@serve.zone/appstore 32.5.0 → 32.7.0

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@serve.zone/appstore",
-  "version": "32.5.0",
+  "version": "32.7.0",
   "private": false,
   "description": "serve.zone App Store metadata, parser, and resolver client.",
   "type": "module",
@@ -16,7 +16,7 @@
   "devDependencies": {
     "@git.zone/tsbuild": "^5.0.0",
     "@git.zone/tsdoc": "2.2.2",
-    "@git.zone/tstest": "6.3.0",
+    "@git.zone/tstest": "6.3.2",
     "@types/node": "26.6.2"
   },
   "files": [

package/readme.md

@@ -33,7 +33,7 @@ The App Store currently lists 21 app templates.
 | App ID | Name | App Store category | Image | Port |
 | --- | --- | --- | --- | --- |
 | `adminer` | Adminer | Dev Tools | `adminer:latest` | `8080` |
-| `cloudly` | Cloudly | Dev Tools | `code.foss.global/serve.zone/cloudly@sha256:11bc9a39011c1fa21bf621067e0ff6d4c2fe8cb0306745eca825db13285ae756` | `3000` |
+| `cloudly` | Cloudly | Dev Tools | `code.foss.global/serve.zone/cloudly@sha256:f4f88f0c3765d1b129fa4f3ff68438958e55d4fad598393fb0c686261e46c7ed` | `3000` |
 | `ghost` | Ghost | CMS | `ghost:latest` | `2368` |
 | `gitea` | Gitea | Dev Tools | `gitea/gitea:latest` | `3000` |
 | `gitops` | GitOps | Dev Tools | `code.foss.global/serve.zone/gitops:2.13.0` | `3000` |
@@ -64,7 +64,7 @@ Some templates ask Onebox to provision local platform services and inject connec
 
 | App ID | Requirements | Notes |
 | --- | --- | --- |
-| `cloudly` | MongoDB, S3 | Version `1.5.0` pins Cloudly `33.2.0` and requires Onebox `32.4.0`. It keeps the `1.4.0` runtime contract and is marked breaking, migration-required, backup-before-upgrade and manual-review, because the flags are read from the target version alone and an upgrade from `1.2.1` or earlier still migrates on this image; from `1.4.0` there is no data step. Cloudly `33.2.0` takes a dcrouter admin token once through `bootstrapExternalGatewayCredential` to provision its own gateway-client credential, starts a first enrollment with the gateway settings, and stages a gateway settings change the held credential cannot carry until the next bootstrap. From `1.2.1` or earlier, startup runs the forward-only migration from `0.20.0` to `0.21.0`, dropping the relay certificate and DNS collections of Cloudly's retired Cloudflare and Let's Encrypt integration and logging every relay name whose A record Cloudly had written at Cloudflare, which the operator removes at the provider. dcrouter holds every cluster relay name's A record and certificate from then on, `SERVEZONE_SSLMODE=letsencrypt` is refused, and the typed API changes as the Cloudly 33.0.0 changelog lists. Stop Cloudly and take a verified backup before upgrading; rollback is full-restore-only. Roll out Cloudly `33.2.0` before Coreflow `33.2.0`; `33.1.0` of both is the minimum pair. From `1.3.0` there is no data step, but roll out Cloudly before Coreflow and Corestore `33.0.0`, and set every node's Corestore database endpoint, because a database binding on a node without one is not granted and its service is refused `database-endpoint-missing`, and existing database bindings return no credentials until they are granted again for the endpoint. From `1.1.10` or earlier, startup first runs the `1.2.0` steps from `0.10.0` and needs completed Secrets v2 cutover retirement. Both the existing Secrets v2 keyring and operator-approved WorkloadInit authority are required encrypted inputs delivered as separate root-owned `0400` files; the public environment contains only their fixed paths. |
+| `cloudly` | MongoDB, S3 | Version `1.7.0` pins Cloudly `33.4.0` and requires Onebox `32.4.0`. It keeps the `1.6.0` runtime contract and is marked breaking, migration-required, backup-before-upgrade and manual-review, because the flags are read from the target version alone and every upgrade from `1.6.0` or earlier migrates on this image. From `1.3.0` through `1.6.0`, startup runs the forward-only data step `runtime-session-protocol-offer` from `0.21.0` to `0.22.0`, which states `protocol: null` on every Pallet session row recorded before Cloudly stored its node's protocol offer; stop Cloudly and take a verified backup first, as rollback is full-restore-only. Cloudly `33.4.0` lets `setServicePublishedPorts` publish a contiguous range through `hostPortEnd` (at most 1024 ports in 64 entries per protocol) and same-port outbound through `symmetric: true`, which needs public egress (`published-port-symmetric-without-egress`) and owns its inside ports (`published-port-symmetric-inside-overlap`). New handoff leases translate outbound flows only into `49152-65535`, whose ports are refused `published-port-reserved`; a node keeps its `1024-65535` lease until its router is re-created. A policy write for a service being deleted is refused `service-deleting`. A projection carrying a range or a symmetric entry is withheld as `node-contract-behind` from a Pallet node whose session states a release below interfaces `32.31.0`, or an unrecorded one, so ranges and symmetric entries take effect on a node only once it runs a Pallet release built on interfaces `32.31.0` or later. From `1.5.0`, Cloudly `33.3.0`'s changes apply: Cloudly `33.3.0` lets an administrator set a service's network egress with `setServiceNetworkEgress` (public internet, and the platform endpoints of the protected authority), and refuses a workload whose database or object-storage binding sits on a node whose Corestore endpoint its network does not select as `database-endpoint-unselected` or `objectstorage-endpoint-unselected`; a replica already running keeps running while its target reports the refusal. From `1.4.0`, Cloudly `33.2.0`'s changes apply: Cloudly takes a dcrouter admin token once through `bootstrapExternalGatewayCredential` to provision its own gateway-client credential, starts a first enrollment with the gateway settings, and stages a gateway settings change the held credential cannot carry until the next bootstrap. From `1.2.1` or earlier, startup runs the forward-only migration from `0.20.0` to `0.21.0` before that step, dropping the relay certificate and DNS collections of Cloudly's retired Cloudflare and Let's Encrypt integration and logging every relay name whose A record Cloudly had written at Cloudflare, which the operator removes at the provider. dcrouter holds every cluster relay name's A record and certificate from then on, `SERVEZONE_SSLMODE=letsencrypt` is refused, and the typed API changes as the Cloudly 33.0.0 changelog lists. Stop Cloudly and take a verified backup before upgrading; rollback is full-restore-only. Roll out Cloudly `33.4.0` before Coreflow `33.2.0`; Coreflow `33.1.0` is the minimum. From `1.3.0`, also roll out Cloudly before Coreflow and Corestore `33.0.0`, and set every node's Corestore database endpoint, because a database binding on a node without one is not granted and its service is refused `database-endpoint-missing`, and existing database bindings return no credentials until they are granted again for the endpoint. From `1.1.10` or earlier, startup first runs the `1.2.0` steps from `0.10.0` and needs completed Secrets v2 cutover retirement. Both the existing Secrets v2 keyring and operator-approved WorkloadInit authority are required encrypted inputs delivered as separate root-owned `0400` files; the public environment contains only their fixed paths. |
 | `ghost` | MariaDB | Uses MySQL-style `database__connection__*` environment variables. |
 | `gitea` | MariaDB | Uses Gitea database environment variables with `${MARIADB_*}` placeholders. |
 | `nextcloud` | MariaDB, Valkey | Uses MySQL-compatible database variables. Valkey is declared as a platform requirement. |

package/ts_client/data.generated.ts

@@ -34,7 +34,7 @@ export const appStorePackageData: IAppStorePackageData = {
       "description": "Multi-node serve.zone control plane for clusters, workload services, domains, and deployments.",
       "category": "Dev Tools",
       "iconName": "server",
-      "latestVersion": "1.5.0",
+      "latestVersion": "1.7.0",
       "versions": [
         "1.0.0",
         "1.1.0",
@@ -52,7 +52,9 @@ export const appStorePackageData: IAppStorePackageData = {
         "1.2.1",
         "1.3.0",
         "1.4.0",
-        "1.5.0"
+        "1.5.0",
+        "1.6.0",
+        "1.7.0"
       ],
       "maintainer": "serve.zone",
       "links": {
@@ -2686,6 +2688,352 @@ export const appStorePackageData: IAppStorePackageData = {
         "expectedStatus": 200
       }
     },
+    "apps/cloudly/versions/1.6.0/config.json": {
+      "image": "code.foss.global/serve.zone/cloudly@sha256:fe1d10de09a8dc28f4dcf32b8e2cfed1ca7329b7d1b7405048a6e328afe5f9a6",
+      "targetPorts": [
+        {
+          "name": "web",
+          "port": 3000,
+          "protocol": "http",
+          "default": true
+        }
+      ],
+      "envVars": [
+        {
+          "key": "SERVEZONE_ENVIRONMENT",
+          "value": "production",
+          "description": "Cloudly runtime environment.",
+          "required": true
+        },
+        {
+          "key": "SERVEZONE_PUBLIC_ORIGIN",
+          "value": "https://${SERVICE_DOMAIN}",
+          "description": "Canonical public Cloudly origin including protocol and optional public port.",
+          "required": true
+        },
+        {
+          "key": "SERVEZONE_LISTENPORT",
+          "value": "3000",
+          "description": "Internal Cloudly HTTP port inside the container.",
+          "required": true
+        },
+        {
+          "key": "SERVEZONE_SSLMODE",
+          "value": "external",
+          "description": "Use external TLS termination through Onebox or dcrouter.",
+          "required": true
+        },
+        {
+          "key": "SERVEZONE_SECRET_KEYRING_PATH",
+          "value": "/run/secrets/cloudly-secrets-v2-keyring.json",
+          "description": "Path to the Cloudly Secrets v2 keyring mounted by Onebox; the keyring value is never placed in the public environment.",
+          "required": true
+        },
+        {
+          "key": "SERVEZONE_SECRET_KEYRING_FILE",
+          "description": "Existing Cloudly Secrets v2 keyring. Onebox stores it encrypted and mounts it only as a root-readable file; retain the existing keyring when upgrading.",
+          "required": true,
+          "secret": true,
+          "delivery": {
+            "type": "file",
+            "targetPath": "/run/secrets/cloudly-secrets-v2-keyring.json",
+            "uid": 0,
+            "gid": 0,
+            "mode": 256
+          }
+        },
+        {
+          "key": "SERVEZONE_WORKLOADINIT_APPROVAL_PATH",
+          "value": "/run/secrets/cloudly-workloadinit-approval.json",
+          "description": "Private WorkloadInit release-approval artifact mounted by Onebox for Coreflow secret-runtime registration.",
+          "required": true
+        },
+        {
+          "key": "SERVEZONE_WORKLOADINIT_APPROVAL_FILE",
+          "description": "Operator-approved WorkloadInit release authority. Onebox stores it encrypted and mounts it only as a root-readable file.",
+          "required": true,
+          "secret": true,
+          "delivery": {
+            "type": "file",
+            "targetPath": "/run/secrets/cloudly-workloadinit-approval.json",
+            "uid": 0,
+            "gid": 0,
+            "mode": 256
+          }
+        },
+        {
+          "key": "MONGODB_URL",
+          "value": "${MONGODB_URI}",
+          "description": "Authenticated MongoDB wire-protocol URL provisioned by Onebox Corestore.",
+          "required": true
+        },
+        {
+          "key": "MONGODB_NAME",
+          "value": "${MONGODB_DATABASE}",
+          "description": "MongoDB wire-protocol database name provisioned by Onebox Corestore.",
+          "required": true
+        },
+        {
+          "key": "MONGODB_USER",
+          "value": "${MONGODB_USERNAME}",
+          "description": "MongoDB wire-protocol username provisioned by Onebox Corestore.",
+          "required": true
+        },
+        {
+          "key": "MONGODB_PASS",
+          "value": "${MONGODB_PASSWORD}",
+          "description": "MongoDB wire-protocol password provisioned by Onebox Corestore.",
+          "required": true
+        },
+        {
+          "key": "S3_ENDPOINT",
+          "value": "onebox-corestore",
+          "description": "S3 endpoint host provisioned by Onebox Corestore.",
+          "required": true
+        },
+        {
+          "key": "S3_PORT",
+          "value": "9000",
+          "description": "S3 endpoint port provisioned by Onebox Corestore.",
+          "required": true
+        },
+        {
+          "key": "S3_USESSL",
+          "value": "false",
+          "description": "Use plain HTTP for internal Corestore S3 traffic on the Onebox network.",
+          "required": true
+        },
+        {
+          "key": "S3_BUCKET",
+          "value": "${S3_BUCKET}",
+          "description": "S3 bucket provisioned by Onebox Corestore for Cloudly's registry.",
+          "required": true
+        },
+        {
+          "key": "S3_ACCESSKEY",
+          "value": "${S3_ACCESS_KEY}",
+          "description": "S3 access key provisioned by Onebox Corestore.",
+          "required": true
+        },
+        {
+          "key": "S3_SECRETKEY",
+          "value": "${S3_SECRET_KEY}",
+          "description": "S3 secret key provisioned by Onebox Corestore.",
+          "required": true
+        }
+      ],
+      "platformRequirements": {
+        "mongodb": true,
+        "s3": true
+      },
+      "platformOidc": {
+        "redirectPath": "/auth/oidc/callback",
+        "roles": [
+          {
+            "id": "admin",
+            "label": "Administrator",
+            "description": "Full Cloudly administration for this hosted instance."
+          },
+          {
+            "id": "user",
+            "label": "User",
+            "description": "Standard authenticated Cloudly access for this hosted instance."
+          }
+        ],
+        "environmentVariables": {
+          "issuerUrl": "SERVEZONE_PLATFORM_OIDC_ISSUER",
+          "clientId": "SERVEZONE_PLATFORM_OIDC_CLIENT_ID",
+          "clientSecret": "SERVEZONE_PLATFORM_OIDC_CLIENT_SECRET",
+          "redirectUri": "SERVEZONE_PLATFORM_OIDC_REDIRECT_URI",
+          "audience": "SERVEZONE_PLATFORM_OIDC_AUDIENCE"
+        },
+        "clientAuthenticationMethod": "client_secret_basic"
+      },
+      "minOneboxVersion": "32.4.0",
+      "changelog": "Move Cloudly to 33.3.0, a feature release over 33.2.0: an administrator sets a service's network egress with setServiceNetworkEgress, which states whether the service's attached workloads reach the public internet and which platform endpoints of the protected authority they reach, and reads it with getServiceNetworkEgress; before this nothing could grant a workload public egress or a platform endpoint. A workload whose enabled database or object-storage binding sits on a node whose Corestore endpoint its network does not select is refused database-endpoint-unselected or objectstorage-endpoint-unselected instead of being started against a connection that stays dark, and an isolated network selects none; a replica already running keeps running while its target reports the refusal, so grant the endpoint through the service's egress before such a workload is placed again. The default runtime spec of a new service probes its process instead of its first TCP target port. The runtime contract is unchanged from 1.5.0 and requires Onebox 32.4.0. From 1.5.0 there is no data step, as the data version stays 0.21.0; take a verified backup before upgrading. From 1.4.0 there is no data step either, but the gateway admin bootstrap of Cloudly 33.2.0 applies: an administrator hands Cloudly a dcrouter admin token once through bootstrapExternalGatewayCredential or servezone gateway bootstrap, from which Cloudly provisions and stores its own gateway-client credential; a first enrollment turns admin-bootstrap-required, a gateway settings change the held credential cannot carry is staged, a runtime network address plan out of its canonical order is refused plan-unsorted, and a relay naming a node Cloudly does not hold is refused relay-node-unknown: roll out Cloudly 33.3.0 first, then Coreflow 33.2.0, which recognises the relay-node-unknown refusal. From 1.3.0 there is no data step either, but the per-node database endpoint of Cloudly 33.1.0 applies: roll out Cloudly 33.3.0 first, then Coreflow 33.2.0 (33.1.0 at minimum), then Corestore 33.0.0, and set every node's Corestore database endpoint with setClusterNodeCorestoreDatabaseEndpoint, because a database binding on a node without one is not granted and its service is refused database-endpoint-missing, and existing database bindings answer no credential material until they are granted again for the endpoint. From 1.2.1 or earlier, startup runs the forward-only data migration from 0.20.0 to 0.21.0 through the step retire-cluster-relay-acme, which drops the relay certificate and DNS collections of Cloudly's retired Cloudflare and Let's Encrypt integration and logs every relay name whose A record Cloudly had written at Cloudflare: remove each such record at the provider. A cluster relay then requires a dcrouter that advertises dns.clientRecords and certificates.exactIssuance, SERVEZONE_SSLMODE=letsencrypt is refused (this template keeps external), and the typed API changes as the Breaking Changes of the Cloudly 33.0.0 changelog list; review them, stop Cloudly and take a verified backup before upgrading, because the 32.9 image refuses the migrated data and rollback requires a full restore. The upgrade is marked breaking, migration-required, backup-before-upgrade and manual-review because these flags are read from the target version alone and an upgrade from 1.2.1 or earlier still runs the migration on this image. An installation on 1.1.10 or earlier also runs the 1.2.0 steps first, from 0.10.0, and requires completed Secrets v2 cutover retirement. Preserve existing user and storage identities, OIDC bindings, the encrypted keyring and WorkloadInit approval as dedicated root-readable files.",
+      "breaking": true,
+      "requiresManualReview": true,
+      "migrationRequired": true,
+      "backupBeforeUpgrade": true,
+      "healthCheck": {
+        "path": "/status",
+        "port": 3000,
+        "expectedStatus": 200
+      }
+    },
+    "apps/cloudly/versions/1.7.0/config.json": {
+      "image": "code.foss.global/serve.zone/cloudly@sha256:f4f88f0c3765d1b129fa4f3ff68438958e55d4fad598393fb0c686261e46c7ed",
+      "targetPorts": [
+        {
+          "name": "web",
+          "port": 3000,
+          "protocol": "http",
+          "default": true
+        }
+      ],
+      "envVars": [
+        {
+          "key": "SERVEZONE_ENVIRONMENT",
+          "value": "production",
+          "description": "Cloudly runtime environment.",
+          "required": true
+        },
+        {
+          "key": "SERVEZONE_PUBLIC_ORIGIN",
+          "value": "https://${SERVICE_DOMAIN}",
+          "description": "Canonical public Cloudly origin including protocol and optional public port.",
+          "required": true
+        },
+        {
+          "key": "SERVEZONE_LISTENPORT",
+          "value": "3000",
+          "description": "Internal Cloudly HTTP port inside the container.",
+          "required": true
+        },
+        {
+          "key": "SERVEZONE_SSLMODE",
+          "value": "external",
+          "description": "Use external TLS termination through Onebox or dcrouter.",
+          "required": true
+        },
+        {
+          "key": "SERVEZONE_SECRET_KEYRING_PATH",
+          "value": "/run/secrets/cloudly-secrets-v2-keyring.json",
+          "description": "Path to the Cloudly Secrets v2 keyring mounted by Onebox; the keyring value is never placed in the public environment.",
+          "required": true
+        },
+        {
+          "key": "SERVEZONE_SECRET_KEYRING_FILE",
+          "description": "Existing Cloudly Secrets v2 keyring. Onebox stores it encrypted and mounts it only as a root-readable file; retain the existing keyring when upgrading.",
+          "required": true,
+          "secret": true,
+          "delivery": {
+            "type": "file",
+            "targetPath": "/run/secrets/cloudly-secrets-v2-keyring.json",
+            "uid": 0,
+            "gid": 0,
+            "mode": 256
+          }
+        },
+        {
+          "key": "SERVEZONE_WORKLOADINIT_APPROVAL_PATH",
+          "value": "/run/secrets/cloudly-workloadinit-approval.json",
+          "description": "Private WorkloadInit release-approval artifact mounted by Onebox for Coreflow secret-runtime registration.",
+          "required": true
+        },
+        {
+          "key": "SERVEZONE_WORKLOADINIT_APPROVAL_FILE",
+          "description": "Operator-approved WorkloadInit release authority. Onebox stores it encrypted and mounts it only as a root-readable file.",
+          "required": true,
+          "secret": true,
+          "delivery": {
+            "type": "file",
+            "targetPath": "/run/secrets/cloudly-workloadinit-approval.json",
+            "uid": 0,
+            "gid": 0,
+            "mode": 256
+          }
+        },
+        {
+          "key": "MONGODB_URL",
+          "value": "${MONGODB_URI}",
+          "description": "Authenticated MongoDB wire-protocol URL provisioned by Onebox Corestore.",
+          "required": true
+        },
+        {
+          "key": "MONGODB_NAME",
+          "value": "${MONGODB_DATABASE}",
+          "description": "MongoDB wire-protocol database name provisioned by Onebox Corestore.",
+          "required": true
+        },
+        {
+          "key": "MONGODB_USER",
+          "value": "${MONGODB_USERNAME}",
+          "description": "MongoDB wire-protocol username provisioned by Onebox Corestore.",
+          "required": true
+        },
+        {
+          "key": "MONGODB_PASS",
+          "value": "${MONGODB_PASSWORD}",
+          "description": "MongoDB wire-protocol password provisioned by Onebox Corestore.",
+          "required": true
+        },
+        {
+          "key": "S3_ENDPOINT",
+          "value": "onebox-corestore",
+          "description": "S3 endpoint host provisioned by Onebox Corestore.",
+          "required": true
+        },
+        {
+          "key": "S3_PORT",
+          "value": "9000",
+          "description": "S3 endpoint port provisioned by Onebox Corestore.",
+          "required": true
+        },
+        {
+          "key": "S3_USESSL",
+          "value": "false",
+          "description": "Use plain HTTP for internal Corestore S3 traffic on the Onebox network.",
+          "required": true
+        },
+        {
+          "key": "S3_BUCKET",
+          "value": "${S3_BUCKET}",
+          "description": "S3 bucket provisioned by Onebox Corestore for Cloudly's registry.",
+          "required": true
+        },
+        {
+          "key": "S3_ACCESSKEY",
+          "value": "${S3_ACCESS_KEY}",
+          "description": "S3 access key provisioned by Onebox Corestore.",
+          "required": true
+        },
+        {
+          "key": "S3_SECRETKEY",
+          "value": "${S3_SECRET_KEY}",
+          "description": "S3 secret key provisioned by Onebox Corestore.",
+          "required": true
+        }
+      ],
+      "platformRequirements": {
+        "mongodb": true,
+        "s3": true
+      },
+      "platformOidc": {
+        "redirectPath": "/auth/oidc/callback",
+        "roles": [
+          {
+            "id": "admin",
+            "label": "Administrator",
+            "description": "Full Cloudly administration for this hosted instance."
+          },
+          {
+            "id": "user",
+            "label": "User",
+            "description": "Standard authenticated Cloudly access for this hosted instance."
+          }
+        ],
+        "environmentVariables": {
+          "issuerUrl": "SERVEZONE_PLATFORM_OIDC_ISSUER",
+          "clientId": "SERVEZONE_PLATFORM_OIDC_CLIENT_ID",
+          "clientSecret": "SERVEZONE_PLATFORM_OIDC_CLIENT_SECRET",
+          "redirectUri": "SERVEZONE_PLATFORM_OIDC_REDIRECT_URI",
+          "audience": "SERVEZONE_PLATFORM_OIDC_AUDIENCE"
+        },
+        "clientAuthenticationMethod": "client_secret_basic"
+      },
+      "minOneboxVersion": "32.4.0",
+      "changelog": "Move Cloudly to 33.4.0, a feature release over 33.3.0: setServicePublishedPorts accepts a contiguous published-port range through hostPortEnd, each host port to the same inside port, and same-port outbound through symmetric: true, so a SIP router can publish udp 20000-20200 and answer from the ports it listens on. Entries of one protocol never overlap and cover at most 1024 ports in 64 entries; a range onto other inside ports, hostIp and an overlap are refused, and a symmetric entry owns its inside ports, so another entry of the same protocol publishing to any of them is refused published-port-symmetric-inside-overlap. A symmetric entry needs public egress: published-port-symmetric-without-egress refuses it on a published-port write and refuses clearing egress under it on an egress write. New handoff leases translate outbound flows only into the SNAT band 49152-65535, whose ports are refused published-port-reserved; a leased handoff is immutable, so a node keeps its 1024-65535 lease until its router is re-created. The service runtime producer refuses an attached spec whose policy document, written before these rules, holds a reserved port or a symmetric port without egress. A service network policy write for a service whose deletion has begun is refused service-deleting. Cluster ingress port routes, HTTP routes and inbound mail targets are authorized by a range that covers their port, while an edge (dcrouter) route stays one route per port. A projection carrying a range or a symmetric entry is withheld from a Pallet node whose session states a release below interfaces 32.31.0, or none: its compilation reports node-contract-behind and the node keeps its current head, so ranges and symmetric entries take effect on a node only once it runs a Pallet release built on interfaces 32.31.0 or later. Two entries claiming one port of one node are withheld as published-port-conflict. The runtime contract is unchanged from 1.6.0 and requires Onebox 32.4.0. From 1.6.0, startup runs the forward-only data migration from 0.21.0 to 0.22.0 through the step runtime-session-protocol-offer, which states protocol: null on every Pallet session row recorded before Cloudly stored the protocol offer its node stated, so such a node counts as unrecorded until it registers again; stop Cloudly and take a verified backup before upgrading, because the step has no inverse and rollback requires a full restore. From 1.5.0 the same step runs, and the service network egress of Cloudly 33.3.0 applies too: an administrator sets a service's network egress with setServiceNetworkEgress, which states whether the service's attached workloads reach the public internet and which platform endpoints of the protected authority they reach, and reads it with getServiceNetworkEgress; a workload whose enabled database or object-storage binding sits on a node whose Corestore endpoint its network does not select is refused database-endpoint-unselected or objectstorage-endpoint-unselected, and a replica already running keeps running while its target reports the refusal, so grant the endpoint through the service's egress before such a workload is placed again; the default runtime spec of a new service probes its process instead of its first TCP target port. From 1.4.0 the same step runs, and the gateway admin bootstrap of Cloudly 33.2.0 applies too: an administrator hands Cloudly a dcrouter admin token once through bootstrapExternalGatewayCredential or servezone gateway bootstrap, from which Cloudly provisions and stores its own gateway-client credential; a first enrollment turns admin-bootstrap-required, a gateway settings change the held credential cannot carry is staged, a runtime network address plan out of its canonical order is refused plan-unsorted, and a relay naming a node Cloudly does not hold is refused relay-node-unknown: roll out Cloudly 33.4.0 first, then Coreflow 33.2.0, which recognises the relay-node-unknown refusal. From 1.3.0 the same step runs, and the per-node database endpoint of Cloudly 33.1.0 applies too: roll out Cloudly 33.4.0 first, then Coreflow 33.2.0 (33.1.0 at minimum), then Corestore 33.0.0, and set every node's Corestore database endpoint with setClusterNodeCorestoreDatabaseEndpoint, because a database binding on a node without one is not granted and its service is refused database-endpoint-missing, and existing database bindings answer no credential material until they are granted again for the endpoint. From 1.2.1 or earlier, startup runs the forward-only data migration from 0.20.0 to 0.21.0 through the step retire-cluster-relay-acme and then the step runtime-session-protocol-offer to 0.22.0; retire-cluster-relay-acme drops the relay certificate and DNS collections of Cloudly's retired Cloudflare and Let's Encrypt integration and logs every relay name whose A record Cloudly had written at Cloudflare: remove each such record at the provider. A cluster relay then requires a dcrouter that advertises dns.clientRecords and certificates.exactIssuance, SERVEZONE_SSLMODE=letsencrypt is refused (this template keeps external), and the typed API changes as the Breaking Changes of the Cloudly 33.0.0 changelog list; review them, stop Cloudly and take a verified backup before upgrading, because the 32.9 image refuses the migrated data and rollback requires a full restore. The upgrade is marked breaking, migration-required, backup-before-upgrade and manual-review because these flags are read from the target version alone, every upgrade from 1.6.0 or earlier runs the 0.21.0 to 0.22.0 step, and an upgrade from 1.2.1 or earlier still runs the migration from 0.20.0 on this image as well. An installation on 1.1.10 or earlier also runs the 1.2.0 steps first, from 0.10.0, and requires completed Secrets v2 cutover retirement. Preserve existing user and storage identities, OIDC bindings, the encrypted keyring and WorkloadInit approval as dedicated root-readable files.",
+      "breaking": true,
+      "requiresManualReview": true,
+      "migrationRequired": true,
+      "backupBeforeUpgrade": true,
+      "healthCheck": {
+        "path": "/status",
+        "port": 3000,
+        "expectedStatus": 200
+      }
+    },
     "apps/ghost/app.json": {
       "id": "ghost",
       "name": "Ghost",
@@ -3714,7 +4062,7 @@ export const appStorePackageData: IAppStorePackageData = {
           "description": "Multi-node serve.zone control plane for clusters, workload services, domains, and deployments.",
           "category": "Dev Tools",
           "iconName": "server",
-          "latestVersion": "1.5.0",
+          "latestVersion": "1.7.0",
           "tags": [
             "serve.zone",
             "control-plane",