@checkstack/satellite-frontend 0.2.12 → 0.3.0

package/CHANGELOG.md

@@ -1,5 +1,219 @@
 # @checkstack/satellite-frontend
 
+## 0.3.0
+
+### Minor Changes
+
+- f6f9a5c: Add a GitOps `Satellite` kind plus a UI affordance for resetting tokens.
+
+  GitOps owns satellite **metadata only** — `metadata.name`,
+  `spec.region`, and `metadata.labels` (used as the satellite's runtime
+  tags). The bcrypt token is intentionally never expressed in YAML; on
+  first reconcile a satellite is created with a random token that is
+  discarded, and operators must use the Satellites page to retrieve a
+  working credential.
+
+  To support that flow:
+
+  - New service methods: `updateSatelliteMetadata`, `rotateSatelliteToken`,
+    `getSatelliteByName`.
+  - New RPC procs: `updateSatellite`, `rotateSatelliteToken`.
+  - New `RotateSatelliteTokenDialog` and a "Reset token" key icon on the
+    Satellites list. The dialog reuses the one-time-reveal layout from
+    `CreateSatelliteDialog`.
+  - The Satellites list shows a `GitOpsSourceBadge` next to managed
+    satellites and disables the delete button while leaving the
+    token-reset button enabled (so operators can always re-issue a
+    credential without touching YAML).
+
+  The satellite kind reconciler adopts pre-existing satellites by name on
+  first sync, so this is safe to roll out against installations that
+  already have manually-created satellites.
+
+- 3547670: Wire the new tips infrastructure across the frontends:
+
+  **Empty-state coaching.** Replace generic "no items" copy with onboarding
+  guidance — short description, three numbered steps and a primary CTA — on
+  every EmptyState that has a meaningful next action. Affects: catalog
+  (systems + groups), dashboard, health-check page, integrations (subscriptions
+
+  - provider connections), GitOps providers + secrets, GitOps provenance,
+    SLO config + overview, maintenance config, satellites, plugin manager,
+    incident config, announcements. Read-only EmptyStates (incident history,
+    maintenance history, plugin events) get clearer descriptions explaining
+    what would populate them.
+
+  **First-run anchored tips.** Add `<Tip>` popovers to the most important
+  "Create" affordances so first-time users see a one-line explanation of
+  what they're about to make and why it matters: catalog “Add System” /
+  “Add Group”, healthcheck “Create Check”, integrations “New Subscription”,
+  GitOps “Add Provider”, SLO “Create SLO”, maintenance “Create Maintenance”,
+  satellite “Create Satellite”, plugin-manager “Install plugin”, incident
+  “Report Incident”, announcement “New Announcement”. Each tip is dismissed
+  per user (server-backed when signed in, localStorage otherwise) and
+  namespaced through `qualifyTipId(plugin, …)` so it cannot escape the
+  plugin's own namespace.
+
+  **Welcome banner on the dashboard.** A `<TipBanner>` at the top of the
+  dashboard introduces Checkstack's main flow ("add a system, then a health
+  check") with a one-click jump into the catalog.
+
+### Patch Changes
+
+- 950d6ec: Fix mobile UserMenu items rendering at zero height, group menu items by
+  section, and unstack cramped card headers on small viewports.
+
+  - **UserMenu mobile bug**: On mobile, the user-menu Sheet rendered every
+    menu item as a grid row, which combined with `flex-shrink: 1` on each
+    item collapsed the buttons whose internal layout uses `display: flex`
+    (the items registered with `useNavigate` rather than `<Link>`) to zero
+    content height. Switched the mobile container to a flex column with
+    `[&>*]:shrink-0` and added `min-h-0` so the sheet scrolls correctly
+    when the list overflows.
+
+  - **UserMenu grouping**: Slot extensions now accept an optional `group`
+    field. The user menu buckets `UserMenuItemsSlot` extensions by `group`
+    and renders each group under a labeled header (`Workspace`,
+    `Reliability`, `Configuration`, `Documentation`, `Account`). Existing
+    core plugins are tagged with the appropriate group; third-party plugins
+    can pick any of these or supply their own label. Untagged extensions
+    render last with no header. `UserMenuItemsBottomSlot` is unaffected.
+
+  - **Card header responsiveness**: `CardHeaderRow` (the primitive shared by
+    Incident, Maintenance, Auth, Catalog, GitOps and other config cards) now
+    stacks vertically on narrow viewports and only switches to a single row
+    at the `sm` breakpoint, so titles and adjacent filter controls (e.g.
+    status `Select`, "Show resolved" checkbox) no longer cram together on
+    mobile. Refactored the Incident and Maintenance config pages to use the
+    primitive instead of a hand-rolled `flex items-center justify-between`
+    row, and made their `Select` triggers full-width on mobile.
+
+- Updated dependencies [42abfff]
+- Updated dependencies [3547670]
+- Updated dependencies [f6f9a5c]
+- Updated dependencies [f6f9a5c]
+- Updated dependencies [1ef2e79]
+- Updated dependencies [aa89bc5]
+- Updated dependencies [3547670]
+- Updated dependencies [950d6ec]
+- Updated dependencies [3547670]
+- Updated dependencies [3547670]
+  - @checkstack/common@0.9.0
+  - @checkstack/ui@1.8.0
+  - @checkstack/satellite-common@0.4.0
+  - @checkstack/gitops-common@0.3.0
+  - @checkstack/gitops-frontend@0.4.0
+  - @checkstack/frontend-api@0.5.0
+  - @checkstack/tips-frontend@0.2.0
+  - @checkstack/signal-frontend@0.1.2
+
+## 0.2.13
+
+### Patch Changes
+
+- 50e5f5f: Runtime plugin system: install + uninstall plugins from npm, GitHub releases
+  (including private GitHub Enterprise instances), or tarball uploads at
+  runtime, with multi-package bundles, dependency-derived compatibility checks,
+  multi-instance coordination via a Postgres artifact store, and
+  single-coordinator destructive cleanup.
+
+  Highlights:
+
+  - New `PluginSource` discriminated union and `PluginInstaller` /
+    `PluginInstallerRegistry` interfaces in `@checkstack/backend-api`. The
+    GitHub variant accepts an optional `apiBaseUrl` so deployments backed by
+    GitHub Enterprise can install from `https://ghe.example.com/api/v3`
+    instead of `api.github.com`.
+  - New `installPackageMetadataSchema` (Zod) in `@checkstack/common` validates
+    every plugin's `package.json` at install time. Required fields: `name`,
+    `version`, `description`, `author`, `license`, `checkstack.type`,
+    `checkstack.pluginId`. Optional: `checkstack.bundle`,
+    `checkstack.usageInstructions`, `checkstack.allowInstallScripts`.
+  - New `pluginManagerContract` in `@checkstack/pluginmanager-common` with
+    `list`, `previewInstall`, `install`, `previewUninstall`, `uninstall`, and
+    `events` procedures.
+  - New `@checkstack/pluginmanager-frontend` admin UI: installed-plugins list
+    with per-row uninstall (typed-confirmation modal, schema/configs/cascade
+    toggles), install page with NPM / Tarball Upload / GitHub Release tabs
+    (Catalog tab disabled — coming soon), and an events page surfacing the
+    install/uninstall audit log.
+  - New `bunx @checkstack/scripts plugin-pack` CLI for plugin authors —
+    per-package mode produces an npm-shaped tarball; `--bundle` mode produces
+    an outer tarball containing every sibling declared in
+    `package.json#checkstack.bundle`. Published to npm so external authors
+    can `bunx` it directly without a workspace checkout.
+  - Compatibility derived from `package.json#dependencies` ranges
+    (`semver.satisfies` against the platform's loaded `@checkstack/*`
+    versions) — no separate `compatibility` field.
+  - Multi-instance: originator persists artifacts + `plugins` rows + broadcasts
+    install/uninstall; receiving instances do in-process register/unregister
+    only. Destructive ops (drop schema, delete plugin_configs, delete
+    artifacts, delete `plugins` rows) run exactly once on the originator.
+  - Fresh-instance bootstrap: `loadPlugins()` hydrates any
+    `is_uninstallable=true` plugin missing from `node_modules` from the
+    artifact store before normal Phase 1 register.
+  - New schema: `plugin_artifacts` (tarball storage), `plugin_install_events`
+    (audit/error log). `plugins` extended with `version`, `metadata`,
+    `source`, `bundle_id`, `is_primary`. Local plugin sync now writes
+    `version` from each plugin's `package.json` so the admin UI shows real
+    versions instead of `—`.
+  - Tarball-upload endpoint (`POST /api/pluginmanager/upload-tarball`) for
+    the install UI; access-gated by `pluginmanager.plugin.manage`.
+  - Plugin Manager menu link added to the user menu (main grid, alongside
+    Profile / Notification Settings / etc.).
+
+  Cross-cutting changes:
+
+  - Backend request/response logging now flows through `rootLogger` (winston)
+    instead of `hono/logger`. 5xx responses include the response body inline
+    so swallowed early-return errors are visible in the log.
+  - The `/api/:pluginId/*` dispatcher now logs which core service is missing
+    or which `pluginId` had no metadata when it 500s.
+  - New `registerCorePluginMetadata` on `PluginManager` for core routers
+    (like the plugin manager itself) that need their metadata visible to the
+    RPC dispatcher without going through the full plugin lifecycle.
+  - ESLint: `unicorn/no-null` is now disabled globally. Drizzle distinguishes
+    between `null` (writes a real SQL NULL) and `undefined` (skip the column
+    on insert), so treating them as interchangeable produced latent bugs at
+    the persistence boundary. The bulk of the patch-bumped packages above
+    reflect lint-fix touches that landed when this rule was relaxed.
+  - Workspace-wide license normalization to `Elastic-2.0` (matches
+    `LICENSE.md`). Every `package.json` in the workspace now declares the
+    same SPDX identifier; the patch bumps capture this.
+
+  Plugin packages (every `plugins/*`): added a `pack` npm script
+  (`bunx @checkstack/scripts plugin-pack`), mirrored each plugin's
+  `pluginId` from `plugin-metadata.ts` into `package.json#checkstack.pluginId`
+  so install-time validation passes, stubbed any missing required metadata
+  fields (`description`, `author`, `license`), and added
+  `checkstack.bundle` to multi-package plugin primaries (telegram, rcon, ssh,
+  jira, queue-bullmq, queue-memory, cache-memory).
+
+  Breaking changes:
+
+  - The legacy single-method `PluginInstaller` interface (`install(packageName)`)
+    is removed. Callers must use `coreServices.pluginInstallerRegistry`.
+  - The old `pluginAdminContract` and `createPluginAdminRouter` are removed.
+    Replaced by `pluginManagerContract` in `@checkstack/pluginmanager-common`
+    and `createPluginManagerRouter` in `core/backend`.
+  - `@checkstack/test-utils-backend` no longer exports
+    `createMockPluginInstaller` / `MockPluginInstaller` (the legacy interface
+    it shimmed is gone).
+
+  Note: bumps are limited to `minor` (for packages with new public API
+  surface) and `patch` (for downstream consumers, license normalization,
+  and lint fixes). No `major` bumps despite the `PluginInstaller` removal —
+  the legacy interface had no third-party consumers in the wild before this
+  runtime plugin system landed, and the contract surface is the same shape
+  modulo the rename.
+
+- Updated dependencies [50e5f5f]
+  - @checkstack/common@0.8.0
+  - @checkstack/signal-frontend@0.1.1
+  - @checkstack/ui@1.7.1
+  - @checkstack/frontend-api@0.4.2
+  - @checkstack/satellite-common@0.3.2
+
 ## 0.2.12
 
 ### Patch Changes

package/package.json

@@ -1,29 +1,33 @@
 {
   "name": "@checkstack/satellite-frontend",
-  "version": "0.2.12",
+  "version": "0.3.0",
+  "license": "Elastic-2.0",
   "type": "module",
   "main": "src/index.tsx",
   "checkstack": {
     "type": "frontend"
   },
   "scripts": {
-    "typecheck": "tsc --noEmit",
+    "typecheck": "tsgo -b",
     "lint": "bun run lint:code",
     "lint:code": "eslint . --max-warnings 0"
   },
   "dependencies": {
-    "@checkstack/common": "0.7.0",
-    "@checkstack/frontend-api": "0.4.0",
-    "@checkstack/satellite-common": "0.3.0",
-    "@checkstack/signal-frontend": "0.1.0",
-    "@checkstack/ui": "1.6.1",
+    "@checkstack/common": "0.8.0",
+    "@checkstack/frontend-api": "0.4.2",
+    "@checkstack/satellite-common": "0.3.2",
+    "@checkstack/signal-frontend": "0.1.1",
+    "@checkstack/gitops-common": "0.2.2",
+    "@checkstack/gitops-frontend": "0.3.8",
+    "@checkstack/tips-frontend": "0.1.0",
+    "@checkstack/ui": "1.7.1",
     "lucide-react": "^0.344.0",
     "react": "^18.2.0",
     "react-router-dom": "^6.20.0"
   },
   "devDependencies": {
-    "@checkstack/tsconfig": "0.0.5",
-    "@checkstack/scripts": "0.1.2",
+    "@checkstack/tsconfig": "0.0.7",
+    "@checkstack/scripts": "0.3.0",
     "@types/react": "^18.2.0",
     "typescript": "^5.0.0"
   }

package/src/components/RotateSatelliteTokenDialog.tsx

@@ -0,0 +1,195 @@
+import React, { useEffect, useState } from "react";
+import { usePluginClient } from "@checkstack/frontend-api";
+import {
+  SatelliteApi,
+  type SatelliteWithStatus,
+} from "@checkstack/satellite-common";
+import {
+  Dialog,
+  DialogContent,
+  DialogDescription,
+  DialogHeader,
+  DialogTitle,
+  DialogFooter,
+  Button,
+  Input,
+  Label,
+  useToast,
+} from "@checkstack/ui";
+import { Copy, AlertTriangle, RefreshCw } from "lucide-react";
+import { extractErrorMessage } from "@checkstack/common";
+
+interface Props {
+  satellite: SatelliteWithStatus | undefined;
+  onClose: () => void;
+  onRotated: () => void;
+}
+
+interface RotatedCredentials {
+  clientId: string;
+  token: string;
+}
+
+/**
+ * Two-phase dialog: confirm intent → rotate → reveal new credentials once.
+ * Used for both ad-hoc resets and the GitOps "claim my token" workflow,
+ * since GitOps-managed satellites never receive a token via YAML.
+ */
+export const RotateSatelliteTokenDialog: React.FC<Props> = ({
+  satellite,
+  onClose,
+  onRotated,
+}) => {
+  const satelliteClient = usePluginClient(SatelliteApi);
+  const toast = useToast();
+  const [credentials, setCredentials] = useState<RotatedCredentials | undefined>();
+
+  useEffect(() => {
+    if (!satellite) setCredentials(undefined);
+  }, [satellite]);
+
+  const rotateMutation = satelliteClient.rotateSatelliteToken.useMutation({
+    onSuccess: (data) => {
+      setCredentials({
+        clientId: data.satellite.id,
+        token: data.token,
+      });
+      toast.success("Satellite token rotated");
+      onRotated();
+    },
+    onError: (error) => {
+      toast.error(extractErrorMessage(error, "Failed to rotate token"));
+    },
+  });
+
+  const copyToClipboard = async (text: string, label: string) => {
+    try {
+      await navigator.clipboard.writeText(text);
+      toast.success(`${label} copied to clipboard`);
+    } catch {
+      toast.error("Failed to copy to clipboard");
+    }
+  };
+
+  const handleClose = () => {
+    setCredentials(undefined);
+    onClose();
+  };
+
+  if (!satellite) return null;
+
+  if (credentials) {
+    return (
+      <Dialog open onOpenChange={handleClose}>
+        <DialogContent>
+          <DialogHeader>
+            <DialogTitle>New Token Issued</DialogTitle>
+            <DialogDescription>
+              Save the new token securely — the previous token has been
+              invalidated and the new one will not be shown again.
+            </DialogDescription>
+          </DialogHeader>
+
+          <div className="grid gap-4 py-4">
+            <div className="rounded-md border border-warning/50 bg-warning/10 p-3 flex items-start gap-2">
+              <AlertTriangle className="h-4 w-4 text-warning mt-0.5 shrink-0" />
+              <p className="text-sm text-warning">
+                Update the satellite&apos;s configuration with this token. Any
+                running satellite still using the previous token will be
+                disconnected.
+              </p>
+            </div>
+
+            <div className="grid gap-2">
+              <Label htmlFor="rotated-client-id">Client ID</Label>
+              <div className="flex gap-2">
+                <Input
+                  id="rotated-client-id"
+                  value={credentials.clientId}
+                  readOnly
+                  className="font-mono text-sm"
+                />
+                <Button
+                  variant="outline"
+                  size="icon"
+                  onClick={() =>
+                    void copyToClipboard(credentials.clientId, "Client ID")
+                  }
+                >
+                  <Copy className="h-4 w-4" />
+                </Button>
+              </div>
+            </div>
+
+            <div className="grid gap-2">
+              <Label htmlFor="rotated-token">New Token</Label>
+              <div className="flex gap-2">
+                <Input
+                  id="rotated-token"
+                  value={credentials.token}
+                  readOnly
+                  className="font-mono text-sm"
+                />
+                <Button
+                  variant="outline"
+                  size="icon"
+                  onClick={() =>
+                    void copyToClipboard(credentials.token, "Token")
+                  }
+                >
+                  <Copy className="h-4 w-4" />
+                </Button>
+              </div>
+            </div>
+
+            <div className="grid gap-2 mt-2">
+              <Label>Environment Variables</Label>
+              <pre className="rounded-md bg-muted p-3 text-xs font-mono overflow-x-auto">
+                {`CHECKSTACK_CORE_URL=<your-core-url>\nCHECKSTACK_SATELLITE_CLIENT_ID=${credentials.clientId}\nCHECKSTACK_SATELLITE_TOKEN=${credentials.token}`}
+              </pre>
+            </div>
+          </div>
+
+          <DialogFooter>
+            <Button onClick={handleClose}>Done</Button>
+          </DialogFooter>
+        </DialogContent>
+      </Dialog>
+    );
+  }
+
+  return (
+    <Dialog open onOpenChange={handleClose}>
+      <DialogContent>
+        <DialogHeader>
+          <DialogTitle>Reset Satellite Token</DialogTitle>
+          <DialogDescription>
+            Issue a new token for satellite &ldquo;{satellite.name}&rdquo;. The
+            existing token will stop working immediately.
+          </DialogDescription>
+        </DialogHeader>
+
+        <div className="rounded-md border border-warning/50 bg-warning/10 p-3 flex items-start gap-2 my-2">
+          <AlertTriangle className="h-4 w-4 text-warning mt-0.5 shrink-0" />
+          <p className="text-sm text-warning">
+            Any running satellite using the previous token will be disconnected
+            until reconfigured with the new one.
+          </p>
+        </div>
+
+        <DialogFooter>
+          <Button variant="outline" onClick={handleClose}>
+            Cancel
+          </Button>
+          <Button
+            onClick={() => rotateMutation.mutate({ id: satellite.id })}
+            disabled={rotateMutation.isPending}
+          >
+            <RefreshCw className="h-4 w-4 mr-2" />
+            {rotateMutation.isPending ? "Rotating..." : "Rotate Token"}
+          </Button>
+        </DialogFooter>
+      </DialogContent>
+    </Dialog>
+  );
+};

package/src/index.tsx

@@ -26,6 +26,7 @@ export default createFrontendPlugin({
     createSlotExtension(UserMenuItemsSlot, {
       id: "satellite.user-menu.items",
       component: SatelliteMenuItems,
+      metadata: { group: "Reliability" },
     }),
   ],
 });

package/src/pages/SatelliteListPage.tsx

@@ -8,7 +8,9 @@ import {
 import {
   SatelliteApi,
   satelliteAccess,
+  pluginMetadata as satellitePluginMetadata,
 } from "@checkstack/satellite-common";
+import { Tip } from "@checkstack/tips-frontend";
 import type { SatelliteWithStatus } from "@checkstack/satellite-common";
 import {
   Card,
@@ -28,9 +30,14 @@ import {
   ConfirmationModal,
   PageLayout,
 } from "@checkstack/ui";
-import { Plus, Satellite, Trash2, MapPin } from "lucide-react";
+import { Plus, Satellite, Trash2, MapPin, KeyRound } from "lucide-react";
 import { SatelliteStatusBadge } from "../components/SatelliteStatusBadge";
 import { CreateSatelliteDialog } from "../components/CreateSatelliteDialog";
+import { RotateSatelliteTokenDialog } from "../components/RotateSatelliteTokenDialog";
+import {
+  useProvenanceLocks,
+  GitOpsSourceBadge,
+} from "@checkstack/gitops-frontend";
 import { extractErrorMessage } from "@checkstack/common";
 
 const SatelliteListPageContent: React.FC = () => {
@@ -46,6 +53,11 @@ const SatelliteListPageContent: React.FC = () => {
   const [deleteTarget, setDeleteTarget] = useState<
     SatelliteWithStatus | undefined
   >();
+  const [rotateTarget, setRotateTarget] = useState<
+    SatelliteWithStatus | undefined
+  >();
+
+  const { getLock } = useProvenanceLocks();
 
   const {
     data: satellites,
@@ -79,10 +91,19 @@ const SatelliteListPageContent: React.FC = () => {
       loading={accessLoading}
       allowed={canManage}
       actions={
-        <Button onClick={() => setCreateOpen(true)}>
-          <Plus className="h-4 w-4 mr-2" />
-          Create Satellite
-        </Button>
+        <Tip
+          plugin={satellitePluginMetadata}
+          id="create"
+          title="Run checks from anywhere"
+          description="A satellite is a small Checkstack agent you deploy somewhere this server can't reach directly — another region, a customer site, an air-gapped network. Once registered, you can pin specific health checks to it."
+          side="bottom"
+          align="end"
+        >
+          <Button onClick={() => setCreateOpen(true)}>
+            <Plus className="h-4 w-4 mr-2" />
+            Create Satellite
+          </Button>
+        </Tip>
       }
     >
       <Card>
@@ -99,8 +120,22 @@ const SatelliteListPageContent: React.FC = () => {
             </div>
           ) : satelliteList.length === 0 ? (
             <EmptyState
-              title="No satellites configured"
-              description="Deploy satellite nodes to execute health checks from multiple geographic locations."
+              icon={<Satellite className="size-10" />}
+              title="No satellites yet"
+              description="A satellite is a small Checkstack agent you run somewhere else — another region, another VPC, a customer site — that executes health checks and reports results back to this server. You only need them if you want checks to run from a vantage point this server can't reach itself."
+              steps={[
+                "Create a satellite here to mint a registration token.",
+                "Deploy the satellite container or binary on the target machine using that token.",
+                "Once it's online, assign health checks to it on a per-check basis — TCP, HTTP, ping etc. all support satellite execution.",
+              ]}
+              actions={
+                canManage ? (
+                  <Button onClick={() => setCreateOpen(true)}>
+                    <Plus className="h-4 w-4 mr-2" />
+                    Create satellite
+                  </Button>
+                ) : undefined
+              }
             />
           ) : (
             <Table>
@@ -114,39 +149,68 @@ const SatelliteListPageContent: React.FC = () => {
                 </TableRow>
               </TableHeader>
               <TableBody>
-                {satelliteList.map((sat) => (
-                  <TableRow key={sat.id}>
-                    <TableCell>
-                      <p className="font-medium">{sat.name}</p>
-                      <p className="text-xs text-muted-foreground font-mono">
-                        {sat.id}
-                      </p>
-                    </TableCell>
-                    <TableCell>
-                      <div className="flex items-center gap-1.5 text-sm text-muted-foreground">
-                        <MapPin className="h-3.5 w-3.5" />
-                        {sat.region}
-                      </div>
-                    </TableCell>
-                    <TableCell>
-                      <SatelliteStatusBadge status={sat.status} />
-                    </TableCell>
-                    <TableCell>
-                      <span className="text-sm text-muted-foreground font-mono">
-                        {sat.version ?? "—"}
-                      </span>
-                    </TableCell>
-                    <TableCell>
-                      <Button
-                        variant="ghost"
-                        size="sm"
-                        onClick={() => setDeleteTarget(sat)}
-                      >
-                        <Trash2 className="h-4 w-4 text-destructive" />
-                      </Button>
-                    </TableCell>
-                  </TableRow>
-                ))}
+                {satelliteList.map((sat) => {
+                  const lock = getLock({
+                    kind: "Satellite",
+                    entityId: sat.id,
+                  });
+                  return (
+                    <TableRow key={sat.id}>
+                      <TableCell>
+                        <div className="flex items-center gap-2">
+                          {lock.isLocked && lock.provenance && (
+                            <GitOpsSourceBadge provenance={lock.provenance} />
+                          )}
+                          <div>
+                            <p className="font-medium">{sat.name}</p>
+                            <p className="text-xs text-muted-foreground font-mono">
+                              {sat.id}
+                            </p>
+                          </div>
+                        </div>
+                      </TableCell>
+                      <TableCell>
+                        <div className="flex items-center gap-1.5 text-sm text-muted-foreground">
+                          <MapPin className="h-3.5 w-3.5" />
+                          {sat.region}
+                        </div>
+                      </TableCell>
+                      <TableCell>
+                        <SatelliteStatusBadge status={sat.status} />
+                      </TableCell>
+                      <TableCell>
+                        <span className="text-sm text-muted-foreground font-mono">
+                          {sat.version ?? "—"}
+                        </span>
+                      </TableCell>
+                      <TableCell>
+                        <div className="flex items-center gap-1">
+                          <Button
+                            variant="ghost"
+                            size="sm"
+                            title="Reset token"
+                            aria-label={`Reset token for ${sat.name}`}
+                            onClick={() => setRotateTarget(sat)}
+                          >
+                            <KeyRound className="h-4 w-4" />
+                          </Button>
+                          <Button
+                            variant="ghost"
+                            size="sm"
+                            disabled={lock.isLocked}
+                            title={
+                              lock.isLocked ? "Managed by GitOps" : "Delete satellite"
+                            }
+                            aria-label={`Delete ${sat.name}`}
+                            onClick={() => setDeleteTarget(sat)}
+                          >
+                            <Trash2 className="h-4 w-4 text-destructive" />
+                          </Button>
+                        </div>
+                      </TableCell>
+                    </TableRow>
+                  );
+                })}
               </TableBody>
             </Table>
           )}
@@ -169,6 +233,12 @@ const SatelliteListPageContent: React.FC = () => {
         onConfirm={handleDelete}
         isLoading={deleteMutation.isPending}
       />
+
+      <RotateSatelliteTokenDialog
+        satellite={rotateTarget}
+        onClose={() => setRotateTarget(undefined)}
+        onRotated={() => void refetch()}
+      />
     </PageLayout>
   );
 };

package/tsconfig.json

@@ -2,5 +2,31 @@
   "extends": "@checkstack/tsconfig/frontend.json",
   "include": [
     "src"
+  ],
+  "references": [
+    {
+      "path": "../common"
+    },
+    {
+      "path": "../frontend-api"
+    },
+    {
+      "path": "../gitops-common"
+    },
+    {
+      "path": "../gitops-frontend"
+    },
+    {
+      "path": "../satellite-common"
+    },
+    {
+      "path": "../signal-frontend"
+    },
+    {
+      "path": "../tips-frontend"
+    },
+    {
+      "path": "../ui"
+    }
   ]
 }