@stacksjs/ts-cloud 0.11.7 → 0.12.1

package/dist/operations/drained-sites.d.ts

@@ -0,0 +1,56 @@
+/**
+ * Detect sites whose files are still on a box that no longer serves them.
+ *
+ * `site:move` deliberately never deletes anything on the source: it stops the
+ * units, drops the gateway route, and leaves the whole tree in place. That
+ * leftover tree IS the rollback — the one thing that makes a bad cutover
+ * recoverable, and the reason the operation can promise reversibility "until the
+ * source server is destroyed".
+ *
+ * Which makes destroying that server the moment the promise expires, and nothing
+ * about the box says so. It has no running units for the site, so it looks idle;
+ * the config has moved on; the operator is tidying up. Terminating it is exactly
+ * the right thing to do once the move is verified, and exactly the wrong thing
+ * to do before — and those two look identical from outside.
+ *
+ * So: before a teardown, ask the box whether it is holding anyone's rollback.
+ *
+ * @see https://github.com/stacksjs/ts-cloud/issues/167
+ */
+/**
+ * Report every one of this project's site trees on the box and whether anything
+ * is still running for it.
+ *
+ * Read-only by construction — it lists and queries, and that is all. A scan that
+ * could change the box would be a poor thing to run immediately before deciding
+ * whether to keep it.
+ *
+ * A directory is only counted when it holds `releases/`, so a stray folder under
+ * `/var/www` is not mistaken for a deployed site and does not block a teardown
+ * the operator genuinely wants.
+ */
+export declare function buildDrainedSiteScanScript(slug: string, wwwRoot?: string): string[];
+export interface DrainedSite {
+    name: string;
+    /** Human-readable size of the tree left behind, e.g. `1.2G`. */
+    size: string;
+}
+/**
+ * Sites the box still holds but no longer runs.
+ *
+ * A site with something active is NOT drained — it is simply a site on a box
+ * being torn down, which is ordinary and already covered by the teardown's own
+ * confirmation. The interesting case is files with nothing running: either a
+ * completed `site:move` whose rollback this is, or a site that has been stopped
+ * and forgotten. Both are worth a sentence before the disk goes away.
+ */
+export declare function parseDrainedSites(output: string | undefined): DrainedSite[];
+/**
+ * What the operator sees instead of a teardown.
+ *
+ * Names the sites, says what the files are FOR, and gives the two ways forward.
+ * The flag is deliberately its own thing rather than `--force`: `--force` exists
+ * so a teardown can run unattended, and a CI job that skips a prompt must not
+ * also silently discard the only copy of a rollback.
+ */
+export declare function formatDrainedSiteRefusal(sites: readonly DrainedSite[], slug: string, flag: string): string;

package/dist/operations/drained-sites.test.d.ts

@@ -0,0 +1 @@
+export {};

package/dist/pages/cloudflare-pages.d.ts

@@ -0,0 +1,240 @@
+/**
+ * Deploy a built static site to Cloudflare Pages.
+ *
+ * Pages is the one Cloudflare product that is not reachable through the zone
+ * API the rest of this codebase talks to: projects are account-scoped, and
+ * uploads go through a separate content-addressed flow rather than a single
+ * PUT. The shape of that flow drives this module:
+ *
+ *  - **Files are addressed by hash, not by path.** A deployment is a manifest
+ *    mapping `/path` to a hash; the bytes are uploaded separately, and only for
+ *    hashes the account has never seen. A redeploy of a site whose CSS did not
+ *    change re-uploads nothing for that file, which is why `deployDirectory`
+ *    checks `/pages/assets/check-missing` before sending anything.
+ *  - **The hash is Cloudflare's own, not a plain digest.** It is a blake3 of
+ *    the base64 payload concatenated with the file extension, truncated to 32
+ *    hex characters. Getting this wrong does not error — it uploads fine and
+ *    then serves 404s, because the manifest points at a hash the asset store
+ *    does not hold under that name.
+ *  - **Upload auth is a separate, short-lived JWT**, fetched from
+ *    `/pages/projects/{name}/upload-token`. The account API token cannot be
+ *    used against the asset endpoints.
+ *
+ * A custom domain is attached with {@link attachCustomDomain}, which is
+ * idempotent, and still needs a CNAME in DNS — see {@link pagesDnsRecord}.
+ */
+import type { DnsRecord } from '../dns/types';
+/** Cloudflare's asset-upload ceiling. Larger files are rejected outright. */
+export declare const PAGES_MAX_FILE_BYTES: number;
+export interface CloudflarePagesProject {
+    id: string;
+    name: string;
+    subdomain: string;
+    domains: string[];
+    production_branch?: string;
+}
+export interface CloudflarePagesDeployment {
+    id: string;
+    url: string;
+    environment: string;
+    project_name: string;
+}
+export interface CloudflarePagesOptions {
+    /** Account-scoped API token with the `Cloudflare Pages: Edit` permission. */
+    apiToken: string;
+    /** Account the project lives under. */
+    accountId: string;
+}
+/** One file in a deployment, already hashed. */
+export interface PagesAsset {
+    /** Site-absolute path, e.g. `/guide/index.html`. */
+    path: string;
+    /** Cloudflare asset hash (32 hex chars). */
+    hash: string;
+    /** Base64 of the file's bytes. */
+    base64: string;
+    /** Extension without the dot, e.g. `html`. Empty when there is none. */
+    extension: string;
+    /** Byte length of the original file, for reporting and limit checks. */
+    size: number;
+}
+export interface DeployDirectoryResult {
+    deployment: CloudflarePagesDeployment;
+    /** Every asset in the manifest. */
+    total: number;
+    /** Assets whose bytes had to be sent, the rest already being in the store. */
+    uploaded: number;
+    /** Bytes actually transferred. */
+    uploadedBytes: number;
+}
+/**
+ * Cloudflare Pages, scoped to one account.
+ *
+ * Mirrors {@link CloudflareProvider}: a thin authenticated `request`, and
+ * methods that each map onto one API concern.
+ */
+export declare class CloudflarePagesProvider {
+    readonly name = "cloudflare-pages";
+    private readonly apiToken;
+    private readonly accountId;
+    constructor(options: CloudflarePagesOptions);
+    /**
+     * Make an authenticated request against the account-scoped Pages API.
+     *
+     * @param method - HTTP method
+     * @param endpoint - Path below `/accounts/{id}`, starting with a slash
+     * @param body - JSON body, or a `FormData` for multipart endpoints
+     * @returns The unwrapped `result`
+     * @throws {Error} When Cloudflare reports failure
+     */
+    private request;
+    /**
+     * Look up a project by name.
+     *
+     * @param name - Project name
+     * @returns The project, or `null` when it does not exist
+     */
+    getProject(name: string): Promise<CloudflarePagesProject | null>;
+    /**
+     * Create a direct-upload project, or return the existing one.
+     *
+     * Direct upload means ts-cloud pushes the built output itself rather than
+     * Cloudflare cloning and building the repository. That keeps the build in
+     * your CI, where the toolchain and secrets already are.
+     *
+     * @param name - Project name; also the `<name>.pages.dev` subdomain
+     * @param productionBranch - Branch treated as production. @default 'main'
+     * @returns The project, whether created here or already present
+     */
+    ensureProject(name: string, productionBranch?: string): Promise<CloudflarePagesProject>;
+    /**
+     * Short-lived JWT for the asset endpoints.
+     *
+     * The account API token is not accepted there, so this is fetched per deploy
+     * rather than held.
+     *
+     * @param project - Project name
+     */
+    private uploadToken;
+    /**
+     * Ask which of these hashes the asset store does not already hold.
+     *
+     * @param jwt - Upload token
+     * @param hashes - Every hash in the manifest
+     * @returns The subset whose bytes still need sending
+     */
+    private missingHashes;
+    /**
+     * Record hashes as present in the account's asset store.
+     *
+     * Uploading bytes is not by itself enough to make them findable: until the
+     * hashes are upserted, `check-missing` keeps reporting them absent, and every
+     * subsequent deploy re-uploads the entire site. Skipping this call is not
+     * visible in a single deploy — it only shows up as an upload that never gets
+     * cheaper.
+     *
+     * @param jwt - Upload token
+     * @param hashes - Every hash in the manifest, not only the newly uploaded ones
+     */
+    private upsertHashes;
+    /**
+     * Upload one batch of assets.
+     *
+     * @param jwt - Upload token
+     * @param assets - At most {@link UPLOAD_BATCH_SIZE} assets
+     */
+    private uploadBatch;
+    /**
+     * Create a deployment from an already-hashed manifest.
+     *
+     * @param project - Project name
+     * @param assets - Every file in the site
+     * @param branch - Branch to record. Matching the production branch publishes
+     * to the live domain; anything else becomes a preview deployment.
+     * @returns The created deployment
+     */
+    createDeployment(project: string, assets: PagesAsset[], branch?: string): Promise<CloudflarePagesDeployment>;
+    /**
+     * Build, upload and deploy a directory.
+     *
+     * The whole flow: hash every file, ask what is missing, upload only that,
+     * then create the deployment.
+     *
+     * @param options.project - Project name
+     * @param options.directory - Directory to publish; becomes the site root
+     * @param options.branch - Branch to record on the deployment
+     * @param options.onProgress - Called as batches complete, for CLI output
+     * @returns The deployment and what it cost to send
+     * @throws {Error} When the directory is empty or a file exceeds the size limit
+     */
+    deployDirectory(options: {
+        project: string;
+        directory: string;
+        branch?: string;
+        onProgress?: (uploaded: number, total: number) => void;
+    }): Promise<DeployDirectoryResult>;
+    /** Custom domains already attached to a project. */
+    listCustomDomains(project: string): Promise<string[]>;
+    /**
+     * Attach a custom domain, or leave it attached.
+     *
+     * Idempotent so a deploy pipeline can call it on every run rather than
+     * guarding with a lookup that races.
+     *
+     * @param project - Project name
+     * @param domain - Hostname to serve, e.g. `buddy.sh`
+     * @returns Whether this call is what attached it
+     */
+    attachCustomDomain(project: string, domain: string): Promise<boolean>;
+}
+/**
+ * The DNS record that points a custom domain at a Pages project.
+ *
+ * Pages serves from a `*.pages.dev` host, so the zone needs a CNAME. Two things
+ * are easy to get wrong here:
+ *
+ *  - **The target is the project's `subdomain`, not `<name>.pages.dev`.**
+ *    Cloudflare only grants the bare name when it is free; a project named
+ *    `buddy` whose name was taken is served from `buddy-5yo.pages.dev`.
+ *    Deriving the host from the project name instead of reading `subdomain`
+ *    produces a CNAME to a host that does not exist.
+ *  - **It must be proxied.** An unproxied CNAME reaches Cloudflare's edge but
+ *    arrives without the routing metadata Pages uses to pick a project, and
+ *    answers 404.
+ *
+ * A CNAME at the apex is legal here only because Cloudflare flattens it.
+ *
+ * @param hostname - Public hostname, e.g. `buddy.sh` or `www.buddy.sh`
+ * @param subdomain - The project's `subdomain`, e.g. `buddy-5yo.pages.dev`
+ * @returns A record ready for `CloudflareProvider.upsertRecord`
+ */
+export declare function pagesDnsRecord(hostname: string, subdomain: string): DnsRecord;
+/**
+ * Cloudflare's asset hash: BLAKE3 of `<base64><extension>`, first 32 hex chars.
+ *
+ * The extension is part of the input, so the same bytes saved as `.html` and
+ * as `.txt` hash differently — which is deliberate, since the asset store
+ * serves content type from the key.
+ *
+ * BLAKE3 specifically, and it has to come from a library: Bun's `CryptoHasher`
+ * ships blake2b but not blake3. Substituting a different digest is not a
+ * degradation that shows up as an error — the upload succeeds and the site
+ * then serves 404s, because the manifest names a key the store does not hold.
+ *
+ * @param base64 - Base64 of the file's bytes
+ * @param extension - Extension without the dot
+ */
+export declare function pagesAssetHash(base64: string, extension: string): Promise<string>;
+/**
+ * Walk a directory into a deployable manifest.
+ *
+ * Dotfiles are included: a built site legitimately contains `.well-known`, and
+ * bunpress writes its output under a `.bunpress` root. Cloudflare's own
+ * reserved paths are skipped, since uploading them as assets shadows the
+ * configuration they are meant to be.
+ *
+ * @param directory - Site root
+ * @returns One entry per file, hashed and base64-encoded
+ * @throws {Error} When a file exceeds {@link PAGES_MAX_FILE_BYTES}
+ */
+export declare function collectAssets(directory: string): Promise<PagesAsset[]>;

package/dist/pages/cloudflare-pages.test.d.ts

@@ -0,0 +1 @@
+export {};

package/dist/pages/index.d.ts

@@ -0,0 +1,2 @@
+export { CloudflarePagesProvider, collectAssets, PAGES_MAX_FILE_BYTES, pagesAssetHash, pagesDnsRecord, } from './cloudflare-pages';
+export type { CloudflarePagesDeployment, CloudflarePagesOptions, CloudflarePagesProject, DeployDirectoryResult, PagesAsset, } from './cloudflare-pages';

package/dist/protection/index.js

@@ -1 +1 @@
-import{$k as z,_k as y,al as A,bl as B,cl as C,dl as D,el as E,fl as F,gl as G,hl as H,il as I,jl as J,kl as K,ll as L,ml as M}from"../chunk-1qdne0bf.js";import{nl as s,ol as t,pl as u,ql as v,rl as w,sl as x}from"../chunk-hn40z11p.js";import{Al as r,tl as k,ul as l,vl as m,wl as n,xl as o,yl as p,zl as q}from"../chunk-x3hay61c.js";import{Ns as a,Os as b,Ps as c,Qs as d,Rs as e,Ss as f,Ts as g,Us as h,Vs as i,Ws as j}from"../chunk-zz52xje8.js";import"../chunk-z2qqwy7e.js";export{b as CHAIN_HEADER,H as DEFAULT_ATTACK_MODE_HOURS,k as DEFAULT_DDOS_THRESHOLDS,e as DEFAULT_RECURSION_LIMITS,a as DEPTH_HEADER,G as MAX_CONTROL_HOURS,F as PROTECTION_SETTING,I as ProtectionControlStore,y as RATE_LIMIT_KEY_SEPARATOR,C as RateLimiter,h as RecursionGuard,c as TRACE_HEADER,L as applyControlsToDdos,K as applyControlsToRateLimits,r as applyMitigationFactor,E as defaultRateLimitRules,J as describePosture,s as escapeSecLang,d as functionFingerprint,z as globMatches,u as globToRegex,g as inspectInvocation,t as isSafePattern,l as isValidCidr,M as mergeControlsIntoConfig,f as parseChain,q as planMitigation,i as propagationHeaders,D as rateLimitHeaders,B as rateLimitKey,j as recursionBlockedResponse,p as renderDdosInstallScript,o as renderNftablesRuleset,n as renderSysctlFile,v as renderWafConfig,w as renderWafInstallScript,A as ruleMatches,m as sysctlHardening,x as wafEventTelemetry};
+import{$k as z,_k as y,al as A,bl as B,cl as C,dl as D,el as E,fl as F,gl as G,hl as H,il as I,jl as J,kl as K,ll as L,ml as M}from"../chunk-fvjczc73.js";import{nl as s,ol as t,pl as u,ql as v,rl as w,sl as x}from"../chunk-q0wffgw5.js";import{Al as r,tl as k,ul as l,vl as m,wl as n,xl as o,yl as p,zl as q}from"../chunk-wcrj06cg.js";import{Ns as a,Os as b,Ps as c,Qs as d,Rs as e,Ss as f,Ts as g,Us as h,Vs as i,Ws as j}from"../chunk-6xcbfs2r.js";import"../chunk-rr1yaj55.js";export{x as wafEventTelemetry,m as sysctlHardening,A as ruleMatches,w as renderWafInstallScript,v as renderWafConfig,n as renderSysctlFile,o as renderNftablesRuleset,p as renderDdosInstallScript,j as recursionBlockedResponse,B as rateLimitKey,D as rateLimitHeaders,i as propagationHeaders,q as planMitigation,f as parseChain,M as mergeControlsIntoConfig,l as isValidCidr,t as isSafePattern,g as inspectInvocation,u as globToRegex,z as globMatches,d as functionFingerprint,s as escapeSecLang,J as describePosture,E as defaultRateLimitRules,r as applyMitigationFactor,K as applyControlsToRateLimits,L as applyControlsToDdos,c as TRACE_HEADER,h as RecursionGuard,C as RateLimiter,y as RATE_LIMIT_KEY_SEPARATOR,I as ProtectionControlStore,F as PROTECTION_SETTING,G as MAX_CONTROL_HOURS,a as DEPTH_HEADER,e as DEFAULT_RECURSION_LIMITS,k as DEFAULT_DDOS_THRESHOLDS,H as DEFAULT_ATTACK_MODE_HOURS,b as CHAIN_HEADER};

package/dist/push/index.js

@@ -1 +1 @@
-import"../chunk-z2qqwy7e.js";import*as h from"node:http2";import{createSign as b}from"node:crypto";var f="api.push.apple.com",k="api.sandbox.push.apple.com",S=2700000;class R{config;token=null;tokenGeneratedAt=0;client=null;host;constructor(e){this.config=e,this.host=e.production?f:k}generateToken(){let e=Math.floor(Date.now()/1000);if(this.token&&Date.now()-this.tokenGeneratedAt<S)return this.token;let t={alg:"ES256",kid:this.config.keyId},s={iss:this.config.teamId,iat:e},r=Buffer.from(JSON.stringify(t)).toString("base64url"),n=Buffer.from(JSON.stringify(s)).toString("base64url"),i=`${r}.${n}`,o=b("SHA256");o.update(i);let a=o.sign(this.config.privateKey),l=this.derToRaw(a).toString("base64url");return this.token=`${i}.${l}`,this.tokenGeneratedAt=Date.now(),this.token}derToRaw(e){let t=2;if(e[t]!==2)throw Error("Invalid DER signature: expected 0x02 for R");t++;let s=e[t];t++;let r=e.subarray(t,t+s);if(t+=s,e[t]!==2)throw Error("Invalid DER signature: expected 0x02 for S");t++;let n=e[t];t++;let i=e.subarray(t,t+n);if(r[0]===0&&r.length===33)r=r.subarray(1);if(i[0]===0&&i.length===33)i=i.subarray(1);let o=Buffer.alloc(64);return r.copy(o,32-r.length),i.copy(o,64-i.length),o}async getClient(){if(this.client&&!this.client.destroyed)return this.client;return new Promise((e,t)=>{this.client=h.connect(`https://${this.host}`),this.client.on("error",(s)=>{t(s)}),this.client.on("connect",()=>{e(this.client)}),this.client.on("close",()=>{this.client=null})})}buildPayload(e){let t={};if(e.title||e.body||e.subtitle){if(t.alert={},e.title)t.alert.title=e.title;if(e.subtitle)t.alert.subtitle=e.subtitle;if(e.body)t.alert.body=e.body}if(e.badge!==void 0)t.badge=e.badge;if(e.sound!==void 0)t.sound=e.sound;if(e.category)t.category=e.category;if(e.threadId)t["thread-id"]=e.threadId;if(e.contentAvailable)t["content-available"]=1;if(e.mutableContent)t["mutable-content"]=1;if(e.targetContentId)t["target-content-id"]=e.targetContentId;let s={aps:t};if(e.data)Object.assign(s,e.data);return s}async send(e){try{let t=await this.getClient(),s=this.generateToken(),r=JSON.stringify(this.buildPayload(e)),n={":method":"POST",":path":`/3/device/${e.deviceToken}`,authorization:`bearer ${s}`,"apns-topic":this.config.bundleId,"apns-push-type":e.pushType||"alert","apns-priority":String(e.priority||10)};if(e.expiration!==void 0)n["apns-expiration"]=String(e.expiration);if(e.collapseId)n["apns-collapse-id"]=e.collapseId;return new Promise((i)=>{let o=t.request(n),a="",d=0,l;o.on("response",(c)=>{d=c[":status"],l=c["apns-id"]}),o.on("data",(c)=>{a+=c.toString()}),o.on("end",()=>{if(d===200)i({success:!0,deviceToken:e.deviceToken,apnsId:l,statusCode:d});else{let c="Unknown error",g,u;if(a)try{let p=JSON.parse(a);g=p.reason,u=p.timestamp,c=g||c}catch{c=a}i({success:!1,deviceToken:e.deviceToken,apnsId:l,statusCode:d,error:c,reason:g,timestamp:u})}}),o.on("error",(c)=>{i({success:!1,deviceToken:e.deviceToken,error:c.message})}),o.write(r),o.end()})}catch(t){return{success:!1,deviceToken:e.deviceToken,error:t.message}}}async sendBatch(e,t){let s=t?.concurrency||10,r=[];for(let n=0;n<e.length;n+=s){let i=e.slice(n,n+s),o=await Promise.all(i.map((a)=>this.send(a)));r.push(...o)}return{sent:r.filter((n)=>n.success).length,failed:r.filter((n)=>!n.success).length,results:r}}async sendSimple(e,t,s,r){return this.send({deviceToken:e,title:t,body:s,data:r})}async sendSilent(e,t){return this.send({deviceToken:e,contentAvailable:!0,pushType:"background",priority:5,data:t})}close(){if(this.client)this.client.close(),this.client=null;this.token=null,this.tokenGeneratedAt=0}}import{createSign as T}from"node:crypto";var C="https://fcm.googleapis.com/v1/projects",y="https://oauth2.googleapis.com/token",P=3300000;class m{config;accessToken=null;tokenExpiresAt=0;constructor(e){this.config=e}static fromServiceAccount(e){return new m({projectId:e.project_id,clientEmail:e.client_email,privateKey:e.private_key})}generateJWT(){let e=Math.floor(Date.now()/1000),t=e+3600,s={alg:"RS256",typ:"JWT"},r={iss:this.config.clientEmail,sub:this.config.clientEmail,aud:y,iat:e,exp:t,scope:"https://www.googleapis.com/auth/firebase.messaging"},n=Buffer.from(JSON.stringify(s)).toString("base64url"),i=Buffer.from(JSON.stringify(r)).toString("base64url"),o=`${n}.${i}`,a=T("SHA256");a.update(o);let d=a.sign(this.config.privateKey,"base64url");return`${o}.${d}`}async getAccessToken(){if(this.accessToken&&Date.now()<this.tokenExpiresAt)return this.accessToken;let e=this.generateJWT(),t=await fetch(y,{method:"POST",headers:{"Content-Type":"application/x-www-form-urlencoded"},body:new URLSearchParams({grant_type:"urn:ietf:params:oauth:grant-type:jwt-bearer",assertion:e}).toString()});if(!t.ok){let r=await t.text();throw Error(`Failed to get access token: ${r}`)}let s=await t.json();return this.accessToken=s.access_token,this.tokenExpiresAt=Date.now()+P,this.accessToken}buildMessage(e){let t={};if(e.token)t.token=e.token;else if(e.topic)t.topic=e.topic;else if(e.condition)t.condition=e.condition;if(e.title||e.body||e.imageUrl){if(t.notification={},e.title)t.notification.title=e.title;if(e.body)t.notification.body=e.body;if(e.imageUrl)t.notification.image=e.imageUrl}if(e.data&&Object.keys(e.data).length>0)t.data=e.data;if(e.android){if(t.android={priority:e.android.priority||"high"},e.android.ttl)t.android.ttl=`${e.android.ttl}s`;if(e.android.collapseKey)t.android.collapse_key=e.android.collapseKey;if(e.android.directBootOk)t.android.direct_boot_ok=e.android.directBootOk;let s={};if(e.android.channelId)s.channel_id=e.android.channelId;if(e.android.icon)s.icon=e.android.icon;if(e.android.color)s.color=e.android.color;if(e.android.sound)s.sound=e.android.sound;if(e.android.clickAction)s.click_action=e.android.clickAction;if(e.android.tag)s.tag=e.android.tag;if(e.android.visibility)s.visibility=e.android.visibility;if(e.android.notificationCount!==void 0)s.notification_count=e.android.notificationCount;if(Object.keys(s).length>0)t.android.notification=s}if(e.webpush)t.webpush=e.webpush;if(e.apns)t.apns=e.apns;if(e.fcmOptions)t.fcm_options=e.fcmOptions;return{message:t}}async send(e){try{let t=await this.getAccessToken(),s=this.buildMessage(e),r=await fetch(`${C}/${this.config.projectId}/messages:send`,{method:"POST",headers:{Authorization:`Bearer ${t}`,"Content-Type":"application/json"},body:JSON.stringify(s)}),n=await r.json();if(r.ok)return{success:!0,messageId:n.name};else return{success:!1,error:n.error?.message||"Unknown error",errorCode:n.error?.status}}catch(t){return{success:!1,error:t.message}}}async sendBatch(e,t,s){let r=s?.concurrency||10,n=[];for(let i=0;i<e.length;i+=r){let a=e.slice(i,i+r).map(async(l)=>({...await this.send({...t,token:l}),token:l})),d=await Promise.all(a);n.push(...d)}return{sent:n.filter((i)=>i.success).length,failed:n.filter((i)=>!i.success).length,results:n}}async sendToTopic(e,t){return this.send({...t,topic:e})}async sendToCondition(e,t){return this.send({...t,condition:e})}async sendSimple(e,t,s,r){return this.send({token:e,title:t,body:s,data:r})}async sendSilent(e,t){return this.send({token:e,data:t,android:{priority:"high"}})}async subscribeToTopic(e,t){try{let s=await this.getAccessToken(),r=await fetch("https://iid.googleapis.com/iid/v1:batchAdd",{method:"POST",headers:{Authorization:`Bearer ${s}`,"Content-Type":"application/json"},body:JSON.stringify({to:`/topics/${t}`,registration_tokens:e})});if(r.ok)return{success:!0};else return{success:!1,error:(await r.json()).error?.message||"Failed to subscribe"}}catch(s){return{success:!1,error:s.message}}}async unsubscribeFromTopic(e,t){try{let s=await this.getAccessToken(),r=await fetch("https://iid.googleapis.com/iid/v1:batchRemove",{method:"POST",headers:{Authorization:`Bearer ${s}`,"Content-Type":"application/json"},body:JSON.stringify({to:`/topics/${t}`,registration_tokens:e})});if(r.ok)return{success:!0};else return{success:!1,error:(await r.json()).error?.message||"Failed to unsubscribe"}}catch(s){return{success:!1,error:s.message}}}}export{R as APNsClient,m as FCMClient};
+import"../chunk-rr1yaj55.js";import*as K from"node:http2";import{createSign as U}from"node:crypto";var q="api.push.apple.com",D="api.sandbox.push.apple.com",M=2700000;class E{config;token=null;tokenGeneratedAt=0;client=null;host;constructor(z){this.config=z,this.host=z.production?q:D}generateToken(){let z=Math.floor(Date.now()/1000);if(this.token&&Date.now()-this.tokenGeneratedAt<M)return this.token;let J={alg:"ES256",kid:this.config.keyId},Q={iss:this.config.teamId,iat:z},V=Buffer.from(JSON.stringify(J)).toString("base64url"),W=Buffer.from(JSON.stringify(Q)).toString("base64url"),Z=`${V}.${W}`,$=U("SHA256");$.update(Z);let B=$.sign(this.config.privateKey),x=this.derToRaw(B).toString("base64url");return this.token=`${Z}.${x}`,this.tokenGeneratedAt=Date.now(),this.token}derToRaw(z){let J=2;if(z[J]!==2)throw Error("Invalid DER signature: expected 0x02 for R");J++;let Q=z[J];J++;let V=z.subarray(J,J+Q);if(J+=Q,z[J]!==2)throw Error("Invalid DER signature: expected 0x02 for S");J++;let W=z[J];J++;let Z=z.subarray(J,J+W);if(V[0]===0&&V.length===33)V=V.subarray(1);if(Z[0]===0&&Z.length===33)Z=Z.subarray(1);let $=Buffer.alloc(64);return V.copy($,32-V.length),Z.copy($,64-Z.length),$}async getClient(){if(this.client&&!this.client.destroyed)return this.client;return new Promise((z,J)=>{this.client=K.connect(`https://${this.host}`),this.client.on("error",(Q)=>{J(Q)}),this.client.on("connect",()=>{z(this.client)}),this.client.on("close",()=>{this.client=null})})}buildPayload(z){let J={};if(z.title||z.body||z.subtitle){if(J.alert={},z.title)J.alert.title=z.title;if(z.subtitle)J.alert.subtitle=z.subtitle;if(z.body)J.alert.body=z.body}if(z.badge!==void 0)J.badge=z.badge;if(z.sound!==void 0)J.sound=z.sound;if(z.category)J.category=z.category;if(z.threadId)J["thread-id"]=z.threadId;if(z.contentAvailable)J["content-available"]=1;if(z.mutableContent)J["mutable-content"]=1;if(z.targetContentId)J["target-content-id"]=z.targetContentId;let Q={aps:J};if(z.data)Object.assign(Q,z.data);return Q}async send(z){try{let J=await this.getClient(),Q=this.generateToken(),V=JSON.stringify(this.buildPayload(z)),W={":method":"POST",":path":`/3/device/${z.deviceToken}`,authorization:`bearer ${Q}`,"apns-topic":this.config.bundleId,"apns-push-type":z.pushType||"alert","apns-priority":String(z.priority||10)};if(z.expiration!==void 0)W["apns-expiration"]=String(z.expiration);if(z.collapseId)W["apns-collapse-id"]=z.collapseId;return new Promise((Z)=>{let $=J.request(W),B="",j=0,x;$.on("response",(Y)=>{j=Y[":status"],x=Y["apns-id"]}),$.on("data",(Y)=>{B+=Y.toString()}),$.on("end",()=>{if(j===200)Z({success:!0,deviceToken:z.deviceToken,apnsId:x,statusCode:j});else{let Y="Unknown error",X,w;if(B)try{let G=JSON.parse(B);X=G.reason,w=G.timestamp,Y=X||Y}catch{Y=B}Z({success:!1,deviceToken:z.deviceToken,apnsId:x,statusCode:j,error:Y,reason:X,timestamp:w})}}),$.on("error",(Y)=>{Z({success:!1,deviceToken:z.deviceToken,error:Y.message})}),$.write(V),$.end()})}catch(J){return{success:!1,deviceToken:z.deviceToken,error:J.message}}}async sendBatch(z,J){let Q=J?.concurrency||10,V=[];for(let W=0;W<z.length;W+=Q){let Z=z.slice(W,W+Q),$=await Promise.all(Z.map((B)=>this.send(B)));V.push(...$)}return{sent:V.filter((W)=>W.success).length,failed:V.filter((W)=>!W.success).length,results:V}}async sendSimple(z,J,Q,V){return this.send({deviceToken:z,title:J,body:Q,data:V})}async sendSilent(z,J){return this.send({deviceToken:z,contentAvailable:!0,pushType:"background",priority:5,data:J})}close(){if(this.client)this.client.close(),this.client=null;this.token=null,this.tokenGeneratedAt=0}}import{createSign as L}from"node:crypto";var R="https://fcm.googleapis.com/v1/projects",F="https://oauth2.googleapis.com/token",b=3300000;class H{config;accessToken=null;tokenExpiresAt=0;constructor(z){this.config=z}static fromServiceAccount(z){return new H({projectId:z.project_id,clientEmail:z.client_email,privateKey:z.private_key})}generateJWT(){let z=Math.floor(Date.now()/1000),J=z+3600,Q={alg:"RS256",typ:"JWT"},V={iss:this.config.clientEmail,sub:this.config.clientEmail,aud:F,iat:z,exp:J,scope:"https://www.googleapis.com/auth/firebase.messaging"},W=Buffer.from(JSON.stringify(Q)).toString("base64url"),Z=Buffer.from(JSON.stringify(V)).toString("base64url"),$=`${W}.${Z}`,B=L("SHA256");B.update($);let j=B.sign(this.config.privateKey,"base64url");return`${$}.${j}`}async getAccessToken(){if(this.accessToken&&Date.now()<this.tokenExpiresAt)return this.accessToken;let z=this.generateJWT(),J=await fetch(F,{method:"POST",headers:{"Content-Type":"application/x-www-form-urlencoded"},body:new URLSearchParams({grant_type:"urn:ietf:params:oauth:grant-type:jwt-bearer",assertion:z}).toString()});if(!J.ok){let V=await J.text();throw Error(`Failed to get access token: ${V}`)}let Q=await J.json();return this.accessToken=Q.access_token,this.tokenExpiresAt=Date.now()+b,this.accessToken}buildMessage(z){let J={};if(z.token)J.token=z.token;else if(z.topic)J.topic=z.topic;else if(z.condition)J.condition=z.condition;if(z.title||z.body||z.imageUrl){if(J.notification={},z.title)J.notification.title=z.title;if(z.body)J.notification.body=z.body;if(z.imageUrl)J.notification.image=z.imageUrl}if(z.data&&Object.keys(z.data).length>0)J.data=z.data;if(z.android){if(J.android={priority:z.android.priority||"high"},z.android.ttl)J.android.ttl=`${z.android.ttl}s`;if(z.android.collapseKey)J.android.collapse_key=z.android.collapseKey;if(z.android.directBootOk)J.android.direct_boot_ok=z.android.directBootOk;let Q={};if(z.android.channelId)Q.channel_id=z.android.channelId;if(z.android.icon)Q.icon=z.android.icon;if(z.android.color)Q.color=z.android.color;if(z.android.sound)Q.sound=z.android.sound;if(z.android.clickAction)Q.click_action=z.android.clickAction;if(z.android.tag)Q.tag=z.android.tag;if(z.android.visibility)Q.visibility=z.android.visibility;if(z.android.notificationCount!==void 0)Q.notification_count=z.android.notificationCount;if(Object.keys(Q).length>0)J.android.notification=Q}if(z.webpush)J.webpush=z.webpush;if(z.apns)J.apns=z.apns;if(z.fcmOptions)J.fcm_options=z.fcmOptions;return{message:J}}async send(z){try{let J=await this.getAccessToken(),Q=this.buildMessage(z),V=await fetch(`${R}/${this.config.projectId}/messages:send`,{method:"POST",headers:{Authorization:`Bearer ${J}`,"Content-Type":"application/json"},body:JSON.stringify(Q)}),W=await V.json();if(V.ok)return{success:!0,messageId:W.name};else return{success:!1,error:W.error?.message||"Unknown error",errorCode:W.error?.status}}catch(J){return{success:!1,error:J.message}}}async sendBatch(z,J,Q){let V=Q?.concurrency||10,W=[];for(let Z=0;Z<z.length;Z+=V){let B=z.slice(Z,Z+V).map(async(x)=>{return{...await this.send({...J,token:x}),token:x}}),j=await Promise.all(B);W.push(...j)}return{sent:W.filter((Z)=>Z.success).length,failed:W.filter((Z)=>!Z.success).length,results:W}}async sendToTopic(z,J){return this.send({...J,topic:z})}async sendToCondition(z,J){return this.send({...J,condition:z})}async sendSimple(z,J,Q,V){return this.send({token:z,title:J,body:Q,data:V})}async sendSilent(z,J){return this.send({token:z,data:J,android:{priority:"high"}})}async subscribeToTopic(z,J){try{let Q=await this.getAccessToken(),V=await fetch("https://iid.googleapis.com/iid/v1:batchAdd",{method:"POST",headers:{Authorization:`Bearer ${Q}`,"Content-Type":"application/json"},body:JSON.stringify({to:`/topics/${J}`,registration_tokens:z})});if(V.ok)return{success:!0};else return{success:!1,error:(await V.json()).error?.message||"Failed to subscribe"}}catch(Q){return{success:!1,error:Q.message}}}async unsubscribeFromTopic(z,J){try{let Q=await this.getAccessToken(),V=await fetch("https://iid.googleapis.com/iid/v1:batchRemove",{method:"POST",headers:{Authorization:`Bearer ${Q}`,"Content-Type":"application/json"},body:JSON.stringify({to:`/topics/${J}`,registration_tokens:z})});if(V.ok)return{success:!0};else return{success:!1,error:(await V.json()).error?.message||"Failed to unsubscribe"}}catch(Q){return{success:!1,error:Q.message}}}}export{H as FCMClient,E as APNsClient};

package/dist/spend/index.js

@@ -1 +1 @@
-import{$j as _,Aj as z,Bj as A,Cj as B,Dj as C,Ej as D,Fj as E,Gj as F,Hj as G,Ij as H,Jj as I,Jk as qa,Kj as J,Kk as ra,Lj as K,Lk as sa,Mj as L,Mk as ta,Nj as M,Nk as ua,Oj as N,Ok as va,Pj as O,Pk as wa,Qj as P,Qk as xa,Rj as Q,Rk as ya,Sj as R,Sk as za,Tj as S,Tk as Aa,Uj as T,Uk as Ba,Vj as U,Wj as V,Xj as W,Yj as X,Yk as Ca,Zj as Y,Zk as Da,_j as Z,ak as aa,bj as a,bk as ba,cj as b,ck as ca,dj as c,dk as da,ej as d,ek as ea,fj as e,fk as fa,gj as f,gk as ga,hj as g,hk as ha,ij as h,ik as ia,jj as i,jk as ja,kj as j,kk as ka,lj as k,lk as la,mj as l,mk as ma,nj as m,nk as na,oj as n,ok as oa,pj as o,pk as pa,qj as p,rj as q,sj as r,tj as s,uj as t,vj as u,wj as v,xj as w,yj as x,zj as y}from"../chunk-aw0cgv5w.js";import"../chunk-x3hay61c.js";import"../chunk-zz52xje8.js";import"../chunk-z2qqwy7e.js";export{Z as AnomalyConfigStore,za as AwsSpendTransport,Aa as ComputeSpendTransport,x as CounterTracker,u as DEFAULT_METER_MAPPINGS,l as DEFAULT_PRICE_BOOK,B as DEFAULT_THRESHOLDS,_ as DETECTABLE_SIGNALS,c as ENFORCEMENT_ACTIONS,K as ENFORCEMENT_DESCRIPTIONS,d as ENFORCEMENT_SEVERITY,ea as FOCUS_VERSION,b as METERS,a as METER_KEYS,e as MICRO_CENTS,G as MIN_PROJECTION_CONFIDENCE,pa as RecordingSpendTransport,X as SENSITIVITY_THRESHOLDS,xa as SPEND_CYCLE_SECONDS,ka as SPEND_GATE_SETTING,ua as SPEND_LEASE_SETTING,ba as SignalSource,ma as SpendCapError,la as SpendGate,va as SpendLoopLease,ta as SpendNotificationRouter,wa as SpendRunner,ia as SpendService,C as SpendStore,qa as URGENT_SPEND_EVENTS,L as USER_VISIBLE_ACTIONS,z as aggregateDeltas,W as anomalyOptionsForSignal,na as assertSpendAllows,q as budgetWindow,Ba as compositeSpendTransport,oa as createEnforcementHandlers,U as detectAnomalies,V as detectLatestAnomaly,I as evaluateBudget,T as ewma,v as findMapping,g as findPriceEntry,ra as formatCents,F as formatTimeToExhaustion,H as governingLimitCents,Ca as handleSpendRequest,s as hourBucket,t as hourBucketsBetween,P as isOperationAllowed,m as isValidTimeZone,da as lookbackHoursForSignal,Q as median,R as medianAbsoluteDeviation,J as mergeDecisions,k as mergePriceBooks,y as meterTelemetry,ca as optionsForSignal,E as percentOfLimit,M as planEnforcement,r as previousBudgetWindow,h as priceUsage,i as priceUsageLines,D as projectSpend,S as robustZScore,j as roundCents,Y as routeMatches,N as runEnforcement,A as scopeKey,aa as signalDefinition,sa as spendNotificationText,Da as spendOpenApiPaths,ya as startSpendLoop,ha as streamFocusJsonl,O as strongestActiveAction,f as tieredMicroCents,ga as toFocusJsonl,fa as toFocusRecords,w as usageDeltaKey,p as utcInstantOfLocal,ja as zeroFill,o as zoneOffsetMs,n as zonedParts};
+import{$j as _,Aj as z,Bj as A,Cj as B,Dj as C,Ej as D,Fj as E,Gj as F,Hj as G,Ij as H,Jj as I,Jk as pa,Kj as J,Kk as qa,Lj as K,Lk as ra,Mj as L,Mk as sa,Nj as M,Nk as ta,Oj as N,Ok as ua,Pj as O,Pk as va,Qj as P,Qk as wa,Rj as Q,Rk as xa,Sj as R,Sk as ya,Tj as S,Tk as za,Uj as T,Uk as Aa,Vj as U,Wj as V,Xj as W,Yj as X,Yk as Ba,Zj as Y,Zk as Ca,_j as Z,ak as $,bj as a,bk as aa,cj as b,ck as ba,dj as c,dk as ca,ej as d,ek as da,fj as e,fk as ea,gj as f,gk as fa,hj as g,hk as ga,ij as h,ik as ha,jj as i,jk as ia,kj as j,kk as ja,lj as k,lk as ka,mj as l,mk as la,nj as m,nk as ma,oj as n,ok as na,pj as o,pk as oa,qj as p,rj as q,sj as r,tj as s,uj as t,vj as u,wj as v,xj as w,yj as x,zj as y}from"../chunk-y1dh3znq.js";import"../chunk-wcrj06cg.js";import"../chunk-6xcbfs2r.js";import"../chunk-rr1yaj55.js";export{n as zonedParts,o as zoneOffsetMs,ia as zeroFill,p as utcInstantOfLocal,w as usageDeltaKey,ea as toFocusRecords,fa as toFocusJsonl,f as tieredMicroCents,O as strongestActiveAction,ga as streamFocusJsonl,xa as startSpendLoop,Ca as spendOpenApiPaths,ra as spendNotificationText,$ as signalDefinition,A as scopeKey,N as runEnforcement,Y as routeMatches,j as roundCents,S as robustZScore,D as projectSpend,i as priceUsageLines,h as priceUsage,r as previousBudgetWindow,M as planEnforcement,E as percentOfLimit,ba as optionsForSignal,y as meterTelemetry,k as mergePriceBooks,J as mergeDecisions,R as medianAbsoluteDeviation,Q as median,ca as lookbackHoursForSignal,m as isValidTimeZone,P as isOperationAllowed,t as hourBucketsBetween,s as hourBucket,Ba as handleSpendRequest,H as governingLimitCents,F as formatTimeToExhaustion,qa as formatCents,g as findPriceEntry,v as findMapping,T as ewma,I as evaluateBudget,V as detectLatestAnomaly,U as detectAnomalies,na as createEnforcementHandlers,Aa as compositeSpendTransport,q as budgetWindow,ma as assertSpendAllows,W as anomalyOptionsForSignal,z as aggregateDeltas,L as USER_VISIBLE_ACTIONS,pa as URGENT_SPEND_EVENTS,C as SpendStore,ha as SpendService,va as SpendRunner,sa as SpendNotificationRouter,ua as SpendLoopLease,ka as SpendGate,la as SpendCapError,aa as SignalSource,ta as SPEND_LEASE_SETTING,ja as SPEND_GATE_SETTING,wa as SPEND_CYCLE_SECONDS,X as SENSITIVITY_THRESHOLDS,oa as RecordingSpendTransport,G as MIN_PROJECTION_CONFIDENCE,e as MICRO_CENTS,a as METER_KEYS,b as METERS,da as FOCUS_VERSION,d as ENFORCEMENT_SEVERITY,K as ENFORCEMENT_DESCRIPTIONS,c as ENFORCEMENT_ACTIONS,_ as DETECTABLE_SIGNALS,B as DEFAULT_THRESHOLDS,l as DEFAULT_PRICE_BOOK,u as DEFAULT_METER_MAPPINGS,x as CounterTracker,za as ComputeSpendTransport,ya as AwsSpendTransport,Z as AnomalyConfigStore};

package/dist/ui/404.html

@@ -2,7 +2,7 @@
 <html lang="en" data-theme="dark">
 <head>
   <meta charset="UTF-8">
-  <meta name="stx-build" content="mt68a7naip9gue">
+  <meta name="stx-build" content="mt7lhcctpiur4a">
 
 <!-- stx SEO Tags -->
 <meta name="title" content="Page not found · ts-cloud">

package/dist/ui/accept-invitation.html

@@ -1,4 +1,4 @@
-<!DOCTYPE html><html lang="en" data-theme="dark"><head><meta charset="UTF-8"><meta name="stx-build" content="mt689snetu3vh5"><meta name="title" content="stx Project"><meta name="description" content="A website built with stx templating engine"><meta property="og:title" content="stx Project"><meta property="og:description" content="A website built with stx templating engine"><meta property="og:type" content="website"><meta name="twitter:card" content="summary_large_image"><meta name="twitter:title" content="stx Project"><meta name="twitter:description" content="A website built with stx templating engine"><meta name="viewport" content="width=device-width, initial-scale=1.0"><title>ts-cloud - Accept invitation</title><link rel="icon" type="image/svg+xml" href="data:image/svg+xml,%3Csvg xmlns='http://www.w3.org/2000/svg' viewBox='0 0 32 32'%3E%3Crect x='3' y='3' width='26' height='26' rx='8' fill='%235a8be0'/%3E%3C/svg%3E"><link rel="preconnect" href="https://fonts.googleapis.com"><link href="https://fonts.googleapis.com/css2?family=Inter:wght@400;500;600;700;800&display=swap" rel="stylesheet"><link rel="stylesheet" href="/_stx/style.448ab192.css"><style data-stx-cloak>[x-cloak]{display:none !important}</style><link data-crosswind="generated" rel="stylesheet" href="/_stx/crosswind.616c25f3.css"></head><body class="auth-page"><main class="auth-card" id="main-content"><a class="brand" href="/"><span class="dot"></span><span>ts-cloud</span></a><div><span class="context-label">Organization invitation</span><h1>Join your team</h1><p>Choose the dashboard username and password you will use after this invitation is accepted.</p></div><form id="accept-invitation-form" class="auth-form"><div class="field-block"><label for="invite-name">Name</label><input id="invite-name" name="name" autocomplete="name" placeholder="Chris Breuer"></div><div class="field-block"><label for="invite-username">Username</label><input id="invite-username" name="username" autocomplete="username" minlength="2" maxlength="32" required></div><div class="field-block"><label for="invite-password">Password</label><input id="invite-password" name="password" type="password" autocomplete="new-password" minlength="12" required><small>At least 12 characters.</small></div><button class="btn" type="submit">Accept invitation</button><div id="invitation-status" class="auth-status" role="status"></div></form><p class="note">If this link expired or was already used, ask an organization owner to resend the invitation.</p></main> <script data-stx-scoped data-stx-run="always">
+<!DOCTYPE html><html lang="en" data-theme="dark"><head><meta charset="UTF-8"><meta name="stx-build" content="mt7lgvq3gjbx1h"><meta name="title" content="stx Project"><meta name="description" content="A website built with stx templating engine"><meta property="og:title" content="stx Project"><meta property="og:description" content="A website built with stx templating engine"><meta property="og:type" content="website"><meta name="twitter:card" content="summary_large_image"><meta name="twitter:title" content="stx Project"><meta name="twitter:description" content="A website built with stx templating engine"><meta name="viewport" content="width=device-width, initial-scale=1.0"><title>ts-cloud - Accept invitation</title><link rel="icon" type="image/svg+xml" href="data:image/svg+xml,%3Csvg xmlns='http://www.w3.org/2000/svg' viewBox='0 0 32 32'%3E%3Crect x='3' y='3' width='26' height='26' rx='8' fill='%235a8be0'/%3E%3C/svg%3E"><link rel="preconnect" href="https://fonts.googleapis.com"><link href="https://fonts.googleapis.com/css2?family=Inter:wght@400;500;600;700;800&display=swap" rel="stylesheet"><link rel="stylesheet" href="/_stx/style.448ab192.css"><style data-stx-cloak>[x-cloak]{display:none !important}</style><link data-crosswind="generated" rel="stylesheet" href="/_stx/crosswind.616c25f3.css"></head><body class="auth-page"><main class="auth-card" id="main-content"><a class="brand" href="/"><span class="dot"></span><span>ts-cloud</span></a><div><span class="context-label">Organization invitation</span><h1>Join your team</h1><p>Choose the dashboard username and password you will use after this invitation is accepted.</p></div><form id="accept-invitation-form" class="auth-form"><div class="field-block"><label for="invite-name">Name</label><input id="invite-name" name="name" autocomplete="name" placeholder="Chris Breuer"></div><div class="field-block"><label for="invite-username">Username</label><input id="invite-username" name="username" autocomplete="username" minlength="2" maxlength="32" required></div><div class="field-block"><label for="invite-password">Password</label><input id="invite-password" name="password" type="password" autocomplete="new-password" minlength="12" required><small>At least 12 characters.</small></div><button class="btn" type="submit">Accept invitation</button><div id="invitation-status" class="auth-status" role="status"></div></form><p class="note">If this link expired or was already used, ask an organization owner to resend the invitation.</p></main> <script data-stx-scoped data-stx-run="always">
 ;(function() {
   'use strict';
 (() => {

package/dist/ui/access-denied.html

@@ -1,4 +1,4 @@
-<!DOCTYPE html><html lang="en" data-theme="dark"><head><meta charset="UTF-8"><meta name="stx-build" content="mt689snetu3vh5"><meta name="title" content="Access unavailable · ts-cloud"><meta name="description" content="A website built with stx templating engine"><meta property="og:title" content="Access unavailable · ts-cloud"><meta property="og:description" content="A website built with stx templating engine"><meta property="og:type" content="website"><meta name="twitter:card" content="summary_large_image"><meta name="twitter:title" content="Access unavailable · ts-cloud"><meta name="twitter:description" content="A website built with stx templating engine"> <script data-stx-runtime src="/_stx/runtime.c696d17a.js"></script> <meta name="viewport" content="width=device-width, initial-scale=1.0"><title>Access unavailable · ts-cloud</title><link rel="icon" type="image/svg+xml" href="data:image/svg+xml,%3Csvg xmlns='http://www.w3.org/2000/svg' viewBox='0 0 32 32'%3E%3Crect x='3' y='3' width='26' height='26' rx='8' fill='%235a8be0'/%3E%3C/svg%3E"><link rel="preconnect" href="https://fonts.googleapis.com"><link href="https://fonts.googleapis.com/css2?family=Inter:wght@400;500;600;700;800&display=swap" rel="stylesheet"><link rel="stylesheet" href="/_stx/style.448ab192.css"><style data-stx-cloak>[x-cloak]{display:none !important}</style><link data-crosswind="generated" rel="stylesheet" href="/_stx/crosswind.906ee17c.css"></head><body data-stx-auto><a data-stx-scope="stx_scope_nav_50" class="skip-link" href="#main-content">Skip to content</a><button class="nav-toggle-button" type="button" aria-label="Open navigation" aria-controls="primary-navigation" aria-expanded="false"><span></span><span></span><span></span></button><button class="nav-scrim" type="button" aria-label="Close navigation"></button><aside class="app-sidebar" id="primary-navigation" aria-label="Primary navigation"><a class="brand" href="/?env=production"><span class="dot"></span><span>ts-cloud</span></a><div class="sidebar-context"><span class="context-label">Project</span><strong>ts-cloud</strong></div><div class="environment-picker" aria-label="Environment"><span class="context-label">Environment</span><details><summary class="environment-current production"><span>PROD</span><strong>production</strong></summary></details></div><button class="command-trigger" type="button" aria-keyshortcuts="Meta+K Control+K"><span>Search resources</span><kbd>⌘ K</kbd></button><div class="nav-groups"><section class="nav-group"><h2>Overview</h2><a class="" href="/?env=production">Dashboard</a><a href="/server/activity?env=production">Activity</a></section><section class="nav-group"><h2>Applications</h2><a class="" href="/server/sites?env=production">Services</a><a class="" href="/server/deployments?env=production">Deployments</a><a class="" href="/server/logs?env=production">Logs</a><a class="" href="/integrations?env=production">Git integrations</a><a class="" href="/applications/new?env=production">Create application</a><a class="" href="/applications/compose?env=production">Compose applications</a></section><section class="nav-group"><h2>Operations</h2><a class="" href="/operations/queue?env=production">Deployment queue</a><a class="" href="/operations/previews?env=production">Preview environments</a><a class="" href="/operations/releases?env=production">Releases & promotion</a><a class="" href="/operations/regions?env=production">Regions & failover</a><a class="" href="/operations/maintenance?env=production">Maintenance & DR</a><a class="" href="/operations/workloads?env=production">Workloads</a><a class="" href="/operations/observability?env=production">Observability</a><a class="" href="/operations/alerts?env=production">Alerts & health</a><a class="" href="/operations/spend?env=production">Spend & budgets</a><a href="/server/metrics?env=production">Metrics</a><a href="/server/services?env=production">Runtime services</a><a class="" href="/operations/jobs?env=production">Workers & schedules</a><a class="" href="/operations/configuration?env=production">Environment &amp; secrets</a><a class="" href="/data/backups?env=production">Backups &amp; recovery</a><a class="" href="/data/volumes?env=production">Persistent volumes</a><a href="/server/actions?env=production">Run operations</a></section><section class="nav-group"><h2>Infrastructure</h2><a class="" href="/infrastructure/topology?env=production">Infrastructure map</a><a class="" href="/data/services?env=production">Data services</a><a class="" href="/data/volumes?env=production">Persistent volumes</a><a href="/server/firewall?env=production">Network & firewall</a><a href="/server/ssh-keys?env=production">SSH keys</a><a class="" href="/server/fleet?env=production">Fleet inventory</a><a class="" href="/server/capacity?env=production">Capacity & placement</a><a href="/security?env=production">Security posture</a><a href="/server/terminal?env=production">Terminal</a></section><section class="nav-group"><h2>Organization</h2><a class="" href="/server/team?env=production">People & access</a><a class="" href="/account/automation?env=production">API & automation</a></section><section class="nav-group"><h2>Account</h2><a class="" href="/account/security?env=production">Sign-in & security</a></section></div><form method="post" action="/api/logout" class="signout"><button type="submit">Sign out</button></form></aside><dialog class="command-palette" aria-labelledby="command-title"><div class="command-search"><span aria-hidden="true">⌕</span><input type="search" placeholder="Search services, domains, deployments…" aria-label="Search resources" autocomplete="off"><button type="button" class="command-close" aria-label="Close search">Esc</button></div><h2 id="command-title" class="sr-only">Search resources and navigation</h2><div class="command-status" role="status">Start typing to search this project.</div><section class="saved-views" aria-labelledby="saved-views-title"><div class="saved-views-heading"><h3 id="saved-views-title">Saved views</h3><form class="save-view-form"><label class="sr-only" for="save-view-name">Saved view name</label><input id="save-view-name" maxlength="64" placeholder="Name this view" autocomplete="off"><button type="submit">Save current filters</button></form></div><div class="saved-view-list"></div></section><form class="tag-result-form"><label for="tag-result-name">Tag selected resource</label><input id="tag-result-name" maxlength="32" placeholder="customer-facing" pattern="[A-Za-z0-9][A-Za-z0-9 -]{0,31}" autocomplete="off"><input class="tag-color" type="color" value="#5a8be0" aria-label="Tag color"><button type="submit">Add tag</button></form><div class="command-results" role="listbox" aria-label="Search results"></div><footer><span>↑ ↓ navigate</span><span>Enter open</span><span>Esc close</span></footer></dialog><div class="context-bar" aria-label="Current scope"><div class="context-path"><div class="context-breadcrumb"><span>ts-cloud</span><i>/</i><strong>production</strong></div><div class="context-filters" aria-label="Active filters"></div></div><span class="scope-safety production">Production scope</span></div> <script data-stx-scoped data-stx-run="always">
+<!DOCTYPE html><html lang="en" data-theme="dark"><head><meta charset="UTF-8"><meta name="stx-build" content="mt7lgvq3gjbx1h"><meta name="title" content="Access unavailable · ts-cloud"><meta name="description" content="A website built with stx templating engine"><meta property="og:title" content="Access unavailable · ts-cloud"><meta property="og:description" content="A website built with stx templating engine"><meta property="og:type" content="website"><meta name="twitter:card" content="summary_large_image"><meta name="twitter:title" content="Access unavailable · ts-cloud"><meta name="twitter:description" content="A website built with stx templating engine"> <script data-stx-runtime src="/_stx/runtime.c696d17a.js"></script> <meta name="viewport" content="width=device-width, initial-scale=1.0"><title>Access unavailable · ts-cloud</title><link rel="icon" type="image/svg+xml" href="data:image/svg+xml,%3Csvg xmlns='http://www.w3.org/2000/svg' viewBox='0 0 32 32'%3E%3Crect x='3' y='3' width='26' height='26' rx='8' fill='%235a8be0'/%3E%3C/svg%3E"><link rel="preconnect" href="https://fonts.googleapis.com"><link href="https://fonts.googleapis.com/css2?family=Inter:wght@400;500;600;700;800&display=swap" rel="stylesheet"><link rel="stylesheet" href="/_stx/style.448ab192.css"><style data-stx-cloak>[x-cloak]{display:none !important}</style><link data-crosswind="generated" rel="stylesheet" href="/_stx/crosswind.906ee17c.css"></head><body data-stx-auto><a data-stx-scope="stx_scope_nav_50" class="skip-link" href="#main-content">Skip to content</a><button class="nav-toggle-button" type="button" aria-label="Open navigation" aria-controls="primary-navigation" aria-expanded="false"><span></span><span></span><span></span></button><button class="nav-scrim" type="button" aria-label="Close navigation"></button><aside class="app-sidebar" id="primary-navigation" aria-label="Primary navigation"><a class="brand" href="/?env=production"><span class="dot"></span><span>ts-cloud</span></a><div class="sidebar-context"><span class="context-label">Project</span><strong>ts-cloud</strong></div><div class="environment-picker" aria-label="Environment"><span class="context-label">Environment</span><details><summary class="environment-current production"><span>PROD</span><strong>production</strong></summary></details></div><button class="command-trigger" type="button" aria-keyshortcuts="Meta+K Control+K"><span>Search resources</span><kbd>⌘ K</kbd></button><div class="nav-groups"><section class="nav-group"><h2>Overview</h2><a class="" href="/?env=production">Dashboard</a><a href="/server/activity?env=production">Activity</a></section><section class="nav-group"><h2>Applications</h2><a class="" href="/server/sites?env=production">Services</a><a class="" href="/server/deployments?env=production">Deployments</a><a class="" href="/server/logs?env=production">Logs</a><a class="" href="/integrations?env=production">Git integrations</a><a class="" href="/applications/new?env=production">Create application</a><a class="" href="/applications/compose?env=production">Compose applications</a></section><section class="nav-group"><h2>Operations</h2><a class="" href="/operations/queue?env=production">Deployment queue</a><a class="" href="/operations/previews?env=production">Preview environments</a><a class="" href="/operations/releases?env=production">Releases & promotion</a><a class="" href="/operations/regions?env=production">Regions & failover</a><a class="" href="/operations/maintenance?env=production">Maintenance & DR</a><a class="" href="/operations/workloads?env=production">Workloads</a><a class="" href="/operations/observability?env=production">Observability</a><a class="" href="/operations/alerts?env=production">Alerts & health</a><a class="" href="/operations/spend?env=production">Spend & budgets</a><a href="/server/metrics?env=production">Metrics</a><a href="/server/services?env=production">Runtime services</a><a class="" href="/operations/jobs?env=production">Workers & schedules</a><a class="" href="/operations/configuration?env=production">Environment &amp; secrets</a><a class="" href="/data/backups?env=production">Backups &amp; recovery</a><a class="" href="/data/volumes?env=production">Persistent volumes</a><a href="/server/actions?env=production">Run operations</a></section><section class="nav-group"><h2>Infrastructure</h2><a class="" href="/infrastructure/topology?env=production">Infrastructure map</a><a class="" href="/data/services?env=production">Data services</a><a class="" href="/data/volumes?env=production">Persistent volumes</a><a href="/server/firewall?env=production">Network & firewall</a><a href="/server/ssh-keys?env=production">SSH keys</a><a class="" href="/server/fleet?env=production">Fleet inventory</a><a class="" href="/server/capacity?env=production">Capacity & placement</a><a href="/security?env=production">Security posture</a><a href="/server/terminal?env=production">Terminal</a></section><section class="nav-group"><h2>Organization</h2><a class="" href="/server/team?env=production">People & access</a><a class="" href="/account/automation?env=production">API & automation</a></section><section class="nav-group"><h2>Account</h2><a class="" href="/account/security?env=production">Sign-in & security</a></section></div><form method="post" action="/api/logout" class="signout"><button type="submit">Sign out</button></form></aside><dialog class="command-palette" aria-labelledby="command-title"><div class="command-search"><span aria-hidden="true">⌕</span><input type="search" placeholder="Search services, domains, deployments…" aria-label="Search resources" autocomplete="off"><button type="button" class="command-close" aria-label="Close search">Esc</button></div><h2 id="command-title" class="sr-only">Search resources and navigation</h2><div class="command-status" role="status">Start typing to search this project.</div><section class="saved-views" aria-labelledby="saved-views-title"><div class="saved-views-heading"><h3 id="saved-views-title">Saved views</h3><form class="save-view-form"><label class="sr-only" for="save-view-name">Saved view name</label><input id="save-view-name" maxlength="64" placeholder="Name this view" autocomplete="off"><button type="submit">Save current filters</button></form></div><div class="saved-view-list"></div></section><form class="tag-result-form"><label for="tag-result-name">Tag selected resource</label><input id="tag-result-name" maxlength="32" placeholder="customer-facing" pattern="[A-Za-z0-9][A-Za-z0-9 -]{0,31}" autocomplete="off"><input class="tag-color" type="color" value="#5a8be0" aria-label="Tag color"><button type="submit">Add tag</button></form><div class="command-results" role="listbox" aria-label="Search results"></div><footer><span>↑ ↓ navigate</span><span>Enter open</span><span>Esc close</span></footer></dialog><div class="context-bar" aria-label="Current scope"><div class="context-path"><div class="context-breadcrumb"><span>ts-cloud</span><i>/</i><strong>production</strong></div><div class="context-filters" aria-label="Active filters"></div></div><span class="scope-safety production">Production scope</span></div> <script data-stx-scoped data-stx-run="always">
 (function() {
   var { batch, computed, configureFetch, defineEmits, defineExpose, definePageMeta, defineProps, defineSlots, defineStore, derived, effect, goBack, goForward, inject, invalidateRoute, isDerived, isSignal, navigate, nextTick, onBeforeMount, onBeforeUnmount, onDestroy, onMount, onMounted, onUnmounted, peek, provide, reactive, ref, refresh, registerStoresClient, setRouteParams, state, untrack, useAsync, useClickOutside, useColorMode, useCookie, useCounter, useDark, useDebounce, useDebouncedValue, useEventListener, useFetch, useFocus, useHead, useId, useInterval, useLocalStorage, useMediaQuery, useMutation, useOptimistic, usePreferredContrast, usePreferredDark, usePreferredLight, usePreferredReducedMotion, useQuery, useReactiveProp, useRef, useRoute, useRouteParam, useRouteParams, useScrollLock, useSearchParams, useSeoMeta, useSessionStorage, useSlots, useStore, useThrottle, useTimeout, useToggle, useWebSocket, watch, watchEffect, watchMultiple, withDefaults } = window.stx;
   var __destroyHooks = [];

package/dist/ui/account/automation.html

@@ -1,5 +1,5 @@
-<!DOCTYPE html><html lang="en" data-theme="dark"><head><meta charset="UTF-8"><meta name="stx-build" content="mt689snetu3vh5"><meta name="title" content="stx Project"><meta name="description" content="A website built with stx templating engine"><meta property="og:title" content="stx Project"><meta property="og:description" content="A website built with stx templating engine"><meta property="og:type" content="website"><meta name="twitter:card" content="summary_large_image"><meta name="twitter:title" content="stx Project"><meta name="twitter:description" content="A website built with stx templating engine"> <script data-stx-runtime src="/_stx/runtime.c696d17a.js"></script> <meta name="viewport" content="width=device-width, initial-scale=1.0"><title>ts-cloud - API &amp; automation</title><link rel="icon" type="image/svg+xml" href="data:image/svg+xml,%3Csvg xmlns='http://www.w3.org/2000/svg' viewBox='0 0 32 32'%3E%3Crect x='3' y='3' width='26' height='26' rx='8' fill='%235a8be0'/%3E%3C/svg%3E"><link rel="preconnect" href="https://fonts.googleapis.com"><link href="https://fonts.googleapis.com/css2?family=Inter:wght@400;500;600;700;800&display=swap" rel="stylesheet"><link rel="stylesheet" href="/_stx/style.448ab192.css"> <script data-stx-scoped>
-function __stx_setup_1787514988755_0() {
+<!DOCTYPE html><html lang="en" data-theme="dark"><head><meta charset="UTF-8"><meta name="stx-build" content="mt7lgvq3gjbx1h"><meta name="title" content="stx Project"><meta name="description" content="A website built with stx templating engine"><meta property="og:title" content="stx Project"><meta property="og:description" content="A website built with stx templating engine"><meta property="og:type" content="website"><meta name="twitter:card" content="summary_large_image"><meta name="twitter:title" content="stx Project"><meta name="twitter:description" content="A website built with stx templating engine"> <script data-stx-runtime src="/_stx/runtime.c696d17a.js"></script> <meta name="viewport" content="width=device-width, initial-scale=1.0"><title>ts-cloud - API &amp; automation</title><link rel="icon" type="image/svg+xml" href="data:image/svg+xml,%3Csvg xmlns='http://www.w3.org/2000/svg' viewBox='0 0 32 32'%3E%3Crect x='3' y='3' width='26' height='26' rx='8' fill='%235a8be0'/%3E%3C/svg%3E"><link rel="preconnect" href="https://fonts.googleapis.com"><link href="https://fonts.googleapis.com/css2?family=Inter:wght@400;500;600;700;800&display=swap" rel="stylesheet"><link rel="stylesheet" href="/_stx/style.448ab192.css"> <script data-stx-scoped>
+function __stx_setup_1787597620495_7() {
   const { batch, computed, configureFetch, defineEmits, defineExpose, definePageMeta, defineProps, defineSlots, defineStore, derived, effect, goBack, goForward, inject, invalidateRoute, isDerived, isSignal, navigate, nextTick, onBeforeMount, onBeforeUnmount, onDestroy, onMount, onMounted, onUnmounted, peek, provide, reactive, ref, refresh, registerStoresClient, setRouteParams, state, untrack, useAsync, useClickOutside, useColorMode, useCookie, useCounter, useDark, useDebounce, useDebouncedValue, useEventListener, useFetch, useFocus, useHead, useId, useInterval, useLocalStorage, useMediaQuery, useMutation, useOptimistic, usePreferredContrast, usePreferredDark, usePreferredLight, usePreferredReducedMotion, useQuery, useReactiveProp, useRef, useRoute, useRouteParam, useRouteParams, useScrollLock, useSearchParams, useSeoMeta, useSessionStorage, useSlots, useStore, useThrottle, useTimeout, useToggle, useWebSocket, watch, watchEffect, watchMultiple, withDefaults } = window.stx;
 
 const accounts = state([]);
@@ -189,9 +189,9 @@ onMount(() => {
 
   return { accounts, project, environments, resources, message, messageKind, reveal, accountSlug, accountName, accountRole, accountScopeType, accountScopeId, selectedAccount, tokenName, tokenCapabilities, tokenScopeType, tokenScopeId, tokenExpiry, password, mfaCode, capabilities, setMessage, setScope, scopeLabel, tokenState, toggleCapability, load, selectAccount, stepUp, createAccount, createToken, tokenAction, disableAccount, curlExample, cliExample, copy };
 }
-window.__stx_latestSetup=__stx_setup_1787514988755_0;
-if(window.stx)window.stx._latestSetup=__stx_setup_1787514988755_0;
-</script> <style data-stx-cloak>[x-cloak]{display:none !important}</style><link data-crosswind="generated" rel="stylesheet" href="/_stx/crosswind.906ee17c.css"></head><body data-stx="__stx_setup_1787514988755_0"><a data-stx-scope="stx_scope_nav_1" class="skip-link" href="#main-content">Skip to content</a><button class="nav-toggle-button" type="button" aria-label="Open navigation" aria-controls="primary-navigation" aria-expanded="false"><span></span><span></span><span></span></button><button class="nav-scrim" type="button" aria-label="Close navigation"></button><aside class="app-sidebar" id="primary-navigation" aria-label="Primary navigation"><a class="brand" href="/?env=production"><span class="dot"></span><span>ts-cloud</span></a><div class="sidebar-context"><span class="context-label">Project</span><strong>ts-cloud</strong></div><div class="environment-picker" aria-label="Environment"><span class="context-label">Environment</span><details><summary class="environment-current production"><span>PROD</span><strong>production</strong></summary></details></div><button class="command-trigger" type="button" aria-keyshortcuts="Meta+K Control+K"><span>Search resources</span><kbd>⌘ K</kbd></button><div class="nav-groups"><section class="nav-group"><h2>Overview</h2><a class="" href="/?env=production">Dashboard</a><a href="/server/activity?env=production">Activity</a></section><section class="nav-group"><h2>Applications</h2><a class="" href="/server/sites?env=production">Services</a><a class="" href="/server/deployments?env=production">Deployments</a><a class="" href="/server/logs?env=production">Logs</a><a class="" href="/integrations?env=production">Git integrations</a><a class="" href="/applications/new?env=production">Create application</a><a class="" href="/applications/compose?env=production">Compose applications</a></section><section class="nav-group"><h2>Operations</h2><a class="" href="/operations/queue?env=production">Deployment queue</a><a class="" href="/operations/previews?env=production">Preview environments</a><a class="" href="/operations/releases?env=production">Releases & promotion</a><a class="" href="/operations/regions?env=production">Regions & failover</a><a class="" href="/operations/maintenance?env=production">Maintenance & DR</a><a class="" href="/operations/workloads?env=production">Workloads</a><a class="" href="/operations/observability?env=production">Observability</a><a class="" href="/operations/alerts?env=production">Alerts & health</a><a class="" href="/operations/spend?env=production">Spend & budgets</a><a href="/server/metrics?env=production">Metrics</a><a href="/server/services?env=production">Runtime services</a><a class="" href="/operations/jobs?env=production">Workers & schedules</a><a class="" href="/operations/configuration?env=production">Environment &amp; secrets</a><a class="" href="/data/backups?env=production">Backups &amp; recovery</a><a class="" href="/data/volumes?env=production">Persistent volumes</a><a href="/server/actions?env=production">Run operations</a></section><section class="nav-group"><h2>Infrastructure</h2><a class="" href="/infrastructure/topology?env=production">Infrastructure map</a><a class="" href="/data/services?env=production">Data services</a><a class="" href="/data/volumes?env=production">Persistent volumes</a><a href="/server/firewall?env=production">Network & firewall</a><a href="/server/ssh-keys?env=production">SSH keys</a><a class="" href="/server/fleet?env=production">Fleet inventory</a><a class="" href="/server/capacity?env=production">Capacity & placement</a><a href="/security?env=production">Security posture</a><a href="/server/terminal?env=production">Terminal</a></section><section class="nav-group"><h2>Organization</h2><a class="" href="/server/team?env=production">People & access</a><a class="active" href="/account/automation?env=production">API & automation</a></section><section class="nav-group"><h2>Account</h2><a class="" href="/account/security?env=production">Sign-in & security</a></section></div><form method="post" action="/api/logout" class="signout"><button type="submit">Sign out</button></form></aside><dialog class="command-palette" aria-labelledby="command-title"><div class="command-search"><span aria-hidden="true">⌕</span><input type="search" placeholder="Search services, domains, deployments…" aria-label="Search resources" autocomplete="off"><button type="button" class="command-close" aria-label="Close search">Esc</button></div><h2 id="command-title" class="sr-only">Search resources and navigation</h2><div class="command-status" role="status">Start typing to search this project.</div><section class="saved-views" aria-labelledby="saved-views-title"><div class="saved-views-heading"><h3 id="saved-views-title">Saved views</h3><form class="save-view-form"><label class="sr-only" for="save-view-name">Saved view name</label><input id="save-view-name" maxlength="64" placeholder="Name this view" autocomplete="off"><button type="submit">Save current filters</button></form></div><div class="saved-view-list"></div></section><form class="tag-result-form"><label for="tag-result-name">Tag selected resource</label><input id="tag-result-name" maxlength="32" placeholder="customer-facing" pattern="[A-Za-z0-9][A-Za-z0-9 -]{0,31}" autocomplete="off"><input class="tag-color" type="color" value="#5a8be0" aria-label="Tag color"><button type="submit">Add tag</button></form><div class="command-results" role="listbox" aria-label="Search results"></div><footer><span>↑ ↓ navigate</span><span>Enter open</span><span>Esc close</span></footer></dialog><div class="context-bar" aria-label="Current scope"><div class="context-path"><div class="context-breadcrumb"><span>ts-cloud</span><i>/</i><strong>production</strong></div><div class="context-filters" aria-label="Active filters"></div></div><span class="scope-safety production">Production scope</span></div> <script data-stx-scoped data-stx-run="always">
+window.__stx_latestSetup=__stx_setup_1787597620495_7;
+if(window.stx)window.stx._latestSetup=__stx_setup_1787597620495_7;
+</script> <style data-stx-cloak>[x-cloak]{display:none !important}</style><link data-crosswind="generated" rel="stylesheet" href="/_stx/crosswind.906ee17c.css"></head><body data-stx="__stx_setup_1787597620495_7"><a data-stx-scope="stx_scope_nav_10" class="skip-link" href="#main-content">Skip to content</a><button class="nav-toggle-button" type="button" aria-label="Open navigation" aria-controls="primary-navigation" aria-expanded="false"><span></span><span></span><span></span></button><button class="nav-scrim" type="button" aria-label="Close navigation"></button><aside class="app-sidebar" id="primary-navigation" aria-label="Primary navigation"><a class="brand" href="/?env=production"><span class="dot"></span><span>ts-cloud</span></a><div class="sidebar-context"><span class="context-label">Project</span><strong>ts-cloud</strong></div><div class="environment-picker" aria-label="Environment"><span class="context-label">Environment</span><details><summary class="environment-current production"><span>PROD</span><strong>production</strong></summary></details></div><button class="command-trigger" type="button" aria-keyshortcuts="Meta+K Control+K"><span>Search resources</span><kbd>⌘ K</kbd></button><div class="nav-groups"><section class="nav-group"><h2>Overview</h2><a class="" href="/?env=production">Dashboard</a><a href="/server/activity?env=production">Activity</a></section><section class="nav-group"><h2>Applications</h2><a class="" href="/server/sites?env=production">Services</a><a class="" href="/server/deployments?env=production">Deployments</a><a class="" href="/server/logs?env=production">Logs</a><a class="" href="/integrations?env=production">Git integrations</a><a class="" href="/applications/new?env=production">Create application</a><a class="" href="/applications/compose?env=production">Compose applications</a></section><section class="nav-group"><h2>Operations</h2><a class="" href="/operations/queue?env=production">Deployment queue</a><a class="" href="/operations/previews?env=production">Preview environments</a><a class="" href="/operations/releases?env=production">Releases & promotion</a><a class="" href="/operations/regions?env=production">Regions & failover</a><a class="" href="/operations/maintenance?env=production">Maintenance & DR</a><a class="" href="/operations/workloads?env=production">Workloads</a><a class="" href="/operations/observability?env=production">Observability</a><a class="" href="/operations/alerts?env=production">Alerts & health</a><a class="" href="/operations/spend?env=production">Spend & budgets</a><a href="/server/metrics?env=production">Metrics</a><a href="/server/services?env=production">Runtime services</a><a class="" href="/operations/jobs?env=production">Workers & schedules</a><a class="" href="/operations/configuration?env=production">Environment &amp; secrets</a><a class="" href="/data/backups?env=production">Backups &amp; recovery</a><a class="" href="/data/volumes?env=production">Persistent volumes</a><a href="/server/actions?env=production">Run operations</a></section><section class="nav-group"><h2>Infrastructure</h2><a class="" href="/infrastructure/topology?env=production">Infrastructure map</a><a class="" href="/data/services?env=production">Data services</a><a class="" href="/data/volumes?env=production">Persistent volumes</a><a href="/server/firewall?env=production">Network & firewall</a><a href="/server/ssh-keys?env=production">SSH keys</a><a class="" href="/server/fleet?env=production">Fleet inventory</a><a class="" href="/server/capacity?env=production">Capacity & placement</a><a href="/security?env=production">Security posture</a><a href="/server/terminal?env=production">Terminal</a></section><section class="nav-group"><h2>Organization</h2><a class="" href="/server/team?env=production">People & access</a><a class="active" href="/account/automation?env=production">API & automation</a></section><section class="nav-group"><h2>Account</h2><a class="" href="/account/security?env=production">Sign-in & security</a></section></div><form method="post" action="/api/logout" class="signout"><button type="submit">Sign out</button></form></aside><dialog class="command-palette" aria-labelledby="command-title"><div class="command-search"><span aria-hidden="true">⌕</span><input type="search" placeholder="Search services, domains, deployments…" aria-label="Search resources" autocomplete="off"><button type="button" class="command-close" aria-label="Close search">Esc</button></div><h2 id="command-title" class="sr-only">Search resources and navigation</h2><div class="command-status" role="status">Start typing to search this project.</div><section class="saved-views" aria-labelledby="saved-views-title"><div class="saved-views-heading"><h3 id="saved-views-title">Saved views</h3><form class="save-view-form"><label class="sr-only" for="save-view-name">Saved view name</label><input id="save-view-name" maxlength="64" placeholder="Name this view" autocomplete="off"><button type="submit">Save current filters</button></form></div><div class="saved-view-list"></div></section><form class="tag-result-form"><label for="tag-result-name">Tag selected resource</label><input id="tag-result-name" maxlength="32" placeholder="customer-facing" pattern="[A-Za-z0-9][A-Za-z0-9 -]{0,31}" autocomplete="off"><input class="tag-color" type="color" value="#5a8be0" aria-label="Tag color"><button type="submit">Add tag</button></form><div class="command-results" role="listbox" aria-label="Search results"></div><footer><span>↑ ↓ navigate</span><span>Enter open</span><span>Esc close</span></footer></dialog><div class="context-bar" aria-label="Current scope"><div class="context-path"><div class="context-breadcrumb"><span>ts-cloud</span><i>/</i><strong>production</strong></div><div class="context-filters" aria-label="Active filters"></div></div><span class="scope-safety production">Production scope</span></div> <script data-stx-scoped data-stx-run="always">
 (function() {
   var { batch, computed, configureFetch, defineEmits, defineExpose, definePageMeta, defineProps, defineSlots, defineStore, derived, effect, goBack, goForward, inject, invalidateRoute, isDerived, isSignal, navigate, nextTick, onBeforeMount, onBeforeUnmount, onDestroy, onMount, onMounted, onUnmounted, peek, provide, reactive, ref, refresh, registerStoresClient, setRouteParams, state, untrack, useAsync, useClickOutside, useColorMode, useCookie, useCounter, useDark, useDebounce, useDebouncedValue, useEventListener, useFetch, useFocus, useHead, useId, useInterval, useLocalStorage, useMediaQuery, useMutation, useOptimistic, usePreferredContrast, usePreferredDark, usePreferredLight, usePreferredReducedMotion, useQuery, useReactiveProp, useRef, useRoute, useRouteParam, useRouteParams, useScrollLock, useSearchParams, useSeoMeta, useSessionStorage, useSlots, useStore, useThrottle, useTimeout, useToggle, useWebSocket, watch, watchEffect, watchMultiple, withDefaults } = window.stx;
   var __destroyHooks = [];
@@ -542,6 +542,6 @@ if(window.stx)window.stx._latestSetup=__stx_setup_1787514988755_0;
   
   
   try { if (typeof __stxScopeRenames !== 'undefined' && __stxScopeRenames) { for (var __stxRK in __stxScopeRenames) __scopeRegistration[__stxRK] = __stxScopeRenames[__stxRK]; } } catch (e) { /* no renames */ }
-  window.stx._scopes['stx_scope_nav_1'] = __scopeRegistration;
+  window.stx._scopes['stx_scope_nav_10'] = __scopeRegistration;
 })();
 </script> <div class="wrap"><div class="crumbs"><a href="/">Dashboard</a><span class="sep">/</span> Organization <span class="sep">/</span> API &amp; automation</div><header class="page"><div><h1>API &amp; automation</h1><p>Create least-privilege machine identities for CI. Tokens never create browser sessions and cannot access outside their membership and token scope.</p></div><a class="btn ghost" href="/api/v1/openapi.json">OpenAPI 3.1</a></header><div class="automation-message msg" :class="messageKind()" role="status" aria-live="polite" x-cloak>{{ message() }}</div><div class="panel reveal" @show="!!reveal()" x-cloak><div><strong>Copy this token now</strong><span>The raw secret is shown once. Rotation keeps the old token active until you explicitly revoke it.</span></div><code x-cloak>{{ reveal()?.secret }}</code><button class="btn sm" type="button" @click="copy(reveal()?.secret)">Copy token</button><label>curl</label><code x-cloak>{{ curlExample() }}</code><button class="btn ghost sm" type="button" @click="copy(curlExample())">Copy curl</button><label>CLI</label><code x-cloak>{{ cliExample() }}</code><button class="btn ghost sm" type="button" @click="copy(cliExample())">Copy CLI</button><button class="btn danger sm" type="button" @click="reveal.set(null)">I saved it; hide secret</button></div><div class="section"><h2>Service accounts</h2><div class="accounts" x-cloak><template :for="item in accounts()"><article class="account panel" :class="selectedAccount() === item.account.id ? 'selected' : ''" x-cloak><button class="account-main" type="button" @click="selectAccount(item)" x-cloak><span x-cloak><strong x-cloak>{{ item.account.name }}</strong><small x-cloak>{{ item.account.slug }} · {{ item.membership?.roleTemplate }} · {{ scopeLabel(item.membership?.scope) }}</small><small x-cloak>Created {{ new Date(item.account.createdAt).toLocaleDateString() }} by {{ item.createdBy?.displayName || 'offline administrator' }}</small></span><span class="tag" x-cloak>{{ item.account.state }}</span></button><div class="token-list" x-cloak><template :for="token in item.tokens"><div class="token" x-cloak><div x-cloak><strong x-cloak>{{ token.name }}</strong><code x-cloak>{{ token.prefix }}</code><small x-cloak>{{ tokenState(token) }} · created {{ new Date(token.createdAt).toLocaleDateString() }} by {{ token.createdBy?.displayName || 'offline administrator' }} · expires {{ new Date(token.expiresAt).toLocaleDateString() }} · last used {{ token.lastUsedAt ? new Date(token.lastUsedAt).toLocaleString() : 'never' }}</small><small x-cloak>{{ token.capabilities.join(', ') }} · {{ scopeLabel(token.scope) }}</small></div><div class="table-actions"><button class="btn ghost sm" type="button" @show="token.state === 'active'" @click="tokenAction(token, 'rotate')" x-cloak>Rotate</button><button class="btn danger sm" type="button" @show="token.state === 'active'" @click="tokenAction(token, 'revoke')" x-cloak>Revoke</button></div></div></template><div class="compact empty" @show="item.tokens.length === 0" x-cloak><span>No tokens yet.</span></div></div><button class="btn danger sm" type="button" @show="item.account.state === 'active'" @click="disableAccount(item)" x-cloak>Disable account and tokens</button></article></template><div class="compact empty panel" @show="accounts().length === 0" x-cloak><strong>No service accounts</strong><span>Create one for a CI system or external automation.</span></div></div></div><div class="section"><h2>Create service account</h2><div class="panel"><form class="form-grid" @submit.prevent="createAccount()"><div class="field-block"><label for="account-name">Name</label><input id="account-name" :value="accountName()" @input="accountName.set($event.target.value)" placeholder="Production CI" required></div><div class="field-block"><label for="account-slug">Slug</label><input id="account-slug" :value="accountSlug()" @input="accountSlug.set($event.target.value)" pattern="[a-z0-9][a-z0-9-]{1,47}" placeholder="production-ci" required></div><div class="field-block"><label for="account-role">Maximum role</label><select id="account-role" :value="accountRole()" @change="accountRole.set($event.target.value)"><option value="viewer">Viewer</option><option value="auditor">Auditor</option><option value="deployer">Deployer</option><option value="operator">Operator</option><option value="admin">Admin</option></select><small>Service accounts can never be owners.</small></div><div class="field-block"><label for="account-scope">Maximum scope</label><select id="account-scope" :value="accountScopeType()" @change="accountScopeType.set($event.target.value); setScope($event.target.value, accountScopeId)"><option value="organization">Organization</option><option value="project">Current project</option><option value="environment">One environment</option><option value="resource">One service</option></select></div><div class="field-block" @show="accountScopeType() === 'environment'" x-cloak><label for="account-environment">Environment</label><select id="account-environment" :value="accountScopeId()" @change="accountScopeId.set($event.target.value)"><template :for="environment in environments()"><option :value="environment.id">{{ environment.name }}</option></template></select></div><div class="field-block" @show="accountScopeType() === 'resource'" x-cloak><label for="account-resource">Service</label><select id="account-resource" :value="accountScopeId()" @change="accountScopeId.set($event.target.value)"><template :for="resource in resources()"><option :value="resource.id">{{ resource.name }}</option></template></select></div><div class="form-actions"><button class="btn" type="submit">Create service account</button></div></form></div></div><div class="section"><h2>Create API token</h2><div class="panel"><form class="form-grid" @submit.prevent="createToken()"><div class="field-block"><label for="token-account">Service account</label><select id="token-account" :value="selectedAccount()" @change="selectAccount(accounts().find(item => item.account.id === $event.target.value))" required><template :for="item in accounts()"><option :value="item.account.id" :disabled="item.account.state !== 'active'">{{ item.account.name }}</option></template></select></div><div class="field-block"><label for="token-name">Token name</label><input id="token-name" :value="tokenName()" @input="tokenName.set($event.target.value)" required></div><div class="field-block"><label for="token-expiry">Expiry</label><input id="token-expiry" type="date" :value="tokenExpiry()" @input="tokenExpiry.set($event.target.value)"><small>Defaults to 90 days; maximum one year.</small></div><div class="field-block"><label for="token-scope">Token scope</label><select id="token-scope" :value="tokenScopeType()" @change="tokenScopeType.set($event.target.value); setScope($event.target.value, tokenScopeId)"><option value="organization">Organization</option><option value="project">Current project</option><option value="environment">One environment</option><option value="resource">One service</option></select><small>Must be equal to or narrower than the service-account scope.</small></div><div class="field-block" @show="tokenScopeType() === 'environment'" x-cloak><label>Environment</label><select :value="tokenScopeId()" @change="tokenScopeId.set($event.target.value)"><template :for="environment in environments()"><option :value="environment.id">{{ environment.name }}</option></template></select></div><div class="field-block" @show="tokenScopeType() === 'resource'" x-cloak><label>Service</label><select :value="tokenScopeId()" @change="tokenScopeId.set($event.target.value)"><template :for="resource in resources()"><option :value="resource.id">{{ resource.name }}</option></template></select></div><fieldset class="capabilities"><legend>Explicit capabilities</legend><template :for="capability in capabilities"><label class="capability" x-cloak><input type="checkbox" :checked="tokenCapabilities().includes(capability[0])" @change="toggleCapability(capability[0])"><span x-cloak><b x-cloak>{{ capability[0] }}</b><small x-cloak>{{ capability[1] }}</small></span></label></template></fieldset><div class="form-actions"><button class="btn" type="submit" :disabled="!selectedAccount() || tokenCapabilities().length === 0">Create and reveal token</button></div></form></div></div><div class="section"><h2>Confirm sensitive changes</h2><div class="auth-grid panel"><div class="field-block"><label for="automation-password">Your password</label><input id="automation-password" type="password" autocomplete="current-password" :value="password()" @input="password.set($event.target.value)" required></div><div class="field-block"><label for="automation-code">Authenticator or recovery code</label><input id="automation-code" autocomplete="one-time-code" :value="mfaCode()" @input="mfaCode.set($event.target.value)"><small>Required when MFA is enabled. Used only for recent-auth confirmation.</small></div></div></div></div><style> .automation-message{min-height:20px;margin-top:12px}.accounts{display:grid;gap:12px}.account{display:grid;gap:14px}.account.selected{border-color:var(--accent)} .account-main{display:flex;justify-content:space-between;gap:12px;width:100%;text-align:left;background:none;border:0;color:inherit;cursor:pointer}.account-main span:first-child{display:grid;gap:4px}.account-main small,.token small{color:var(--txt3);font-size:12px;line-height:1.5} .token-list{display:grid;gap:10px}.token{display:flex;justify-content:space-between;gap:14px;padding:12px;border:1px solid var(--panel-br);border-radius:10px}.token>div:first-child{display:grid;gap:4px;min-width:0}.token code{color:var(--txt2)} .reveal{display:grid;grid-template-columns:minmax(0,1fr) auto;gap:10px;margin-top:18px;border-color:rgba(53,209,155,.35)}.reveal>div,.reveal>code,.reveal>label{grid-column:1/-1}.reveal>div{display:grid;gap:4px}.reveal span{color:var(--txt2);font-size:12px}.reveal code{padding:10px;background:rgba(0,0,0,.25);border-radius:8px;overflow-wrap:anywhere;user-select:all} .capabilities{grid-column:1/-1;border:1px solid var(--panel-br);border-radius:10px;padding:12px;display:grid;grid-template-columns:repeat(2,minmax(0,1fr));gap:8px}.capabilities legend{padding:0 6px;color:var(--txt3);font-size:11px;font-weight:800;text-transform:uppercase}.capability{display:flex;gap:9px;align-items:flex-start;padding:9px}.capability input{width:auto;margin-top:3px}.capability span{display:grid;gap:2px}.capability small{color:var(--txt3);font-size:11px}.auth-grid{display:grid;grid-template-columns:1fr 1fr;gap:14px} @media(max-width:700px){.token{display:grid}.reveal,.capabilities,.auth-grid{grid-template-columns:1fr}.reveal>*{grid-column:1}} </style></body></html>