@stacksjs/ts-cloud 0.16.56 → 0.16.58

package/dist/deploy/index.js

@@ -1 +1 @@
-import{wn,Rn,Ku,ys,Wu,Ju,Xu,za,Yu,Zu,dh,eg,E,tg,Ss,Me,rg,ng,$S,ig,sg,og,ag,cg,lh,MS,FS,US,uh,gh,QS,HS,ph,mh,GS,Is,Ar,Ka,Dn,Pn,yr,ct,Lt,bs,fh,kn,dg,lg,Wa,Es,Bn,vs,dc}from"../chunk-86d69jp3.js";import{lc,xn,On,Ts,ws,Rs,Ds,uc,gc}from"../chunk-94z7s8ky.js";import{pc}from"../chunk-hybz2q8w.js";import"../chunk-nhsefr22.js";import"../chunk-qyr5hn6v.js";import"../chunk-stc3ykm3.js";import"../chunk-vgtqd3sb.js";import"../chunk-mp2y4t6w.js";import"../chunk-smt4t6rc.js";import"../chunk-y7k5872m.js";import{Dg,kc,Pg,De,Nc,Wn,kg,Bc,rd,no,nd,Jt,vi,io}from"../chunk-acxmtx6c.js";import"../chunk-yt8qgn5d.js";import"../chunk-80bgb48v.js";import"../chunk-d245va6b.js";import"../chunk-jyvnfny6.js";import"../chunk-e42gpavb.js";import{It,AA,md,ki,Ni,Bi,Mp}from"../chunk-apj1eqcy.js";import{U,Vr,qr,fd,po,d,yA,Fp,Up,CI,EI}from"../chunk-2hma3g5q.js";import"../chunk-430acqjk.js";import"../chunk-zvcd6x45.js";import"../chunk-a99wz633.js";export{AA as DEFAULT_SITE_PORT_RANGE,It as HOST_SITES_DIR,Nc as IPV6_EXCLUDED_HOST_LABELS,rd as MANAGEMENT_DASHBOARD_SITE,wn as addSiteToCloudConfig,Mp as allocateSitePorts,GS as buildAndPushContainerImage,pc as buildAndPushServerlessImage,Ar as buildFunctionEnv,Ni as buildHostSitePortsScript,io as buildManagementDashboardArtifact,Lt as buildServerTopology,bs as buildServerlessTopology,fh as buildTopology,Wa as collectEgressMetrics,Dg as collectServerDnsDomains,mh as createContainerImageDependencies,uh as createExistingStaticFullStackDependencies,lh as createStaticApiOriginDependencies,Bn as dashboardActions,no as dashboardCredentialsFile,rg as dashboardPageRoutes,ag as deleteFailoverReplicaBuckets,uc as deleteStaticSite,QS as deployExistingStaticFullStack,Ka as deployServerlessApp,EI as deployShipsFiles,cg as deploySite,MS as deployStaticApiOrigin,ws as deployStaticSite,gc as deployStaticSiteFull,xn as deployStaticSiteWithExternalDns,On as deployStaticSiteWithExternalDnsFull,dg as egressReportMetrics,E as ensureDashboardActor,ig as ensureFailoverReplicaBuckets,vi as ensureManagementDashboard,HS as estimateExistingStaticFullStackMonthlyCost,US as estimateStaticApiOriginMonthlyCost,lg as fetchEgressReport,gh as generateExistingStaticFullStackTemplate,lc as generateExternalDnsStaticSiteTemplate,Ts as generateStaticSiteTemplate,sg as grantFailoverReplicaAccess,yA as hasComputeConfigured,fd as hasProxyUpstream,ph as hashContainerContext,Wn as hostAcceptsIpv6,Is as infraEnvFromOutputs,tg as initializeDashboardControlPlane,Ds as invalidateCache,Vr as isPhpSite,za as isValidHostname,De as normalizePublicIpv6,ki as occupiedHostPorts,Bi as parseHostSiteFragments,md as parseUpstreamPort,kg as reconcileAddressRecords,Dn as redeployServerlessApp,Pg as removeAddressRecords,Rn as removeSiteFromCloudConfig,kc as removeStaleServerAddressRecords,Yu as renderAliasesValue,Xu as renderEnvValue,Zu as renderRedirectsValue,dh as renderSiteSnippet,Wu as renderSslValue,Ju as renderStringValue,vs as resolveDashboardAction,nd as resolveDashboardAuth,kn as resolveDashboardData,ng as resolveLegacyDashboardRoute,qr as resolveProxyUpstreams,po as resolveSiteDeployTarget,d as resolveSiteKind,Jt as resolveUiSource,Pn as rollbackServerlessApp,$S as routesForDashboard,ct as runRemoteCommand,Es as sanitizeCloudConfig,og as seedFailoverReplicas,eg as setAttachToInCloudConfig,yr as setMaintenance,ys as setSitePropertyInCloudConfig,Up as shipsARelease,CI as shipsToBucket,U as siteInstallBase,dc as startLocalDashboardServer,Ss as synchronizeDashboardUsers,Me as trackDashboardOperation,Ku as updateSiteInCloudConfig,Rs as uploadStaticFiles,Fp as validateDeploymentConfig,Bc as verifyAddressRecord,FS as verifyStaticApiOrigin};
+import{wn,Rn,Ku,ys,Wu,Ju,Xu,za,Yu,Zu,dh,eg,E,tg,Ss,Me,rg,ng,$S,ig,sg,og,ag,cg,lh,MS,FS,US,uh,gh,QS,HS,ph,mh,GS,Is,Ar,Ka,Dn,Pn,yr,ct,Lt,bs,fh,kn,dg,lg,Wa,Es,Bn,vs,dc}from"../chunk-4f0b21fp.js";import{lc,xn,On,Ts,ws,Rs,Ds,uc,gc}from"../chunk-94z7s8ky.js";import{pc}from"../chunk-hybz2q8w.js";import"../chunk-nhsefr22.js";import"../chunk-qyr5hn6v.js";import"../chunk-stc3ykm3.js";import"../chunk-vgtqd3sb.js";import"../chunk-mp2y4t6w.js";import"../chunk-smt4t6rc.js";import"../chunk-y7k5872m.js";import{Dg,kc,Pg,De,Nc,Wn,kg,Bc,rd,no,nd,Jt,vi,io}from"../chunk-y2dej583.js";import"../chunk-yt8qgn5d.js";import"../chunk-80bgb48v.js";import"../chunk-d245va6b.js";import"../chunk-jyvnfny6.js";import"../chunk-e42gpavb.js";import{It,AA,md,ki,Ni,Bi,Mp}from"../chunk-apj1eqcy.js";import{U,Vr,qr,fd,po,d,yA,Fp,Up,CI,EI}from"../chunk-2hma3g5q.js";import"../chunk-430acqjk.js";import"../chunk-zvcd6x45.js";import"../chunk-a99wz633.js";export{AA as DEFAULT_SITE_PORT_RANGE,It as HOST_SITES_DIR,Nc as IPV6_EXCLUDED_HOST_LABELS,rd as MANAGEMENT_DASHBOARD_SITE,wn as addSiteToCloudConfig,Mp as allocateSitePorts,GS as buildAndPushContainerImage,pc as buildAndPushServerlessImage,Ar as buildFunctionEnv,Ni as buildHostSitePortsScript,io as buildManagementDashboardArtifact,Lt as buildServerTopology,bs as buildServerlessTopology,fh as buildTopology,Wa as collectEgressMetrics,Dg as collectServerDnsDomains,mh as createContainerImageDependencies,uh as createExistingStaticFullStackDependencies,lh as createStaticApiOriginDependencies,Bn as dashboardActions,no as dashboardCredentialsFile,rg as dashboardPageRoutes,ag as deleteFailoverReplicaBuckets,uc as deleteStaticSite,QS as deployExistingStaticFullStack,Ka as deployServerlessApp,EI as deployShipsFiles,cg as deploySite,MS as deployStaticApiOrigin,ws as deployStaticSite,gc as deployStaticSiteFull,xn as deployStaticSiteWithExternalDns,On as deployStaticSiteWithExternalDnsFull,dg as egressReportMetrics,E as ensureDashboardActor,ig as ensureFailoverReplicaBuckets,vi as ensureManagementDashboard,HS as estimateExistingStaticFullStackMonthlyCost,US as estimateStaticApiOriginMonthlyCost,lg as fetchEgressReport,gh as generateExistingStaticFullStackTemplate,lc as generateExternalDnsStaticSiteTemplate,Ts as generateStaticSiteTemplate,sg as grantFailoverReplicaAccess,yA as hasComputeConfigured,fd as hasProxyUpstream,ph as hashContainerContext,Wn as hostAcceptsIpv6,Is as infraEnvFromOutputs,tg as initializeDashboardControlPlane,Ds as invalidateCache,Vr as isPhpSite,za as isValidHostname,De as normalizePublicIpv6,ki as occupiedHostPorts,Bi as parseHostSiteFragments,md as parseUpstreamPort,kg as reconcileAddressRecords,Dn as redeployServerlessApp,Pg as removeAddressRecords,Rn as removeSiteFromCloudConfig,kc as removeStaleServerAddressRecords,Yu as renderAliasesValue,Xu as renderEnvValue,Zu as renderRedirectsValue,dh as renderSiteSnippet,Wu as renderSslValue,Ju as renderStringValue,vs as resolveDashboardAction,nd as resolveDashboardAuth,kn as resolveDashboardData,ng as resolveLegacyDashboardRoute,qr as resolveProxyUpstreams,po as resolveSiteDeployTarget,d as resolveSiteKind,Jt as resolveUiSource,Pn as rollbackServerlessApp,$S as routesForDashboard,ct as runRemoteCommand,Es as sanitizeCloudConfig,og as seedFailoverReplicas,eg as setAttachToInCloudConfig,yr as setMaintenance,ys as setSitePropertyInCloudConfig,Up as shipsARelease,CI as shipsToBucket,U as siteInstallBase,dc as startLocalDashboardServer,Ss as synchronizeDashboardUsers,Me as trackDashboardOperation,Ku as updateSiteInCloudConfig,Rs as uploadStaticFiles,Fp as validateDeploymentConfig,Bc as verifyAddressRecord,FS as verifyStaticApiOrigin};

package/dist/drivers/index.js

@@ -1 +1 @@
-import{Jn,jt,Pr,zt,Xn,M,Br,Yn,Zn,xr,Or,Bh,xh,Lg,$g,Oh,_h,Lh,_r,ei,Mg,Ys,ti,ri,ni,ii,si,xc,Oc,oi,Lr,Se,_c,ai,Lc,ci,$c,$r,Fc,Ve,se,Zs,Fg,Uc,Qc,Hc,Gc,Vc,mt,qe,je,ft,di,li,Pe,eo,qc,Ug,Qg,jc,Hg,ht,ui,zc,Gg,Vg,Kc,Mr,ke,Wc,qg,jg,to,gi,At,zg,Kg,Wg,Jg,Xg,Yg,Zg,ep,tp,pi,mi,fi,hi,Ai,yi,Si,rp,np,Fr,F,ro,ip,sp,op,Jc,ap,cp,$h,Mh,Fh,Xc,dp,Uh,Qh,Hh,Ii,bi,Ci,Ei,Yc,Zc,ed,td,Gh,so,id,Ti,sd,lp,up,gp,Vh}from"../chunk-acxmtx6c.js";import{ao,lo,uo,qh,cd,B,Xt,bI,go,hp,ze,G,Ne}from"../chunk-yt8qgn5d.js";import"../chunk-80bgb48v.js";import"../chunk-d245va6b.js";import"../chunk-jyvnfny6.js";import"../chunk-e42gpavb.js";import"../chunk-2hma3g5q.js";import"../chunk-zvcd6x45.js";import"../chunk-a99wz633.js";export{td as AwsBoxProvisioner,Br as AwsDriver,op as BOOT_PARTITION_LABEL,ro as CloudDriverFactory,$g as DEFAULT_HOST_CLEANUP_ESCALATED,_h as DEFAULT_HOST_CLEANUP_HIGH_WATER_PERCENT,Oh as DEFAULT_HOST_CLEANUP_LOW_WATER_PERCENT,Lg as DEFAULT_HOST_CLEANUP_RETENTION,Lh as DEFAULT_HOST_CLEANUP_SCHEDULE,ao as DEFAULT_RPX_CERTS_DIR,sp as FIRST_BOOT_SCRIPT_PATH,Or as HOST_ARTIFACT_CACHE_DIR,Bh as HOST_CLEANUP_SCRIPT_PATH,xh as HOST_CLEANUP_UNIT,ed as HetznerBoxProvisioner,$r as HetznerClient,Pe as HetznerDriver,Vc as LEGACY_DRIVER_STATE_DIR,eo as LocalBoxDriver,up as MANAGED_CACHE_POLICY_DISABLED,lp as MANAGED_CACHE_POLICY_OPTIMIZED,gp as MANAGED_ORIGIN_REQUEST_POLICY_ALL_VIEWER,jg as RASPBERRY_PI_DEFAULT_SWAP_GB,$c as REMOTE_SCRIPT_RUNNER,go as RPX_DIR,hp as RPX_LAUNCHER_PATH,ze as RPX_SERVICE_NAME,Wc as SSH_BOOTSTRAP_MARKER_DIR,ke as SSH_BOOTSTRAP_VERSION,At as SSH_DEFAULTS,Si as SSH_DEPLOY_STORAGE_PATH,Ug as SSH_INSECURE_HOST_KEY_OPTS,Qg as SSH_KEEPALIVE_OPTS,mi as SSH_PREFLIGHT_SCRIPT,rp as SSH_SKIP_BOOTSTRAP_ENV,Fr as SshDriver,Mr as SystemSshTransport,Yc as UBUNTU_2404_AMI_PARAM,Hh as acquireResizeLock,$h as applyHetznerHostOptimization,li as applyHetznerVolumes,to as assertArchSupported,np as assertSshComputeConfig,xc as buildAwsArtifactFetch,Zc as buildBoxUserData,Vh as buildCloudFrontOriginConfig,Jc as buildCloudInitFirstBoot,Zn as buildComputeStorageInstallScript,xr as buildComputeStorageSiteScript,cp as buildHetznerHostOptimizationScript,ti as buildHostCleanupDeployScript,Mg as buildHostCleanupExecutable,Ys as buildHostCleanupInstallScript,ei as buildHostCleanupScript,Oc as buildLocalArtifactFetch,B as buildRpxConfig,Ne as buildRpxFragmentRefreshScript,Xt as buildRpxLbConfig,G as buildRpxProvisionScript,Hg as buildScpArgsFor,ni as buildSiteDeployScript,oi as buildSshArgs,jc as buildSshArgsFor,gi as buildSshBootstrapScript,ii as buildStaticSiteDeployScript,ip as cloudDrivers,Mh as collectHetznerHostOptimizationReport,Qc as collectHetznerResizeManifest,Gh as createBoxProvisioner,F as createCloudDriver,id as deployAllComputeSites,so as deploySiteRelease,cd as deriveRouteId,Jn as describeScriptSyntaxError,mt as driverStateDir,qe as driverStatePath,bi as ensureFirewall,Ci as ensureServer,Ii as ensureSshKey,hi as evaluatePreflight,Uc as executeHetznerServerResize,Vg as findKnownHostKey,yi as formatPreflightFindings,jt as formatSshFailure,uo as gatewayHostnames,M as generateUbuntuAppCloudInit,lo as hasAutoWwwVariant,qc as isBoxMode,Fg as isHetznerCapacityError,Xn as isLocalDatabase,Gg as knownHostsLine,zc as knownHostsToken,qh as normalizeRoutePath,Ve as normalizeSshPublicKey,fi as parsePreflightFacts,Zs as planHetznerServerResize,di as planHetznerVolumes,Ai as preflightFailed,Hc as prepareHetznerResize,je as readDriverState,Uh as readResizeCheckpoint,si as releaseTarballTmpPath,Ti as reloadRpxGateway,ci as remoteScriptRunner,bI as renderRpxLauncher,sd as renewRpxCertificates,Xc as resizeCheckpointPath,dp as resizeLockPath,Yn as resolveComputeVolumes,ri as resolveExecStart,Fc as resolveHetznerApiToken,ap as resolveHetznerHostOptimizationPlan,_r as resolveHostCleanupConfig,Xg as resolveSshHostKeyPolicy,zg as resolveSshHosts,tp as resolveSshLan,Wg as resolveSshPort,Jg as resolveSshPrivateKeyPath,Zg as resolveSshProfile,ep as resolveSshPublicIp,pi as resolveSshSettings,Yg as resolveSshSudo,Kg as resolveSshUser,ui as scanHostKey,_c as scpUpload,Ei as serverPublicIpv4,qg as sshBootstrapMarkerPath,Lr as sshExec,Se as sshExecOrThrow,ht as sshHostKeyFingerprint,Kc as sshKnownHostsPath,zt as summarizeRemoteFailures,Pr as surfaceRemoteNotices,Fh as verifyHetznerHostOptimization,Gc as verifyHetznerResize,Lc as waitForCloudInit,ai as waitForSsh,se as wrapCloudInitUserData,ft as writeDriverState,Qh as writeResizeCheckpoint};
+import{Jn,jt,Pr,zt,Xn,M,Br,Yn,Zn,xr,Or,Bh,xh,Lg,$g,Oh,_h,Lh,_r,ei,Mg,Ys,ti,ri,ni,ii,si,xc,Oc,oi,Lr,Se,_c,ai,Lc,ci,$c,$r,Fc,Ve,se,Zs,Fg,Uc,Qc,Hc,Gc,Vc,mt,qe,je,ft,di,li,Pe,eo,qc,Ug,Qg,jc,Hg,ht,ui,zc,Gg,Vg,Kc,Mr,ke,Wc,qg,jg,to,gi,At,zg,Kg,Wg,Jg,Xg,Yg,Zg,ep,tp,pi,mi,fi,hi,Ai,yi,Si,rp,np,Fr,F,ro,ip,sp,op,Jc,ap,cp,$h,Mh,Fh,Xc,dp,Uh,Qh,Hh,Ii,bi,Ci,Ei,Yc,Zc,ed,td,Gh,so,id,Ti,sd,lp,up,gp,Vh}from"../chunk-y2dej583.js";import{ao,lo,uo,qh,cd,B,Xt,bI,go,hp,ze,G,Ne}from"../chunk-yt8qgn5d.js";import"../chunk-80bgb48v.js";import"../chunk-d245va6b.js";import"../chunk-jyvnfny6.js";import"../chunk-e42gpavb.js";import"../chunk-2hma3g5q.js";import"../chunk-zvcd6x45.js";import"../chunk-a99wz633.js";export{td as AwsBoxProvisioner,Br as AwsDriver,op as BOOT_PARTITION_LABEL,ro as CloudDriverFactory,$g as DEFAULT_HOST_CLEANUP_ESCALATED,_h as DEFAULT_HOST_CLEANUP_HIGH_WATER_PERCENT,Oh as DEFAULT_HOST_CLEANUP_LOW_WATER_PERCENT,Lg as DEFAULT_HOST_CLEANUP_RETENTION,Lh as DEFAULT_HOST_CLEANUP_SCHEDULE,ao as DEFAULT_RPX_CERTS_DIR,sp as FIRST_BOOT_SCRIPT_PATH,Or as HOST_ARTIFACT_CACHE_DIR,Bh as HOST_CLEANUP_SCRIPT_PATH,xh as HOST_CLEANUP_UNIT,ed as HetznerBoxProvisioner,$r as HetznerClient,Pe as HetznerDriver,Vc as LEGACY_DRIVER_STATE_DIR,eo as LocalBoxDriver,up as MANAGED_CACHE_POLICY_DISABLED,lp as MANAGED_CACHE_POLICY_OPTIMIZED,gp as MANAGED_ORIGIN_REQUEST_POLICY_ALL_VIEWER,jg as RASPBERRY_PI_DEFAULT_SWAP_GB,$c as REMOTE_SCRIPT_RUNNER,go as RPX_DIR,hp as RPX_LAUNCHER_PATH,ze as RPX_SERVICE_NAME,Wc as SSH_BOOTSTRAP_MARKER_DIR,ke as SSH_BOOTSTRAP_VERSION,At as SSH_DEFAULTS,Si as SSH_DEPLOY_STORAGE_PATH,Ug as SSH_INSECURE_HOST_KEY_OPTS,Qg as SSH_KEEPALIVE_OPTS,mi as SSH_PREFLIGHT_SCRIPT,rp as SSH_SKIP_BOOTSTRAP_ENV,Fr as SshDriver,Mr as SystemSshTransport,Yc as UBUNTU_2404_AMI_PARAM,Hh as acquireResizeLock,$h as applyHetznerHostOptimization,li as applyHetznerVolumes,to as assertArchSupported,np as assertSshComputeConfig,xc as buildAwsArtifactFetch,Zc as buildBoxUserData,Vh as buildCloudFrontOriginConfig,Jc as buildCloudInitFirstBoot,Zn as buildComputeStorageInstallScript,xr as buildComputeStorageSiteScript,cp as buildHetznerHostOptimizationScript,ti as buildHostCleanupDeployScript,Mg as buildHostCleanupExecutable,Ys as buildHostCleanupInstallScript,ei as buildHostCleanupScript,Oc as buildLocalArtifactFetch,B as buildRpxConfig,Ne as buildRpxFragmentRefreshScript,Xt as buildRpxLbConfig,G as buildRpxProvisionScript,Hg as buildScpArgsFor,ni as buildSiteDeployScript,oi as buildSshArgs,jc as buildSshArgsFor,gi as buildSshBootstrapScript,ii as buildStaticSiteDeployScript,ip as cloudDrivers,Mh as collectHetznerHostOptimizationReport,Qc as collectHetznerResizeManifest,Gh as createBoxProvisioner,F as createCloudDriver,id as deployAllComputeSites,so as deploySiteRelease,cd as deriveRouteId,Jn as describeScriptSyntaxError,mt as driverStateDir,qe as driverStatePath,bi as ensureFirewall,Ci as ensureServer,Ii as ensureSshKey,hi as evaluatePreflight,Uc as executeHetznerServerResize,Vg as findKnownHostKey,yi as formatPreflightFindings,jt as formatSshFailure,uo as gatewayHostnames,M as generateUbuntuAppCloudInit,lo as hasAutoWwwVariant,qc as isBoxMode,Fg as isHetznerCapacityError,Xn as isLocalDatabase,Gg as knownHostsLine,zc as knownHostsToken,qh as normalizeRoutePath,Ve as normalizeSshPublicKey,fi as parsePreflightFacts,Zs as planHetznerServerResize,di as planHetznerVolumes,Ai as preflightFailed,Hc as prepareHetznerResize,je as readDriverState,Uh as readResizeCheckpoint,si as releaseTarballTmpPath,Ti as reloadRpxGateway,ci as remoteScriptRunner,bI as renderRpxLauncher,sd as renewRpxCertificates,Xc as resizeCheckpointPath,dp as resizeLockPath,Yn as resolveComputeVolumes,ri as resolveExecStart,Fc as resolveHetznerApiToken,ap as resolveHetznerHostOptimizationPlan,_r as resolveHostCleanupConfig,Xg as resolveSshHostKeyPolicy,zg as resolveSshHosts,tp as resolveSshLan,Wg as resolveSshPort,Jg as resolveSshPrivateKeyPath,Zg as resolveSshProfile,ep as resolveSshPublicIp,pi as resolveSshSettings,Yg as resolveSshSudo,Kg as resolveSshUser,ui as scanHostKey,_c as scpUpload,Ei as serverPublicIpv4,qg as sshBootstrapMarkerPath,Lr as sshExec,Se as sshExecOrThrow,ht as sshHostKeyFingerprint,Kc as sshKnownHostsPath,zt as summarizeRemoteFailures,Pr as surfaceRemoteNotices,Fh as verifyHetznerHostOptimization,Gc as verifyHetznerResize,Lc as waitForCloudInit,ai as waitForSsh,se as wrapCloudInitUserData,ft as writeDriverState,Qh as writeResizeCheckpoint};

package/dist/drivers/shared/compute-ops.d.ts

@@ -7,7 +7,7 @@
  * with the shared generators, and runs it on every box — mirroring how
  * {@link import('./compute-deploy').deploySiteRelease} drives a deploy.
  */
-import type { CloudDriver, DatabaseConfig, EnvironmentType, RemoteDeployInstanceResult } from '@ts-cloud/core';
+import type { CloudDriver, DatabaseConfig, EnvironmentType, RemoteDeployInstanceResult, SiteConfig } from '@ts-cloud/core';
 export interface ComputeOpsLogger {
     info(message: string): void;
     warn(message: string): void;
@@ -31,14 +31,17 @@ export interface ComputeOpsResult {
 /**
  * Roll a site back to a previous release (Forge-style). With `to`, points
  * `current` at `releases/<to>`; otherwise the most recent prior release. After
- * flipping the symlink, php-fpm is restarted and queue workers are signalled so
- * they pick up the rolled-back code.
+ * flipping the symlink, the release's service is restarted. Declared PHP sites
+ * also restart php-fpm and, when artisan exists, their Laravel queue workers.
+ * Pass the site's declared config to enable PHP runtime hooks; an unspecified
+ * site never starts an unrelated runtime.
  */
 export declare function rollbackComputeSite(ctx: ComputeOpsContext, options: {
     siteName: string;
     to?: string;
     dryRun?: boolean;
     onlyIfLive?: string;
+    site?: SiteConfig;
 }): Promise<ComputeOpsResult>;
 /**
  * Stop the script (successfully) unless the site's live release is `release`.

package/dist/drivers/shared/remote-exec.d.ts

@@ -6,6 +6,8 @@
  * Uses the system `ssh`/`scp` binaries via Bun.spawn — no keys or agents are
  * managed here; pass `identityFile` or rely on the ambient SSH config.
  */
+/** Use PATH for SSH instead of scp's potentially non-relocatable build-time path. */
+export declare const SCP_SSH_TRANSPORT_ARGS: readonly ['-S', 'ssh'];
 export interface RemoteExecOptions {
     /** SSH user. @default 'root' */
     user?: string;

package/dist/index.js

@@ -1,4 +1,4 @@
-import{DI,PI,el,um,tl,rl,on,Q,l,nl,gm,K,il,g,zA,b,Xe,zi,an,w,be,sl,KA,r,t,kI,NI,p,BI,xI,OI,_I,LI,sr,ol,Ki,WA,$I,MI,xe,Ye,al,pm,mm,FI,fm,hm,Am,Mo,cl,ce,cn,Tt,Fo,wt,Ce,JA,dl,Uo,ym,Sm,Im,bm,ll,UI,W,C,XA,YA,Cm,a,y,Ze,m,Em,et,J,Rt,QI,vm,X,ul,Oe,or,Qo,de,gl,le,ZA,Ho,Y,Z,_,Wi,D,ar,Dt,ee,e,dn,HI,Tm,pl,GI,VI,qI,jI,ml,zI,KI,WI,JI,XI,YI,ZI,eb,tb,rb,nb,ib,ey,ty,ry,ny,iy,sy,oy,cr,wm,Rm,dr,Ji,sb,Dm,ob,ab,ln,cb,db,lb,ub,gb,pb,ay,cy,dy,ly,uy,Xi,mb,Go,gy,Pm,V,py,tt,Vo,Pt,my,km,fy,hy,Ay,Nm,q,fb,hb,Ab,yb,yy,Sb,te,Ib,bb,Cb,fl,hl,Sy,Bm,xm,Eb,vb,Tb,wb,Rb,Iy,Al,Db,Pb,kb,Nb,Bb,by,Cy,xb,Ob,_b,Lb,$b,Mb,Fb,Ey,Ub,Om,yl,Qb,Hb,Gb,Vb,_m,Lm,$m,qb,Sl,vy,Ty,wy,Ry,Il,Dy,jb,zb,Kb,Wb,Jb,Xb,Yb,Py,ky,Ny,By,Mm,Zb,eC,tC,rC,nC,iC,sC,oC,aC,xy,Oy,_y,Ly,cC,dC,Fm,lC,Um,Qm,Hm,Gm,uC,gC,pC,mC,_e,Yi,fC,hC,AC,yC,SC,IC,bC,CC,$y,EC,vC,Vm,qm,TC,wC,My,RC,DC,PC,kC,NC,BC,xC,OC,_C,LC,$C,MC,FC,UC,QC,HC,GC,VC,qC,jC,zC,bl,Fy,Cl,Uy,El,Qy,vl,Hy,Tl,Gy,lr,Vy,wl,qy,Zi,jy,Rl,zy,Dl,Ky,jm,KC,zm,WC,Pl,Wy,ur,Jy,Km,JC,kl,Xy,Wm,XC,Jm,YC,Xm,ZC,Nl,Yy,Ym,eE,Zm,tE,ef,rE,tf,nE,Bl,Zy,xl,eS,rf,iE,nf,sE,sf,oE,of,aE,af,cE,cf,dE,Ol,tS,df,lE,lf,uE,uf,gE,gf,pE,pf,mE,mf,fE,ff,hf,Af,yf,Sf,hE,If,AE,bf,yE,Cf,SE,rt,Ef,rS,qo,_l,un,nS,es,gr,Ll,$l,iS,sS,Ml,vf,Fl,Tf,IE,bE,jo,zo,Ko,Ul,gn,Ql,Hl,ts,Wo,Jo,wf,oS,aS,cS,CE,Rf,Df,EE,dS,Pf,lS,uS,gS,vE,kf,pn,Gl,Nf,TE,pS,Xo,Yo,Vl,Bf,wE,ql,mS,xf,RE,Of,DE,_f,PE}from"./chunk-zvcd6x45.js";import{jl,k,zl,Zo,fS,Lf,hS,AS,yS,SS,IS,bS,CS,ES}from"./chunk-a99wz633.js";import{sa,$f,eu,RS,ss,tu,oa,Mf,Ff,fn,aa,ru,it,nu,iu,su,os,hn,Uf,st,ou,ca,da,la,au,cu,du,as,ua,lu,An,cs,ga,kt,Qf,uu,gu,Hf,pu,pa,pr,mu,fu,hu,Au,ot,Gf,yu,mr,ma,fa,ha,ds,ls,yn,Su,us,Aa,ya,Sn,Iu,In,Vf,qf,Nt,bn,Sa,jf,bu,Cu,Ia,Eu,vu,Tu,DS,ue,wu,PS,kS,gs,ps,NS,Ee,zf,Bt,Le,$e,xt,Ru,Du,Pu,ku,Kf,Wf,ba,Jf,Xf,Ca,Nu,Bu,Yf,ge,Zf,xu,ve,Ea,at,Ot,_t,Cn,ms,Ou,BS,eh,th,rh,nh,va,Ta,_u,wa,En,Ra,Lu,fs,$u,Da,Pa,ka,Na,Ba,xa,Oa,_a,Mu,fr,La,Fu,vn,Uu,$a,Ma,Qu,hr,Fa,Ua,ih,xS,hs,OS,_S,LS,Qa,Ha,Hu,sh,Ga,Tn,Gu,As,Vu,qu,ju,Va,oh,qa,zu,ah,ja,ch,wn,Rn,Ku,ys,eg,ig,sg,og,ag,cg,Is,Ar,Ka,Dn,Pn,yr,ct,hh,Ja,Ah,yh,ug,Xa,Cs,gg,Ya,$t,Fe,pg,Za,ec,mg,tc,rc,nc,ic,fg,hg,Nn,sc,oc,ac,cc,Ag,Es,Bn,vs,dc}from"./chunk-86d69jp3.js";import{U,qr,fd,po,d,Fp,Up}from"./chunk-2hma3g5q.js";import{It,md,ki,Ni,Bi,Mp}from"./chunk-apj1eqcy.js";import{zh,Kh,Wh,Sp,Ip,bp,Jh,Cp,Ep,Xh,Yh,vp,Zh,eA,gd,Tp,tA,rA,wp,nA,iA,sA,oA,aA,cA,dA,Pi,pd,Rp,Dp,Pp,kp,Np,Bp,xp,Op,_p,Lp,$p,lA,uA,gA,pA,mA,fA,hA}from"./chunk-184bvh5s.js";import{Ke,hd,Ie,Yt,Ad,x,Zt,bt,yd,mo,SA,Qp,Sd,s,xi,fo,jr,Id,bd,zr,IA,Cd,vI,TI,ho,wI,RI,Ed,vd,Oi,Ao,ae,c,yo,We,Kr,bA,CA,Td,EA,So,vA,TA,Io,wd,Wr,bo,wA,er,Rd,Hp,tr,Jr,RA,Co,DA,O,PA,Dd,Gp,Eo,kA,NA,BA,Pd,_i,vo,kd,rr,Ct,xA,Xr,OA,Nd,Vp,qp,To,Bd,xd,Et,jp,Li,Od,wo,Yr,zp,$i,_d,Ld,Mi,Kp,$d,Md,Fd,Ud,Ro,Wp,Jp,_A,Xp,Qd,Fi,Yp,Zp,Do,Zr,Po,ko,No,Hd,em,Gd,Bo,LA,nr,$A,Vd,en,qd,MA,jd,tm,Ui,tn,xo,Qi,Je,FA,rm,nm,ir,zd,Kd,Wd,Hi,Gi,Vi,UA,QA,vt,Oo,HA,rn,im,_o,GA,sm,om,am,VA,cm,dm,qA,i,jA,qi,Lo,$o}from"./chunk-430acqjk.js";import{n}from"./chunk-e42gpavb.js";import{Re,gt,Vn}from"./chunk-qyr5hn6v.js";import{o}from"./chunk-jyvnfny6.js";import{Te,Ns,Bs,Ig,mc,fc,xs,hc,dt,re,lt,pe,v,we,Ln,Ac,Ue,yc,$n,Mn,Un,Mt,Ft,Ut,Qn,Ir,Sc,br,Cr,ut,Hn,bc,Qt,Er,Gn,Ec,Tg,wg,vc,vr}from"./chunk-nhsefr22.js";import{pt,he,Ge,Rg,Ht,wc,Rc,Gt,H,qn,Vt,qt,jn,$s,Ms,Tr,wr,zn,Rr,Fs,Us,Qs,Hs,ie,Gs,Vs,qs,js,Ae,zs,Ks,Ws,N,Dc,Kn,Pc,ye,Dr}from"./chunk-smt4t6rc.js";import{ne}from"./chunk-mp2y4t6w.js";import{Dg,kc,Pg,De,Nc,Wn,kg,Bc,Ng,Bg,Nh,Xn,Xs,M,Br,Yn,Zn,xr,_r,ei,Ys,ti,ri,ni,ii,oi,Lr,Se,_c,ai,Lc,$r,Fc,Ve,se,qe,je,ft,di,li,Pe,Mr,ke,gi,pi,mi,fi,hi,Ai,yi,Fr,F,ro,ip,Jc,Ii,bi,Ci,Ei,rd,no,nd,Jt,vi,io,so,id,Ti,sd}from"./chunk-acxmtx6c.js";import{ao,lo,uo,B,Ne}from"./chunk-yt8qgn5d.js";import{Kl,ea,rs,ns,ta,Wl,Jl,is,ra,na,Yl,Zl,ia}from"./chunk-gmtds745.js";import{lc,xn,On,Ts,ws,Rs,Ds,uc,gc}from"./chunk-94z7s8ky.js";import{pc}from"./chunk-hybz2q8w.js";import{Tc,Qe,S}from"./chunk-stc3ykm3.js";import{He}from"./chunk-vgtqd3sb.js";import{I}from"./chunk-y7k5872m.js";import{oe,wi,oo,od,Ri,pp}from"./chunk-wbbbpt4v.js";import{Qr,Be}from"./chunk-80bgb48v.js";import{h}from"./chunk-d245va6b.js";import{Jd,nn,Xd,Yd,Zd,ji,lm,sn}from"./chunk-qjp3f5y8.js";import{vS,nt}from"./chunk-c482jhc6.js";var qh="https://api.machines.dev/v1";class Ls extends Error{status;path;constructor(u,f,R){super(u);this.status=f;this.path=R;this.name="FlyApiError"}}function Qc(u){let f=u.ip.includes(":");if(f&&u.ip.startsWith("fdaa:"))return"private_v6";if(u.shared)return"shared_v4";return f?"v6":"v4"}class hp{token;fetch;constructor(u){if(!u.token)throw Error("Fly.io needs an API token: set FLY_API_TOKEN (`fly tokens create deploy` makes one scoped to an app).");this.token=u.token,this.fetch=u.fetch??fetch}async rest(u,f,R={}){let A=new URL(`https://api.machines.dev/v1${f}`);for(let[L,z]of Object.entries(R.query??{}))A.searchParams.set(L,z);let T=await this.fetch(A,{method:u,headers:{Authorization:`Bearer ${this.token}`,...R.body!==void 0?{"Content-Type":"application/json"}:{},...R.headers},body:R.body===void 0?void 0:JSON.stringify(R.body)});if(T.status===404&&R.notFound==="null")return null;let E=await T.text(),P=E?yp(E):void 0;if(!T.ok){let L=typeof P==="object"&&P&&"error"in P?String(P.error):E||T.statusText;throw new Ls(`Fly.io ${u} ${f} failed (${T.status}): ${L}`,T.status,f)}return P}getApp(u){return this.rest("GET",`/apps/${encodeURIComponent(u)}`,{notFound:"null"})}createApp(u,f){return this.rest("POST","/apps",{body:{app_name:u,org_slug:f}})}async listMachines(u){return await this.rest("GET",`/apps/${encodeURIComponent(u)}/machines`)??[]}createMachine(u,f){return this.rest("POST",`/apps/${encodeURIComponent(u)}/machines`,{body:f})}updateMachine(u,f,R,A){return this.rest("POST",`/apps/${encodeURIComponent(u)}/machines/${encodeURIComponent(f)}`,{body:R,headers:{"fly-machine-lease-nonce":A}})}async acquireLease(u,f,R=120){let T=(await this.rest("POST",`/apps/${encodeURIComponent(u)}/machines/${encodeURIComponent(f)}/lease`,{body:{ttl:R}})).data?.nonce;if(!T)throw new Ls(`Fly.io gave no lease nonce for Machine ${f}`,200,`/machines/${f}/lease`);return T}async releaseLease(u,f,R){await this.rest("DELETE",`/apps/${encodeURIComponent(u)}/machines/${encodeURIComponent(f)}/lease`,{headers:{"fly-machine-lease-nonce":R}})}async waitForState(u,f,R,A={}){await this.rest("GET",`/apps/${encodeURIComponent(u)}/machines/${encodeURIComponent(f)}/wait`,{query:{state:R,timeout:String(A.timeoutSeconds??60),...A.instanceId?{instance_id:A.instanceId}:{}}})}async listVolumes(u){return await this.rest("GET",`/apps/${encodeURIComponent(u)}/volumes`)??[]}createVolume(u,f){return this.rest("POST",`/apps/${encodeURIComponent(u)}/volumes`,{body:{...f,encrypted:!0}})}async setSecrets(u,f){return(await this.rest("POST",`/apps/${encodeURIComponent(u)}/secrets`,{body:{values:f}})).version}async listIpAssignments(u){return(await this.rest("GET",`/apps/${encodeURIComponent(u)}/ip_assignments`)).ips??[]}async assignIp(u,f){let R=await this.rest("POST",`/apps/${encodeURIComponent(u)}/ip_assignments`,{body:{type:f}});if(!R.ip)throw new Ls(`Fly.io assigned no ${f} address to ${u}`,200,`/apps/${u}/ip_assignments`);return{ip:R.ip,shared:R.shared??f==="shared_v4",region:R.region}}async requestCertificate(u,f){return this.rest("POST",`/apps/${encodeURIComponent(u)}/certificates/acme`,{body:{hostname:f}})}}function yp(u){try{return JSON.parse(u)}catch{return}}var Wc="ts-cloud-role";function $S(u,f){let R=u.fly??{},A=R.app??`${u.project.slug}-${f.environment}`;if(!/^[a-z0-9][a-z0-9-]{1,61}[a-z0-9]$/.test(A))throw Error(`"${A}" is not a valid Fly app name: lowercase letters, digits and dashes, 3 to 63 characters.`);let T=R.internalPort??3000,E=R.count??1;if(!Number.isInteger(E)||E<1)throw Error(`fly.count must be a whole number of at least 1, got ${E}.`);return{app:A,org:R.org??"personal",image:f.image,regions:R.regions?.length?R.regions:["iad"],count:E,internalPort:T,healthPath:R.healthPath??"/",vm:{cpuKind:R.vm?.cpuKind??"shared",cpus:R.vm?.cpus??1,memoryMb:R.vm?.memoryMb??512},...R.volume?{volume:{name:R.volume.name??"data",sizeGb:R.volume.sizeGb,path:R.volume.path}}:{},autoStop:R.autoStop??!1,env:{...f.env,PORT:String(T)},secrets:f.secrets??{},hostnames:R.hostnames??[],release:f.release}}function Ap(u){return{image:u.image,env:u.env,guest:{cpu_kind:u.vm.cpuKind,cpus:u.vm.cpus,memory_mb:u.vm.memoryMb},services:[{protocol:"tcp",internal_port:u.internalPort,ports:[{port:80,handlers:["http"],force_https:!0},{port:443,handlers:["tls","http"]}],autostop:u.autoStop?"stop":"off",autostart:!0,...u.autoStop?{min_machines_running:0}:{},checks:[{type:"http",method:"GET",path:u.healthPath,interval:"15s",timeout:"5s",grace_period:"10s"}]}],restart:{policy:"on-failure",max_retries:10},metadata:{[Wc]:"app","ts-cloud-release":u.release}}}async function wS(u,f,R=()=>{}){let A=!1;if(!await u.getApp(f.app))R(`Creating Fly app ${f.app} in ${f.org}`),await u.createApp(f.app,f.org),A=!0;let T;if(Object.keys(f.secrets).length>0)T=await u.setSecrets(f.app,f.secrets),R(`Set ${Object.keys(f.secrets).length} secret(s) (version ${T})`);let E=await u.listIpAssignments(f.app),P=new Set(E.map(Qc));if(!P.has("v6"))E.push(await u.assignIp(f.app,"v6")),R("Assigned a dedicated IPv6");if(!P.has("v4")&&!P.has("shared_v4"))E.push(await u.assignIp(f.app,"shared_v4")),R("Assigned a shared IPv4");let L=Ap(f),z=(await u.listMachines(f.app)).filter((Me)=>{let ze=Me.config?.metadata??{};if(ze[Wc])return ze[Wc]==="app";return!ze.fly_process_group||ze.fly_process_group==="app"}),fe=f.volume?await u.listVolumes(f.app):[],me=[],At=[],Lt=new Set;for(let Me of f.regions){let ze=z.filter((j)=>j.region===Me).sort((j,yt)=>j.id.localeCompare(yt.id));for(let j=0;j<f.count;j++){let yt=ze[j];if(yt){Lt.add(yt.id),await tg(u,f.app,yt,L,T),At.push(yt.id),R(`Updated ${yt.id} (${Me}) to ${f.image}`);continue}let G=f.volume?[{volume:(await rg(u,f,Me,fe)).id,path:f.volume.path}]:void 0,ht=await u.createMachine(f.app,{region:Me,name:`${f.app}-${Me}-${j+1}`,config:{...L,...G?{mounts:G}:{}},...T!==void 0?{min_secrets_version:T}:{}});await u.waitForState(f.app,ht.id,"started",{instanceId:ht.instance_id}),me.push(ht.id),R(`Created ${ht.id} in ${Me}`)}}let mt=[];for(let Me of f.hostnames)mt.push(await u.requestCertificate(f.app,Me));return{app:f.app,url:`https://${f.app}.fly.dev`,createdApp:A,created:me,updated:At,untouched:z.filter((Me)=>!Lt.has(Me.id)).map((Me)=>Me.id),ips:E,certificates:mt}}async function tg(u,f,R,A,T){let E=await u.acquireLease(f,R.id);try{let P=await u.updateMachine(f,R.id,{config:{...A,...R.config?.mounts?.length?{mounts:R.config.mounts}:{}},...T!==void 0?{min_secrets_version:T}:{}},E);await u.waitForState(f,R.id,"started",{instanceId:P.instance_id})}finally{await u.releaseLease(f,R.id,E)}}async function rg(u,f,R,A){let T=A.find((P)=>P.region===R&&P.name===f.volume.name&&!P.attached_machine_id);if(T)return T.attached_machine_id="pending",T;let E=await u.createVolume(f.app,{name:f.volume.name,region:R,size_gb:f.volume.sizeGb});return A.push({...E,attached_machine_id:"pending"}),E}import{createHmac as Xl,createSign as ng,timingSafeEqual as lg}from"node:crypto";function eo(u){let f=u instanceof Date?u.getTime():u;if(!Number.isFinite(f))throw TypeError("Media access timestamp must be finite");return Math.floor(f/1000)}function Wu(u){return Buffer.from(u).toString("base64").replaceAll("+","-").replaceAll("=","_").replaceAll("/","~")}function dg(u){return Buffer.from(u).toString("base64url")}function Zu(u,f=!1){if(!u||/[\r\n]/.test(u))throw TypeError("Media resource is invalid");let R=f?u.replaceAll("*","wildcard"):u,A=new URL(R);if(!["http:","https:"].includes(A.protocol))throw TypeError("Media resource must use HTTP or HTTPS");if(!f&&u.includes("*"))throw TypeError("Canned policies cannot contain wildcards")}function Ju(u,f){let R=ng("RSA-SHA1");return R.update(u),R.end(),Wu(R.sign(f))}function Yu(u){Zu(u.resource,!0);let R={DateLessThan:{"AWS:EpochTime":eo(u.expiresAt)}};if(u.activeAt!==void 0)R.DateGreaterThan={"AWS:EpochTime":eo(u.activeAt)};if(u.ipAddress)R.IpAddress={"AWS:SourceIp":u.ipAddress};return JSON.stringify({Statement:[{Resource:u.resource,Condition:R}]})}function HS(u,f,R){Zu(u);let A=eo(f),T=u.includes("?")?"&":"?",E=Yu({resource:u,expiresAt:f}),P=Ju(E,R.privateKey);return`${u}${T}Expires=${A}&Signature=${encodeURIComponent(P)}&Key-Pair-Id=${encodeURIComponent(R.keyPairId)}`}function US(u,f){let R=Yu(u);return{"CloudFront-Key-Pair-Id":f.keyPairId,"CloudFront-Policy":Wu(Buffer.from(R)),"CloudFront-Signature":Ju(R,f.privateKey)}}function GS(u){if(!u.resource||/[\r\n]/.test(u.resource))throw TypeError("Media resource is invalid");let f=dg(Buffer.from(JSON.stringify({resource:u.resource,expiresAt:eo(u.expiresAt),...u.keyId?{keyId:u.keyId}:{},...u.audience?{audience:u.audience}:{}}))),R=Xl("sha256",u.secret).update(f).digest("base64url");return`${f}.${R}`}function jS(u,f){let[R,A,T]=u.split(".");if(!R||!A||T)return null;let E=Xl("sha256",f.secret).update(R).digest(),P;try{P=Buffer.from(A,"base64url")}catch{return null}if(E.length!==P.length||!lg(E,P))return null;try{let L=JSON.parse(Buffer.from(R,"base64url").toString("utf8")),z=eo(f.now??Date.now());if(!L.resource||!Number.isSafeInteger(L.expiresAt)||L.expiresAt<=z)return null;if(f.resource&&L.resource!==f.resource)return null;if(f.audience&&L.audience!==f.audience)return null;return L}catch{return null}}function KS(u,f=!1){let R=new URL(u,"https://media.invalid").pathname.toLowerCase(),A=/\.(?:m3u8|mpd|vtt|json)$/.test(R),T=/\.(?:key|license)$/.test(R)||R.includes("/keys/")||R.includes("/licenses/");return{"Accept-Ranges":"bytes","Cache-Control":f&&(A||T)?"private, no-store":A?"public, max-age=5, s-maxage=30, stale-while-revalidate=30":"public, max-age=31536000, immutable","Cross-Origin-Resource-Policy":"cross-origin","X-Content-Type-Options":"nosniff"}}function qS(u){if(!/^[a-z0-9][a-z0-9.-]{1,61}[a-z0-9]$/.test(u.bucket))throw TypeError("Media bucket is invalid");if(!/^[a-z0-9-]+$/.test(u.region))throw TypeError("Media bucket region is invalid");let f=u.prefix?`/${u.prefix.replace(/^\/+|\/+$/g,"")}`:"",R=u.protected??!1,A="public, max-age=31536000, immutable",T=R?"private, no-store":"public, max-age=5, s-maxage=30, stale-while-revalidate=30";return{originDomain:`${u.bucket}.s3.${u.region}.amazonaws.com`,originPath:f,domain:u.domain,trustedKeyGroupIds:[...new Set(u.trustedKeyGroupIds??[])],behaviors:[{pathPattern:"*.m3u8",cacheControl:T,compress:!0,signed:R},{pathPattern:"*.mpd",cacheControl:T,compress:!0,signed:R},{pathPattern:"*.vtt",cacheControl:T,compress:!0,signed:R},{pathPattern:"*",cacheControl:A,compress:!1,signed:R}],responseHeaders:{"Access-Control-Allow-Headers":"Range, If-Range","Access-Control-Allow-Methods":"GET, HEAD, OPTIONS","Access-Control-Allow-Origin":"*","Access-Control-Expose-Headers":"Accept-Ranges, Content-Length, Content-Range, ETag","X-Content-Type-Options":"nosniff"}}}class yg{builder;config;environment;mergedConfig;serverEipLogicalIds=new Map;storageFailoverReplicas=[];constructor(u){this.config=u.config,this.environment=u.environment,this.builder=new sl(`${this.config.project.name} - ${this.environment}`),this.mergedConfig=this.mergeEnvironmentConfig()}mergeEnvironmentConfig(){let f=this.config.environments[this.environment]?.infrastructure;if(!f)return this.config;return{...this.config,infrastructure:{...this.config.infrastructure,...f,compute:{...this.config.infrastructure?.compute,...f.compute},storage:{...this.config.infrastructure?.storage,...f.storage},functions:{...this.config.infrastructure?.functions,...f.functions},servers:{...this.config.infrastructure?.servers,...f.servers},databases:{...this.config.infrastructure?.databases,...f.databases},cdn:{...this.config.infrastructure?.cdn,...f.cdn},sftp:f.sftp??this.config.infrastructure?.sftp,queues:{...this.config.infrastructure?.queues,...f.queues},redirects:{...this.config.infrastructure?.redirects,...f.redirects},realtime:{...this.config.infrastructure?.realtime,...f.realtime},cache:{...this.config.infrastructure?.cache,...f.cache},fileSystem:{...this.config.infrastructure?.fileSystem,...f.fileSystem},email:{...this.config.infrastructure?.email,...f.email},search:{...this.config.infrastructure?.search,...f.search},ai:{...this.config.infrastructure?.ai,...f.ai}}}}shouldDeploy(u){if(u.environments&&!u.environments.includes(this.environment))return!1;if(u.requiresFeatures){let f=this.config.features||{};if(!u.requiresFeatures.every((A)=>f[A]===!0))return!1}if(u.regions){let f=this.config.environments[this.environment]?.region||this.config.project.region;if(!u.regions.includes(f))return!1}if(u.condition&&typeof u.condition==="function")return u.condition(this.config,this.environment);return!0}resolveApiOriginPort(){let u=this.mergedConfig.infrastructure?.api?.port??this.mergedConfig.ports?.api,f=Number(u||3008);return Number.isFinite(f)&&f>0?f:3008}defaultComputeCachePathPatterns(){return["/api/*","/auth/*","/publisher/api/*","/publisher/*","/publish","/publish/*","/analytics/*","/packages/*","/npm/*","/zig/*","/php/*","/commits/*","/health","/dashboard/*","/search","/login","/logout","/signup","/account","/account/*"]}shouldRouteStorageBucketToCompute(u,f){return u==="public"||f.routeCompute===!0}storageBucketName(u,f,R){return this.mergedConfig.infrastructure?.storage?.[R]?.bucket??`${u}-${f}-${R}`}fileSystemLogicalId(u,f,R){return t(r({slug:`${u}-${R}`,environment:f,resourceType:"efs"}))}resolveSftpStorage(u,f,R){let A=u.storage;if(A?.type==="efs"&&A.fileSystem){if(!this.mergedConfig.infrastructure?.fileSystem?.[A.fileSystem])throw Error(`sftp: storage.fileSystem "${A.fileSystem}" is not defined in infrastructure.fileSystem`);return{type:"efs",fileSystemId:{Ref:this.fileSystemLogicalId(f,R,A.fileSystem)},posixProfile:A.posixProfile}}if(A?.type==="s3"&&A.storageBucket){if(!this.mergedConfig.infrastructure?.storage?.[A.storageBucket])throw Error(`sftp: storage.storageBucket "${A.storageBucket}" is not defined in infrastructure.storage`);return{type:"s3",bucket:this.storageBucketName(f,R,A.storageBucket)}}return}resolveComputeCachePathPatterns(u){if(u&&u.length>0)return u;return this.defaultComputeCachePathPatterns()}createComputeCacheBehavior(u,f){return{PathPattern:u,TargetOriginId:f,ViewerProtocolPolicy:"redirect-to-https",AllowedMethods:["GET","HEAD","OPTIONS","PUT","POST","PATCH","DELETE"],CachedMethods:["GET","HEAD"],Compress:!0,CachePolicyId:"4135ea2d-6df8-44a3-9df3-4b5a84be39ad",OriginRequestPolicyId:"b689b0a8-53d0-40ab-baf2-68738e2966ac"}}appendComputeAppOrigin(u,f,R,A,T,E){let P=this.serverEipLogicalIds.get("app"),L=this.serverEipLogicalIds.get("appInstance");if(!P)return;let z=`EC2-${A}-${T}-api`,fe=this.mergedConfig.infrastructure?.servers?.app?.region||this.mergedConfig.project?.region||"us-east-1",me=fe==="us-east-1"?".compute-1.amazonaws.com":`.${fe}.compute.amazonaws.com`,At={"Fn::Join":["",["ec2-",{"Fn::Join":["-",{"Fn::Split":[".",{Ref:P}]}]},me]]},Lt=this.resolveApiOriginPort();if(u.push({Id:z,DomainName:At,CustomOriginConfig:{HTTPPort:Lt,HTTPSPort:443,OriginProtocolPolicy:"http-only",OriginSSLProtocols:["TLSv1.2"]}}),R.push(P),L)R.push(L);for(let mt of E)f.push(this.createComputeCacheBehavior(mt,z))}buildCaddyfile(u){let f=u.filter(([,T])=>typeof T.domain==="string"&&T.domain&&typeof T.port==="number");if(f.length===0)return;let R=new Map;for(let[,T]of f){let E=R.get(T.domain)??[];E.push({port:T.port,path:T.path}),R.set(T.domain,E)}let A=[];for(let[T,E]of R){let L=[...E].sort((z,fe)=>{let me=!z.path||z.path==="/",At=!fe.path||fe.path==="/";if(me&&!At)return 1;if(!me&&At)return-1;return(fe.path?.length??0)-(z.path?.length??0)}).map((z)=>{let fe=!z.path||z.path==="/",me=`reverse_proxy localhost:${z.port}`;return fe?`  handle {
+import{DI,PI,el,um,tl,rl,on,Q,l,nl,gm,K,il,g,zA,b,Xe,zi,an,w,be,sl,KA,r,t,kI,NI,p,BI,xI,OI,_I,LI,sr,ol,Ki,WA,$I,MI,xe,Ye,al,pm,mm,FI,fm,hm,Am,Mo,cl,ce,cn,Tt,Fo,wt,Ce,JA,dl,Uo,ym,Sm,Im,bm,ll,UI,W,C,XA,YA,Cm,a,y,Ze,m,Em,et,J,Rt,QI,vm,X,ul,Oe,or,Qo,de,gl,le,ZA,Ho,Y,Z,_,Wi,D,ar,Dt,ee,e,dn,HI,Tm,pl,GI,VI,qI,jI,ml,zI,KI,WI,JI,XI,YI,ZI,eb,tb,rb,nb,ib,ey,ty,ry,ny,iy,sy,oy,cr,wm,Rm,dr,Ji,sb,Dm,ob,ab,ln,cb,db,lb,ub,gb,pb,ay,cy,dy,ly,uy,Xi,mb,Go,gy,Pm,V,py,tt,Vo,Pt,my,km,fy,hy,Ay,Nm,q,fb,hb,Ab,yb,yy,Sb,te,Ib,bb,Cb,fl,hl,Sy,Bm,xm,Eb,vb,Tb,wb,Rb,Iy,Al,Db,Pb,kb,Nb,Bb,by,Cy,xb,Ob,_b,Lb,$b,Mb,Fb,Ey,Ub,Om,yl,Qb,Hb,Gb,Vb,_m,Lm,$m,qb,Sl,vy,Ty,wy,Ry,Il,Dy,jb,zb,Kb,Wb,Jb,Xb,Yb,Py,ky,Ny,By,Mm,Zb,eC,tC,rC,nC,iC,sC,oC,aC,xy,Oy,_y,Ly,cC,dC,Fm,lC,Um,Qm,Hm,Gm,uC,gC,pC,mC,_e,Yi,fC,hC,AC,yC,SC,IC,bC,CC,$y,EC,vC,Vm,qm,TC,wC,My,RC,DC,PC,kC,NC,BC,xC,OC,_C,LC,$C,MC,FC,UC,QC,HC,GC,VC,qC,jC,zC,bl,Fy,Cl,Uy,El,Qy,vl,Hy,Tl,Gy,lr,Vy,wl,qy,Zi,jy,Rl,zy,Dl,Ky,jm,KC,zm,WC,Pl,Wy,ur,Jy,Km,JC,kl,Xy,Wm,XC,Jm,YC,Xm,ZC,Nl,Yy,Ym,eE,Zm,tE,ef,rE,tf,nE,Bl,Zy,xl,eS,rf,iE,nf,sE,sf,oE,of,aE,af,cE,cf,dE,Ol,tS,df,lE,lf,uE,uf,gE,gf,pE,pf,mE,mf,fE,ff,hf,Af,yf,Sf,hE,If,AE,bf,yE,Cf,SE,rt,Ef,rS,qo,_l,un,nS,es,gr,Ll,$l,iS,sS,Ml,vf,Fl,Tf,IE,bE,jo,zo,Ko,Ul,gn,Ql,Hl,ts,Wo,Jo,wf,oS,aS,cS,CE,Rf,Df,EE,dS,Pf,lS,uS,gS,vE,kf,pn,Gl,Nf,TE,pS,Xo,Yo,Vl,Bf,wE,ql,mS,xf,RE,Of,DE,_f,PE}from"./chunk-zvcd6x45.js";import{jl,k,zl,Zo,fS,Lf,hS,AS,yS,SS,IS,bS,CS,ES}from"./chunk-a99wz633.js";import{sa,$f,eu,RS,ss,tu,oa,Mf,Ff,fn,aa,ru,it,nu,iu,su,os,hn,Uf,st,ou,ca,da,la,au,cu,du,as,ua,lu,An,cs,ga,kt,Qf,uu,gu,Hf,pu,pa,pr,mu,fu,hu,Au,ot,Gf,yu,mr,ma,fa,ha,ds,ls,yn,Su,us,Aa,ya,Sn,Iu,In,Vf,qf,Nt,bn,Sa,jf,bu,Cu,Ia,Eu,vu,Tu,DS,ue,wu,PS,kS,gs,ps,NS,Ee,zf,Bt,Le,$e,xt,Ru,Du,Pu,ku,Kf,Wf,ba,Jf,Xf,Ca,Nu,Bu,Yf,ge,Zf,xu,ve,Ea,at,Ot,_t,Cn,ms,Ou,BS,eh,th,rh,nh,va,Ta,_u,wa,En,Ra,Lu,fs,$u,Da,Pa,ka,Na,Ba,xa,Oa,_a,Mu,fr,La,Fu,vn,Uu,$a,Ma,Qu,hr,Fa,Ua,ih,xS,hs,OS,_S,LS,Qa,Ha,Hu,sh,Ga,Tn,Gu,As,Vu,qu,ju,Va,oh,qa,zu,ah,ja,ch,wn,Rn,Ku,ys,eg,ig,sg,og,ag,cg,Is,Ar,Ka,Dn,Pn,yr,ct,hh,Ja,Ah,yh,ug,Xa,Cs,gg,Ya,$t,Fe,pg,Za,ec,mg,tc,rc,nc,ic,fg,hg,Nn,sc,oc,ac,cc,Ag,Es,Bn,vs,dc}from"./chunk-4f0b21fp.js";import{U,qr,fd,po,d,Fp,Up}from"./chunk-2hma3g5q.js";import{It,md,ki,Ni,Bi,Mp}from"./chunk-apj1eqcy.js";import{zh,Kh,Wh,Sp,Ip,bp,Jh,Cp,Ep,Xh,Yh,vp,Zh,eA,gd,Tp,tA,rA,wp,nA,iA,sA,oA,aA,cA,dA,Pi,pd,Rp,Dp,Pp,kp,Np,Bp,xp,Op,_p,Lp,$p,lA,uA,gA,pA,mA,fA,hA}from"./chunk-184bvh5s.js";import{Ke,hd,Ie,Yt,Ad,x,Zt,bt,yd,mo,SA,Qp,Sd,s,xi,fo,jr,Id,bd,zr,IA,Cd,vI,TI,ho,wI,RI,Ed,vd,Oi,Ao,ae,c,yo,We,Kr,bA,CA,Td,EA,So,vA,TA,Io,wd,Wr,bo,wA,er,Rd,Hp,tr,Jr,RA,Co,DA,O,PA,Dd,Gp,Eo,kA,NA,BA,Pd,_i,vo,kd,rr,Ct,xA,Xr,OA,Nd,Vp,qp,To,Bd,xd,Et,jp,Li,Od,wo,Yr,zp,$i,_d,Ld,Mi,Kp,$d,Md,Fd,Ud,Ro,Wp,Jp,_A,Xp,Qd,Fi,Yp,Zp,Do,Zr,Po,ko,No,Hd,em,Gd,Bo,LA,nr,$A,Vd,en,qd,MA,jd,tm,Ui,tn,xo,Qi,Je,FA,rm,nm,ir,zd,Kd,Wd,Hi,Gi,Vi,UA,QA,vt,Oo,HA,rn,im,_o,GA,sm,om,am,VA,cm,dm,qA,i,jA,qi,Lo,$o}from"./chunk-430acqjk.js";import{n}from"./chunk-e42gpavb.js";import{Re,gt,Vn}from"./chunk-qyr5hn6v.js";import{o}from"./chunk-jyvnfny6.js";import{Te,Ns,Bs,Ig,mc,fc,xs,hc,dt,re,lt,pe,v,we,Ln,Ac,Ue,yc,$n,Mn,Un,Mt,Ft,Ut,Qn,Ir,Sc,br,Cr,ut,Hn,bc,Qt,Er,Gn,Ec,Tg,wg,vc,vr}from"./chunk-nhsefr22.js";import{pt,he,Ge,Rg,Ht,wc,Rc,Gt,H,qn,Vt,qt,jn,$s,Ms,Tr,wr,zn,Rr,Fs,Us,Qs,Hs,ie,Gs,Vs,qs,js,Ae,zs,Ks,Ws,N,Dc,Kn,Pc,ye,Dr}from"./chunk-smt4t6rc.js";import{ne}from"./chunk-mp2y4t6w.js";import{Dg,kc,Pg,De,Nc,Wn,kg,Bc,Ng,Bg,Nh,Xn,Xs,M,Br,Yn,Zn,xr,_r,ei,Ys,ti,ri,ni,ii,oi,Lr,Se,_c,ai,Lc,$r,Fc,Ve,se,qe,je,ft,di,li,Pe,Mr,ke,gi,pi,mi,fi,hi,Ai,yi,Fr,F,ro,ip,Jc,Ii,bi,Ci,Ei,rd,no,nd,Jt,vi,io,so,id,Ti,sd}from"./chunk-y2dej583.js";import{ao,lo,uo,B,Ne}from"./chunk-yt8qgn5d.js";import{Kl,ea,rs,ns,ta,Wl,Jl,is,ra,na,Yl,Zl,ia}from"./chunk-gmtds745.js";import{lc,xn,On,Ts,ws,Rs,Ds,uc,gc}from"./chunk-94z7s8ky.js";import{pc}from"./chunk-hybz2q8w.js";import{Tc,Qe,S}from"./chunk-stc3ykm3.js";import{He}from"./chunk-vgtqd3sb.js";import{I}from"./chunk-y7k5872m.js";import{oe,wi,oo,od,Ri,pp}from"./chunk-wbbbpt4v.js";import{Qr,Be}from"./chunk-80bgb48v.js";import{h}from"./chunk-d245va6b.js";import{Jd,nn,Xd,Yd,Zd,ji,lm,sn}from"./chunk-qjp3f5y8.js";import{vS,nt}from"./chunk-c482jhc6.js";var qh="https://api.machines.dev/v1";class Ls extends Error{status;path;constructor(u,f,R){super(u);this.status=f;this.path=R;this.name="FlyApiError"}}function Qc(u){let f=u.ip.includes(":");if(f&&u.ip.startsWith("fdaa:"))return"private_v6";if(u.shared)return"shared_v4";return f?"v6":"v4"}class hp{token;fetch;constructor(u){if(!u.token)throw Error("Fly.io needs an API token: set FLY_API_TOKEN (`fly tokens create deploy` makes one scoped to an app).");this.token=u.token,this.fetch=u.fetch??fetch}async rest(u,f,R={}){let A=new URL(`https://api.machines.dev/v1${f}`);for(let[L,z]of Object.entries(R.query??{}))A.searchParams.set(L,z);let T=await this.fetch(A,{method:u,headers:{Authorization:`Bearer ${this.token}`,...R.body!==void 0?{"Content-Type":"application/json"}:{},...R.headers},body:R.body===void 0?void 0:JSON.stringify(R.body)});if(T.status===404&&R.notFound==="null")return null;let E=await T.text(),P=E?yp(E):void 0;if(!T.ok){let L=typeof P==="object"&&P&&"error"in P?String(P.error):E||T.statusText;throw new Ls(`Fly.io ${u} ${f} failed (${T.status}): ${L}`,T.status,f)}return P}getApp(u){return this.rest("GET",`/apps/${encodeURIComponent(u)}`,{notFound:"null"})}createApp(u,f){return this.rest("POST","/apps",{body:{app_name:u,org_slug:f}})}async listMachines(u){return await this.rest("GET",`/apps/${encodeURIComponent(u)}/machines`)??[]}createMachine(u,f){return this.rest("POST",`/apps/${encodeURIComponent(u)}/machines`,{body:f})}updateMachine(u,f,R,A){return this.rest("POST",`/apps/${encodeURIComponent(u)}/machines/${encodeURIComponent(f)}`,{body:R,headers:{"fly-machine-lease-nonce":A}})}async acquireLease(u,f,R=120){let T=(await this.rest("POST",`/apps/${encodeURIComponent(u)}/machines/${encodeURIComponent(f)}/lease`,{body:{ttl:R}})).data?.nonce;if(!T)throw new Ls(`Fly.io gave no lease nonce for Machine ${f}`,200,`/machines/${f}/lease`);return T}async releaseLease(u,f,R){await this.rest("DELETE",`/apps/${encodeURIComponent(u)}/machines/${encodeURIComponent(f)}/lease`,{headers:{"fly-machine-lease-nonce":R}})}async waitForState(u,f,R,A={}){await this.rest("GET",`/apps/${encodeURIComponent(u)}/machines/${encodeURIComponent(f)}/wait`,{query:{state:R,timeout:String(A.timeoutSeconds??60),...A.instanceId?{instance_id:A.instanceId}:{}}})}async listVolumes(u){return await this.rest("GET",`/apps/${encodeURIComponent(u)}/volumes`)??[]}createVolume(u,f){return this.rest("POST",`/apps/${encodeURIComponent(u)}/volumes`,{body:{...f,encrypted:!0}})}async setSecrets(u,f){return(await this.rest("POST",`/apps/${encodeURIComponent(u)}/secrets`,{body:{values:f}})).version}async listIpAssignments(u){return(await this.rest("GET",`/apps/${encodeURIComponent(u)}/ip_assignments`)).ips??[]}async assignIp(u,f){let R=await this.rest("POST",`/apps/${encodeURIComponent(u)}/ip_assignments`,{body:{type:f}});if(!R.ip)throw new Ls(`Fly.io assigned no ${f} address to ${u}`,200,`/apps/${u}/ip_assignments`);return{ip:R.ip,shared:R.shared??f==="shared_v4",region:R.region}}async requestCertificate(u,f){return this.rest("POST",`/apps/${encodeURIComponent(u)}/certificates/acme`,{body:{hostname:f}})}}function yp(u){try{return JSON.parse(u)}catch{return}}var Wc="ts-cloud-role";function $S(u,f){let R=u.fly??{},A=R.app??`${u.project.slug}-${f.environment}`;if(!/^[a-z0-9][a-z0-9-]{1,61}[a-z0-9]$/.test(A))throw Error(`"${A}" is not a valid Fly app name: lowercase letters, digits and dashes, 3 to 63 characters.`);let T=R.internalPort??3000,E=R.count??1;if(!Number.isInteger(E)||E<1)throw Error(`fly.count must be a whole number of at least 1, got ${E}.`);return{app:A,org:R.org??"personal",image:f.image,regions:R.regions?.length?R.regions:["iad"],count:E,internalPort:T,healthPath:R.healthPath??"/",vm:{cpuKind:R.vm?.cpuKind??"shared",cpus:R.vm?.cpus??1,memoryMb:R.vm?.memoryMb??512},...R.volume?{volume:{name:R.volume.name??"data",sizeGb:R.volume.sizeGb,path:R.volume.path}}:{},autoStop:R.autoStop??!1,env:{...f.env,PORT:String(T)},secrets:f.secrets??{},hostnames:R.hostnames??[],release:f.release}}function Ap(u){return{image:u.image,env:u.env,guest:{cpu_kind:u.vm.cpuKind,cpus:u.vm.cpus,memory_mb:u.vm.memoryMb},services:[{protocol:"tcp",internal_port:u.internalPort,ports:[{port:80,handlers:["http"],force_https:!0},{port:443,handlers:["tls","http"]}],autostop:u.autoStop?"stop":"off",autostart:!0,...u.autoStop?{min_machines_running:0}:{},checks:[{type:"http",method:"GET",path:u.healthPath,interval:"15s",timeout:"5s",grace_period:"10s"}]}],restart:{policy:"on-failure",max_retries:10},metadata:{[Wc]:"app","ts-cloud-release":u.release}}}async function wS(u,f,R=()=>{}){let A=!1;if(!await u.getApp(f.app))R(`Creating Fly app ${f.app} in ${f.org}`),await u.createApp(f.app,f.org),A=!0;let T;if(Object.keys(f.secrets).length>0)T=await u.setSecrets(f.app,f.secrets),R(`Set ${Object.keys(f.secrets).length} secret(s) (version ${T})`);let E=await u.listIpAssignments(f.app),P=new Set(E.map(Qc));if(!P.has("v6"))E.push(await u.assignIp(f.app,"v6")),R("Assigned a dedicated IPv6");if(!P.has("v4")&&!P.has("shared_v4"))E.push(await u.assignIp(f.app,"shared_v4")),R("Assigned a shared IPv4");let L=Ap(f),z=(await u.listMachines(f.app)).filter((Me)=>{let ze=Me.config?.metadata??{};if(ze[Wc])return ze[Wc]==="app";return!ze.fly_process_group||ze.fly_process_group==="app"}),fe=f.volume?await u.listVolumes(f.app):[],me=[],At=[],Lt=new Set;for(let Me of f.regions){let ze=z.filter((j)=>j.region===Me).sort((j,yt)=>j.id.localeCompare(yt.id));for(let j=0;j<f.count;j++){let yt=ze[j];if(yt){Lt.add(yt.id),await tg(u,f.app,yt,L,T),At.push(yt.id),R(`Updated ${yt.id} (${Me}) to ${f.image}`);continue}let G=f.volume?[{volume:(await rg(u,f,Me,fe)).id,path:f.volume.path}]:void 0,ht=await u.createMachine(f.app,{region:Me,name:`${f.app}-${Me}-${j+1}`,config:{...L,...G?{mounts:G}:{}},...T!==void 0?{min_secrets_version:T}:{}});await u.waitForState(f.app,ht.id,"started",{instanceId:ht.instance_id}),me.push(ht.id),R(`Created ${ht.id} in ${Me}`)}}let mt=[];for(let Me of f.hostnames)mt.push(await u.requestCertificate(f.app,Me));return{app:f.app,url:`https://${f.app}.fly.dev`,createdApp:A,created:me,updated:At,untouched:z.filter((Me)=>!Lt.has(Me.id)).map((Me)=>Me.id),ips:E,certificates:mt}}async function tg(u,f,R,A,T){let E=await u.acquireLease(f,R.id);try{let P=await u.updateMachine(f,R.id,{config:{...A,...R.config?.mounts?.length?{mounts:R.config.mounts}:{}},...T!==void 0?{min_secrets_version:T}:{}},E);await u.waitForState(f,R.id,"started",{instanceId:P.instance_id})}finally{await u.releaseLease(f,R.id,E)}}async function rg(u,f,R,A){let T=A.find((P)=>P.region===R&&P.name===f.volume.name&&!P.attached_machine_id);if(T)return T.attached_machine_id="pending",T;let E=await u.createVolume(f.app,{name:f.volume.name,region:R,size_gb:f.volume.sizeGb});return A.push({...E,attached_machine_id:"pending"}),E}import{createHmac as Xl,createSign as ng,timingSafeEqual as lg}from"node:crypto";function eo(u){let f=u instanceof Date?u.getTime():u;if(!Number.isFinite(f))throw TypeError("Media access timestamp must be finite");return Math.floor(f/1000)}function Wu(u){return Buffer.from(u).toString("base64").replaceAll("+","-").replaceAll("=","_").replaceAll("/","~")}function dg(u){return Buffer.from(u).toString("base64url")}function Zu(u,f=!1){if(!u||/[\r\n]/.test(u))throw TypeError("Media resource is invalid");let R=f?u.replaceAll("*","wildcard"):u,A=new URL(R);if(!["http:","https:"].includes(A.protocol))throw TypeError("Media resource must use HTTP or HTTPS");if(!f&&u.includes("*"))throw TypeError("Canned policies cannot contain wildcards")}function Ju(u,f){let R=ng("RSA-SHA1");return R.update(u),R.end(),Wu(R.sign(f))}function Yu(u){Zu(u.resource,!0);let R={DateLessThan:{"AWS:EpochTime":eo(u.expiresAt)}};if(u.activeAt!==void 0)R.DateGreaterThan={"AWS:EpochTime":eo(u.activeAt)};if(u.ipAddress)R.IpAddress={"AWS:SourceIp":u.ipAddress};return JSON.stringify({Statement:[{Resource:u.resource,Condition:R}]})}function HS(u,f,R){Zu(u);let A=eo(f),T=u.includes("?")?"&":"?",E=Yu({resource:u,expiresAt:f}),P=Ju(E,R.privateKey);return`${u}${T}Expires=${A}&Signature=${encodeURIComponent(P)}&Key-Pair-Id=${encodeURIComponent(R.keyPairId)}`}function US(u,f){let R=Yu(u);return{"CloudFront-Key-Pair-Id":f.keyPairId,"CloudFront-Policy":Wu(Buffer.from(R)),"CloudFront-Signature":Ju(R,f.privateKey)}}function GS(u){if(!u.resource||/[\r\n]/.test(u.resource))throw TypeError("Media resource is invalid");let f=dg(Buffer.from(JSON.stringify({resource:u.resource,expiresAt:eo(u.expiresAt),...u.keyId?{keyId:u.keyId}:{},...u.audience?{audience:u.audience}:{}}))),R=Xl("sha256",u.secret).update(f).digest("base64url");return`${f}.${R}`}function jS(u,f){let[R,A,T]=u.split(".");if(!R||!A||T)return null;let E=Xl("sha256",f.secret).update(R).digest(),P;try{P=Buffer.from(A,"base64url")}catch{return null}if(E.length!==P.length||!lg(E,P))return null;try{let L=JSON.parse(Buffer.from(R,"base64url").toString("utf8")),z=eo(f.now??Date.now());if(!L.resource||!Number.isSafeInteger(L.expiresAt)||L.expiresAt<=z)return null;if(f.resource&&L.resource!==f.resource)return null;if(f.audience&&L.audience!==f.audience)return null;return L}catch{return null}}function KS(u,f=!1){let R=new URL(u,"https://media.invalid").pathname.toLowerCase(),A=/\.(?:m3u8|mpd|vtt|json)$/.test(R),T=/\.(?:key|license)$/.test(R)||R.includes("/keys/")||R.includes("/licenses/");return{"Accept-Ranges":"bytes","Cache-Control":f&&(A||T)?"private, no-store":A?"public, max-age=5, s-maxage=30, stale-while-revalidate=30":"public, max-age=31536000, immutable","Cross-Origin-Resource-Policy":"cross-origin","X-Content-Type-Options":"nosniff"}}function qS(u){if(!/^[a-z0-9][a-z0-9.-]{1,61}[a-z0-9]$/.test(u.bucket))throw TypeError("Media bucket is invalid");if(!/^[a-z0-9-]+$/.test(u.region))throw TypeError("Media bucket region is invalid");let f=u.prefix?`/${u.prefix.replace(/^\/+|\/+$/g,"")}`:"",R=u.protected??!1,A="public, max-age=31536000, immutable",T=R?"private, no-store":"public, max-age=5, s-maxage=30, stale-while-revalidate=30";return{originDomain:`${u.bucket}.s3.${u.region}.amazonaws.com`,originPath:f,domain:u.domain,trustedKeyGroupIds:[...new Set(u.trustedKeyGroupIds??[])],behaviors:[{pathPattern:"*.m3u8",cacheControl:T,compress:!0,signed:R},{pathPattern:"*.mpd",cacheControl:T,compress:!0,signed:R},{pathPattern:"*.vtt",cacheControl:T,compress:!0,signed:R},{pathPattern:"*",cacheControl:A,compress:!1,signed:R}],responseHeaders:{"Access-Control-Allow-Headers":"Range, If-Range","Access-Control-Allow-Methods":"GET, HEAD, OPTIONS","Access-Control-Allow-Origin":"*","Access-Control-Expose-Headers":"Accept-Ranges, Content-Length, Content-Range, ETag","X-Content-Type-Options":"nosniff"}}}class yg{builder;config;environment;mergedConfig;serverEipLogicalIds=new Map;storageFailoverReplicas=[];constructor(u){this.config=u.config,this.environment=u.environment,this.builder=new sl(`${this.config.project.name} - ${this.environment}`),this.mergedConfig=this.mergeEnvironmentConfig()}mergeEnvironmentConfig(){let f=this.config.environments[this.environment]?.infrastructure;if(!f)return this.config;return{...this.config,infrastructure:{...this.config.infrastructure,...f,compute:{...this.config.infrastructure?.compute,...f.compute},storage:{...this.config.infrastructure?.storage,...f.storage},functions:{...this.config.infrastructure?.functions,...f.functions},servers:{...this.config.infrastructure?.servers,...f.servers},databases:{...this.config.infrastructure?.databases,...f.databases},cdn:{...this.config.infrastructure?.cdn,...f.cdn},sftp:f.sftp??this.config.infrastructure?.sftp,queues:{...this.config.infrastructure?.queues,...f.queues},redirects:{...this.config.infrastructure?.redirects,...f.redirects},realtime:{...this.config.infrastructure?.realtime,...f.realtime},cache:{...this.config.infrastructure?.cache,...f.cache},fileSystem:{...this.config.infrastructure?.fileSystem,...f.fileSystem},email:{...this.config.infrastructure?.email,...f.email},search:{...this.config.infrastructure?.search,...f.search},ai:{...this.config.infrastructure?.ai,...f.ai}}}}shouldDeploy(u){if(u.environments&&!u.environments.includes(this.environment))return!1;if(u.requiresFeatures){let f=this.config.features||{};if(!u.requiresFeatures.every((A)=>f[A]===!0))return!1}if(u.regions){let f=this.config.environments[this.environment]?.region||this.config.project.region;if(!u.regions.includes(f))return!1}if(u.condition&&typeof u.condition==="function")return u.condition(this.config,this.environment);return!0}resolveApiOriginPort(){let u=this.mergedConfig.infrastructure?.api?.port??this.mergedConfig.ports?.api,f=Number(u||3008);return Number.isFinite(f)&&f>0?f:3008}defaultComputeCachePathPatterns(){return["/api/*","/auth/*","/publisher/api/*","/publisher/*","/publish","/publish/*","/analytics/*","/packages/*","/npm/*","/zig/*","/php/*","/commits/*","/health","/dashboard/*","/search","/login","/logout","/signup","/account","/account/*"]}shouldRouteStorageBucketToCompute(u,f){return u==="public"||f.routeCompute===!0}storageBucketName(u,f,R){return this.mergedConfig.infrastructure?.storage?.[R]?.bucket??`${u}-${f}-${R}`}fileSystemLogicalId(u,f,R){return t(r({slug:`${u}-${R}`,environment:f,resourceType:"efs"}))}resolveSftpStorage(u,f,R){let A=u.storage;if(A?.type==="efs"&&A.fileSystem){if(!this.mergedConfig.infrastructure?.fileSystem?.[A.fileSystem])throw Error(`sftp: storage.fileSystem "${A.fileSystem}" is not defined in infrastructure.fileSystem`);return{type:"efs",fileSystemId:{Ref:this.fileSystemLogicalId(f,R,A.fileSystem)},posixProfile:A.posixProfile}}if(A?.type==="s3"&&A.storageBucket){if(!this.mergedConfig.infrastructure?.storage?.[A.storageBucket])throw Error(`sftp: storage.storageBucket "${A.storageBucket}" is not defined in infrastructure.storage`);return{type:"s3",bucket:this.storageBucketName(f,R,A.storageBucket)}}return}resolveComputeCachePathPatterns(u){if(u&&u.length>0)return u;return this.defaultComputeCachePathPatterns()}createComputeCacheBehavior(u,f){return{PathPattern:u,TargetOriginId:f,ViewerProtocolPolicy:"redirect-to-https",AllowedMethods:["GET","HEAD","OPTIONS","PUT","POST","PATCH","DELETE"],CachedMethods:["GET","HEAD"],Compress:!0,CachePolicyId:"4135ea2d-6df8-44a3-9df3-4b5a84be39ad",OriginRequestPolicyId:"b689b0a8-53d0-40ab-baf2-68738e2966ac"}}appendComputeAppOrigin(u,f,R,A,T,E){let P=this.serverEipLogicalIds.get("app"),L=this.serverEipLogicalIds.get("appInstance");if(!P)return;let z=`EC2-${A}-${T}-api`,fe=this.mergedConfig.infrastructure?.servers?.app?.region||this.mergedConfig.project?.region||"us-east-1",me=fe==="us-east-1"?".compute-1.amazonaws.com":`.${fe}.compute.amazonaws.com`,At={"Fn::Join":["",["ec2-",{"Fn::Join":["-",{"Fn::Split":[".",{Ref:P}]}]},me]]},Lt=this.resolveApiOriginPort();if(u.push({Id:z,DomainName:At,CustomOriginConfig:{HTTPPort:Lt,HTTPSPort:443,OriginProtocolPolicy:"http-only",OriginSSLProtocols:["TLSv1.2"]}}),R.push(P),L)R.push(L);for(let mt of E)f.push(this.createComputeCacheBehavior(mt,z))}buildCaddyfile(u){let f=u.filter(([,T])=>typeof T.domain==="string"&&T.domain&&typeof T.port==="number");if(f.length===0)return;let R=new Map;for(let[,T]of f){let E=R.get(T.domain)??[];E.push({port:T.port,path:T.path}),R.set(T.domain,E)}let A=[];for(let[T,E]of R){let L=[...E].sort((z,fe)=>{let me=!z.path||z.path==="/",At=!fe.path||fe.path==="/";if(me&&!At)return 1;if(!me&&At)return-1;return(fe.path?.length??0)-(z.path?.length??0)}).map((z)=>{let fe=!z.path||z.path==="/",me=`reverse_proxy localhost:${z.port}`;return fe?`  handle {
     ${me}
   }`:`  handle ${z.path} {
     ${me}

package/dist/mail/index.js

@@ -1,3 +1,3 @@
-import{b,Xe,zi,an,w}from"../chunk-zvcd6x45.js";import"../chunk-a99wz633.js";import"../chunk-2hma3g5q.js";import{B,R,yt,G}from"../chunk-yt8qgn5d.js";function a(t){return`'${t.replace(/'/g,"'\\''")}'`}function h(t,e="/etc/mail/mail.env",r="/usr/local/bin/bun"){let i={SMTP_ENABLE_WEBMAIL:String(t.webmail.enabled),SMTP_WEBMAIL_PORT:String(t.webmail.port),SMTP_WEBMAIL_TLS:String(t.webmail.tls),SMTP_WEBMAIL_SECURE_COOKIES:String(t.webmail.secureCookies),SMTP_WEBMAIL_ATTACHMENT_MAX_FILE:String(t.webmail.attachmentMaxFileBytes),SMTP_WEBMAIL_ATTACHMENT_MAX_TOTAL:String(t.webmail.attachmentMaxTotalBytes),SMTP_WEBMAIL_ATTACHMENT_MAX_COUNT:String(t.webmail.attachmentMaxCount),SMTP_WEBMAIL_UNDO_SEND_SECONDS:String(t.webmail.undoSendSeconds)},n="const fs=require('node:fs');const path=process.argv[1];const settings=JSON.parse(process.argv[2]);const before=fs.readFileSync(path,'utf8');const lines=before.split(/\\r?\\n/).filter(line=>line!==''&&!Object.hasOwn(settings,line.split('=',1)[0]));const after=lines.concat(Object.entries(settings).map(([key,value])=>key+'='+value)).join('\\n')+'\\n';if(after===before){console.log('unchanged')}else{const stat=fs.statSync(path);const backup=path+'.bak-webmail';fs.copyFileSync(path,backup);fs.chmodSync(backup,stat.mode&511);fs.chownSync(backup,stat.uid,stat.gid);const temporary=path+'.webmail-'+process.pid;fs.writeFileSync(temporary,after,{mode:stat.mode&511});fs.chownSync(temporary,stat.uid,stat.gid);fs.renameSync(temporary,path);console.log('changed')}";return`${a(r)} --eval ${a("const fs=require('node:fs');const path=process.argv[1];const settings=JSON.parse(process.argv[2]);const before=fs.readFileSync(path,'utf8');const lines=before.split(/\\r?\\n/).filter(line=>line!==''&&!Object.hasOwn(settings,line.split('=',1)[0]));const after=lines.concat(Object.entries(settings).map(([key,value])=>key+'='+value)).join('\\n')+'\\n';if(after===before){console.log('unchanged')}else{const stat=fs.statSync(path);const backup=path+'.bak-webmail';fs.copyFileSync(path,backup);fs.chmodSync(backup,stat.mode&511);fs.chownSync(backup,stat.uid,stat.gid);const temporary=path+'.webmail-'+process.pid;fs.writeFileSync(temporary,after,{mode:stat.mode&511});fs.chownSync(temporary,stat.uid,stat.gid);fs.renameSync(temporary,path);console.log('changed')}")} ${a(e)} ${a(JSON.stringify(i))}`}function p(t,e){let r=e.environment??"production",i=b(t,{environment:r});if(!i.enabled||!i.webmail.enabled)return"";if(!i.webmail.domain)throw Error("Mail webmail deployment needs a hostname; set mail.webmail.domain or use compute provisioning for a local catcher");if(i.webmail.tls)throw Error("Gateway webmail uses loopback HTTP: set mail.webmail.tls to false, or domain to false for a direct TLS listener");let n=w(t,{environment:r}),l=e.slug??t.project.slug,s=e.bunBin??"/usr/local/bin/bun",o=e.envFile??"/etc/mail/mail.env",c=e.service??"mail.service",m=e.healthPath??"/login";if(!/^[a-z0-9@._-]+$/i.test(c)||c.startsWith("-"))throw Error("Invalid mail service unit");if(!o.startsWith("/")||!m.startsWith("/")||/[\r\n]/.test(o+m))throw Error("Mail environment path must be absolute and health path must start with /");let g=B({},{proxy:n,slug:l,mail:i}),d=e.gateway!=="provision",u=["set -euo pipefail",`test -f ${a(o)}`,...d?[`test -x ${yt}`,`test -d ${R}/node_modules/@stacksjs/rpx`,...n.onDemandTls?[`test -f ${R}/node_modules/@stacksjs/tlsx/dist/bin/cli.js`]:[]]:[],`__tsc_mail_changed="$(${h(i,o,s)})"`,`if [ "$__tsc_mail_changed" = changed ] || ! systemctl is-active --quiet ${a(c)}; then systemctl restart ${a(c)}; fi`,`curl --fail --silent --show-error --retry 30 --retry-all-errors --retry-delay 1 --max-time 5 ${a(`http://127.0.0.1:${i.webmail.port}${m}`)} >/dev/null`,...G({config:g,proxy:n,slug:l,bunBin:s,tenant:d})];if(e.verify!==!1)for(let f of[i.webmail.domain,...i.webmail.aliases])u.push(`__tsc_mail_status="$(curl --fail --silent --show-error --retry 10 --retry-connrefused --retry-delay 3 --max-time 15 --output /dev/null --write-out '%{http_code}' ${a(`https://${f}${m}`)})"`,`if [ "$__tsc_mail_status" != 200 ]; then echo ${a(`ts-cloud: webmail verification failed for ${f}`)} >&2; exit 1; fi`);return u.push(`echo ${a(`[ts-cloud] Webmail deployed: ${[i.webmail.domain,...i.webmail.aliases].join(", ")}`)}`),`${u.join(`
+import{b,Xe,zi,an,w}from"../chunk-zvcd6x45.js";import"../chunk-a99wz633.js";import"../chunk-2hma3g5q.js";import{B,R,yt,G}from"../chunk-yt8qgn5d.js";function a(t){return`'${t.replace(/'/g,"'\\''")}'`}function h(t,e="/etc/mail/mail.env",r="/usr/local/bin/bun"){let i={SMTP_ENABLE_WEBMAIL:String(t.webmail.enabled),SMTP_WEBMAIL_PORT:String(t.webmail.port),SMTP_WEBMAIL_TLS:String(t.webmail.tls),SMTP_WEBMAIL_SECURE_COOKIES:String(t.webmail.secureCookies),SMTP_WEBMAIL_ATTACHMENT_MAX_FILE:String(t.webmail.attachmentMaxFileBytes),SMTP_WEBMAIL_ATTACHMENT_MAX_TOTAL:String(t.webmail.attachmentMaxTotalBytes),SMTP_WEBMAIL_ATTACHMENT_MAX_COUNT:String(t.webmail.attachmentMaxCount),SMTP_WEBMAIL_UNDO_SEND_SECONDS:String(t.webmail.undoSendSeconds)},s="const fs=require('node:fs');const path=process.argv[1];const settings=JSON.parse(process.argv[2]);const before=fs.readFileSync(path,'utf8');const lines=before.split(/\\r?\\n/).filter(line=>line!==''&&!Object.hasOwn(settings,line.split('=',1)[0]));const after=lines.concat(Object.entries(settings).map(([key,value])=>key+'='+value)).join('\\n')+'\\n';if(after===before){console.log('unchanged')}else{const stat=fs.statSync(path);const backup=path+'.bak-webmail';fs.copyFileSync(path,backup);fs.chmodSync(backup,stat.mode&511);fs.chownSync(backup,stat.uid,stat.gid);const temporary=path+'.webmail-'+process.pid;fs.writeFileSync(temporary,after,{mode:stat.mode&511});fs.chownSync(temporary,stat.uid,stat.gid);fs.chmodSync(temporary,stat.mode&511);fs.renameSync(temporary,path);console.log('changed')}";return`${a(r)} --eval ${a("const fs=require('node:fs');const path=process.argv[1];const settings=JSON.parse(process.argv[2]);const before=fs.readFileSync(path,'utf8');const lines=before.split(/\\r?\\n/).filter(line=>line!==''&&!Object.hasOwn(settings,line.split('=',1)[0]));const after=lines.concat(Object.entries(settings).map(([key,value])=>key+'='+value)).join('\\n')+'\\n';if(after===before){console.log('unchanged')}else{const stat=fs.statSync(path);const backup=path+'.bak-webmail';fs.copyFileSync(path,backup);fs.chmodSync(backup,stat.mode&511);fs.chownSync(backup,stat.uid,stat.gid);const temporary=path+'.webmail-'+process.pid;fs.writeFileSync(temporary,after,{mode:stat.mode&511});fs.chownSync(temporary,stat.uid,stat.gid);fs.chmodSync(temporary,stat.mode&511);fs.renameSync(temporary,path);console.log('changed')}")} ${a(e)} ${a(JSON.stringify(i))}`}function p(t,e){let r=e.environment??"production",i=b(t,{environment:r});if(!i.enabled||!i.webmail.enabled)return"";if(!i.webmail.domain)throw Error("Mail webmail deployment needs a hostname; set mail.webmail.domain or use compute provisioning for a local catcher");if(i.webmail.tls)throw Error("Gateway webmail uses loopback HTTP: set mail.webmail.tls to false, or domain to false for a direct TLS listener");let s=w(t,{environment:r}),o=e.slug??t.project.slug,n=e.bunBin??"/usr/local/bin/bun",l=e.envFile??"/etc/mail/mail.env",c=e.service??"mail.service",m=e.healthPath??"/login";if(!/^[a-z0-9@._-]+$/i.test(c)||c.startsWith("-"))throw Error("Invalid mail service unit");if(!l.startsWith("/")||!m.startsWith("/")||/[\r\n]/.test(l+m))throw Error("Mail environment path must be absolute and health path must start with /");let g=B({},{proxy:s,slug:o,mail:i}),u=e.gateway!=="provision",d=["set -euo pipefail",`test -f ${a(l)}`,...u?[`test -x ${yt}`,`test -d ${R}/node_modules/@stacksjs/rpx`,...s.onDemandTls?[`test -f ${R}/node_modules/@stacksjs/tlsx/dist/bin/cli.js`]:[]]:[],`__tsc_mail_changed="$(${h(i,l,n)})"`,`if [ "$__tsc_mail_changed" = changed ] || ! systemctl is-active --quiet ${a(c)}; then systemctl restart ${a(c)}; fi`,`curl --fail --silent --show-error --retry 30 --retry-all-errors --retry-delay 1 --max-time 5 ${a(`http://127.0.0.1:${i.webmail.port}${m}`)} >/dev/null`,...G({config:g,proxy:s,slug:o,bunBin:n,tenant:u})];if(e.verify!==!1)for(let f of[i.webmail.domain,...i.webmail.aliases])d.push(`__tsc_mail_status="$(curl --fail --silent --show-error --retry 10 --retry-connrefused --retry-delay 3 --max-time 15 --output /dev/null --write-out '%{http_code}' ${a(`https://${f}${m}`)})"`,`if [ "$__tsc_mail_status" != 200 ]; then echo ${a(`ts-cloud: webmail verification failed for ${f}`)} >&2; exit 1; fi`);return d.push(`echo ${a(`[ts-cloud] Webmail deployed: ${[i.webmail.domain,...i.webmail.aliases].join(", ")}`)}`),`${d.join(`
 `)}
-`}async function y(t,e){let r=p(t,e);if(!r)return;if(!/^(?:[a-z_][a-z0-9._-]*@)?[a-z0-9.:[\]_-]+$/i.test(e.target)||e.target.startsWith("-"))throw Error("Invalid SSH target");let i=["ssh","-T","-o","BatchMode=yes","-o","ConnectTimeout=15",...e.sshKeyPath?["-i",e.sshKeyPath]:[],e.target,"bash","-se"],n=Bun.spawn(i,{stdin:new Blob([r]),stdout:"inherit",stderr:"inherit"}),l=setTimeout(()=>n.kill(),e.timeoutMs??300000);try{let s=await n.exited;if(s!==0)throw Error(`Mail webmail deployment failed (SSH exit ${s})`)}finally{clearTimeout(l)}}export{zi as buildMailEnv,p as buildMailWebmailDeploymentScript,h as buildMailWebmailEnvPatch,y as deployMailWebmail,Xe as mailFirewallPorts,an as mailWebmailSites,w as resolveMailProxy,b as resolveMailService};
+`}async function y(t,e){let r=p(t,e);if(!r)return;if(!/^(?:[a-z_][a-z0-9._-]*@)?[a-z0-9.:[\]_-]+$/i.test(e.target)||e.target.startsWith("-"))throw Error("Invalid SSH target");let i=["ssh","-T","-o","BatchMode=yes","-o","ConnectTimeout=15",...e.sshKeyPath?["-i",e.sshKeyPath]:[],e.target,"bash","-se"],s=Bun.spawn(i,{stdin:new Blob([r]),stdout:"inherit",stderr:"inherit"}),o=setTimeout(()=>s.kill(),e.timeoutMs??300000);try{let n=await s.exited;if(n!==0)throw Error(`Mail webmail deployment failed (SSH exit ${n})`)}finally{clearTimeout(o)}}export{zi as buildMailEnv,p as buildMailWebmailDeploymentScript,h as buildMailWebmailEnvPatch,y as deployMailWebmail,Xe as mailFirewallPorts,an as mailWebmailSites,w as resolveMailProxy,b as resolveMailService};

package/dist/ui/404.html

@@ -2,7 +2,7 @@
 <html lang="en" data-theme="dark">
 <head>
   <meta charset="UTF-8">
-  <meta name="stx-build" content="mv9xdluip2fc6n">
+  <meta name="stx-build" content="mvch1e4g6i3djg">
 
 <!-- stx SEO Tags -->
 <meta name="title" content="Page not found · ts-cloud">

package/dist/ui/accept-invitation.html

@@ -1,4 +1,4 @@
-<!DOCTYPE html><html lang="en" data-theme="dark"><head><meta charset="UTF-8"><meta name="stx-build" content="mv9xd6vjq20cwd"><meta name="title" content="stx Project"><meta name="description" content="A website built with stx templating engine"><meta property="og:title" content="stx Project"><meta property="og:description" content="A website built with stx templating engine"><meta property="og:type" content="website"><meta name="twitter:card" content="summary_large_image"><meta name="twitter:title" content="stx Project"><meta name="twitter:description" content="A website built with stx templating engine"><meta name="viewport" content="width=device-width, initial-scale=1.0"><title>ts-cloud - Accept invitation</title><link rel="icon" type="image/svg+xml" href="data:image/svg+xml,%3Csvg xmlns='http://www.w3.org/2000/svg' viewBox='0 0 32 32'%3E%3Crect x='3' y='3' width='26' height='26' rx='8' fill='%235a8be0'/%3E%3C/svg%3E"><link rel="preconnect" href="https://fonts.googleapis.com"><link href="https://fonts.googleapis.com/css2?family=Inter:wght@400;500;600;700;800&display=swap" rel="stylesheet"><link rel="stylesheet" href="/_stx/style.448ab192.css"><style data-stx-cloak>[x-cloak]{display:none !important}</style><link data-crosswind="generated" rel="stylesheet" href="/_stx/crosswind.616c25f3.css"></head><body class="auth-page"><main class="auth-card" id="main-content"><a class="brand" href="/"><span class="dot"></span><span>ts-cloud</span></a><div><span class="context-label">Organization invitation</span><h1>Join your team</h1><p>Choose the dashboard username and password you will use after this invitation is accepted.</p></div><form id="accept-invitation-form" class="auth-form"><div class="field-block"><label for="invite-name">Name</label><input id="invite-name" name="name" autocomplete="name" placeholder="Chris Breuer"></div><div class="field-block"><label for="invite-username">Username</label><input id="invite-username" name="username" autocomplete="username" minlength="2" maxlength="32" required></div><div class="field-block"><label for="invite-password">Password</label><input id="invite-password" name="password" type="password" autocomplete="new-password" minlength="12" required><small>At least 12 characters.</small></div><button class="btn" type="submit">Accept invitation</button><div id="invitation-status" class="auth-status" role="status"></div></form><p class="note">If this link expired or was already used, ask an organization owner to resend the invitation.</p></main> <script data-stx-scoped data-stx-run="always">
+<!DOCTYPE html><html lang="en" data-theme="dark"><head><meta charset="UTF-8"><meta name="stx-build" content="mvch0p1wacfwdd"><meta name="title" content="stx Project"><meta name="description" content="A website built with stx templating engine"><meta property="og:title" content="stx Project"><meta property="og:description" content="A website built with stx templating engine"><meta property="og:type" content="website"><meta name="twitter:card" content="summary_large_image"><meta name="twitter:title" content="stx Project"><meta name="twitter:description" content="A website built with stx templating engine"><meta name="viewport" content="width=device-width, initial-scale=1.0"><title>ts-cloud - Accept invitation</title><link rel="icon" type="image/svg+xml" href="data:image/svg+xml,%3Csvg xmlns='http://www.w3.org/2000/svg' viewBox='0 0 32 32'%3E%3Crect x='3' y='3' width='26' height='26' rx='8' fill='%235a8be0'/%3E%3C/svg%3E"><link rel="preconnect" href="https://fonts.googleapis.com"><link href="https://fonts.googleapis.com/css2?family=Inter:wght@400;500;600;700;800&display=swap" rel="stylesheet"><link rel="stylesheet" href="/_stx/style.448ab192.css"><style data-stx-cloak>[x-cloak]{display:none !important}</style><link data-crosswind="generated" rel="stylesheet" href="/_stx/crosswind.616c25f3.css"></head><body class="auth-page"><main class="auth-card" id="main-content"><a class="brand" href="/"><span class="dot"></span><span>ts-cloud</span></a><div><span class="context-label">Organization invitation</span><h1>Join your team</h1><p>Choose the dashboard username and password you will use after this invitation is accepted.</p></div><form id="accept-invitation-form" class="auth-form"><div class="field-block"><label for="invite-name">Name</label><input id="invite-name" name="name" autocomplete="name" placeholder="Chris Breuer"></div><div class="field-block"><label for="invite-username">Username</label><input id="invite-username" name="username" autocomplete="username" minlength="2" maxlength="32" required></div><div class="field-block"><label for="invite-password">Password</label><input id="invite-password" name="password" type="password" autocomplete="new-password" minlength="12" required><small>At least 12 characters.</small></div><button class="btn" type="submit">Accept invitation</button><div id="invitation-status" class="auth-status" role="status"></div></form><p class="note">If this link expired or was already used, ask an organization owner to resend the invitation.</p></main> <script data-stx-scoped data-stx-run="always">
 ;(function() {
   'use strict';
 (() => {

package/dist/ui/access-denied.html

@@ -1,4 +1,4 @@
-<!DOCTYPE html><html lang="en" data-theme="dark"><head><meta charset="UTF-8"><meta name="stx-build" content="mv9xd6vjq20cwd"><meta name="title" content="Access unavailable · ts-cloud"><meta name="description" content="A website built with stx templating engine"><meta property="og:title" content="Access unavailable · ts-cloud"><meta property="og:description" content="A website built with stx templating engine"><meta property="og:type" content="website"><meta name="twitter:card" content="summary_large_image"><meta name="twitter:title" content="Access unavailable · ts-cloud"><meta name="twitter:description" content="A website built with stx templating engine"> <script data-stx-runtime src="/_stx/runtime.dbee66d1.js"></script> <meta name="viewport" content="width=device-width, initial-scale=1.0"><title>Access unavailable · ts-cloud</title><link rel="icon" type="image/svg+xml" href="data:image/svg+xml,%3Csvg xmlns='http://www.w3.org/2000/svg' viewBox='0 0 32 32'%3E%3Crect x='3' y='3' width='26' height='26' rx='8' fill='%235a8be0'/%3E%3C/svg%3E"><link rel="preconnect" href="https://fonts.googleapis.com"><link href="https://fonts.googleapis.com/css2?family=Inter:wght@400;500;600;700;800&display=swap" rel="stylesheet"><link rel="stylesheet" href="/_stx/style.448ab192.css"><style data-stx-cloak>[x-cloak]{display:none !important}</style><link data-crosswind="generated" rel="stylesheet" href="/_stx/crosswind.906ee17c.css"></head><body data-stx-auto><a data-stx-scope="stx_scope_nav_50" class="skip-link" href="#main-content">Skip to content</a><button class="nav-toggle-button" type="button" aria-label="Open navigation" aria-controls="primary-navigation" aria-expanded="false"><span></span><span></span><span></span></button><button class="nav-scrim" type="button" aria-label="Close navigation"></button><aside class="app-sidebar" id="primary-navigation" aria-label="Primary navigation"><a class="brand" href="/?env=production"><span class="dot"></span><span>ts-cloud</span></a><div class="sidebar-context"><span class="context-label">Project</span><strong>ts-cloud</strong></div><div class="environment-picker" aria-label="Environment"><span class="context-label">Environment</span><details><summary class="environment-current production"><span>PROD</span><strong>production</strong></summary></details></div><button class="command-trigger" type="button" aria-keyshortcuts="Meta+K Control+K"><span>Search resources</span><kbd>⌘ K</kbd></button><div class="nav-groups"><section class="nav-group"><h2>Overview</h2><a class="" href="/?env=production">Dashboard</a><a href="/server/activity?env=production">Activity</a></section><section class="nav-group"><h2>Applications</h2><a class="" href="/server/sites?env=production">Services</a><a class="" href="/server/deployments?env=production">Deployments</a><a class="" href="/server/logs?env=production">Logs</a><a class="" href="/integrations?env=production">Git integrations</a><a class="" href="/applications/new?env=production">Create application</a><a class="" href="/applications/compose?env=production">Compose applications</a></section><section class="nav-group"><h2>Operations</h2><a class="" href="/operations/queue?env=production">Deployment queue</a><a class="" href="/operations/previews?env=production">Preview environments</a><a class="" href="/operations/releases?env=production">Releases & promotion</a><a class="" href="/operations/regions?env=production">Regions & failover</a><a class="" href="/operations/maintenance?env=production">Maintenance & DR</a><a class="" href="/operations/workloads?env=production">Workloads</a><a class="" href="/operations/observability?env=production">Observability</a><a class="" href="/operations/alerts?env=production">Alerts & health</a><a class="" href="/operations/spend?env=production">Spend & budgets</a><a href="/server/metrics?env=production">Metrics</a><a href="/server/services?env=production">Runtime services</a><a class="" href="/operations/jobs?env=production">Workers & schedules</a><a class="" href="/operations/configuration?env=production">Environment &amp; secrets</a><a class="" href="/data/backups?env=production">Backups &amp; recovery</a><a class="" href="/data/volumes?env=production">Persistent volumes</a><a href="/server/actions?env=production">Run operations</a></section><section class="nav-group"><h2>Infrastructure</h2><a class="" href="/infrastructure/topology?env=production">Infrastructure map</a><a class="" href="/data/services?env=production">Data services</a><a class="" href="/data/volumes?env=production">Persistent volumes</a><a href="/server/firewall?env=production">Network & firewall</a><a href="/server/ssh-keys?env=production">SSH keys</a><a class="" href="/server/fleet?env=production">Fleet inventory</a><a class="" href="/server/capacity?env=production">Capacity & placement</a><a href="/security?env=production">Security posture</a><a href="/server/terminal?env=production">Terminal</a></section><section class="nav-group"><h2>Organization</h2><a class="" href="/server/team?env=production">People & access</a><a class="" href="/account/automation?env=production">API & automation</a></section><section class="nav-group"><h2>Account</h2><a class="" href="/account/security?env=production">Sign-in & security</a></section></div><form method="post" action="/api/logout" class="signout"><button type="submit">Sign out</button></form></aside><dialog class="command-palette" aria-labelledby="command-title"><div class="command-search"><span aria-hidden="true">⌕</span><input type="search" placeholder="Search services, domains, deployments…" aria-label="Search resources" autocomplete="off"><button type="button" class="command-close" aria-label="Close search">Esc</button></div><h2 id="command-title" class="sr-only">Search resources and navigation</h2><div class="command-status" role="status">Start typing to search this project.</div><section class="saved-views" aria-labelledby="saved-views-title"><div class="saved-views-heading"><h3 id="saved-views-title">Saved views</h3><form class="save-view-form"><label class="sr-only" for="save-view-name">Saved view name</label><input id="save-view-name" maxlength="64" placeholder="Name this view" autocomplete="off"><button type="submit">Save current filters</button></form></div><div class="saved-view-list"></div></section><form class="tag-result-form"><label for="tag-result-name">Tag selected resource</label><input id="tag-result-name" maxlength="32" placeholder="customer-facing" pattern="[A-Za-z0-9][A-Za-z0-9 -]{0,31}" autocomplete="off"><input class="tag-color" type="color" value="#5a8be0" aria-label="Tag color"><button type="submit">Add tag</button></form><div class="command-results" role="listbox" aria-label="Search results"></div><footer><span>↑ ↓ navigate</span><span>Enter open</span><span>Esc close</span></footer></dialog><div class="context-bar" aria-label="Current scope"><div class="context-path"><div class="context-breadcrumb"><span>ts-cloud</span><i>/</i><strong>production</strong></div><div class="context-filters" aria-label="Active filters"></div></div><span class="scope-safety production">Production scope</span></div> <script data-stx-scoped data-stx-run="always">
+<!DOCTYPE html><html lang="en" data-theme="dark"><head><meta charset="UTF-8"><meta name="stx-build" content="mvch0p1wacfwdd"><meta name="title" content="Access unavailable · ts-cloud"><meta name="description" content="A website built with stx templating engine"><meta property="og:title" content="Access unavailable · ts-cloud"><meta property="og:description" content="A website built with stx templating engine"><meta property="og:type" content="website"><meta name="twitter:card" content="summary_large_image"><meta name="twitter:title" content="Access unavailable · ts-cloud"><meta name="twitter:description" content="A website built with stx templating engine"> <script data-stx-runtime src="/_stx/runtime.dbee66d1.js"></script> <meta name="viewport" content="width=device-width, initial-scale=1.0"><title>Access unavailable · ts-cloud</title><link rel="icon" type="image/svg+xml" href="data:image/svg+xml,%3Csvg xmlns='http://www.w3.org/2000/svg' viewBox='0 0 32 32'%3E%3Crect x='3' y='3' width='26' height='26' rx='8' fill='%235a8be0'/%3E%3C/svg%3E"><link rel="preconnect" href="https://fonts.googleapis.com"><link href="https://fonts.googleapis.com/css2?family=Inter:wght@400;500;600;700;800&display=swap" rel="stylesheet"><link rel="stylesheet" href="/_stx/style.448ab192.css"><style data-stx-cloak>[x-cloak]{display:none !important}</style><link data-crosswind="generated" rel="stylesheet" href="/_stx/crosswind.906ee17c.css"></head><body data-stx-auto><a data-stx-scope="stx_scope_nav_50" class="skip-link" href="#main-content">Skip to content</a><button class="nav-toggle-button" type="button" aria-label="Open navigation" aria-controls="primary-navigation" aria-expanded="false"><span></span><span></span><span></span></button><button class="nav-scrim" type="button" aria-label="Close navigation"></button><aside class="app-sidebar" id="primary-navigation" aria-label="Primary navigation"><a class="brand" href="/?env=production"><span class="dot"></span><span>ts-cloud</span></a><div class="sidebar-context"><span class="context-label">Project</span><strong>ts-cloud</strong></div><div class="environment-picker" aria-label="Environment"><span class="context-label">Environment</span><details><summary class="environment-current production"><span>PROD</span><strong>production</strong></summary></details></div><button class="command-trigger" type="button" aria-keyshortcuts="Meta+K Control+K"><span>Search resources</span><kbd>⌘ K</kbd></button><div class="nav-groups"><section class="nav-group"><h2>Overview</h2><a class="" href="/?env=production">Dashboard</a><a href="/server/activity?env=production">Activity</a></section><section class="nav-group"><h2>Applications</h2><a class="" href="/server/sites?env=production">Services</a><a class="" href="/server/deployments?env=production">Deployments</a><a class="" href="/server/logs?env=production">Logs</a><a class="" href="/integrations?env=production">Git integrations</a><a class="" href="/applications/new?env=production">Create application</a><a class="" href="/applications/compose?env=production">Compose applications</a></section><section class="nav-group"><h2>Operations</h2><a class="" href="/operations/queue?env=production">Deployment queue</a><a class="" href="/operations/previews?env=production">Preview environments</a><a class="" href="/operations/releases?env=production">Releases & promotion</a><a class="" href="/operations/regions?env=production">Regions & failover</a><a class="" href="/operations/maintenance?env=production">Maintenance & DR</a><a class="" href="/operations/workloads?env=production">Workloads</a><a class="" href="/operations/observability?env=production">Observability</a><a class="" href="/operations/alerts?env=production">Alerts & health</a><a class="" href="/operations/spend?env=production">Spend & budgets</a><a href="/server/metrics?env=production">Metrics</a><a href="/server/services?env=production">Runtime services</a><a class="" href="/operations/jobs?env=production">Workers & schedules</a><a class="" href="/operations/configuration?env=production">Environment &amp; secrets</a><a class="" href="/data/backups?env=production">Backups &amp; recovery</a><a class="" href="/data/volumes?env=production">Persistent volumes</a><a href="/server/actions?env=production">Run operations</a></section><section class="nav-group"><h2>Infrastructure</h2><a class="" href="/infrastructure/topology?env=production">Infrastructure map</a><a class="" href="/data/services?env=production">Data services</a><a class="" href="/data/volumes?env=production">Persistent volumes</a><a href="/server/firewall?env=production">Network & firewall</a><a href="/server/ssh-keys?env=production">SSH keys</a><a class="" href="/server/fleet?env=production">Fleet inventory</a><a class="" href="/server/capacity?env=production">Capacity & placement</a><a href="/security?env=production">Security posture</a><a href="/server/terminal?env=production">Terminal</a></section><section class="nav-group"><h2>Organization</h2><a class="" href="/server/team?env=production">People & access</a><a class="" href="/account/automation?env=production">API & automation</a></section><section class="nav-group"><h2>Account</h2><a class="" href="/account/security?env=production">Sign-in & security</a></section></div><form method="post" action="/api/logout" class="signout"><button type="submit">Sign out</button></form></aside><dialog class="command-palette" aria-labelledby="command-title"><div class="command-search"><span aria-hidden="true">⌕</span><input type="search" placeholder="Search services, domains, deployments…" aria-label="Search resources" autocomplete="off"><button type="button" class="command-close" aria-label="Close search">Esc</button></div><h2 id="command-title" class="sr-only">Search resources and navigation</h2><div class="command-status" role="status">Start typing to search this project.</div><section class="saved-views" aria-labelledby="saved-views-title"><div class="saved-views-heading"><h3 id="saved-views-title">Saved views</h3><form class="save-view-form"><label class="sr-only" for="save-view-name">Saved view name</label><input id="save-view-name" maxlength="64" placeholder="Name this view" autocomplete="off"><button type="submit">Save current filters</button></form></div><div class="saved-view-list"></div></section><form class="tag-result-form"><label for="tag-result-name">Tag selected resource</label><input id="tag-result-name" maxlength="32" placeholder="customer-facing" pattern="[A-Za-z0-9][A-Za-z0-9 -]{0,31}" autocomplete="off"><input class="tag-color" type="color" value="#5a8be0" aria-label="Tag color"><button type="submit">Add tag</button></form><div class="command-results" role="listbox" aria-label="Search results"></div><footer><span>↑ ↓ navigate</span><span>Enter open</span><span>Esc close</span></footer></dialog><div class="context-bar" aria-label="Current scope"><div class="context-path"><div class="context-breadcrumb"><span>ts-cloud</span><i>/</i><strong>production</strong></div><div class="context-filters" aria-label="Active filters"></div></div><span class="scope-safety production">Production scope</span></div> <script data-stx-scoped data-stx-run="always">
 (function() {
   var { batch, computed, configureFetch, defineEmits, defineExpose, definePageMeta, defineProps, defineSlots, defineStore, derived, effect, goBack, goForward, inject, invalidateRoute, isDerived, isSignal, navigate, nextTick, onBeforeMount, onBeforeUnmount, onDestroy, onMount, onMounted, onUnmounted, peek, provide, reactive, ref, refresh, registerStoresClient, setRouteParams, state, untrack, useAsync, useClickOutside, useColorMode, useCookie, useCounter, useDark, useDebounce, useDebouncedValue, useEventListener, useFetch, useFocus, useHead, useId, useInterval, useLocalStorage, useMediaQuery, useMutation, useOptimistic, usePreferredContrast, usePreferredDark, usePreferredLight, usePreferredReducedMotion, useQuery, useReactiveProp, useRef, useRoute, useRouteParam, useRouteParams, useScrollLock, useSearchParams, useSeoMeta, useSessionStorage, useSlots, useStore, useThrottle, useTimeout, useToggle, useWebSocket, watch, watchEffect, watchMultiple, withDefaults } = window.stx;
   var __destroyHooks = [];

package/dist/ui/account/automation.html

@@ -1,5 +1,5 @@
-<!DOCTYPE html><html lang="en" data-theme="dark"><head><meta charset="UTF-8"><meta name="stx-build" content="mv9xd6vjq20cwd"><meta name="title" content="stx Project"><meta name="description" content="A website built with stx templating engine"><meta property="og:title" content="stx Project"><meta property="og:description" content="A website built with stx templating engine"><meta property="og:type" content="website"><meta name="twitter:card" content="summary_large_image"><meta name="twitter:title" content="stx Project"><meta name="twitter:description" content="A website built with stx templating engine"> <script data-stx-runtime src="/_stx/runtime.dbee66d1.js"></script> <meta name="viewport" content="width=device-width, initial-scale=1.0"><title>ts-cloud - API &amp; automation</title><link rel="icon" type="image/svg+xml" href="data:image/svg+xml,%3Csvg xmlns='http://www.w3.org/2000/svg' viewBox='0 0 32 32'%3E%3Crect x='3' y='3' width='26' height='26' rx='8' fill='%235a8be0'/%3E%3C/svg%3E"><link rel="preconnect" href="https://fonts.googleapis.com"><link href="https://fonts.googleapis.com/css2?family=Inter:wght@400;500;600;700;800&display=swap" rel="stylesheet"><link rel="stylesheet" href="/_stx/style.448ab192.css"> <script data-stx-scoped>
-function __stx_setup_1792092100788_5() {
+<!DOCTYPE html><html lang="en" data-theme="dark"><head><meta charset="UTF-8"><meta name="stx-build" content="mvch0p1wacfwdd"><meta name="title" content="stx Project"><meta name="description" content="A website built with stx templating engine"><meta property="og:title" content="stx Project"><meta property="og:description" content="A website built with stx templating engine"><meta property="og:type" content="website"><meta name="twitter:card" content="summary_large_image"><meta name="twitter:title" content="stx Project"><meta name="twitter:description" content="A website built with stx templating engine"> <script data-stx-runtime src="/_stx/runtime.dbee66d1.js"></script> <meta name="viewport" content="width=device-width, initial-scale=1.0"><title>ts-cloud - API &amp; automation</title><link rel="icon" type="image/svg+xml" href="data:image/svg+xml,%3Csvg xmlns='http://www.w3.org/2000/svg' viewBox='0 0 32 32'%3E%3Crect x='3' y='3' width='26' height='26' rx='8' fill='%235a8be0'/%3E%3C/svg%3E"><link rel="preconnect" href="https://fonts.googleapis.com"><link href="https://fonts.googleapis.com/css2?family=Inter:wght@400;500;600;700;800&display=swap" rel="stylesheet"><link rel="stylesheet" href="/_stx/style.448ab192.css"> <script data-stx-scoped>
+function __stx_setup_1792246042494_1() {
   const { batch, computed, configureFetch, defineEmits, defineExpose, definePageMeta, defineProps, defineSlots, defineStore, derived, effect, goBack, goForward, inject, invalidateRoute, isDerived, isSignal, navigate, nextTick, onBeforeMount, onBeforeUnmount, onDestroy, onMount, onMounted, onUnmounted, peek, provide, reactive, ref, refresh, registerStoresClient, setRouteParams, state, untrack, useAsync, useClickOutside, useColorMode, useCookie, useCounter, useDark, useDebounce, useDebouncedValue, useEventListener, useFetch, useFocus, useHead, useId, useInterval, useLocalStorage, useMediaQuery, useMutation, useOptimistic, usePreferredContrast, usePreferredDark, usePreferredLight, usePreferredReducedMotion, useQuery, useReactiveProp, useRef, useRoute, useRouteParam, useRouteParams, useScrollLock, useSearchParams, useSeoMeta, useSessionStorage, useSlots, useStore, useThrottle, useTimeout, useToggle, useWebSocket, watch, watchEffect, watchMultiple, withDefaults } = window.stx;
 
 const accounts = state([]);
@@ -189,9 +189,9 @@ onMount(() => {
 
   return { accounts, project, environments, resources, message, messageKind, reveal, accountSlug, accountName, accountRole, accountScopeType, accountScopeId, selectedAccount, tokenName, tokenCapabilities, tokenScopeType, tokenScopeId, tokenExpiry, password, mfaCode, capabilities, setMessage, setScope, scopeLabel, tokenState, toggleCapability, load, selectAccount, stepUp, createAccount, createToken, tokenAction, disableAccount, curlExample, cliExample, copy };
 }
-window.__stx_latestSetup=__stx_setup_1792092100788_5;
-if(window.stx)window.stx._latestSetup=__stx_setup_1792092100788_5;
-</script> <style data-stx-cloak>[x-cloak]{display:none !important}</style><link data-crosswind="generated" rel="stylesheet" href="/_stx/crosswind.906ee17c.css"></head><body data-stx="__stx_setup_1792092100788_5"><a data-stx-scope="stx_scope_nav_6" class="skip-link" href="#main-content">Skip to content</a><button class="nav-toggle-button" type="button" aria-label="Open navigation" aria-controls="primary-navigation" aria-expanded="false"><span></span><span></span><span></span></button><button class="nav-scrim" type="button" aria-label="Close navigation"></button><aside class="app-sidebar" id="primary-navigation" aria-label="Primary navigation"><a class="brand" href="/?env=production"><span class="dot"></span><span>ts-cloud</span></a><div class="sidebar-context"><span class="context-label">Project</span><strong>ts-cloud</strong></div><div class="environment-picker" aria-label="Environment"><span class="context-label">Environment</span><details><summary class="environment-current production"><span>PROD</span><strong>production</strong></summary></details></div><button class="command-trigger" type="button" aria-keyshortcuts="Meta+K Control+K"><span>Search resources</span><kbd>⌘ K</kbd></button><div class="nav-groups"><section class="nav-group"><h2>Overview</h2><a class="" href="/?env=production">Dashboard</a><a href="/server/activity?env=production">Activity</a></section><section class="nav-group"><h2>Applications</h2><a class="" href="/server/sites?env=production">Services</a><a class="" href="/server/deployments?env=production">Deployments</a><a class="" href="/server/logs?env=production">Logs</a><a class="" href="/integrations?env=production">Git integrations</a><a class="" href="/applications/new?env=production">Create application</a><a class="" href="/applications/compose?env=production">Compose applications</a></section><section class="nav-group"><h2>Operations</h2><a class="" href="/operations/queue?env=production">Deployment queue</a><a class="" href="/operations/previews?env=production">Preview environments</a><a class="" href="/operations/releases?env=production">Releases & promotion</a><a class="" href="/operations/regions?env=production">Regions & failover</a><a class="" href="/operations/maintenance?env=production">Maintenance & DR</a><a class="" href="/operations/workloads?env=production">Workloads</a><a class="" href="/operations/observability?env=production">Observability</a><a class="" href="/operations/alerts?env=production">Alerts & health</a><a class="" href="/operations/spend?env=production">Spend & budgets</a><a href="/server/metrics?env=production">Metrics</a><a href="/server/services?env=production">Runtime services</a><a class="" href="/operations/jobs?env=production">Workers & schedules</a><a class="" href="/operations/configuration?env=production">Environment &amp; secrets</a><a class="" href="/data/backups?env=production">Backups &amp; recovery</a><a class="" href="/data/volumes?env=production">Persistent volumes</a><a href="/server/actions?env=production">Run operations</a></section><section class="nav-group"><h2>Infrastructure</h2><a class="" href="/infrastructure/topology?env=production">Infrastructure map</a><a class="" href="/data/services?env=production">Data services</a><a class="" href="/data/volumes?env=production">Persistent volumes</a><a href="/server/firewall?env=production">Network & firewall</a><a href="/server/ssh-keys?env=production">SSH keys</a><a class="" href="/server/fleet?env=production">Fleet inventory</a><a class="" href="/server/capacity?env=production">Capacity & placement</a><a href="/security?env=production">Security posture</a><a href="/server/terminal?env=production">Terminal</a></section><section class="nav-group"><h2>Organization</h2><a class="" href="/server/team?env=production">People & access</a><a class="active" href="/account/automation?env=production">API & automation</a></section><section class="nav-group"><h2>Account</h2><a class="" href="/account/security?env=production">Sign-in & security</a></section></div><form method="post" action="/api/logout" class="signout"><button type="submit">Sign out</button></form></aside><dialog class="command-palette" aria-labelledby="command-title"><div class="command-search"><span aria-hidden="true">⌕</span><input type="search" placeholder="Search services, domains, deployments…" aria-label="Search resources" autocomplete="off"><button type="button" class="command-close" aria-label="Close search">Esc</button></div><h2 id="command-title" class="sr-only">Search resources and navigation</h2><div class="command-status" role="status">Start typing to search this project.</div><section class="saved-views" aria-labelledby="saved-views-title"><div class="saved-views-heading"><h3 id="saved-views-title">Saved views</h3><form class="save-view-form"><label class="sr-only" for="save-view-name">Saved view name</label><input id="save-view-name" maxlength="64" placeholder="Name this view" autocomplete="off"><button type="submit">Save current filters</button></form></div><div class="saved-view-list"></div></section><form class="tag-result-form"><label for="tag-result-name">Tag selected resource</label><input id="tag-result-name" maxlength="32" placeholder="customer-facing" pattern="[A-Za-z0-9][A-Za-z0-9 -]{0,31}" autocomplete="off"><input class="tag-color" type="color" value="#5a8be0" aria-label="Tag color"><button type="submit">Add tag</button></form><div class="command-results" role="listbox" aria-label="Search results"></div><footer><span>↑ ↓ navigate</span><span>Enter open</span><span>Esc close</span></footer></dialog><div class="context-bar" aria-label="Current scope"><div class="context-path"><div class="context-breadcrumb"><span>ts-cloud</span><i>/</i><strong>production</strong></div><div class="context-filters" aria-label="Active filters"></div></div><span class="scope-safety production">Production scope</span></div> <script data-stx-scoped data-stx-run="always">
+window.__stx_latestSetup=__stx_setup_1792246042494_1;
+if(window.stx)window.stx._latestSetup=__stx_setup_1792246042494_1;
+</script> <style data-stx-cloak>[x-cloak]{display:none !important}</style><link data-crosswind="generated" rel="stylesheet" href="/_stx/crosswind.906ee17c.css"></head><body data-stx="__stx_setup_1792246042494_1"><a data-stx-scope="stx_scope_nav_4" class="skip-link" href="#main-content">Skip to content</a><button class="nav-toggle-button" type="button" aria-label="Open navigation" aria-controls="primary-navigation" aria-expanded="false"><span></span><span></span><span></span></button><button class="nav-scrim" type="button" aria-label="Close navigation"></button><aside class="app-sidebar" id="primary-navigation" aria-label="Primary navigation"><a class="brand" href="/?env=production"><span class="dot"></span><span>ts-cloud</span></a><div class="sidebar-context"><span class="context-label">Project</span><strong>ts-cloud</strong></div><div class="environment-picker" aria-label="Environment"><span class="context-label">Environment</span><details><summary class="environment-current production"><span>PROD</span><strong>production</strong></summary></details></div><button class="command-trigger" type="button" aria-keyshortcuts="Meta+K Control+K"><span>Search resources</span><kbd>⌘ K</kbd></button><div class="nav-groups"><section class="nav-group"><h2>Overview</h2><a class="" href="/?env=production">Dashboard</a><a href="/server/activity?env=production">Activity</a></section><section class="nav-group"><h2>Applications</h2><a class="" href="/server/sites?env=production">Services</a><a class="" href="/server/deployments?env=production">Deployments</a><a class="" href="/server/logs?env=production">Logs</a><a class="" href="/integrations?env=production">Git integrations</a><a class="" href="/applications/new?env=production">Create application</a><a class="" href="/applications/compose?env=production">Compose applications</a></section><section class="nav-group"><h2>Operations</h2><a class="" href="/operations/queue?env=production">Deployment queue</a><a class="" href="/operations/previews?env=production">Preview environments</a><a class="" href="/operations/releases?env=production">Releases & promotion</a><a class="" href="/operations/regions?env=production">Regions & failover</a><a class="" href="/operations/maintenance?env=production">Maintenance & DR</a><a class="" href="/operations/workloads?env=production">Workloads</a><a class="" href="/operations/observability?env=production">Observability</a><a class="" href="/operations/alerts?env=production">Alerts & health</a><a class="" href="/operations/spend?env=production">Spend & budgets</a><a href="/server/metrics?env=production">Metrics</a><a href="/server/services?env=production">Runtime services</a><a class="" href="/operations/jobs?env=production">Workers & schedules</a><a class="" href="/operations/configuration?env=production">Environment &amp; secrets</a><a class="" href="/data/backups?env=production">Backups &amp; recovery</a><a class="" href="/data/volumes?env=production">Persistent volumes</a><a href="/server/actions?env=production">Run operations</a></section><section class="nav-group"><h2>Infrastructure</h2><a class="" href="/infrastructure/topology?env=production">Infrastructure map</a><a class="" href="/data/services?env=production">Data services</a><a class="" href="/data/volumes?env=production">Persistent volumes</a><a href="/server/firewall?env=production">Network & firewall</a><a href="/server/ssh-keys?env=production">SSH keys</a><a class="" href="/server/fleet?env=production">Fleet inventory</a><a class="" href="/server/capacity?env=production">Capacity & placement</a><a href="/security?env=production">Security posture</a><a href="/server/terminal?env=production">Terminal</a></section><section class="nav-group"><h2>Organization</h2><a class="" href="/server/team?env=production">People & access</a><a class="active" href="/account/automation?env=production">API & automation</a></section><section class="nav-group"><h2>Account</h2><a class="" href="/account/security?env=production">Sign-in & security</a></section></div><form method="post" action="/api/logout" class="signout"><button type="submit">Sign out</button></form></aside><dialog class="command-palette" aria-labelledby="command-title"><div class="command-search"><span aria-hidden="true">⌕</span><input type="search" placeholder="Search services, domains, deployments…" aria-label="Search resources" autocomplete="off"><button type="button" class="command-close" aria-label="Close search">Esc</button></div><h2 id="command-title" class="sr-only">Search resources and navigation</h2><div class="command-status" role="status">Start typing to search this project.</div><section class="saved-views" aria-labelledby="saved-views-title"><div class="saved-views-heading"><h3 id="saved-views-title">Saved views</h3><form class="save-view-form"><label class="sr-only" for="save-view-name">Saved view name</label><input id="save-view-name" maxlength="64" placeholder="Name this view" autocomplete="off"><button type="submit">Save current filters</button></form></div><div class="saved-view-list"></div></section><form class="tag-result-form"><label for="tag-result-name">Tag selected resource</label><input id="tag-result-name" maxlength="32" placeholder="customer-facing" pattern="[A-Za-z0-9][A-Za-z0-9 -]{0,31}" autocomplete="off"><input class="tag-color" type="color" value="#5a8be0" aria-label="Tag color"><button type="submit">Add tag</button></form><div class="command-results" role="listbox" aria-label="Search results"></div><footer><span>↑ ↓ navigate</span><span>Enter open</span><span>Esc close</span></footer></dialog><div class="context-bar" aria-label="Current scope"><div class="context-path"><div class="context-breadcrumb"><span>ts-cloud</span><i>/</i><strong>production</strong></div><div class="context-filters" aria-label="Active filters"></div></div><span class="scope-safety production">Production scope</span></div> <script data-stx-scoped data-stx-run="always">
 (function() {
   var { batch, computed, configureFetch, defineEmits, defineExpose, definePageMeta, defineProps, defineSlots, defineStore, derived, effect, goBack, goForward, inject, invalidateRoute, isDerived, isSignal, navigate, nextTick, onBeforeMount, onBeforeUnmount, onDestroy, onMount, onMounted, onUnmounted, peek, provide, reactive, ref, refresh, registerStoresClient, setRouteParams, state, untrack, useAsync, useClickOutside, useColorMode, useCookie, useCounter, useDark, useDebounce, useDebouncedValue, useEventListener, useFetch, useFocus, useHead, useId, useInterval, useLocalStorage, useMediaQuery, useMutation, useOptimistic, usePreferredContrast, usePreferredDark, usePreferredLight, usePreferredReducedMotion, useQuery, useReactiveProp, useRef, useRoute, useRouteParam, useRouteParams, useScrollLock, useSearchParams, useSeoMeta, useSessionStorage, useSlots, useStore, useThrottle, useTimeout, useToggle, useWebSocket, watch, watchEffect, watchMultiple, withDefaults } = window.stx;
   var __destroyHooks = [];
@@ -542,6 +542,6 @@ if(window.stx)window.stx._latestSetup=__stx_setup_1792092100788_5;
   
   
   try { if (typeof __stxScopeRenames !== 'undefined' && __stxScopeRenames) { for (var __stxRK in __stxScopeRenames) __scopeRegistration[__stxRK] = __stxScopeRenames[__stxRK]; } } catch (e) { /* no renames */ }
-  window.stx._scopes['stx_scope_nav_6'] = __scopeRegistration;
+  window.stx._scopes['stx_scope_nav_4'] = __scopeRegistration;
 })();
 </script> <div class="wrap"><div class="crumbs"><a href="/">Dashboard</a><span class="sep">/</span> Organization <span class="sep">/</span> API &amp; automation</div><header class="page"><div><h1>API &amp; automation</h1><p>Create least-privilege machine identities for CI. Tokens never create browser sessions and cannot access outside their membership and token scope.</p></div><a class="btn ghost" href="/api/v1/openapi.json">OpenAPI 3.1</a></header><div class="automation-message msg" :class="messageKind()" role="status" aria-live="polite" x-cloak>{{ message() }}</div><div class="panel reveal" @show="!!reveal()" x-cloak><div><strong>Copy this token now</strong><span>The raw secret is shown once. Rotation keeps the old token active until you explicitly revoke it.</span></div><code x-cloak>{{ reveal()?.secret }}</code><button class="btn sm" type="button" @click="copy(reveal()?.secret)">Copy token</button><label>curl</label><code x-cloak>{{ curlExample() }}</code><button class="btn ghost sm" type="button" @click="copy(curlExample())">Copy curl</button><label>CLI</label><code x-cloak>{{ cliExample() }}</code><button class="btn ghost sm" type="button" @click="copy(cliExample())">Copy CLI</button><button class="btn danger sm" type="button" @click="reveal.set(null)">I saved it; hide secret</button></div><div class="section"><h2>Service accounts</h2><div class="accounts" x-cloak><template :for="item in accounts()"><article class="account panel" :class="selectedAccount() === item.account.id ? 'selected' : ''" x-cloak><button class="account-main" type="button" @click="selectAccount(item)" x-cloak><span x-cloak><strong x-cloak>{{ item.account.name }}</strong><small x-cloak>{{ item.account.slug }} · {{ item.membership?.roleTemplate }} · {{ scopeLabel(item.membership?.scope) }}</small><small x-cloak>Created {{ new Date(item.account.createdAt).toLocaleDateString() }} by {{ item.createdBy?.displayName || 'offline administrator' }}</small></span><span class="tag" x-cloak>{{ item.account.state }}</span></button><div class="token-list" x-cloak><template :for="token in item.tokens"><div class="token" x-cloak><div x-cloak><strong x-cloak>{{ token.name }}</strong><code x-cloak>{{ token.prefix }}</code><small x-cloak>{{ tokenState(token) }} · created {{ new Date(token.createdAt).toLocaleDateString() }} by {{ token.createdBy?.displayName || 'offline administrator' }} · expires {{ new Date(token.expiresAt).toLocaleDateString() }} · last used {{ token.lastUsedAt ? new Date(token.lastUsedAt).toLocaleString() : 'never' }}</small><small x-cloak>{{ token.capabilities.join(', ') }} · {{ scopeLabel(token.scope) }}</small></div><div class="table-actions"><button class="btn ghost sm" type="button" @show="token.state === 'active'" @click="tokenAction(token, 'rotate')" x-cloak>Rotate</button><button class="btn danger sm" type="button" @show="token.state === 'active'" @click="tokenAction(token, 'revoke')" x-cloak>Revoke</button></div></div></template><div class="compact empty" @show="item.tokens.length === 0" x-cloak><span>No tokens yet.</span></div></div><button class="btn danger sm" type="button" @show="item.account.state === 'active'" @click="disableAccount(item)" x-cloak>Disable account and tokens</button></article></template><div class="compact empty panel" @show="accounts().length === 0" x-cloak><strong>No service accounts</strong><span>Create one for a CI system or external automation.</span></div></div></div><div class="section"><h2>Create service account</h2><div class="panel"><form class="form-grid" @submit.prevent="createAccount()"><div class="field-block"><label for="account-name">Name</label><input id="account-name" :value="accountName()" @input="accountName.set($event.target.value)" placeholder="Production CI" required></div><div class="field-block"><label for="account-slug">Slug</label><input id="account-slug" :value="accountSlug()" @input="accountSlug.set($event.target.value)" pattern="[a-z0-9][a-z0-9-]{1,47}" placeholder="production-ci" required></div><div class="field-block"><label for="account-role">Maximum role</label><select id="account-role" :value="accountRole()" @change="accountRole.set($event.target.value)"><option value="viewer">Viewer</option><option value="auditor">Auditor</option><option value="deployer">Deployer</option><option value="operator">Operator</option><option value="admin">Admin</option></select><small>Service accounts can never be owners.</small></div><div class="field-block"><label for="account-scope">Maximum scope</label><select id="account-scope" :value="accountScopeType()" @change="accountScopeType.set($event.target.value); setScope($event.target.value, accountScopeId)"><option value="organization">Organization</option><option value="project">Current project</option><option value="environment">One environment</option><option value="resource">One service</option></select></div><div class="field-block" @show="accountScopeType() === 'environment'" x-cloak><label for="account-environment">Environment</label><select id="account-environment" :value="accountScopeId()" @change="accountScopeId.set($event.target.value)"><template :for="environment in environments()"><option :value="environment.id">{{ environment.name }}</option></template></select></div><div class="field-block" @show="accountScopeType() === 'resource'" x-cloak><label for="account-resource">Service</label><select id="account-resource" :value="accountScopeId()" @change="accountScopeId.set($event.target.value)"><template :for="resource in resources()"><option :value="resource.id">{{ resource.name }}</option></template></select></div><div class="form-actions"><button class="btn" type="submit">Create service account</button></div></form></div></div><div class="section"><h2>Create API token</h2><div class="panel"><form class="form-grid" @submit.prevent="createToken()"><div class="field-block"><label for="token-account">Service account</label><select id="token-account" :value="selectedAccount()" @change="selectAccount(accounts().find(item => item.account.id === $event.target.value))" required><template :for="item in accounts()"><option :value="item.account.id" :disabled="item.account.state !== 'active'">{{ item.account.name }}</option></template></select></div><div class="field-block"><label for="token-name">Token name</label><input id="token-name" :value="tokenName()" @input="tokenName.set($event.target.value)" required></div><div class="field-block"><label for="token-expiry">Expiry</label><input id="token-expiry" type="date" :value="tokenExpiry()" @input="tokenExpiry.set($event.target.value)"><small>Defaults to 90 days; maximum one year.</small></div><div class="field-block"><label for="token-scope">Token scope</label><select id="token-scope" :value="tokenScopeType()" @change="tokenScopeType.set($event.target.value); setScope($event.target.value, tokenScopeId)"><option value="organization">Organization</option><option value="project">Current project</option><option value="environment">One environment</option><option value="resource">One service</option></select><small>Must be equal to or narrower than the service-account scope.</small></div><div class="field-block" @show="tokenScopeType() === 'environment'" x-cloak><label>Environment</label><select :value="tokenScopeId()" @change="tokenScopeId.set($event.target.value)"><template :for="environment in environments()"><option :value="environment.id">{{ environment.name }}</option></template></select></div><div class="field-block" @show="tokenScopeType() === 'resource'" x-cloak><label>Service</label><select :value="tokenScopeId()" @change="tokenScopeId.set($event.target.value)"><template :for="resource in resources()"><option :value="resource.id">{{ resource.name }}</option></template></select></div><fieldset class="capabilities"><legend>Explicit capabilities</legend><template :for="capability in capabilities"><label class="capability" x-cloak><input type="checkbox" :checked="tokenCapabilities().includes(capability[0])" @change="toggleCapability(capability[0])"><span x-cloak><b x-cloak>{{ capability[0] }}</b><small x-cloak>{{ capability[1] }}</small></span></label></template></fieldset><div class="form-actions"><button class="btn" type="submit" :disabled="!selectedAccount() || tokenCapabilities().length === 0">Create and reveal token</button></div></form></div></div><div class="section"><h2>Confirm sensitive changes</h2><div class="auth-grid panel"><div class="field-block"><label for="automation-password">Your password</label><input id="automation-password" type="password" autocomplete="current-password" :value="password()" @input="password.set($event.target.value)" required></div><div class="field-block"><label for="automation-code">Authenticator or recovery code</label><input id="automation-code" autocomplete="one-time-code" :value="mfaCode()" @input="mfaCode.set($event.target.value)"><small>Required when MFA is enabled. Used only for recent-auth confirmation.</small></div></div></div></div><style> .automation-message{min-height:20px;margin-top:12px}.accounts{display:grid;gap:12px}.account{display:grid;gap:14px}.account.selected{border-color:var(--accent)} .account-main{display:flex;justify-content:space-between;gap:12px;width:100%;text-align:left;background:none;border:0;color:inherit;cursor:pointer}.account-main span:first-child{display:grid;gap:4px}.account-main small,.token small{color:var(--txt3);font-size:12px;line-height:1.5} .token-list{display:grid;gap:10px}.token{display:flex;justify-content:space-between;gap:14px;padding:12px;border:1px solid var(--panel-br);border-radius:10px}.token>div:first-child{display:grid;gap:4px;min-width:0}.token code{color:var(--txt2)} .reveal{display:grid;grid-template-columns:minmax(0,1fr) auto;gap:10px;margin-top:18px;border-color:rgba(53,209,155,.35)}.reveal>div,.reveal>code,.reveal>label{grid-column:1/-1}.reveal>div{display:grid;gap:4px}.reveal span{color:var(--txt2);font-size:12px}.reveal code{padding:10px;background:rgba(0,0,0,.25);border-radius:8px;overflow-wrap:anywhere;user-select:all} .capabilities{grid-column:1/-1;border:1px solid var(--panel-br);border-radius:10px;padding:12px;display:grid;grid-template-columns:repeat(2,minmax(0,1fr));gap:8px}.capabilities legend{padding:0 6px;color:var(--txt3);font-size:11px;font-weight:800;text-transform:uppercase}.capability{display:flex;gap:9px;align-items:flex-start;padding:9px}.capability input{width:auto;margin-top:3px}.capability span{display:grid;gap:2px}.capability small{color:var(--txt3);font-size:11px}.auth-grid{display:grid;grid-template-columns:1fr 1fr;gap:14px} @media(max-width:700px){.token{display:grid}.reveal,.capabilities,.auth-grid{grid-template-columns:1fr}.reveal>*{grid-column:1}} </style></body></html>

package/dist/ui/account/security.html

@@ -1,4 +1,4 @@
-<!DOCTYPE html><html lang="en" data-theme="dark"><head><meta charset="UTF-8"><meta name="stx-build" content="mv9xd6vjq20cwd"><meta name="title" content="stx Project"><meta name="description" content="A website built with stx templating engine"><meta property="og:title" content="stx Project"><meta property="og:description" content="A website built with stx templating engine"><meta property="og:type" content="website"><meta name="twitter:card" content="summary_large_image"><meta name="twitter:title" content="stx Project"><meta name="twitter:description" content="A website built with stx templating engine"> <script data-stx-runtime src="/_stx/runtime.dbee66d1.js"></script> <meta name="viewport" content="width=device-width, initial-scale=1.0"><title>ts-cloud - Sign-in &amp; security</title><link rel="icon" type="image/svg+xml" href="data:image/svg+xml,%3Csvg xmlns='http://www.w3.org/2000/svg' viewBox='0 0 32 32'%3E%3Crect x='3' y='3' width='26' height='26' rx='8' fill='%235a8be0'/%3E%3C/svg%3E"><link rel="preconnect" href="https://fonts.googleapis.com"><link href="https://fonts.googleapis.com/css2?family=Inter:wght@400;500;600;700;800&display=swap" rel="stylesheet"><link rel="stylesheet" href="/_stx/style.448ab192.css"><style> .security-layout { display: grid; grid-template-columns: minmax(0, 1fr) minmax(280px, .7fr); gap: 18px; align-items: start; } .security-stack { display: grid; gap: 18px; } .security-summary { display: grid; gap: 10px; } .security-summary .kv { padding: 8px 0; } .session-list { display: grid; gap: 10px; } .session-row { display: grid; grid-template-columns: minmax(0, 1fr) auto; gap: 14px; align-items: center; padding: 13px; border: 1px solid var(--panel-br); border-radius: 11px; } .session-copy { display: grid; gap: 4px; min-width: 0; } .session-copy strong, .session-copy span { overflow: hidden; text-overflow: ellipsis; white-space: nowrap; } .session-copy span { color: var(--txt3); font-size: 11px; } .security-form { display: grid; gap: 13px; } .security-form label { display: grid; gap: 6px; color: var(--txt3); font-size: 11px; font-weight: 800; text-transform: uppercase; letter-spacing: .06em; } .security-form input { width: 100%; } .security-status { min-height: 20px; color: var(--txt2); font-size: 12px; } .mfa-secret { display: block; margin: 9px 0; padding: 10px; overflow-wrap: anywhere; border: 1px solid var(--panel-br); border-radius: 9px; background: rgba(255,255,255,.025); color: var(--accent); font: 700 12px var(--mono); } .recovery-codes { display: grid; grid-template-columns: 1fr 1fr; gap: 6px; margin-top: 10px; } .recovery-codes code { padding: 7px; border: 1px solid var(--panel-br); border-radius: 7px; text-align: center; } .hidden { display: none !important; } @media (max-width: 900px) { .security-layout { grid-template-columns: 1fr; } } </style><style data-stx-cloak>[x-cloak]{display:none !important}</style><link data-crosswind="generated" rel="stylesheet" href="/_stx/crosswind.222ed683.css"></head><body data-stx-auto><a data-stx-scope="stx_scope_nav_9" class="skip-link" href="#main-content">Skip to content</a><button class="nav-toggle-button" type="button" aria-label="Open navigation" aria-controls="primary-navigation" aria-expanded="false"><span></span><span></span><span></span></button><button class="nav-scrim" type="button" aria-label="Close navigation"></button><aside class="app-sidebar" id="primary-navigation" aria-label="Primary navigation"><a class="brand" href="/?env=production"><span class="dot"></span><span>ts-cloud</span></a><div class="sidebar-context"><span class="context-label">Project</span><strong>Project</strong></div><div class="environment-picker" aria-label="Environment"><span class="context-label">Environment</span><details><summary class="environment-current production"><span>PROD</span><strong>production</strong></summary></details></div><button class="command-trigger" type="button" aria-keyshortcuts="Meta+K Control+K"><span>Search resources</span><kbd>⌘ K</kbd></button><div class="nav-groups"><section class="nav-group"><h2>Overview</h2><a class="" href="/?env=production">Dashboard</a><a href="/server/activity?env=production">Activity</a></section><section class="nav-group"><h2>Applications</h2><a class="" href="/server/sites?env=production">Services</a><a class="" href="/server/deployments?env=production">Deployments</a><a class="" href="/server/logs?env=production">Logs</a><a class="" href="/integrations?env=production">Git integrations</a><a class="" href="/applications/new?env=production">Create application</a><a class="" href="/applications/compose?env=production">Compose applications</a></section><section class="nav-group"><h2>Operations</h2><a class="" href="/operations/queue?env=production">Deployment queue</a><a class="" href="/operations/previews?env=production">Preview environments</a><a class="" href="/operations/releases?env=production">Releases & promotion</a><a class="" href="/operations/regions?env=production">Regions & failover</a><a class="" href="/operations/maintenance?env=production">Maintenance & DR</a><a class="" href="/operations/workloads?env=production">Workloads</a><a class="" href="/operations/observability?env=production">Observability</a><a class="" href="/operations/alerts?env=production">Alerts & health</a><a class="" href="/operations/spend?env=production">Spend & budgets</a><a href="/server/metrics?env=production">Metrics</a><a href="/server/services?env=production">Runtime services</a><a class="" href="/operations/jobs?env=production">Workers & schedules</a><a class="" href="/operations/configuration?env=production">Environment &amp; secrets</a><a class="" href="/data/backups?env=production">Backups &amp; recovery</a><a class="" href="/data/volumes?env=production">Persistent volumes</a><a href="/server/actions?env=production">Run operations</a></section><section class="nav-group"><h2>Infrastructure</h2><a class="" href="/infrastructure/topology?env=production">Infrastructure map</a><a class="" href="/data/services?env=production">Data services</a><a class="" href="/data/volumes?env=production">Persistent volumes</a><a href="/server/firewall?env=production">Network & firewall</a><a href="/server/ssh-keys?env=production">SSH keys</a><a class="" href="/server/fleet?env=production">Fleet inventory</a><a class="" href="/server/capacity?env=production">Capacity & placement</a><a href="/security?env=production">Security posture</a><a href="/server/terminal?env=production">Terminal</a></section><section class="nav-group"><h2>Organization</h2><a class="" href="/server/team?env=production">People & access</a><a class="" href="/account/automation?env=production">API & automation</a></section><section class="nav-group"><h2>Account</h2><a class="active" href="/account/security?env=production">Sign-in & security</a></section></div><form method="post" action="/api/logout" class="signout"><button type="submit">Sign out</button></form></aside><dialog class="command-palette" aria-labelledby="command-title"><div class="command-search"><span aria-hidden="true">⌕</span><input type="search" placeholder="Search services, domains, deployments…" aria-label="Search resources" autocomplete="off"><button type="button" class="command-close" aria-label="Close search">Esc</button></div><h2 id="command-title" class="sr-only">Search resources and navigation</h2><div class="command-status" role="status">Start typing to search this project.</div><section class="saved-views" aria-labelledby="saved-views-title"><div class="saved-views-heading"><h3 id="saved-views-title">Saved views</h3><form class="save-view-form"><label class="sr-only" for="save-view-name">Saved view name</label><input id="save-view-name" maxlength="64" placeholder="Name this view" autocomplete="off"><button type="submit">Save current filters</button></form></div><div class="saved-view-list"></div></section><form class="tag-result-form"><label for="tag-result-name">Tag selected resource</label><input id="tag-result-name" maxlength="32" placeholder="customer-facing" pattern="[A-Za-z0-9][A-Za-z0-9 -]{0,31}" autocomplete="off"><input class="tag-color" type="color" value="#5a8be0" aria-label="Tag color"><button type="submit">Add tag</button></form><div class="command-results" role="listbox" aria-label="Search results"></div><footer><span>↑ ↓ navigate</span><span>Enter open</span><span>Esc close</span></footer></dialog><div class="context-bar" aria-label="Current scope"><div class="context-path"><div class="context-breadcrumb"><span>Project</span><i>/</i><strong>production</strong></div><div class="context-filters" aria-label="Active filters"></div></div><span class="scope-safety production">Production scope</span></div> <script data-stx-scoped data-stx-run="always">
+<!DOCTYPE html><html lang="en" data-theme="dark"><head><meta charset="UTF-8"><meta name="stx-build" content="mvch0p1wacfwdd"><meta name="title" content="stx Project"><meta name="description" content="A website built with stx templating engine"><meta property="og:title" content="stx Project"><meta property="og:description" content="A website built with stx templating engine"><meta property="og:type" content="website"><meta name="twitter:card" content="summary_large_image"><meta name="twitter:title" content="stx Project"><meta name="twitter:description" content="A website built with stx templating engine"> <script data-stx-runtime src="/_stx/runtime.dbee66d1.js"></script> <meta name="viewport" content="width=device-width, initial-scale=1.0"><title>ts-cloud - Sign-in &amp; security</title><link rel="icon" type="image/svg+xml" href="data:image/svg+xml,%3Csvg xmlns='http://www.w3.org/2000/svg' viewBox='0 0 32 32'%3E%3Crect x='3' y='3' width='26' height='26' rx='8' fill='%235a8be0'/%3E%3C/svg%3E"><link rel="preconnect" href="https://fonts.googleapis.com"><link href="https://fonts.googleapis.com/css2?family=Inter:wght@400;500;600;700;800&display=swap" rel="stylesheet"><link rel="stylesheet" href="/_stx/style.448ab192.css"><style> .security-layout { display: grid; grid-template-columns: minmax(0, 1fr) minmax(280px, .7fr); gap: 18px; align-items: start; } .security-stack { display: grid; gap: 18px; } .security-summary { display: grid; gap: 10px; } .security-summary .kv { padding: 8px 0; } .session-list { display: grid; gap: 10px; } .session-row { display: grid; grid-template-columns: minmax(0, 1fr) auto; gap: 14px; align-items: center; padding: 13px; border: 1px solid var(--panel-br); border-radius: 11px; } .session-copy { display: grid; gap: 4px; min-width: 0; } .session-copy strong, .session-copy span { overflow: hidden; text-overflow: ellipsis; white-space: nowrap; } .session-copy span { color: var(--txt3); font-size: 11px; } .security-form { display: grid; gap: 13px; } .security-form label { display: grid; gap: 6px; color: var(--txt3); font-size: 11px; font-weight: 800; text-transform: uppercase; letter-spacing: .06em; } .security-form input { width: 100%; } .security-status { min-height: 20px; color: var(--txt2); font-size: 12px; } .mfa-secret { display: block; margin: 9px 0; padding: 10px; overflow-wrap: anywhere; border: 1px solid var(--panel-br); border-radius: 9px; background: rgba(255,255,255,.025); color: var(--accent); font: 700 12px var(--mono); } .recovery-codes { display: grid; grid-template-columns: 1fr 1fr; gap: 6px; margin-top: 10px; } .recovery-codes code { padding: 7px; border: 1px solid var(--panel-br); border-radius: 7px; text-align: center; } .hidden { display: none !important; } @media (max-width: 900px) { .security-layout { grid-template-columns: 1fr; } } </style><style data-stx-cloak>[x-cloak]{display:none !important}</style><link data-crosswind="generated" rel="stylesheet" href="/_stx/crosswind.222ed683.css"></head><body data-stx-auto><a data-stx-scope="stx_scope_nav_1" class="skip-link" href="#main-content">Skip to content</a><button class="nav-toggle-button" type="button" aria-label="Open navigation" aria-controls="primary-navigation" aria-expanded="false"><span></span><span></span><span></span></button><button class="nav-scrim" type="button" aria-label="Close navigation"></button><aside class="app-sidebar" id="primary-navigation" aria-label="Primary navigation"><a class="brand" href="/?env=production"><span class="dot"></span><span>ts-cloud</span></a><div class="sidebar-context"><span class="context-label">Project</span><strong>Project</strong></div><div class="environment-picker" aria-label="Environment"><span class="context-label">Environment</span><details><summary class="environment-current production"><span>PROD</span><strong>production</strong></summary></details></div><button class="command-trigger" type="button" aria-keyshortcuts="Meta+K Control+K"><span>Search resources</span><kbd>⌘ K</kbd></button><div class="nav-groups"><section class="nav-group"><h2>Overview</h2><a class="" href="/?env=production">Dashboard</a><a href="/server/activity?env=production">Activity</a></section><section class="nav-group"><h2>Applications</h2><a class="" href="/server/sites?env=production">Services</a><a class="" href="/server/deployments?env=production">Deployments</a><a class="" href="/server/logs?env=production">Logs</a><a class="" href="/integrations?env=production">Git integrations</a><a class="" href="/applications/new?env=production">Create application</a><a class="" href="/applications/compose?env=production">Compose applications</a></section><section class="nav-group"><h2>Operations</h2><a class="" href="/operations/queue?env=production">Deployment queue</a><a class="" href="/operations/previews?env=production">Preview environments</a><a class="" href="/operations/releases?env=production">Releases & promotion</a><a class="" href="/operations/regions?env=production">Regions & failover</a><a class="" href="/operations/maintenance?env=production">Maintenance & DR</a><a class="" href="/operations/workloads?env=production">Workloads</a><a class="" href="/operations/observability?env=production">Observability</a><a class="" href="/operations/alerts?env=production">Alerts & health</a><a class="" href="/operations/spend?env=production">Spend & budgets</a><a href="/server/metrics?env=production">Metrics</a><a href="/server/services?env=production">Runtime services</a><a class="" href="/operations/jobs?env=production">Workers & schedules</a><a class="" href="/operations/configuration?env=production">Environment &amp; secrets</a><a class="" href="/data/backups?env=production">Backups &amp; recovery</a><a class="" href="/data/volumes?env=production">Persistent volumes</a><a href="/server/actions?env=production">Run operations</a></section><section class="nav-group"><h2>Infrastructure</h2><a class="" href="/infrastructure/topology?env=production">Infrastructure map</a><a class="" href="/data/services?env=production">Data services</a><a class="" href="/data/volumes?env=production">Persistent volumes</a><a href="/server/firewall?env=production">Network & firewall</a><a href="/server/ssh-keys?env=production">SSH keys</a><a class="" href="/server/fleet?env=production">Fleet inventory</a><a class="" href="/server/capacity?env=production">Capacity & placement</a><a href="/security?env=production">Security posture</a><a href="/server/terminal?env=production">Terminal</a></section><section class="nav-group"><h2>Organization</h2><a class="" href="/server/team?env=production">People & access</a><a class="" href="/account/automation?env=production">API & automation</a></section><section class="nav-group"><h2>Account</h2><a class="active" href="/account/security?env=production">Sign-in & security</a></section></div><form method="post" action="/api/logout" class="signout"><button type="submit">Sign out</button></form></aside><dialog class="command-palette" aria-labelledby="command-title"><div class="command-search"><span aria-hidden="true">⌕</span><input type="search" placeholder="Search services, domains, deployments…" aria-label="Search resources" autocomplete="off"><button type="button" class="command-close" aria-label="Close search">Esc</button></div><h2 id="command-title" class="sr-only">Search resources and navigation</h2><div class="command-status" role="status">Start typing to search this project.</div><section class="saved-views" aria-labelledby="saved-views-title"><div class="saved-views-heading"><h3 id="saved-views-title">Saved views</h3><form class="save-view-form"><label class="sr-only" for="save-view-name">Saved view name</label><input id="save-view-name" maxlength="64" placeholder="Name this view" autocomplete="off"><button type="submit">Save current filters</button></form></div><div class="saved-view-list"></div></section><form class="tag-result-form"><label for="tag-result-name">Tag selected resource</label><input id="tag-result-name" maxlength="32" placeholder="customer-facing" pattern="[A-Za-z0-9][A-Za-z0-9 -]{0,31}" autocomplete="off"><input class="tag-color" type="color" value="#5a8be0" aria-label="Tag color"><button type="submit">Add tag</button></form><div class="command-results" role="listbox" aria-label="Search results"></div><footer><span>↑ ↓ navigate</span><span>Enter open</span><span>Esc close</span></footer></dialog><div class="context-bar" aria-label="Current scope"><div class="context-path"><div class="context-breadcrumb"><span>Project</span><i>/</i><strong>production</strong></div><div class="context-filters" aria-label="Active filters"></div></div><span class="scope-safety production">Production scope</span></div> <script data-stx-scoped data-stx-run="always">
 (function() {
   var { batch, computed, configureFetch, defineEmits, defineExpose, definePageMeta, defineProps, defineSlots, defineStore, derived, effect, goBack, goForward, inject, invalidateRoute, isDerived, isSignal, navigate, nextTick, onBeforeMount, onBeforeUnmount, onDestroy, onMount, onMounted, onUnmounted, peek, provide, reactive, ref, refresh, registerStoresClient, setRouteParams, state, untrack, useAsync, useClickOutside, useColorMode, useCookie, useCounter, useDark, useDebounce, useDebouncedValue, useEventListener, useFetch, useFocus, useHead, useId, useInterval, useLocalStorage, useMediaQuery, useMutation, useOptimistic, usePreferredContrast, usePreferredDark, usePreferredLight, usePreferredReducedMotion, useQuery, useReactiveProp, useRef, useRoute, useRouteParam, useRouteParams, useScrollLock, useSearchParams, useSeoMeta, useSessionStorage, useSlots, useStore, useThrottle, useTimeout, useToggle, useWebSocket, watch, watchEffect, watchMultiple, withDefaults } = window.stx;
   var __destroyHooks = [];
@@ -349,7 +349,7 @@
   
   
   try { if (typeof __stxScopeRenames !== 'undefined' && __stxScopeRenames) { for (var __stxRK in __stxScopeRenames) __scopeRegistration[__stxRK] = __stxScopeRenames[__stxRK]; } } catch (e) { /* no renames */ }
-  window.stx._scopes['stx_scope_nav_9'] = __scopeRegistration;
+  window.stx._scopes['stx_scope_nav_1'] = __scopeRegistration;
 })();
 </script> <main class="wrap" id="main-content"><div class="crumbs"><a href="/">Account</a><span class="sep">/</span> Sign-in & security</div><header class="page"><div><h1>Sign-in & security</h1><p>Manage your password and review every browser session with access to this account.</p></div></header><div class="security-layout"><div class="security-stack"><section class="panel" aria-labelledby="sessions-title"><div class="section-heading"><div><h2 id="sessions-title">Active sessions</h2><p class="note">Last-used times and device details help you spot unfamiliar access.</p></div><button class="btn ghost sm" id="revoke-others" type="button">Sign out other sessions</button></div><div class="session-list" id="session-list" aria-live="polite"><div class="compact empty"><strong>Loading sessions…</strong></div></div></section></div><div class="security-stack"><section class="panel security-summary" aria-labelledby="identity-title"><h2 id="identity-title">Identity</h2><div class="kv"><span>Username</span><b id="identity-username">—</b></div><div class="kv"><span>Email</span><b id="identity-email">Not configured</b></div><div class="kv"><span>Last sign-in</span><b id="identity-login">—</b></div><div class="kv"><span>Multi-factor authentication</span><b id="identity-mfa">Loading…</b></div><details><summary>Confirm identity for sensitive changes</summary><form class="security-form" id="step-up-form"><label>Current password<input name="password" type="password" autocomplete="current-password" required></label><label>Authenticator or recovery code (when enabled)<input name="code" autocomplete="one-time-code"></label><button class="btn ghost" type="submit">Confirm identity</button><div class="security-status" id="step-up-status" role="status"></div></form></details></section><section class="panel" aria-labelledby="mfa-title"><h2 id="mfa-title">Authenticator app</h2><p class="note" id="mfa-copy">Add a time-based code as a second sign-in factor.</p><form class="security-form" id="mfa-enroll-form"><label>Current password<input name="password" type="password" autocomplete="current-password" required></label><button class="btn" type="submit">Set up authenticator</button></form><form class="hidden security-form" id="mfa-verify-form"><p class="note">Add this secret or setup URI to your authenticator app, then enter its six-digit code.</p><code class="mfa-secret" id="mfa-secret"></code><details><summary>Show full setup URI</summary><code class="mfa-secret" id="mfa-uri"></code></details><label>Six-digit code<input name="code" inputmode="numeric" autocomplete="one-time-code" pattern="[0-9]{6}" required></label><button class="btn" type="submit">Verify and enable</button></form><form class="hidden security-form" id="mfa-disable-form"><label>Current password<input name="password" type="password" autocomplete="current-password" required></label><label>Authenticator or recovery code<input name="code" autocomplete="one-time-code" required></label><button class="btn danger" type="submit">Disable MFA</button></form><div class="hidden recovery-codes" id="recovery-codes" aria-label="Recovery codes"></div><div class="security-status" id="mfa-status" role="status"></div></section><section class="panel" aria-labelledby="password-title"><h2 id="password-title">Change password</h2><p class="note">Changing your password rotates this session and immediately signs out every other session.</p><form class="security-form" id="password-form"><label>Current password<input name="currentPassword" type="password" autocomplete="current-password" required></label><label>New password<input name="password" type="password" autocomplete="new-password" minlength="12" required></label><label>Confirm new password<input name="confirmation" type="password" autocomplete="new-password" minlength="12" required></label><button class="btn" type="submit">Change password</button><div class="security-status" id="password-status" role="status"></div></form></section></div></div></main> <script data-stx-scoped data-stx-run="always">
 ;(function() {