@serve.zone/appstore 33.18.0 → 33.20.0

package/changelog.md

@@ -1,5 +1,35 @@
 # Changelog
 
+## 2026-11-07 - 33.20.0
+
+### Features
+
+- AGL-1505: add Cloudly template 1.29.12 on the published 33.28.0 image for hosts without `storage.database.backup-exclusions` (Linus ruling 2026-11-05).
+  - Pin exact multi-platform root `code.foss.global/serve.zone/cloudly@sha256:be728be0dc6b86f910684067c3bf8db3f07404586f6a85ca00f079de6d8cd64d`; keep 1.29.11's config and add 1.30.9's optional sealed `SERVEZONE_ADMINACCOUNT` declaration word for word. No `databaseBackupExclusions`, no `storage.database.backup-exclusions`; Onebox 33.17.x resolves its newest Cloudly target to 1.29.12.
+  - Document the six forward-only data steps from 0.33.0 to 0.39.0 (`spark-fleet-target`, `node-action-carrier-expiry` after the four of 1.30.8), restore-only rollback, and that a 1.29.12 installation must not move to 1.30.8 or 1.30.9, which run the older 33.26.0 image.
+
+- AGL-1216: append Cloudly template 1.30.9 as interim bootstrap compatibility for the exact unchanged 33.26.0 image.
+  - Declare `SERVEZONE_ADMINACCOUNT` as a private optional launcher-environment secret with no value/default or generator, preserving every existing config and lock record. Existing installations omit it; a fresh empty database uses the existing private bootstrap path.
+  - Document normal owner removal/replacement separately from revoking the persisted Cloudly password, preserve all inherited backup/feature/upgrade/OIDC/private-file requirements, and keep actual fresh host installation and active admission as separate qualification gates. AGL-1246 records this transitional input alternative; AGL-1179 under AGL-1178 owns the final Onebox broker and removal of the Cloudly password-admin and parent initial-admin bootstrap paths. This is no permanent password architecture, automatic revocation, fresh-host readiness claim or >=33.27.0 owning lab/catalog qualification.
+
+- AGL-1216: add Cloudly template 1.30.8 on the published 33.26.0 native-monitor image.
+  - Pin exact multi-platform root `code.foss.global/serve.zone/cloudly@sha256:b5b1d9f0ba494d4e8472f141c03b7b76a8590d256debfd9c144f1eb866c18069`; preserve every published template byte and change only image/changelog relative to 1.30.7. Keep its environment aliases, NoSQLDB/Corestore storage mappings, encrypted keyring and WorkloadInit delivery, OIDC capability, Onebox minimum, health check, backup exclusions, feature requirements and four upgrade flags.
+  - Document the 0.33.0 to 0.37.0 forward-only hostname, runtime-authority, assignment-failure and bounded-slot-history data steps, verified pre-upgrade backup and restore-only rollback; hosts lacking the database backup-exclusions feature keep 1.29.11.
+  - Qualify append-only catalog/lock succession, exact image/config, secret/storage semantics, host feature admission and upgrade disclosure. Catalog publication does not install a reviewer instance, upgrade production, create authority or expose a public route.
+
+### Maintenance
+
+- Release tooling currency: pin pnpm 12.16.1 and use @types/node 26.6.6.
+
+## 2026-10-23 - 33.19.0
+
+### Features
+
+- publish the Cloudly 1.29.11 and 1.30.7 templates on Cloudly 33.24.0 (cloudly)
+  - Add Cloudly app version 1.29.11, pinned to the Cloudly 33.24.0 multi-platform image index `code.foss.global/serve.zone/cloudly@sha256:e230729d762f770d20643e05d769d92ad27038dc64cb9fac448f45b2f881b43a` (tag `v33.24.0`), on 1.29.10's config with the image and the changelog changed: it keeps `CLOUDLY_BACKUP_CRON` `15 2 * * *`, `backupExclusions` for `runtime-logs/` and `requiresFeatures: ['storage.object-storage.backup-exclusions']`, and is the newest Cloudly target of a host that does not fulfil `storage.database.backup-exclusions`.
+  - Add Cloudly app version 1.30.7, 1.29.11 plus 1.30.0's `databaseBackupExclusions` for the six runtime log ledger collections and `requiresFeatures: ['storage.database.backup-exclusions', 'storage.object-storage.backup-exclusions']` (`declarationsOf: '1.29.11'` in `test/test.cloudlytemplates.node.ts`), and make it Cloudly's latest version; it is the upgrade target of 1.30.6, 1.30.5, 1.30.4, 1.30.3, 1.30.2, 1.30.1, 1.30.0, 1.29.11, 1.29.10, 1.29.9 and every version 1.30.0 upgrades from.
+  - Cloudly 33.24.0 adds the dashboard's Temp tokens view (Security, Temp tokens, `/temp-tokens`): an administrator mints, lists and revokes delegated admin temp tokens there, so one who signs in with a passkey through Onebox mints one without a Cloudly password; the token is shown once in its dialog and never stored, and minting still needs a sign-in within the last five minutes (the rule is unchanged). The release adds no data step, no environment variable, no setting, no collection and no index and changes neither the Dockerfile nor the `qenv.yml` requirements; both templates keep the Onebox minimum 33.8.0 and the four upgrade flags, because an upgrade from 1.29.8, 1.30.4 or earlier still runs the forward-only data step `retire-stale-reconciliation-stages` (data version 0.32.0 to 0.33.0).
+
 ## 2026-10-22 - 33.18.0
 
 ### Features

package/dist_catalog/catalog.digest

@@ -1 +1 @@
-sha256:f32ef786a1a2aa49f5d88660313b6b3d0c554fab253e0f42a6fb3d819e90b6a7
+sha256:7226b1911772081a6201e4bd54c0b199d98aae28876cae6037bf7f386987c7db