@serve.zone/interfaces 24.2.0 → 25.1.0

package/changelog.md

@@ -1,5 +1,26 @@
 # Changelog
 
+## 2026-08-07 - 25.1.0
+
+### Features
+
+- add shared hosted-app authorization RPC contracts (hostedapp)
+  - Export Cloudly's access configuration, role assignment, platform OIDC enablement, and authorization completion contracts with full `IIdentity` context.
+
+### Maintenance
+
+- refresh release and test tooling
+  - Update tstest to 4.0.0; retain mature pnpm and Node.js type versions under the configured minimum-release-age policy.
+
+## 2026-08-01 - 25.0.0
+
+### Breaking Changes
+
+- require canonical organization authority for service creation (service)
+  - Add a required top-level `organizationId` to the `createService` request.
+  - Keep organization ownership excluded from caller-writable service data.
+  - Export canonical organization identifier validation and contract coverage.
+
 ## 2026-08-01 - 24.2.0
 
 ### Features

package/dist_ts/00_commitinfo_data.js

@@ -3,7 +3,7 @@
  */
 export const commitinfo = {
     name: '@serve.zone/interfaces',
-    version: '24.2.0',
+    version: '25.1.0',
     description: 'Shared TypeScript interfaces and TypedRequest contracts for the serve.zone ecosystem.'
 };
 //# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoiMDBfY29tbWl0aW5mb19kYXRhLmpzIiwic291cmNlUm9vdCI6IiIsInNvdXJjZXMiOlsiLi4vdHMvMDBfY29tbWl0aW5mb19kYXRhLnRzIl0sIm5hbWVzIjpbXSwibWFwcGluZ3MiOiJBQUFBOztHQUVHO0FBQ0gsTUFBTSxDQUFDLE1BQU0sVUFBVSxHQUFHO0lBQ3hCLElBQUksRUFBRSx3QkFBd0I7SUFDOUIsT0FBTyxFQUFFLFFBQVE7SUFDakIsV0FBVyxFQUFFLHVGQUF1RjtDQUNyRyxDQUFBIn0=

package/dist_ts/data/service.d.ts

@@ -22,6 +22,8 @@ export interface IServiceVolume {
     /** Driver-specific options forwarded to Docker's VolumeDriver.Create request. */
     options?: Record<string, string>;
 }
+/** Validates the canonical organization authority used by service operations. */
+export declare const validateOrganizationId: (valueArg: unknown) => string[];
 export declare const serviceContainerArgLimits: {
     readonly maximumArgs: 64;
     readonly maximumArgBytes: 4096;

package/dist_ts/data/service.js

@@ -1,3 +1,11 @@
+const organizationIdRegex = /^[A-Za-z0-9][A-Za-z0-9:._-]{0,199}$/;
+/** Validates the canonical organization authority used by service operations. */
+export const validateOrganizationId = (valueArg) => {
+    if (typeof valueArg !== 'string' || !organizationIdRegex.test(valueArg)) {
+        return ['organizationId must be a canonical 1-200 character identifier'];
+    }
+    return [];
+};
 export const serviceContainerArgLimits = {
     maximumArgs: 64,
     maximumArgBytes: 4096,
@@ -57,4 +65,4 @@ export const validateServiceContainerArgs = (containerArgsArg) => {
     }
     return [];
 };
-//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoic2VydmljZS5qcyIsInNvdXJjZVJvb3QiOiIiLCJzb3VyY2VzIjpbIi4uLy4uL3RzL2RhdGEvc2VydmljZS50cyJdLCJuYW1lcyI6W10sIm1hcHBpbmdzIjoiQUFvQ0EsTUFBTSxDQUFDLE1BQU0seUJBQXlCLEdBQUc7SUFDdkMsV0FBVyxFQUFFLEVBQUU7SUFDZixlQUFlLEVBQUUsSUFBSTtJQUNyQixpQkFBaUIsRUFBRSxFQUFFLEdBQUcsSUFBSTtDQUNwQixDQUFDO0FBRVgsTUFBTSxDQUFDLE1BQU0sNEJBQTRCLEdBQUcsQ0FBQyxPQUFlLEVBQXNCLEVBQUU7SUFDbEYsSUFBSSxPQUFPLE9BQU8sS0FBSyxRQUFRO1dBQzFCLENBQUMsT0FBTyxDQUFDLFVBQVUsQ0FBQyxHQUFHLENBQUM7V0FDeEIsT0FBTyxDQUFDLFFBQVEsQ0FBQyxJQUFJLENBQUM7V0FDdEIsT0FBTyxDQUFDLE1BQU0sR0FBRyxHQUFHLEVBQUUsQ0FBQztRQUMxQixPQUFPLFNBQVMsQ0FBQztJQUNuQixDQUFDO0lBQ0QsTUFBTSxRQUFRLEdBQWEsRUFBRSxDQUFDO0lBQzlCLEtBQUssTUFBTSxPQUFPLElBQUksT0FBTyxDQUFDLEtBQUssQ0FBQyxHQUFHLENBQUMsRUFBRSxDQUFDO1FBQ3pDLElBQUksQ0FBQyxPQUFPLElBQUksT0FBTyxLQUFLLEdBQUc7WUFBRSxTQUFTO1FBQzFDLElBQUksT0FBTyxLQUFLLElBQUksRUFBRSxDQUFDO1lBQ3JCLElBQUksUUFBUSxDQUFDLE1BQU0sS0FBSyxDQUFDO2dCQUFFLE9BQU8sU0FBUyxDQUFDO1lBQzVDLFFBQVEsQ0FBQyxHQUFHLEVBQUUsQ0FBQztZQUNmLFNBQVM7UUFDWCxDQUFDO1FBQ0QsSUFBSSxDQUFDLG1CQUFtQixDQUFDLElBQUksQ0FBQyxPQUFPLENBQUM7WUFBRSxPQUFPLFNBQVMsQ0FBQztRQUN6RCxRQUFRLENBQUMsSUFBSSxDQUFDLE9BQU8sQ0FBQyxDQUFDO0lBQ3pCLENBQUM7SUFDRCxPQUFPLElBQUksUUFBUSxDQUFDLElBQUksQ0FBQyxHQUFHLENBQUMsRUFBRSxDQUFDO0FBQ2xDLENBQUMsQ0FBQztBQUVGLHVGQUF1RjtBQUN2RixNQUFNLENBQUMsTUFBTSw0QkFBNEIsR0FBRyxDQUFDLGdCQUF5QixFQUFZLEVBQUU7SUFDbEYsSUFBSSxnQkFBZ0IsS0FBSyxTQUFTO1FBQUUsT0FBTyxFQUFFLENBQUM7SUFDOUMsSUFBSSxDQUFDLEtBQUssQ0FBQyxPQUFPLENBQUMsZ0JBQWdCLENBQUM7UUFBRSxPQUFPLENBQUMsZ0NBQWdDLENBQUMsQ0FBQztJQUNoRixJQUFJLGdCQUFnQixDQUFDLE1BQU0sS0FBSyxDQUFDLEVBQUUsQ0FBQztRQUNsQyxPQUFPLENBQUMsK0RBQStELENBQUMsQ0FBQztJQUMzRSxDQUFDO0lBQ0QsSUFBSSxnQkFBZ0IsQ0FBQyxNQUFNLEdBQUcseUJBQXlCLENBQUMsV0FBVyxFQUFFLENBQUM7UUFDcEUsT0FBTyxDQUFDLHNDQUFzQyx5QkFBeUIsQ0FBQyxXQUFXLFVBQVUsQ0FBQyxDQUFDO0lBQ2pHLENBQUM7SUFDRCxJQUFJLFVBQVUsR0FBRyxDQUFDLENBQUM7SUFDbkIsS0FBSyxNQUFNLENBQUMsS0FBSyxFQUFFLFFBQVEsQ0FBQyxJQUFJLGdCQUFnQixDQUFDLE9BQU8sRUFBRSxFQUFFLENBQUM7UUFDM0QsSUFBSSxPQUFPLFFBQVEsS0FBSyxRQUFRLElBQUksUUFBUSxDQUFDLE1BQU0sS0FBSyxDQUFDLEVBQUUsQ0FBQztZQUMxRCxPQUFPLENBQUMsaUJBQWlCLEtBQUssOEJBQThCLENBQUMsQ0FBQztRQUNoRSxDQUFDO1FBQ0QsSUFBSSx1QkFBdUIsQ0FBQyxJQUFJLENBQUMsUUFBUSxDQUFDLEVBQUUsQ0FBQztZQUMzQyxPQUFPLENBQUMsaUJBQWlCLEtBQUssdUNBQXVDLENBQUMsQ0FBQztRQUN6RSxDQUFDO1FBQ0QsTUFBTSxhQUFhLEdBQUcsSUFBSSxXQUFXLEVBQUUsQ0FBQyxNQUFNLENBQUMsUUFBUSxDQUFDLENBQUMsVUFBVSxDQUFDO1FBQ3BFLElBQUksYUFBYSxHQUFHLHlCQUF5QixDQUFDLGVBQWUsRUFBRSxDQUFDO1lBQzlELE9BQU8sQ0FBQyxpQkFBaUIsS0FBSyxvQ0FBb0MsQ0FBQyxDQUFDO1FBQ3RFLENBQUM7UUFDRCxVQUFVLElBQUksYUFBYSxDQUFDO0lBQzlCLENBQUM7SUFDRCxJQUFJLFVBQVUsR0FBRyx5QkFBeUIsQ0FBQyxpQkFBaUIsRUFBRSxDQUFDO1FBQzdELE9BQU8sQ0FBQyxzREFBc0QsQ0FBQyxDQUFDO0lBQ2xFLENBQUM7SUFDRCxPQUFPLEVBQUUsQ0FBQztBQUNaLENBQUMsQ0FBQyJ9
+//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoic2VydmljZS5qcyIsInNvdXJjZVJvb3QiOiIiLCJzb3VyY2VzIjpbIi4uLy4uL3RzL2RhdGEvc2VydmljZS50cyJdLCJuYW1lcyI6W10sIm1hcHBpbmdzIjoiQUFvQ0EsTUFBTSxtQkFBbUIsR0FBRyxxQ0FBcUMsQ0FBQztBQUVsRSxpRkFBaUY7QUFDakYsTUFBTSxDQUFDLE1BQU0sc0JBQXNCLEdBQUcsQ0FBQyxRQUFpQixFQUFZLEVBQUU7SUFDcEUsSUFBSSxPQUFPLFFBQVEsS0FBSyxRQUFRLElBQUksQ0FBQyxtQkFBbUIsQ0FBQyxJQUFJLENBQUMsUUFBUSxDQUFDLEVBQUUsQ0FBQztRQUN4RSxPQUFPLENBQUMsK0RBQStELENBQUMsQ0FBQztJQUMzRSxDQUFDO0lBQ0QsT0FBTyxFQUFFLENBQUM7QUFDWixDQUFDLENBQUM7QUFFRixNQUFNLENBQUMsTUFBTSx5QkFBeUIsR0FBRztJQUN2QyxXQUFXLEVBQUUsRUFBRTtJQUNmLGVBQWUsRUFBRSxJQUFJO0lBQ3JCLGlCQUFpQixFQUFFLEVBQUUsR0FBRyxJQUFJO0NBQ3BCLENBQUM7QUFFWCxNQUFNLENBQUMsTUFBTSw0QkFBNEIsR0FBRyxDQUFDLE9BQWUsRUFBc0IsRUFBRTtJQUNsRixJQUFJLE9BQU8sT0FBTyxLQUFLLFFBQVE7V0FDMUIsQ0FBQyxPQUFPLENBQUMsVUFBVSxDQUFDLEdBQUcsQ0FBQztXQUN4QixPQUFPLENBQUMsUUFBUSxDQUFDLElBQUksQ0FBQztXQUN0QixPQUFPLENBQUMsTUFBTSxHQUFHLEdBQUcsRUFBRSxDQUFDO1FBQzFCLE9BQU8sU0FBUyxDQUFDO0lBQ25CLENBQUM7SUFDRCxNQUFNLFFBQVEsR0FBYSxFQUFFLENBQUM7SUFDOUIsS0FBSyxNQUFNLE9BQU8sSUFBSSxPQUFPLENBQUMsS0FBSyxDQUFDLEdBQUcsQ0FBQyxFQUFFLENBQUM7UUFDekMsSUFBSSxDQUFDLE9BQU8sSUFBSSxPQUFPLEtBQUssR0FBRztZQUFFLFNBQVM7UUFDMUMsSUFBSSxPQUFPLEtBQUssSUFBSSxFQUFFLENBQUM7WUFDckIsSUFBSSxRQUFRLENBQUMsTUFBTSxLQUFLLENBQUM7Z0JBQUUsT0FBTyxTQUFTLENBQUM7WUFDNUMsUUFBUSxDQUFDLEdBQUcsRUFBRSxDQUFDO1lBQ2YsU0FBUztRQUNYLENBQUM7UUFDRCxJQUFJLENBQUMsbUJBQW1CLENBQUMsSUFBSSxDQUFDLE9BQU8sQ0FBQztZQUFFLE9BQU8sU0FBUyxDQUFDO1FBQ3pELFFBQVEsQ0FBQyxJQUFJLENBQUMsT0FBTyxDQUFDLENBQUM7SUFDekIsQ0FBQztJQUNELE9BQU8sSUFBSSxRQUFRLENBQUMsSUFBSSxDQUFDLEdBQUcsQ0FBQyxFQUFFLENBQUM7QUFDbEMsQ0FBQyxDQUFDO0FBRUYsdUZBQXVGO0FBQ3ZGLE1BQU0sQ0FBQyxNQUFNLDRCQUE0QixHQUFHLENBQUMsZ0JBQXlCLEVBQVksRUFBRTtJQUNsRixJQUFJLGdCQUFnQixLQUFLLFNBQVM7UUFBRSxPQUFPLEVBQUUsQ0FBQztJQUM5QyxJQUFJLENBQUMsS0FBSyxDQUFDLE9BQU8sQ0FBQyxnQkFBZ0IsQ0FBQztRQUFFLE9BQU8sQ0FBQyxnQ0FBZ0MsQ0FBQyxDQUFDO0lBQ2hGLElBQUksZ0JBQWdCLENBQUMsTUFBTSxLQUFLLENBQUMsRUFBRSxDQUFDO1FBQ2xDLE9BQU8sQ0FBQywrREFBK0QsQ0FBQyxDQUFDO0lBQzNFLENBQUM7SUFDRCxJQUFJLGdCQUFnQixDQUFDLE1BQU0sR0FBRyx5QkFBeUIsQ0FBQyxXQUFXLEVBQUUsQ0FBQztRQUNwRSxPQUFPLENBQUMsc0NBQXNDLHlCQUF5QixDQUFDLFdBQVcsVUFBVSxDQUFDLENBQUM7SUFDakcsQ0FBQztJQUNELElBQUksVUFBVSxHQUFHLENBQUMsQ0FBQztJQUNuQixLQUFLLE1BQU0sQ0FBQyxLQUFLLEVBQUUsUUFBUSxDQUFDLElBQUksZ0JBQWdCLENBQUMsT0FBTyxFQUFFLEVBQUUsQ0FBQztRQUMzRCxJQUFJLE9BQU8sUUFBUSxLQUFLLFFBQVEsSUFBSSxRQUFRLENBQUMsTUFBTSxLQUFLLENBQUMsRUFBRSxDQUFDO1lBQzFELE9BQU8sQ0FBQyxpQkFBaUIsS0FBSyw4QkFBOEIsQ0FBQyxDQUFDO1FBQ2hFLENBQUM7UUFDRCxJQUFJLHVCQUF1QixDQUFDLElBQUksQ0FBQyxRQUFRLENBQUMsRUFBRSxDQUFDO1lBQzNDLE9BQU8sQ0FBQyxpQkFBaUIsS0FBSyx1Q0FBdUMsQ0FBQyxDQUFDO1FBQ3pFLENBQUM7UUFDRCxNQUFNLGFBQWEsR0FBRyxJQUFJLFdBQVcsRUFBRSxDQUFDLE1BQU0sQ0FBQyxRQUFRLENBQUMsQ0FBQyxVQUFVLENBQUM7UUFDcEUsSUFBSSxhQUFhLEdBQUcseUJBQXlCLENBQUMsZUFBZSxFQUFFLENBQUM7WUFDOUQsT0FBTyxDQUFDLGlCQUFpQixLQUFLLG9DQUFvQyxDQUFDLENBQUM7UUFDdEUsQ0FBQztRQUNELFVBQVUsSUFBSSxhQUFhLENBQUM7SUFDOUIsQ0FBQztJQUNELElBQUksVUFBVSxHQUFHLHlCQUF5QixDQUFDLGlCQUFpQixFQUFFLENBQUM7UUFDN0QsT0FBTyxDQUFDLHNEQUFzRCxDQUFDLENBQUM7SUFDbEUsQ0FBQztJQUNELE9BQU8sRUFBRSxDQUFDO0FBQ1osQ0FBQyxDQUFDIn0=

package/dist_ts/requests/hostedapp.d.ts

@@ -1,6 +1,86 @@
 import * as plugins from '../plugins.js';
+import type * as data from '../data/index.js';
 import type { IIdentity, IIdentityCredential } from '../data/user.js';
 import type { IHostedAppBootstrapAction, IHostedAppBootstrapActionRequest, IHostedAppLifecycleReport, IHostedAppLifecycleState, IHostedAppUpgradeState } from '../data/hostedapp.js';
+export interface IReq_GetHostedAppAccessConfiguration extends plugins.typedrequestInterfaces.implementsTR<plugins.typedrequestInterfaces.ITypedRequest, IReq_GetHostedAppAccessConfiguration> {
+    method: 'getHostedAppAccessConfiguration';
+    request: {
+        identity: data.IIdentity;
+    };
+    response: {
+        users: Array<{
+            userId: string;
+            username: string;
+            role: 'admin' | 'user';
+            platformOidcIssuer?: string;
+        }>;
+        assignments: data.IHostedAppRoleAssignment[];
+        apps: Array<{
+            serviceId: string;
+            appInstanceId: string;
+            displayName: string;
+            roles: data.IHostedAppRoleDefinition[];
+            platformOidcSupported: boolean;
+            platformOidcRegistration?: data.IHostedAppPlatformOidcRegistration;
+        }>;
+    };
+}
+export interface IReq_SetHostedAppRoleAssignment extends plugins.typedrequestInterfaces.implementsTR<plugins.typedrequestInterfaces.ITypedRequest, IReq_SetHostedAppRoleAssignment> {
+    method: 'setHostedAppRoleAssignment';
+    request: {
+        identity: data.IIdentity;
+        userId: string;
+        appInstanceId: string;
+        roleIds: string[];
+    };
+    response: {
+        assignment: data.IHostedAppRoleAssignment | null;
+    };
+}
+export interface IReq_SetHostedAppPlatformOidc extends plugins.typedrequestInterfaces.implementsTR<plugins.typedrequestInterfaces.ITypedRequest, IReq_SetHostedAppPlatformOidc> {
+    method: 'setHostedAppPlatformOidc';
+    request: {
+        identity: data.IIdentity;
+        appInstanceId: string;
+        enabled: boolean;
+    };
+    response: {
+        registration: data.IHostedAppPlatformOidcRegistration;
+    };
+}
+export interface IReq_GetHostedAppOidcAuthorization extends plugins.typedrequestInterfaces.implementsTR<plugins.typedrequestInterfaces.ITypedRequest, IReq_GetHostedAppOidcAuthorization> {
+    method: 'getHostedAppOidcAuthorization';
+    request: {
+        identity: data.IIdentity;
+        requestId: string;
+    };
+    response: {
+        appInstanceId: string;
+        appName: string;
+        roleIds: string[];
+        expiresAt: number;
+    };
+}
+export interface IReq_CompleteHostedAppOidcAuthorization extends plugins.typedrequestInterfaces.implementsTR<plugins.typedrequestInterfaces.ITypedRequest, IReq_CompleteHostedAppOidcAuthorization> {
+    method: 'completeHostedAppOidcAuthorization';
+    request: {
+        identity: data.IIdentity;
+        requestId: string;
+    };
+    response: {
+        redirectUrl: string;
+    };
+}
+export interface IReq_CancelHostedAppOidcAuthorization extends plugins.typedrequestInterfaces.implementsTR<plugins.typedrequestInterfaces.ITypedRequest, IReq_CancelHostedAppOidcAuthorization> {
+    method: 'cancelHostedAppOidcAuthorization';
+    request: {
+        identity: data.IIdentity;
+        requestId: string;
+    };
+    response: {
+        redirectUrl: string;
+    };
+}
 export interface IReq_HostedApp_ReportLifecycleState extends plugins.typedrequestInterfaces.implementsTR<plugins.typedrequestInterfaces.ITypedRequest, IReq_HostedApp_ReportLifecycleState> {
     method: 'hostedAppReportLifecycleState';
     request: {

package/dist_ts/requests/hostedapp.js

@@ -36,4 +36,4 @@ export const validateHostedAppCompleteBootstrapActionRequest = (requestArg) => {
     }
     return errors;
 };
-//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoiaG9zdGVkYXBwLmpzIiwic291cmNlUm9vdCI6IiIsInNvdXJjZXMiOlsiLi4vLi4vdHMvcmVxdWVzdHMvaG9zdGVkYXBwLnRzIl0sIm5hbWVzIjpbXSwibWFwcGluZ3MiOiJBQUFBLE9BQU8sS0FBSyxPQUFPLE1BQU0sZUFBZSxDQUFDO0FBcUV6QyxNQUFNLENBQUMsTUFBTSwrQ0FBK0MsR0FBRyxDQUM3RCxVQUFtQixFQUNULEVBQUU7SUFDWixJQUFJLENBQUMsVUFBVSxJQUFJLE9BQU8sVUFBVSxLQUFLLFFBQVEsSUFBSSxLQUFLLENBQUMsT0FBTyxDQUFDLFVBQVUsQ0FBQyxFQUFFLENBQUM7UUFDL0UsT0FBTyxDQUFDLG1EQUFtRCxDQUFDLENBQUM7SUFDL0QsQ0FBQztJQUNELE1BQU0sT0FBTyxHQUFHLFVBQXFDLENBQUM7SUFDdEQsTUFBTSxNQUFNLEdBQWEsRUFBRSxDQUFDO0lBQzVCLE1BQU0sV0FBVyxHQUFHLElBQUksR0FBRyxDQUFDO1FBQzFCLFVBQVU7UUFDVixVQUFVO1FBQ1Ysd0JBQXdCO1FBQ3hCLHNCQUFzQjtRQUN0QixTQUFTO0tBQ1YsQ0FBQyxDQUFDO0lBQ0gsSUFBSSxNQUFNLENBQUMsSUFBSSxDQUFDLE9BQU8sQ0FBQyxDQUFDLElBQUksQ0FBQyxDQUFDLE1BQU0sRUFBRSxFQUFFLENBQUMsQ0FBQyxXQUFXLENBQUMsR0FBRyxDQUFDLE1BQU0sQ0FBQyxDQUFDLEVBQUUsQ0FBQztRQUNwRSxNQUFNLENBQUMsSUFBSSxDQUFDLG9FQUFvRSxDQUFDLENBQUM7SUFDcEYsQ0FBQztJQUNELElBQUksQ0FBQyxPQUFPLENBQUMsUUFBUSxJQUFJLE9BQU8sT0FBTyxDQUFDLFFBQVEsS0FBSyxRQUFRO1dBQ3hELE9BQVEsT0FBTyxDQUFDLFFBQW9DLENBQUMsR0FBRyxLQUFLLFFBQVEsRUFBRSxDQUFDO1FBQzNFLE1BQU0sQ0FBQyxJQUFJLENBQUMseURBQXlELENBQUMsQ0FBQztJQUN6RSxDQUFDO0lBQ0QsSUFBSSxPQUFPLE9BQU8sQ0FBQyxRQUFRLEtBQUssUUFBUTtXQUNuQyxDQUFDLHFDQUFxQyxDQUFDLElBQUksQ0FBQyxPQUFPLENBQUMsUUFBUSxDQUFDLEVBQUUsQ0FBQztRQUNuRSxNQUFNLENBQUMsSUFBSSxDQUFDLDREQUE0RCxDQUFDLENBQUM7SUFDNUUsQ0FBQztJQUNELElBQUksQ0FBQyxNQUFNLENBQUMsYUFBYSxDQUFDLE9BQU8sQ0FBQyxzQkFBc0IsQ0FBQztXQUNuRCxPQUFPLENBQUMsc0JBQWlDLEdBQUcsQ0FBQyxFQUFFLENBQUM7UUFDcEQsTUFBTSxDQUFDLElBQUksQ0FBQywyREFBMkQsQ0FBQyxDQUFDO0lBQzNFLENBQUM7SUFDRCxJQUFJLE9BQU8sQ0FBQyxvQkFBb0IsS0FBSyxPQUFPLEVBQUUsQ0FBQztRQUM3QyxNQUFNLENBQUMsSUFBSSxDQUFDLHlEQUF5RCxDQUFDLENBQUM7SUFDekUsQ0FBQztJQUNELElBQUksT0FBTyxDQUFDLE9BQU8sS0FBSyxTQUFTO1dBQzVCLENBQUMsT0FBTyxPQUFPLENBQUMsT0FBTyxLQUFLLFFBQVEsSUFBSSxPQUFPLENBQUMsT0FBTyxDQUFDLE1BQU0sR0FBRyxJQUFJLENBQUMsRUFBRSxDQUFDO1FBQzVFLE1BQU0sQ0FBQyxJQUFJLENBQUMseURBQXlELENBQUMsQ0FBQztJQUN6RSxDQUFDO0lBQ0QsT0FBTyxNQUFNLENBQUM7QUFDaEIsQ0FBQyxDQUFDIn0=
+//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoiaG9zdGVkYXBwLmpzIiwic291cmNlUm9vdCI6IiIsInNvdXJjZXMiOlsiLi4vLi4vdHMvcmVxdWVzdHMvaG9zdGVkYXBwLnRzIl0sIm5hbWVzIjpbXSwibWFwcGluZ3MiOiJBQUFBLE9BQU8sS0FBSyxPQUFPLE1BQU0sZUFBZSxDQUFDO0FBNkt6QyxNQUFNLENBQUMsTUFBTSwrQ0FBK0MsR0FBRyxDQUM3RCxVQUFtQixFQUNULEVBQUU7SUFDWixJQUFJLENBQUMsVUFBVSxJQUFJLE9BQU8sVUFBVSxLQUFLLFFBQVEsSUFBSSxLQUFLLENBQUMsT0FBTyxDQUFDLFVBQVUsQ0FBQyxFQUFFLENBQUM7UUFDL0UsT0FBTyxDQUFDLG1EQUFtRCxDQUFDLENBQUM7SUFDL0QsQ0FBQztJQUNELE1BQU0sT0FBTyxHQUFHLFVBQXFDLENBQUM7SUFDdEQsTUFBTSxNQUFNLEdBQWEsRUFBRSxDQUFDO0lBQzVCLE1BQU0sV0FBVyxHQUFHLElBQUksR0FBRyxDQUFDO1FBQzFCLFVBQVU7UUFDVixVQUFVO1FBQ1Ysd0JBQXdCO1FBQ3hCLHNCQUFzQjtRQUN0QixTQUFTO0tBQ1YsQ0FBQyxDQUFDO0lBQ0gsSUFBSSxNQUFNLENBQUMsSUFBSSxDQUFDLE9BQU8sQ0FBQyxDQUFDLElBQUksQ0FBQyxDQUFDLE1BQU0sRUFBRSxFQUFFLENBQUMsQ0FBQyxXQUFXLENBQUMsR0FBRyxDQUFDLE1BQU0sQ0FBQyxDQUFDLEVBQUUsQ0FBQztRQUNwRSxNQUFNLENBQUMsSUFBSSxDQUFDLG9FQUFvRSxDQUFDLENBQUM7SUFDcEYsQ0FBQztJQUNELElBQUksQ0FBQyxPQUFPLENBQUMsUUFBUSxJQUFJLE9BQU8sT0FBTyxDQUFDLFFBQVEsS0FBSyxRQUFRO1dBQ3hELE9BQVEsT0FBTyxDQUFDLFFBQW9DLENBQUMsR0FBRyxLQUFLLFFBQVEsRUFBRSxDQUFDO1FBQzNFLE1BQU0sQ0FBQyxJQUFJLENBQUMseURBQXlELENBQUMsQ0FBQztJQUN6RSxDQUFDO0lBQ0QsSUFBSSxPQUFPLE9BQU8sQ0FBQyxRQUFRLEtBQUssUUFBUTtXQUNuQyxDQUFDLHFDQUFxQyxDQUFDLElBQUksQ0FBQyxPQUFPLENBQUMsUUFBUSxDQUFDLEVBQUUsQ0FBQztRQUNuRSxNQUFNLENBQUMsSUFBSSxDQUFDLDREQUE0RCxDQUFDLENBQUM7SUFDNUUsQ0FBQztJQUNELElBQUksQ0FBQyxNQUFNLENBQUMsYUFBYSxDQUFDLE9BQU8sQ0FBQyxzQkFBc0IsQ0FBQztXQUNuRCxPQUFPLENBQUMsc0JBQWlDLEdBQUcsQ0FBQyxFQUFFLENBQUM7UUFDcEQsTUFBTSxDQUFDLElBQUksQ0FBQywyREFBMkQsQ0FBQyxDQUFDO0lBQzNFLENBQUM7SUFDRCxJQUFJLE9BQU8sQ0FBQyxvQkFBb0IsS0FBSyxPQUFPLEVBQUUsQ0FBQztRQUM3QyxNQUFNLENBQUMsSUFBSSxDQUFDLHlEQUF5RCxDQUFDLENBQUM7SUFDekUsQ0FBQztJQUNELElBQUksT0FBTyxDQUFDLE9BQU8sS0FBSyxTQUFTO1dBQzVCLENBQUMsT0FBTyxPQUFPLENBQUMsT0FBTyxLQUFLLFFBQVEsSUFBSSxPQUFPLENBQUMsT0FBTyxDQUFDLE1BQU0sR0FBRyxJQUFJLENBQUMsRUFBRSxDQUFDO1FBQzVFLE1BQU0sQ0FBQyxJQUFJLENBQUMseURBQXlELENBQUMsQ0FBQztJQUN6RSxDQUFDO0lBQ0QsT0FBTyxNQUFNLENBQUM7QUFDaEIsQ0FBQyxDQUFDIn0=

package/dist_ts/requests/service.d.ts

@@ -202,6 +202,8 @@ export interface IRequest_Any_Cloudly_CreateService extends plugins.typedrequest
     method: 'createService';
     request: {
         identity: IIdentity;
+        /** Canonical organization authority assigned by Cloudly to the new service. */
+        organizationId: string;
         serviceData: TServiceWritableData;
     };
     response: {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@serve.zone/interfaces",
-  "version": "24.2.0",
+  "version": "25.1.0",
   "private": false,
   "description": "Shared TypeScript interfaces and TypedRequest contracts for the serve.zone ecosystem.",
   "exports": {
@@ -26,7 +26,7 @@
     "@git.zone/tsbuild": "^4.4.2",
     "@git.zone/tsdoc": "^2.1.1",
     "@git.zone/tsrun": "^2.0.6",
-    "@git.zone/tstest": "^3.6.7",
+    "@git.zone/tstest": "^4.0.0",
     "@types/node": "^26.1.1"
   },
   "files": [

package/readme.md

@@ -30,6 +30,13 @@ import { appstore, data, platform, platformservice, requests } from '@serve.zone
 
 This package intentionally has no service implementation logic. It is a stable vocabulary for services that need to agree on payload shape, method names, and response types.
 
+Service creation carries canonical ownership separately from caller-writable
+service data. `requests.service.IRequest_Any_Cloudly_CreateService` requires a
+top-level `organizationId`, while `data.TServiceWritableData` excludes the
+server-managed ownership field. Consumers should use
+`data.validateOrganizationId()` to validate the identifier shape and verify
+the request's ownership authorization separately before persistence.
+
 ## Secrets v24 Pre-Cutover Contract
 
 Version 24 retains the value-free v23 architecture while replacing the remaining
@@ -515,6 +522,8 @@ const config: appstore.IAppStoreVersionConfig = {
 
 `data.IHostedAppRoleAssignment` binds a stable user subject to an immutable `appInstanceId`. That same app instance is the OIDC `client_id`, the ID-token `aud`, and the `servezone_app_instance_id` claim. Tokens include only the assigned roles for that audience; `preferred_username` is display metadata and must not be treated as identity authority.
 
+`requests.hostedapp` exports the shared authorization RPCs used by a host dashboard. `getHostedAppAccessConfiguration` returns human user summaries, role assignments, and hosted-app summaries. `setHostedAppRoleAssignment` returns the assignment or `null` when it is removed, while `setHostedAppPlatformOidc` returns the current registration state. `getHostedAppOidcAuthorization` returns the app and role summary for a pending request; `completeHostedAppOidcAuthorization` and `cancelHostedAppOidcAuthorization` return the redirect URL. All six requests require a full `data.IIdentity`.
+
 Validate untrusted manifests, registrations, and claims with:
 
 - `data.validateHostedAppRoleDefinitions`

package/ts/00_commitinfo_data.ts

@@ -3,6 +3,6 @@
  */
 export const commitinfo = {
   name: '@serve.zone/interfaces',
-  version: '24.2.0',
+  version: '25.1.0',
   description: 'Shared TypeScript interfaces and TypedRequest contracts for the serve.zone ecosystem.'
 }

package/ts/data/service.ts

@@ -34,6 +34,16 @@ export interface IServiceVolume {
   options?: Record<string, string>;
 }
 
+const organizationIdRegex = /^[A-Za-z0-9][A-Za-z0-9:._-]{0,199}$/;
+
+/** Validates the canonical organization authority used by service operations. */
+export const validateOrganizationId = (valueArg: unknown): string[] => {
+  if (typeof valueArg !== 'string' || !organizationIdRegex.test(valueArg)) {
+    return ['organizationId must be a canonical 1-200 character identifier'];
+  }
+  return [];
+};
+
 export const serviceContainerArgLimits = {
   maximumArgs: 64,
   maximumArgBytes: 4096,

package/ts/requests/hostedapp.ts

@@ -1,4 +1,5 @@
 import * as plugins from '../plugins.js';
+import type * as data from '../data/index.js';
 import type { IIdentity, IIdentityCredential } from '../data/user.js';
 import type {
   IHostedAppBootstrapAction,
@@ -8,6 +9,109 @@ import type {
   IHostedAppUpgradeState,
 } from '../data/hostedapp.js';
 
+export interface IReq_GetHostedAppAccessConfiguration extends plugins.typedrequestInterfaces.implementsTR<
+  plugins.typedrequestInterfaces.ITypedRequest,
+  IReq_GetHostedAppAccessConfiguration
+> {
+  method: 'getHostedAppAccessConfiguration';
+  request: {
+    identity: data.IIdentity;
+  };
+  response: {
+    users: Array<{
+      userId: string;
+      username: string;
+      role: 'admin' | 'user';
+      platformOidcIssuer?: string;
+    }>;
+    assignments: data.IHostedAppRoleAssignment[];
+    apps: Array<{
+      serviceId: string;
+      appInstanceId: string;
+      displayName: string;
+      roles: data.IHostedAppRoleDefinition[];
+      platformOidcSupported: boolean;
+      platformOidcRegistration?: data.IHostedAppPlatformOidcRegistration;
+    }>;
+  };
+}
+
+export interface IReq_SetHostedAppRoleAssignment extends plugins.typedrequestInterfaces.implementsTR<
+  plugins.typedrequestInterfaces.ITypedRequest,
+  IReq_SetHostedAppRoleAssignment
+> {
+  method: 'setHostedAppRoleAssignment';
+  request: {
+    identity: data.IIdentity;
+    userId: string;
+    appInstanceId: string;
+    roleIds: string[];
+  };
+  response: {
+    assignment: data.IHostedAppRoleAssignment | null;
+  };
+}
+
+export interface IReq_SetHostedAppPlatformOidc extends plugins.typedrequestInterfaces.implementsTR<
+  plugins.typedrequestInterfaces.ITypedRequest,
+  IReq_SetHostedAppPlatformOidc
+> {
+  method: 'setHostedAppPlatformOidc';
+  request: {
+    identity: data.IIdentity;
+    appInstanceId: string;
+    enabled: boolean;
+  };
+  response: {
+    registration: data.IHostedAppPlatformOidcRegistration;
+  };
+}
+
+export interface IReq_GetHostedAppOidcAuthorization extends plugins.typedrequestInterfaces.implementsTR<
+  plugins.typedrequestInterfaces.ITypedRequest,
+  IReq_GetHostedAppOidcAuthorization
+> {
+  method: 'getHostedAppOidcAuthorization';
+  request: {
+    identity: data.IIdentity;
+    requestId: string;
+  };
+  response: {
+    appInstanceId: string;
+    appName: string;
+    roleIds: string[];
+    expiresAt: number;
+  };
+}
+
+export interface IReq_CompleteHostedAppOidcAuthorization extends plugins.typedrequestInterfaces.implementsTR<
+  plugins.typedrequestInterfaces.ITypedRequest,
+  IReq_CompleteHostedAppOidcAuthorization
+> {
+  method: 'completeHostedAppOidcAuthorization';
+  request: {
+    identity: data.IIdentity;
+    requestId: string;
+  };
+  response: {
+    redirectUrl: string;
+  };
+}
+
+export interface IReq_CancelHostedAppOidcAuthorization extends plugins.typedrequestInterfaces.implementsTR<
+  plugins.typedrequestInterfaces.ITypedRequest,
+  IReq_CancelHostedAppOidcAuthorization
+> {
+  method: 'cancelHostedAppOidcAuthorization';
+  request: {
+    identity: data.IIdentity;
+    requestId: string;
+  };
+  response: {
+    redirectUrl: string;
+  };
+}
+
 export interface IReq_HostedApp_ReportLifecycleState extends plugins.typedrequestInterfaces.implementsTR<
   plugins.typedrequestInterfaces.ITypedRequest,
   IReq_HostedApp_ReportLifecycleState

package/ts/requests/service.ts

@@ -304,6 +304,8 @@ extends plugins.typedrequestInterfaces.implementsTR<
   method: 'createService';
   request: {
     identity: IIdentity;
+    /** Canonical organization authority assigned by Cloudly to the new service. */
+    organizationId: string;
     serviceData: TServiceWritableData;
   };
   response: {