@serve.zone/interfaces 16.4.1 → 16.6.0

package/changelog.md

@@ -1,5 +1,18 @@
 # Changelog
 
+## 2026-07-21 - 16.6.0
+
+### Security
+
+- mark App Store inputs for server-side random generation and service-owned secret-bundle persistence, with optional file-only Docker secret delivery
+
+## 2026-07-21 - 16.5.0
+
+### Features
+
+- add OCI container arguments to App Store runtime contracts
+- add an explicit null sentinel for removing container arguments through generic service updates
+
 ## 2026-07-21 - 16.4.1
 
 ### Fixes

package/dist_ts/00_commitinfo_data.js

@@ -3,7 +3,7 @@
  */
 export const commitinfo = {
     name: '@serve.zone/interfaces',
-    version: '16.4.1',
+    version: '16.6.0',
     description: 'Shared TypeScript interfaces and TypedRequest contracts for the serve.zone ecosystem.'
 };
 //# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoiMDBfY29tbWl0aW5mb19kYXRhLmpzIiwic291cmNlUm9vdCI6IiIsInNvdXJjZXMiOlsiLi4vdHMvMDBfY29tbWl0aW5mb19kYXRhLnRzIl0sIm5hbWVzIjpbXSwibWFwcGluZ3MiOiJBQUFBOztHQUVHO0FBQ0gsTUFBTSxDQUFDLE1BQU0sVUFBVSxHQUFHO0lBQ3hCLElBQUksRUFBRSx3QkFBd0I7SUFDOUIsT0FBTyxFQUFFLFFBQVE7SUFDakIsV0FBVyxFQUFFLHVGQUF1RjtDQUNyRyxDQUFBIn0=

package/dist_ts/appstore/types.d.ts

@@ -1,3 +1,4 @@
+import type { IServiceSecretFile } from '../data/service.js';
 import type { IServiceDomainRoute, IServicePublicPortMapping, IServiceTargetPort } from '../data/serviceports.js';
 export type TAppStorePlatformRequirement = 'mongodb' | 's3' | 'clickhouse' | 'valkey' | 'mariadb';
 export type TAppStoreSourceType = 'inline' | 'repoManifest' | 'dockerImage';
@@ -35,6 +36,14 @@ export interface IAppStoreEnvVar {
     value?: string;
     description: string;
     required?: boolean;
+    /** Store the submitted value in the service-owned Cloudly secret bundle, never in service environment data. */
+    secret?: boolean;
+    /** Generate a value server-side when the installer does not submit one. Generation is allowed only for secrets. */
+    generate?: {
+        type: 'randomHex';
+        /** Number of random bytes before hexadecimal encoding. */
+        bytes: number;
+    };
 }
 export interface IAppStoreVolume {
     /** Stable Docker volume name. If omitted, the runtime derives one from service name and mount path. */
@@ -101,6 +110,10 @@ export interface IAppStoreVersionConfig {
     image: string;
     /** Legacy shorthand for targetPorts.web. New templates should prefer targetPorts. */
     port?: number;
+    /** Exact OCI/Docker argument vector appended after the image entrypoint. */
+    containerArgs?: string[];
+    /** Secret-bundle keys delivered only through Docker's read-only secret tmpfs. */
+    secretFiles?: IServiceSecretFile[];
     targetPorts?: IServiceTargetPort[];
     domains?: IServiceDomainRoute[];
     /** Edge/coretraffic public TCP/UDP exposure, distinct from Docker publishedPorts. */

package/dist_ts/data/service.d.ts

@@ -186,3 +186,7 @@ export interface IService {
 }
 /** Caller-writable service data. Immutable policy and rollout fields are server-managed. */
 export type TServiceWritableData = Omit<IService['data'], 'organizationId' | 'immutableImageRequired' | 'imageDeployment' | 'imageRolloutStatus'>;
+/** Caller-writable update data. Null explicitly removes an existing argument vector. */
+export type TServiceUpdateWritableData = Omit<TServiceWritableData, 'containerArgs'> & {
+    containerArgs?: string[] | null;
+};

package/dist_ts/requests/service.d.ts

@@ -1,6 +1,6 @@
 import * as plugins from '../plugins.js';
 import type { IService } from '../data/service.js';
-import type { TServiceWritableData } from '../data/service.js';
+import type { TServiceUpdateWritableData, TServiceWritableData } from '../data/service.js';
 import type { IRegistryTarget } from '../data/registry.js';
 import type { IIdentity, IIdentityCredential } from '../data/user.js';
 import type { IImageRelease } from '../data/immutableimage.js';
@@ -212,7 +212,7 @@ export interface IRequest_Any_Cloudly_UpdateService extends plugins.typedrequest
     request: {
         identity: IIdentity;
         serviceId: string;
-        serviceData: TServiceWritableData;
+        serviceData: TServiceUpdateWritableData;
     };
     response: {
         service: IService;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@serve.zone/interfaces",
-  "version": "16.4.1",
+  "version": "16.6.0",
   "private": false,
   "description": "Shared TypeScript interfaces and TypedRequest contracts for the serve.zone ecosystem.",
   "exports": {

package/ts/00_commitinfo_data.ts

@@ -3,6 +3,6 @@
  */
 export const commitinfo = {
   name: '@serve.zone/interfaces',
-  version: '16.4.1',
+  version: '16.6.0',
   description: 'Shared TypeScript interfaces and TypedRequest contracts for the serve.zone ecosystem.'
 }

package/ts/appstore/types.ts

@@ -1,3 +1,4 @@
+import type { IServiceSecretFile } from '../data/service.js';
 import type {
   IServiceDomainRoute,
   IServicePublicPortMapping,
@@ -49,6 +50,14 @@ export interface IAppStoreEnvVar {
   value?: string;
   description: string;
   required?: boolean;
+  /** Store the submitted value in the service-owned Cloudly secret bundle, never in service environment data. */
+  secret?: boolean;
+  /** Generate a value server-side when the installer does not submit one. Generation is allowed only for secrets. */
+  generate?: {
+    type: 'randomHex';
+    /** Number of random bytes before hexadecimal encoding. */
+    bytes: number;
+  };
 }
 
 export interface IAppStoreVolume {
@@ -122,6 +131,10 @@ export interface IAppStoreVersionConfig {
   image: string;
   /** Legacy shorthand for targetPorts.web. New templates should prefer targetPorts. */
   port?: number;
+  /** Exact OCI/Docker argument vector appended after the image entrypoint. */
+  containerArgs?: string[];
+  /** Secret-bundle keys delivered only through Docker's read-only secret tmpfs. */
+  secretFiles?: IServiceSecretFile[];
   targetPorts?: IServiceTargetPort[];
   domains?: IServiceDomainRoute[];
   /** Edge/coretraffic public TCP/UDP exposure, distinct from Docker publishedPorts. */

package/ts/data/service.ts

@@ -333,3 +333,11 @@ export type TServiceWritableData = Omit<
   IService['data'],
   'organizationId' | 'immutableImageRequired' | 'imageDeployment' | 'imageRolloutStatus'
 >;
+
+/** Caller-writable update data. Null explicitly removes an existing argument vector. */
+export type TServiceUpdateWritableData = Omit<
+  TServiceWritableData,
+  'containerArgs'
+> & {
+  containerArgs?: string[] | null;
+};

package/ts/requests/service.ts

@@ -1,6 +1,6 @@
 import * as plugins from '../plugins.js';
 import type { IService } from '../data/service.js';
-import type { TServiceWritableData } from '../data/service.js';
+import type { TServiceUpdateWritableData, TServiceWritableData } from '../data/service.js';
 import type { IRegistryTarget } from '../data/registry.js';
 import type { IIdentity, IIdentityCredential } from '../data/user.js';
 import type { IServiceRessources } from '../data/docker.js';
@@ -319,7 +319,7 @@ extends plugins.typedrequestInterfaces.implementsTR<
   request: {
     identity: IIdentity;
     serviceId: string;
-    serviceData: TServiceWritableData;
+    serviceData: TServiceUpdateWritableData;
   };
   response: {
     service: IService;