@stacksjs/ts-cloud 0.16.39 → 0.16.40

package/dist/operations/index.js

@@ -1 +1 @@
-import{Dh,Ph,Nh,Xg,Yg,Zg,kh,ep,tp,Bh,xh,rp,Oh,_h,Vc,np,Lh,$h,ip,Mh,Fh,Uh,Qh,Hh,Gh,Vh,Ai,qc,sp,op,ap,cp,dp,lp,up,gp,pp,mp,fp,qh,jh,zh,Kh,Wh,Jh,Xh}from"../chunk-jsnhb1p4.js";import"../chunk-kpjhfgbh.js";import"../chunk-ffba3270.js";import"../chunk-tbn385ak.js";import"../chunk-c45ay9fx.js";export{Yg as ENVIRONMENT_LABEL,Xg as PROJECT_LABEL,Zg as ROLE_LABEL,$h as applyPlan,Hh as attachConflicts,Gh as attachIsViable,Qh as attachPreconditions,Wh as buildCertificatePackScript,jh as buildCertificateStateScript,Jh as buildCertificateUnpackScript,pp as buildDrainSourceScript,Dh as buildDrainedSiteScanScript,gp as buildHealthGateScript,sp as buildPauseWorkersScript,dp as buildRestoreScript,Fh as buildSetHostnameScript,cp as buildSnapshotScript,mp as buildSourceStateScript,lp as buildTargetStateScript,op as buildWorkersStateScript,Kh as certificatesMatch,Vh as formatAttachPlan,Nh as formatDrainedSiteRefusal,Oh as formatInventory,Lh as formatPlan,zh as parseCertificateState,Ph as parseDrainedSites,fp as parseSourceDrained,up as parseTargetReady,ap as parseWorkersPaused,Vc as pendingSteps,np as planIsDestructive,Mh as planServerRename,Xh as planSiteMove,Bh as probeHostRoutes,xh as reconcile,Uh as resolveAttachTarget,_h as resolvePlan,ep as routesFromFragments,Ai as siteMoveArchivePath,qh as siteMoveCertArchivePath,qc as siteUnitGlob,tp as tenantsOf,kh as toInventoryServer,rp as unaccountedSites,ip as validateServerName};
+import{Nh,kh,Bh,Zg,ep,tp,xh,rp,np,Oh,_h,ip,Lh,$h,jc,sp,Mh,Fh,op,Uh,Qh,Hh,Gh,Vh,qh,jh,Ii,zc,ap,cp,dp,lp,up,gp,pp,mp,fp,hp,Ap,zh,Kh,Wh,Jh,Xh,Yh,Zh}from"../chunk-qg03hfb6.js";import"../chunk-bfbahave.js";import"../chunk-jbtnyhrh.js";import"../chunk-5n1y5ehd.js";import"../chunk-my61jkg1.js";export{ep as ENVIRONMENT_LABEL,Zg as PROJECT_LABEL,tp as ROLE_LABEL,Fh as applyPlan,Vh as attachConflicts,qh as attachIsViable,Gh as attachPreconditions,Xh as buildCertificatePackScript,Kh as buildCertificateStateScript,Yh as buildCertificateUnpackScript,fp as buildDrainSourceScript,Nh as buildDrainedSiteScanScript,mp as buildHealthGateScript,ap as buildPauseWorkersScript,up as buildRestoreScript,Qh as buildSetHostnameScript,lp as buildSnapshotScript,hp as buildSourceStateScript,gp as buildTargetStateScript,cp as buildWorkersStateScript,Jh as certificatesMatch,jh as formatAttachPlan,Bh as formatDrainedSiteRefusal,Lh as formatInventory,Mh as formatPlan,Wh as parseCertificateState,kh as parseDrainedSites,Ap as parseSourceDrained,pp as parseTargetReady,dp as parseWorkersPaused,jc as pendingSteps,sp as planIsDestructive,Uh as planServerRename,Zh as planSiteMove,Oh as probeHostRoutes,_h as reconcile,Hh as resolveAttachTarget,$h as resolvePlan,rp as routesFromFragments,Ii as siteMoveArchivePath,zh as siteMoveCertArchivePath,zc as siteUnitGlob,np as tenantsOf,xh as toInventoryServer,ip as unaccountedSites,op as validateServerName};

package/dist/protection/index.js

@@ -1 +1 @@
-import{Dl,_o,Vi,qi,Lo,Pl,Nl,kl,ji,$o,Mo,Bl,xl,Fo,aS}from"../chunk-kkeb1dk1.js";import{Z,mi,js,Hc,fi,Kg}from"../chunk-v83qx041.js";import{Dd,qr,Pd,Nd,kd,Oi,Hp,jr}from"../chunk-yrcv3hrj.js";import{Ro,Do,Po,Il,Zr,bl,Cl,Gi,No,ko}from"../chunk-tbn385ak.js";import"../chunk-c45ay9fx.js";export{Do as CHAIN_HEADER,$o as DEFAULT_ATTACK_MODE_HOURS,Dd as DEFAULT_DDOS_THRESHOLDS,Zr as DEFAULT_RECURSION_LIMITS,Ro as DEPTH_HEADER,ji as MAX_CONTROL_HOURS,kl as PROTECTION_SETTING,Mo as ProtectionControlStore,Dl as RATE_LIMIT_KEY_SEPARATOR,Lo as RateLimiter,Gi as RecursionGuard,Po as TRACE_HEADER,Fo as applyControlsToDdos,xl as applyControlsToRateLimits,jr as applyMitigationFactor,Nl as defaultRateLimitRules,Bl as describePosture,Z as escapeSecLang,Il as functionFingerprint,_o as globMatches,js as globToRegex,Cl as inspectInvocation,mi as isSafePattern,qr as isValidCidr,aS as mergeControlsIntoConfig,bl as parseChain,Hp as planMitigation,No as propagationHeaders,Pl as rateLimitHeaders,qi as rateLimitKey,ko as recursionBlockedResponse,Oi as renderDdosInstallScript,kd as renderNftablesRuleset,Nd as renderSysctlFile,Hc as renderWafConfig,fi as renderWafInstallScript,Vi as ruleMatches,Pd as sysctlHardening,Kg as wafEventTelemetry};
+import{Nl,$o,zi,Ki,Mo,kl,Bl,xl,Wi,Fo,Uo,Ol,_l,Qo,dS}from"../chunk-qbbap3bt.js";import{ee,Ai,Ks,Vc,yi,Jg}from"../chunk-2vrv31sk.js";import{Nd,Kr,kd,Bd,xd,$i,Vp,Wr}from"../chunk-0evxayn1.js";import{Po,No,ko,Cl,rn,El,vl,ji,Bo,xo}from"../chunk-5n1y5ehd.js";import"../chunk-my61jkg1.js";export{No as CHAIN_HEADER,Fo as DEFAULT_ATTACK_MODE_HOURS,Nd as DEFAULT_DDOS_THRESHOLDS,rn as DEFAULT_RECURSION_LIMITS,Po as DEPTH_HEADER,Wi as MAX_CONTROL_HOURS,xl as PROTECTION_SETTING,Uo as ProtectionControlStore,Nl as RATE_LIMIT_KEY_SEPARATOR,Mo as RateLimiter,ji as RecursionGuard,ko as TRACE_HEADER,Qo as applyControlsToDdos,_l as applyControlsToRateLimits,Wr as applyMitigationFactor,Bl as defaultRateLimitRules,Ol as describePosture,ee as escapeSecLang,Cl as functionFingerprint,$o as globMatches,Ks as globToRegex,vl as inspectInvocation,Ai as isSafePattern,Kr as isValidCidr,dS as mergeControlsIntoConfig,El as parseChain,Vp as planMitigation,Bo as propagationHeaders,kl as rateLimitHeaders,Ki as rateLimitKey,xo as recursionBlockedResponse,$i as renderDdosInstallScript,xd as renderNftablesRuleset,Bd as renderSysctlFile,Vc as renderWafConfig,yi as renderWafInstallScript,zi as ruleMatches,kd as sysctlHardening,Jg as wafEventTelemetry};

package/dist/r2/index.d.ts

@@ -0,0 +1,8 @@
+/**
+ * Cloudflare R2: bucket management through the account API, S3 credentials
+ * derived from an API token, and the deploy-time reconcile for `infrastructure.r2`.
+ */
+export type { R2ApiLifecycleRule, R2Bucket, R2BucketScope, R2CustomDomain, R2ManagedDomain, R2ProviderOptions, R2S3Credentials, } from './provider';
+export { R2_NOT_ENABLED_ERROR_CODE, R2ApiError, r2Endpoint, R2NotEnabledError, R2Provider, r2S3Credentials, sameCorsRules, sameLifecycleRules, } from './provider';
+export type { R2BucketSummary, R2ConfigSource, R2ReconcileSummary, ReconcileR2BucketsOptions, } from './reconcile';
+export { cacheRuleParameters, domainStatus, managedRuleInSync, reconcileR2Buckets, toApiLifecycleRule, } from './reconcile';

package/dist/r2/provider.d.ts

@@ -0,0 +1,303 @@
+/**
+ * Cloudflare R2, through Cloudflare's account REST API.
+ *
+ * R2 has two front doors and they are easy to confuse:
+ *
+ *  - **The S3-compatible endpoint** (`https://{account}.r2.cloudflarestorage.com`)
+ *    reads and writes objects. It speaks SigV4 with an access key pair, and is
+ *    what an application uses at runtime; see {@link r2S3Credentials}.
+ *  - **The account API** (`/accounts/{id}/r2/...`) manages the buckets
+ *    themselves: creation, CORS, lifecycle, custom domains, the `r2.dev` URL.
+ *    It takes the account API token directly, as a Bearer token.
+ *
+ * This module is the second one. It mirrors {@link CloudflarePagesProvider}:
+ * account-scoped, a thin authenticated `request`, and one method per API
+ * concern. The `ensure*` methods read before they write, so a deploy that runs
+ * them on every release only touches what actually drifted.
+ */
+import type { R2CorsRule, R2Jurisdiction, R2LocationHint, R2MinTls } from '@ts-cloud/core';
+/**
+ * Cloudflare's answer when the account has never turned R2 on.
+ *
+ * R2 has to be enabled once, by a human, in the dashboard (it asks for a
+ * payment method even on the free tier), and no API call can do it. Every R2
+ * endpoint then fails with this code, which reads like a permissions problem
+ * unless it is called out.
+ */
+export declare const R2_NOT_ENABLED_ERROR_CODE = 10042;
+type FetchLike = (input: string, init?: RequestInit) => Promise<Response>;
+/** A failed call to the R2 account API, with Cloudflare's error codes kept. */
+export declare class R2ApiError extends Error {
+    readonly status: number;
+    readonly errors: Array<{
+        code: number;
+        message: string;
+    }>;
+    constructor(message: string, status: number, errors?: Array<{
+        code: number;
+        message: string;
+    }>);
+    /** Whether Cloudflare reported this error code. */
+    hasCode(code: number): boolean;
+}
+/**
+ * R2 is not enabled on the account. Only fixable in the dashboard.
+ *
+ * Thrown in place of the raw API error so a deploy can print one sentence the
+ * operator can act on, rather than "Cloudflare API error: 10042".
+ */
+export declare class R2NotEnabledError extends R2ApiError {
+    readonly accountId: string;
+    constructor(accountId: string, status: number, errors?: Array<{
+        code: number;
+        message: string;
+    }>);
+}
+export interface R2Bucket {
+    name: string;
+    creation_date?: string;
+    location?: R2LocationHint;
+    jurisdiction?: R2Jurisdiction;
+    storage_class?: 'Standard' | 'InfrequentAccess';
+}
+/** A lifecycle rule as the API stores it (nested transitions). */
+export interface R2ApiLifecycleRule {
+    id: string;
+    enabled: boolean;
+    conditions: {
+        prefix: string;
+    };
+    deleteObjectsTransition?: {
+        condition: {
+            type: 'Age';
+            maxAge: number;
+        } | {
+            type: 'Date';
+            date: string;
+        };
+    };
+    abortMultipartUploadsTransition?: {
+        condition: {
+            type: 'Age';
+            maxAge: number;
+        };
+    };
+    storageClassTransitions?: Array<{
+        storageClass: 'InfrequentAccess';
+        condition: {
+            type: 'Age';
+            maxAge: number;
+        } | {
+            type: 'Date';
+            date: string;
+        };
+    }>;
+}
+/** A custom domain attached to a bucket, as the list endpoint returns it. */
+export interface R2CustomDomain {
+    domain: string;
+    enabled: boolean;
+    zoneId?: string;
+    zoneName?: string;
+    minTLS?: R2MinTls;
+    ciphers?: string[];
+    status?: {
+        ownership?: 'pending' | 'active' | 'deactivated' | 'blocked' | 'error' | 'unknown';
+        ssl?: 'initializing' | 'pending' | 'active' | 'deactivated' | 'error' | 'unknown';
+    };
+}
+/** The bucket's `*.r2.dev` URL and whether it serves. */
+export interface R2ManagedDomain {
+    bucketId?: string;
+    domain: string;
+    enabled: boolean;
+}
+export interface R2ProviderOptions {
+    /** Account API token with `Workers R2 Storage: Edit`. */
+    apiToken: string;
+    /** Account the buckets live under. */
+    accountId: string;
+    /** Override `fetch`, for tests. */
+    fetch?: FetchLike;
+}
+/** Options shared by every bucket-scoped call. */
+export interface R2BucketScope {
+    /**
+     * The bucket's jurisdiction. A bucket created in `eu` (or any non-default
+     * jurisdiction) does not exist as far as a request without the matching
+     * header is concerned: it 404s rather than erroring helpfully.
+     */
+    jurisdiction?: R2Jurisdiction;
+}
+/**
+ * Cloudflare R2 bucket management, scoped to one account.
+ */
+export declare class R2Provider {
+    readonly name = "cloudflare-r2";
+    private readonly apiToken;
+    private readonly accountId;
+    private readonly fetchImpl;
+    constructor(options: R2ProviderOptions);
+    /**
+     * Make an authenticated request against the account-scoped R2 API.
+     *
+     * @param method - HTTP method
+     * @param endpoint - Path below `/accounts/{id}/r2`, starting with a slash
+     * @param body - JSON body
+     * @param scope - Jurisdiction header, when the bucket has one
+     * @returns The whole envelope, so list calls can read the cursor
+     * @throws {R2NotEnabledError} When R2 has never been enabled on the account
+     * @throws {R2ApiError} When Cloudflare reports any other failure
+     */
+    private requestEnvelope;
+    private request;
+    /** Path of one bucket, with the name escaped. */
+    private bucketPath;
+    /**
+     * Every bucket in the account (in the default jurisdiction, or in `scope`'s).
+     *
+     * Follows the cursor, so an account with more buckets than one page still
+     * answers completely.
+     */
+    listBuckets(scope?: R2BucketScope): Promise<R2Bucket[]>;
+    /**
+     * Look up a bucket by name.
+     *
+     * @returns The bucket, or `null` when it does not exist
+     */
+    getBucket(name: string, scope?: R2BucketScope): Promise<R2Bucket | null>;
+    /**
+     * Create a bucket, or return the existing one.
+     *
+     * The location hint and jurisdiction only matter at creation: R2 cannot move
+     * a bucket, so an existing bucket is returned as-is even if they differ.
+     *
+     * @returns The bucket, and whether this call is what created it
+     */
+    ensureBucket(name: string, options?: {
+        locationHint?: R2LocationHint;
+        jurisdiction?: R2Jurisdiction;
+    }): Promise<{
+        bucket: R2Bucket;
+        created: boolean;
+    }>;
+    /**
+     * The bucket's CORS rules. A bucket that never had a policy answers with an
+     * error rather than an empty list; that is reported as `[]`.
+     */
+    getCors(bucket: string, scope?: R2BucketScope): Promise<R2CorsRule[]>;
+    /**
+     * Replace the bucket's CORS rules. An empty list deletes the policy, since
+     * that is the only way the API expresses "no CORS".
+     */
+    putCors(bucket: string, rules: R2CorsRule[], scope?: R2BucketScope): Promise<void>;
+    /**
+     * Set CORS only when it differs from what is there.
+     *
+     * @returns Whether anything was written
+     */
+    ensureCors(bucket: string, rules: R2CorsRule[], scope?: R2BucketScope): Promise<boolean>;
+    /** The bucket's lifecycle rules. */
+    getLifecycle(bucket: string, scope?: R2BucketScope): Promise<R2ApiLifecycleRule[]>;
+    /** Replace the bucket's lifecycle rules wholesale. */
+    putLifecycle(bucket: string, rules: R2ApiLifecycleRule[], scope?: R2BucketScope): Promise<void>;
+    /**
+     * Set lifecycle rules only when they differ from what is there.
+     *
+     * @returns Whether anything was written
+     */
+    ensureLifecycle(bucket: string, rules: R2ApiLifecycleRule[], scope?: R2BucketScope): Promise<boolean>;
+    /** Custom domains attached to the bucket. */
+    listCustomDomains(bucket: string, scope?: R2BucketScope): Promise<R2CustomDomain[]>;
+    /**
+     * Attach a custom domain.
+     *
+     * Cloudflare creates the proxied DNS record for the hostname itself, and
+     * refuses when the hostname already has a record: that record has to go
+     * first. This is the raw create; {@link ensureCustomDomain} is the
+     * idempotent form.
+     */
+    attachCustomDomain(bucket: string, options: {
+        domain: string;
+        zoneId: string;
+        enabled?: boolean;
+        minTLS?: R2MinTls;
+    }, scope?: R2BucketScope): Promise<R2CustomDomain>;
+    /** Change an attached domain's `enabled` or `minTLS`. */
+    updateCustomDomain(bucket: string, domain: string, changes: {
+        enabled?: boolean;
+        minTLS?: R2MinTls;
+    }, scope?: R2BucketScope): Promise<R2CustomDomain>;
+    /**
+     * Attach a domain if it is missing, or bring an attached one back to enabled
+     * with the requested minimum TLS.
+     *
+     * @param existing - The bucket's current domains, when the caller already
+     * listed them (saves a request per domain)
+     * @returns What happened, and the domain's state afterwards
+     */
+    ensureCustomDomain(bucket: string, options: {
+        domain: string;
+        zoneId: string;
+        minTLS?: R2MinTls;
+    }, scope?: R2BucketScope, existing?: R2CustomDomain[]): Promise<{
+        action: 'attached' | 'updated' | 'unchanged';
+        domain: R2CustomDomain;
+    }>;
+    /** The bucket's `*.r2.dev` URL and whether it is serving. */
+    getManagedDomain(bucket: string, scope?: R2BucketScope): Promise<R2ManagedDomain>;
+    /**
+     * Turn the bucket's public `*.r2.dev` URL on or off, only writing when it
+     * differs.
+     *
+     * @returns Whether anything was written, and the domain's state afterwards
+     */
+    setManagedDomain(bucket: string, enabled: boolean, scope?: R2BucketScope): Promise<{
+        changed: boolean;
+        domain: R2ManagedDomain;
+    }>;
+}
+/** S3-compatible endpoint for an account's R2 buckets. */
+export declare function r2Endpoint(accountId: string): string;
+export interface R2S3Credentials {
+    accessKeyId: string;
+    secretAccessKey: string;
+    /** `https://{accountId}.r2.cloudflarestorage.com` */
+    endpoint: string;
+    /** R2 ignores the region; SigV4 still needs one, and `auto` is what R2 documents. */
+    region: 'auto';
+}
+/**
+ * Derive S3-compatible credentials from a Cloudflare API token.
+ *
+ * Cloudflare documents this mapping instead of issuing a separate key pair:
+ * the Access Key ID is the token's **id**, and the Secret Access Key is the
+ * SHA-256 of the token's **value**, as lowercase hex. The id is not part of
+ * the token string, so it has to be asked for.
+ *
+ * The token's id is read from the account-scoped verify endpoint first. That
+ * order matters: an account-owned token answers 401 at `/user/tokens/verify`,
+ * which looks exactly like a revoked token. The user endpoint is tried second
+ * so a user-owned token still works.
+ *
+ * The token needs R2 permissions for the derived keys to be any use; that is
+ * not checked here, because the S3 endpoint will say so on first use.
+ *
+ * @throws {Error} When neither verify endpoint accepts the token
+ */
+export declare function r2S3Credentials(options: {
+    apiToken: string;
+    accountId: string;
+    fetch?: FetchLike;
+}): Promise<R2S3Credentials>;
+/**
+ * Do two CORS policies say the same thing?
+ *
+ * Rule order is kept (R2 uses the first rule that matches a request), but the
+ * values inside a rule are compared as sets. Ids are only compared when the
+ * desired side sets them, since the API may assign its own.
+ */
+export declare function sameCorsRules(current: R2CorsRule[], desired: R2CorsRule[]): boolean;
+/** Do two lifecycle rule lists say the same thing? Order-insensitive, keyed by id. */
+export declare function sameLifecycleRules(current: R2ApiLifecycleRule[], desired: R2ApiLifecycleRule[]): boolean;
+export {};

package/dist/r2/provider.test.d.ts

@@ -0,0 +1 @@
+export {};

package/dist/r2/reconcile.d.ts

@@ -0,0 +1,98 @@
+/**
+ * Make the Cloudflare R2 buckets a config declares exist, and look the way it
+ * says.
+ *
+ * Runs on every deploy, so it is a reconcile rather than a create: each step
+ * reads first and writes only what drifted, and a bucket that is already right
+ * costs a handful of GETs and reports no changes. The order per bucket is the
+ * order things depend on each other: the bucket, then the settings that live
+ * on it (CORS, lifecycle, the `r2.dev` URL), then the custom domains, and last
+ * the cache rule that is scoped to those domains' hostnames.
+ *
+ * What is NOT done, deliberately: nothing is ever deleted. A bucket or custom
+ * domain dropped from config is left in place, because removing either loses
+ * data or takes a public URL down, and a config edit should not be able to do
+ * that silently.
+ */
+import type { R2BucketConfig, R2Config, R2LifecycleRule } from '@ts-cloud/core';
+import type { CloudflareRule } from '../dns/cloudflare';
+import type { R2ApiLifecycleRule, R2CustomDomain } from './provider';
+/** What a deploy needs to know about one bucket after the reconcile. */
+export interface R2BucketSummary {
+    /** Bucket name. */
+    name: string;
+    /**
+     * Human-readable changes, e.g. `created`, `cors updated`,
+     * `custom domain tiles.example.com attached`. Empty when already in sync.
+     * In a dry run each entry starts with `would`.
+     */
+    changes: string[];
+    /** Every declared custom domain and its state (`active`, `pending`, ...). */
+    domains: Array<{
+        domain: string;
+        status?: string;
+    }>;
+}
+export interface R2ReconcileSummary {
+    buckets: R2BucketSummary[];
+    /** Problems that did not stop the reconcile: a domain that would not attach, a cache rule the token could not write. */
+    warnings: string[];
+}
+export interface ReconcileR2BucketsOptions {
+    /** Account API token with `Workers R2 Storage: Edit` (plus `Zone: Read` and cache-rule edit for custom domains and `cache`). */
+    apiToken?: string;
+    /** Account the buckets live under. */
+    accountId?: string;
+    /**
+     * Zone id to use for custom domains inside that zone. Domains outside it,
+     * or every domain when this is unset, have their zone looked up by apex.
+     */
+    zoneId?: string;
+    /** Progress lines. */
+    log?: (message: string) => void;
+    /** Read everything, write nothing, and report what would change. */
+    dryRun?: boolean;
+    /** Override `fetch` for the R2 calls, for tests. */
+    fetch?: (input: string, init?: RequestInit) => Promise<Response>;
+}
+/** Anything carrying an `r2` block, at the top level or under `infrastructure`. */
+export interface R2ConfigSource {
+    infrastructure?: {
+        r2?: R2Config;
+    };
+    r2?: R2Config;
+}
+/**
+ * Reconcile every bucket in `config`'s `r2` block.
+ *
+ * Skips cleanly (logs and returns an empty summary) when there is no `r2`
+ * block, and when the token or account id is missing (with a warning, since a
+ * declared bucket that silently never appears is the worst outcome).
+ *
+ * Per-bucket problems that leave the rest of the bucket usable (a domain that
+ * will not attach, a cache rule the token cannot write) become warnings. A
+ * bucket that cannot be created, or any other API failure, throws.
+ *
+ * @throws {R2NotEnabledError} When R2 has never been enabled on the account
+ */
+export declare function reconcileR2Buckets(config: R2ConfigSource, options?: ReconcileR2BucketsOptions): Promise<R2ReconcileSummary>;
+/** `action_parameters` for a `set_cache_settings` rule, or null when nothing is set. */
+export declare function cacheRuleParameters(cache: NonNullable<R2BucketConfig['cache']>): Record<string, unknown> | null;
+/**
+ * Is `rule` already in effect in `existing`, so a PUT would change nothing?
+ *
+ * Not a plain equality check, because of how the managed merge stores rules:
+ * rules with identical behaviour from different projects are folded into one
+ * rule over the union of their hosts. So the rule is in sync when some managed
+ * rule behaves identically and covers all of its hosts, and no OTHER managed
+ * rule still claims any of them (which the merge would strip on write).
+ */
+export declare function managedRuleInSync(existing: CloudflareRule[], rule: CloudflareRule): boolean;
+/** Config lifecycle rule (flat) to the API's nested transition shape. */
+export declare function toApiLifecycleRule(rule: R2LifecycleRule): R2ApiLifecycleRule;
+/**
+ * One status word for a custom domain: `active` once both ownership and the
+ * edge certificate are, the failing state when either has failed, otherwise
+ * `pending`.
+ */
+export declare function domainStatus(domain: R2CustomDomain): string;

package/dist/r2/reconcile.test.d.ts

@@ -0,0 +1 @@
+export {};

package/dist/r2/test-fetch.d.ts

@@ -0,0 +1,32 @@
+/**
+ * A routed fake `fetch` for the R2 tests: no network, every request recorded.
+ *
+ * Routes are keyed `METHOD /path` with the path below `/client/v4` and the
+ * query string dropped. A handler returns the `result` (wrapped in Cloudflare's
+ * success envelope), or a {@link CloudflareFailure} for an error envelope. An
+ * unrouted request fails the test loudly instead of silently answering.
+ */
+export interface RecordedRequest {
+    method: string;
+    path: string;
+    query: URLSearchParams;
+    headers: Record<string, string>;
+    body: any;
+}
+export declare class CloudflareFailure {
+    readonly status: number;
+    readonly errors: Array<{
+        code: number;
+        message: string;
+    }>;
+    constructor(status: number, errors: Array<{
+        code: number;
+        message: string;
+    }>);
+}
+export type RouteHandler = (request: RecordedRequest) => unknown;
+export declare function fakeCloudflare(routes: Record<string, RouteHandler | unknown>): {
+    fetch: (input: string, init?: RequestInit) => Promise<Response>;
+    calls: RecordedRequest[];
+    writes: () => RecordedRequest[];
+};

package/dist/spend/index.js

@@ -1 +1 @@
-import{cA,ro,dA,N,lA,od,bp,no,uA,gA,pA,ad,Ei,io,cd,qt,ft,mA,Fr,fA,dd,Cp,Ep,so,ld,ud,ht,vp,vi,gd,oo,Ur,Tp,Ti,pd,md,wi,wp,fd,hd,Ad,yd,ao,Rp,Dp,hA,Pp,Sd,Ri,Np,kp,co,Qr,lo,uo,go,Id,Bp,bd,po,AA,jt,yA,Cd,Hr,Ed,SA,vd,xp,EA,Vr,Lp,ho,vA,$p,Mp,Fp,TA,Up,Qp,wA,Ao,yo}from"../chunk-qhtgfjhd.js";import"../chunk-tbn385ak.js";import"../chunk-c45ay9fx.js";export{co as AnomalyConfigStore,Up as AwsSpendTransport,Qp as ComputeSpendTransport,so as CounterTracker,dd as DEFAULT_METER_MAPPINGS,ad as DEFAULT_PRICE_BOOK,vp as DEFAULT_THRESHOLDS,Qr as DETECTABLE_SIGNALS,dA as ENFORCEMENT_ACTIONS,wi as ENFORCEMENT_DESCRIPTIONS,N as ENFORCEMENT_SEVERITY,Bp as FOCUS_VERSION,ro as METERS,cA as METER_KEYS,lA as MICRO_CENTS,Tp as MIN_PROJECTION_CONFIDENCE,xp as RecordingSpendTransport,Np as SENSITIVITY_THRESHOLDS,Fp as SPEND_CYCLE_SECONDS,Cd as SPEND_GATE_SETTING,vA as SPEND_LEASE_SETTING,uo as SignalSource,Ed as SpendCapError,Hr as SpendGate,$p as SpendLoopLease,ho as SpendNotificationRouter,Mp as SpendRunner,jt as SpendService,vi as SpendStore,EA as URGENT_SPEND_EVENTS,wp as USER_VISIBLE_ACTIONS,ud as aggregateDeltas,Ri as anomalyOptionsForSignal,SA as assertSpendAllows,ft as budgetWindow,wA as compositeSpendTransport,vd as createEnforcementHandlers,Pp as detectAnomalies,Sd as detectLatestAnomaly,pd as evaluateBudget,hA as ewma,Cp as findMapping,bp as findPriceEntry,Vr as formatCents,Ur as formatTimeToExhaustion,Ti as governingLimitCents,Ao as handleSpendRequest,Fr as hourBucket,fA as hourBucketsBetween,yd as isOperationAllowed,Ei as isValidTimeZone,Id as lookbackHoursForSignal,ao as median,Rp as medianAbsoluteDeviation,md as mergeDecisions,pA as mergePriceBooks,ld as meterTelemetry,go as optionsForSignal,oo as percentOfLimit,fd as planEnforcement,mA as previousBudgetWindow,no as priceUsage,uA as priceUsageLines,gd as projectSpend,Dp as robustZScore,gA as roundCents,kp as routeMatches,hd as runEnforcement,ht as scopeKey,lo as signalDefinition,Lp as spendNotificationText,yo as spendOpenApiPaths,TA as startSpendLoop,AA as streamFocusJsonl,Ad as strongestActiveAction,od as tieredMicroCents,po as toFocusJsonl,bd as toFocusRecords,Ep as usageDeltaKey,qt as utcInstantOfLocal,yA as zeroFill,cd as zoneOffsetMs,io as zonedParts};
+import{lA,io,uA,N,gA,cd,Ep,so,pA,mA,fA,dd,wi,oo,ld,Kt,ft,hA,Hr,AA,ud,vp,Tp,ao,gd,pd,ht,wp,Ri,md,co,Gr,Rp,Di,fd,hd,Pi,Dp,Ad,yd,Sd,Id,lo,Pp,Np,yA,kp,bd,Ni,Bp,xp,uo,Vr,go,po,mo,Cd,Op,Ed,fo,SA,Wt,IA,vd,qr,Td,bA,wd,_p,TA,zr,Mp,yo,wA,Fp,Up,Qp,RA,Hp,Gp,DA,So,Io}from"../chunk-yt6m703r.js";import"../chunk-5n1y5ehd.js";import"../chunk-my61jkg1.js";export{uo as AnomalyConfigStore,Hp as AwsSpendTransport,Gp as ComputeSpendTransport,ao as CounterTracker,ud as DEFAULT_METER_MAPPINGS,dd as DEFAULT_PRICE_BOOK,wp as DEFAULT_THRESHOLDS,Vr as DETECTABLE_SIGNALS,uA as ENFORCEMENT_ACTIONS,Pi as ENFORCEMENT_DESCRIPTIONS,N as ENFORCEMENT_SEVERITY,Op as FOCUS_VERSION,io as METERS,lA as METER_KEYS,gA as MICRO_CENTS,Rp as MIN_PROJECTION_CONFIDENCE,_p as RecordingSpendTransport,Bp as SENSITIVITY_THRESHOLDS,Qp as SPEND_CYCLE_SECONDS,vd as SPEND_GATE_SETTING,wA as SPEND_LEASE_SETTING,po as SignalSource,Td as SpendCapError,qr as SpendGate,Fp as SpendLoopLease,yo as SpendNotificationRouter,Up as SpendRunner,Wt as SpendService,Ri as SpendStore,TA as URGENT_SPEND_EVENTS,Dp as USER_VISIBLE_ACTIONS,pd as aggregateDeltas,Ni as anomalyOptionsForSignal,bA as assertSpendAllows,ft as budgetWindow,DA as compositeSpendTransport,wd as createEnforcementHandlers,kp as detectAnomalies,bd as detectLatestAnomaly,fd as evaluateBudget,yA as ewma,vp as findMapping,Ep as findPriceEntry,zr as formatCents,Gr as formatTimeToExhaustion,Di as governingLimitCents,So as handleSpendRequest,Hr as hourBucket,AA as hourBucketsBetween,Id as isOperationAllowed,wi as isValidTimeZone,Cd as lookbackHoursForSignal,lo as median,Pp as medianAbsoluteDeviation,hd as mergeDecisions,fA as mergePriceBooks,gd as meterTelemetry,mo as optionsForSignal,co as percentOfLimit,Ad as planEnforcement,hA as previousBudgetWindow,so as priceUsage,pA as priceUsageLines,md as projectSpend,Np as robustZScore,mA as roundCents,xp as routeMatches,yd as runEnforcement,ht as scopeKey,go as signalDefinition,Mp as spendNotificationText,Io as spendOpenApiPaths,RA as startSpendLoop,SA as streamFocusJsonl,Sd as strongestActiveAction,cd as tieredMicroCents,fo as toFocusJsonl,Ed as toFocusRecords,Tp as usageDeltaKey,Kt as utcInstantOfLocal,IA as zeroFill,ld as zoneOffsetMs,oo as zonedParts};

package/dist/ui/404.html

@@ -2,7 +2,7 @@
 <html lang="en" data-theme="dark">
 <head>
   <meta charset="UTF-8">
-  <meta name="stx-build" content="muw2rgfkt828iy">
+  <meta name="stx-build" content="muw8matxqv773g">
 
 <!-- stx SEO Tags -->
 <meta name="title" content="Page not found · ts-cloud">

package/dist/ui/accept-invitation.html

@@ -1,4 +1,4 @@
-<!DOCTYPE html><html lang="en" data-theme="dark"><head><meta charset="UTF-8"><meta name="stx-build" content="muw2r2b6hpfy3w"><meta name="title" content="stx Project"><meta name="description" content="A website built with stx templating engine"><meta property="og:title" content="stx Project"><meta property="og:description" content="A website built with stx templating engine"><meta property="og:type" content="website"><meta name="twitter:card" content="summary_large_image"><meta name="twitter:title" content="stx Project"><meta name="twitter:description" content="A website built with stx templating engine"><meta name="viewport" content="width=device-width, initial-scale=1.0"><title>ts-cloud - Accept invitation</title><link rel="icon" type="image/svg+xml" href="data:image/svg+xml,%3Csvg xmlns='http://www.w3.org/2000/svg' viewBox='0 0 32 32'%3E%3Crect x='3' y='3' width='26' height='26' rx='8' fill='%235a8be0'/%3E%3C/svg%3E"><link rel="preconnect" href="https://fonts.googleapis.com"><link href="https://fonts.googleapis.com/css2?family=Inter:wght@400;500;600;700;800&display=swap" rel="stylesheet"><link rel="stylesheet" href="/_stx/style.448ab192.css"><style data-stx-cloak>[x-cloak]{display:none !important}</style><link data-crosswind="generated" rel="stylesheet" href="/_stx/crosswind.616c25f3.css"></head><body class="auth-page"><main class="auth-card" id="main-content"><a class="brand" href="/"><span class="dot"></span><span>ts-cloud</span></a><div><span class="context-label">Organization invitation</span><h1>Join your team</h1><p>Choose the dashboard username and password you will use after this invitation is accepted.</p></div><form id="accept-invitation-form" class="auth-form"><div class="field-block"><label for="invite-name">Name</label><input id="invite-name" name="name" autocomplete="name" placeholder="Chris Breuer"></div><div class="field-block"><label for="invite-username">Username</label><input id="invite-username" name="username" autocomplete="username" minlength="2" maxlength="32" required></div><div class="field-block"><label for="invite-password">Password</label><input id="invite-password" name="password" type="password" autocomplete="new-password" minlength="12" required><small>At least 12 characters.</small></div><button class="btn" type="submit">Accept invitation</button><div id="invitation-status" class="auth-status" role="status"></div></form><p class="note">If this link expired or was already used, ask an organization owner to resend the invitation.</p></main> <script data-stx-scoped data-stx-run="always">
+<!DOCTYPE html><html lang="en" data-theme="dark"><head><meta charset="UTF-8"><meta name="stx-build" content="muw8lwgexgvl1d"><meta name="title" content="stx Project"><meta name="description" content="A website built with stx templating engine"><meta property="og:title" content="stx Project"><meta property="og:description" content="A website built with stx templating engine"><meta property="og:type" content="website"><meta name="twitter:card" content="summary_large_image"><meta name="twitter:title" content="stx Project"><meta name="twitter:description" content="A website built with stx templating engine"><meta name="viewport" content="width=device-width, initial-scale=1.0"><title>ts-cloud - Accept invitation</title><link rel="icon" type="image/svg+xml" href="data:image/svg+xml,%3Csvg xmlns='http://www.w3.org/2000/svg' viewBox='0 0 32 32'%3E%3Crect x='3' y='3' width='26' height='26' rx='8' fill='%235a8be0'/%3E%3C/svg%3E"><link rel="preconnect" href="https://fonts.googleapis.com"><link href="https://fonts.googleapis.com/css2?family=Inter:wght@400;500;600;700;800&display=swap" rel="stylesheet"><link rel="stylesheet" href="/_stx/style.448ab192.css"><style data-stx-cloak>[x-cloak]{display:none !important}</style><link data-crosswind="generated" rel="stylesheet" href="/_stx/crosswind.616c25f3.css"></head><body class="auth-page"><main class="auth-card" id="main-content"><a class="brand" href="/"><span class="dot"></span><span>ts-cloud</span></a><div><span class="context-label">Organization invitation</span><h1>Join your team</h1><p>Choose the dashboard username and password you will use after this invitation is accepted.</p></div><form id="accept-invitation-form" class="auth-form"><div class="field-block"><label for="invite-name">Name</label><input id="invite-name" name="name" autocomplete="name" placeholder="Chris Breuer"></div><div class="field-block"><label for="invite-username">Username</label><input id="invite-username" name="username" autocomplete="username" minlength="2" maxlength="32" required></div><div class="field-block"><label for="invite-password">Password</label><input id="invite-password" name="password" type="password" autocomplete="new-password" minlength="12" required><small>At least 12 characters.</small></div><button class="btn" type="submit">Accept invitation</button><div id="invitation-status" class="auth-status" role="status"></div></form><p class="note">If this link expired or was already used, ask an organization owner to resend the invitation.</p></main> <script data-stx-scoped data-stx-run="always">
 ;(function() {
   'use strict';
 (() => {

package/dist/ui/access-denied.html

@@ -1,4 +1,4 @@
-<!DOCTYPE html><html lang="en" data-theme="dark"><head><meta charset="UTF-8"><meta name="stx-build" content="muw2r2b6hpfy3w"><meta name="title" content="Access unavailable · ts-cloud"><meta name="description" content="A website built with stx templating engine"><meta property="og:title" content="Access unavailable · ts-cloud"><meta property="og:description" content="A website built with stx templating engine"><meta property="og:type" content="website"><meta name="twitter:card" content="summary_large_image"><meta name="twitter:title" content="Access unavailable · ts-cloud"><meta name="twitter:description" content="A website built with stx templating engine"> <script data-stx-runtime src="/_stx/runtime.dbee66d1.js"></script> <meta name="viewport" content="width=device-width, initial-scale=1.0"><title>Access unavailable · ts-cloud</title><link rel="icon" type="image/svg+xml" href="data:image/svg+xml,%3Csvg xmlns='http://www.w3.org/2000/svg' viewBox='0 0 32 32'%3E%3Crect x='3' y='3' width='26' height='26' rx='8' fill='%235a8be0'/%3E%3C/svg%3E"><link rel="preconnect" href="https://fonts.googleapis.com"><link href="https://fonts.googleapis.com/css2?family=Inter:wght@400;500;600;700;800&display=swap" rel="stylesheet"><link rel="stylesheet" href="/_stx/style.448ab192.css"><style data-stx-cloak>[x-cloak]{display:none !important}</style><link data-crosswind="generated" rel="stylesheet" href="/_stx/crosswind.906ee17c.css"></head><body data-stx-auto><a data-stx-scope="stx_scope_nav_50" class="skip-link" href="#main-content">Skip to content</a><button class="nav-toggle-button" type="button" aria-label="Open navigation" aria-controls="primary-navigation" aria-expanded="false"><span></span><span></span><span></span></button><button class="nav-scrim" type="button" aria-label="Close navigation"></button><aside class="app-sidebar" id="primary-navigation" aria-label="Primary navigation"><a class="brand" href="/?env=production"><span class="dot"></span><span>ts-cloud</span></a><div class="sidebar-context"><span class="context-label">Project</span><strong>ts-cloud</strong></div><div class="environment-picker" aria-label="Environment"><span class="context-label">Environment</span><details><summary class="environment-current production"><span>PROD</span><strong>production</strong></summary></details></div><button class="command-trigger" type="button" aria-keyshortcuts="Meta+K Control+K"><span>Search resources</span><kbd>⌘ K</kbd></button><div class="nav-groups"><section class="nav-group"><h2>Overview</h2><a class="" href="/?env=production">Dashboard</a><a href="/server/activity?env=production">Activity</a></section><section class="nav-group"><h2>Applications</h2><a class="" href="/server/sites?env=production">Services</a><a class="" href="/server/deployments?env=production">Deployments</a><a class="" href="/server/logs?env=production">Logs</a><a class="" href="/integrations?env=production">Git integrations</a><a class="" href="/applications/new?env=production">Create application</a><a class="" href="/applications/compose?env=production">Compose applications</a></section><section class="nav-group"><h2>Operations</h2><a class="" href="/operations/queue?env=production">Deployment queue</a><a class="" href="/operations/previews?env=production">Preview environments</a><a class="" href="/operations/releases?env=production">Releases & promotion</a><a class="" href="/operations/regions?env=production">Regions & failover</a><a class="" href="/operations/maintenance?env=production">Maintenance & DR</a><a class="" href="/operations/workloads?env=production">Workloads</a><a class="" href="/operations/observability?env=production">Observability</a><a class="" href="/operations/alerts?env=production">Alerts & health</a><a class="" href="/operations/spend?env=production">Spend & budgets</a><a href="/server/metrics?env=production">Metrics</a><a href="/server/services?env=production">Runtime services</a><a class="" href="/operations/jobs?env=production">Workers & schedules</a><a class="" href="/operations/configuration?env=production">Environment &amp; secrets</a><a class="" href="/data/backups?env=production">Backups &amp; recovery</a><a class="" href="/data/volumes?env=production">Persistent volumes</a><a href="/server/actions?env=production">Run operations</a></section><section class="nav-group"><h2>Infrastructure</h2><a class="" href="/infrastructure/topology?env=production">Infrastructure map</a><a class="" href="/data/services?env=production">Data services</a><a class="" href="/data/volumes?env=production">Persistent volumes</a><a href="/server/firewall?env=production">Network & firewall</a><a href="/server/ssh-keys?env=production">SSH keys</a><a class="" href="/server/fleet?env=production">Fleet inventory</a><a class="" href="/server/capacity?env=production">Capacity & placement</a><a href="/security?env=production">Security posture</a><a href="/server/terminal?env=production">Terminal</a></section><section class="nav-group"><h2>Organization</h2><a class="" href="/server/team?env=production">People & access</a><a class="" href="/account/automation?env=production">API & automation</a></section><section class="nav-group"><h2>Account</h2><a class="" href="/account/security?env=production">Sign-in & security</a></section></div><form method="post" action="/api/logout" class="signout"><button type="submit">Sign out</button></form></aside><dialog class="command-palette" aria-labelledby="command-title"><div class="command-search"><span aria-hidden="true">⌕</span><input type="search" placeholder="Search services, domains, deployments…" aria-label="Search resources" autocomplete="off"><button type="button" class="command-close" aria-label="Close search">Esc</button></div><h2 id="command-title" class="sr-only">Search resources and navigation</h2><div class="command-status" role="status">Start typing to search this project.</div><section class="saved-views" aria-labelledby="saved-views-title"><div class="saved-views-heading"><h3 id="saved-views-title">Saved views</h3><form class="save-view-form"><label class="sr-only" for="save-view-name">Saved view name</label><input id="save-view-name" maxlength="64" placeholder="Name this view" autocomplete="off"><button type="submit">Save current filters</button></form></div><div class="saved-view-list"></div></section><form class="tag-result-form"><label for="tag-result-name">Tag selected resource</label><input id="tag-result-name" maxlength="32" placeholder="customer-facing" pattern="[A-Za-z0-9][A-Za-z0-9 -]{0,31}" autocomplete="off"><input class="tag-color" type="color" value="#5a8be0" aria-label="Tag color"><button type="submit">Add tag</button></form><div class="command-results" role="listbox" aria-label="Search results"></div><footer><span>↑ ↓ navigate</span><span>Enter open</span><span>Esc close</span></footer></dialog><div class="context-bar" aria-label="Current scope"><div class="context-path"><div class="context-breadcrumb"><span>ts-cloud</span><i>/</i><strong>production</strong></div><div class="context-filters" aria-label="Active filters"></div></div><span class="scope-safety production">Production scope</span></div> <script data-stx-scoped data-stx-run="always">
+<!DOCTYPE html><html lang="en" data-theme="dark"><head><meta charset="UTF-8"><meta name="stx-build" content="muw8lwgexgvl1d"><meta name="title" content="Access unavailable · ts-cloud"><meta name="description" content="A website built with stx templating engine"><meta property="og:title" content="Access unavailable · ts-cloud"><meta property="og:description" content="A website built with stx templating engine"><meta property="og:type" content="website"><meta name="twitter:card" content="summary_large_image"><meta name="twitter:title" content="Access unavailable · ts-cloud"><meta name="twitter:description" content="A website built with stx templating engine"> <script data-stx-runtime src="/_stx/runtime.dbee66d1.js"></script> <meta name="viewport" content="width=device-width, initial-scale=1.0"><title>Access unavailable · ts-cloud</title><link rel="icon" type="image/svg+xml" href="data:image/svg+xml,%3Csvg xmlns='http://www.w3.org/2000/svg' viewBox='0 0 32 32'%3E%3Crect x='3' y='3' width='26' height='26' rx='8' fill='%235a8be0'/%3E%3C/svg%3E"><link rel="preconnect" href="https://fonts.googleapis.com"><link href="https://fonts.googleapis.com/css2?family=Inter:wght@400;500;600;700;800&display=swap" rel="stylesheet"><link rel="stylesheet" href="/_stx/style.448ab192.css"><style data-stx-cloak>[x-cloak]{display:none !important}</style><link data-crosswind="generated" rel="stylesheet" href="/_stx/crosswind.906ee17c.css"></head><body data-stx-auto><a data-stx-scope="stx_scope_nav_50" class="skip-link" href="#main-content">Skip to content</a><button class="nav-toggle-button" type="button" aria-label="Open navigation" aria-controls="primary-navigation" aria-expanded="false"><span></span><span></span><span></span></button><button class="nav-scrim" type="button" aria-label="Close navigation"></button><aside class="app-sidebar" id="primary-navigation" aria-label="Primary navigation"><a class="brand" href="/?env=production"><span class="dot"></span><span>ts-cloud</span></a><div class="sidebar-context"><span class="context-label">Project</span><strong>ts-cloud</strong></div><div class="environment-picker" aria-label="Environment"><span class="context-label">Environment</span><details><summary class="environment-current production"><span>PROD</span><strong>production</strong></summary></details></div><button class="command-trigger" type="button" aria-keyshortcuts="Meta+K Control+K"><span>Search resources</span><kbd>⌘ K</kbd></button><div class="nav-groups"><section class="nav-group"><h2>Overview</h2><a class="" href="/?env=production">Dashboard</a><a href="/server/activity?env=production">Activity</a></section><section class="nav-group"><h2>Applications</h2><a class="" href="/server/sites?env=production">Services</a><a class="" href="/server/deployments?env=production">Deployments</a><a class="" href="/server/logs?env=production">Logs</a><a class="" href="/integrations?env=production">Git integrations</a><a class="" href="/applications/new?env=production">Create application</a><a class="" href="/applications/compose?env=production">Compose applications</a></section><section class="nav-group"><h2>Operations</h2><a class="" href="/operations/queue?env=production">Deployment queue</a><a class="" href="/operations/previews?env=production">Preview environments</a><a class="" href="/operations/releases?env=production">Releases & promotion</a><a class="" href="/operations/regions?env=production">Regions & failover</a><a class="" href="/operations/maintenance?env=production">Maintenance & DR</a><a class="" href="/operations/workloads?env=production">Workloads</a><a class="" href="/operations/observability?env=production">Observability</a><a class="" href="/operations/alerts?env=production">Alerts & health</a><a class="" href="/operations/spend?env=production">Spend & budgets</a><a href="/server/metrics?env=production">Metrics</a><a href="/server/services?env=production">Runtime services</a><a class="" href="/operations/jobs?env=production">Workers & schedules</a><a class="" href="/operations/configuration?env=production">Environment &amp; secrets</a><a class="" href="/data/backups?env=production">Backups &amp; recovery</a><a class="" href="/data/volumes?env=production">Persistent volumes</a><a href="/server/actions?env=production">Run operations</a></section><section class="nav-group"><h2>Infrastructure</h2><a class="" href="/infrastructure/topology?env=production">Infrastructure map</a><a class="" href="/data/services?env=production">Data services</a><a class="" href="/data/volumes?env=production">Persistent volumes</a><a href="/server/firewall?env=production">Network & firewall</a><a href="/server/ssh-keys?env=production">SSH keys</a><a class="" href="/server/fleet?env=production">Fleet inventory</a><a class="" href="/server/capacity?env=production">Capacity & placement</a><a href="/security?env=production">Security posture</a><a href="/server/terminal?env=production">Terminal</a></section><section class="nav-group"><h2>Organization</h2><a class="" href="/server/team?env=production">People & access</a><a class="" href="/account/automation?env=production">API & automation</a></section><section class="nav-group"><h2>Account</h2><a class="" href="/account/security?env=production">Sign-in & security</a></section></div><form method="post" action="/api/logout" class="signout"><button type="submit">Sign out</button></form></aside><dialog class="command-palette" aria-labelledby="command-title"><div class="command-search"><span aria-hidden="true">⌕</span><input type="search" placeholder="Search services, domains, deployments…" aria-label="Search resources" autocomplete="off"><button type="button" class="command-close" aria-label="Close search">Esc</button></div><h2 id="command-title" class="sr-only">Search resources and navigation</h2><div class="command-status" role="status">Start typing to search this project.</div><section class="saved-views" aria-labelledby="saved-views-title"><div class="saved-views-heading"><h3 id="saved-views-title">Saved views</h3><form class="save-view-form"><label class="sr-only" for="save-view-name">Saved view name</label><input id="save-view-name" maxlength="64" placeholder="Name this view" autocomplete="off"><button type="submit">Save current filters</button></form></div><div class="saved-view-list"></div></section><form class="tag-result-form"><label for="tag-result-name">Tag selected resource</label><input id="tag-result-name" maxlength="32" placeholder="customer-facing" pattern="[A-Za-z0-9][A-Za-z0-9 -]{0,31}" autocomplete="off"><input class="tag-color" type="color" value="#5a8be0" aria-label="Tag color"><button type="submit">Add tag</button></form><div class="command-results" role="listbox" aria-label="Search results"></div><footer><span>↑ ↓ navigate</span><span>Enter open</span><span>Esc close</span></footer></dialog><div class="context-bar" aria-label="Current scope"><div class="context-path"><div class="context-breadcrumb"><span>ts-cloud</span><i>/</i><strong>production</strong></div><div class="context-filters" aria-label="Active filters"></div></div><span class="scope-safety production">Production scope</span></div> <script data-stx-scoped data-stx-run="always">
 (function() {
   var { batch, computed, configureFetch, defineEmits, defineExpose, definePageMeta, defineProps, defineSlots, defineStore, derived, effect, goBack, goForward, inject, invalidateRoute, isDerived, isSignal, navigate, nextTick, onBeforeMount, onBeforeUnmount, onDestroy, onMount, onMounted, onUnmounted, peek, provide, reactive, ref, refresh, registerStoresClient, setRouteParams, state, untrack, useAsync, useClickOutside, useColorMode, useCookie, useCounter, useDark, useDebounce, useDebouncedValue, useEventListener, useFetch, useFocus, useHead, useId, useInterval, useLocalStorage, useMediaQuery, useMutation, useOptimistic, usePreferredContrast, usePreferredDark, usePreferredLight, usePreferredReducedMotion, useQuery, useReactiveProp, useRef, useRoute, useRouteParam, useRouteParams, useScrollLock, useSearchParams, useSeoMeta, useSessionStorage, useSlots, useStore, useThrottle, useTimeout, useToggle, useWebSocket, watch, watchEffect, watchMultiple, withDefaults } = window.stx;
   var __destroyHooks = [];