@stacksjs/ts-cloud 0.7.18 → 0.7.20

package/dist/{chunk-h4pdjzq2.js → chunk-qdhn1s7j.js}

@@ -23,11 +23,12 @@ import {
   buildRollbackScript,
   createCloudDriver,
   releasePaths,
+  resolveHetznerLocation,
   resolveSiteFramework,
   resolveSiteKind,
   resolveUiSource,
   siteInstallBase
-} from "./chunk-vpyd42tp.js";
+} from "./chunk-xgnxz5dz.js";
 import {
   artifactKey,
   composeServerlessAppTemplate,
@@ -1159,11 +1160,11 @@ async function resolveDashboardData(config, environment) {
   return out;
 }
 // src/deploy/local-dashboard-server.ts
-import { existsSync as existsSync16, statSync as statSync3 } from "node:fs";
+import { existsSync as existsSync18, statSync as statSync3 } from "node:fs";
 import { readFile, writeFile as writeFile4 } from "node:fs/promises";
 import { mkdtempSync } from "node:fs";
 import { tmpdir } from "node:os";
-import { dirname as dirname5, extname as extname2, join as join10, normalize } from "node:path";
+import { dirname as dirname8, extname as extname2, join as join12, normalize } from "node:path";
 import { fileURLToPath } from "node:url";
 
 // src/config.ts
@@ -9896,6 +9897,67 @@ async function getConfig() {
 var loadCloudConfig = getConfig;
 var config5 = defaultConfig4;
 
+// src/deploy/dashboard-auth.ts
+import { randomBytes as randomBytes4, scryptSync, timingSafeEqual } from "node:crypto";
+var SITE_ROLE_CAPABILITIES = {
+  owner: new Set(["site:read", "site:deploy", "site:settings"]),
+  collaborator: new Set(["site:read", "site:deploy"])
+};
+function isBoxCapability(capability) {
+  return capability.startsWith("box:");
+}
+function authorize({ user, capability, site }) {
+  if (user.role === "admin")
+    return true;
+  if (isBoxCapability(capability))
+    return false;
+  if (!site)
+    return false;
+  const siteRole = user.sites?.[site];
+  if (!siteRole)
+    return false;
+  return SITE_ROLE_CAPABILITIES[siteRole]?.has(capability) ?? false;
+}
+function visibleSites(user, allSites) {
+  if (user.role === "admin")
+    return [...allSites];
+  return allSites.filter((site) => !!user.sites?.[site]);
+}
+var SCRYPT_N = 16384;
+var SCRYPT_R = 8;
+var SCRYPT_P = 1;
+var KEY_LEN = 32;
+var SALT_LEN = 16;
+function hashPassword(password) {
+  const salt = randomBytes4(SALT_LEN);
+  const hash = scryptSync(password, salt, KEY_LEN, { N: SCRYPT_N, r: SCRYPT_R, p: SCRYPT_P });
+  return `scrypt$${SCRYPT_N}$${SCRYPT_R}$${SCRYPT_P}$${salt.toString("base64url")}$${hash.toString("base64url")}`;
+}
+function verifyPassword(password, stored) {
+  try {
+    const parts = stored.split("$");
+    if (parts.length !== 6 || parts[0] !== "scrypt")
+      return false;
+    const [, nRaw, rRaw, pRaw, saltRaw, hashRaw] = parts;
+    const N = Number(nRaw);
+    const r = Number(rRaw);
+    const p = Number(pRaw);
+    if (!Number.isFinite(N) || !Number.isFinite(r) || !Number.isFinite(p))
+      return false;
+    const salt = Buffer.from(saltRaw, "base64url");
+    const expected = Buffer.from(hashRaw, "base64url");
+    if (salt.length === 0 || expected.length === 0)
+      return false;
+    const actual = scryptSync(password, salt, expected.length, { N, r, p, maxmem: 256 * 1024 * 1024 });
+    return timingSafeEqual(actual, expected);
+  } catch {
+    return false;
+  }
+}
+function generatePassword() {
+  return randomBytes4(18).toString("base64url");
+}
+
 // src/deploy/dashboard-data-server.ts
 import { existsSync as existsSync14, readFileSync as readFileSync3 } from "node:fs";
 import { join as join9 } from "node:path";
@@ -10157,10 +10219,8 @@ function configuredProvider(config6) {
   return config6.infrastructure?.compute?.provider ?? config6.cloud?.provider ?? config6.provider ?? "aws";
 }
 function configuredRegion(config6) {
-  const provider = configuredProvider(config6);
-  if (provider === "hetzner") {
-    return config6.hetzner?.location ?? process.env.HCLOUD_LOCATION ?? process.env.HETZNER_LOCATION ?? "fsn1";
-  }
+  if (configuredProvider(config6) === "hetzner")
+    return resolveHetznerLocation(config6);
   return config6.project.region ?? "us-east-1";
 }
 function loadLocalState(config6, environment) {
@@ -10993,6 +11053,447 @@ async function listDatabaseBackups(config6, environment) {
   return { ...r, backups };
 }
 
+// src/deploy/dashboard-policy.ts
+var FAIL_CLOSED = { capability: "box:shell" };
+var PUBLIC_ROUTES = new Set([
+  "POST /api/login",
+  "POST /api/logout"
+]);
+var POLICIES = {
+  "GET /api/health": { capability: "site:read", anyUser: true },
+  "GET /api/dashboard-data": { capability: "site:read", anyUser: true },
+  "GET /api/config": { capability: "site:read", anyUser: true },
+  "GET /api/me": { capability: "site:read", anyUser: true },
+  "POST /api/sites/deploy": { capability: "site:deploy", siteFrom: "body" },
+  "PATCH /api/sites": { capability: "site:settings", siteFrom: "body" },
+  "POST /api/sites": { capability: "box:sites:create" },
+  "DELETE /api/sites": { capability: "box:sites:delete" },
+  "POST /api/env": { capability: "box:config" },
+  "GET /api/ssh-keys": { capability: "box:ssh" },
+  "POST /api/ssh-keys": { capability: "box:ssh" },
+  "DELETE /api/ssh-keys": { capability: "box:ssh" },
+  "GET /api/firewall": { capability: "box:firewall" },
+  "POST /api/firewall": { capability: "box:firewall" },
+  "DELETE /api/firewall": { capability: "box:firewall" },
+  "GET /api/databases": { capability: "box:database" },
+  "POST /api/databases": { capability: "box:database" },
+  "GET /api/databases/backups": { capability: "box:database" },
+  "POST /api/databases/backup": { capability: "box:database" },
+  "POST /api/databases/users": { capability: "box:database" },
+  "GET /api/actions": { capability: "box:read" },
+  "POST /api/actions/run": { capability: "box:shell" },
+  "GET /api/server/operations": { capability: "box:read" },
+  "POST /api/server/operations/run": { capability: "box:shell" },
+  "POST /api/server/command": { capability: "box:shell" },
+  "GET /api/terminal": { capability: "box:shell" },
+  "GET /api/users": { capability: "box:users" },
+  "POST /api/users": { capability: "box:users" },
+  "DELETE /api/users": { capability: "box:users" },
+  "GET /api/serverless/operations": { capability: "box:serverless" },
+  "POST /api/serverless/operations/run": { capability: "box:serverless" },
+  "POST /api/serverless/command": { capability: "box:serverless" },
+  "GET /api/serverless/dlq": { capability: "box:serverless" },
+  "POST /api/serverless/dlq/redrive": { capability: "box:serverless" },
+  "POST /api/serverless/dlq/purge": { capability: "box:serverless" },
+  "GET /api/serverless/secrets": { capability: "box:serverless" },
+  "POST /api/serverless/secrets": { capability: "box:serverless" },
+  "DELETE /api/serverless/secrets": { capability: "box:serverless" },
+  "POST /api/serverless/functions/config": { capability: "box:serverless" },
+  "GET /api/serverless/alarms": { capability: "box:serverless" },
+  "POST /api/serverless/alarms": { capability: "box:serverless" },
+  "DELETE /api/serverless/alarms": { capability: "box:serverless" },
+  "GET /api/serverless/traces": { capability: "box:serverless" },
+  "POST /api/serverless/scheduler": { capability: "box:serverless" }
+};
+function routePolicy(method, pathname) {
+  return POLICIES[`${method.toUpperCase()} ${pathname}`] ?? FAIL_CLOSED;
+}
+
+// src/deploy/dashboard-session.ts
+import { createHmac, randomBytes as randomBytes6, timingSafeEqual as timingSafeEqual2 } from "node:crypto";
+import { chmodSync, existsSync as existsSync16, mkdirSync as mkdirSync5, readFileSync as readFileSync4, writeFileSync as writeFileSync8 } from "node:fs";
+import { dirname as dirname5, join as join10 } from "node:path";
+var SESSION_COOKIE = "ts_cloud_session";
+var SECRET_FILE = join10(".ts-cloud", "dashboard-secret");
+var SESSION_TTL_MS = 8 * 60 * 60 * 1000;
+function resolveSessionSecret(cwd) {
+  const fromEnv = process.env.TS_CLOUD_DASHBOARD_SECRET?.trim();
+  if (fromEnv)
+    return fromEnv;
+  const file = join10(cwd, SECRET_FILE);
+  try {
+    if (existsSync16(file)) {
+      const saved = readFileSync4(file, "utf8").trim();
+      if (saved)
+        return saved;
+    }
+  } catch {}
+  const secret = randomBytes6(32).toString("base64url");
+  try {
+    mkdirSync5(dirname5(file), { recursive: true });
+    writeFileSync8(file, `${secret}
+`);
+    chmodSync(file, 384);
+  } catch {}
+  return secret;
+}
+function sign(data, secret) {
+  return createHmac("sha256", secret).update(data).digest("base64url");
+}
+function createSessionToken(username, secret, ttlMs = SESSION_TTL_MS) {
+  const payload = { u: username, exp: Date.now() + ttlMs };
+  const encoded = Buffer.from(JSON.stringify(payload), "utf8").toString("base64url");
+  return `${encoded}.${sign(encoded, secret)}`;
+}
+function verifySessionToken(token, secret) {
+  if (!token)
+    return null;
+  const dot = token.lastIndexOf(".");
+  if (dot <= 0)
+    return null;
+  const encoded = token.slice(0, dot);
+  const signature = token.slice(dot + 1);
+  const expected = sign(encoded, secret);
+  const a = Buffer.from(signature);
+  const b = Buffer.from(expected);
+  if (a.length !== b.length || !timingSafeEqual2(a, b))
+    return null;
+  try {
+    const payload = JSON.parse(Buffer.from(encoded, "base64url").toString("utf8"));
+    if (typeof payload?.u !== "string" || typeof payload?.exp !== "number")
+      return null;
+    if (Date.now() >= payload.exp)
+      return null;
+    return payload;
+  } catch {
+    return null;
+  }
+}
+function readCookie(header2, name) {
+  if (!header2)
+    return;
+  for (const part of header2.split(";")) {
+    const eq = part.indexOf("=");
+    if (eq < 0)
+      continue;
+    if (part.slice(0, eq).trim() === name)
+      return decodeURIComponent(part.slice(eq + 1).trim());
+  }
+  return;
+}
+function serializeSessionCookie(token, options = { secure: true }) {
+  const maxAge = Math.floor((options.maxAgeMs ?? SESSION_TTL_MS) / 1000);
+  const attrs = [
+    `${SESSION_COOKIE}=${encodeURIComponent(token)}`,
+    "Path=/",
+    "HttpOnly",
+    "SameSite=Lax",
+    `Max-Age=${maxAge}`
+  ];
+  if (options.secure)
+    attrs.push("Secure");
+  return attrs.join("; ");
+}
+function clearSessionCookie(options = { secure: true }) {
+  const attrs = [`${SESSION_COOKIE}=`, "Path=/", "HttpOnly", "SameSite=Lax", "Max-Age=0"];
+  if (options.secure)
+    attrs.push("Secure");
+  return attrs.join("; ");
+}
+
+// src/deploy/dashboard-users.ts
+import { chmodSync as chmodSync2, existsSync as existsSync17, mkdirSync as mkdirSync7, readFileSync as readFileSync5, writeFileSync as writeFileSync10 } from "node:fs";
+import { dirname as dirname7, join as join11 } from "node:path";
+var USERS_FILE = join11(".ts-cloud", "dashboard-users.json");
+function isValidUsername(value) {
+  return /^[a-z0-9][a-z0-9._-]{1,31}$/i.test(value);
+}
+function normalizeUser(raw) {
+  if (!raw || typeof raw.username !== "string" || typeof raw.passwordHash !== "string")
+    return null;
+  const role = raw.role === "admin" ? "admin" : "member";
+  const sites = {};
+  if (raw.sites && typeof raw.sites === "object") {
+    for (const [site, siteRole] of Object.entries(raw.sites)) {
+      if (siteRole === "owner" || siteRole === "collaborator")
+        sites[site] = siteRole;
+    }
+  }
+  return {
+    username: raw.username,
+    passwordHash: raw.passwordHash,
+    role,
+    sites,
+    name: typeof raw.name === "string" ? raw.name : undefined,
+    createdAt: typeof raw.createdAt === "string" ? raw.createdAt : undefined
+  };
+}
+function parseUsersFile(text) {
+  try {
+    const parsed = JSON.parse(text);
+    if (!Array.isArray(parsed?.users))
+      return [];
+    return parsed.users.map(normalizeUser).filter((u) => u !== null);
+  } catch {
+    return [];
+  }
+}
+function usersFilePath(cwd) {
+  return join11(cwd, USERS_FILE);
+}
+function loadUsers(cwd) {
+  const file = usersFilePath(cwd);
+  if (!existsSync17(file))
+    return [];
+  try {
+    return parseUsersFile(readFileSync5(file, "utf8"));
+  } catch {
+    return [];
+  }
+}
+function saveUsers(cwd, users) {
+  const file = usersFilePath(cwd);
+  mkdirSync7(dirname7(file), { recursive: true });
+  writeFileSync10(file, `${JSON.stringify({ users }, null, 2)}
+`);
+  chmodSync2(file, 384);
+}
+function findUser(users, username) {
+  const wanted = username.trim().toLowerCase();
+  return users.find((u) => u.username.toLowerCase() === wanted);
+}
+function ensureAdminUser(cwd, username = "admin") {
+  const users = loadUsers(cwd);
+  if (users.some((u) => u.role === "admin"))
+    return { users };
+  const password = process.env.TS_CLOUD_UI_PASSWORD?.trim() || generatePassword();
+  const admin = {
+    username,
+    passwordHash: hashPassword(password),
+    role: "admin",
+    sites: {},
+    name: "Administrator",
+    createdAt: new Date().toISOString()
+  };
+  const next = [...users, admin];
+  saveUsers(cwd, next);
+  return { users: next, generated: { username, password } };
+}
+function upsertMember(cwd, input) {
+  const users = loadUsers(cwd);
+  const existing = findUser(users, input.username);
+  const password = input.password?.trim() || (existing ? undefined : generatePassword());
+  const user = {
+    username: existing?.username ?? input.username,
+    passwordHash: password ? hashPassword(password) : existing.passwordHash,
+    role: existing?.role ?? "member",
+    sites: input.sites,
+    name: input.name ?? existing?.name,
+    createdAt: existing?.createdAt ?? new Date().toISOString()
+  };
+  const next = existing ? users.map((u) => u.username.toLowerCase() === user.username.toLowerCase() ? user : u) : [...users, user];
+  saveUsers(cwd, next);
+  return { user, password };
+}
+function removeUser(cwd, username) {
+  const users = loadUsers(cwd);
+  const target = findUser(users, username);
+  if (!target)
+    return { ok: false, error: `No such user: ${username}` };
+  if (target.role === "admin" && users.filter((u) => u.role === "admin").length === 1)
+    return { ok: false, error: "Cannot remove the last admin." };
+  saveUsers(cwd, users.filter((u) => u.username.toLowerCase() !== target.username.toLowerCase()));
+  return { ok: true };
+}
+function describeUser(user) {
+  return {
+    username: user.username,
+    name: user.name ?? user.username,
+    role: user.role,
+    sites: user.sites,
+    siteCount: Object.keys(user.sites).length,
+    createdAt: user.createdAt
+  };
+}
+
+// src/deploy/dashboard-guard.ts
+var LOCAL_ADMIN = {
+  username: "local",
+  passwordHash: "",
+  role: "admin",
+  sites: {},
+  name: "Local (auth disabled)"
+};
+function createDashboardGuard(options) {
+  const { cwd, enabled, secret } = options;
+  return {
+    enabled,
+    resolveUser(req) {
+      if (!enabled)
+        return LOCAL_ADMIN;
+      const token = readCookie(req.headers.get("cookie"), SESSION_COOKIE);
+      const payload = verifySessionToken(token, secret);
+      if (!payload)
+        return null;
+      return findUser(loadUsers(cwd), payload.u) ?? null;
+    },
+    check(req, pathname, user, site) {
+      if (!enabled)
+        return { ok: true };
+      if (!user)
+        return { ok: false, status: 401, error: "Sign in to continue.", unauthenticated: true };
+      const policy = routePolicy(req.method, pathname);
+      if (policy.anyUser)
+        return { ok: true };
+      if (policy.siteFrom === "body" && !site) {
+        return { ok: false, status: 400, error: "This request must name a site." };
+      }
+      if (!authorize({ user, capability: policy.capability, site })) {
+        return { ok: false, status: 403, error: "You do not have access to this." };
+      }
+      return { ok: true };
+    }
+  };
+}
+async function siteFromRequest(req, pathname) {
+  const policy = routePolicy(req.method, pathname);
+  if (policy.siteFrom !== "body")
+    return;
+  try {
+    const body = await req.clone().json();
+    const name = String(body?.name ?? "").trim();
+    return name || undefined;
+  } catch {
+    return;
+  }
+}
+
+// src/deploy/dashboard-login-page.ts
+var STYLES = `
+  :root {
+    --bg: #0a0e15; --bg2: #0b0f18; --panel: rgba(255,255,255,0.03); --panel-br: rgba(255,255,255,0.072);
+    --txt: #e9edf5; --txt2: #94a1b8; --txt3: #5a6577;
+    --accent: #5a8be0; --accent-ink: #061019;
+    --bad: #f0736e; --badbg: rgba(240,115,110,0.11);
+  }
+  * { box-sizing: border-box; margin: 0; padding: 0; }
+  html { background: var(--bg); min-height: 100%; }
+  body {
+    font-family: 'Inter', system-ui, sans-serif; color: var(--txt); min-height: 100vh;
+    background:
+      radial-gradient(900px 460px at 88% -8%, rgba(90,139,224,0.06), transparent 62%),
+      linear-gradient(175deg, var(--bg), var(--bg2));
+    -webkit-font-smoothing: antialiased;
+    display: grid; place-items: center; padding: 24px;
+  }
+  .card {
+    width: 100%; max-width: 380px;
+    background: var(--panel); border: 1px solid var(--panel-br); border-radius: 16px;
+    padding: 32px; backdrop-filter: blur(6px);
+    animation: rise .5s cubic-bezier(0.16, 1, 0.3, 1) both;
+  }
+  @keyframes rise { from { opacity: 0; transform: translateY(8px) } to { opacity: 1; transform: none } }
+  @media (prefers-reduced-motion: reduce) { .card { animation: none } }
+  .brand { display: flex; align-items: center; gap: 10px; font-weight: 700; font-size: 17px; letter-spacing: -0.02em; }
+  .brand .dot { width: 20px; height: 20px; border-radius: 6px; background: var(--accent); box-shadow: inset 0 1px 0 rgba(255,255,255,0.35); }
+  h1 { font-size: 21px; font-weight: 800; letter-spacing: -0.02em; margin-top: 22px; }
+  .sub { color: var(--txt2); font-size: 13.5px; margin-top: 5px; line-height: 1.5; }
+  form { margin-top: 24px; display: grid; gap: 14px; }
+  .field { display: flex; flex-direction: column; gap: 7px; }
+  label { color: var(--txt3); font-size: 11px; font-weight: 800; text-transform: uppercase; letter-spacing: 0.07em; }
+  input {
+    width: 100%; background: rgba(255,255,255,0.05); border: 1px solid var(--panel-br); border-radius: 10px;
+    padding: 10px 12px; color: var(--txt); font-family: inherit; font-size: 14px;
+  }
+  input:focus { outline: none; border-color: var(--accent); box-shadow: 0 0 0 3px rgba(90,139,224,0.12); }
+  button {
+    margin-top: 4px; background: var(--accent); color: var(--accent-ink); border: 0; border-radius: 10px;
+    padding: 11px 16px; font-weight: 700; font-size: 13.5px; cursor: pointer; font-family: inherit;
+    transition: filter .12s, transform .12s;
+  }
+  button:hover { filter: brightness(1.06); }
+  button:active { transform: translateY(1px); }
+  button[disabled] { opacity: 0.6; cursor: default; }
+  .msg {
+    display: none; margin-top: 14px; padding: 10px 12px; border-radius: 10px;
+    background: var(--badbg); border: 1px solid rgba(240,115,110,0.22); color: var(--bad);
+    font-size: 13px; line-height: 1.45;
+  }
+  .msg.shown { display: block; }
+  .note { color: var(--txt3); font-size: 12px; margin-top: 20px; line-height: 1.5; }
+  .note code { font-family: ui-monospace, SFMono-Regular, Menlo, monospace; color: var(--txt2); }
+`;
+function renderLoginPage(serverless = false) {
+  const home = serverless ? "/serverless" : "/";
+  return `<!doctype html>
+<html lang="en">
+<head>
+<meta charset="UTF-8">
+<meta name="viewport" content="width=device-width, initial-scale=1.0">
+<title>Sign in · ts-cloud</title>
+<link rel="icon" type="image/svg+xml" href="data:image/svg+xml,%3Csvg xmlns='http://www.w3.org/2000/svg' viewBox='0 0 32 32'%3E%3Crect x='3' y='3' width='26' height='26' rx='8' fill='%235a8be0'/%3E%3C/svg%3E">
+<link rel="preconnect" href="https://fonts.googleapis.com">
+<link href="https://fonts.googleapis.com/css2?family=Inter:wght@400;500;600;700;800&display=swap" rel="stylesheet">
+<style>${STYLES}</style>
+</head>
+<body>
+  <main class="card">
+    <div class="brand"><span class="dot"></span> ts-cloud</div>
+    <h1>Sign in</h1>
+    <p class="sub">Manage the sites you have been given access to.</p>
+
+    <form id="login" autocomplete="on">
+      <div class="field">
+        <label for="username">Username</label>
+        <input id="username" name="username" autocomplete="username" required autofocus>
+      </div>
+      <div class="field">
+        <label for="password">Password</label>
+        <input id="password" name="password" type="password" autocomplete="current-password" required>
+      </div>
+      <button type="submit" id="submit">Sign in</button>
+    </form>
+
+    <p class="msg" id="msg" role="alert" aria-live="polite"></p>
+    <p class="note">Lost the first admin password? Delete <code>.ts-cloud/dashboard-users.json</code> on the deploy host and restart the dashboard to mint a new one.</p>
+  </main>
+
+<script>
+  const form = document.getElementById('login')
+  const msg = document.getElementById('msg')
+  const submit = document.getElementById('submit')
+
+  form.addEventListener('submit', async (event) => {
+    event.preventDefault()
+    msg.classList.remove('shown')
+    submit.disabled = true
+    submit.textContent = 'Signing in...'
+    try {
+      const res = await fetch('/api/login', {
+        method: 'POST',
+        headers: { 'content-type': 'application/json' },
+        body: JSON.stringify({
+          username: document.getElementById('username').value,
+          password: document.getElementById('password').value,
+        }),
+      })
+      const body = await res.json().catch(() => ({}))
+      if (!res.ok || !body.ok) throw new Error(body.error || 'Could not sign in.')
+      location.href = ${JSON.stringify(home)}
+    } catch (error) {
+      msg.textContent = (error && error.message) || String(error)
+      msg.classList.add('shown')
+      submit.disabled = false
+      submit.textContent = 'Sign in'
+      document.getElementById('password').value = ''
+      document.getElementById('password').focus()
+    }
+  })
+</script>
+</body>
+</html>`;
+}
+
 // src/drivers/shared/compute-ops.ts
 var noopLogger = {
   info: () => {},
@@ -11270,6 +11771,69 @@ async function runServerShellCommand(config6, environment, command) {
   };
 }
 
+// src/deploy/dashboard-scope.ts
+function siteLogSources(slug, site) {
+  return [`${slug}-${site}`, `${slug}-${site}-queues`, `${slug}-${site}-daemons`];
+}
+function isVisibleLogSource(source, slug, sites) {
+  return sites.some((site) => siteLogSources(slug, site).includes(source));
+}
+function scopeDashboardData(data, options) {
+  const { user, slug } = options;
+  if (user.role === "admin")
+    return data;
+  const allSites = (data.sites ?? []).map((s) => s.name).filter(Boolean);
+  const allowed = visibleSites(user, allSites);
+  const allowedSet = new Set(allowed);
+  const sites = (data.sites ?? []).filter((s) => allowedSet.has(s.name));
+  const sitesDetail = (data.sitesDetail ?? []).filter((s) => allowedSet.has(s.name));
+  const domains = new Set(sitesDetail.map((s) => s.domain).filter(Boolean));
+  const deployments = (data.serverDeploymentsDetail ?? data.serverDeployments ?? []).filter((d) => allowedSet.has(d.site));
+  const logs = (data.serverLogs ?? []).filter((log4) => isVisibleLogSource(log4.source, slug, allowed));
+  const tlsCertificates = (data.security?.tlsCertificates ?? []).filter((cert) => domains.has(cert.domain));
+  const activity = (data.activity ?? []).filter((entry) => {
+    if (entry.type === "deploy")
+      return allowed.some((site) => String(entry.title ?? "").startsWith(`${site} `));
+    if (entry.type === "log")
+      return isVisibleLogSource(String(entry.title ?? "").split(" ")[0], slug, allowed);
+    return false;
+  });
+  return {
+    mode: data.mode,
+    environment: data.environment,
+    environments: data.environments,
+    scoped: true,
+    server: { name: "" },
+    sites,
+    sitesDetail,
+    workers: (data.workers ?? []).filter((w) => allowedSet.has(w.site)),
+    serverDeployments: deployments.slice(0, 5),
+    serverDeploymentsDetail: deployments.slice(0, 50),
+    deploymentsEmptyReason: deployments.length ? undefined : "No deployments have been recorded for your sites yet.",
+    serverLogs: logs,
+    serverLogsEmptyReason: logs.length ? undefined : "No recent log entries for your sites.",
+    security: {
+      tlsCertificates,
+      ports: [],
+      firewall: null,
+      authEvents: []
+    },
+    diagnostics: (data.diagnostics ?? []).filter((check) => ["Route conflicts", "TLS certificates"].includes(check.name)),
+    activity
+  };
+}
+function scopeCloudConfig(config6, user) {
+  if (user.role === "admin")
+    return config6;
+  const allowed = new Set(visibleSites(user, Object.keys(config6.sites ?? {})));
+  return {
+    project: { name: config6.project?.name },
+    environment: config6.environment,
+    environments: config6.environments,
+    sites: Object.fromEntries(Object.entries(config6.sites ?? {}).filter(([name]) => allowed.has(name)))
+  };
+}
+
 // src/deploy/firewall-config-editor.ts
 var ALWAYS_OPEN = new Set([22, 80, 443]);
 function isValidPort(port) {
@@ -12085,7 +12649,7 @@ function createTerminalSession(onData, options = {}) {
 var DEFAULT_HOST = "127.0.0.1";
 var DEFAULT_PORT = 7676;
 var MAX_OUTPUT_BYTES3 = 64 * 1024;
-var here = dirname5(fileURLToPath(import.meta.url));
+var here = dirname8(fileURLToPath(import.meta.url));
 var contentTypes = {
   ".html": "text/html; charset=utf-8",
   ".css": "text/css; charset=utf-8",
@@ -12098,12 +12662,13 @@ var contentTypes = {
   ".webp": "image/webp",
   ".ico": "image/x-icon"
 };
-function json(data, status = 200) {
+function json(data, status = 200, headers = {}) {
   return new Response(JSON.stringify(data, null, 2), {
     status,
-    headers: { "content-type": "application/json; charset=utf-8" }
+    headers: { "content-type": "application/json; charset=utf-8", ...headers }
   });
 }
+var DUMMY_HASH = hashPassword("ts-cloud-dummy-password");
 function text(data, status = 200) {
   return new Response(data, {
     status,
@@ -12118,13 +12683,13 @@ function selectedEnvironment(config6, requested) {
 }
 async function loadLocalEnv(cwd) {
   const candidates = [
-    join10(here, "..", "..", "..", "..", ".env"),
-    join10(cwd, ".env"),
-    join10(cwd, ".env.local"),
-    join10(cwd, ".env.production")
+    join12(here, "..", "..", "..", "..", ".env"),
+    join12(cwd, ".env"),
+    join12(cwd, ".env.local"),
+    join12(cwd, ".env.production")
   ];
   for (const file of candidates) {
-    if (!existsSync16(file))
+    if (!existsSync18(file))
       continue;
     const text2 = await readFile(file, "utf8").catch(() => "");
     for (const line of text2.split(`
@@ -12145,12 +12710,12 @@ async function loadLocalEnv(cwd) {
 }
 function resolveCloudConfigPath(cwd) {
   const candidates = [
-    join10(cwd, "config", "cloud.ts"),
-    join10(cwd, "config", "cloud.js"),
-    join10(cwd, "cloud.config.ts"),
-    join10(cwd, "cloud.config.js")
+    join12(cwd, "config", "cloud.ts"),
+    join12(cwd, "config", "cloud.js"),
+    join12(cwd, "cloud.config.ts"),
+    join12(cwd, "cloud.config.js")
   ];
-  return candidates.find((file) => existsSync16(file)) ?? null;
+  return candidates.find((file) => existsSync18(file)) ?? null;
 }
 function computeSshKeys(config6) {
   return config6.infrastructure?.compute?.sshKeys ?? [];
@@ -12188,15 +12753,15 @@ async function resolveLiveDashboardData(config6, environment) {
 }
 function resolveUiSourceDir(cwd) {
   const candidates = [
-    join10(cwd, "packages", "ui"),
-    join10(here, "..", "..", "..", "ui"),
-    join10(here, "..", "..", "ui"),
-    join10(here, "..", "ui-src"),
-    join10(here, "..", "..", "ui-src"),
-    join10(here, "..", "..", "dist", "ui-src")
+    join12(cwd, "packages", "ui"),
+    join12(here, "..", "..", "..", "ui"),
+    join12(here, "..", "..", "ui"),
+    join12(here, "..", "ui-src"),
+    join12(here, "..", "..", "ui-src"),
+    join12(here, "..", "..", "dist", "ui-src")
   ];
   for (const dir of candidates) {
-    if (existsSync16(join10(dir, "pages")) && existsSync16(join10(dir, "package.json")))
+    if (existsSync18(join12(dir, "pages")) && existsSync18(join12(dir, "package.json")))
       return dir;
   }
   return null;
@@ -12206,9 +12771,9 @@ async function buildLiveUi(cwd, data) {
   if (!uiDir)
     return null;
   try {
-    const outDir = mkdtempSync(join10(tmpdir(), "ts-cloud-dashboard-"));
-    const localStx = join10(uiDir, "node_modules", ".bin", "stx");
-    const cmd = existsSync16(localStx) ? [localStx, "build", "--pages", "pages", "--out", outDir, "--no-sitemap", "--no-cache"] : ["bunx", "--bun", "@stacksjs/stx", "build", "--pages", "pages", "--out", outDir, "--no-sitemap", "--no-cache"];
+    const outDir = mkdtempSync(join12(tmpdir(), "ts-cloud-dashboard-"));
+    const localStx = join12(uiDir, "node_modules", ".bin", "stx");
+    const cmd = existsSync18(localStx) ? [localStx, "build", "--pages", "pages", "--out", outDir, "--no-sitemap", "--no-cache"] : ["bunx", "--bun", "@stacksjs/stx", "build", "--pages", "pages", "--out", outDir, "--no-sitemap", "--no-cache"];
     const proc = Bun.spawn(cmd, {
       cwd: uiDir,
       stdout: "pipe",
@@ -12341,19 +12906,33 @@ async function runAction(action, options) {
     stderr: clampOutput3(stderr)
   };
 }
+var MEMBER_PAGES = new Set([
+  "/server/sites",
+  "/server/deployments",
+  "/server/logs"
+]);
+function isBoxOnlyPage(pathname) {
+  const ext = extname2(pathname);
+  if (ext && ext !== ".html")
+    return false;
+  const clean = pathname.replace(/\.html$/, "").replace(/\/+$/, "") || "/";
+  if (clean === "/")
+    return false;
+  return !MEMBER_PAGES.has(clean);
+}
 function staticPath(uiRoot, pathname) {
   const clean = decodeURIComponent(pathname).replace(/^\/+/, "");
   const wanted = clean === "" ? "index.html" : clean;
   const normalized = normalize(wanted);
   if (normalized.startsWith("..") || normalized.includes("/../"))
     return null;
-  const base = join10(uiRoot, normalized);
-  if (existsSync16(base) && !statSync3(base).isDirectory())
+  const base = join12(uiRoot, normalized);
+  if (existsSync18(base) && !statSync3(base).isDirectory())
     return base;
-  if (!extname2(base) && existsSync16(`${base}.html`))
+  if (!extname2(base) && existsSync18(`${base}.html`))
     return `${base}.html`;
-  if (!extname2(base) && existsSync16(join10(base, "index.html")))
-    return join10(base, "index.html");
+  if (!extname2(base) && existsSync18(join12(base, "index.html")))
+    return join12(base, "index.html");
   return null;
 }
 async function serveStatic(uiRoot, pathname) {
@@ -12381,13 +12960,48 @@ async function startLocalDashboardServer(options = {}) {
   const configPath = resolveCloudConfigPath(cwd);
   const initialData = await resolveLiveDashboardData(config6, environment);
   let latestData = initialData;
-  const liveUiRoot = await buildLiveUi(cwd, initialData);
   const packagedUi = resolveUiSource(cwd);
-  let activeUiRoot = liveUiRoot ?? packagedUi?.uiRoot;
-  if (!activeUiRoot)
+  const uiCache = new Map;
+  const scopeKey = (user) => user.role === "admin" ? "admin" : `member:${Object.entries(user.sites).sort(([a], [b]) => a.localeCompare(b)).map(([site, role]) => `${site}=${role}`).join(",")}`;
+  async function uiRootFor(user) {
+    const key = scopeKey(user);
+    const cached = uiCache.get(key);
+    if (cached)
+      return cached;
+    const scoped = {
+      ...scopeDashboardData(latestData, { user, slug: config6.project.slug }),
+      viewer: { role: user.role }
+    };
+    const root = await buildLiveUi(cwd, scoped) ?? packagedUi?.uiRoot;
+    if (root)
+      uiCache.set(key, root);
+    return root;
+  }
+  const adminUiRoot = await uiRootFor({ username: "", passwordHash: "", role: "admin", sites: {} });
+  if (!adminUiRoot)
     throw new Error("ts-cloud dashboard UI not found. Run `bun run build` in ts-cloud or reinstall the package.");
   const terminalSessions = new WeakMap;
   const terminalEnabled = process.env.TS_CLOUD_DASHBOARD_TERMINAL !== "0";
+  const authDisabled = process.env.TS_CLOUD_DASHBOARD_AUTH === "0";
+  if (authDisabled && options.box)
+    throw new Error("TS_CLOUD_DASHBOARD_AUTH=0 is refused in box mode: the dashboard is internet-facing there, and disabling auth would expose a root shell.");
+  const authEnabled = !authDisabled;
+  const secret = resolveSessionSecret(cwd);
+  const guard = createDashboardGuard({ cwd, enabled: authEnabled, secret });
+  if (authEnabled) {
+    const bootstrap = ensureAdminUser(cwd, process.env.TS_CLOUD_UI_USERNAME?.trim() || "admin");
+    if (bootstrap.generated) {
+      console.warn(`
+  ts-cloud dashboard: created the first admin.
+    username: ${bootstrap.generated.username}
+    password: ${bootstrap.generated.password}
+  Saved (hashed) to .ts-cloud/dashboard-users.json. This password is shown once.
+`);
+    }
+  } else {
+    console.warn("  ts-cloud dashboard: authentication is DISABLED (TS_CLOUD_DASHBOARD_AUTH=0). Every request runs as an admin.");
+  }
+  const cookieSecure = host !== "127.0.0.1" && host !== "localhost";
   const server = Bun.serve({
     hostname: host,
     port,
@@ -12422,6 +13036,45 @@ async function startLocalDashboardServer(options = {}) {
     async fetch(req, server2) {
       const url = new URL(req.url);
       try {
+        if (url.pathname === "/api/login" && req.method === "POST") {
+          const body = await readJsonBody(req);
+          const username = String(body.username ?? "").trim();
+          const password = String(body.password ?? "");
+          const user2 = findUser(loadUsers(cwd), username);
+          const hash = user2?.passwordHash || DUMMY_HASH;
+          const ok = verifyPassword(password, hash) && !!user2;
+          if (!ok)
+            return json({ ok: false, error: "Incorrect username or password." }, 401);
+          const token = createSessionToken(user2.username, secret);
+          return json({ ok: true, user: describeUser(user2) }, 200, {
+            "set-cookie": serializeSessionCookie(token, { secure: cookieSecure })
+          });
+        }
+        if (url.pathname === "/api/logout" && req.method === "POST") {
+          const cookie = clearSessionCookie({ secure: cookieSecure });
+          if (req.headers.get("accept")?.includes("text/html"))
+            return new Response(null, { status: 302, headers: { location: "/login", "set-cookie": cookie } });
+          return json({ ok: true }, 200, { "set-cookie": cookie });
+        }
+        if (url.pathname === "/login") {
+          return new Response(renderLoginPage(latestData?.mode === "serverless"), {
+            headers: { "content-type": "text/html; charset=utf-8" }
+          });
+        }
+        const user = guard.resolveUser(req);
+        if (!user) {
+          if (!url.pathname.startsWith("/api/") && req.headers.get("accept")?.includes("text/html"))
+            return new Response(null, { status: 302, headers: { location: "/login" } });
+          return json({ ok: false, error: "Sign in to continue." }, 401);
+        }
+        if (url.pathname === "/api/me")
+          return json({ ok: true, user: describeUser(user), authEnabled });
+        if (url.pathname.startsWith("/api/")) {
+          const site = await siteFromRequest(req, url.pathname);
+          const decision = guard.check(req, url.pathname, user, site);
+          if (!decision.ok)
+            return json({ ok: false, error: decision.error }, decision.status ?? 403);
+        }
         if (url.pathname === "/api/terminal") {
           if (!terminalEnabled)
             return json({ ok: false, error: "The web terminal is disabled." }, 403);
@@ -12435,12 +13088,14 @@ async function startLocalDashboardServer(options = {}) {
             cwd,
             environment,
             environments: availableEnvironments,
-            uiRoot: activeUiRoot,
-            liveData: !!liveUiRoot,
+            uiRoot: await uiRootFor(user),
+            liveData: uiCache.size > 0,
             terminal: terminalEnabled,
             localPackage: import.meta.url.includes("/Code/Libraries/ts-cloud/")
           });
         }
+        if (url.pathname === "/" && user.role === "member")
+          return new Response(null, { status: 302, headers: { location: "/server/sites" } });
         if (url.pathname === "/" && latestData?.mode === "serverless")
           return new Response(null, { status: 302, headers: { location: "/serverless" } });
         if (url.pathname === "/api/env" && req.method === "POST") {
@@ -12452,14 +13107,14 @@ async function startLocalDashboardServer(options = {}) {
             environment = requested;
             actions = dashboardActions(environment);
             latestData = await resolveLiveDashboardData(config6, environment);
-            const rebuilt = await buildLiveUi(cwd, latestData);
-            if (rebuilt)
-              activeUiRoot = rebuilt;
+            uiCache.clear();
           }
           return json({ ok: true, environment, environments: availableEnvironments });
         }
-        if (url.pathname === "/api/config")
-          return json({ ...sanitizeCloudConfig(config6), environment, environments: availableEnvironments });
+        if (url.pathname === "/api/config") {
+          const sanitized = { ...sanitizeCloudConfig(config6), environment, environments: availableEnvironments };
+          return json(scopeCloudConfig(sanitized, user));
+        }
         if (url.pathname === "/api/ssh-keys" && req.method === "GET") {
           return json({
             configPath,
@@ -12686,7 +13341,42 @@ async function startLocalDashboardServer(options = {}) {
         }
         if (url.pathname === "/api/dashboard-data") {
           latestData = await resolveLiveDashboardData(config6, environment);
-          return json(latestData);
+          return json(scopeDashboardData(latestData, { user, slug: config6.project.slug }));
+        }
+        if (url.pathname === "/api/users" && req.method === "GET")
+          return json({ ok: true, users: loadUsers(cwd).map(describeUser) });
+        if (url.pathname === "/api/users" && req.method === "POST") {
+          const body = await readJsonBody(req);
+          const username = String(body.username ?? "").trim();
+          if (!isValidUsername(username))
+            return json({ ok: false, error: "Username must be 2-32 characters: letters, numbers, dot, dash or underscore." }, 422);
+          const requested = body.sites && typeof body.sites === "object" ? body.sites : {};
+          const known = new Set(Object.keys(config6.sites ?? {}));
+          const sites = {};
+          for (const [site, role] of Object.entries(requested)) {
+            if (!known.has(site))
+              return json({ ok: false, error: `Site '${site}' was not found.` }, 404);
+            if (role !== "owner" && role !== "collaborator")
+              return json({ ok: false, error: `Unknown site role '${role}'. Use 'owner' or 'collaborator'.` }, 422);
+            sites[site] = role;
+          }
+          const password = typeof body.password === "string" && body.password.trim() ? body.password.trim() : undefined;
+          if (password && password.length < 12)
+            return json({ ok: false, error: "Password must be at least 12 characters." }, 422);
+          const result = upsertMember(cwd, { username, password, name: typeof body.name === "string" ? body.name : undefined, sites });
+          uiCache.clear();
+          return json({ ok: true, user: describeUser(result.user), password: result.password });
+        }
+        if (url.pathname === "/api/users" && req.method === "DELETE") {
+          const body = await readJsonBody(req);
+          const username = String(body.username ?? "").trim();
+          if (username.toLowerCase() === user.username.toLowerCase())
+            return json({ ok: false, error: "You cannot remove your own account." }, 409);
+          const result = removeUser(cwd, username);
+          if (!result.ok)
+            return json(result, 409);
+          uiCache.clear();
+          return json({ ok: true, username });
         }
         if (url.pathname === "/api/actions/run" && req.method === "POST") {
           const body = await req.json().catch(() => ({}));
@@ -12809,15 +13499,18 @@ async function startLocalDashboardServer(options = {}) {
           return json(await controlScheduler(config6, environment, action));
         }
         const requestedEnv = url.searchParams.get("env");
-        if (requestedEnv && availableEnvironments.includes(requestedEnv) && requestedEnv !== environment) {
+        if (requestedEnv && availableEnvironments.includes(requestedEnv) && requestedEnv !== environment && authorize({ user, capability: "box:config" })) {
           environment = requestedEnv;
           actions = dashboardActions(environment);
           latestData = await resolveLiveDashboardData(config6, environment);
-          const rebuilt = await buildLiveUi(cwd, latestData);
-          if (rebuilt)
-            activeUiRoot = rebuilt;
-        }
-        return serveStatic(activeUiRoot, url.pathname);
+          uiCache.clear();
+        }
+        if (user.role === "member" && isBoxOnlyPage(url.pathname))
+          return new Response(null, { status: 302, headers: { location: "/server/sites" } });
+        const uiRoot = await uiRootFor(user);
+        if (!uiRoot)
+          return text("ts-cloud dashboard UI is unavailable.", 503);
+        return serveStatic(uiRoot, url.pathname);
       } catch (error2) {
         if (options.verbose)
           console.error(error2);