@serve.zone/appstore 32.1.1 → 32.3.0

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@serve.zone/appstore",
-  "version": "32.1.1",
+  "version": "32.3.0",
   "private": false,
   "description": "serve.zone App Store metadata, parser, and resolver client.",
   "type": "module",
@@ -14,10 +14,10 @@
     "@serve.zone/interfaces": "32.3.0"
   },
   "devDependencies": {
-    "@git.zone/tsbuild": "^4.6.0",
+    "@git.zone/tsbuild": "^5.0.0",
     "@git.zone/tsdoc": "2.2.2",
-    "@git.zone/tstest": "6.2.0",
-    "@types/node": "26.6.1"
+    "@git.zone/tstest": "6.3.0",
+    "@types/node": "26.6.2"
   },
   "files": [
     "apps/**/*",

package/readme.md

@@ -33,7 +33,7 @@ The App Store currently lists 21 app templates.
 | App ID | Name | App Store category | Image | Port |
 | --- | --- | --- | --- | --- |
 | `adminer` | Adminer | Dev Tools | `adminer:latest` | `8080` |
-| `cloudly` | Cloudly | Dev Tools | `code.foss.global/serve.zone/cloudly@sha256:9731dcf7d56567235017008994a00b2a4eeb7fd64a7d801bee0933fd6eede007` | `3000` |
+| `cloudly` | Cloudly | Dev Tools | `code.foss.global/serve.zone/cloudly@sha256:26a7469181059aca2a5505d2f86e8f6286ebc0b1e0dee0df2262bfe3df2d1f06` | `3000` |
 | `ghost` | Ghost | CMS | `ghost:latest` | `2368` |
 | `gitea` | Gitea | Dev Tools | `gitea/gitea:latest` | `3000` |
 | `gitops` | GitOps | Dev Tools | `code.foss.global/serve.zone/gitops:2.13.0` | `3000` |
@@ -64,7 +64,7 @@ Some templates ask Onebox to provision local platform services and inject connec
 
 | App ID | Requirements | Notes |
 | --- | --- | --- |
-| `cloudly` | MongoDB, S3 | Version `1.2.0` pins Cloudly `32.9.0` and requires Onebox `32.4.0`. Startup migrates the data to `0.20.0`, from `0.17.0` on Cloudly 32.2 or from `0.10.0` on the `1.1.10` image, while preserving the `1.1.10` runtime contract, existing user and storage identities, and OIDC bindings. Cluster relay registrations that name no authority are removed, so a live relay registers again. Both the existing Secrets v2 keyring and operator-approved WorkloadInit authority are required encrypted inputs delivered as separate root-owned `0400` files; the public environment contains only their fixed paths. Complete cutover retirement and verify a fresh restorable checkpoint before upgrading. Rollback remains full-restore-only. |
+| `cloudly` | MongoDB, S3 | Version `1.3.0` pins Cloudly `33.0.0` and requires Onebox `32.4.0`. It keeps the `1.2.1` runtime contract and is breaking: startup migrates the data from `0.20.0` to `0.21.0`, dropping the relay certificate and DNS collections of Cloudly's retired Cloudflare and Let's Encrypt integration and logging every relay name whose A record Cloudly had written at Cloudflare, which the operator removes at the provider. dcrouter holds every cluster relay name's A record and certificate from then on, `SERVEZONE_SSLMODE=letsencrypt` is refused, and the typed API changes as the Cloudly 33.0.0 changelog lists. Stop Cloudly and take a verified backup before upgrading; rollback is full-restore-only. From `1.1.10` or earlier, startup first runs the `1.2.0` steps from `0.10.0` and needs completed Secrets v2 cutover retirement. Both the existing Secrets v2 keyring and operator-approved WorkloadInit authority are required encrypted inputs delivered as separate root-owned `0400` files; the public environment contains only their fixed paths. |
 | `ghost` | MariaDB | Uses MySQL-style `database__connection__*` environment variables. |
 | `gitea` | MariaDB | Uses Gitea database environment variables with `${MARIADB_*}` placeholders. |
 | `nextcloud` | MariaDB, Valkey | Uses MySQL-compatible database variables. Valkey is declared as a platform requirement. |

package/ts_client/data.generated.ts

@@ -34,7 +34,7 @@ export const appStorePackageData: IAppStorePackageData = {
       "description": "Multi-node serve.zone control plane for clusters, workload services, domains, and deployments.",
       "category": "Dev Tools",
       "iconName": "server",
-      "latestVersion": "1.2.0",
+      "latestVersion": "1.3.0",
       "versions": [
         "1.0.0",
         "1.1.0",
@@ -48,7 +48,9 @@ export const appStorePackageData: IAppStorePackageData = {
         "1.1.8",
         "1.1.9",
         "1.1.10",
-        "1.2.0"
+        "1.2.0",
+        "1.2.1",
+        "1.3.0"
       ],
       "maintainer": "serve.zone",
       "links": {
@@ -1990,6 +1992,352 @@ export const appStorePackageData: IAppStorePackageData = {
         "expectedStatus": 200
       }
     },
+    "apps/cloudly/versions/1.2.1/config.json": {
+      "image": "code.foss.global/serve.zone/cloudly@sha256:f0da8c0ef826d2e044aa49ec1b59533f7be16c372357dbf818fe488ccdc5b0c9",
+      "targetPorts": [
+        {
+          "name": "web",
+          "port": 3000,
+          "protocol": "http",
+          "default": true
+        }
+      ],
+      "envVars": [
+        {
+          "key": "SERVEZONE_ENVIRONMENT",
+          "value": "production",
+          "description": "Cloudly runtime environment.",
+          "required": true
+        },
+        {
+          "key": "SERVEZONE_PUBLIC_ORIGIN",
+          "value": "https://${SERVICE_DOMAIN}",
+          "description": "Canonical public Cloudly origin including protocol and optional public port.",
+          "required": true
+        },
+        {
+          "key": "SERVEZONE_LISTENPORT",
+          "value": "3000",
+          "description": "Internal Cloudly HTTP port inside the container.",
+          "required": true
+        },
+        {
+          "key": "SERVEZONE_SSLMODE",
+          "value": "external",
+          "description": "Use external TLS termination through Onebox or dcrouter.",
+          "required": true
+        },
+        {
+          "key": "SERVEZONE_SECRET_KEYRING_PATH",
+          "value": "/run/secrets/cloudly-secrets-v2-keyring.json",
+          "description": "Path to the Cloudly Secrets v2 keyring mounted by Onebox; the keyring value is never placed in the public environment.",
+          "required": true
+        },
+        {
+          "key": "SERVEZONE_SECRET_KEYRING_FILE",
+          "description": "Existing Cloudly Secrets v2 keyring. Onebox stores it encrypted and mounts it only as a root-readable file; retain the existing keyring when upgrading.",
+          "required": true,
+          "secret": true,
+          "delivery": {
+            "type": "file",
+            "targetPath": "/run/secrets/cloudly-secrets-v2-keyring.json",
+            "uid": 0,
+            "gid": 0,
+            "mode": 256
+          }
+        },
+        {
+          "key": "SERVEZONE_WORKLOADINIT_APPROVAL_PATH",
+          "value": "/run/secrets/cloudly-workloadinit-approval.json",
+          "description": "Private WorkloadInit release-approval artifact mounted by Onebox for Coreflow secret-runtime registration.",
+          "required": true
+        },
+        {
+          "key": "SERVEZONE_WORKLOADINIT_APPROVAL_FILE",
+          "description": "Operator-approved WorkloadInit release authority. Onebox stores it encrypted and mounts it only as a root-readable file.",
+          "required": true,
+          "secret": true,
+          "delivery": {
+            "type": "file",
+            "targetPath": "/run/secrets/cloudly-workloadinit-approval.json",
+            "uid": 0,
+            "gid": 0,
+            "mode": 256
+          }
+        },
+        {
+          "key": "MONGODB_URL",
+          "value": "${MONGODB_URI}",
+          "description": "Authenticated MongoDB wire-protocol URL provisioned by Onebox Corestore.",
+          "required": true
+        },
+        {
+          "key": "MONGODB_NAME",
+          "value": "${MONGODB_DATABASE}",
+          "description": "MongoDB wire-protocol database name provisioned by Onebox Corestore.",
+          "required": true
+        },
+        {
+          "key": "MONGODB_USER",
+          "value": "${MONGODB_USERNAME}",
+          "description": "MongoDB wire-protocol username provisioned by Onebox Corestore.",
+          "required": true
+        },
+        {
+          "key": "MONGODB_PASS",
+          "value": "${MONGODB_PASSWORD}",
+          "description": "MongoDB wire-protocol password provisioned by Onebox Corestore.",
+          "required": true
+        },
+        {
+          "key": "S3_ENDPOINT",
+          "value": "onebox-corestore",
+          "description": "S3 endpoint host provisioned by Onebox Corestore.",
+          "required": true
+        },
+        {
+          "key": "S3_PORT",
+          "value": "9000",
+          "description": "S3 endpoint port provisioned by Onebox Corestore.",
+          "required": true
+        },
+        {
+          "key": "S3_USESSL",
+          "value": "false",
+          "description": "Use plain HTTP for internal Corestore S3 traffic on the Onebox network.",
+          "required": true
+        },
+        {
+          "key": "S3_BUCKET",
+          "value": "${S3_BUCKET}",
+          "description": "S3 bucket provisioned by Onebox Corestore for Cloudly's registry.",
+          "required": true
+        },
+        {
+          "key": "S3_ACCESSKEY",
+          "value": "${S3_ACCESS_KEY}",
+          "description": "S3 access key provisioned by Onebox Corestore.",
+          "required": true
+        },
+        {
+          "key": "S3_SECRETKEY",
+          "value": "${S3_SECRET_KEY}",
+          "description": "S3 secret key provisioned by Onebox Corestore.",
+          "required": true
+        }
+      ],
+      "platformRequirements": {
+        "mongodb": true,
+        "s3": true
+      },
+      "platformOidc": {
+        "redirectPath": "/auth/oidc/callback",
+        "roles": [
+          {
+            "id": "admin",
+            "label": "Administrator",
+            "description": "Full Cloudly administration for this hosted instance."
+          },
+          {
+            "id": "user",
+            "label": "User",
+            "description": "Standard authenticated Cloudly access for this hosted instance."
+          }
+        ],
+        "environmentVariables": {
+          "issuerUrl": "SERVEZONE_PLATFORM_OIDC_ISSUER",
+          "clientId": "SERVEZONE_PLATFORM_OIDC_CLIENT_ID",
+          "clientSecret": "SERVEZONE_PLATFORM_OIDC_CLIENT_SECRET",
+          "redirectUri": "SERVEZONE_PLATFORM_OIDC_REDIRECT_URI",
+          "audience": "SERVEZONE_PLATFORM_OIDC_AUDIENCE"
+        },
+        "clientAuthenticationMethod": "client_secret_basic"
+      },
+      "minOneboxVersion": "32.4.0",
+      "changelog": "Move Cloudly to 32.9.1, a fixes-only patch over 32.9.0: a certificate request for a relay-namespace name whose relay is not enabled is refused, a route whose certificate Cloudly cannot obtain or whose hostname or service conflicts is left out of its cluster's ingress route table instead of freezing or withdrawing the whole table, and service admission refuses relay-namespace hostnames and hostnames another service's deployment route claim owns. 32.9.1 adds no data migration step and keeps the 1.2.0 runtime contract, so upgrading from 1.2.0 needs no manual review, data migration or backup. An installation on 1.1.10 or earlier still runs the 1.2.0 startup migration to 0.20.0 on this image: it requires completed Secrets v2 cutover retirement and a fresh verified restorable checkpoint, and rolling it back requires a full restore. Requires Onebox 32.4.0. Preserve existing user and storage identities, OIDC bindings, the encrypted keyring and WorkloadInit approval as dedicated root-readable files.",
+      "breaking": false,
+      "requiresManualReview": false,
+      "migrationRequired": false,
+      "backupBeforeUpgrade": false,
+      "healthCheck": {
+        "path": "/status",
+        "port": 3000,
+        "expectedStatus": 200
+      }
+    },
+    "apps/cloudly/versions/1.3.0/config.json": {
+      "image": "code.foss.global/serve.zone/cloudly@sha256:26a7469181059aca2a5505d2f86e8f6286ebc0b1e0dee0df2262bfe3df2d1f06",
+      "targetPorts": [
+        {
+          "name": "web",
+          "port": 3000,
+          "protocol": "http",
+          "default": true
+        }
+      ],
+      "envVars": [
+        {
+          "key": "SERVEZONE_ENVIRONMENT",
+          "value": "production",
+          "description": "Cloudly runtime environment.",
+          "required": true
+        },
+        {
+          "key": "SERVEZONE_PUBLIC_ORIGIN",
+          "value": "https://${SERVICE_DOMAIN}",
+          "description": "Canonical public Cloudly origin including protocol and optional public port.",
+          "required": true
+        },
+        {
+          "key": "SERVEZONE_LISTENPORT",
+          "value": "3000",
+          "description": "Internal Cloudly HTTP port inside the container.",
+          "required": true
+        },
+        {
+          "key": "SERVEZONE_SSLMODE",
+          "value": "external",
+          "description": "Use external TLS termination through Onebox or dcrouter.",
+          "required": true
+        },
+        {
+          "key": "SERVEZONE_SECRET_KEYRING_PATH",
+          "value": "/run/secrets/cloudly-secrets-v2-keyring.json",
+          "description": "Path to the Cloudly Secrets v2 keyring mounted by Onebox; the keyring value is never placed in the public environment.",
+          "required": true
+        },
+        {
+          "key": "SERVEZONE_SECRET_KEYRING_FILE",
+          "description": "Existing Cloudly Secrets v2 keyring. Onebox stores it encrypted and mounts it only as a root-readable file; retain the existing keyring when upgrading.",
+          "required": true,
+          "secret": true,
+          "delivery": {
+            "type": "file",
+            "targetPath": "/run/secrets/cloudly-secrets-v2-keyring.json",
+            "uid": 0,
+            "gid": 0,
+            "mode": 256
+          }
+        },
+        {
+          "key": "SERVEZONE_WORKLOADINIT_APPROVAL_PATH",
+          "value": "/run/secrets/cloudly-workloadinit-approval.json",
+          "description": "Private WorkloadInit release-approval artifact mounted by Onebox for Coreflow secret-runtime registration.",
+          "required": true
+        },
+        {
+          "key": "SERVEZONE_WORKLOADINIT_APPROVAL_FILE",
+          "description": "Operator-approved WorkloadInit release authority. Onebox stores it encrypted and mounts it only as a root-readable file.",
+          "required": true,
+          "secret": true,
+          "delivery": {
+            "type": "file",
+            "targetPath": "/run/secrets/cloudly-workloadinit-approval.json",
+            "uid": 0,
+            "gid": 0,
+            "mode": 256
+          }
+        },
+        {
+          "key": "MONGODB_URL",
+          "value": "${MONGODB_URI}",
+          "description": "Authenticated MongoDB wire-protocol URL provisioned by Onebox Corestore.",
+          "required": true
+        },
+        {
+          "key": "MONGODB_NAME",
+          "value": "${MONGODB_DATABASE}",
+          "description": "MongoDB wire-protocol database name provisioned by Onebox Corestore.",
+          "required": true
+        },
+        {
+          "key": "MONGODB_USER",
+          "value": "${MONGODB_USERNAME}",
+          "description": "MongoDB wire-protocol username provisioned by Onebox Corestore.",
+          "required": true
+        },
+        {
+          "key": "MONGODB_PASS",
+          "value": "${MONGODB_PASSWORD}",
+          "description": "MongoDB wire-protocol password provisioned by Onebox Corestore.",
+          "required": true
+        },
+        {
+          "key": "S3_ENDPOINT",
+          "value": "onebox-corestore",
+          "description": "S3 endpoint host provisioned by Onebox Corestore.",
+          "required": true
+        },
+        {
+          "key": "S3_PORT",
+          "value": "9000",
+          "description": "S3 endpoint port provisioned by Onebox Corestore.",
+          "required": true
+        },
+        {
+          "key": "S3_USESSL",
+          "value": "false",
+          "description": "Use plain HTTP for internal Corestore S3 traffic on the Onebox network.",
+          "required": true
+        },
+        {
+          "key": "S3_BUCKET",
+          "value": "${S3_BUCKET}",
+          "description": "S3 bucket provisioned by Onebox Corestore for Cloudly's registry.",
+          "required": true
+        },
+        {
+          "key": "S3_ACCESSKEY",
+          "value": "${S3_ACCESS_KEY}",
+          "description": "S3 access key provisioned by Onebox Corestore.",
+          "required": true
+        },
+        {
+          "key": "S3_SECRETKEY",
+          "value": "${S3_SECRET_KEY}",
+          "description": "S3 secret key provisioned by Onebox Corestore.",
+          "required": true
+        }
+      ],
+      "platformRequirements": {
+        "mongodb": true,
+        "s3": true
+      },
+      "platformOidc": {
+        "redirectPath": "/auth/oidc/callback",
+        "roles": [
+          {
+            "id": "admin",
+            "label": "Administrator",
+            "description": "Full Cloudly administration for this hosted instance."
+          },
+          {
+            "id": "user",
+            "label": "User",
+            "description": "Standard authenticated Cloudly access for this hosted instance."
+          }
+        ],
+        "environmentVariables": {
+          "issuerUrl": "SERVEZONE_PLATFORM_OIDC_ISSUER",
+          "clientId": "SERVEZONE_PLATFORM_OIDC_CLIENT_ID",
+          "clientSecret": "SERVEZONE_PLATFORM_OIDC_CLIENT_SECRET",
+          "redirectUri": "SERVEZONE_PLATFORM_OIDC_REDIRECT_URI",
+          "audience": "SERVEZONE_PLATFORM_OIDC_AUDIENCE"
+        },
+        "clientAuthenticationMethod": "client_secret_basic"
+      },
+      "minOneboxVersion": "32.4.0",
+      "changelog": "Move Cloudly to 33.0.0, a breaking release. Startup migrates the data from 0.20.0 to 0.21.0 through the step retire-cluster-relay-acme, which drops the relay certificate and DNS collections Cloudly kept while it issued relay certificates and wrote relay A records through its own Cloudflare credential, and logs a warning for every relay name whose A record Cloudly had written at Cloudflare: remove each such record at the provider, because dcrouter refuses a relay name another writer holds. dcrouter now holds every cluster relay name's A record and certificate, so enabling a cluster relay requires a dcrouter that advertises dns.clientRecords and certificates.exactIssuance; Cloudly reads no Cloudflare token, the Cloudflare domain sync is gone, and SERVEZONE_SSLMODE=letsencrypt is refused at start (this template keeps external). The typed API also changes for Corestore binding placement and credential material, Pallet-owned runtime specs, server-managed volume initialization and object-storage environment conflicts; review the Breaking Changes of the Cloudly 33.0.0 changelog before upgrading. The runtime contract is unchanged from 1.2.1 and requires Onebox 32.4.0. Stop Cloudly and take a verified backup before upgrading; the migration is forward-only, the 32.9 image refuses the migrated data, and rollback requires a full restore. An installation on 1.1.10 or earlier runs the 1.2.0 steps first, from 0.10.0, and also requires completed Secrets v2 cutover retirement. Preserve existing user and storage identities, OIDC bindings, the encrypted keyring and WorkloadInit approval as dedicated root-readable files.",
+      "breaking": true,
+      "requiresManualReview": true,
+      "migrationRequired": true,
+      "backupBeforeUpgrade": true,
+      "healthCheck": {
+        "path": "/status",
+        "port": 3000,
+        "expectedStatus": 200
+      }
+    },
     "apps/ghost/app.json": {
       "id": "ghost",
       "name": "Ghost",
@@ -2810,7 +3158,7 @@ export const appStorePackageData: IAppStorePackageData = {
       }
     },
     "appstore.json": {
-      "updatedAt": "2026-09-23T15:44:52Z",
+      "updatedAt": "2026-09-23T23:40:57Z",
       "apps": [
         {
           "id": "nginx",
@@ -3018,7 +3366,7 @@ export const appStorePackageData: IAppStorePackageData = {
           "description": "Multi-node serve.zone control plane for clusters, workload services, domains, and deployments.",
           "category": "Dev Tools",
           "iconName": "server",
-          "latestVersion": "1.2.0",
+          "latestVersion": "1.3.0",
           "tags": [
             "serve.zone",
             "control-plane",