@serve.zone/interfaces 25.0.0 → 25.1.0

package/changelog.md

@@ -1,5 +1,17 @@
 # Changelog
 
+## 2026-08-07 - 25.1.0
+
+### Features
+
+- add shared hosted-app authorization RPC contracts (hostedapp)
+  - Export Cloudly's access configuration, role assignment, platform OIDC enablement, and authorization completion contracts with full `IIdentity` context.
+
+### Maintenance
+
+- refresh release and test tooling
+  - Update tstest to 4.0.0; retain mature pnpm and Node.js type versions under the configured minimum-release-age policy.
+
 ## 2026-08-01 - 25.0.0
 
 ### Breaking Changes

package/dist_ts/00_commitinfo_data.js

@@ -3,7 +3,7 @@
  */
 export const commitinfo = {
     name: '@serve.zone/interfaces',
-    version: '25.0.0',
+    version: '25.1.0',
     description: 'Shared TypeScript interfaces and TypedRequest contracts for the serve.zone ecosystem.'
 };
 //# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoiMDBfY29tbWl0aW5mb19kYXRhLmpzIiwic291cmNlUm9vdCI6IiIsInNvdXJjZXMiOlsiLi4vdHMvMDBfY29tbWl0aW5mb19kYXRhLnRzIl0sIm5hbWVzIjpbXSwibWFwcGluZ3MiOiJBQUFBOztHQUVHO0FBQ0gsTUFBTSxDQUFDLE1BQU0sVUFBVSxHQUFHO0lBQ3hCLElBQUksRUFBRSx3QkFBd0I7SUFDOUIsT0FBTyxFQUFFLFFBQVE7SUFDakIsV0FBVyxFQUFFLHVGQUF1RjtDQUNyRyxDQUFBIn0=

package/dist_ts/requests/hostedapp.d.ts

@@ -1,6 +1,86 @@
 import * as plugins from '../plugins.js';
+import type * as data from '../data/index.js';
 import type { IIdentity, IIdentityCredential } from '../data/user.js';
 import type { IHostedAppBootstrapAction, IHostedAppBootstrapActionRequest, IHostedAppLifecycleReport, IHostedAppLifecycleState, IHostedAppUpgradeState } from '../data/hostedapp.js';
+export interface IReq_GetHostedAppAccessConfiguration extends plugins.typedrequestInterfaces.implementsTR<plugins.typedrequestInterfaces.ITypedRequest, IReq_GetHostedAppAccessConfiguration> {
+    method: 'getHostedAppAccessConfiguration';
+    request: {
+        identity: data.IIdentity;
+    };
+    response: {
+        users: Array<{
+            userId: string;
+            username: string;
+            role: 'admin' | 'user';
+            platformOidcIssuer?: string;
+        }>;
+        assignments: data.IHostedAppRoleAssignment[];
+        apps: Array<{
+            serviceId: string;
+            appInstanceId: string;
+            displayName: string;
+            roles: data.IHostedAppRoleDefinition[];
+            platformOidcSupported: boolean;
+            platformOidcRegistration?: data.IHostedAppPlatformOidcRegistration;
+        }>;
+    };
+}
+export interface IReq_SetHostedAppRoleAssignment extends plugins.typedrequestInterfaces.implementsTR<plugins.typedrequestInterfaces.ITypedRequest, IReq_SetHostedAppRoleAssignment> {
+    method: 'setHostedAppRoleAssignment';
+    request: {
+        identity: data.IIdentity;
+        userId: string;
+        appInstanceId: string;
+        roleIds: string[];
+    };
+    response: {
+        assignment: data.IHostedAppRoleAssignment | null;
+    };
+}
+export interface IReq_SetHostedAppPlatformOidc extends plugins.typedrequestInterfaces.implementsTR<plugins.typedrequestInterfaces.ITypedRequest, IReq_SetHostedAppPlatformOidc> {
+    method: 'setHostedAppPlatformOidc';
+    request: {
+        identity: data.IIdentity;
+        appInstanceId: string;
+        enabled: boolean;
+    };
+    response: {
+        registration: data.IHostedAppPlatformOidcRegistration;
+    };
+}
+export interface IReq_GetHostedAppOidcAuthorization extends plugins.typedrequestInterfaces.implementsTR<plugins.typedrequestInterfaces.ITypedRequest, IReq_GetHostedAppOidcAuthorization> {
+    method: 'getHostedAppOidcAuthorization';
+    request: {
+        identity: data.IIdentity;
+        requestId: string;
+    };
+    response: {
+        appInstanceId: string;
+        appName: string;
+        roleIds: string[];
+        expiresAt: number;
+    };
+}
+export interface IReq_CompleteHostedAppOidcAuthorization extends plugins.typedrequestInterfaces.implementsTR<plugins.typedrequestInterfaces.ITypedRequest, IReq_CompleteHostedAppOidcAuthorization> {
+    method: 'completeHostedAppOidcAuthorization';
+    request: {
+        identity: data.IIdentity;
+        requestId: string;
+    };
+    response: {
+        redirectUrl: string;
+    };
+}
+export interface IReq_CancelHostedAppOidcAuthorization extends plugins.typedrequestInterfaces.implementsTR<plugins.typedrequestInterfaces.ITypedRequest, IReq_CancelHostedAppOidcAuthorization> {
+    method: 'cancelHostedAppOidcAuthorization';
+    request: {
+        identity: data.IIdentity;
+        requestId: string;
+    };
+    response: {
+        redirectUrl: string;
+    };
+}
 export interface IReq_HostedApp_ReportLifecycleState extends plugins.typedrequestInterfaces.implementsTR<plugins.typedrequestInterfaces.ITypedRequest, IReq_HostedApp_ReportLifecycleState> {
     method: 'hostedAppReportLifecycleState';
     request: {

package/dist_ts/requests/hostedapp.js

@@ -36,4 +36,4 @@ export const validateHostedAppCompleteBootstrapActionRequest = (requestArg) => {
     }
     return errors;
 };
-//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoiaG9zdGVkYXBwLmpzIiwic291cmNlUm9vdCI6IiIsInNvdXJjZXMiOlsiLi4vLi4vdHMvcmVxdWVzdHMvaG9zdGVkYXBwLnRzIl0sIm5hbWVzIjpbXSwibWFwcGluZ3MiOiJBQUFBLE9BQU8sS0FBSyxPQUFPLE1BQU0sZUFBZSxDQUFDO0FBcUV6QyxNQUFNLENBQUMsTUFBTSwrQ0FBK0MsR0FBRyxDQUM3RCxVQUFtQixFQUNULEVBQUU7SUFDWixJQUFJLENBQUMsVUFBVSxJQUFJLE9BQU8sVUFBVSxLQUFLLFFBQVEsSUFBSSxLQUFLLENBQUMsT0FBTyxDQUFDLFVBQVUsQ0FBQyxFQUFFLENBQUM7UUFDL0UsT0FBTyxDQUFDLG1EQUFtRCxDQUFDLENBQUM7SUFDL0QsQ0FBQztJQUNELE1BQU0sT0FBTyxHQUFHLFVBQXFDLENBQUM7SUFDdEQsTUFBTSxNQUFNLEdBQWEsRUFBRSxDQUFDO0lBQzVCLE1BQU0sV0FBVyxHQUFHLElBQUksR0FBRyxDQUFDO1FBQzFCLFVBQVU7UUFDVixVQUFVO1FBQ1Ysd0JBQXdCO1FBQ3hCLHNCQUFzQjtRQUN0QixTQUFTO0tBQ1YsQ0FBQyxDQUFDO0lBQ0gsSUFBSSxNQUFNLENBQUMsSUFBSSxDQUFDLE9BQU8sQ0FBQyxDQUFDLElBQUksQ0FBQyxDQUFDLE1BQU0sRUFBRSxFQUFFLENBQUMsQ0FBQyxXQUFXLENBQUMsR0FBRyxDQUFDLE1BQU0sQ0FBQyxDQUFDLEVBQUUsQ0FBQztRQUNwRSxNQUFNLENBQUMsSUFBSSxDQUFDLG9FQUFvRSxDQUFDLENBQUM7SUFDcEYsQ0FBQztJQUNELElBQUksQ0FBQyxPQUFPLENBQUMsUUFBUSxJQUFJLE9BQU8sT0FBTyxDQUFDLFFBQVEsS0FBSyxRQUFRO1dBQ3hELE9BQVEsT0FBTyxDQUFDLFFBQW9DLENBQUMsR0FBRyxLQUFLLFFBQVEsRUFBRSxDQUFDO1FBQzNFLE1BQU0sQ0FBQyxJQUFJLENBQUMseURBQXlELENBQUMsQ0FBQztJQUN6RSxDQUFDO0lBQ0QsSUFBSSxPQUFPLE9BQU8sQ0FBQyxRQUFRLEtBQUssUUFBUTtXQUNuQyxDQUFDLHFDQUFxQyxDQUFDLElBQUksQ0FBQyxPQUFPLENBQUMsUUFBUSxDQUFDLEVBQUUsQ0FBQztRQUNuRSxNQUFNLENBQUMsSUFBSSxDQUFDLDREQUE0RCxDQUFDLENBQUM7SUFDNUUsQ0FBQztJQUNELElBQUksQ0FBQyxNQUFNLENBQUMsYUFBYSxDQUFDLE9BQU8sQ0FBQyxzQkFBc0IsQ0FBQztXQUNuRCxPQUFPLENBQUMsc0JBQWlDLEdBQUcsQ0FBQyxFQUFFLENBQUM7UUFDcEQsTUFBTSxDQUFDLElBQUksQ0FBQywyREFBMkQsQ0FBQyxDQUFDO0lBQzNFLENBQUM7SUFDRCxJQUFJLE9BQU8sQ0FBQyxvQkFBb0IsS0FBSyxPQUFPLEVBQUUsQ0FBQztRQUM3QyxNQUFNLENBQUMsSUFBSSxDQUFDLHlEQUF5RCxDQUFDLENBQUM7SUFDekUsQ0FBQztJQUNELElBQUksT0FBTyxDQUFDLE9BQU8sS0FBSyxTQUFTO1dBQzVCLENBQUMsT0FBTyxPQUFPLENBQUMsT0FBTyxLQUFLLFFBQVEsSUFBSSxPQUFPLENBQUMsT0FBTyxDQUFDLE1BQU0sR0FBRyxJQUFJLENBQUMsRUFBRSxDQUFDO1FBQzVFLE1BQU0sQ0FBQyxJQUFJLENBQUMseURBQXlELENBQUMsQ0FBQztJQUN6RSxDQUFDO0lBQ0QsT0FBTyxNQUFNLENBQUM7QUFDaEIsQ0FBQyxDQUFDIn0=
+//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoiaG9zdGVkYXBwLmpzIiwic291cmNlUm9vdCI6IiIsInNvdXJjZXMiOlsiLi4vLi4vdHMvcmVxdWVzdHMvaG9zdGVkYXBwLnRzIl0sIm5hbWVzIjpbXSwibWFwcGluZ3MiOiJBQUFBLE9BQU8sS0FBSyxPQUFPLE1BQU0sZUFBZSxDQUFDO0FBNkt6QyxNQUFNLENBQUMsTUFBTSwrQ0FBK0MsR0FBRyxDQUM3RCxVQUFtQixFQUNULEVBQUU7SUFDWixJQUFJLENBQUMsVUFBVSxJQUFJLE9BQU8sVUFBVSxLQUFLLFFBQVEsSUFBSSxLQUFLLENBQUMsT0FBTyxDQUFDLFVBQVUsQ0FBQyxFQUFFLENBQUM7UUFDL0UsT0FBTyxDQUFDLG1EQUFtRCxDQUFDLENBQUM7SUFDL0QsQ0FBQztJQUNELE1BQU0sT0FBTyxHQUFHLFVBQXFDLENBQUM7SUFDdEQsTUFBTSxNQUFNLEdBQWEsRUFBRSxDQUFDO0lBQzVCLE1BQU0sV0FBVyxHQUFHLElBQUksR0FBRyxDQUFDO1FBQzFCLFVBQVU7UUFDVixVQUFVO1FBQ1Ysd0JBQXdCO1FBQ3hCLHNCQUFzQjtRQUN0QixTQUFTO0tBQ1YsQ0FBQyxDQUFDO0lBQ0gsSUFBSSxNQUFNLENBQUMsSUFBSSxDQUFDLE9BQU8sQ0FBQyxDQUFDLElBQUksQ0FBQyxDQUFDLE1BQU0sRUFBRSxFQUFFLENBQUMsQ0FBQyxXQUFXLENBQUMsR0FBRyxDQUFDLE1BQU0sQ0FBQyxDQUFDLEVBQUUsQ0FBQztRQUNwRSxNQUFNLENBQUMsSUFBSSxDQUFDLG9FQUFvRSxDQUFDLENBQUM7SUFDcEYsQ0FBQztJQUNELElBQUksQ0FBQyxPQUFPLENBQUMsUUFBUSxJQUFJLE9BQU8sT0FBTyxDQUFDLFFBQVEsS0FBSyxRQUFRO1dBQ3hELE9BQVEsT0FBTyxDQUFDLFFBQW9DLENBQUMsR0FBRyxLQUFLLFFBQVEsRUFBRSxDQUFDO1FBQzNFLE1BQU0sQ0FBQyxJQUFJLENBQUMseURBQXlELENBQUMsQ0FBQztJQUN6RSxDQUFDO0lBQ0QsSUFBSSxPQUFPLE9BQU8sQ0FBQyxRQUFRLEtBQUssUUFBUTtXQUNuQyxDQUFDLHFDQUFxQyxDQUFDLElBQUksQ0FBQyxPQUFPLENBQUMsUUFBUSxDQUFDLEVBQUUsQ0FBQztRQUNuRSxNQUFNLENBQUMsSUFBSSxDQUFDLDREQUE0RCxDQUFDLENBQUM7SUFDNUUsQ0FBQztJQUNELElBQUksQ0FBQyxNQUFNLENBQUMsYUFBYSxDQUFDLE9BQU8sQ0FBQyxzQkFBc0IsQ0FBQztXQUNuRCxPQUFPLENBQUMsc0JBQWlDLEdBQUcsQ0FBQyxFQUFFLENBQUM7UUFDcEQsTUFBTSxDQUFDLElBQUksQ0FBQywyREFBMkQsQ0FBQyxDQUFDO0lBQzNFLENBQUM7SUFDRCxJQUFJLE9BQU8sQ0FBQyxvQkFBb0IsS0FBSyxPQUFPLEVBQUUsQ0FBQztRQUM3QyxNQUFNLENBQUMsSUFBSSxDQUFDLHlEQUF5RCxDQUFDLENBQUM7SUFDekUsQ0FBQztJQUNELElBQUksT0FBTyxDQUFDLE9BQU8sS0FBSyxTQUFTO1dBQzVCLENBQUMsT0FBTyxPQUFPLENBQUMsT0FBTyxLQUFLLFFBQVEsSUFBSSxPQUFPLENBQUMsT0FBTyxDQUFDLE1BQU0sR0FBRyxJQUFJLENBQUMsRUFBRSxDQUFDO1FBQzVFLE1BQU0sQ0FBQyxJQUFJLENBQUMseURBQXlELENBQUMsQ0FBQztJQUN6RSxDQUFDO0lBQ0QsT0FBTyxNQUFNLENBQUM7QUFDaEIsQ0FBQyxDQUFDIn0=

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@serve.zone/interfaces",
-  "version": "25.0.0",
+  "version": "25.1.0",
   "private": false,
   "description": "Shared TypeScript interfaces and TypedRequest contracts for the serve.zone ecosystem.",
   "exports": {
@@ -26,7 +26,7 @@
     "@git.zone/tsbuild": "^4.4.2",
     "@git.zone/tsdoc": "^2.1.1",
     "@git.zone/tsrun": "^2.0.6",
-    "@git.zone/tstest": "^3.6.7",
+    "@git.zone/tstest": "^4.0.0",
     "@types/node": "^26.1.1"
   },
   "files": [

package/readme.md

@@ -522,6 +522,8 @@ const config: appstore.IAppStoreVersionConfig = {
 
 `data.IHostedAppRoleAssignment` binds a stable user subject to an immutable `appInstanceId`. That same app instance is the OIDC `client_id`, the ID-token `aud`, and the `servezone_app_instance_id` claim. Tokens include only the assigned roles for that audience; `preferred_username` is display metadata and must not be treated as identity authority.
 
+`requests.hostedapp` exports the shared authorization RPCs used by a host dashboard. `getHostedAppAccessConfiguration` returns human user summaries, role assignments, and hosted-app summaries. `setHostedAppRoleAssignment` returns the assignment or `null` when it is removed, while `setHostedAppPlatformOidc` returns the current registration state. `getHostedAppOidcAuthorization` returns the app and role summary for a pending request; `completeHostedAppOidcAuthorization` and `cancelHostedAppOidcAuthorization` return the redirect URL. All six requests require a full `data.IIdentity`.
+
 Validate untrusted manifests, registrations, and claims with:
 
 - `data.validateHostedAppRoleDefinitions`

package/ts/00_commitinfo_data.ts

@@ -3,6 +3,6 @@
  */
 export const commitinfo = {
   name: '@serve.zone/interfaces',
-  version: '25.0.0',
+  version: '25.1.0',
   description: 'Shared TypeScript interfaces and TypedRequest contracts for the serve.zone ecosystem.'
 }

package/ts/requests/hostedapp.ts

@@ -1,4 +1,5 @@
 import * as plugins from '../plugins.js';
+import type * as data from '../data/index.js';
 import type { IIdentity, IIdentityCredential } from '../data/user.js';
 import type {
   IHostedAppBootstrapAction,
@@ -8,6 +9,109 @@ import type {
   IHostedAppUpgradeState,
 } from '../data/hostedapp.js';
 
+export interface IReq_GetHostedAppAccessConfiguration extends plugins.typedrequestInterfaces.implementsTR<
+  plugins.typedrequestInterfaces.ITypedRequest,
+  IReq_GetHostedAppAccessConfiguration
+> {
+  method: 'getHostedAppAccessConfiguration';
+  request: {
+    identity: data.IIdentity;
+  };
+  response: {
+    users: Array<{
+      userId: string;
+      username: string;
+      role: 'admin' | 'user';
+      platformOidcIssuer?: string;
+    }>;
+    assignments: data.IHostedAppRoleAssignment[];
+    apps: Array<{
+      serviceId: string;
+      appInstanceId: string;
+      displayName: string;
+      roles: data.IHostedAppRoleDefinition[];
+      platformOidcSupported: boolean;
+      platformOidcRegistration?: data.IHostedAppPlatformOidcRegistration;
+    }>;
+  };
+}
+
+export interface IReq_SetHostedAppRoleAssignment extends plugins.typedrequestInterfaces.implementsTR<
+  plugins.typedrequestInterfaces.ITypedRequest,
+  IReq_SetHostedAppRoleAssignment
+> {
+  method: 'setHostedAppRoleAssignment';
+  request: {
+    identity: data.IIdentity;
+    userId: string;
+    appInstanceId: string;
+    roleIds: string[];
+  };
+  response: {
+    assignment: data.IHostedAppRoleAssignment | null;
+  };
+}
+
+export interface IReq_SetHostedAppPlatformOidc extends plugins.typedrequestInterfaces.implementsTR<
+  plugins.typedrequestInterfaces.ITypedRequest,
+  IReq_SetHostedAppPlatformOidc
+> {
+  method: 'setHostedAppPlatformOidc';
+  request: {
+    identity: data.IIdentity;
+    appInstanceId: string;
+    enabled: boolean;
+  };
+  response: {
+    registration: data.IHostedAppPlatformOidcRegistration;
+  };
+}
+
+export interface IReq_GetHostedAppOidcAuthorization extends plugins.typedrequestInterfaces.implementsTR<
+  plugins.typedrequestInterfaces.ITypedRequest,
+  IReq_GetHostedAppOidcAuthorization
+> {
+  method: 'getHostedAppOidcAuthorization';
+  request: {
+    identity: data.IIdentity;
+    requestId: string;
+  };
+  response: {
+    appInstanceId: string;
+    appName: string;
+    roleIds: string[];
+    expiresAt: number;
+  };
+}
+
+export interface IReq_CompleteHostedAppOidcAuthorization extends plugins.typedrequestInterfaces.implementsTR<
+  plugins.typedrequestInterfaces.ITypedRequest,
+  IReq_CompleteHostedAppOidcAuthorization
+> {
+  method: 'completeHostedAppOidcAuthorization';
+  request: {
+    identity: data.IIdentity;
+    requestId: string;
+  };
+  response: {
+    redirectUrl: string;
+  };
+}
+
+export interface IReq_CancelHostedAppOidcAuthorization extends plugins.typedrequestInterfaces.implementsTR<
+  plugins.typedrequestInterfaces.ITypedRequest,
+  IReq_CancelHostedAppOidcAuthorization
+> {
+  method: 'cancelHostedAppOidcAuthorization';
+  request: {
+    identity: data.IIdentity;
+    requestId: string;
+  };
+  response: {
+    redirectUrl: string;
+  };
+}
+
 export interface IReq_HostedApp_ReportLifecycleState extends plugins.typedrequestInterfaces.implementsTR<
   plugins.typedrequestInterfaces.ITypedRequest,
   IReq_HostedApp_ReportLifecycleState