or from 0.10.0 on the 1.1.10 image; the last three steps bind runtime sessions to their cluster, keep one service runtime target per service and cluster, and remove cluster relay registrations that name no authority, so a live relay registers again. Requires Onebox 32.4.0, completed Secrets v2 cutover retirement and a fresh verified restorable checkpoint. Preserve existing user and storage identities, OIDC bindings, the encrypted keyring and WorkloadInit approval as dedicated root-readable files. Rollback requires a full restore.",
             "breaking": true,
             "requiresManualReview": true,
             "migrationRequired": true,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@serve.zone/appstore",
-  "version": "32.1.0",
+  "version": "32.1.1",
   "private": false,
   "description": "serve.zone App Store metadata, parser, and resolver client.",
   "type": "module",
@@ -14,7 +14,7 @@
     "@serve.zone/interfaces": "32.3.0"
   },
   "devDependencies": {
-    "@git.zone/tsbuild": "^4.5.2",
+    "@git.zone/tsbuild": "^4.6.0",
     "@git.zone/tsdoc": "2.2.2",
     "@git.zone/tstest": "6.2.0",
     "@types/node": "26.6.1"

package/readme.md

@@ -64,7 +64,7 @@ Some templates ask Onebox to provision local platform services and inject connec
 
 | App ID | Requirements | Notes |
 | --- | --- | --- |
-| `cloudly` | MongoDB, S3 | Version `1.2.0` pins Cloudly `32.9.0` and requires Onebox `32.5.0`. Startup migrates the data to `0.20.0`, from `0.17.0` on Cloudly 32.2 or from `0.10.0` on the `1.1.10` image, while preserving the `1.1.10` runtime contract, existing user and storage identities, and OIDC bindings. Cluster relay registrations that name no authority are removed, so a live relay registers again. Both the existing Secrets v2 keyring and operator-approved WorkloadInit authority are required encrypted inputs delivered as separate root-owned `0400` files; the public environment contains only their fixed paths. Complete cutover retirement and verify a fresh restorable checkpoint before upgrading. Rollback remains full-restore-only. |
+| `cloudly` | MongoDB, S3 | Version `1.2.0` pins Cloudly `32.9.0` and requires Onebox `32.4.0`. Startup migrates the data to `0.20.0`, from `0.17.0` on Cloudly 32.2 or from `0.10.0` on the `1.1.10` image, while preserving the `1.1.10` runtime contract, existing user and storage identities, and OIDC bindings. Cluster relay registrations that name no authority are removed, so a live relay registers again. Both the existing Secrets v2 keyring and operator-approved WorkloadInit authority are required encrypted inputs delivered as separate root-owned `0400` files; the public environment contains only their fixed paths. Complete cutover retirement and verify a fresh restorable checkpoint before upgrading. Rollback remains full-restore-only. |
 | `ghost` | MariaDB | Uses MySQL-style `database__connection__*` environment variables. |
 | `gitea` | MariaDB | Uses Gitea database environment variables with `${MARIADB_*}` placeholders. |
 | `nextcloud` | MariaDB, Valkey | Uses MySQL-compatible database variables. Valkey is declared as a platform requirement. |

package/ts_client/data.generated.ts

@@ -1978,8 +1978,8 @@ export const appStorePackageData: IAppStorePackageData = {
         },
         "clientAuthenticationMethod": "client_secret_basic"
       },
-      "minOneboxVersion": "32.5.0",
-      "changelog": "Move Cloudly to 32.9.0. Startup migrates the data to 0.20.0, from 0.17.0 on Cloudly 32.2 or from 0.10.0 on the 1.1.10 image; the last three steps bind runtime sessions to their cluster, keep one service runtime target per service and cluster, and remove cluster relay registrations that name no authority, so a live relay registers again. Requires Onebox 32.5.0, completed Secrets v2 cutover retirement and a fresh verified restorable checkpoint. Preserve existing user and storage identities, OIDC bindings, the encrypted keyring and WorkloadInit approval as dedicated root-readable files. Rollback requires a full restore.",
+      "minOneboxVersion": "32.4.0",
+      "changelog": "Move Cloudly to 32.9.0. Startup migrates the data to 0.20.0, from 0.17.0 on Cloudly 32.2 or from 0.10.0 on the 1.1.10 image; the last three steps bind runtime sessions to their cluster, keep one service runtime target per service and cluster, and remove cluster relay registrations that name no authority, so a live relay registers again. Requires Onebox 32.4.0, completed Secrets v2 cutover retirement and a fresh verified restorable checkpoint. Preserve existing user and storage identities, OIDC bindings, the encrypted keyring and WorkloadInit approval as dedicated root-readable files. Rollback requires a full restore.",
       "breaking": true,
       "requiresManualReview": true,
       "migrationRequired": true,