@stacksjs/ts-cloud 0.16.57 → 0.16.58

package/dist/bin/dashboard-server.js

@@ -1 +1 @@
-import"./chunk-rqvrjp8g.js";import"./chunk-z6xnegpe.js";import"./chunk-dg8ceycc.js";import"./chunk-jxm62h8r.js";import{dr}from"./chunk-mn3x457v.js";import"./chunk-0xfy78nc.js";import"./chunk-7cactd6c.js";import"./chunk-95djv2ja.js";import"./chunk-hkx5j0bn.js";import"./chunk-s59x3psv.js";import"./chunk-rbyrd9we.js";import"./chunk-28124w0n.js";import"./chunk-9t78j764.js";import"./chunk-n2jh5p5x.js";import"./chunk-nva480hg.js";import"./chunk-mdcv2vw1.js";import"./chunk-4crz28b9.js";import"./chunk-p23wfy3r.js";import"./chunk-sy4zws71.js";import"./chunk-k1kk78qg.js";import"./chunk-1q6wqzh1.js";import"./chunk-ek27709c.js";import"./chunk-jyvr7eh5.js";import"./chunk-cdseg15k.js";import"./chunk-gr1ra9nj.js";import"./chunk-3mhzd931.js";import"./chunk-jvbe549p.js";import n from"node:process";function r(o){let e=n.argv.indexOf(o);return e===-1?void 0:n.argv[e+1]}function t(o){return n.argv.includes(o)}async function i(){let o=await dr({host:r("--host")??"127.0.0.1",port:Number(r("--port")??7676),environment:r("--env"),box:t("--box"),verbose:t("--verbose")});console.log("ts-cloud Local Dashboard"),console.log(`Serving ${o.url}`),await new Promise((e)=>{let s=()=>{o.server.stop(!0),e()};n.once("SIGINT",s),n.once("SIGTERM",s)})}i();
+import"./chunk-t8qzx4ka.js";import"./chunk-z6xnegpe.js";import"./chunk-qvrfaeqq.js";import"./chunk-8t01yv89.js";import{dr}from"./chunk-p1eqv66t.js";import"./chunk-0xfy78nc.js";import"./chunk-7cactd6c.js";import"./chunk-95djv2ja.js";import"./chunk-vmrkqtch.js";import"./chunk-9292d4yb.js";import"./chunk-rbyrd9we.js";import"./chunk-zp1cxtbh.js";import"./chunk-9t78j764.js";import"./chunk-n2jh5p5x.js";import"./chunk-nva480hg.js";import"./chunk-mdcv2vw1.js";import"./chunk-4crz28b9.js";import"./chunk-p23wfy3r.js";import"./chunk-sy4zws71.js";import"./chunk-ebhfg18g.js";import"./chunk-1gznb7bh.js";import"./chunk-zpjy26jk.js";import"./chunk-wzpsq446.js";import"./chunk-37aphhk9.js";import"./chunk-gr1ra9nj.js";import"./chunk-3mhzd931.js";import"./chunk-jvbe549p.js";import n from"node:process";function r(o){let e=n.argv.indexOf(o);return e===-1?void 0:n.argv[e+1]}function t(o){return n.argv.includes(o)}async function i(){let o=await dr({host:r("--host")??"127.0.0.1",port:Number(r("--port")??7676),environment:r("--env"),box:t("--box"),verbose:t("--verbose")});console.log("ts-cloud Local Dashboard"),console.log(`Serving ${o.url}`),await new Promise((e)=>{let s=()=>{o.server.stop(!0),e()};n.once("SIGINT",s),n.once("SIGTERM",s)})}i();

package/dist/{chunk-r3qpx6xp.js → chunk-4f0b21fp.js}

@@ -643,9 +643,9 @@ EOF`,'echo "DISKPCT=${DISKPCT:-0}"','echo "DISKUSEDG=${DISKUSEDG:-0}"','echo "DI
   })
 </script>
 </body>
-</html>`}var Hb={info:()=>{},warn:()=>{},error:()=>{},step:()=>{},success:()=>{}};async function Kb(e){return await e.driver.findComputeTargets({slug:e.slug,environment:e.environment,role:e.role||"app"})}async function Jb(e,t){let r=e.logger||Hb,a=await Kb(e);if(a.length===0)return{success:!1,error:`No '${e.role||"app"}' servers found for ${e.slug}/${e.environment}.`};let u=U(e.slug,t.siteName),m=Wt(u,t.to||"unused"),f=t.onlyIfLive?u_(m.current,t.siteName,t.onlyIfLive):[];if(t.dryRun){let y=await e.driver.runRemoteDeploy({targets:a,commands:["set -uo pipefail",...f,...Og(m,t.to?{to:t.to}:{})],comment:`ts-cloud rollback plan ${e.slug}/${t.siteName}`,tags:{Project:e.slug,Environment:e.environment,Role:e.role||"app"}});return{success:y.success,error:y.error,perInstance:y.perInstance}}let b=["set -uo pipefail",...f,..._g(m,{...t.to?{to:t.to}:{},unitBase:`${e.slug}-${t.siteName}`}),`(cd ${T} && pantry restart php-fpm) 2>/dev/null || true`,`(cd ${m.current} && eval "$(cd ${T} && pantry env 2>/dev/null)" && php artisan queue:restart) 2>/dev/null || true`];r.step(`Rolling back ${t.siteName}${t.to?` to ${t.to}`:" to the previous release"} on ${a.length} server(s)...`);let w=await e.driver.runRemoteDeploy({targets:a,commands:b,comment:`ts-cloud rollback ${e.slug}/${t.siteName}`,tags:{Project:e.slug,Environment:e.environment,Role:e.role||"app"}});if(!w.success)r.error(`Rollback failed: ${w.error||"unknown error"}`);else r.success(`Rolled back ${t.siteName}.`);return{success:w.success,error:w.error,perInstance:w.perInstance}}function u_(e,t,r){let a=r.replace(/[^0-9A-Za-z._-]/g,"");return[`TS_CLOUD_LIVE_ID=$(basename "$(readlink -f ${e} 2>/dev/null)" 2>/dev/null || true)`,`if [ -z "$TS_CLOUD_LIVE_ID" ] || [ "$TS_CLOUD_LIVE_ID" = "." ]; then echo "${t}: no live release here; left alone"; exit 0; fi`,`case "${a}" in "$TS_CLOUD_LIVE_ID"*) ;; *) echo "${t} serves $TS_CLOUD_LIVE_ID, not ${a}; left alone"; exit 0 ;; esac`]}async function Gb(e,t){let r=e.logger||Hb;if(!t.database?.name)return{success:!1,error:"No appDatabase configured to restore."};let a=await Kb(e);if(a.length===0)return{success:!1,error:`No '${e.role||"app"}' servers found for ${e.slug}/${e.environment}.`};r.step(`Restoring database '${t.database.name}'${t.from?` from ${t.from}`:" from the latest backup"} on ${a.length} server(s)...`);let u=await e.driver.runRemoteDeploy({targets:a,commands:xg(t.database,{from:t.from}),comment:`ts-cloud db:restore ${e.slug}/${t.database.name}`,tags:{Project:e.slug,Environment:e.environment,Role:e.role||"app"}});if(!u.success)r.error(`Restore failed: ${u.error||"unknown error"}`);else r.success(`Restored ${t.database.name}.`);return{success:u.success,error:u.error,perInstance:u.perInstance}}var p_=["restart","reload","start","stop","enable","disable"],Qb=65536;function Ms(e){return e.length<=Qb?e:`${e.slice(0,Qb)}
+</html>`}var Hb={info:()=>{},warn:()=>{},error:()=>{},step:()=>{},success:()=>{}};async function Kb(e){return await e.driver.findComputeTargets({slug:e.slug,environment:e.environment,role:e.role||"app"})}async function Jb(e,t){let r=e.logger||Hb,a=await Kb(e);if(a.length===0)return{success:!1,error:`No '${e.role||"app"}' servers found for ${e.slug}/${e.environment}.`};let u=U(e.slug,t.siteName),m=Wt(u,t.to||"unused"),f=t.onlyIfLive?u_(m.current,t.siteName,t.onlyIfLive):[];if(t.dryRun){let y=await e.driver.runRemoteDeploy({targets:a,commands:["set -uo pipefail",...f,...Og(m,t.to?{to:t.to}:{})],comment:`ts-cloud rollback plan ${e.slug}/${t.siteName}`,tags:{Project:e.slug,Environment:e.environment,Role:e.role||"app"}});return{success:y.success,error:y.error,perInstance:y.perInstance}}let b=["set -euo pipefail",...f,..._g(m,{...t.to?{to:t.to}:{},unitBase:`${e.slug}-${t.siteName}`})];if(t.site&&d(t.site)==="server-php")b.push(`(cd ${T} && pantry restart php-fpm)`,`if [ -f ${m.current}/artisan ]; then (cd ${m.current} && TS_CLOUD_RB_ENV=$(cd ${T} && pantry env) && eval "$TS_CLOUD_RB_ENV" && php artisan queue:restart); fi`);r.step(`Rolling back ${t.siteName}${t.to?` to ${t.to}`:" to the previous release"} on ${a.length} server(s)...`);let w=await e.driver.runRemoteDeploy({targets:a,commands:b,comment:`ts-cloud rollback ${e.slug}/${t.siteName}`,tags:{Project:e.slug,Environment:e.environment,Role:e.role||"app"}});if(!w.success)r.error(`Rollback failed: ${w.error||"unknown error"}`);else r.success(`Rolled back ${t.siteName}.`);return{success:w.success,error:w.error,perInstance:w.perInstance}}function u_(e,t,r){let a=r.replace(/[^0-9A-Za-z._-]/g,"");return[`TS_CLOUD_LIVE_ID=$(basename "$(readlink -f ${e} 2>/dev/null)" 2>/dev/null || true)`,`if [ -z "$TS_CLOUD_LIVE_ID" ] || [ "$TS_CLOUD_LIVE_ID" = "." ]; then echo "${t}: no live release here; left alone"; exit 0; fi`,`case "${a}" in "$TS_CLOUD_LIVE_ID"*) ;; *) echo "${t} serves $TS_CLOUD_LIVE_ID, not ${a}; left alone"; exit 0 ;; esac`]}async function Gb(e,t){let r=e.logger||Hb;if(!t.database?.name)return{success:!1,error:"No appDatabase configured to restore."};let a=await Kb(e);if(a.length===0)return{success:!1,error:`No '${e.role||"app"}' servers found for ${e.slug}/${e.environment}.`};r.step(`Restoring database '${t.database.name}'${t.from?` from ${t.from}`:" from the latest backup"} on ${a.length} server(s)...`);let u=await e.driver.runRemoteDeploy({targets:a,commands:xg(t.database,{from:t.from}),comment:`ts-cloud db:restore ${e.slug}/${t.database.name}`,tags:{Project:e.slug,Environment:e.environment,Role:e.role||"app"}});if(!u.success)r.error(`Restore failed: ${u.error||"unknown error"}`);else r.success(`Restored ${t.database.name}.`);return{success:u.success,error:u.error,perInstance:u.perInstance}}var p_=["restart","reload","start","stop","enable","disable"],Qb=65536;function Ms(e){return e.length<=Qb?e:`${e.slice(0,Qb)}
 
-[output truncated]`}function g_(e){return/^[A-Za-z0-9_.@:-]+$/.test(e)}function cm(e){return/^[A-Za-z0-9_-]+$/.test(e)}function m_(e){return e.charAt(0).toUpperCase()+e.slice(1)}function cl(e,t){let r=[],a=t.servicesDetail??t.services??[];for(let f of a){let b=String(f?.name??"");if(!b||!g_(b))continue;for(let w of p_)r.push({id:`${w}:${b}`,label:`${m_(w)} ${b}`,group:"service",target:b,mutates:!0,confirm:b,danger:w==="stop"||w==="disable"})}for(let[f,b]of Object.entries(e.sites??{})){if(!b||!cm(f))continue;let w=d(b);if(w==="server-app"||w==="server-php")r.push({id:`rollback:${f}`,label:`Rollback ${f}`,group:"deploy",target:f,mutates:!0,confirm:f,danger:!0})}let u=new Set;for(let f of t.workers??[]){let b=String(f?.name??"").split(":")[0];if(b&&cm(b))u.add(b)}for(let f of u)r.push({id:`worker:restart:${f}`,label:`Restart workers (${f})`,group:"worker",target:f,mutates:!0,confirm:f});for(let[f,b]of Object.entries(e.sites??{})){if(!b||!cm(f))continue;if(b.scheduler||b.schedule){let w=Ur(b)==="laravel";r.push({id:`scheduler:run:${f}`,label:`${w?"Run":"Restart"} scheduler (${f})`,group:"scheduler",target:f,mutates:!0,confirm:f})}}if(e.infrastructure?.compute?.backups?.enabled){if(r.push({id:"backup:run",label:"Run backup now",group:"backup",target:"backup",mutates:!0,confirm:"backup"}),g(e))r.push({id:"backup:restore",label:"Restore latest DB backup",group:"backup",target:"database",mutates:!0,confirm:"restore",danger:!0})}return r}function dm(e,t,r){return cl(t,r).find((a)=>a.id===e)}function f_(e,t){let r=e==="enable"||e==="disable"?`systemctl is-enabled ${t} 2>/dev/null || true`:`systemctl is-active ${t} 2>/dev/null || true`;return["set -o pipefail",`systemctl ${e} ${t}`,r]}function h_(){return`eval "$(cd ${T} && pantry env 2>/dev/null)"`}function Zb(e,t,r){let a=`${U(e,t)}/current`;return["set -uo pipefail",`[ -d ${a} ] || { echo "site ${t} has no current release" >&2; exit 1; }`,`cd ${a} && ${h_()} && php artisan ${r}`]}function y_(e,t,r){if(e==="laravel")return Zb(t,r,"queue:restart");let a=`${t}-${r}-queue-*.service`;return["set -uo pipefail",`units=$(systemctl list-units --type=service --all --no-legend '${a}' 2>/dev/null | awk '{print $1}')`,`[ -n "$units" ] || { echo "no queue-worker units found for ${r} (${a})" >&2; exit 1; }`,"systemctl restart $units",`systemctl --no-legend --type=service list-units '${a}' 2>/dev/null || true`]}function v_(e,t,r){if(e==="laravel")return Zb(t,r,"schedule:run");let a=`${t}-${r}-scheduler.service`;return["set -uo pipefail",`systemctl restart ${a}`,`systemctl is-active ${a} 2>/dev/null || true`]}function b_(){return["set -uo pipefail",`[ -x ${Nr} ] || { echo "scheduled backups are not provisioned on this server" >&2; exit 1; }`,Nr]}function Yb(e,t,r){return{operation:e,command:t,ok:r.success,stdout:Ms(r.perInstance?.[0]?.output??""),stderr:Ms(r.perInstance?.[0]?.error??r.error??"")}}async function dl(e,t,r,a={}){let u=e.project.slug,m;try{m=F({config:e})}catch(A){return{operation:r.id,ok:!1,error:`Could not initialize the cloud driver: ${A?.message??A}`}}let f={driver:m,slug:u,environment:t,role:"app"};if(r.group==="deploy"){let A=a.to&&/^[A-Za-z0-9._-]+$/.test(a.to)?a.to:void 0,D=await Jb(f,{siteName:r.target,to:A});return Yb(r.id,`rollback ${r.target}${A?` → ${A}`:""}`,D)}if(r.id==="backup:restore"){let A=await Gb(f,{database:g(e)});return Yb(r.id,"db restore",A)}let b=await m.findComputeTargets({slug:u,environment:t,role:"app"});if(!b.length)return{operation:r.id,ok:!1,error:"No app server target was found for this environment."};let w,y;if(r.group==="service"){let[A,...D]=r.id.split(":");w=f_(A,D.join(":")),y=`systemctl ${A} ${r.target}`}else if(r.group==="worker"){let A=Ur(e.sites?.[r.target]??{});w=y_(A,u,r.target),y=A==="laravel"?`queue:restart (${r.target})`:`restart queue units (${r.target})`}else if(r.group==="scheduler"){let A=Ur(e.sites?.[r.target]??{});w=v_(A,u,r.target),y=A==="laravel"?`schedule:run (${r.target})`:`restart scheduler (${r.target})`}else if(r.id==="backup:run")w=b_(),y="ts-cloud backup";else return{operation:r.id,ok:!1,error:"Unknown operation."};let I=await m.runRemoteDeploy({targets:[b[0]],commands:w,comment:`ts-cloud dashboard:${r.id}`,tags:{Project:u,Environment:t,Role:"app"}});return{operation:r.id,command:y,ok:I.success,stdout:Ms(I.perInstance?.[0]?.output??""),stderr:Ms(I.perInstance?.[0]?.error??I.error??"")}}async function vc(e,t,r){let a=r.trim();if(!a)return{operation:"command",ok:!1,error:"A command is required."};let u;try{u=F({config:e})}catch(w){return{operation:"command",ok:!1,error:`Could not initialize the cloud driver: ${w?.message??w}`}}let m=e.project.slug,f=await u.findComputeTargets({slug:m,environment:t,role:"app"});if(!f.length)return{operation:"command",ok:!1,error:"No app server target was found for this environment."};let b=await u.runRemoteDeploy({targets:[f[0]],commands:["set -o pipefail",a],comment:"ts-cloud dashboard:command",tags:{Project:m,Environment:t,Role:"app"}});return{operation:"command",command:a,ok:b.success,stdout:Ms(b.perInstance?.[0]?.output??""),stderr:Ms(b.perInstance?.[0]?.error??b.error??"")}}function S_(e,t){return[`${e}-${t}`,`${e}-${t}-queues`,`${e}-${t}-daemons`]}function Xb(e,t,r){return r.some((a)=>S_(t,a).includes(e))}function lm(e,t){let{user:r,slug:a}=t;if(r.role==="admin")return e;let u=(e.sites??[]).map((M)=>M.name).filter(Boolean),m=Kg(r,u),f=new Set(m),b=(e.sites??[]).filter((M)=>f.has(M.name)),w=(e.sitesDetail??[]).filter((M)=>f.has(M.name)),y=new Set(w.map((M)=>M.domain).filter(Boolean)),I=(e.serverDeploymentsDetail??e.serverDeployments??[]).filter((M)=>f.has(M.site)),A=(e.serverLogs??[]).filter((M)=>Xb(M.source,a,m)),D=(e.security?.tlsCertificates??[]).filter((M)=>y.has(M.domain)),O=(e.activity??[]).filter((M)=>{if(M.type==="deploy")return m.some((z)=>String(M.title??"").startsWith(`${z} `));if(M.type==="log")return Xb(String(M.title??"").split(" ")[0],a,m);return!1});return{mode:e.mode,environment:e.environment,environments:e.environments,scoped:!0,server:{name:""},sites:b,sitesDetail:w,workers:(e.workers??[]).filter((M)=>f.has(M.site)),serverDeployments:I.slice(0,5),serverDeploymentsDetail:I.slice(0,50),deploymentsEmptyReason:I.length?void 0:"No deployments have been recorded for your sites yet.",serverLogs:A,serverLogsEmptyReason:A.length?void 0:"No recent log entries for your sites.",security:{tlsCertificates:D,ports:[],firewall:null,authEvents:[]},diagnostics:(e.diagnostics??[]).filter((M)=>["Route conflicts","TLS certificates"].includes(M.name)),activity:O}}function eS(e,t){if(t.role==="admin")return e;let r=new Set(Kg(t,Object.keys(e.sites??{})));return{project:{name:e.project?.name},environment:e.environment,environments:e.environments,sites:Object.fromEntries(Object.entries(e.sites??{}).filter(([a])=>r.has(a)))}}function tS(e){let t=new RegExp("[\\u007F-\\uFFFF]","g");return JSON.stringify(e).replace(t,(r)=>`\\u${r.charCodeAt(0).toString(16).padStart(4,"0")}`)}var w_=new Set(["name","ssl","env","redirects","aliases","domain","path"]),rS={build:"build runs as a shell command on the server",start:"start runs as a shell command on the server",root:"root is a filesystem path on the shared server",port:"ports are allocated by the server owner",type:"the deploy type is set by the server owner",php:"the PHP runtime is set by the server owner"};function iS(e){let t=Object.keys(e).filter((u)=>e[u]!==void 0),r=t.filter((u)=>(u in rS));if(r.length)return{ok:!1,error:`Only the server owner can change ${r.map((m)=>`${m} (${rS[m]})`).join(", ")}.`};let a=t.filter((u)=>!w_.has(u));if(a.length)return{ok:!1,error:`Only the server owner can change ${a.join(", ")}.`};return{ok:!0}}function ul(e){return String(e??"").trim().toLowerCase().replace(/\.$/,"")}function nS(e){let t=String(e??"/").trim();if(!t||t==="/")return"/";return(t.startsWith("/")?t:`/${t}`).replace(/\/+$/,"")||"/"}function k_(e){let t=[ul(e?.domain)];if(Array.isArray(e?.aliases))t.push(...e.aliases.map(ul));return t.filter(Boolean)}function oS({siteName:e,body:t,sites:r,ownSites:a}){let u=r[e]??{},m=new Set(a),f=new Set;if(t.domain!==void 0)f.add(ul(t.domain));if(Array.isArray(t.aliases))for(let w of t.aliases)f.add(ul(w));if(f.delete(""),f.size===0)return{ok:!0};let b=nS(t.path!==void 0?t.path:u.path);for(let[w,y]of Object.entries(r)){if(w===e||m.has(w))continue;let I=nS(y?.path);for(let A of k_(y)){if(!f.has(A))continue;if(I===b)return{ok:!1,error:`${A}${b==="/"?"":b} is already served by another site on this server.`}}}return{ok:!0}}class bc{maxAttempts;lockoutMs;windowMs;attempts=new Map;constructor(e=8,t=900000,r=900000){this.maxAttempts=e;this.lockoutMs=t;this.windowMs=r}key(e,t){return`${e.trim().toLowerCase()}\x00${t}`}check(e,t,r=Date.now()){let a=this.attempts.get(this.key(e,t));if(!a?.until)return{allowed:!0};if(r>=a.until)return this.attempts.delete(this.key(e,t)),{allowed:!0};return{allowed:!1,retryAfterSeconds:Math.ceil((a.until-r)/1000)}}recordFailure(e,t,r=Date.now()){let a=this.key(e,t),u=this.attempts.get(a),f=!u||r-u.last>this.windowMs?1:u.count+1,b={count:f,last:r};if(f>=this.maxAttempts)b.until=r+this.lockoutMs;this.attempts.set(a,b)}recordSuccess(e,t){this.attempts.delete(this.key(e,t))}prune(e=Date.now()){for(let[t,r]of this.attempts)if(r.until?e>=r.until:e-r.last>this.windowMs)this.attempts.delete(t)}get size(){return this.attempts.size}}var aS=new Set([22,80,443]);function Sc(e){return Number.isInteger(e)&&e>=1&&e<=65535}function Ro(e){return[...new Set(e.filter((t)=>Sc(t)&&!aS.has(t)))].sort((t,r)=>t-r)}function cS(e,t,r=[]){if(!Sc(t))throw Error("Port must be an integer between 1 and 65535.");if(aS.has(t))throw Error(`Port ${t} (SSH/HTTP/HTTPS) is always open and is not managed here.`);return lS({configText:e,ports:Ro([...r,t])})}function dS(e,t,r=[]){return lS({configText:e,ports:Ro(r.filter((a)=>a!==t))})}function sS(e,t,r,a,u){let m=e.slice(t,r),f=new RegExp(`\\b${a}\\s*:\\s*\\${u}`).exec(m);if(!f)return null;let b=t+f.index,w=e.indexOf(u,b);return{propStart:b,open:w,close:fc(e,w,u,u==="{"?"}":"]")}}function um(e){return`allowedPorts: [${e.join(", ")}]`}function lS(e){let{configText:t}=e,r=Ro(e.ports),a=/\bcompute\s*:\s*{/.exec(t);if(!a)throw Error("Could not find infrastructure.compute in the cloud config.");let u=t.indexOf("{",a.index),m=fc(t,u,"{","}"),f=sS(t,u+1,m,"firewall","{");if(f){let I=sS(t,f.open+1,f.close,"allowedPorts","[");if(I){let M=I.propStart;while(M>0&&t[M-1]!==`
+[output truncated]`}function g_(e){return/^[A-Za-z0-9_.@:-]+$/.test(e)}function cm(e){return/^[A-Za-z0-9_-]+$/.test(e)}function m_(e){return e.charAt(0).toUpperCase()+e.slice(1)}function cl(e,t){let r=[],a=t.servicesDetail??t.services??[];for(let f of a){let b=String(f?.name??"");if(!b||!g_(b))continue;for(let w of p_)r.push({id:`${w}:${b}`,label:`${m_(w)} ${b}`,group:"service",target:b,mutates:!0,confirm:b,danger:w==="stop"||w==="disable"})}for(let[f,b]of Object.entries(e.sites??{})){if(!b||!cm(f))continue;let w=d(b);if(w==="server-app"||w==="server-php")r.push({id:`rollback:${f}`,label:`Rollback ${f}`,group:"deploy",target:f,mutates:!0,confirm:f,danger:!0})}let u=new Set;for(let f of t.workers??[]){let b=String(f?.name??"").split(":")[0];if(b&&cm(b))u.add(b)}for(let f of u)r.push({id:`worker:restart:${f}`,label:`Restart workers (${f})`,group:"worker",target:f,mutates:!0,confirm:f});for(let[f,b]of Object.entries(e.sites??{})){if(!b||!cm(f))continue;if(b.scheduler||b.schedule){let w=Ur(b)==="laravel";r.push({id:`scheduler:run:${f}`,label:`${w?"Run":"Restart"} scheduler (${f})`,group:"scheduler",target:f,mutates:!0,confirm:f})}}if(e.infrastructure?.compute?.backups?.enabled){if(r.push({id:"backup:run",label:"Run backup now",group:"backup",target:"backup",mutates:!0,confirm:"backup"}),g(e))r.push({id:"backup:restore",label:"Restore latest DB backup",group:"backup",target:"database",mutates:!0,confirm:"restore",danger:!0})}return r}function dm(e,t,r){return cl(t,r).find((a)=>a.id===e)}function f_(e,t){let r=e==="enable"||e==="disable"?`systemctl is-enabled ${t} 2>/dev/null || true`:`systemctl is-active ${t} 2>/dev/null || true`;return["set -o pipefail",`systemctl ${e} ${t}`,r]}function h_(){return`eval "$(cd ${T} && pantry env 2>/dev/null)"`}function Zb(e,t,r){let a=`${U(e,t)}/current`;return["set -uo pipefail",`[ -d ${a} ] || { echo "site ${t} has no current release" >&2; exit 1; }`,`cd ${a} && ${h_()} && php artisan ${r}`]}function y_(e,t,r){if(e==="laravel")return Zb(t,r,"queue:restart");let a=`${t}-${r}-queue-*.service`;return["set -uo pipefail",`units=$(systemctl list-units --type=service --all --no-legend '${a}' 2>/dev/null | awk '{print $1}')`,`[ -n "$units" ] || { echo "no queue-worker units found for ${r} (${a})" >&2; exit 1; }`,"systemctl restart $units",`systemctl --no-legend --type=service list-units '${a}' 2>/dev/null || true`]}function v_(e,t,r){if(e==="laravel")return Zb(t,r,"schedule:run");let a=`${t}-${r}-scheduler.service`;return["set -uo pipefail",`systemctl restart ${a}`,`systemctl is-active ${a} 2>/dev/null || true`]}function b_(){return["set -uo pipefail",`[ -x ${Nr} ] || { echo "scheduled backups are not provisioned on this server" >&2; exit 1; }`,Nr]}function Yb(e,t,r){return{operation:e,command:t,ok:r.success,stdout:Ms(r.perInstance?.[0]?.output??""),stderr:Ms(r.perInstance?.[0]?.error??r.error??"")}}async function dl(e,t,r,a={}){let u=e.project.slug,m;try{m=F({config:e})}catch(A){return{operation:r.id,ok:!1,error:`Could not initialize the cloud driver: ${A?.message??A}`}}let f={driver:m,slug:u,environment:t,role:"app"};if(r.group==="deploy"){let A=a.to&&/^[A-Za-z0-9._-]+$/.test(a.to)?a.to:void 0,D=await Jb(f,{siteName:r.target,to:A,site:e.sites?.[r.target]});return Yb(r.id,`rollback ${r.target}${A?` → ${A}`:""}`,D)}if(r.id==="backup:restore"){let A=await Gb(f,{database:g(e)});return Yb(r.id,"db restore",A)}let b=await m.findComputeTargets({slug:u,environment:t,role:"app"});if(!b.length)return{operation:r.id,ok:!1,error:"No app server target was found for this environment."};let w,y;if(r.group==="service"){let[A,...D]=r.id.split(":");w=f_(A,D.join(":")),y=`systemctl ${A} ${r.target}`}else if(r.group==="worker"){let A=Ur(e.sites?.[r.target]??{});w=y_(A,u,r.target),y=A==="laravel"?`queue:restart (${r.target})`:`restart queue units (${r.target})`}else if(r.group==="scheduler"){let A=Ur(e.sites?.[r.target]??{});w=v_(A,u,r.target),y=A==="laravel"?`schedule:run (${r.target})`:`restart scheduler (${r.target})`}else if(r.id==="backup:run")w=b_(),y="ts-cloud backup";else return{operation:r.id,ok:!1,error:"Unknown operation."};let I=await m.runRemoteDeploy({targets:[b[0]],commands:w,comment:`ts-cloud dashboard:${r.id}`,tags:{Project:u,Environment:t,Role:"app"}});return{operation:r.id,command:y,ok:I.success,stdout:Ms(I.perInstance?.[0]?.output??""),stderr:Ms(I.perInstance?.[0]?.error??I.error??"")}}async function vc(e,t,r){let a=r.trim();if(!a)return{operation:"command",ok:!1,error:"A command is required."};let u;try{u=F({config:e})}catch(w){return{operation:"command",ok:!1,error:`Could not initialize the cloud driver: ${w?.message??w}`}}let m=e.project.slug,f=await u.findComputeTargets({slug:m,environment:t,role:"app"});if(!f.length)return{operation:"command",ok:!1,error:"No app server target was found for this environment."};let b=await u.runRemoteDeploy({targets:[f[0]],commands:["set -o pipefail",a],comment:"ts-cloud dashboard:command",tags:{Project:m,Environment:t,Role:"app"}});return{operation:"command",command:a,ok:b.success,stdout:Ms(b.perInstance?.[0]?.output??""),stderr:Ms(b.perInstance?.[0]?.error??b.error??"")}}function S_(e,t){return[`${e}-${t}`,`${e}-${t}-queues`,`${e}-${t}-daemons`]}function Xb(e,t,r){return r.some((a)=>S_(t,a).includes(e))}function lm(e,t){let{user:r,slug:a}=t;if(r.role==="admin")return e;let u=(e.sites??[]).map((M)=>M.name).filter(Boolean),m=Kg(r,u),f=new Set(m),b=(e.sites??[]).filter((M)=>f.has(M.name)),w=(e.sitesDetail??[]).filter((M)=>f.has(M.name)),y=new Set(w.map((M)=>M.domain).filter(Boolean)),I=(e.serverDeploymentsDetail??e.serverDeployments??[]).filter((M)=>f.has(M.site)),A=(e.serverLogs??[]).filter((M)=>Xb(M.source,a,m)),D=(e.security?.tlsCertificates??[]).filter((M)=>y.has(M.domain)),O=(e.activity??[]).filter((M)=>{if(M.type==="deploy")return m.some((z)=>String(M.title??"").startsWith(`${z} `));if(M.type==="log")return Xb(String(M.title??"").split(" ")[0],a,m);return!1});return{mode:e.mode,environment:e.environment,environments:e.environments,scoped:!0,server:{name:""},sites:b,sitesDetail:w,workers:(e.workers??[]).filter((M)=>f.has(M.site)),serverDeployments:I.slice(0,5),serverDeploymentsDetail:I.slice(0,50),deploymentsEmptyReason:I.length?void 0:"No deployments have been recorded for your sites yet.",serverLogs:A,serverLogsEmptyReason:A.length?void 0:"No recent log entries for your sites.",security:{tlsCertificates:D,ports:[],firewall:null,authEvents:[]},diagnostics:(e.diagnostics??[]).filter((M)=>["Route conflicts","TLS certificates"].includes(M.name)),activity:O}}function eS(e,t){if(t.role==="admin")return e;let r=new Set(Kg(t,Object.keys(e.sites??{})));return{project:{name:e.project?.name},environment:e.environment,environments:e.environments,sites:Object.fromEntries(Object.entries(e.sites??{}).filter(([a])=>r.has(a)))}}function tS(e){let t=new RegExp("[\\u007F-\\uFFFF]","g");return JSON.stringify(e).replace(t,(r)=>`\\u${r.charCodeAt(0).toString(16).padStart(4,"0")}`)}var w_=new Set(["name","ssl","env","redirects","aliases","domain","path"]),rS={build:"build runs as a shell command on the server",start:"start runs as a shell command on the server",root:"root is a filesystem path on the shared server",port:"ports are allocated by the server owner",type:"the deploy type is set by the server owner",php:"the PHP runtime is set by the server owner"};function iS(e){let t=Object.keys(e).filter((u)=>e[u]!==void 0),r=t.filter((u)=>(u in rS));if(r.length)return{ok:!1,error:`Only the server owner can change ${r.map((m)=>`${m} (${rS[m]})`).join(", ")}.`};let a=t.filter((u)=>!w_.has(u));if(a.length)return{ok:!1,error:`Only the server owner can change ${a.join(", ")}.`};return{ok:!0}}function ul(e){return String(e??"").trim().toLowerCase().replace(/\.$/,"")}function nS(e){let t=String(e??"/").trim();if(!t||t==="/")return"/";return(t.startsWith("/")?t:`/${t}`).replace(/\/+$/,"")||"/"}function k_(e){let t=[ul(e?.domain)];if(Array.isArray(e?.aliases))t.push(...e.aliases.map(ul));return t.filter(Boolean)}function oS({siteName:e,body:t,sites:r,ownSites:a}){let u=r[e]??{},m=new Set(a),f=new Set;if(t.domain!==void 0)f.add(ul(t.domain));if(Array.isArray(t.aliases))for(let w of t.aliases)f.add(ul(w));if(f.delete(""),f.size===0)return{ok:!0};let b=nS(t.path!==void 0?t.path:u.path);for(let[w,y]of Object.entries(r)){if(w===e||m.has(w))continue;let I=nS(y?.path);for(let A of k_(y)){if(!f.has(A))continue;if(I===b)return{ok:!1,error:`${A}${b==="/"?"":b} is already served by another site on this server.`}}}return{ok:!0}}class bc{maxAttempts;lockoutMs;windowMs;attempts=new Map;constructor(e=8,t=900000,r=900000){this.maxAttempts=e;this.lockoutMs=t;this.windowMs=r}key(e,t){return`${e.trim().toLowerCase()}\x00${t}`}check(e,t,r=Date.now()){let a=this.attempts.get(this.key(e,t));if(!a?.until)return{allowed:!0};if(r>=a.until)return this.attempts.delete(this.key(e,t)),{allowed:!0};return{allowed:!1,retryAfterSeconds:Math.ceil((a.until-r)/1000)}}recordFailure(e,t,r=Date.now()){let a=this.key(e,t),u=this.attempts.get(a),f=!u||r-u.last>this.windowMs?1:u.count+1,b={count:f,last:r};if(f>=this.maxAttempts)b.until=r+this.lockoutMs;this.attempts.set(a,b)}recordSuccess(e,t){this.attempts.delete(this.key(e,t))}prune(e=Date.now()){for(let[t,r]of this.attempts)if(r.until?e>=r.until:e-r.last>this.windowMs)this.attempts.delete(t)}get size(){return this.attempts.size}}var aS=new Set([22,80,443]);function Sc(e){return Number.isInteger(e)&&e>=1&&e<=65535}function Ro(e){return[...new Set(e.filter((t)=>Sc(t)&&!aS.has(t)))].sort((t,r)=>t-r)}function cS(e,t,r=[]){if(!Sc(t))throw Error("Port must be an integer between 1 and 65535.");if(aS.has(t))throw Error(`Port ${t} (SSH/HTTP/HTTPS) is always open and is not managed here.`);return lS({configText:e,ports:Ro([...r,t])})}function dS(e,t,r=[]){return lS({configText:e,ports:Ro(r.filter((a)=>a!==t))})}function sS(e,t,r,a,u){let m=e.slice(t,r),f=new RegExp(`\\b${a}\\s*:\\s*\\${u}`).exec(m);if(!f)return null;let b=t+f.index,w=e.indexOf(u,b);return{propStart:b,open:w,close:fc(e,w,u,u==="{"?"}":"]")}}function um(e){return`allowedPorts: [${e.join(", ")}]`}function lS(e){let{configText:t}=e,r=Ro(e.ports),a=/\bcompute\s*:\s*{/.exec(t);if(!a)throw Error("Could not find infrastructure.compute in the cloud config.");let u=t.indexOf("{",a.index),m=fc(t,u,"{","}"),f=sS(t,u+1,m,"firewall","{");if(f){let I=sS(t,f.open+1,f.close,"allowedPorts","[");if(I){let M=I.propStart;while(M>0&&t[M-1]!==`
 `&&/\s/.test(t[M-1]))M--;let z=t.slice(M,I.propStart);return`${t.slice(0,M)}${z}${um(r)}${t.slice(I.close+1)}`}let A=t.slice(0,f.close).trimEnd(),D=t.slice(f.close),O=A.endsWith(",")||A.endsWith("{")?"":",";return`${A}${O}
         ${um(r)},
       ${D}`}let b=t.slice(0,m).trimEnd(),w=t.slice(m),y=b.endsWith(",")||b.endsWith("{")?"":",";return`${b}${y}

package/dist/deploy/index.js

@@ -1 +1 @@
-import{wn,Rn,Ku,ys,Wu,Ju,Xu,za,Yu,Zu,dh,eg,E,tg,Ss,Me,rg,ng,$S,ig,sg,og,ag,cg,lh,MS,FS,US,uh,gh,QS,HS,ph,mh,GS,Is,Ar,Ka,Dn,Pn,yr,ct,Lt,bs,fh,kn,dg,lg,Wa,Es,Bn,vs,dc}from"../chunk-r3qpx6xp.js";import{lc,xn,On,Ts,ws,Rs,Ds,uc,gc}from"../chunk-94z7s8ky.js";import{pc}from"../chunk-hybz2q8w.js";import"../chunk-nhsefr22.js";import"../chunk-qyr5hn6v.js";import"../chunk-stc3ykm3.js";import"../chunk-vgtqd3sb.js";import"../chunk-mp2y4t6w.js";import"../chunk-smt4t6rc.js";import"../chunk-y7k5872m.js";import{Dg,kc,Pg,De,Nc,Wn,kg,Bc,rd,no,nd,Jt,vi,io}from"../chunk-y2dej583.js";import"../chunk-yt8qgn5d.js";import"../chunk-80bgb48v.js";import"../chunk-d245va6b.js";import"../chunk-jyvnfny6.js";import"../chunk-e42gpavb.js";import{It,AA,md,ki,Ni,Bi,Mp}from"../chunk-apj1eqcy.js";import{U,Vr,qr,fd,po,d,yA,Fp,Up,CI,EI}from"../chunk-2hma3g5q.js";import"../chunk-430acqjk.js";import"../chunk-zvcd6x45.js";import"../chunk-a99wz633.js";export{AA as DEFAULT_SITE_PORT_RANGE,It as HOST_SITES_DIR,Nc as IPV6_EXCLUDED_HOST_LABELS,rd as MANAGEMENT_DASHBOARD_SITE,wn as addSiteToCloudConfig,Mp as allocateSitePorts,GS as buildAndPushContainerImage,pc as buildAndPushServerlessImage,Ar as buildFunctionEnv,Ni as buildHostSitePortsScript,io as buildManagementDashboardArtifact,Lt as buildServerTopology,bs as buildServerlessTopology,fh as buildTopology,Wa as collectEgressMetrics,Dg as collectServerDnsDomains,mh as createContainerImageDependencies,uh as createExistingStaticFullStackDependencies,lh as createStaticApiOriginDependencies,Bn as dashboardActions,no as dashboardCredentialsFile,rg as dashboardPageRoutes,ag as deleteFailoverReplicaBuckets,uc as deleteStaticSite,QS as deployExistingStaticFullStack,Ka as deployServerlessApp,EI as deployShipsFiles,cg as deploySite,MS as deployStaticApiOrigin,ws as deployStaticSite,gc as deployStaticSiteFull,xn as deployStaticSiteWithExternalDns,On as deployStaticSiteWithExternalDnsFull,dg as egressReportMetrics,E as ensureDashboardActor,ig as ensureFailoverReplicaBuckets,vi as ensureManagementDashboard,HS as estimateExistingStaticFullStackMonthlyCost,US as estimateStaticApiOriginMonthlyCost,lg as fetchEgressReport,gh as generateExistingStaticFullStackTemplate,lc as generateExternalDnsStaticSiteTemplate,Ts as generateStaticSiteTemplate,sg as grantFailoverReplicaAccess,yA as hasComputeConfigured,fd as hasProxyUpstream,ph as hashContainerContext,Wn as hostAcceptsIpv6,Is as infraEnvFromOutputs,tg as initializeDashboardControlPlane,Ds as invalidateCache,Vr as isPhpSite,za as isValidHostname,De as normalizePublicIpv6,ki as occupiedHostPorts,Bi as parseHostSiteFragments,md as parseUpstreamPort,kg as reconcileAddressRecords,Dn as redeployServerlessApp,Pg as removeAddressRecords,Rn as removeSiteFromCloudConfig,kc as removeStaleServerAddressRecords,Yu as renderAliasesValue,Xu as renderEnvValue,Zu as renderRedirectsValue,dh as renderSiteSnippet,Wu as renderSslValue,Ju as renderStringValue,vs as resolveDashboardAction,nd as resolveDashboardAuth,kn as resolveDashboardData,ng as resolveLegacyDashboardRoute,qr as resolveProxyUpstreams,po as resolveSiteDeployTarget,d as resolveSiteKind,Jt as resolveUiSource,Pn as rollbackServerlessApp,$S as routesForDashboard,ct as runRemoteCommand,Es as sanitizeCloudConfig,og as seedFailoverReplicas,eg as setAttachToInCloudConfig,yr as setMaintenance,ys as setSitePropertyInCloudConfig,Up as shipsARelease,CI as shipsToBucket,U as siteInstallBase,dc as startLocalDashboardServer,Ss as synchronizeDashboardUsers,Me as trackDashboardOperation,Ku as updateSiteInCloudConfig,Rs as uploadStaticFiles,Fp as validateDeploymentConfig,Bc as verifyAddressRecord,FS as verifyStaticApiOrigin};
+import{wn,Rn,Ku,ys,Wu,Ju,Xu,za,Yu,Zu,dh,eg,E,tg,Ss,Me,rg,ng,$S,ig,sg,og,ag,cg,lh,MS,FS,US,uh,gh,QS,HS,ph,mh,GS,Is,Ar,Ka,Dn,Pn,yr,ct,Lt,bs,fh,kn,dg,lg,Wa,Es,Bn,vs,dc}from"../chunk-4f0b21fp.js";import{lc,xn,On,Ts,ws,Rs,Ds,uc,gc}from"../chunk-94z7s8ky.js";import{pc}from"../chunk-hybz2q8w.js";import"../chunk-nhsefr22.js";import"../chunk-qyr5hn6v.js";import"../chunk-stc3ykm3.js";import"../chunk-vgtqd3sb.js";import"../chunk-mp2y4t6w.js";import"../chunk-smt4t6rc.js";import"../chunk-y7k5872m.js";import{Dg,kc,Pg,De,Nc,Wn,kg,Bc,rd,no,nd,Jt,vi,io}from"../chunk-y2dej583.js";import"../chunk-yt8qgn5d.js";import"../chunk-80bgb48v.js";import"../chunk-d245va6b.js";import"../chunk-jyvnfny6.js";import"../chunk-e42gpavb.js";import{It,AA,md,ki,Ni,Bi,Mp}from"../chunk-apj1eqcy.js";import{U,Vr,qr,fd,po,d,yA,Fp,Up,CI,EI}from"../chunk-2hma3g5q.js";import"../chunk-430acqjk.js";import"../chunk-zvcd6x45.js";import"../chunk-a99wz633.js";export{AA as DEFAULT_SITE_PORT_RANGE,It as HOST_SITES_DIR,Nc as IPV6_EXCLUDED_HOST_LABELS,rd as MANAGEMENT_DASHBOARD_SITE,wn as addSiteToCloudConfig,Mp as allocateSitePorts,GS as buildAndPushContainerImage,pc as buildAndPushServerlessImage,Ar as buildFunctionEnv,Ni as buildHostSitePortsScript,io as buildManagementDashboardArtifact,Lt as buildServerTopology,bs as buildServerlessTopology,fh as buildTopology,Wa as collectEgressMetrics,Dg as collectServerDnsDomains,mh as createContainerImageDependencies,uh as createExistingStaticFullStackDependencies,lh as createStaticApiOriginDependencies,Bn as dashboardActions,no as dashboardCredentialsFile,rg as dashboardPageRoutes,ag as deleteFailoverReplicaBuckets,uc as deleteStaticSite,QS as deployExistingStaticFullStack,Ka as deployServerlessApp,EI as deployShipsFiles,cg as deploySite,MS as deployStaticApiOrigin,ws as deployStaticSite,gc as deployStaticSiteFull,xn as deployStaticSiteWithExternalDns,On as deployStaticSiteWithExternalDnsFull,dg as egressReportMetrics,E as ensureDashboardActor,ig as ensureFailoverReplicaBuckets,vi as ensureManagementDashboard,HS as estimateExistingStaticFullStackMonthlyCost,US as estimateStaticApiOriginMonthlyCost,lg as fetchEgressReport,gh as generateExistingStaticFullStackTemplate,lc as generateExternalDnsStaticSiteTemplate,Ts as generateStaticSiteTemplate,sg as grantFailoverReplicaAccess,yA as hasComputeConfigured,fd as hasProxyUpstream,ph as hashContainerContext,Wn as hostAcceptsIpv6,Is as infraEnvFromOutputs,tg as initializeDashboardControlPlane,Ds as invalidateCache,Vr as isPhpSite,za as isValidHostname,De as normalizePublicIpv6,ki as occupiedHostPorts,Bi as parseHostSiteFragments,md as parseUpstreamPort,kg as reconcileAddressRecords,Dn as redeployServerlessApp,Pg as removeAddressRecords,Rn as removeSiteFromCloudConfig,kc as removeStaleServerAddressRecords,Yu as renderAliasesValue,Xu as renderEnvValue,Zu as renderRedirectsValue,dh as renderSiteSnippet,Wu as renderSslValue,Ju as renderStringValue,vs as resolveDashboardAction,nd as resolveDashboardAuth,kn as resolveDashboardData,ng as resolveLegacyDashboardRoute,qr as resolveProxyUpstreams,po as resolveSiteDeployTarget,d as resolveSiteKind,Jt as resolveUiSource,Pn as rollbackServerlessApp,$S as routesForDashboard,ct as runRemoteCommand,Es as sanitizeCloudConfig,og as seedFailoverReplicas,eg as setAttachToInCloudConfig,yr as setMaintenance,ys as setSitePropertyInCloudConfig,Up as shipsARelease,CI as shipsToBucket,U as siteInstallBase,dc as startLocalDashboardServer,Ss as synchronizeDashboardUsers,Me as trackDashboardOperation,Ku as updateSiteInCloudConfig,Rs as uploadStaticFiles,Fp as validateDeploymentConfig,Bc as verifyAddressRecord,FS as verifyStaticApiOrigin};

package/dist/drivers/shared/compute-ops.d.ts

@@ -7,7 +7,7 @@
  * with the shared generators, and runs it on every box — mirroring how
  * {@link import('./compute-deploy').deploySiteRelease} drives a deploy.
  */
-import type { CloudDriver, DatabaseConfig, EnvironmentType, RemoteDeployInstanceResult } from '@ts-cloud/core';
+import type { CloudDriver, DatabaseConfig, EnvironmentType, RemoteDeployInstanceResult, SiteConfig } from '@ts-cloud/core';
 export interface ComputeOpsLogger {
     info(message: string): void;
     warn(message: string): void;
@@ -31,14 +31,17 @@ export interface ComputeOpsResult {
 /**
  * Roll a site back to a previous release (Forge-style). With `to`, points
  * `current` at `releases/<to>`; otherwise the most recent prior release. After
- * flipping the symlink, php-fpm is restarted and queue workers are signalled so
- * they pick up the rolled-back code.
+ * flipping the symlink, the release's service is restarted. Declared PHP sites
+ * also restart php-fpm and, when artisan exists, their Laravel queue workers.
+ * Pass the site's declared config to enable PHP runtime hooks; an unspecified
+ * site never starts an unrelated runtime.
  */
 export declare function rollbackComputeSite(ctx: ComputeOpsContext, options: {
     siteName: string;
     to?: string;
     dryRun?: boolean;
     onlyIfLive?: string;
+    site?: SiteConfig;
 }): Promise<ComputeOpsResult>;
 /**
  * Stop the script (successfully) unless the site's live release is `release`.

package/dist/index.js

@@ -1,4 +1,4 @@
-import{DI,PI,el,um,tl,rl,on,Q,l,nl,gm,K,il,g,zA,b,Xe,zi,an,w,be,sl,KA,r,t,kI,NI,p,BI,xI,OI,_I,LI,sr,ol,Ki,WA,$I,MI,xe,Ye,al,pm,mm,FI,fm,hm,Am,Mo,cl,ce,cn,Tt,Fo,wt,Ce,JA,dl,Uo,ym,Sm,Im,bm,ll,UI,W,C,XA,YA,Cm,a,y,Ze,m,Em,et,J,Rt,QI,vm,X,ul,Oe,or,Qo,de,gl,le,ZA,Ho,Y,Z,_,Wi,D,ar,Dt,ee,e,dn,HI,Tm,pl,GI,VI,qI,jI,ml,zI,KI,WI,JI,XI,YI,ZI,eb,tb,rb,nb,ib,ey,ty,ry,ny,iy,sy,oy,cr,wm,Rm,dr,Ji,sb,Dm,ob,ab,ln,cb,db,lb,ub,gb,pb,ay,cy,dy,ly,uy,Xi,mb,Go,gy,Pm,V,py,tt,Vo,Pt,my,km,fy,hy,Ay,Nm,q,fb,hb,Ab,yb,yy,Sb,te,Ib,bb,Cb,fl,hl,Sy,Bm,xm,Eb,vb,Tb,wb,Rb,Iy,Al,Db,Pb,kb,Nb,Bb,by,Cy,xb,Ob,_b,Lb,$b,Mb,Fb,Ey,Ub,Om,yl,Qb,Hb,Gb,Vb,_m,Lm,$m,qb,Sl,vy,Ty,wy,Ry,Il,Dy,jb,zb,Kb,Wb,Jb,Xb,Yb,Py,ky,Ny,By,Mm,Zb,eC,tC,rC,nC,iC,sC,oC,aC,xy,Oy,_y,Ly,cC,dC,Fm,lC,Um,Qm,Hm,Gm,uC,gC,pC,mC,_e,Yi,fC,hC,AC,yC,SC,IC,bC,CC,$y,EC,vC,Vm,qm,TC,wC,My,RC,DC,PC,kC,NC,BC,xC,OC,_C,LC,$C,MC,FC,UC,QC,HC,GC,VC,qC,jC,zC,bl,Fy,Cl,Uy,El,Qy,vl,Hy,Tl,Gy,lr,Vy,wl,qy,Zi,jy,Rl,zy,Dl,Ky,jm,KC,zm,WC,Pl,Wy,ur,Jy,Km,JC,kl,Xy,Wm,XC,Jm,YC,Xm,ZC,Nl,Yy,Ym,eE,Zm,tE,ef,rE,tf,nE,Bl,Zy,xl,eS,rf,iE,nf,sE,sf,oE,of,aE,af,cE,cf,dE,Ol,tS,df,lE,lf,uE,uf,gE,gf,pE,pf,mE,mf,fE,ff,hf,Af,yf,Sf,hE,If,AE,bf,yE,Cf,SE,rt,Ef,rS,qo,_l,un,nS,es,gr,Ll,$l,iS,sS,Ml,vf,Fl,Tf,IE,bE,jo,zo,Ko,Ul,gn,Ql,Hl,ts,Wo,Jo,wf,oS,aS,cS,CE,Rf,Df,EE,dS,Pf,lS,uS,gS,vE,kf,pn,Gl,Nf,TE,pS,Xo,Yo,Vl,Bf,wE,ql,mS,xf,RE,Of,DE,_f,PE}from"./chunk-zvcd6x45.js";import{jl,k,zl,Zo,fS,Lf,hS,AS,yS,SS,IS,bS,CS,ES}from"./chunk-a99wz633.js";import{sa,$f,eu,RS,ss,tu,oa,Mf,Ff,fn,aa,ru,it,nu,iu,su,os,hn,Uf,st,ou,ca,da,la,au,cu,du,as,ua,lu,An,cs,ga,kt,Qf,uu,gu,Hf,pu,pa,pr,mu,fu,hu,Au,ot,Gf,yu,mr,ma,fa,ha,ds,ls,yn,Su,us,Aa,ya,Sn,Iu,In,Vf,qf,Nt,bn,Sa,jf,bu,Cu,Ia,Eu,vu,Tu,DS,ue,wu,PS,kS,gs,ps,NS,Ee,zf,Bt,Le,$e,xt,Ru,Du,Pu,ku,Kf,Wf,ba,Jf,Xf,Ca,Nu,Bu,Yf,ge,Zf,xu,ve,Ea,at,Ot,_t,Cn,ms,Ou,BS,eh,th,rh,nh,va,Ta,_u,wa,En,Ra,Lu,fs,$u,Da,Pa,ka,Na,Ba,xa,Oa,_a,Mu,fr,La,Fu,vn,Uu,$a,Ma,Qu,hr,Fa,Ua,ih,xS,hs,OS,_S,LS,Qa,Ha,Hu,sh,Ga,Tn,Gu,As,Vu,qu,ju,Va,oh,qa,zu,ah,ja,ch,wn,Rn,Ku,ys,eg,ig,sg,og,ag,cg,Is,Ar,Ka,Dn,Pn,yr,ct,hh,Ja,Ah,yh,ug,Xa,Cs,gg,Ya,$t,Fe,pg,Za,ec,mg,tc,rc,nc,ic,fg,hg,Nn,sc,oc,ac,cc,Ag,Es,Bn,vs,dc}from"./chunk-r3qpx6xp.js";import{U,qr,fd,po,d,Fp,Up}from"./chunk-2hma3g5q.js";import{It,md,ki,Ni,Bi,Mp}from"./chunk-apj1eqcy.js";import{zh,Kh,Wh,Sp,Ip,bp,Jh,Cp,Ep,Xh,Yh,vp,Zh,eA,gd,Tp,tA,rA,wp,nA,iA,sA,oA,aA,cA,dA,Pi,pd,Rp,Dp,Pp,kp,Np,Bp,xp,Op,_p,Lp,$p,lA,uA,gA,pA,mA,fA,hA}from"./chunk-184bvh5s.js";import{Ke,hd,Ie,Yt,Ad,x,Zt,bt,yd,mo,SA,Qp,Sd,s,xi,fo,jr,Id,bd,zr,IA,Cd,vI,TI,ho,wI,RI,Ed,vd,Oi,Ao,ae,c,yo,We,Kr,bA,CA,Td,EA,So,vA,TA,Io,wd,Wr,bo,wA,er,Rd,Hp,tr,Jr,RA,Co,DA,O,PA,Dd,Gp,Eo,kA,NA,BA,Pd,_i,vo,kd,rr,Ct,xA,Xr,OA,Nd,Vp,qp,To,Bd,xd,Et,jp,Li,Od,wo,Yr,zp,$i,_d,Ld,Mi,Kp,$d,Md,Fd,Ud,Ro,Wp,Jp,_A,Xp,Qd,Fi,Yp,Zp,Do,Zr,Po,ko,No,Hd,em,Gd,Bo,LA,nr,$A,Vd,en,qd,MA,jd,tm,Ui,tn,xo,Qi,Je,FA,rm,nm,ir,zd,Kd,Wd,Hi,Gi,Vi,UA,QA,vt,Oo,HA,rn,im,_o,GA,sm,om,am,VA,cm,dm,qA,i,jA,qi,Lo,$o}from"./chunk-430acqjk.js";import{n}from"./chunk-e42gpavb.js";import{Re,gt,Vn}from"./chunk-qyr5hn6v.js";import{o}from"./chunk-jyvnfny6.js";import{Te,Ns,Bs,Ig,mc,fc,xs,hc,dt,re,lt,pe,v,we,Ln,Ac,Ue,yc,$n,Mn,Un,Mt,Ft,Ut,Qn,Ir,Sc,br,Cr,ut,Hn,bc,Qt,Er,Gn,Ec,Tg,wg,vc,vr}from"./chunk-nhsefr22.js";import{pt,he,Ge,Rg,Ht,wc,Rc,Gt,H,qn,Vt,qt,jn,$s,Ms,Tr,wr,zn,Rr,Fs,Us,Qs,Hs,ie,Gs,Vs,qs,js,Ae,zs,Ks,Ws,N,Dc,Kn,Pc,ye,Dr}from"./chunk-smt4t6rc.js";import{ne}from"./chunk-mp2y4t6w.js";import{Dg,kc,Pg,De,Nc,Wn,kg,Bc,Ng,Bg,Nh,Xn,Xs,M,Br,Yn,Zn,xr,_r,ei,Ys,ti,ri,ni,ii,oi,Lr,Se,_c,ai,Lc,$r,Fc,Ve,se,qe,je,ft,di,li,Pe,Mr,ke,gi,pi,mi,fi,hi,Ai,yi,Fr,F,ro,ip,Jc,Ii,bi,Ci,Ei,rd,no,nd,Jt,vi,io,so,id,Ti,sd}from"./chunk-y2dej583.js";import{ao,lo,uo,B,Ne}from"./chunk-yt8qgn5d.js";import{Kl,ea,rs,ns,ta,Wl,Jl,is,ra,na,Yl,Zl,ia}from"./chunk-gmtds745.js";import{lc,xn,On,Ts,ws,Rs,Ds,uc,gc}from"./chunk-94z7s8ky.js";import{pc}from"./chunk-hybz2q8w.js";import{Tc,Qe,S}from"./chunk-stc3ykm3.js";import{He}from"./chunk-vgtqd3sb.js";import{I}from"./chunk-y7k5872m.js";import{oe,wi,oo,od,Ri,pp}from"./chunk-wbbbpt4v.js";import{Qr,Be}from"./chunk-80bgb48v.js";import{h}from"./chunk-d245va6b.js";import{Jd,nn,Xd,Yd,Zd,ji,lm,sn}from"./chunk-qjp3f5y8.js";import{vS,nt}from"./chunk-c482jhc6.js";var qh="https://api.machines.dev/v1";class Ls extends Error{status;path;constructor(u,f,R){super(u);this.status=f;this.path=R;this.name="FlyApiError"}}function Qc(u){let f=u.ip.includes(":");if(f&&u.ip.startsWith("fdaa:"))return"private_v6";if(u.shared)return"shared_v4";return f?"v6":"v4"}class hp{token;fetch;constructor(u){if(!u.token)throw Error("Fly.io needs an API token: set FLY_API_TOKEN (`fly tokens create deploy` makes one scoped to an app).");this.token=u.token,this.fetch=u.fetch??fetch}async rest(u,f,R={}){let A=new URL(`https://api.machines.dev/v1${f}`);for(let[L,z]of Object.entries(R.query??{}))A.searchParams.set(L,z);let T=await this.fetch(A,{method:u,headers:{Authorization:`Bearer ${this.token}`,...R.body!==void 0?{"Content-Type":"application/json"}:{},...R.headers},body:R.body===void 0?void 0:JSON.stringify(R.body)});if(T.status===404&&R.notFound==="null")return null;let E=await T.text(),P=E?yp(E):void 0;if(!T.ok){let L=typeof P==="object"&&P&&"error"in P?String(P.error):E||T.statusText;throw new Ls(`Fly.io ${u} ${f} failed (${T.status}): ${L}`,T.status,f)}return P}getApp(u){return this.rest("GET",`/apps/${encodeURIComponent(u)}`,{notFound:"null"})}createApp(u,f){return this.rest("POST","/apps",{body:{app_name:u,org_slug:f}})}async listMachines(u){return await this.rest("GET",`/apps/${encodeURIComponent(u)}/machines`)??[]}createMachine(u,f){return this.rest("POST",`/apps/${encodeURIComponent(u)}/machines`,{body:f})}updateMachine(u,f,R,A){return this.rest("POST",`/apps/${encodeURIComponent(u)}/machines/${encodeURIComponent(f)}`,{body:R,headers:{"fly-machine-lease-nonce":A}})}async acquireLease(u,f,R=120){let T=(await this.rest("POST",`/apps/${encodeURIComponent(u)}/machines/${encodeURIComponent(f)}/lease`,{body:{ttl:R}})).data?.nonce;if(!T)throw new Ls(`Fly.io gave no lease nonce for Machine ${f}`,200,`/machines/${f}/lease`);return T}async releaseLease(u,f,R){await this.rest("DELETE",`/apps/${encodeURIComponent(u)}/machines/${encodeURIComponent(f)}/lease`,{headers:{"fly-machine-lease-nonce":R}})}async waitForState(u,f,R,A={}){await this.rest("GET",`/apps/${encodeURIComponent(u)}/machines/${encodeURIComponent(f)}/wait`,{query:{state:R,timeout:String(A.timeoutSeconds??60),...A.instanceId?{instance_id:A.instanceId}:{}}})}async listVolumes(u){return await this.rest("GET",`/apps/${encodeURIComponent(u)}/volumes`)??[]}createVolume(u,f){return this.rest("POST",`/apps/${encodeURIComponent(u)}/volumes`,{body:{...f,encrypted:!0}})}async setSecrets(u,f){return(await this.rest("POST",`/apps/${encodeURIComponent(u)}/secrets`,{body:{values:f}})).version}async listIpAssignments(u){return(await this.rest("GET",`/apps/${encodeURIComponent(u)}/ip_assignments`)).ips??[]}async assignIp(u,f){let R=await this.rest("POST",`/apps/${encodeURIComponent(u)}/ip_assignments`,{body:{type:f}});if(!R.ip)throw new Ls(`Fly.io assigned no ${f} address to ${u}`,200,`/apps/${u}/ip_assignments`);return{ip:R.ip,shared:R.shared??f==="shared_v4",region:R.region}}async requestCertificate(u,f){return this.rest("POST",`/apps/${encodeURIComponent(u)}/certificates/acme`,{body:{hostname:f}})}}function yp(u){try{return JSON.parse(u)}catch{return}}var Wc="ts-cloud-role";function $S(u,f){let R=u.fly??{},A=R.app??`${u.project.slug}-${f.environment}`;if(!/^[a-z0-9][a-z0-9-]{1,61}[a-z0-9]$/.test(A))throw Error(`"${A}" is not a valid Fly app name: lowercase letters, digits and dashes, 3 to 63 characters.`);let T=R.internalPort??3000,E=R.count??1;if(!Number.isInteger(E)||E<1)throw Error(`fly.count must be a whole number of at least 1, got ${E}.`);return{app:A,org:R.org??"personal",image:f.image,regions:R.regions?.length?R.regions:["iad"],count:E,internalPort:T,healthPath:R.healthPath??"/",vm:{cpuKind:R.vm?.cpuKind??"shared",cpus:R.vm?.cpus??1,memoryMb:R.vm?.memoryMb??512},...R.volume?{volume:{name:R.volume.name??"data",sizeGb:R.volume.sizeGb,path:R.volume.path}}:{},autoStop:R.autoStop??!1,env:{...f.env,PORT:String(T)},secrets:f.secrets??{},hostnames:R.hostnames??[],release:f.release}}function Ap(u){return{image:u.image,env:u.env,guest:{cpu_kind:u.vm.cpuKind,cpus:u.vm.cpus,memory_mb:u.vm.memoryMb},services:[{protocol:"tcp",internal_port:u.internalPort,ports:[{port:80,handlers:["http"],force_https:!0},{port:443,handlers:["tls","http"]}],autostop:u.autoStop?"stop":"off",autostart:!0,...u.autoStop?{min_machines_running:0}:{},checks:[{type:"http",method:"GET",path:u.healthPath,interval:"15s",timeout:"5s",grace_period:"10s"}]}],restart:{policy:"on-failure",max_retries:10},metadata:{[Wc]:"app","ts-cloud-release":u.release}}}async function wS(u,f,R=()=>{}){let A=!1;if(!await u.getApp(f.app))R(`Creating Fly app ${f.app} in ${f.org}`),await u.createApp(f.app,f.org),A=!0;let T;if(Object.keys(f.secrets).length>0)T=await u.setSecrets(f.app,f.secrets),R(`Set ${Object.keys(f.secrets).length} secret(s) (version ${T})`);let E=await u.listIpAssignments(f.app),P=new Set(E.map(Qc));if(!P.has("v6"))E.push(await u.assignIp(f.app,"v6")),R("Assigned a dedicated IPv6");if(!P.has("v4")&&!P.has("shared_v4"))E.push(await u.assignIp(f.app,"shared_v4")),R("Assigned a shared IPv4");let L=Ap(f),z=(await u.listMachines(f.app)).filter((Me)=>{let ze=Me.config?.metadata??{};if(ze[Wc])return ze[Wc]==="app";return!ze.fly_process_group||ze.fly_process_group==="app"}),fe=f.volume?await u.listVolumes(f.app):[],me=[],At=[],Lt=new Set;for(let Me of f.regions){let ze=z.filter((j)=>j.region===Me).sort((j,yt)=>j.id.localeCompare(yt.id));for(let j=0;j<f.count;j++){let yt=ze[j];if(yt){Lt.add(yt.id),await tg(u,f.app,yt,L,T),At.push(yt.id),R(`Updated ${yt.id} (${Me}) to ${f.image}`);continue}let G=f.volume?[{volume:(await rg(u,f,Me,fe)).id,path:f.volume.path}]:void 0,ht=await u.createMachine(f.app,{region:Me,name:`${f.app}-${Me}-${j+1}`,config:{...L,...G?{mounts:G}:{}},...T!==void 0?{min_secrets_version:T}:{}});await u.waitForState(f.app,ht.id,"started",{instanceId:ht.instance_id}),me.push(ht.id),R(`Created ${ht.id} in ${Me}`)}}let mt=[];for(let Me of f.hostnames)mt.push(await u.requestCertificate(f.app,Me));return{app:f.app,url:`https://${f.app}.fly.dev`,createdApp:A,created:me,updated:At,untouched:z.filter((Me)=>!Lt.has(Me.id)).map((Me)=>Me.id),ips:E,certificates:mt}}async function tg(u,f,R,A,T){let E=await u.acquireLease(f,R.id);try{let P=await u.updateMachine(f,R.id,{config:{...A,...R.config?.mounts?.length?{mounts:R.config.mounts}:{}},...T!==void 0?{min_secrets_version:T}:{}},E);await u.waitForState(f,R.id,"started",{instanceId:P.instance_id})}finally{await u.releaseLease(f,R.id,E)}}async function rg(u,f,R,A){let T=A.find((P)=>P.region===R&&P.name===f.volume.name&&!P.attached_machine_id);if(T)return T.attached_machine_id="pending",T;let E=await u.createVolume(f.app,{name:f.volume.name,region:R,size_gb:f.volume.sizeGb});return A.push({...E,attached_machine_id:"pending"}),E}import{createHmac as Xl,createSign as ng,timingSafeEqual as lg}from"node:crypto";function eo(u){let f=u instanceof Date?u.getTime():u;if(!Number.isFinite(f))throw TypeError("Media access timestamp must be finite");return Math.floor(f/1000)}function Wu(u){return Buffer.from(u).toString("base64").replaceAll("+","-").replaceAll("=","_").replaceAll("/","~")}function dg(u){return Buffer.from(u).toString("base64url")}function Zu(u,f=!1){if(!u||/[\r\n]/.test(u))throw TypeError("Media resource is invalid");let R=f?u.replaceAll("*","wildcard"):u,A=new URL(R);if(!["http:","https:"].includes(A.protocol))throw TypeError("Media resource must use HTTP or HTTPS");if(!f&&u.includes("*"))throw TypeError("Canned policies cannot contain wildcards")}function Ju(u,f){let R=ng("RSA-SHA1");return R.update(u),R.end(),Wu(R.sign(f))}function Yu(u){Zu(u.resource,!0);let R={DateLessThan:{"AWS:EpochTime":eo(u.expiresAt)}};if(u.activeAt!==void 0)R.DateGreaterThan={"AWS:EpochTime":eo(u.activeAt)};if(u.ipAddress)R.IpAddress={"AWS:SourceIp":u.ipAddress};return JSON.stringify({Statement:[{Resource:u.resource,Condition:R}]})}function HS(u,f,R){Zu(u);let A=eo(f),T=u.includes("?")?"&":"?",E=Yu({resource:u,expiresAt:f}),P=Ju(E,R.privateKey);return`${u}${T}Expires=${A}&Signature=${encodeURIComponent(P)}&Key-Pair-Id=${encodeURIComponent(R.keyPairId)}`}function US(u,f){let R=Yu(u);return{"CloudFront-Key-Pair-Id":f.keyPairId,"CloudFront-Policy":Wu(Buffer.from(R)),"CloudFront-Signature":Ju(R,f.privateKey)}}function GS(u){if(!u.resource||/[\r\n]/.test(u.resource))throw TypeError("Media resource is invalid");let f=dg(Buffer.from(JSON.stringify({resource:u.resource,expiresAt:eo(u.expiresAt),...u.keyId?{keyId:u.keyId}:{},...u.audience?{audience:u.audience}:{}}))),R=Xl("sha256",u.secret).update(f).digest("base64url");return`${f}.${R}`}function jS(u,f){let[R,A,T]=u.split(".");if(!R||!A||T)return null;let E=Xl("sha256",f.secret).update(R).digest(),P;try{P=Buffer.from(A,"base64url")}catch{return null}if(E.length!==P.length||!lg(E,P))return null;try{let L=JSON.parse(Buffer.from(R,"base64url").toString("utf8")),z=eo(f.now??Date.now());if(!L.resource||!Number.isSafeInteger(L.expiresAt)||L.expiresAt<=z)return null;if(f.resource&&L.resource!==f.resource)return null;if(f.audience&&L.audience!==f.audience)return null;return L}catch{return null}}function KS(u,f=!1){let R=new URL(u,"https://media.invalid").pathname.toLowerCase(),A=/\.(?:m3u8|mpd|vtt|json)$/.test(R),T=/\.(?:key|license)$/.test(R)||R.includes("/keys/")||R.includes("/licenses/");return{"Accept-Ranges":"bytes","Cache-Control":f&&(A||T)?"private, no-store":A?"public, max-age=5, s-maxage=30, stale-while-revalidate=30":"public, max-age=31536000, immutable","Cross-Origin-Resource-Policy":"cross-origin","X-Content-Type-Options":"nosniff"}}function qS(u){if(!/^[a-z0-9][a-z0-9.-]{1,61}[a-z0-9]$/.test(u.bucket))throw TypeError("Media bucket is invalid");if(!/^[a-z0-9-]+$/.test(u.region))throw TypeError("Media bucket region is invalid");let f=u.prefix?`/${u.prefix.replace(/^\/+|\/+$/g,"")}`:"",R=u.protected??!1,A="public, max-age=31536000, immutable",T=R?"private, no-store":"public, max-age=5, s-maxage=30, stale-while-revalidate=30";return{originDomain:`${u.bucket}.s3.${u.region}.amazonaws.com`,originPath:f,domain:u.domain,trustedKeyGroupIds:[...new Set(u.trustedKeyGroupIds??[])],behaviors:[{pathPattern:"*.m3u8",cacheControl:T,compress:!0,signed:R},{pathPattern:"*.mpd",cacheControl:T,compress:!0,signed:R},{pathPattern:"*.vtt",cacheControl:T,compress:!0,signed:R},{pathPattern:"*",cacheControl:A,compress:!1,signed:R}],responseHeaders:{"Access-Control-Allow-Headers":"Range, If-Range","Access-Control-Allow-Methods":"GET, HEAD, OPTIONS","Access-Control-Allow-Origin":"*","Access-Control-Expose-Headers":"Accept-Ranges, Content-Length, Content-Range, ETag","X-Content-Type-Options":"nosniff"}}}class yg{builder;config;environment;mergedConfig;serverEipLogicalIds=new Map;storageFailoverReplicas=[];constructor(u){this.config=u.config,this.environment=u.environment,this.builder=new sl(`${this.config.project.name} - ${this.environment}`),this.mergedConfig=this.mergeEnvironmentConfig()}mergeEnvironmentConfig(){let f=this.config.environments[this.environment]?.infrastructure;if(!f)return this.config;return{...this.config,infrastructure:{...this.config.infrastructure,...f,compute:{...this.config.infrastructure?.compute,...f.compute},storage:{...this.config.infrastructure?.storage,...f.storage},functions:{...this.config.infrastructure?.functions,...f.functions},servers:{...this.config.infrastructure?.servers,...f.servers},databases:{...this.config.infrastructure?.databases,...f.databases},cdn:{...this.config.infrastructure?.cdn,...f.cdn},sftp:f.sftp??this.config.infrastructure?.sftp,queues:{...this.config.infrastructure?.queues,...f.queues},redirects:{...this.config.infrastructure?.redirects,...f.redirects},realtime:{...this.config.infrastructure?.realtime,...f.realtime},cache:{...this.config.infrastructure?.cache,...f.cache},fileSystem:{...this.config.infrastructure?.fileSystem,...f.fileSystem},email:{...this.config.infrastructure?.email,...f.email},search:{...this.config.infrastructure?.search,...f.search},ai:{...this.config.infrastructure?.ai,...f.ai}}}}shouldDeploy(u){if(u.environments&&!u.environments.includes(this.environment))return!1;if(u.requiresFeatures){let f=this.config.features||{};if(!u.requiresFeatures.every((A)=>f[A]===!0))return!1}if(u.regions){let f=this.config.environments[this.environment]?.region||this.config.project.region;if(!u.regions.includes(f))return!1}if(u.condition&&typeof u.condition==="function")return u.condition(this.config,this.environment);return!0}resolveApiOriginPort(){let u=this.mergedConfig.infrastructure?.api?.port??this.mergedConfig.ports?.api,f=Number(u||3008);return Number.isFinite(f)&&f>0?f:3008}defaultComputeCachePathPatterns(){return["/api/*","/auth/*","/publisher/api/*","/publisher/*","/publish","/publish/*","/analytics/*","/packages/*","/npm/*","/zig/*","/php/*","/commits/*","/health","/dashboard/*","/search","/login","/logout","/signup","/account","/account/*"]}shouldRouteStorageBucketToCompute(u,f){return u==="public"||f.routeCompute===!0}storageBucketName(u,f,R){return this.mergedConfig.infrastructure?.storage?.[R]?.bucket??`${u}-${f}-${R}`}fileSystemLogicalId(u,f,R){return t(r({slug:`${u}-${R}`,environment:f,resourceType:"efs"}))}resolveSftpStorage(u,f,R){let A=u.storage;if(A?.type==="efs"&&A.fileSystem){if(!this.mergedConfig.infrastructure?.fileSystem?.[A.fileSystem])throw Error(`sftp: storage.fileSystem "${A.fileSystem}" is not defined in infrastructure.fileSystem`);return{type:"efs",fileSystemId:{Ref:this.fileSystemLogicalId(f,R,A.fileSystem)},posixProfile:A.posixProfile}}if(A?.type==="s3"&&A.storageBucket){if(!this.mergedConfig.infrastructure?.storage?.[A.storageBucket])throw Error(`sftp: storage.storageBucket "${A.storageBucket}" is not defined in infrastructure.storage`);return{type:"s3",bucket:this.storageBucketName(f,R,A.storageBucket)}}return}resolveComputeCachePathPatterns(u){if(u&&u.length>0)return u;return this.defaultComputeCachePathPatterns()}createComputeCacheBehavior(u,f){return{PathPattern:u,TargetOriginId:f,ViewerProtocolPolicy:"redirect-to-https",AllowedMethods:["GET","HEAD","OPTIONS","PUT","POST","PATCH","DELETE"],CachedMethods:["GET","HEAD"],Compress:!0,CachePolicyId:"4135ea2d-6df8-44a3-9df3-4b5a84be39ad",OriginRequestPolicyId:"b689b0a8-53d0-40ab-baf2-68738e2966ac"}}appendComputeAppOrigin(u,f,R,A,T,E){let P=this.serverEipLogicalIds.get("app"),L=this.serverEipLogicalIds.get("appInstance");if(!P)return;let z=`EC2-${A}-${T}-api`,fe=this.mergedConfig.infrastructure?.servers?.app?.region||this.mergedConfig.project?.region||"us-east-1",me=fe==="us-east-1"?".compute-1.amazonaws.com":`.${fe}.compute.amazonaws.com`,At={"Fn::Join":["",["ec2-",{"Fn::Join":["-",{"Fn::Split":[".",{Ref:P}]}]},me]]},Lt=this.resolveApiOriginPort();if(u.push({Id:z,DomainName:At,CustomOriginConfig:{HTTPPort:Lt,HTTPSPort:443,OriginProtocolPolicy:"http-only",OriginSSLProtocols:["TLSv1.2"]}}),R.push(P),L)R.push(L);for(let mt of E)f.push(this.createComputeCacheBehavior(mt,z))}buildCaddyfile(u){let f=u.filter(([,T])=>typeof T.domain==="string"&&T.domain&&typeof T.port==="number");if(f.length===0)return;let R=new Map;for(let[,T]of f){let E=R.get(T.domain)??[];E.push({port:T.port,path:T.path}),R.set(T.domain,E)}let A=[];for(let[T,E]of R){let L=[...E].sort((z,fe)=>{let me=!z.path||z.path==="/",At=!fe.path||fe.path==="/";if(me&&!At)return 1;if(!me&&At)return-1;return(fe.path?.length??0)-(z.path?.length??0)}).map((z)=>{let fe=!z.path||z.path==="/",me=`reverse_proxy localhost:${z.port}`;return fe?`  handle {
+import{DI,PI,el,um,tl,rl,on,Q,l,nl,gm,K,il,g,zA,b,Xe,zi,an,w,be,sl,KA,r,t,kI,NI,p,BI,xI,OI,_I,LI,sr,ol,Ki,WA,$I,MI,xe,Ye,al,pm,mm,FI,fm,hm,Am,Mo,cl,ce,cn,Tt,Fo,wt,Ce,JA,dl,Uo,ym,Sm,Im,bm,ll,UI,W,C,XA,YA,Cm,a,y,Ze,m,Em,et,J,Rt,QI,vm,X,ul,Oe,or,Qo,de,gl,le,ZA,Ho,Y,Z,_,Wi,D,ar,Dt,ee,e,dn,HI,Tm,pl,GI,VI,qI,jI,ml,zI,KI,WI,JI,XI,YI,ZI,eb,tb,rb,nb,ib,ey,ty,ry,ny,iy,sy,oy,cr,wm,Rm,dr,Ji,sb,Dm,ob,ab,ln,cb,db,lb,ub,gb,pb,ay,cy,dy,ly,uy,Xi,mb,Go,gy,Pm,V,py,tt,Vo,Pt,my,km,fy,hy,Ay,Nm,q,fb,hb,Ab,yb,yy,Sb,te,Ib,bb,Cb,fl,hl,Sy,Bm,xm,Eb,vb,Tb,wb,Rb,Iy,Al,Db,Pb,kb,Nb,Bb,by,Cy,xb,Ob,_b,Lb,$b,Mb,Fb,Ey,Ub,Om,yl,Qb,Hb,Gb,Vb,_m,Lm,$m,qb,Sl,vy,Ty,wy,Ry,Il,Dy,jb,zb,Kb,Wb,Jb,Xb,Yb,Py,ky,Ny,By,Mm,Zb,eC,tC,rC,nC,iC,sC,oC,aC,xy,Oy,_y,Ly,cC,dC,Fm,lC,Um,Qm,Hm,Gm,uC,gC,pC,mC,_e,Yi,fC,hC,AC,yC,SC,IC,bC,CC,$y,EC,vC,Vm,qm,TC,wC,My,RC,DC,PC,kC,NC,BC,xC,OC,_C,LC,$C,MC,FC,UC,QC,HC,GC,VC,qC,jC,zC,bl,Fy,Cl,Uy,El,Qy,vl,Hy,Tl,Gy,lr,Vy,wl,qy,Zi,jy,Rl,zy,Dl,Ky,jm,KC,zm,WC,Pl,Wy,ur,Jy,Km,JC,kl,Xy,Wm,XC,Jm,YC,Xm,ZC,Nl,Yy,Ym,eE,Zm,tE,ef,rE,tf,nE,Bl,Zy,xl,eS,rf,iE,nf,sE,sf,oE,of,aE,af,cE,cf,dE,Ol,tS,df,lE,lf,uE,uf,gE,gf,pE,pf,mE,mf,fE,ff,hf,Af,yf,Sf,hE,If,AE,bf,yE,Cf,SE,rt,Ef,rS,qo,_l,un,nS,es,gr,Ll,$l,iS,sS,Ml,vf,Fl,Tf,IE,bE,jo,zo,Ko,Ul,gn,Ql,Hl,ts,Wo,Jo,wf,oS,aS,cS,CE,Rf,Df,EE,dS,Pf,lS,uS,gS,vE,kf,pn,Gl,Nf,TE,pS,Xo,Yo,Vl,Bf,wE,ql,mS,xf,RE,Of,DE,_f,PE}from"./chunk-zvcd6x45.js";import{jl,k,zl,Zo,fS,Lf,hS,AS,yS,SS,IS,bS,CS,ES}from"./chunk-a99wz633.js";import{sa,$f,eu,RS,ss,tu,oa,Mf,Ff,fn,aa,ru,it,nu,iu,su,os,hn,Uf,st,ou,ca,da,la,au,cu,du,as,ua,lu,An,cs,ga,kt,Qf,uu,gu,Hf,pu,pa,pr,mu,fu,hu,Au,ot,Gf,yu,mr,ma,fa,ha,ds,ls,yn,Su,us,Aa,ya,Sn,Iu,In,Vf,qf,Nt,bn,Sa,jf,bu,Cu,Ia,Eu,vu,Tu,DS,ue,wu,PS,kS,gs,ps,NS,Ee,zf,Bt,Le,$e,xt,Ru,Du,Pu,ku,Kf,Wf,ba,Jf,Xf,Ca,Nu,Bu,Yf,ge,Zf,xu,ve,Ea,at,Ot,_t,Cn,ms,Ou,BS,eh,th,rh,nh,va,Ta,_u,wa,En,Ra,Lu,fs,$u,Da,Pa,ka,Na,Ba,xa,Oa,_a,Mu,fr,La,Fu,vn,Uu,$a,Ma,Qu,hr,Fa,Ua,ih,xS,hs,OS,_S,LS,Qa,Ha,Hu,sh,Ga,Tn,Gu,As,Vu,qu,ju,Va,oh,qa,zu,ah,ja,ch,wn,Rn,Ku,ys,eg,ig,sg,og,ag,cg,Is,Ar,Ka,Dn,Pn,yr,ct,hh,Ja,Ah,yh,ug,Xa,Cs,gg,Ya,$t,Fe,pg,Za,ec,mg,tc,rc,nc,ic,fg,hg,Nn,sc,oc,ac,cc,Ag,Es,Bn,vs,dc}from"./chunk-4f0b21fp.js";import{U,qr,fd,po,d,Fp,Up}from"./chunk-2hma3g5q.js";import{It,md,ki,Ni,Bi,Mp}from"./chunk-apj1eqcy.js";import{zh,Kh,Wh,Sp,Ip,bp,Jh,Cp,Ep,Xh,Yh,vp,Zh,eA,gd,Tp,tA,rA,wp,nA,iA,sA,oA,aA,cA,dA,Pi,pd,Rp,Dp,Pp,kp,Np,Bp,xp,Op,_p,Lp,$p,lA,uA,gA,pA,mA,fA,hA}from"./chunk-184bvh5s.js";import{Ke,hd,Ie,Yt,Ad,x,Zt,bt,yd,mo,SA,Qp,Sd,s,xi,fo,jr,Id,bd,zr,IA,Cd,vI,TI,ho,wI,RI,Ed,vd,Oi,Ao,ae,c,yo,We,Kr,bA,CA,Td,EA,So,vA,TA,Io,wd,Wr,bo,wA,er,Rd,Hp,tr,Jr,RA,Co,DA,O,PA,Dd,Gp,Eo,kA,NA,BA,Pd,_i,vo,kd,rr,Ct,xA,Xr,OA,Nd,Vp,qp,To,Bd,xd,Et,jp,Li,Od,wo,Yr,zp,$i,_d,Ld,Mi,Kp,$d,Md,Fd,Ud,Ro,Wp,Jp,_A,Xp,Qd,Fi,Yp,Zp,Do,Zr,Po,ko,No,Hd,em,Gd,Bo,LA,nr,$A,Vd,en,qd,MA,jd,tm,Ui,tn,xo,Qi,Je,FA,rm,nm,ir,zd,Kd,Wd,Hi,Gi,Vi,UA,QA,vt,Oo,HA,rn,im,_o,GA,sm,om,am,VA,cm,dm,qA,i,jA,qi,Lo,$o}from"./chunk-430acqjk.js";import{n}from"./chunk-e42gpavb.js";import{Re,gt,Vn}from"./chunk-qyr5hn6v.js";import{o}from"./chunk-jyvnfny6.js";import{Te,Ns,Bs,Ig,mc,fc,xs,hc,dt,re,lt,pe,v,we,Ln,Ac,Ue,yc,$n,Mn,Un,Mt,Ft,Ut,Qn,Ir,Sc,br,Cr,ut,Hn,bc,Qt,Er,Gn,Ec,Tg,wg,vc,vr}from"./chunk-nhsefr22.js";import{pt,he,Ge,Rg,Ht,wc,Rc,Gt,H,qn,Vt,qt,jn,$s,Ms,Tr,wr,zn,Rr,Fs,Us,Qs,Hs,ie,Gs,Vs,qs,js,Ae,zs,Ks,Ws,N,Dc,Kn,Pc,ye,Dr}from"./chunk-smt4t6rc.js";import{ne}from"./chunk-mp2y4t6w.js";import{Dg,kc,Pg,De,Nc,Wn,kg,Bc,Ng,Bg,Nh,Xn,Xs,M,Br,Yn,Zn,xr,_r,ei,Ys,ti,ri,ni,ii,oi,Lr,Se,_c,ai,Lc,$r,Fc,Ve,se,qe,je,ft,di,li,Pe,Mr,ke,gi,pi,mi,fi,hi,Ai,yi,Fr,F,ro,ip,Jc,Ii,bi,Ci,Ei,rd,no,nd,Jt,vi,io,so,id,Ti,sd}from"./chunk-y2dej583.js";import{ao,lo,uo,B,Ne}from"./chunk-yt8qgn5d.js";import{Kl,ea,rs,ns,ta,Wl,Jl,is,ra,na,Yl,Zl,ia}from"./chunk-gmtds745.js";import{lc,xn,On,Ts,ws,Rs,Ds,uc,gc}from"./chunk-94z7s8ky.js";import{pc}from"./chunk-hybz2q8w.js";import{Tc,Qe,S}from"./chunk-stc3ykm3.js";import{He}from"./chunk-vgtqd3sb.js";import{I}from"./chunk-y7k5872m.js";import{oe,wi,oo,od,Ri,pp}from"./chunk-wbbbpt4v.js";import{Qr,Be}from"./chunk-80bgb48v.js";import{h}from"./chunk-d245va6b.js";import{Jd,nn,Xd,Yd,Zd,ji,lm,sn}from"./chunk-qjp3f5y8.js";import{vS,nt}from"./chunk-c482jhc6.js";var qh="https://api.machines.dev/v1";class Ls extends Error{status;path;constructor(u,f,R){super(u);this.status=f;this.path=R;this.name="FlyApiError"}}function Qc(u){let f=u.ip.includes(":");if(f&&u.ip.startsWith("fdaa:"))return"private_v6";if(u.shared)return"shared_v4";return f?"v6":"v4"}class hp{token;fetch;constructor(u){if(!u.token)throw Error("Fly.io needs an API token: set FLY_API_TOKEN (`fly tokens create deploy` makes one scoped to an app).");this.token=u.token,this.fetch=u.fetch??fetch}async rest(u,f,R={}){let A=new URL(`https://api.machines.dev/v1${f}`);for(let[L,z]of Object.entries(R.query??{}))A.searchParams.set(L,z);let T=await this.fetch(A,{method:u,headers:{Authorization:`Bearer ${this.token}`,...R.body!==void 0?{"Content-Type":"application/json"}:{},...R.headers},body:R.body===void 0?void 0:JSON.stringify(R.body)});if(T.status===404&&R.notFound==="null")return null;let E=await T.text(),P=E?yp(E):void 0;if(!T.ok){let L=typeof P==="object"&&P&&"error"in P?String(P.error):E||T.statusText;throw new Ls(`Fly.io ${u} ${f} failed (${T.status}): ${L}`,T.status,f)}return P}getApp(u){return this.rest("GET",`/apps/${encodeURIComponent(u)}`,{notFound:"null"})}createApp(u,f){return this.rest("POST","/apps",{body:{app_name:u,org_slug:f}})}async listMachines(u){return await this.rest("GET",`/apps/${encodeURIComponent(u)}/machines`)??[]}createMachine(u,f){return this.rest("POST",`/apps/${encodeURIComponent(u)}/machines`,{body:f})}updateMachine(u,f,R,A){return this.rest("POST",`/apps/${encodeURIComponent(u)}/machines/${encodeURIComponent(f)}`,{body:R,headers:{"fly-machine-lease-nonce":A}})}async acquireLease(u,f,R=120){let T=(await this.rest("POST",`/apps/${encodeURIComponent(u)}/machines/${encodeURIComponent(f)}/lease`,{body:{ttl:R}})).data?.nonce;if(!T)throw new Ls(`Fly.io gave no lease nonce for Machine ${f}`,200,`/machines/${f}/lease`);return T}async releaseLease(u,f,R){await this.rest("DELETE",`/apps/${encodeURIComponent(u)}/machines/${encodeURIComponent(f)}/lease`,{headers:{"fly-machine-lease-nonce":R}})}async waitForState(u,f,R,A={}){await this.rest("GET",`/apps/${encodeURIComponent(u)}/machines/${encodeURIComponent(f)}/wait`,{query:{state:R,timeout:String(A.timeoutSeconds??60),...A.instanceId?{instance_id:A.instanceId}:{}}})}async listVolumes(u){return await this.rest("GET",`/apps/${encodeURIComponent(u)}/volumes`)??[]}createVolume(u,f){return this.rest("POST",`/apps/${encodeURIComponent(u)}/volumes`,{body:{...f,encrypted:!0}})}async setSecrets(u,f){return(await this.rest("POST",`/apps/${encodeURIComponent(u)}/secrets`,{body:{values:f}})).version}async listIpAssignments(u){return(await this.rest("GET",`/apps/${encodeURIComponent(u)}/ip_assignments`)).ips??[]}async assignIp(u,f){let R=await this.rest("POST",`/apps/${encodeURIComponent(u)}/ip_assignments`,{body:{type:f}});if(!R.ip)throw new Ls(`Fly.io assigned no ${f} address to ${u}`,200,`/apps/${u}/ip_assignments`);return{ip:R.ip,shared:R.shared??f==="shared_v4",region:R.region}}async requestCertificate(u,f){return this.rest("POST",`/apps/${encodeURIComponent(u)}/certificates/acme`,{body:{hostname:f}})}}function yp(u){try{return JSON.parse(u)}catch{return}}var Wc="ts-cloud-role";function $S(u,f){let R=u.fly??{},A=R.app??`${u.project.slug}-${f.environment}`;if(!/^[a-z0-9][a-z0-9-]{1,61}[a-z0-9]$/.test(A))throw Error(`"${A}" is not a valid Fly app name: lowercase letters, digits and dashes, 3 to 63 characters.`);let T=R.internalPort??3000,E=R.count??1;if(!Number.isInteger(E)||E<1)throw Error(`fly.count must be a whole number of at least 1, got ${E}.`);return{app:A,org:R.org??"personal",image:f.image,regions:R.regions?.length?R.regions:["iad"],count:E,internalPort:T,healthPath:R.healthPath??"/",vm:{cpuKind:R.vm?.cpuKind??"shared",cpus:R.vm?.cpus??1,memoryMb:R.vm?.memoryMb??512},...R.volume?{volume:{name:R.volume.name??"data",sizeGb:R.volume.sizeGb,path:R.volume.path}}:{},autoStop:R.autoStop??!1,env:{...f.env,PORT:String(T)},secrets:f.secrets??{},hostnames:R.hostnames??[],release:f.release}}function Ap(u){return{image:u.image,env:u.env,guest:{cpu_kind:u.vm.cpuKind,cpus:u.vm.cpus,memory_mb:u.vm.memoryMb},services:[{protocol:"tcp",internal_port:u.internalPort,ports:[{port:80,handlers:["http"],force_https:!0},{port:443,handlers:["tls","http"]}],autostop:u.autoStop?"stop":"off",autostart:!0,...u.autoStop?{min_machines_running:0}:{},checks:[{type:"http",method:"GET",path:u.healthPath,interval:"15s",timeout:"5s",grace_period:"10s"}]}],restart:{policy:"on-failure",max_retries:10},metadata:{[Wc]:"app","ts-cloud-release":u.release}}}async function wS(u,f,R=()=>{}){let A=!1;if(!await u.getApp(f.app))R(`Creating Fly app ${f.app} in ${f.org}`),await u.createApp(f.app,f.org),A=!0;let T;if(Object.keys(f.secrets).length>0)T=await u.setSecrets(f.app,f.secrets),R(`Set ${Object.keys(f.secrets).length} secret(s) (version ${T})`);let E=await u.listIpAssignments(f.app),P=new Set(E.map(Qc));if(!P.has("v6"))E.push(await u.assignIp(f.app,"v6")),R("Assigned a dedicated IPv6");if(!P.has("v4")&&!P.has("shared_v4"))E.push(await u.assignIp(f.app,"shared_v4")),R("Assigned a shared IPv4");let L=Ap(f),z=(await u.listMachines(f.app)).filter((Me)=>{let ze=Me.config?.metadata??{};if(ze[Wc])return ze[Wc]==="app";return!ze.fly_process_group||ze.fly_process_group==="app"}),fe=f.volume?await u.listVolumes(f.app):[],me=[],At=[],Lt=new Set;for(let Me of f.regions){let ze=z.filter((j)=>j.region===Me).sort((j,yt)=>j.id.localeCompare(yt.id));for(let j=0;j<f.count;j++){let yt=ze[j];if(yt){Lt.add(yt.id),await tg(u,f.app,yt,L,T),At.push(yt.id),R(`Updated ${yt.id} (${Me}) to ${f.image}`);continue}let G=f.volume?[{volume:(await rg(u,f,Me,fe)).id,path:f.volume.path}]:void 0,ht=await u.createMachine(f.app,{region:Me,name:`${f.app}-${Me}-${j+1}`,config:{...L,...G?{mounts:G}:{}},...T!==void 0?{min_secrets_version:T}:{}});await u.waitForState(f.app,ht.id,"started",{instanceId:ht.instance_id}),me.push(ht.id),R(`Created ${ht.id} in ${Me}`)}}let mt=[];for(let Me of f.hostnames)mt.push(await u.requestCertificate(f.app,Me));return{app:f.app,url:`https://${f.app}.fly.dev`,createdApp:A,created:me,updated:At,untouched:z.filter((Me)=>!Lt.has(Me.id)).map((Me)=>Me.id),ips:E,certificates:mt}}async function tg(u,f,R,A,T){let E=await u.acquireLease(f,R.id);try{let P=await u.updateMachine(f,R.id,{config:{...A,...R.config?.mounts?.length?{mounts:R.config.mounts}:{}},...T!==void 0?{min_secrets_version:T}:{}},E);await u.waitForState(f,R.id,"started",{instanceId:P.instance_id})}finally{await u.releaseLease(f,R.id,E)}}async function rg(u,f,R,A){let T=A.find((P)=>P.region===R&&P.name===f.volume.name&&!P.attached_machine_id);if(T)return T.attached_machine_id="pending",T;let E=await u.createVolume(f.app,{name:f.volume.name,region:R,size_gb:f.volume.sizeGb});return A.push({...E,attached_machine_id:"pending"}),E}import{createHmac as Xl,createSign as ng,timingSafeEqual as lg}from"node:crypto";function eo(u){let f=u instanceof Date?u.getTime():u;if(!Number.isFinite(f))throw TypeError("Media access timestamp must be finite");return Math.floor(f/1000)}function Wu(u){return Buffer.from(u).toString("base64").replaceAll("+","-").replaceAll("=","_").replaceAll("/","~")}function dg(u){return Buffer.from(u).toString("base64url")}function Zu(u,f=!1){if(!u||/[\r\n]/.test(u))throw TypeError("Media resource is invalid");let R=f?u.replaceAll("*","wildcard"):u,A=new URL(R);if(!["http:","https:"].includes(A.protocol))throw TypeError("Media resource must use HTTP or HTTPS");if(!f&&u.includes("*"))throw TypeError("Canned policies cannot contain wildcards")}function Ju(u,f){let R=ng("RSA-SHA1");return R.update(u),R.end(),Wu(R.sign(f))}function Yu(u){Zu(u.resource,!0);let R={DateLessThan:{"AWS:EpochTime":eo(u.expiresAt)}};if(u.activeAt!==void 0)R.DateGreaterThan={"AWS:EpochTime":eo(u.activeAt)};if(u.ipAddress)R.IpAddress={"AWS:SourceIp":u.ipAddress};return JSON.stringify({Statement:[{Resource:u.resource,Condition:R}]})}function HS(u,f,R){Zu(u);let A=eo(f),T=u.includes("?")?"&":"?",E=Yu({resource:u,expiresAt:f}),P=Ju(E,R.privateKey);return`${u}${T}Expires=${A}&Signature=${encodeURIComponent(P)}&Key-Pair-Id=${encodeURIComponent(R.keyPairId)}`}function US(u,f){let R=Yu(u);return{"CloudFront-Key-Pair-Id":f.keyPairId,"CloudFront-Policy":Wu(Buffer.from(R)),"CloudFront-Signature":Ju(R,f.privateKey)}}function GS(u){if(!u.resource||/[\r\n]/.test(u.resource))throw TypeError("Media resource is invalid");let f=dg(Buffer.from(JSON.stringify({resource:u.resource,expiresAt:eo(u.expiresAt),...u.keyId?{keyId:u.keyId}:{},...u.audience?{audience:u.audience}:{}}))),R=Xl("sha256",u.secret).update(f).digest("base64url");return`${f}.${R}`}function jS(u,f){let[R,A,T]=u.split(".");if(!R||!A||T)return null;let E=Xl("sha256",f.secret).update(R).digest(),P;try{P=Buffer.from(A,"base64url")}catch{return null}if(E.length!==P.length||!lg(E,P))return null;try{let L=JSON.parse(Buffer.from(R,"base64url").toString("utf8")),z=eo(f.now??Date.now());if(!L.resource||!Number.isSafeInteger(L.expiresAt)||L.expiresAt<=z)return null;if(f.resource&&L.resource!==f.resource)return null;if(f.audience&&L.audience!==f.audience)return null;return L}catch{return null}}function KS(u,f=!1){let R=new URL(u,"https://media.invalid").pathname.toLowerCase(),A=/\.(?:m3u8|mpd|vtt|json)$/.test(R),T=/\.(?:key|license)$/.test(R)||R.includes("/keys/")||R.includes("/licenses/");return{"Accept-Ranges":"bytes","Cache-Control":f&&(A||T)?"private, no-store":A?"public, max-age=5, s-maxage=30, stale-while-revalidate=30":"public, max-age=31536000, immutable","Cross-Origin-Resource-Policy":"cross-origin","X-Content-Type-Options":"nosniff"}}function qS(u){if(!/^[a-z0-9][a-z0-9.-]{1,61}[a-z0-9]$/.test(u.bucket))throw TypeError("Media bucket is invalid");if(!/^[a-z0-9-]+$/.test(u.region))throw TypeError("Media bucket region is invalid");let f=u.prefix?`/${u.prefix.replace(/^\/+|\/+$/g,"")}`:"",R=u.protected??!1,A="public, max-age=31536000, immutable",T=R?"private, no-store":"public, max-age=5, s-maxage=30, stale-while-revalidate=30";return{originDomain:`${u.bucket}.s3.${u.region}.amazonaws.com`,originPath:f,domain:u.domain,trustedKeyGroupIds:[...new Set(u.trustedKeyGroupIds??[])],behaviors:[{pathPattern:"*.m3u8",cacheControl:T,compress:!0,signed:R},{pathPattern:"*.mpd",cacheControl:T,compress:!0,signed:R},{pathPattern:"*.vtt",cacheControl:T,compress:!0,signed:R},{pathPattern:"*",cacheControl:A,compress:!1,signed:R}],responseHeaders:{"Access-Control-Allow-Headers":"Range, If-Range","Access-Control-Allow-Methods":"GET, HEAD, OPTIONS","Access-Control-Allow-Origin":"*","Access-Control-Expose-Headers":"Accept-Ranges, Content-Length, Content-Range, ETag","X-Content-Type-Options":"nosniff"}}}class yg{builder;config;environment;mergedConfig;serverEipLogicalIds=new Map;storageFailoverReplicas=[];constructor(u){this.config=u.config,this.environment=u.environment,this.builder=new sl(`${this.config.project.name} - ${this.environment}`),this.mergedConfig=this.mergeEnvironmentConfig()}mergeEnvironmentConfig(){let f=this.config.environments[this.environment]?.infrastructure;if(!f)return this.config;return{...this.config,infrastructure:{...this.config.infrastructure,...f,compute:{...this.config.infrastructure?.compute,...f.compute},storage:{...this.config.infrastructure?.storage,...f.storage},functions:{...this.config.infrastructure?.functions,...f.functions},servers:{...this.config.infrastructure?.servers,...f.servers},databases:{...this.config.infrastructure?.databases,...f.databases},cdn:{...this.config.infrastructure?.cdn,...f.cdn},sftp:f.sftp??this.config.infrastructure?.sftp,queues:{...this.config.infrastructure?.queues,...f.queues},redirects:{...this.config.infrastructure?.redirects,...f.redirects},realtime:{...this.config.infrastructure?.realtime,...f.realtime},cache:{...this.config.infrastructure?.cache,...f.cache},fileSystem:{...this.config.infrastructure?.fileSystem,...f.fileSystem},email:{...this.config.infrastructure?.email,...f.email},search:{...this.config.infrastructure?.search,...f.search},ai:{...this.config.infrastructure?.ai,...f.ai}}}}shouldDeploy(u){if(u.environments&&!u.environments.includes(this.environment))return!1;if(u.requiresFeatures){let f=this.config.features||{};if(!u.requiresFeatures.every((A)=>f[A]===!0))return!1}if(u.regions){let f=this.config.environments[this.environment]?.region||this.config.project.region;if(!u.regions.includes(f))return!1}if(u.condition&&typeof u.condition==="function")return u.condition(this.config,this.environment);return!0}resolveApiOriginPort(){let u=this.mergedConfig.infrastructure?.api?.port??this.mergedConfig.ports?.api,f=Number(u||3008);return Number.isFinite(f)&&f>0?f:3008}defaultComputeCachePathPatterns(){return["/api/*","/auth/*","/publisher/api/*","/publisher/*","/publish","/publish/*","/analytics/*","/packages/*","/npm/*","/zig/*","/php/*","/commits/*","/health","/dashboard/*","/search","/login","/logout","/signup","/account","/account/*"]}shouldRouteStorageBucketToCompute(u,f){return u==="public"||f.routeCompute===!0}storageBucketName(u,f,R){return this.mergedConfig.infrastructure?.storage?.[R]?.bucket??`${u}-${f}-${R}`}fileSystemLogicalId(u,f,R){return t(r({slug:`${u}-${R}`,environment:f,resourceType:"efs"}))}resolveSftpStorage(u,f,R){let A=u.storage;if(A?.type==="efs"&&A.fileSystem){if(!this.mergedConfig.infrastructure?.fileSystem?.[A.fileSystem])throw Error(`sftp: storage.fileSystem "${A.fileSystem}" is not defined in infrastructure.fileSystem`);return{type:"efs",fileSystemId:{Ref:this.fileSystemLogicalId(f,R,A.fileSystem)},posixProfile:A.posixProfile}}if(A?.type==="s3"&&A.storageBucket){if(!this.mergedConfig.infrastructure?.storage?.[A.storageBucket])throw Error(`sftp: storage.storageBucket "${A.storageBucket}" is not defined in infrastructure.storage`);return{type:"s3",bucket:this.storageBucketName(f,R,A.storageBucket)}}return}resolveComputeCachePathPatterns(u){if(u&&u.length>0)return u;return this.defaultComputeCachePathPatterns()}createComputeCacheBehavior(u,f){return{PathPattern:u,TargetOriginId:f,ViewerProtocolPolicy:"redirect-to-https",AllowedMethods:["GET","HEAD","OPTIONS","PUT","POST","PATCH","DELETE"],CachedMethods:["GET","HEAD"],Compress:!0,CachePolicyId:"4135ea2d-6df8-44a3-9df3-4b5a84be39ad",OriginRequestPolicyId:"b689b0a8-53d0-40ab-baf2-68738e2966ac"}}appendComputeAppOrigin(u,f,R,A,T,E){let P=this.serverEipLogicalIds.get("app"),L=this.serverEipLogicalIds.get("appInstance");if(!P)return;let z=`EC2-${A}-${T}-api`,fe=this.mergedConfig.infrastructure?.servers?.app?.region||this.mergedConfig.project?.region||"us-east-1",me=fe==="us-east-1"?".compute-1.amazonaws.com":`.${fe}.compute.amazonaws.com`,At={"Fn::Join":["",["ec2-",{"Fn::Join":["-",{"Fn::Split":[".",{Ref:P}]}]},me]]},Lt=this.resolveApiOriginPort();if(u.push({Id:z,DomainName:At,CustomOriginConfig:{HTTPPort:Lt,HTTPSPort:443,OriginProtocolPolicy:"http-only",OriginSSLProtocols:["TLSv1.2"]}}),R.push(P),L)R.push(L);for(let mt of E)f.push(this.createComputeCacheBehavior(mt,z))}buildCaddyfile(u){let f=u.filter(([,T])=>typeof T.domain==="string"&&T.domain&&typeof T.port==="number");if(f.length===0)return;let R=new Map;for(let[,T]of f){let E=R.get(T.domain)??[];E.push({port:T.port,path:T.path}),R.set(T.domain,E)}let A=[];for(let[T,E]of R){let L=[...E].sort((z,fe)=>{let me=!z.path||z.path==="/",At=!fe.path||fe.path==="/";if(me&&!At)return 1;if(!me&&At)return-1;return(fe.path?.length??0)-(z.path?.length??0)}).map((z)=>{let fe=!z.path||z.path==="/",me=`reverse_proxy localhost:${z.port}`;return fe?`  handle {
     ${me}
   }`:`  handle ${z.path} {
     ${me}

package/dist/mail/index.js

@@ -1,3 +1,3 @@
-import{b,Xe,zi,an,w}from"../chunk-zvcd6x45.js";import"../chunk-a99wz633.js";import"../chunk-2hma3g5q.js";import{B,R,yt,G}from"../chunk-yt8qgn5d.js";function a(t){return`'${t.replace(/'/g,"'\\''")}'`}function h(t,e="/etc/mail/mail.env",r="/usr/local/bin/bun"){let i={SMTP_ENABLE_WEBMAIL:String(t.webmail.enabled),SMTP_WEBMAIL_PORT:String(t.webmail.port),SMTP_WEBMAIL_TLS:String(t.webmail.tls),SMTP_WEBMAIL_SECURE_COOKIES:String(t.webmail.secureCookies),SMTP_WEBMAIL_ATTACHMENT_MAX_FILE:String(t.webmail.attachmentMaxFileBytes),SMTP_WEBMAIL_ATTACHMENT_MAX_TOTAL:String(t.webmail.attachmentMaxTotalBytes),SMTP_WEBMAIL_ATTACHMENT_MAX_COUNT:String(t.webmail.attachmentMaxCount),SMTP_WEBMAIL_UNDO_SEND_SECONDS:String(t.webmail.undoSendSeconds)},n="const fs=require('node:fs');const path=process.argv[1];const settings=JSON.parse(process.argv[2]);const before=fs.readFileSync(path,'utf8');const lines=before.split(/\\r?\\n/).filter(line=>line!==''&&!Object.hasOwn(settings,line.split('=',1)[0]));const after=lines.concat(Object.entries(settings).map(([key,value])=>key+'='+value)).join('\\n')+'\\n';if(after===before){console.log('unchanged')}else{const stat=fs.statSync(path);const backup=path+'.bak-webmail';fs.copyFileSync(path,backup);fs.chmodSync(backup,stat.mode&511);fs.chownSync(backup,stat.uid,stat.gid);const temporary=path+'.webmail-'+process.pid;fs.writeFileSync(temporary,after,{mode:stat.mode&511});fs.chownSync(temporary,stat.uid,stat.gid);fs.renameSync(temporary,path);console.log('changed')}";return`${a(r)} --eval ${a("const fs=require('node:fs');const path=process.argv[1];const settings=JSON.parse(process.argv[2]);const before=fs.readFileSync(path,'utf8');const lines=before.split(/\\r?\\n/).filter(line=>line!==''&&!Object.hasOwn(settings,line.split('=',1)[0]));const after=lines.concat(Object.entries(settings).map(([key,value])=>key+'='+value)).join('\\n')+'\\n';if(after===before){console.log('unchanged')}else{const stat=fs.statSync(path);const backup=path+'.bak-webmail';fs.copyFileSync(path,backup);fs.chmodSync(backup,stat.mode&511);fs.chownSync(backup,stat.uid,stat.gid);const temporary=path+'.webmail-'+process.pid;fs.writeFileSync(temporary,after,{mode:stat.mode&511});fs.chownSync(temporary,stat.uid,stat.gid);fs.renameSync(temporary,path);console.log('changed')}")} ${a(e)} ${a(JSON.stringify(i))}`}function p(t,e){let r=e.environment??"production",i=b(t,{environment:r});if(!i.enabled||!i.webmail.enabled)return"";if(!i.webmail.domain)throw Error("Mail webmail deployment needs a hostname; set mail.webmail.domain or use compute provisioning for a local catcher");if(i.webmail.tls)throw Error("Gateway webmail uses loopback HTTP: set mail.webmail.tls to false, or domain to false for a direct TLS listener");let n=w(t,{environment:r}),l=e.slug??t.project.slug,s=e.bunBin??"/usr/local/bin/bun",o=e.envFile??"/etc/mail/mail.env",c=e.service??"mail.service",m=e.healthPath??"/login";if(!/^[a-z0-9@._-]+$/i.test(c)||c.startsWith("-"))throw Error("Invalid mail service unit");if(!o.startsWith("/")||!m.startsWith("/")||/[\r\n]/.test(o+m))throw Error("Mail environment path must be absolute and health path must start with /");let g=B({},{proxy:n,slug:l,mail:i}),d=e.gateway!=="provision",u=["set -euo pipefail",`test -f ${a(o)}`,...d?[`test -x ${yt}`,`test -d ${R}/node_modules/@stacksjs/rpx`,...n.onDemandTls?[`test -f ${R}/node_modules/@stacksjs/tlsx/dist/bin/cli.js`]:[]]:[],`__tsc_mail_changed="$(${h(i,o,s)})"`,`if [ "$__tsc_mail_changed" = changed ] || ! systemctl is-active --quiet ${a(c)}; then systemctl restart ${a(c)}; fi`,`curl --fail --silent --show-error --retry 30 --retry-all-errors --retry-delay 1 --max-time 5 ${a(`http://127.0.0.1:${i.webmail.port}${m}`)} >/dev/null`,...G({config:g,proxy:n,slug:l,bunBin:s,tenant:d})];if(e.verify!==!1)for(let f of[i.webmail.domain,...i.webmail.aliases])u.push(`__tsc_mail_status="$(curl --fail --silent --show-error --retry 10 --retry-connrefused --retry-delay 3 --max-time 15 --output /dev/null --write-out '%{http_code}' ${a(`https://${f}${m}`)})"`,`if [ "$__tsc_mail_status" != 200 ]; then echo ${a(`ts-cloud: webmail verification failed for ${f}`)} >&2; exit 1; fi`);return u.push(`echo ${a(`[ts-cloud] Webmail deployed: ${[i.webmail.domain,...i.webmail.aliases].join(", ")}`)}`),`${u.join(`
+import{b,Xe,zi,an,w}from"../chunk-zvcd6x45.js";import"../chunk-a99wz633.js";import"../chunk-2hma3g5q.js";import{B,R,yt,G}from"../chunk-yt8qgn5d.js";function a(t){return`'${t.replace(/'/g,"'\\''")}'`}function h(t,e="/etc/mail/mail.env",r="/usr/local/bin/bun"){let i={SMTP_ENABLE_WEBMAIL:String(t.webmail.enabled),SMTP_WEBMAIL_PORT:String(t.webmail.port),SMTP_WEBMAIL_TLS:String(t.webmail.tls),SMTP_WEBMAIL_SECURE_COOKIES:String(t.webmail.secureCookies),SMTP_WEBMAIL_ATTACHMENT_MAX_FILE:String(t.webmail.attachmentMaxFileBytes),SMTP_WEBMAIL_ATTACHMENT_MAX_TOTAL:String(t.webmail.attachmentMaxTotalBytes),SMTP_WEBMAIL_ATTACHMENT_MAX_COUNT:String(t.webmail.attachmentMaxCount),SMTP_WEBMAIL_UNDO_SEND_SECONDS:String(t.webmail.undoSendSeconds)},s="const fs=require('node:fs');const path=process.argv[1];const settings=JSON.parse(process.argv[2]);const before=fs.readFileSync(path,'utf8');const lines=before.split(/\\r?\\n/).filter(line=>line!==''&&!Object.hasOwn(settings,line.split('=',1)[0]));const after=lines.concat(Object.entries(settings).map(([key,value])=>key+'='+value)).join('\\n')+'\\n';if(after===before){console.log('unchanged')}else{const stat=fs.statSync(path);const backup=path+'.bak-webmail';fs.copyFileSync(path,backup);fs.chmodSync(backup,stat.mode&511);fs.chownSync(backup,stat.uid,stat.gid);const temporary=path+'.webmail-'+process.pid;fs.writeFileSync(temporary,after,{mode:stat.mode&511});fs.chownSync(temporary,stat.uid,stat.gid);fs.chmodSync(temporary,stat.mode&511);fs.renameSync(temporary,path);console.log('changed')}";return`${a(r)} --eval ${a("const fs=require('node:fs');const path=process.argv[1];const settings=JSON.parse(process.argv[2]);const before=fs.readFileSync(path,'utf8');const lines=before.split(/\\r?\\n/).filter(line=>line!==''&&!Object.hasOwn(settings,line.split('=',1)[0]));const after=lines.concat(Object.entries(settings).map(([key,value])=>key+'='+value)).join('\\n')+'\\n';if(after===before){console.log('unchanged')}else{const stat=fs.statSync(path);const backup=path+'.bak-webmail';fs.copyFileSync(path,backup);fs.chmodSync(backup,stat.mode&511);fs.chownSync(backup,stat.uid,stat.gid);const temporary=path+'.webmail-'+process.pid;fs.writeFileSync(temporary,after,{mode:stat.mode&511});fs.chownSync(temporary,stat.uid,stat.gid);fs.chmodSync(temporary,stat.mode&511);fs.renameSync(temporary,path);console.log('changed')}")} ${a(e)} ${a(JSON.stringify(i))}`}function p(t,e){let r=e.environment??"production",i=b(t,{environment:r});if(!i.enabled||!i.webmail.enabled)return"";if(!i.webmail.domain)throw Error("Mail webmail deployment needs a hostname; set mail.webmail.domain or use compute provisioning for a local catcher");if(i.webmail.tls)throw Error("Gateway webmail uses loopback HTTP: set mail.webmail.tls to false, or domain to false for a direct TLS listener");let s=w(t,{environment:r}),o=e.slug??t.project.slug,n=e.bunBin??"/usr/local/bin/bun",l=e.envFile??"/etc/mail/mail.env",c=e.service??"mail.service",m=e.healthPath??"/login";if(!/^[a-z0-9@._-]+$/i.test(c)||c.startsWith("-"))throw Error("Invalid mail service unit");if(!l.startsWith("/")||!m.startsWith("/")||/[\r\n]/.test(l+m))throw Error("Mail environment path must be absolute and health path must start with /");let g=B({},{proxy:s,slug:o,mail:i}),u=e.gateway!=="provision",d=["set -euo pipefail",`test -f ${a(l)}`,...u?[`test -x ${yt}`,`test -d ${R}/node_modules/@stacksjs/rpx`,...s.onDemandTls?[`test -f ${R}/node_modules/@stacksjs/tlsx/dist/bin/cli.js`]:[]]:[],`__tsc_mail_changed="$(${h(i,l,n)})"`,`if [ "$__tsc_mail_changed" = changed ] || ! systemctl is-active --quiet ${a(c)}; then systemctl restart ${a(c)}; fi`,`curl --fail --silent --show-error --retry 30 --retry-all-errors --retry-delay 1 --max-time 5 ${a(`http://127.0.0.1:${i.webmail.port}${m}`)} >/dev/null`,...G({config:g,proxy:s,slug:o,bunBin:n,tenant:u})];if(e.verify!==!1)for(let f of[i.webmail.domain,...i.webmail.aliases])d.push(`__tsc_mail_status="$(curl --fail --silent --show-error --retry 10 --retry-connrefused --retry-delay 3 --max-time 15 --output /dev/null --write-out '%{http_code}' ${a(`https://${f}${m}`)})"`,`if [ "$__tsc_mail_status" != 200 ]; then echo ${a(`ts-cloud: webmail verification failed for ${f}`)} >&2; exit 1; fi`);return d.push(`echo ${a(`[ts-cloud] Webmail deployed: ${[i.webmail.domain,...i.webmail.aliases].join(", ")}`)}`),`${d.join(`
 `)}
-`}async function y(t,e){let r=p(t,e);if(!r)return;if(!/^(?:[a-z_][a-z0-9._-]*@)?[a-z0-9.:[\]_-]+$/i.test(e.target)||e.target.startsWith("-"))throw Error("Invalid SSH target");let i=["ssh","-T","-o","BatchMode=yes","-o","ConnectTimeout=15",...e.sshKeyPath?["-i",e.sshKeyPath]:[],e.target,"bash","-se"],n=Bun.spawn(i,{stdin:new Blob([r]),stdout:"inherit",stderr:"inherit"}),l=setTimeout(()=>n.kill(),e.timeoutMs??300000);try{let s=await n.exited;if(s!==0)throw Error(`Mail webmail deployment failed (SSH exit ${s})`)}finally{clearTimeout(l)}}export{zi as buildMailEnv,p as buildMailWebmailDeploymentScript,h as buildMailWebmailEnvPatch,y as deployMailWebmail,Xe as mailFirewallPorts,an as mailWebmailSites,w as resolveMailProxy,b as resolveMailService};
+`}async function y(t,e){let r=p(t,e);if(!r)return;if(!/^(?:[a-z_][a-z0-9._-]*@)?[a-z0-9.:[\]_-]+$/i.test(e.target)||e.target.startsWith("-"))throw Error("Invalid SSH target");let i=["ssh","-T","-o","BatchMode=yes","-o","ConnectTimeout=15",...e.sshKeyPath?["-i",e.sshKeyPath]:[],e.target,"bash","-se"],s=Bun.spawn(i,{stdin:new Blob([r]),stdout:"inherit",stderr:"inherit"}),o=setTimeout(()=>s.kill(),e.timeoutMs??300000);try{let n=await s.exited;if(n!==0)throw Error(`Mail webmail deployment failed (SSH exit ${n})`)}finally{clearTimeout(o)}}export{zi as buildMailEnv,p as buildMailWebmailDeploymentScript,h as buildMailWebmailEnvPatch,y as deployMailWebmail,Xe as mailFirewallPorts,an as mailWebmailSites,w as resolveMailProxy,b as resolveMailService};

package/dist/ui/404.html

@@ -2,7 +2,7 @@
 <html lang="en" data-theme="dark">
 <head>
   <meta charset="UTF-8">
-  <meta name="stx-build" content="mvbmv4nkt4gu49">
+  <meta name="stx-build" content="mvch1e4g6i3djg">
 
 <!-- stx SEO Tags -->
 <meta name="title" content="Page not found · ts-cloud">

package/dist/ui/accept-invitation.html

@@ -1,4 +1,4 @@
-<!DOCTYPE html><html lang="en" data-theme="dark"><head><meta charset="UTF-8"><meta name="stx-build" content="mvbmupsyyqel0l"><meta name="title" content="stx Project"><meta name="description" content="A website built with stx templating engine"><meta property="og:title" content="stx Project"><meta property="og:description" content="A website built with stx templating engine"><meta property="og:type" content="website"><meta name="twitter:card" content="summary_large_image"><meta name="twitter:title" content="stx Project"><meta name="twitter:description" content="A website built with stx templating engine"><meta name="viewport" content="width=device-width, initial-scale=1.0"><title>ts-cloud - Accept invitation</title><link rel="icon" type="image/svg+xml" href="data:image/svg+xml,%3Csvg xmlns='http://www.w3.org/2000/svg' viewBox='0 0 32 32'%3E%3Crect x='3' y='3' width='26' height='26' rx='8' fill='%235a8be0'/%3E%3C/svg%3E"><link rel="preconnect" href="https://fonts.googleapis.com"><link href="https://fonts.googleapis.com/css2?family=Inter:wght@400;500;600;700;800&display=swap" rel="stylesheet"><link rel="stylesheet" href="/_stx/style.448ab192.css"><style data-stx-cloak>[x-cloak]{display:none !important}</style><link data-crosswind="generated" rel="stylesheet" href="/_stx/crosswind.616c25f3.css"></head><body class="auth-page"><main class="auth-card" id="main-content"><a class="brand" href="/"><span class="dot"></span><span>ts-cloud</span></a><div><span class="context-label">Organization invitation</span><h1>Join your team</h1><p>Choose the dashboard username and password you will use after this invitation is accepted.</p></div><form id="accept-invitation-form" class="auth-form"><div class="field-block"><label for="invite-name">Name</label><input id="invite-name" name="name" autocomplete="name" placeholder="Chris Breuer"></div><div class="field-block"><label for="invite-username">Username</label><input id="invite-username" name="username" autocomplete="username" minlength="2" maxlength="32" required></div><div class="field-block"><label for="invite-password">Password</label><input id="invite-password" name="password" type="password" autocomplete="new-password" minlength="12" required><small>At least 12 characters.</small></div><button class="btn" type="submit">Accept invitation</button><div id="invitation-status" class="auth-status" role="status"></div></form><p class="note">If this link expired or was already used, ask an organization owner to resend the invitation.</p></main> <script data-stx-scoped data-stx-run="always">
+<!DOCTYPE html><html lang="en" data-theme="dark"><head><meta charset="UTF-8"><meta name="stx-build" content="mvch0p1wacfwdd"><meta name="title" content="stx Project"><meta name="description" content="A website built with stx templating engine"><meta property="og:title" content="stx Project"><meta property="og:description" content="A website built with stx templating engine"><meta property="og:type" content="website"><meta name="twitter:card" content="summary_large_image"><meta name="twitter:title" content="stx Project"><meta name="twitter:description" content="A website built with stx templating engine"><meta name="viewport" content="width=device-width, initial-scale=1.0"><title>ts-cloud - Accept invitation</title><link rel="icon" type="image/svg+xml" href="data:image/svg+xml,%3Csvg xmlns='http://www.w3.org/2000/svg' viewBox='0 0 32 32'%3E%3Crect x='3' y='3' width='26' height='26' rx='8' fill='%235a8be0'/%3E%3C/svg%3E"><link rel="preconnect" href="https://fonts.googleapis.com"><link href="https://fonts.googleapis.com/css2?family=Inter:wght@400;500;600;700;800&display=swap" rel="stylesheet"><link rel="stylesheet" href="/_stx/style.448ab192.css"><style data-stx-cloak>[x-cloak]{display:none !important}</style><link data-crosswind="generated" rel="stylesheet" href="/_stx/crosswind.616c25f3.css"></head><body class="auth-page"><main class="auth-card" id="main-content"><a class="brand" href="/"><span class="dot"></span><span>ts-cloud</span></a><div><span class="context-label">Organization invitation</span><h1>Join your team</h1><p>Choose the dashboard username and password you will use after this invitation is accepted.</p></div><form id="accept-invitation-form" class="auth-form"><div class="field-block"><label for="invite-name">Name</label><input id="invite-name" name="name" autocomplete="name" placeholder="Chris Breuer"></div><div class="field-block"><label for="invite-username">Username</label><input id="invite-username" name="username" autocomplete="username" minlength="2" maxlength="32" required></div><div class="field-block"><label for="invite-password">Password</label><input id="invite-password" name="password" type="password" autocomplete="new-password" minlength="12" required><small>At least 12 characters.</small></div><button class="btn" type="submit">Accept invitation</button><div id="invitation-status" class="auth-status" role="status"></div></form><p class="note">If this link expired or was already used, ask an organization owner to resend the invitation.</p></main> <script data-stx-scoped data-stx-run="always">
 ;(function() {
   'use strict';
 (() => {

package/dist/ui/access-denied.html

@@ -1,4 +1,4 @@
-<!DOCTYPE html><html lang="en" data-theme="dark"><head><meta charset="UTF-8"><meta name="stx-build" content="mvbmupsyyqel0l"><meta name="title" content="Access unavailable · ts-cloud"><meta name="description" content="A website built with stx templating engine"><meta property="og:title" content="Access unavailable · ts-cloud"><meta property="og:description" content="A website built with stx templating engine"><meta property="og:type" content="website"><meta name="twitter:card" content="summary_large_image"><meta name="twitter:title" content="Access unavailable · ts-cloud"><meta name="twitter:description" content="A website built with stx templating engine"> <script data-stx-runtime src="/_stx/runtime.dbee66d1.js"></script> <meta name="viewport" content="width=device-width, initial-scale=1.0"><title>Access unavailable · ts-cloud</title><link rel="icon" type="image/svg+xml" href="data:image/svg+xml,%3Csvg xmlns='http://www.w3.org/2000/svg' viewBox='0 0 32 32'%3E%3Crect x='3' y='3' width='26' height='26' rx='8' fill='%235a8be0'/%3E%3C/svg%3E"><link rel="preconnect" href="https://fonts.googleapis.com"><link href="https://fonts.googleapis.com/css2?family=Inter:wght@400;500;600;700;800&display=swap" rel="stylesheet"><link rel="stylesheet" href="/_stx/style.448ab192.css"><style data-stx-cloak>[x-cloak]{display:none !important}</style><link data-crosswind="generated" rel="stylesheet" href="/_stx/crosswind.906ee17c.css"></head><body data-stx-auto><a data-stx-scope="stx_scope_nav_50" class="skip-link" href="#main-content">Skip to content</a><button class="nav-toggle-button" type="button" aria-label="Open navigation" aria-controls="primary-navigation" aria-expanded="false"><span></span><span></span><span></span></button><button class="nav-scrim" type="button" aria-label="Close navigation"></button><aside class="app-sidebar" id="primary-navigation" aria-label="Primary navigation"><a class="brand" href="/?env=production"><span class="dot"></span><span>ts-cloud</span></a><div class="sidebar-context"><span class="context-label">Project</span><strong>ts-cloud</strong></div><div class="environment-picker" aria-label="Environment"><span class="context-label">Environment</span><details><summary class="environment-current production"><span>PROD</span><strong>production</strong></summary></details></div><button class="command-trigger" type="button" aria-keyshortcuts="Meta+K Control+K"><span>Search resources</span><kbd>⌘ K</kbd></button><div class="nav-groups"><section class="nav-group"><h2>Overview</h2><a class="" href="/?env=production">Dashboard</a><a href="/server/activity?env=production">Activity</a></section><section class="nav-group"><h2>Applications</h2><a class="" href="/server/sites?env=production">Services</a><a class="" href="/server/deployments?env=production">Deployments</a><a class="" href="/server/logs?env=production">Logs</a><a class="" href="/integrations?env=production">Git integrations</a><a class="" href="/applications/new?env=production">Create application</a><a class="" href="/applications/compose?env=production">Compose applications</a></section><section class="nav-group"><h2>Operations</h2><a class="" href="/operations/queue?env=production">Deployment queue</a><a class="" href="/operations/previews?env=production">Preview environments</a><a class="" href="/operations/releases?env=production">Releases & promotion</a><a class="" href="/operations/regions?env=production">Regions & failover</a><a class="" href="/operations/maintenance?env=production">Maintenance & DR</a><a class="" href="/operations/workloads?env=production">Workloads</a><a class="" href="/operations/observability?env=production">Observability</a><a class="" href="/operations/alerts?env=production">Alerts & health</a><a class="" href="/operations/spend?env=production">Spend & budgets</a><a href="/server/metrics?env=production">Metrics</a><a href="/server/services?env=production">Runtime services</a><a class="" href="/operations/jobs?env=production">Workers & schedules</a><a class="" href="/operations/configuration?env=production">Environment &amp; secrets</a><a class="" href="/data/backups?env=production">Backups &amp; recovery</a><a class="" href="/data/volumes?env=production">Persistent volumes</a><a href="/server/actions?env=production">Run operations</a></section><section class="nav-group"><h2>Infrastructure</h2><a class="" href="/infrastructure/topology?env=production">Infrastructure map</a><a class="" href="/data/services?env=production">Data services</a><a class="" href="/data/volumes?env=production">Persistent volumes</a><a href="/server/firewall?env=production">Network & firewall</a><a href="/server/ssh-keys?env=production">SSH keys</a><a class="" href="/server/fleet?env=production">Fleet inventory</a><a class="" href="/server/capacity?env=production">Capacity & placement</a><a href="/security?env=production">Security posture</a><a href="/server/terminal?env=production">Terminal</a></section><section class="nav-group"><h2>Organization</h2><a class="" href="/server/team?env=production">People & access</a><a class="" href="/account/automation?env=production">API & automation</a></section><section class="nav-group"><h2>Account</h2><a class="" href="/account/security?env=production">Sign-in & security</a></section></div><form method="post" action="/api/logout" class="signout"><button type="submit">Sign out</button></form></aside><dialog class="command-palette" aria-labelledby="command-title"><div class="command-search"><span aria-hidden="true">⌕</span><input type="search" placeholder="Search services, domains, deployments…" aria-label="Search resources" autocomplete="off"><button type="button" class="command-close" aria-label="Close search">Esc</button></div><h2 id="command-title" class="sr-only">Search resources and navigation</h2><div class="command-status" role="status">Start typing to search this project.</div><section class="saved-views" aria-labelledby="saved-views-title"><div class="saved-views-heading"><h3 id="saved-views-title">Saved views</h3><form class="save-view-form"><label class="sr-only" for="save-view-name">Saved view name</label><input id="save-view-name" maxlength="64" placeholder="Name this view" autocomplete="off"><button type="submit">Save current filters</button></form></div><div class="saved-view-list"></div></section><form class="tag-result-form"><label for="tag-result-name">Tag selected resource</label><input id="tag-result-name" maxlength="32" placeholder="customer-facing" pattern="[A-Za-z0-9][A-Za-z0-9 -]{0,31}" autocomplete="off"><input class="tag-color" type="color" value="#5a8be0" aria-label="Tag color"><button type="submit">Add tag</button></form><div class="command-results" role="listbox" aria-label="Search results"></div><footer><span>↑ ↓ navigate</span><span>Enter open</span><span>Esc close</span></footer></dialog><div class="context-bar" aria-label="Current scope"><div class="context-path"><div class="context-breadcrumb"><span>ts-cloud</span><i>/</i><strong>production</strong></div><div class="context-filters" aria-label="Active filters"></div></div><span class="scope-safety production">Production scope</span></div> <script data-stx-scoped data-stx-run="always">
+<!DOCTYPE html><html lang="en" data-theme="dark"><head><meta charset="UTF-8"><meta name="stx-build" content="mvch0p1wacfwdd"><meta name="title" content="Access unavailable · ts-cloud"><meta name="description" content="A website built with stx templating engine"><meta property="og:title" content="Access unavailable · ts-cloud"><meta property="og:description" content="A website built with stx templating engine"><meta property="og:type" content="website"><meta name="twitter:card" content="summary_large_image"><meta name="twitter:title" content="Access unavailable · ts-cloud"><meta name="twitter:description" content="A website built with stx templating engine"> <script data-stx-runtime src="/_stx/runtime.dbee66d1.js"></script> <meta name="viewport" content="width=device-width, initial-scale=1.0"><title>Access unavailable · ts-cloud</title><link rel="icon" type="image/svg+xml" href="data:image/svg+xml,%3Csvg xmlns='http://www.w3.org/2000/svg' viewBox='0 0 32 32'%3E%3Crect x='3' y='3' width='26' height='26' rx='8' fill='%235a8be0'/%3E%3C/svg%3E"><link rel="preconnect" href="https://fonts.googleapis.com"><link href="https://fonts.googleapis.com/css2?family=Inter:wght@400;500;600;700;800&display=swap" rel="stylesheet"><link rel="stylesheet" href="/_stx/style.448ab192.css"><style data-stx-cloak>[x-cloak]{display:none !important}</style><link data-crosswind="generated" rel="stylesheet" href="/_stx/crosswind.906ee17c.css"></head><body data-stx-auto><a data-stx-scope="stx_scope_nav_50" class="skip-link" href="#main-content">Skip to content</a><button class="nav-toggle-button" type="button" aria-label="Open navigation" aria-controls="primary-navigation" aria-expanded="false"><span></span><span></span><span></span></button><button class="nav-scrim" type="button" aria-label="Close navigation"></button><aside class="app-sidebar" id="primary-navigation" aria-label="Primary navigation"><a class="brand" href="/?env=production"><span class="dot"></span><span>ts-cloud</span></a><div class="sidebar-context"><span class="context-label">Project</span><strong>ts-cloud</strong></div><div class="environment-picker" aria-label="Environment"><span class="context-label">Environment</span><details><summary class="environment-current production"><span>PROD</span><strong>production</strong></summary></details></div><button class="command-trigger" type="button" aria-keyshortcuts="Meta+K Control+K"><span>Search resources</span><kbd>⌘ K</kbd></button><div class="nav-groups"><section class="nav-group"><h2>Overview</h2><a class="" href="/?env=production">Dashboard</a><a href="/server/activity?env=production">Activity</a></section><section class="nav-group"><h2>Applications</h2><a class="" href="/server/sites?env=production">Services</a><a class="" href="/server/deployments?env=production">Deployments</a><a class="" href="/server/logs?env=production">Logs</a><a class="" href="/integrations?env=production">Git integrations</a><a class="" href="/applications/new?env=production">Create application</a><a class="" href="/applications/compose?env=production">Compose applications</a></section><section class="nav-group"><h2>Operations</h2><a class="" href="/operations/queue?env=production">Deployment queue</a><a class="" href="/operations/previews?env=production">Preview environments</a><a class="" href="/operations/releases?env=production">Releases & promotion</a><a class="" href="/operations/regions?env=production">Regions & failover</a><a class="" href="/operations/maintenance?env=production">Maintenance & DR</a><a class="" href="/operations/workloads?env=production">Workloads</a><a class="" href="/operations/observability?env=production">Observability</a><a class="" href="/operations/alerts?env=production">Alerts & health</a><a class="" href="/operations/spend?env=production">Spend & budgets</a><a href="/server/metrics?env=production">Metrics</a><a href="/server/services?env=production">Runtime services</a><a class="" href="/operations/jobs?env=production">Workers & schedules</a><a class="" href="/operations/configuration?env=production">Environment &amp; secrets</a><a class="" href="/data/backups?env=production">Backups &amp; recovery</a><a class="" href="/data/volumes?env=production">Persistent volumes</a><a href="/server/actions?env=production">Run operations</a></section><section class="nav-group"><h2>Infrastructure</h2><a class="" href="/infrastructure/topology?env=production">Infrastructure map</a><a class="" href="/data/services?env=production">Data services</a><a class="" href="/data/volumes?env=production">Persistent volumes</a><a href="/server/firewall?env=production">Network & firewall</a><a href="/server/ssh-keys?env=production">SSH keys</a><a class="" href="/server/fleet?env=production">Fleet inventory</a><a class="" href="/server/capacity?env=production">Capacity & placement</a><a href="/security?env=production">Security posture</a><a href="/server/terminal?env=production">Terminal</a></section><section class="nav-group"><h2>Organization</h2><a class="" href="/server/team?env=production">People & access</a><a class="" href="/account/automation?env=production">API & automation</a></section><section class="nav-group"><h2>Account</h2><a class="" href="/account/security?env=production">Sign-in & security</a></section></div><form method="post" action="/api/logout" class="signout"><button type="submit">Sign out</button></form></aside><dialog class="command-palette" aria-labelledby="command-title"><div class="command-search"><span aria-hidden="true">⌕</span><input type="search" placeholder="Search services, domains, deployments…" aria-label="Search resources" autocomplete="off"><button type="button" class="command-close" aria-label="Close search">Esc</button></div><h2 id="command-title" class="sr-only">Search resources and navigation</h2><div class="command-status" role="status">Start typing to search this project.</div><section class="saved-views" aria-labelledby="saved-views-title"><div class="saved-views-heading"><h3 id="saved-views-title">Saved views</h3><form class="save-view-form"><label class="sr-only" for="save-view-name">Saved view name</label><input id="save-view-name" maxlength="64" placeholder="Name this view" autocomplete="off"><button type="submit">Save current filters</button></form></div><div class="saved-view-list"></div></section><form class="tag-result-form"><label for="tag-result-name">Tag selected resource</label><input id="tag-result-name" maxlength="32" placeholder="customer-facing" pattern="[A-Za-z0-9][A-Za-z0-9 -]{0,31}" autocomplete="off"><input class="tag-color" type="color" value="#5a8be0" aria-label="Tag color"><button type="submit">Add tag</button></form><div class="command-results" role="listbox" aria-label="Search results"></div><footer><span>↑ ↓ navigate</span><span>Enter open</span><span>Esc close</span></footer></dialog><div class="context-bar" aria-label="Current scope"><div class="context-path"><div class="context-breadcrumb"><span>ts-cloud</span><i>/</i><strong>production</strong></div><div class="context-filters" aria-label="Active filters"></div></div><span class="scope-safety production">Production scope</span></div> <script data-stx-scoped data-stx-run="always">
 (function() {
   var { batch, computed, configureFetch, defineEmits, defineExpose, definePageMeta, defineProps, defineSlots, defineStore, derived, effect, goBack, goForward, inject, invalidateRoute, isDerived, isSignal, navigate, nextTick, onBeforeMount, onBeforeUnmount, onDestroy, onMount, onMounted, onUnmounted, peek, provide, reactive, ref, refresh, registerStoresClient, setRouteParams, state, untrack, useAsync, useClickOutside, useColorMode, useCookie, useCounter, useDark, useDebounce, useDebouncedValue, useEventListener, useFetch, useFocus, useHead, useId, useInterval, useLocalStorage, useMediaQuery, useMutation, useOptimistic, usePreferredContrast, usePreferredDark, usePreferredLight, usePreferredReducedMotion, useQuery, useReactiveProp, useRef, useRoute, useRouteParam, useRouteParams, useScrollLock, useSearchParams, useSeoMeta, useSessionStorage, useSlots, useStore, useThrottle, useTimeout, useToggle, useWebSocket, watch, watchEffect, watchMultiple, withDefaults } = window.stx;
   var __destroyHooks = [];

package/dist/ui/account/automation.html

@@ -1,5 +1,5 @@
-<!DOCTYPE html><html lang="en" data-theme="dark"><head><meta charset="UTF-8"><meta name="stx-build" content="mvbmupsyyqel0l"><meta name="title" content="stx Project"><meta name="description" content="A website built with stx templating engine"><meta property="og:title" content="stx Project"><meta property="og:description" content="A website built with stx templating engine"><meta property="og:type" content="website"><meta name="twitter:card" content="summary_large_image"><meta name="twitter:title" content="stx Project"><meta name="twitter:description" content="A website built with stx templating engine"> <script data-stx-runtime src="/_stx/runtime.dbee66d1.js"></script> <meta name="viewport" content="width=device-width, initial-scale=1.0"><title>ts-cloud - API &amp; automation</title><link rel="icon" type="image/svg+xml" href="data:image/svg+xml,%3Csvg xmlns='http://www.w3.org/2000/svg' viewBox='0 0 32 32'%3E%3Crect x='3' y='3' width='26' height='26' rx='8' fill='%235a8be0'/%3E%3C/svg%3E"><link rel="preconnect" href="https://fonts.googleapis.com"><link href="https://fonts.googleapis.com/css2?family=Inter:wght@400;500;600;700;800&display=swap" rel="stylesheet"><link rel="stylesheet" href="/_stx/style.448ab192.css"> <script data-stx-scoped>
-function __stx_setup_1792195375062_5() {
+<!DOCTYPE html><html lang="en" data-theme="dark"><head><meta charset="UTF-8"><meta name="stx-build" content="mvch0p1wacfwdd"><meta name="title" content="stx Project"><meta name="description" content="A website built with stx templating engine"><meta property="og:title" content="stx Project"><meta property="og:description" content="A website built with stx templating engine"><meta property="og:type" content="website"><meta name="twitter:card" content="summary_large_image"><meta name="twitter:title" content="stx Project"><meta name="twitter:description" content="A website built with stx templating engine"> <script data-stx-runtime src="/_stx/runtime.dbee66d1.js"></script> <meta name="viewport" content="width=device-width, initial-scale=1.0"><title>ts-cloud - API &amp; automation</title><link rel="icon" type="image/svg+xml" href="data:image/svg+xml,%3Csvg xmlns='http://www.w3.org/2000/svg' viewBox='0 0 32 32'%3E%3Crect x='3' y='3' width='26' height='26' rx='8' fill='%235a8be0'/%3E%3C/svg%3E"><link rel="preconnect" href="https://fonts.googleapis.com"><link href="https://fonts.googleapis.com/css2?family=Inter:wght@400;500;600;700;800&display=swap" rel="stylesheet"><link rel="stylesheet" href="/_stx/style.448ab192.css"> <script data-stx-scoped>
+function __stx_setup_1792246042494_1() {
   const { batch, computed, configureFetch, defineEmits, defineExpose, definePageMeta, defineProps, defineSlots, defineStore, derived, effect, goBack, goForward, inject, invalidateRoute, isDerived, isSignal, navigate, nextTick, onBeforeMount, onBeforeUnmount, onDestroy, onMount, onMounted, onUnmounted, peek, provide, reactive, ref, refresh, registerStoresClient, setRouteParams, state, untrack, useAsync, useClickOutside, useColorMode, useCookie, useCounter, useDark, useDebounce, useDebouncedValue, useEventListener, useFetch, useFocus, useHead, useId, useInterval, useLocalStorage, useMediaQuery, useMutation, useOptimistic, usePreferredContrast, usePreferredDark, usePreferredLight, usePreferredReducedMotion, useQuery, useReactiveProp, useRef, useRoute, useRouteParam, useRouteParams, useScrollLock, useSearchParams, useSeoMeta, useSessionStorage, useSlots, useStore, useThrottle, useTimeout, useToggle, useWebSocket, watch, watchEffect, watchMultiple, withDefaults } = window.stx;
 
 const accounts = state([]);
@@ -189,9 +189,9 @@ onMount(() => {
 
   return { accounts, project, environments, resources, message, messageKind, reveal, accountSlug, accountName, accountRole, accountScopeType, accountScopeId, selectedAccount, tokenName, tokenCapabilities, tokenScopeType, tokenScopeId, tokenExpiry, password, mfaCode, capabilities, setMessage, setScope, scopeLabel, tokenState, toggleCapability, load, selectAccount, stepUp, createAccount, createToken, tokenAction, disableAccount, curlExample, cliExample, copy };
 }
-window.__stx_latestSetup=__stx_setup_1792195375062_5;
-if(window.stx)window.stx._latestSetup=__stx_setup_1792195375062_5;
-</script> <style data-stx-cloak>[x-cloak]{display:none !important}</style><link data-crosswind="generated" rel="stylesheet" href="/_stx/crosswind.906ee17c.css"></head><body data-stx="__stx_setup_1792195375062_5"><a data-stx-scope="stx_scope_nav_8" class="skip-link" href="#main-content">Skip to content</a><button class="nav-toggle-button" type="button" aria-label="Open navigation" aria-controls="primary-navigation" aria-expanded="false"><span></span><span></span><span></span></button><button class="nav-scrim" type="button" aria-label="Close navigation"></button><aside class="app-sidebar" id="primary-navigation" aria-label="Primary navigation"><a class="brand" href="/?env=production"><span class="dot"></span><span>ts-cloud</span></a><div class="sidebar-context"><span class="context-label">Project</span><strong>ts-cloud</strong></div><div class="environment-picker" aria-label="Environment"><span class="context-label">Environment</span><details><summary class="environment-current production"><span>PROD</span><strong>production</strong></summary></details></div><button class="command-trigger" type="button" aria-keyshortcuts="Meta+K Control+K"><span>Search resources</span><kbd>⌘ K</kbd></button><div class="nav-groups"><section class="nav-group"><h2>Overview</h2><a class="" href="/?env=production">Dashboard</a><a href="/server/activity?env=production">Activity</a></section><section class="nav-group"><h2>Applications</h2><a class="" href="/server/sites?env=production">Services</a><a class="" href="/server/deployments?env=production">Deployments</a><a class="" href="/server/logs?env=production">Logs</a><a class="" href="/integrations?env=production">Git integrations</a><a class="" href="/applications/new?env=production">Create application</a><a class="" href="/applications/compose?env=production">Compose applications</a></section><section class="nav-group"><h2>Operations</h2><a class="" href="/operations/queue?env=production">Deployment queue</a><a class="" href="/operations/previews?env=production">Preview environments</a><a class="" href="/operations/releases?env=production">Releases & promotion</a><a class="" href="/operations/regions?env=production">Regions & failover</a><a class="" href="/operations/maintenance?env=production">Maintenance & DR</a><a class="" href="/operations/workloads?env=production">Workloads</a><a class="" href="/operations/observability?env=production">Observability</a><a class="" href="/operations/alerts?env=production">Alerts & health</a><a class="" href="/operations/spend?env=production">Spend & budgets</a><a href="/server/metrics?env=production">Metrics</a><a href="/server/services?env=production">Runtime services</a><a class="" href="/operations/jobs?env=production">Workers & schedules</a><a class="" href="/operations/configuration?env=production">Environment &amp; secrets</a><a class="" href="/data/backups?env=production">Backups &amp; recovery</a><a class="" href="/data/volumes?env=production">Persistent volumes</a><a href="/server/actions?env=production">Run operations</a></section><section class="nav-group"><h2>Infrastructure</h2><a class="" href="/infrastructure/topology?env=production">Infrastructure map</a><a class="" href="/data/services?env=production">Data services</a><a class="" href="/data/volumes?env=production">Persistent volumes</a><a href="/server/firewall?env=production">Network & firewall</a><a href="/server/ssh-keys?env=production">SSH keys</a><a class="" href="/server/fleet?env=production">Fleet inventory</a><a class="" href="/server/capacity?env=production">Capacity & placement</a><a href="/security?env=production">Security posture</a><a href="/server/terminal?env=production">Terminal</a></section><section class="nav-group"><h2>Organization</h2><a class="" href="/server/team?env=production">People & access</a><a class="active" href="/account/automation?env=production">API & automation</a></section><section class="nav-group"><h2>Account</h2><a class="" href="/account/security?env=production">Sign-in & security</a></section></div><form method="post" action="/api/logout" class="signout"><button type="submit">Sign out</button></form></aside><dialog class="command-palette" aria-labelledby="command-title"><div class="command-search"><span aria-hidden="true">⌕</span><input type="search" placeholder="Search services, domains, deployments…" aria-label="Search resources" autocomplete="off"><button type="button" class="command-close" aria-label="Close search">Esc</button></div><h2 id="command-title" class="sr-only">Search resources and navigation</h2><div class="command-status" role="status">Start typing to search this project.</div><section class="saved-views" aria-labelledby="saved-views-title"><div class="saved-views-heading"><h3 id="saved-views-title">Saved views</h3><form class="save-view-form"><label class="sr-only" for="save-view-name">Saved view name</label><input id="save-view-name" maxlength="64" placeholder="Name this view" autocomplete="off"><button type="submit">Save current filters</button></form></div><div class="saved-view-list"></div></section><form class="tag-result-form"><label for="tag-result-name">Tag selected resource</label><input id="tag-result-name" maxlength="32" placeholder="customer-facing" pattern="[A-Za-z0-9][A-Za-z0-9 -]{0,31}" autocomplete="off"><input class="tag-color" type="color" value="#5a8be0" aria-label="Tag color"><button type="submit">Add tag</button></form><div class="command-results" role="listbox" aria-label="Search results"></div><footer><span>↑ ↓ navigate</span><span>Enter open</span><span>Esc close</span></footer></dialog><div class="context-bar" aria-label="Current scope"><div class="context-path"><div class="context-breadcrumb"><span>ts-cloud</span><i>/</i><strong>production</strong></div><div class="context-filters" aria-label="Active filters"></div></div><span class="scope-safety production">Production scope</span></div> <script data-stx-scoped data-stx-run="always">
+window.__stx_latestSetup=__stx_setup_1792246042494_1;
+if(window.stx)window.stx._latestSetup=__stx_setup_1792246042494_1;
+</script> <style data-stx-cloak>[x-cloak]{display:none !important}</style><link data-crosswind="generated" rel="stylesheet" href="/_stx/crosswind.906ee17c.css"></head><body data-stx="__stx_setup_1792246042494_1"><a data-stx-scope="stx_scope_nav_4" class="skip-link" href="#main-content">Skip to content</a><button class="nav-toggle-button" type="button" aria-label="Open navigation" aria-controls="primary-navigation" aria-expanded="false"><span></span><span></span><span></span></button><button class="nav-scrim" type="button" aria-label="Close navigation"></button><aside class="app-sidebar" id="primary-navigation" aria-label="Primary navigation"><a class="brand" href="/?env=production"><span class="dot"></span><span>ts-cloud</span></a><div class="sidebar-context"><span class="context-label">Project</span><strong>ts-cloud</strong></div><div class="environment-picker" aria-label="Environment"><span class="context-label">Environment</span><details><summary class="environment-current production"><span>PROD</span><strong>production</strong></summary></details></div><button class="command-trigger" type="button" aria-keyshortcuts="Meta+K Control+K"><span>Search resources</span><kbd>⌘ K</kbd></button><div class="nav-groups"><section class="nav-group"><h2>Overview</h2><a class="" href="/?env=production">Dashboard</a><a href="/server/activity?env=production">Activity</a></section><section class="nav-group"><h2>Applications</h2><a class="" href="/server/sites?env=production">Services</a><a class="" href="/server/deployments?env=production">Deployments</a><a class="" href="/server/logs?env=production">Logs</a><a class="" href="/integrations?env=production">Git integrations</a><a class="" href="/applications/new?env=production">Create application</a><a class="" href="/applications/compose?env=production">Compose applications</a></section><section class="nav-group"><h2>Operations</h2><a class="" href="/operations/queue?env=production">Deployment queue</a><a class="" href="/operations/previews?env=production">Preview environments</a><a class="" href="/operations/releases?env=production">Releases & promotion</a><a class="" href="/operations/regions?env=production">Regions & failover</a><a class="" href="/operations/maintenance?env=production">Maintenance & DR</a><a class="" href="/operations/workloads?env=production">Workloads</a><a class="" href="/operations/observability?env=production">Observability</a><a class="" href="/operations/alerts?env=production">Alerts & health</a><a class="" href="/operations/spend?env=production">Spend & budgets</a><a href="/server/metrics?env=production">Metrics</a><a href="/server/services?env=production">Runtime services</a><a class="" href="/operations/jobs?env=production">Workers & schedules</a><a class="" href="/operations/configuration?env=production">Environment &amp; secrets</a><a class="" href="/data/backups?env=production">Backups &amp; recovery</a><a class="" href="/data/volumes?env=production">Persistent volumes</a><a href="/server/actions?env=production">Run operations</a></section><section class="nav-group"><h2>Infrastructure</h2><a class="" href="/infrastructure/topology?env=production">Infrastructure map</a><a class="" href="/data/services?env=production">Data services</a><a class="" href="/data/volumes?env=production">Persistent volumes</a><a href="/server/firewall?env=production">Network & firewall</a><a href="/server/ssh-keys?env=production">SSH keys</a><a class="" href="/server/fleet?env=production">Fleet inventory</a><a class="" href="/server/capacity?env=production">Capacity & placement</a><a href="/security?env=production">Security posture</a><a href="/server/terminal?env=production">Terminal</a></section><section class="nav-group"><h2>Organization</h2><a class="" href="/server/team?env=production">People & access</a><a class="active" href="/account/automation?env=production">API & automation</a></section><section class="nav-group"><h2>Account</h2><a class="" href="/account/security?env=production">Sign-in & security</a></section></div><form method="post" action="/api/logout" class="signout"><button type="submit">Sign out</button></form></aside><dialog class="command-palette" aria-labelledby="command-title"><div class="command-search"><span aria-hidden="true">⌕</span><input type="search" placeholder="Search services, domains, deployments…" aria-label="Search resources" autocomplete="off"><button type="button" class="command-close" aria-label="Close search">Esc</button></div><h2 id="command-title" class="sr-only">Search resources and navigation</h2><div class="command-status" role="status">Start typing to search this project.</div><section class="saved-views" aria-labelledby="saved-views-title"><div class="saved-views-heading"><h3 id="saved-views-title">Saved views</h3><form class="save-view-form"><label class="sr-only" for="save-view-name">Saved view name</label><input id="save-view-name" maxlength="64" placeholder="Name this view" autocomplete="off"><button type="submit">Save current filters</button></form></div><div class="saved-view-list"></div></section><form class="tag-result-form"><label for="tag-result-name">Tag selected resource</label><input id="tag-result-name" maxlength="32" placeholder="customer-facing" pattern="[A-Za-z0-9][A-Za-z0-9 -]{0,31}" autocomplete="off"><input class="tag-color" type="color" value="#5a8be0" aria-label="Tag color"><button type="submit">Add tag</button></form><div class="command-results" role="listbox" aria-label="Search results"></div><footer><span>↑ ↓ navigate</span><span>Enter open</span><span>Esc close</span></footer></dialog><div class="context-bar" aria-label="Current scope"><div class="context-path"><div class="context-breadcrumb"><span>ts-cloud</span><i>/</i><strong>production</strong></div><div class="context-filters" aria-label="Active filters"></div></div><span class="scope-safety production">Production scope</span></div> <script data-stx-scoped data-stx-run="always">
 (function() {
   var { batch, computed, configureFetch, defineEmits, defineExpose, definePageMeta, defineProps, defineSlots, defineStore, derived, effect, goBack, goForward, inject, invalidateRoute, isDerived, isSignal, navigate, nextTick, onBeforeMount, onBeforeUnmount, onDestroy, onMount, onMounted, onUnmounted, peek, provide, reactive, ref, refresh, registerStoresClient, setRouteParams, state, untrack, useAsync, useClickOutside, useColorMode, useCookie, useCounter, useDark, useDebounce, useDebouncedValue, useEventListener, useFetch, useFocus, useHead, useId, useInterval, useLocalStorage, useMediaQuery, useMutation, useOptimistic, usePreferredContrast, usePreferredDark, usePreferredLight, usePreferredReducedMotion, useQuery, useReactiveProp, useRef, useRoute, useRouteParam, useRouteParams, useScrollLock, useSearchParams, useSeoMeta, useSessionStorage, useSlots, useStore, useThrottle, useTimeout, useToggle, useWebSocket, watch, watchEffect, watchMultiple, withDefaults } = window.stx;
   var __destroyHooks = [];
@@ -542,6 +542,6 @@ if(window.stx)window.stx._latestSetup=__stx_setup_1792195375062_5;
   
   
   try { if (typeof __stxScopeRenames !== 'undefined' && __stxScopeRenames) { for (var __stxRK in __stxScopeRenames) __scopeRegistration[__stxRK] = __stxScopeRenames[__stxRK]; } } catch (e) { /* no renames */ }
-  window.stx._scopes['stx_scope_nav_8'] = __scopeRegistration;
+  window.stx._scopes['stx_scope_nav_4'] = __scopeRegistration;
 })();
 </script> <div class="wrap"><div class="crumbs"><a href="/">Dashboard</a><span class="sep">/</span> Organization <span class="sep">/</span> API &amp; automation</div><header class="page"><div><h1>API &amp; automation</h1><p>Create least-privilege machine identities for CI. Tokens never create browser sessions and cannot access outside their membership and token scope.</p></div><a class="btn ghost" href="/api/v1/openapi.json">OpenAPI 3.1</a></header><div class="automation-message msg" :class="messageKind()" role="status" aria-live="polite" x-cloak>{{ message() }}</div><div class="panel reveal" @show="!!reveal()" x-cloak><div><strong>Copy this token now</strong><span>The raw secret is shown once. Rotation keeps the old token active until you explicitly revoke it.</span></div><code x-cloak>{{ reveal()?.secret }}</code><button class="btn sm" type="button" @click="copy(reveal()?.secret)">Copy token</button><label>curl</label><code x-cloak>{{ curlExample() }}</code><button class="btn ghost sm" type="button" @click="copy(curlExample())">Copy curl</button><label>CLI</label><code x-cloak>{{ cliExample() }}</code><button class="btn ghost sm" type="button" @click="copy(cliExample())">Copy CLI</button><button class="btn danger sm" type="button" @click="reveal.set(null)">I saved it; hide secret</button></div><div class="section"><h2>Service accounts</h2><div class="accounts" x-cloak><template :for="item in accounts()"><article class="account panel" :class="selectedAccount() === item.account.id ? 'selected' : ''" x-cloak><button class="account-main" type="button" @click="selectAccount(item)" x-cloak><span x-cloak><strong x-cloak>{{ item.account.name }}</strong><small x-cloak>{{ item.account.slug }} · {{ item.membership?.roleTemplate }} · {{ scopeLabel(item.membership?.scope) }}</small><small x-cloak>Created {{ new Date(item.account.createdAt).toLocaleDateString() }} by {{ item.createdBy?.displayName || 'offline administrator' }}</small></span><span class="tag" x-cloak>{{ item.account.state }}</span></button><div class="token-list" x-cloak><template :for="token in item.tokens"><div class="token" x-cloak><div x-cloak><strong x-cloak>{{ token.name }}</strong><code x-cloak>{{ token.prefix }}</code><small x-cloak>{{ tokenState(token) }} · created {{ new Date(token.createdAt).toLocaleDateString() }} by {{ token.createdBy?.displayName || 'offline administrator' }} · expires {{ new Date(token.expiresAt).toLocaleDateString() }} · last used {{ token.lastUsedAt ? new Date(token.lastUsedAt).toLocaleString() : 'never' }}</small><small x-cloak>{{ token.capabilities.join(', ') }} · {{ scopeLabel(token.scope) }}</small></div><div class="table-actions"><button class="btn ghost sm" type="button" @show="token.state === 'active'" @click="tokenAction(token, 'rotate')" x-cloak>Rotate</button><button class="btn danger sm" type="button" @show="token.state === 'active'" @click="tokenAction(token, 'revoke')" x-cloak>Revoke</button></div></div></template><div class="compact empty" @show="item.tokens.length === 0" x-cloak><span>No tokens yet.</span></div></div><button class="btn danger sm" type="button" @show="item.account.state === 'active'" @click="disableAccount(item)" x-cloak>Disable account and tokens</button></article></template><div class="compact empty panel" @show="accounts().length === 0" x-cloak><strong>No service accounts</strong><span>Create one for a CI system or external automation.</span></div></div></div><div class="section"><h2>Create service account</h2><div class="panel"><form class="form-grid" @submit.prevent="createAccount()"><div class="field-block"><label for="account-name">Name</label><input id="account-name" :value="accountName()" @input="accountName.set($event.target.value)" placeholder="Production CI" required></div><div class="field-block"><label for="account-slug">Slug</label><input id="account-slug" :value="accountSlug()" @input="accountSlug.set($event.target.value)" pattern="[a-z0-9][a-z0-9-]{1,47}" placeholder="production-ci" required></div><div class="field-block"><label for="account-role">Maximum role</label><select id="account-role" :value="accountRole()" @change="accountRole.set($event.target.value)"><option value="viewer">Viewer</option><option value="auditor">Auditor</option><option value="deployer">Deployer</option><option value="operator">Operator</option><option value="admin">Admin</option></select><small>Service accounts can never be owners.</small></div><div class="field-block"><label for="account-scope">Maximum scope</label><select id="account-scope" :value="accountScopeType()" @change="accountScopeType.set($event.target.value); setScope($event.target.value, accountScopeId)"><option value="organization">Organization</option><option value="project">Current project</option><option value="environment">One environment</option><option value="resource">One service</option></select></div><div class="field-block" @show="accountScopeType() === 'environment'" x-cloak><label for="account-environment">Environment</label><select id="account-environment" :value="accountScopeId()" @change="accountScopeId.set($event.target.value)"><template :for="environment in environments()"><option :value="environment.id">{{ environment.name }}</option></template></select></div><div class="field-block" @show="accountScopeType() === 'resource'" x-cloak><label for="account-resource">Service</label><select id="account-resource" :value="accountScopeId()" @change="accountScopeId.set($event.target.value)"><template :for="resource in resources()"><option :value="resource.id">{{ resource.name }}</option></template></select></div><div class="form-actions"><button class="btn" type="submit">Create service account</button></div></form></div></div><div class="section"><h2>Create API token</h2><div class="panel"><form class="form-grid" @submit.prevent="createToken()"><div class="field-block"><label for="token-account">Service account</label><select id="token-account" :value="selectedAccount()" @change="selectAccount(accounts().find(item => item.account.id === $event.target.value))" required><template :for="item in accounts()"><option :value="item.account.id" :disabled="item.account.state !== 'active'">{{ item.account.name }}</option></template></select></div><div class="field-block"><label for="token-name">Token name</label><input id="token-name" :value="tokenName()" @input="tokenName.set($event.target.value)" required></div><div class="field-block"><label for="token-expiry">Expiry</label><input id="token-expiry" type="date" :value="tokenExpiry()" @input="tokenExpiry.set($event.target.value)"><small>Defaults to 90 days; maximum one year.</small></div><div class="field-block"><label for="token-scope">Token scope</label><select id="token-scope" :value="tokenScopeType()" @change="tokenScopeType.set($event.target.value); setScope($event.target.value, tokenScopeId)"><option value="organization">Organization</option><option value="project">Current project</option><option value="environment">One environment</option><option value="resource">One service</option></select><small>Must be equal to or narrower than the service-account scope.</small></div><div class="field-block" @show="tokenScopeType() === 'environment'" x-cloak><label>Environment</label><select :value="tokenScopeId()" @change="tokenScopeId.set($event.target.value)"><template :for="environment in environments()"><option :value="environment.id">{{ environment.name }}</option></template></select></div><div class="field-block" @show="tokenScopeType() === 'resource'" x-cloak><label>Service</label><select :value="tokenScopeId()" @change="tokenScopeId.set($event.target.value)"><template :for="resource in resources()"><option :value="resource.id">{{ resource.name }}</option></template></select></div><fieldset class="capabilities"><legend>Explicit capabilities</legend><template :for="capability in capabilities"><label class="capability" x-cloak><input type="checkbox" :checked="tokenCapabilities().includes(capability[0])" @change="toggleCapability(capability[0])"><span x-cloak><b x-cloak>{{ capability[0] }}</b><small x-cloak>{{ capability[1] }}</small></span></label></template></fieldset><div class="form-actions"><button class="btn" type="submit" :disabled="!selectedAccount() || tokenCapabilities().length === 0">Create and reveal token</button></div></form></div></div><div class="section"><h2>Confirm sensitive changes</h2><div class="auth-grid panel"><div class="field-block"><label for="automation-password">Your password</label><input id="automation-password" type="password" autocomplete="current-password" :value="password()" @input="password.set($event.target.value)" required></div><div class="field-block"><label for="automation-code">Authenticator or recovery code</label><input id="automation-code" autocomplete="one-time-code" :value="mfaCode()" @input="mfaCode.set($event.target.value)"><small>Required when MFA is enabled. Used only for recent-auth confirmation.</small></div></div></div></div><style> .automation-message{min-height:20px;margin-top:12px}.accounts{display:grid;gap:12px}.account{display:grid;gap:14px}.account.selected{border-color:var(--accent)} .account-main{display:flex;justify-content:space-between;gap:12px;width:100%;text-align:left;background:none;border:0;color:inherit;cursor:pointer}.account-main span:first-child{display:grid;gap:4px}.account-main small,.token small{color:var(--txt3);font-size:12px;line-height:1.5} .token-list{display:grid;gap:10px}.token{display:flex;justify-content:space-between;gap:14px;padding:12px;border:1px solid var(--panel-br);border-radius:10px}.token>div:first-child{display:grid;gap:4px;min-width:0}.token code{color:var(--txt2)} .reveal{display:grid;grid-template-columns:minmax(0,1fr) auto;gap:10px;margin-top:18px;border-color:rgba(53,209,155,.35)}.reveal>div,.reveal>code,.reveal>label{grid-column:1/-1}.reveal>div{display:grid;gap:4px}.reveal span{color:var(--txt2);font-size:12px}.reveal code{padding:10px;background:rgba(0,0,0,.25);border-radius:8px;overflow-wrap:anywhere;user-select:all} .capabilities{grid-column:1/-1;border:1px solid var(--panel-br);border-radius:10px;padding:12px;display:grid;grid-template-columns:repeat(2,minmax(0,1fr));gap:8px}.capabilities legend{padding:0 6px;color:var(--txt3);font-size:11px;font-weight:800;text-transform:uppercase}.capability{display:flex;gap:9px;align-items:flex-start;padding:9px}.capability input{width:auto;margin-top:3px}.capability span{display:grid;gap:2px}.capability small{color:var(--txt3);font-size:11px}.auth-grid{display:grid;grid-template-columns:1fr 1fr;gap:14px} @media(max-width:700px){.token{display:grid}.reveal,.capabilities,.auth-grid{grid-template-columns:1fr}.reveal>*{grid-column:1}} </style></body></html>