@stacksjs/ts-cloud 0.7.18 → 0.7.19

package/dist/{chunk-vpyd42tp.js → chunk-xgnxz5dz.js}

@@ -1906,10 +1906,70 @@ class AwsDriver {
 
 // src/drivers/hetzner/driver.ts
 import { existsSync, readFileSync as readFileSync2 } from "node:fs";
-import { homedir } from "node:os";
-import { join as join3 } from "node:path";
 import { execSync } from "node:child_process";
 
+// src/drivers/hetzner/config.ts
+import { homedir } from "node:os";
+import { join as join2 } from "node:path";
+var HETZNER_DEFAULTS = {
+  location: "fsn1",
+  image: "ubuntu-24.04",
+  sshUser: "root",
+  sshPrivateKeyPath: "~/.ssh/id_ed25519"
+};
+function expandHome(path) {
+  return path.startsWith("~/") ? join2(homedir(), path.slice(2)) : path;
+}
+function env(...names) {
+  for (const name of names) {
+    const value = process.env[name]?.trim();
+    if (value)
+      return value;
+  }
+  return;
+}
+function first(...values) {
+  for (const value of values) {
+    const trimmed = value?.trim();
+    if (trimmed)
+      return trimmed;
+  }
+  return;
+}
+function resolveHetznerApiToken(explicit, config) {
+  return first(explicit, config?.hetzner?.apiToken, env("HCLOUD_TOKEN", "HETZNER_API_TOKEN"));
+}
+function resolveHetznerLocation(config, explicit) {
+  return first(explicit, config?.hetzner?.location, env("HCLOUD_LOCATION", "HETZNER_LOCATION")) ?? HETZNER_DEFAULTS.location;
+}
+function resolveHetznerImage(config, explicit) {
+  const compute = config?.infrastructure?.compute;
+  return first(explicit, compute?.image, config?.hetzner?.image, env("HCLOUD_IMAGE", "HETZNER_IMAGE")) ?? HETZNER_DEFAULTS.image;
+}
+function resolveHetznerSshUser(config, explicit) {
+  return first(explicit, config?.hetzner?.sshUser, env("HCLOUD_SSH_USER", "HETZNER_SSH_USER")) ?? HETZNER_DEFAULTS.sshUser;
+}
+function resolveHetznerSshPrivateKeyPath(config, explicit) {
+  return expandHome(first(explicit, config?.hetzner?.sshPrivateKeyPath, env("HCLOUD_SSH_KEY", "HETZNER_SSH_KEY")) ?? HETZNER_DEFAULTS.sshPrivateKeyPath);
+}
+function resolveHetznerSshPublicKeyPath(config, explicit, privateKeyPath) {
+  const explicitPath = first(explicit, config?.hetzner?.sshPublicKeyPath, env("HCLOUD_SSH_PUBLIC_KEY", "HETZNER_SSH_PUBLIC_KEY"));
+  if (explicitPath)
+    return expandHome(explicitPath);
+  return `${privateKeyPath ?? resolveHetznerSshPrivateKeyPath(config)}.pub`;
+}
+function resolveHetznerSettings(config, overrides = {}) {
+  const sshPrivateKeyPath = resolveHetznerSshPrivateKeyPath(config, overrides.sshPrivateKeyPath);
+  return {
+    apiToken: resolveHetznerApiToken(overrides.apiToken, config),
+    location: resolveHetznerLocation(config, overrides.location),
+    image: resolveHetznerImage(config, overrides.image),
+    sshUser: resolveHetznerSshUser(config, overrides.sshUser),
+    sshPrivateKeyPath,
+    sshPublicKeyPath: resolveHetznerSshPublicKeyPath(config, overrides.sshPublicKeyPath, sshPrivateKeyPath)
+  };
+}
+
 // src/drivers/hetzner/client.ts
 var DEFAULT_API_URL = "https://api.hetzner.cloud/v1";
 
@@ -2095,8 +2155,8 @@ class HetznerClient {
     throw new Error(`Timed out waiting for server ${serverId} to reach running state`);
   }
 }
-function resolveHetznerApiToken(configToken) {
-  const token = configToken || process.env.HCLOUD_TOKEN || process.env.HETZNER_API_TOKEN;
+function resolveHetznerApiToken2(configToken, config) {
+  const token = resolveHetznerApiToken(configToken, config);
   if (!token) {
     throw new Error("Hetzner API token required. Set hetzner.apiToken in cloud.config.ts or HCLOUD_TOKEN / HETZNER_API_TOKEN.");
   }
@@ -2138,21 +2198,21 @@ function resolveFleetTopology(compute = {}) {
   };
 }
 function buildFleetServicesEnv(servicesPrivateIp, database) {
-  const env = {
+  const env2 = {
     REDIS_HOST: servicesPrivateIp,
     MEILISEARCH_HOST: `http://${servicesPrivateIp}:7700`
   };
   if (database?.name) {
-    env.DB_CONNECTION = database.engine === "postgres" ? "pgsql" : "mysql";
-    env.DB_HOST = servicesPrivateIp;
-    env.DB_PORT = String(database.port ?? (database.engine === "postgres" ? 5432 : 3306));
-    env.DB_DATABASE = database.name;
+    env2.DB_CONNECTION = database.engine === "postgres" ? "pgsql" : "mysql";
+    env2.DB_HOST = servicesPrivateIp;
+    env2.DB_PORT = String(database.port ?? (database.engine === "postgres" ? 5432 : 3306));
+    env2.DB_DATABASE = database.name;
     if (database.username)
-      env.DB_USERNAME = database.username;
+      env2.DB_USERNAME = database.username;
     if (database.password)
-      env.DB_PASSWORD = database.password;
+      env2.DB_PASSWORD = database.password;
   }
-  return env;
+  return env2;
 }
 
 // src/drivers/hetzner/firewall-rules.ts
@@ -2206,10 +2266,10 @@ function matchesTsCloudLabels(labels, slug, environment, role = "app") {
 
 // src/drivers/hetzner/state.ts
 import { mkdir, readFile, writeFile } from "node:fs/promises";
-import { join as join2 } from "node:path";
+import { join as join3 } from "node:path";
 var STATE_DIR = ".ts-cloud/state";
 function driverStatePath(stackName) {
-  return join2(process.cwd(), STATE_DIR, `${stackName}.json`);
+  return join3(process.cwd(), STATE_DIR, `${stackName}.json`);
 }
 async function readDriverState(stackName) {
   try {
@@ -2221,7 +2281,7 @@ async function readDriverState(stackName) {
 }
 async function writeDriverState(stackName, state) {
   const path = driverStatePath(stackName);
-  await mkdir(join2(process.cwd(), STATE_DIR), { recursive: true });
+  await mkdir(join3(process.cwd(), STATE_DIR), { recursive: true });
   await writeFile(path, `${JSON.stringify(state, null, 2)}
 `, "utf8");
 }
@@ -2242,9 +2302,6 @@ function formatSshFailure(error) {
   return `Remote SSH command failed${status}${signal}${output ? `
 ${output}` : ""}`;
 }
-function expandHome(path) {
-  return path.startsWith("~/") ? join3(homedir(), path.slice(2)) : path;
-}
 
 class HetznerDriver {
   name = "hetzner";
@@ -2258,12 +2315,18 @@ class HetznerDriver {
   bootWait;
   constructor(options = {}) {
     this.client = options.client ?? new HetznerClient({
-      apiToken: resolveHetznerApiToken(options.apiToken)
+      apiToken: resolveHetznerApiToken2(options.apiToken)
+    });
+    const settings = resolveHetznerSettings(undefined, {
+      sshPrivateKeyPath: options.sshPrivateKeyPath,
+      sshPublicKeyPath: options.sshPublicKeyPath,
+      sshUser: options.sshUser,
+      location: options.location
     });
-    this.sshPrivateKeyPath = expandHome(options.sshPrivateKeyPath || process.env.HCLOUD_SSH_KEY || "~/.ssh/id_ed25519");
-    this.sshPublicKeyPath = expandHome(options.sshPublicKeyPath || process.env.HCLOUD_SSH_PUBLIC_KEY || `${this.sshPrivateKeyPath}.pub`);
-    this.sshUser = options.sshUser || process.env.HCLOUD_SSH_USER || "root";
-    this.location = options.location || process.env.HCLOUD_LOCATION || "fsn1";
+    this.sshPrivateKeyPath = settings.sshPrivateKeyPath;
+    this.sshPublicKeyPath = settings.sshPublicKeyPath;
+    this.sshUser = settings.sshUser;
+    this.location = settings.location;
     this.waitForBoot = options.waitForBoot ?? true;
     this.bootWait = {
       sshIntervalMs: options.bootWait?.sshIntervalMs ?? 5000,
@@ -2330,7 +2393,7 @@ class HetznerDriver {
     });
     const userData = wrapCloudInitUserData(bootstrap);
     const serverType = resolveHetznerServerType(compute.size);
-    const image = compute.image || config.hetzner?.image || "ubuntu-24.04";
+    const image = resolveHetznerImage(config);
     const firewallName = `${slug}-${environment}-app-fw`;
     const { firewall } = await this.ensureFirewall(firewallName, labels, buildHetznerFirewallRules({
       allowSsh: compute.allowSsh !== false,
@@ -2373,7 +2436,7 @@ class HetznerDriver {
     const compute = config.infrastructure.compute;
     const stackName = resolveProjectStackName(config, environment);
     const serverType = resolveHetznerServerType(compute.size);
-    const image = compute.image || config.hetzner?.image || "ubuntu-24.04";
+    const image = resolveHetznerImage(config);
     const location = config.hetzner?.location || this.location;
     const baked = compute.bakedImage === true;
     const existingState = await readDriverState(stackName);
@@ -2528,7 +2591,7 @@ class HetznerDriver {
     const compute = config.infrastructure.compute;
     const stackName = resolveProjectStackName(config, environment);
     const serverType = resolveHetznerServerType(compute.size);
-    const image = compute.image || config.hetzner?.image || "ubuntu-24.04";
+    const image = resolveHetznerImage(config);
     const location = config.hetzner?.location || this.location;
     const baked = compute.bakedImage === true;
     const sites = config.sites || {};
@@ -2811,11 +2874,11 @@ class HetznerDriver {
       role: "app",
       stackName: resolveProjectStackName(options.config, options.environment)
     });
-    const first = targets[0];
+    const first2 = targets[0];
     return {
       deployStoragePath: "/var/ts-cloud/staging",
-      appInstanceId: first?.id,
-      appPublicIp: first?.publicIp,
+      appInstanceId: first2?.id,
+      appPublicIp: first2?.publicIp,
       sshUser: this.sshUser
     };
   }
@@ -3137,6 +3200,7 @@ function createCloudDriver(options) {
       return new HetznerDriver({
         apiToken: options.config.hetzner?.apiToken,
         sshPrivateKeyPath: options.config.hetzner?.sshPrivateKeyPath,
+        sshPublicKeyPath: options.config.hetzner?.sshPublicKeyPath,
         sshUser: options.config.hetzner?.sshUser,
         location: options.config.hetzner?.location
       });
@@ -3481,8 +3545,8 @@ function createBoxProvisioner(options) {
   return new AwsBoxProvisioner(options.aws);
 }
 // src/drivers/shared/env-file.ts
-function formatEnvFile(env) {
-  return Object.entries(env).map(([k, v]) => `${k}=${quoteEnvValue(String(v))}`).join(`
+function formatEnvFile(env2) {
+  return Object.entries(env2).map(([k, v]) => `${k}=${quoteEnvValue(String(v))}`).join(`
 `);
 }
 function quoteEnvValue(value) {
@@ -4047,8 +4111,8 @@ function defaultDeployScriptFor(type) {
 function substituteBins(line, phpBin) {
   return line.replace(/^php\s+/, `${phpBin} `).replace(/(\s)php\s+artisan\s+/g, `$1${phpBin} artisan `);
 }
-function writeSharedEnv(sharedEnvPath, env) {
-  const body = formatEnvFile(env);
+function writeSharedEnv(sharedEnvPath, env2) {
+  const body = formatEnvFile(env2);
   return [
     `cat > ${sharedEnvPath} <<'TS_CLOUD_ENV_EOF'`,
     body,
@@ -4767,4 +4831,4 @@ function buildCloudFrontOriginConfig(options) {
     CustomErrorResponses: { Quantity: 0 }
   };
 }
-export { siteInstallBase, isPhpSite, resolveSiteDeployTarget, resolveSiteKind, validateDeploymentConfig, PANTRY_PROJECT_DIR, DEFAULT_RPX_CERTS_DIR, normalizeRoutePath, deriveRouteId, buildRpxConfig, buildRpxLbConfig, renderRpxLauncher, RPX_DIR, RPX_LAUNCHER_PATH, RPX_SERVICE_NAME, buildRpxProvisionScript, BACKUP_RUNNER_PATH, buildBackupRestoreScript, buildUbuntuBootstrapScript, AwsDriver, HetznerClient, resolveHetznerApiToken, normalizeSshPublicKey, wrapCloudInitUserData, HetznerDriver, LocalBoxDriver, isBoxMode, createCloudDriver, CloudDriverFactory, cloudDrivers, ensureSshKey, ensureFirewall, ensureServer, serverPublicIpv4, buildSshArgs, sshExec, sshExecOrThrow, scpUpload, waitForSsh, waitForCloudInit, UBUNTU_2404_AMI_PARAM, buildBoxUserData, HetznerBoxProvisioner, AwsBoxProvisioner, createBoxProvisioner, releasePaths, buildRollbackScript, resolveExecStart, buildSiteDeployScript, buildStaticSiteDeployScript, buildAwsArtifactFetch, buildLocalArtifactFetch, MANAGEMENT_DASHBOARD_SITE, DASHBOARD_CREDENTIALS_FILE, resolveDashboardAuth, resolveUiSource, ensureManagementDashboard, buildManagementDashboardArtifact, resolveSiteFramework, deploySiteRelease, deployAllComputeSites, reloadRpxGateway, MANAGED_CACHE_POLICY_OPTIMIZED, MANAGED_CACHE_POLICY_DISABLED, MANAGED_ORIGIN_REQUEST_POLICY_ALL_VIEWER, buildCloudFrontOriginConfig };
+export { siteInstallBase, isPhpSite, resolveSiteDeployTarget, resolveSiteKind, validateDeploymentConfig, PANTRY_PROJECT_DIR, DEFAULT_RPX_CERTS_DIR, normalizeRoutePath, deriveRouteId, buildRpxConfig, buildRpxLbConfig, renderRpxLauncher, RPX_DIR, RPX_LAUNCHER_PATH, RPX_SERVICE_NAME, buildRpxProvisionScript, BACKUP_RUNNER_PATH, buildBackupRestoreScript, buildUbuntuBootstrapScript, AwsDriver, resolveHetznerLocation, HetznerClient, resolveHetznerApiToken2 as resolveHetznerApiToken, normalizeSshPublicKey, wrapCloudInitUserData, HetznerDriver, LocalBoxDriver, isBoxMode, createCloudDriver, CloudDriverFactory, cloudDrivers, ensureSshKey, ensureFirewall, ensureServer, serverPublicIpv4, buildSshArgs, sshExec, sshExecOrThrow, scpUpload, waitForSsh, waitForCloudInit, UBUNTU_2404_AMI_PARAM, buildBoxUserData, HetznerBoxProvisioner, AwsBoxProvisioner, createBoxProvisioner, releasePaths, buildRollbackScript, resolveExecStart, buildSiteDeployScript, buildStaticSiteDeployScript, buildAwsArtifactFetch, buildLocalArtifactFetch, MANAGEMENT_DASHBOARD_SITE, DASHBOARD_CREDENTIALS_FILE, resolveDashboardAuth, resolveUiSource, ensureManagementDashboard, buildManagementDashboardArtifact, resolveSiteFramework, deploySiteRelease, deployAllComputeSites, reloadRpxGateway, MANAGED_CACHE_POLICY_OPTIMIZED, MANAGED_CACHE_POLICY_DISABLED, MANAGED_ORIGIN_REQUEST_POLICY_ALL_VIEWER, buildCloudFrontOriginConfig };

package/dist/deploy/dashboard-auth.d.ts

@@ -0,0 +1,82 @@
+/**
+ * Identity and authorization for the management dashboard.
+ *
+ * The dashboard hosts sites for more than one party: Stacks owns the box, and
+ * collaborators are invited to individual sites. That makes authorization a
+ * security boundary rather than a convenience — a site collaborator must never
+ * reach another tenant's data, and must never reach the box itself.
+ *
+ * The model has two levels:
+ * - Box role: `admin` (owns the box — everything) or `member` (only what they
+ *   have been granted).
+ * - Site grants: a member holds a {@link SiteRole} per site. `owner` may change
+ *   the site's settings; `collaborator` may view and deploy it.
+ *
+ * Box-level capabilities (shell, terminal, SSH keys, firewall, databases,
+ * cloud-config edits) are **admin-only and never grantable per site**. Each of
+ * them yields root on the box, which would hand a single site's collaborator
+ * control of every other tenant's site. There is deliberately no grant that
+ * unlocks them for a member.
+ *
+ * Authorization is deny-by-default: {@link authorize} answers `false` for any
+ * capability it does not explicitly recognize.
+ */
+/** Box-wide role. `admin` owns the server and everything hosted on it. */
+export type BoxRole = 'admin' | 'member';
+/**
+ * A member's role on one site. `owner` can additionally change that site's
+ * settings; `collaborator` is limited to viewing and deploying it.
+ */
+export type SiteRole = 'owner' | 'collaborator';
+export interface DashboardUser {
+    username: string;
+    /** Encoded scrypt hash — see {@link hashPassword}. Never a plaintext password. */
+    passwordHash: string;
+    role: BoxRole;
+    /** Site name → role. Ignored for admins, who reach every site. */
+    sites: Record<string, SiteRole>;
+    /** Display name shown in the UI. Defaults to the username. */
+    name?: string;
+    createdAt?: string;
+}
+/**
+ * Everything the dashboard can be asked to do.
+ *
+ * `box:*` capabilities are admin-only. `site:*` capabilities are evaluated
+ * against a specific site and may be granted to a member.
+ */
+export type Capability = 'box:read' | 'box:shell' | 'box:ssh' | 'box:firewall' | 'box:database' | 'box:config' | 'box:sites:create' | 'box:sites:delete' | 'box:serverless' | 'box:users' | 'site:read' | 'site:deploy' | 'site:settings';
+/**
+ * Capabilities that are never grantable to a member, for any site. Listed
+ * explicitly so that adding a `site:*` capability can't silently widen a
+ * member's reach into box-level control.
+ */
+export declare function isBoxCapability(capability: Capability): boolean;
+export interface AuthorizeInput {
+    user: Pick<DashboardUser, 'role' | 'sites'>;
+    capability: Capability;
+    /** Required for every `site:*` capability; ignored for `box:*`. */
+    site?: string;
+}
+/**
+ * The single authorization decision point. Deny-by-default: an unrecognized
+ * capability, a missing site, or a site the member holds no grant on all
+ * return `false`.
+ */
+export declare function authorize({ user, capability, site }: AuthorizeInput): boolean;
+/** The sites a user may see. Admins see everything, so pass the full list. */
+export declare function visibleSites(user: Pick<DashboardUser, 'role' | 'sites'>, allSites: string[]): string[];
+/**
+ * Hash a password for storage: `scrypt$N$r$p$salt$hash` (both salt and hash
+ * base64url). The parameters travel with the hash so they can be raised later
+ * without invalidating existing credentials.
+ */
+export declare function hashPassword(password: string): string;
+/**
+ * Verify a password against an encoded hash, in constant time. Returns false
+ * for malformed hashes rather than throwing — a corrupt user record must fail
+ * the login, not crash the server.
+ */
+export declare function verifyPassword(password: string, stored: string): boolean;
+/** A URL-safe generated password, for invites and the bootstrap admin. */
+export declare function generatePassword(): string;

package/dist/deploy/dashboard-auth.test.d.ts

@@ -0,0 +1 @@
+export {};

package/dist/deploy/dashboard-guard.d.ts

@@ -0,0 +1,40 @@
+/**
+ * The request-time gate: resolve who is calling, then decide whether the
+ * {@link routePolicy} for their request permits it.
+ *
+ * Every dashboard request passes through here before reaching a handler, so
+ * this file and {@link import('./dashboard-policy')} together are the complete
+ * authorization story for the HTTP API.
+ */
+import type { DashboardUser } from './dashboard-auth';
+/**
+ * A synthetic admin used only when auth is explicitly disabled for local
+ * development. It is never persisted and never has a password.
+ */
+export declare const LOCAL_ADMIN: DashboardUser;
+export interface GuardOptions {
+    cwd: string;
+    /** When false, every request is treated as {@link LOCAL_ADMIN}. */
+    enabled: boolean;
+    secret: string;
+}
+export interface GuardDecision {
+    ok: boolean;
+    status?: number;
+    error?: string;
+    /** True when the caller has no valid session at all (vs. lacking a grant). */
+    unauthenticated?: boolean;
+}
+export interface DashboardGuard {
+    enabled: boolean;
+    /** The user for this request, or null when unauthenticated. */
+    resolveUser: (req: Request) => DashboardUser | null;
+    /** Whether `user` may perform `req`. `site` is required for site-scoped routes. */
+    check: (req: Request, pathname: string, user: DashboardUser | null, site?: string) => GuardDecision;
+}
+export declare function createDashboardGuard(options: GuardOptions): DashboardGuard;
+/**
+ * Read the site name a site-scoped route acts on, without consuming the body
+ * the handler will read (the request is cloned).
+ */
+export declare function siteFromRequest(req: Request, pathname: string): Promise<string | undefined>;

package/dist/deploy/dashboard-login-page.d.ts

@@ -0,0 +1,16 @@
+/**
+ * The login page.
+ *
+ * Served directly by the dashboard server rather than built with the rest of
+ * the stx UI: it has to render before there is a session, and the built pages
+ * are scope-specific (see the per-scope UI cache in `local-dashboard-server`).
+ * Keeping it self-contained also means a broken UI build still leaves a way in.
+ *
+ * It mirrors the cockpit's existing design tokens so the two don't read as
+ * different products.
+ */
+/**
+ * The page. `serverless` only picks the post-login landing route, matching the
+ * redirect the server already does for a serverless deployment.
+ */
+export declare function renderLoginPage(serverless?: boolean): string;

package/dist/deploy/dashboard-pages.test.d.ts

@@ -0,0 +1 @@
+export {};

package/dist/deploy/dashboard-policy.d.ts

@@ -0,0 +1,37 @@
+/**
+ * The dashboard's route → capability table.
+ *
+ * This is the whole authorization surface of the HTTP API in one readable
+ * place, so it can be reviewed without tracing handlers. {@link routePolicy}
+ * maps a method and path to the {@link Capability} it needs.
+ *
+ * **Fails closed.** A route with no entry resolves to `box:shell` — the most
+ * privileged capability, admin-only. Adding a route and forgetting to give it a
+ * policy therefore locks members out rather than quietly exposing the route.
+ *
+ * Site-scoped routes take their site from the request body, so their entry sets
+ * `siteFrom: 'body'` and the caller supplies the parsed name.
+ */
+import type { Capability } from './dashboard-auth';
+export interface RoutePolicy {
+    capability: Capability;
+    /** Where the site name comes from, for `site:*` capabilities. */
+    siteFrom?: 'body';
+    /** Any authenticated user may call it, regardless of role. */
+    anyUser?: boolean;
+}
+/**
+ * Routes reachable with no session at all. These necessarily run before there
+ * is a user to authorize, so they are listed here explicitly — the set is
+ * deliberately tiny and should stay that way.
+ *
+ * `/login` (the page) is served by the same public path.
+ */
+export declare const PUBLIC_ROUTES: ReadonlySet<string>;
+export declare function isPublicRoute(method: string, pathname: string): boolean;
+/**
+ * The policy for a request. Unlisted API routes fail closed to admin-only.
+ */
+export declare function routePolicy(method: string, pathname: string): RoutePolicy;
+/** Every policy entry, for tests and documentation. */
+export declare function allRoutePolicies(): Record<string, RoutePolicy>;

package/dist/deploy/dashboard-policy.test.d.ts

@@ -0,0 +1 @@
+export {};

package/dist/deploy/dashboard-scope.d.ts

@@ -0,0 +1,24 @@
+/**
+ * Narrow resolved dashboard data to what a user is allowed to see.
+ *
+ * This runs server-side, before serialization: a member is *sent* less, not
+ * merely shown less. Hiding a panel in the UI would leave every other tenant's
+ * deploy history and log lines one devtools tab away.
+ *
+ * Admins get the payload untouched. For a member we keep only their sites and
+ * the observability derived from them, and drop the box-level surface
+ * (host metrics, services, SSH keys, firewall, backups) outright — none of it
+ * is theirs, and some of it (open ports, auth events) is a map of the box.
+ */
+import type { DashboardUser } from './dashboard-auth';
+export interface ScopeOptions {
+    user: Pick<DashboardUser, 'role' | 'sites'>;
+    /** Project slug, used to match a site to its systemd units. */
+    slug: string;
+}
+/**
+ * Return a copy of `data` containing only what `user` may see.
+ */
+export declare function scopeDashboardData(data: Record<string, any>, options: ScopeOptions): Record<string, any>;
+/** Narrow the sanitized cloud config the same way. */
+export declare function scopeCloudConfig(config: Record<string, any>, user: Pick<DashboardUser, 'role' | 'sites'>): Record<string, any>;

package/dist/deploy/dashboard-scope.test.d.ts

@@ -0,0 +1 @@
+export {};

package/dist/deploy/dashboard-session.d.ts

@@ -0,0 +1,52 @@
+/**
+ * Cookie-backed sessions for the management dashboard.
+ *
+ * Sessions are stateless signed tokens (`payload.signature`, HMAC-SHA256) so
+ * they survive a dashboard restart without a session store. The payload carries
+ * only the username and an expiry; every request re-loads the user from the
+ * store, so a revoked or downgraded grant takes effect immediately rather than
+ * lingering until the token expires.
+ *
+ * The signing secret is resolved from `TS_CLOUD_DASHBOARD_SECRET`, else
+ * generated once and persisted to `.ts-cloud/dashboard-secret`. Rotating it
+ * invalidates every outstanding session.
+ */
+export declare const SESSION_COOKIE = "ts_cloud_session";
+export declare const SECRET_FILE: string;
+/** Eight hours: long enough to work through a deploy, short enough to expire. */
+export declare const SESSION_TTL_MS: number;
+export interface SessionPayload {
+    /** Username the session belongs to. */
+    u: string;
+    /** Expiry, epoch milliseconds. */
+    exp: number;
+}
+/**
+ * Resolve the HMAC signing secret, generating and persisting one on first use.
+ * The file is written 0600 — it is equivalent to every dashboard credential.
+ */
+export declare function resolveSessionSecret(cwd: string): string;
+/** Issue a signed session token for `username`. */
+export declare function createSessionToken(username: string, secret: string, ttlMs?: number): string;
+/**
+ * Verify a token and return its payload, or null when the signature is invalid,
+ * the token is malformed, or it has expired. Signature is compared before the
+ * payload is trusted for anything.
+ */
+export declare function verifySessionToken(token: string | undefined, secret: string): SessionPayload | null;
+/** Read one cookie from a request's `Cookie` header. */
+export declare function readCookie(header: string | null, name: string): string | undefined;
+/**
+ * Serialize the session cookie. `HttpOnly` keeps it away from page scripts,
+ * `SameSite=Lax` blocks cross-site POSTs from carrying it (the dashboard's CSRF
+ * defense), and `Secure` is set whenever the dashboard is not on loopback —
+ * in production it is always behind TLS.
+ */
+export declare function serializeSessionCookie(token: string, options?: {
+    secure: boolean;
+    maxAgeMs?: number;
+}): string;
+/** Cookie that clears the session (logout). */
+export declare function clearSessionCookie(options?: {
+    secure: boolean;
+}): string;

package/dist/deploy/dashboard-users.d.ts

@@ -0,0 +1,60 @@
+/**
+ * The dashboard's user store: a JSON file of {@link DashboardUser} records at
+ * `.ts-cloud/dashboard-users.json` (0600), holding scrypt hashes and site
+ * grants. Small on purpose — a box hosts a handful of collaborators, not a
+ * directory service.
+ *
+ * On first use the store bootstraps a single admin so a freshly provisioned
+ * dashboard is never reachable without credentials. The generated password is
+ * returned to the caller to print once; only its hash is ever written.
+ */
+import type { DashboardUser, SiteRole } from './dashboard-auth';
+export declare const USERS_FILE: string;
+/** Usernames are used in URLs and shell-free contexts; keep them boring. */
+export declare function isValidUsername(value: string): boolean;
+export declare function parseUsersFile(text: string): DashboardUser[];
+export declare function usersFilePath(cwd: string): string;
+export declare function loadUsers(cwd: string): DashboardUser[];
+export declare function saveUsers(cwd: string, users: DashboardUser[]): void;
+export declare function findUser(users: DashboardUser[], username: string): DashboardUser | undefined;
+export interface BootstrapResult {
+    users: DashboardUser[];
+    /** Set only when an admin was just created — print it once, then it's gone. */
+    generated?: {
+        username: string;
+        password: string;
+    };
+}
+/**
+ * Ensure at least one admin exists. When the store is empty, create an admin
+ * using `TS_CLOUD_UI_PASSWORD` if set, else a generated password that is
+ * returned for one-time display.
+ */
+export declare function ensureAdminUser(cwd: string, username?: string): BootstrapResult;
+export interface UpsertMemberInput {
+    username: string;
+    password?: string;
+    name?: string;
+    sites: Record<string, SiteRole>;
+}
+/**
+ * Create or update a member and their site grants. Returns the generated
+ * password when one was minted (a new user without an explicit password).
+ *
+ * Members are created through this path only — it cannot produce an admin, so
+ * an invite flow can never escalate someone to box-wide control.
+ */
+export declare function upsertMember(cwd: string, input: UpsertMemberInput): {
+    user: DashboardUser;
+    password?: string;
+};
+/**
+ * Remove a user. The last admin cannot be removed — that would lock everyone
+ * out of the box with no way back in short of editing the file by hand.
+ */
+export declare function removeUser(cwd: string, username: string): {
+    ok: boolean;
+    error?: string;
+};
+/** Public shape for the UI — never leaks the password hash. */
+export declare function describeUser(user: DashboardUser): Record<string, any>;

package/dist/deploy/index.js

@@ -12,7 +12,7 @@ import {
   sanitizeCloudConfig,
   setMaintenance,
   startLocalDashboardServer
-} from "../chunk-h4pdjzq2.js";
+} from "../chunk-nt2hrnva.js";
 import {
   buildAndPushServerlessImage
 } from "../chunk-qgnyzfmx.js";
@@ -30,7 +30,7 @@ import {
   resolveUiSource,
   siteInstallBase,
   validateDeploymentConfig
-} from "../chunk-vpyd42tp.js";
+} from "../chunk-xgnxz5dz.js";
 import"../chunk-49nmy775.js";
 import"../chunk-93hjhs78.js";
 import {

package/dist/deploy/local-dashboard-server.d.ts

@@ -28,4 +28,5 @@ export interface DashboardAction {
 export declare function sanitizeCloudConfig(config: CloudConfig): Record<string, any>;
 export declare function dashboardActions(environment: EnvironmentType): DashboardAction[];
 export declare function resolveDashboardAction(id: string, environment: EnvironmentType): DashboardAction | undefined;
+export declare function isBoxOnlyPage(pathname: string): boolean;
 export declare function startLocalDashboardServer(options?: LocalDashboardServerOptions): Promise<LocalDashboardServer>;

package/dist/drivers/hetzner/client.d.ts

@@ -2,6 +2,7 @@
  * Hetzner Cloud API client
  * @see https://docs.hetzner.cloud/
  */
+import type { CloudConfig } from '@ts-cloud/core';
 export interface HetznerApiErrorBody {
     error?: {
         code?: string;
@@ -183,7 +184,14 @@ export declare class HetznerClient {
         maxWaitMs?: number;
     }): Promise<HetznerServer>;
 }
-export declare function resolveHetznerApiToken(configToken?: string): string;
+/**
+ * The Hetzner API token, or a clear error when none is configured.
+ *
+ * Resolution itself lives in {@link import('./config').resolveHetznerApiToken}
+ * so the driver, the client and the dashboard cannot drift apart on where a
+ * setting comes from.
+ */
+export declare function resolveHetznerApiToken(configToken?: string, config?: CloudConfig): string;
 /**
  * Normalize an OpenSSH public key to its `<type> <base64>` body, dropping the
  * trailing comment. Lets us match a local key against keys already registered