@stacksjs/ts-cloud 0.7.18 → 0.7.20

package/dist/ui-src/pages/partials/head.stx

@@ -46,6 +46,13 @@
   .env-opt { padding: 3px 10px; border-radius: 999px; font-size: 12px; font-weight: 600; color: var(--txt2); }
   .env-opt:hover { color: var(--txt); }
   .env-opt.active { background: var(--okbg); color: var(--ok); }
+  .signout { display: flex; }
+  .signout button {
+    appearance: none; border: 1px solid var(--panel-br); background: rgba(255,255,255,0.035);
+    color: var(--txt2); border-radius: 8px; padding: 5px 11px; font: inherit; font-size: 12px;
+    font-weight: 600; cursor: pointer; transition: color .12s, border-color .12s;
+  }
+  .signout button:hover { color: var(--txt); border-color: rgba(255,255,255,0.16); }
 
   header.page { padding: 30px 0 22px; display: flex; align-items: flex-start; gap: 20px; flex-wrap: wrap; }
   header.page h1 { font-size: 26px; font-weight: 800; letter-spacing: -0.02em; }

package/dist/ui-src/pages/partials/nav.stx

@@ -1,15 +1,25 @@
 <script server>
-// Mode-aware, fully server-rendered nav. The deployment mode + environment list
-// are injected with the dashboard data; the environment switcher is plain links
-// (`?env=<name>`) the server handles - no client JavaScript needed.
+// Mode- and scope-aware, fully server-rendered nav. The deployment mode,
+// environment list and viewer role are injected with the dashboard data; the
+// environment switcher is plain links (`?env=<name>`) the server handles - no
+// client JavaScript needed.
+//
+// The nav offers only what the viewer can actually reach. A member (a
+// collaborator invited to specific sites) has no box-level access, so the
+// server, database and environment-switching surfaces are not shown - the
+// server would refuse them anyway, and offering a link that 403s is worse than
+// not offering it. This is presentation only: access is enforced server-side.
 let __nav = null
 try { __nav = JSON.parse(process.env.TSCLOUD_DASHBOARD_DATA || '') } catch { __nav = null }
 // Server and serverless are mutually exclusive; the dashboard shows one or the other.
 const navMode = __nav?.mode ?? 'server'
-const showServer = navMode === 'server'
-const showServerless = navMode === 'serverless'
+const isMember = (__nav?.viewer?.role ?? 'admin') === 'member'
+const showServer = navMode === 'server' && !isMember
+const showServerless = navMode === 'serverless' && !isMember
 const navEnvs = __nav?.environments ?? []
 const navEnv = __nav?.environment ?? ''
+// Only the box owner can switch the active environment (it is process-wide).
+const showEnvSwitch = navEnvs.length > 1 && !isMember
 </script>
 <nav>
   <div class="brand"><span class="dot"></span> ts-cloud</div>
@@ -28,6 +38,23 @@ const navEnv = __nav?.environment ?? ''
         <a href="/serverless">Serverless</a>
       @endif
     @endif
+    @if (isMember)
+      @if ((active ?? '') === 'sites')
+        <a href="/server/sites" class="active">Sites</a>
+      @else
+        <a href="/server/sites">Sites</a>
+      @endif
+      @if ((active ?? '') === 'deployments')
+        <a href="/server/deployments" class="active">Deployments</a>
+      @else
+        <a href="/server/deployments">Deployments</a>
+      @endif
+      @if ((active ?? '') === 'logs')
+        <a href="/server/logs" class="active">Logs</a>
+      @else
+        <a href="/server/logs">Logs</a>
+      @endif
+    @endif
     @if (showServer)
       @if ((active ?? '') === 'database')
         <a href="/server/database" class="active">Databases</a>
@@ -35,10 +62,17 @@ const navEnv = __nav?.environment ?? ''
         <a href="/server/database">Databases</a>
       @endif
     @endif
+    @if (!isMember)
+      @if ((active ?? '') === 'team')
+        <a href="/server/team" class="active">Team</a>
+      @else
+        <a href="/server/team">Team</a>
+      @endif
+    @endif
   </div>
   <div class="nav-meta">
     <span>{{ name ?? '' }}</span>
-    @if (navEnvs.length > 1)
+    @if (showEnvSwitch)
       <span class="env-switch" title="Switch environment">
         @foreach (navEnvs as e)
           @if (e === navEnv)
@@ -51,5 +85,8 @@ const navEnv = __nav?.environment ?? ''
     @else
       <span class="env">{{ navEnv || env || '' }}</span>
     @endif
+    <form method="post" action="/api/logout" class="signout">
+      <button type="submit">Sign out</button>
+    </form>
   </div>
 </nav>

package/dist/ui-src/pages/server/deployments.stx

@@ -4,6 +4,9 @@ import { renderDeploymentSparkline } from '../../src/charts.ts'
 let __d = null
 try { __d = JSON.parse(process.env.TSCLOUD_DASHBOARD_DATA || '') } catch { __d = null }
 const server = __d?.server ?? { name: 'acme-production-app' }
+// Members reach this page for their own sites; box-level CLI hints and the
+// server crumb are not theirs to act on.
+const isMember = (__d?.viewer?.role ?? 'admin') === 'member'
 const initialDeps = __d?.serverDeploymentsDetail ?? []
 const deploymentChart = renderDeploymentSparkline(initialDeps)
 const deploymentsEmptyReason = __d?.deploymentsEmptyReason ?? 'No deployment history has been recorded yet.'
@@ -49,12 +52,20 @@ async function runOp() {
 <html lang="en" data-theme="dark">
 <head>@include('../partials/head', { title: 'ts-cloud - Deployments' })</head>
 <body>
-  @include('../partials/nav', { active: 'server', name: server.name, env: 'production' })
+  @include('../partials/nav', { active: isMember ? 'deployments' : 'server', name: server.name, env: 'production' })
   <div class="wrap">
-    <div class="crumbs"><a href="/">Server</a> <span class="sep">/</span> Deployments</div>
+    @if (isMember)
+      <div class="crumbs">Deployments</div>
+    @else
+      <div class="crumbs"><a href="/">Server</a> <span class="sep">/</span> Deployments</div>
+    @endif
     <header class="page">
-      <div><h1>Deployments</h1><p>Server release history, newest first.</p></div>
-      <div class="cmds header-actions"><span class="accent cmd">cloud server:deploy {{ server.name }}</span></div>
+      @if (isMember)
+        <div><h1>Deployments</h1><p>Release history for your sites, newest first.</p></div>
+      @else
+        <div><h1>Deployments</h1><p>Server release history, newest first.</p></div>
+        <div class="cmds header-actions"><span class="accent cmd">cloud server:deploy {{ server.name }}</span></div>
+      @endif
     </header>
     <div class="section">
       <div class="panel">
@@ -98,7 +109,11 @@ async function runOp() {
         <div class="empty" @show="deps().length === 0"><strong>No deployments yet</strong><span>{{ deploymentsEmptyReason }}</span></div>
         <div class="compact empty" @show="deps().length > 0 && filtered().length === 0"><strong>No matches</strong><span>Try a different status or site filter.</span></div>
         @include('../partials/op-confirm')
-        <p class="note">Roll back a site to any prior release, or inspect a box with <span class="mono">cloud server:logs {{ server.name }}</span>.</p>
+        @if (isMember)
+          <p class="note">Roll back one of your sites to any prior release.</p>
+        @else
+          <p class="note">Roll back a site to any prior release, or inspect a box with <span class="mono">cloud server:logs {{ server.name }}</span>.</p>
+        @endif
       </div>
     </div>
   </div>

package/dist/ui-src/pages/server/firewall.stx

@@ -81,7 +81,7 @@ onMount(() => { load() })
         <div class="port-grid">
           <template :for="p in alwaysOpen()">
             <div class="port-card">
-              <div class="top"><span class="tag">tcp</span><span class="pill ok">reserved</span></div>
+              <div class="top"><span class="tag">tcp</span><span class="ok pill">reserved</span></div>
               <div class="listen mono">{{ p }}</div>
               <div class="proc">Always allowed by ts-cloud</div>
             </div>

package/dist/ui-src/pages/server/logs.stx

@@ -2,6 +2,9 @@
 let __d = null
 try { __d = JSON.parse(process.env.TSCLOUD_DASHBOARD_DATA || '') } catch { __d = null }
 const server = __d?.server ?? { name: 'stacks-production-app' }
+// Members see only their own sites' units; box-level CLI hints and the server
+// crumb are not theirs to act on.
+const isMember = (__d?.viewer?.role ?? 'admin') === 'member'
 const initialLogs = __d?.serverLogs ?? []
 const emptyReason = __d?.serverLogsEmptyReason ?? 'No server logs are available yet.'
 </script>
@@ -30,15 +33,26 @@ onMount(() => { refresh(); const id = setInterval(refresh, 8000); return () => c
 <html lang="en" data-theme="dark">
 <head>@include('../partials/head', { title: 'ts-cloud - Server logs' })</head>
 <body>
-  @include('../partials/nav', { active: 'server', name: server.name, env: 'production' })
+  @include('../partials/nav', { active: isMember ? 'logs' : 'server', name: server.name, env: 'production' })
   <div class="wrap">
-    <div class="crumbs"><a href="/">Server</a> <span class="sep">/</span> Logs</div>
+    @if (isMember)
+      <div class="crumbs">Logs</div>
+    @else
+      <div class="crumbs"><a href="/">Server</a> <span class="sep">/</span> Logs</div>
+    @endif
     <header class="page">
-      <div>
-        <h1>Logs</h1>
-        <p>Live journal entries from every managed service on {{ server.name }}.</p>
-      </div>
-      <div class="cmds header-actions"><span class="accent cmd">cloud server:logs {{ server.name }}</span></div>
+      @if (isMember)
+        <div>
+          <h1>Logs</h1>
+          <p>Live journal entries from your sites and their queue workers.</p>
+        </div>
+      @else
+        <div>
+          <h1>Logs</h1>
+          <p>Live journal entries from every managed service on {{ server.name }}.</p>
+        </div>
+        <div class="cmds header-actions"><span class="accent cmd">cloud server:logs {{ server.name }}</span></div>
+      @endif
     </header>
 
     <div class="section">
@@ -76,7 +90,11 @@ onMount(() => { refresh(); const id = setInterval(refresh, 8000); return () => c
         <div class="compact empty" @show="logs().length > 0 && filtered().length === 0"><strong>No matching logs</strong><span>Try a different level or source filter.</span></div>
         <div class="empty" @show="logs().length === 0"><strong>No logs available</strong><span>{{ emptyReason }}</span></div>
 
-        <p class="note">Live <span class="mono">journalctl</span> for the web server, every managed service, and each app's service, <b>queue workers</b>, and daemons - plus the backup runner. Auto-refreshes every 8s.</p>
+        @if (isMember)
+          <p class="note">Live <span class="mono">journalctl</span> for your sites' services, <b>queue workers</b> and daemons. Auto-refreshes every 8s.</p>
+        @else
+          <p class="note">Live <span class="mono">journalctl</span> for the web server, every managed service, and each app's service, <b>queue workers</b>, and daemons - plus the backup runner. Auto-refreshes every 8s.</p>
+        @endif
       </div>
     </div>
   </div>

package/dist/ui-src/pages/server/sites.stx

@@ -2,6 +2,10 @@
 let __d = null
 try { __d = JSON.parse(process.env.TSCLOUD_DASHBOARD_DATA || '') } catch { __d = null }
 const server = __d?.server ?? { name: 'stacks-production-app' }
+// A member (a collaborator invited to specific sites) has no box-level access,
+// so the box-owner affordances - adding and removing sites - are not offered.
+// Presentation only: the server enforces this regardless of what is rendered.
+const isMember = (__d?.viewer?.role ?? 'admin') === 'member'
 const sites = __d?.sitesDetail ?? [
   { name: 'main', route: 'stacksjs.com', href: 'https://stacksjs.com', kind: 'stacks', runtime: 'bun', tls: 'https', deploy: 'service', root: '/var/www/main/current', branch: 'main', status: 'live' },
   { name: 'api', route: 'internal', kind: 'api', runtime: 'bun', tls: 'loopback', deploy: 'service', root: '/var/www/api/current', branch: 'main', status: 'live' },
@@ -75,29 +79,45 @@ async function saveEdit(name) {
 <html lang="en" data-theme="dark">
 <head>@include('../partials/head', { title: 'ts-cloud - Sites' })</head>
 <body>
-  @include('../partials/nav', { active: 'server', name: server.name, env: 'production' })
+  @include('../partials/nav', { active: isMember ? 'sites' : 'server', name: server.name, env: 'production' })
   <div class="wrap">
-    <div class="crumbs"><a href="/">Server</a> <span class="sep">/</span> Sites</div>
+    @if (isMember)
+      <div class="crumbs">Sites</div>
+    @else
+      <div class="crumbs"><a href="/">Server</a> <span class="sep">/</span> Sites</div>
+    @endif
     <header class="page">
-      <div><h1>Sites</h1><p>Server routes served from the box, each deployed as an atomic release.</p></div>
-      <div class="cmds header-actions"><span class="accent cmd">cloud site:add &lt;name&gt;</span></div>
+      @if (isMember)
+        <div><h1>Sites</h1><p>The sites you have been given access to.</p></div>
+      @else
+        <div><h1>Sites</h1><p>Server routes served from the box, each deployed as an atomic release.</p></div>
+        <div class="cmds header-actions"><span class="accent cmd">cloud site:add &lt;name&gt;</span></div>
+      @endif
     </header>
-    <div class="section">
-      <h2>Add site</h2>
-      <div class="panel">
-        <form class="form-grid" @submit.prevent="addSite()">
-          <div class="field-block"><label>Name</label><input placeholder="docs" :value="addName()" @input="addName.set($event.target.value)"></div>
-          <div class="field-block"><label>Root</label><input placeholder="dist/docs" :value="addRoot()" @input="addRoot.set($event.target.value)"></div>
-          <div class="field-block"><label>Domain</label><input placeholder="example.com" :value="addDomain()" @input="addDomain.set($event.target.value)"></div>
-          <div class="field-block"><label>Path</label><input placeholder="/docs" :value="addPath()" @input="addPath.set($event.target.value)"></div>
-          <div class="field-block"><label>Deploy</label><input :value="addDeploy()" @input="addDeploy.set($event.target.value)"></div>
-          <div class="field-block"><label>Port</label><input placeholder="3000" :value="addPort()" @input="addPort.set($event.target.value)"></div>
-          <div class="field-block wide"><label>Build command</label><input placeholder="bun run build" :value="addBuild()" @input="addBuild.set($event.target.value)"></div>
-          <div class="field-block wide"><label>Start command</label><input placeholder="bun run start" :value="addStart()" @input="addStart.set($event.target.value)"></div>
-          <div class="form-actions"><button class="btn" type="submit">Add site</button><span class="msg" :class="addMsgKind()">{{ addMsg() }}</span></div>
-        </form>
+    @if (!isMember)
+      <div class="section">
+        <h2>Add site</h2>
+        <div class="panel">
+          <form class="form-grid" @submit.prevent="addSite()">
+            <div class="field-block"><label>Name</label><input placeholder="docs" :value="addName()" @input="addName.set($event.target.value)"></div>
+            <div class="field-block"><label>Root</label><input placeholder="dist/docs" :value="addRoot()" @input="addRoot.set($event.target.value)"></div>
+            <div class="field-block"><label>Domain</label><input placeholder="example.com" :value="addDomain()" @input="addDomain.set($event.target.value)"></div>
+            <div class="field-block"><label>Path</label><input placeholder="/docs" :value="addPath()" @input="addPath.set($event.target.value)"></div>
+            <div class="field-block"><label>Deploy</label><input :value="addDeploy()" @input="addDeploy.set($event.target.value)"></div>
+            <div class="field-block"><label>Port</label><input placeholder="3000" :value="addPort()" @input="addPort.set($event.target.value)"></div>
+            <div class="field-block wide"><label>Build command</label><input placeholder="bun run build" :value="addBuild()" @input="addBuild.set($event.target.value)"></div>
+            <div class="field-block wide"><label>Start command</label><input placeholder="bun run start" :value="addStart()" @input="addStart.set($event.target.value)"></div>
+            <div class="form-actions"><button class="btn" type="submit">Add site</button><span class="msg" :class="addMsgKind()">{{ addMsg() }}</span></div>
+          </form>
+        </div>
+      </div>
+    @endif
+    @if (isMember && sites.length === 0)
+      <div class="empty">
+        <strong>No sites yet</strong>
+        <span>You have not been given access to a site on this server. Ask the server owner to invite you to one.</span>
       </div>
-    </div>
+    @endif
     @foreach (sites as site)
       <div class="section">
         <h2>{{ site.name }} <span class="more"><span class="pill {{ tone(site.status) }}">{{ site.status }}</span></span></h2>
@@ -129,7 +149,9 @@ async function saveEdit(name) {
         <div class="row-actions" style="margin-top:12px;">
           <button class="btn sm" type="button" @click="askDeploy('{{ site.name }}')">Deploy</button>
           <button class="btn ghost sm" type="button" @click="toggleEdit('{{ site.name }}')">Edit</button>
-          <button class="btn danger sm" type="button" @click="askRemove('{{ site.name }}')">Remove</button>
+          @if (!isMember)
+            <button class="btn danger sm" type="button" @click="askRemove('{{ site.name }}')">Remove</button>
+          @endif
         </div>
         <form class="form-grid" style="margin-top:14px;" @show="editing() === '{{ site.name }}'" @submit.prevent="saveEdit('{{ site.name }}')">
           <div class="field-block">

package/dist/ui-src/pages/server/team.stx

@@ -0,0 +1,171 @@
+<script server>
+let __d = null
+try { __d = JSON.parse(process.env.TSCLOUD_DASHBOARD_DATA || '') } catch { __d = null }
+const server = __d?.server ?? { name: 'acme-production-app' }
+// Only the box owner reaches this page (the server refuses /api/users for
+// anyone else), so the site list here is always the full one.
+const siteNames = (__d?.sitesDetail ?? __d?.sites ?? [{ name: 'main' }, { name: 'docs' }]).map(s => s.name)
+</script>
+<script client>
+// Collaborator management: list, invite, revoke. A member holds a role per site
+// - 'owner' may also change that site's settings, 'collaborator' may view and
+// deploy it. Neither ever reaches the box itself (shell, SSH keys, firewall,
+// databases): those are the box owner's alone, because each of them is root on
+// a server that hosts other people's sites.
+const users = state([])
+const sites = state(siteNames)
+const username = state('')
+const displayName = state('')
+const grants = state({})
+const message = state('')
+const messageKind = state('')
+// Shown once after an invite - the password is generated server-side, hashed,
+// and never retrievable again.
+const issued = state(null)
+
+function setMessage(text, kind) { message.set(text); messageKind.set(kind || '') }
+function grantFor(site) { return grants()[site] || 'none' }
+function setGrant(site, role) {
+  const next = { ...grants() }
+  if (role === 'none') delete next[site]
+  else next[site] = role
+  grants.set(next)
+}
+function siteList(user) {
+  const entries = Object.entries(user.sites || {})
+  if (!entries.length) return '-'
+  return entries.map(([s, r]) => s + ' (' + r + ')').join(', ')
+}
+
+async function load() {
+  try {
+    const res = await fetch('/api/users')
+    if (!res.ok) throw new Error('Could not read the team.')
+    const data = await res.json()
+    users.set(data.users || [])
+  } catch (e) { setMessage((e && e.message) || 'Could not read the team.', 'bad') }
+}
+
+async function invite() {
+  setMessage('Saving...', ''); issued.set(null)
+  const payload = { username: username(), name: displayName(), sites: grants() }
+  const res = await fetch('/api/users', { method: 'POST', headers: { 'content-type': 'application/json' }, body: JSON.stringify(payload) })
+  const data = await res.json().catch(() => ({}))
+  if (!res.ok || data.ok === false) { setMessage(data.error || 'Could not save.', 'bad'); return }
+  if (data.password) issued.set({ username: data.user.username, password: data.password })
+  setMessage(data.password ? 'Invited ' + data.user.username + '.' : 'Updated ' + data.user.username + '.', 'ok')
+  username.set(''); displayName.set(''); grants.set({})
+  load()
+}
+
+async function revoke(name) {
+  setMessage('Removing...', '')
+  const res = await fetch('/api/users', { method: 'DELETE', headers: { 'content-type': 'application/json' }, body: JSON.stringify({ username: name }) })
+  const data = await res.json().catch(() => ({}))
+  if (!res.ok || data.ok === false) { setMessage(data.error || 'Could not remove.', 'bad'); return }
+  setMessage('Removed ' + name + '.', 'ok')
+  load()
+}
+
+onMount(() => { load() })
+</script>
+<!DOCTYPE html>
+<html lang="en" data-theme="dark">
+<head>@include('../partials/head', { title: 'ts-cloud - Team' })</head>
+<body>
+  @include('../partials/nav', { active: 'team', name: server.name, env: 'production' })
+  <div class="wrap">
+    <div class="crumbs"><a href="/">Server</a> <span class="sep">/</span> Team</div>
+    <header class="page">
+      <div>
+        <h1>Team</h1>
+        <p>Invite people to individual sites. They see only the sites you grant them, and never the box.</p>
+      </div>
+    </header>
+
+    <div class="section">
+      <h2>Invite</h2>
+      <div class="panel">
+        <form class="form-grid" @submit.prevent="invite()">
+          <div class="field-block">
+            <label for="team-username">Username</label>
+            <input id="team-username" autocomplete="off" placeholder="dana" :value="username()" @input="username.set($event.target.value)" required>
+          </div>
+          <div class="field-block">
+            <label for="team-name">Display name</label>
+            <input id="team-name" autocomplete="off" placeholder="Dana Whitfield" :value="displayName()" @input="displayName.set($event.target.value)">
+          </div>
+          <div class="field-block wide">
+            <label>Site access</label>
+            <div class="grant-grid">
+              <template :for="s in sites()">
+                <div class="grant">
+                  <span class="mono">{{ s }}</span>
+                  <select :value="grantFor(s)" @change="setGrant(s, $event.target.value)">
+                    <option value="none">No access</option>
+                    <option value="collaborator">Collaborator - view and deploy</option>
+                    <option value="owner">Owner - view, deploy and edit settings</option>
+                  </select>
+                </div>
+              </template>
+            </div>
+          </div>
+          <div class="form-actions">
+            <button class="btn" type="submit">Send invite</button>
+            <span class="msg" :class="messageKind()" role="status">{{ message() }}</span>
+          </div>
+        </form>
+
+        <div class="issued" @show="!!issued()">
+          <strong>Password for {{ issued()?.username }}</strong>
+          <code>{{ issued()?.password }}</code>
+          <span>Copy it now and send it over a channel you trust. It is stored hashed and cannot be shown again.</span>
+        </div>
+      </div>
+    </div>
+
+    <div class="section">
+      <h2>People</h2>
+      <div class="panel">
+        <table>
+          <thead><tr><th>User</th><th>Role</th><th>Sites</th><th></th></tr></thead>
+          <tbody>
+            <template :for="u in users()">
+              <tr>
+                <td><b>{{ u.name }}</b><span class="mono uname">{{ u.username }}</span></td>
+                <td><span class="tag">{{ u.role === 'admin' ? 'box owner' : 'member' }}</span></td>
+                <td class="mono">{{ u.role === 'admin' ? 'every site' : siteList(u) }}</td>
+                <td class="table-actions"><button type="button" class="btn danger sm" @click="revoke(u.username)">Remove</button></td>
+              </tr>
+            </template>
+          </tbody>
+        </table>
+        <div class="compact empty" @show="users().length === 0"><strong>No one invited yet</strong><span>Invite someone above to give them access to a site.</span></div>
+        <p class="note">Box owners reach everything on this server. Members reach only the sites listed here, and never the shell, SSH keys, firewall or databases. Access is checked on every request.</p>
+      </div>
+    </div>
+  </div>
+  <style>
+    .grant-grid { display: grid; gap: 10px; }
+    .grant { display: grid; grid-template-columns: minmax(120px, 0.4fr) 1fr; gap: 12px; align-items: center; }
+    .grant > span { color: var(--txt2); font-size: 13px; }
+    .grant select {
+      width: 100%; background: rgba(255,255,255,0.05); border: 1px solid var(--panel-br); border-radius: 10px;
+      padding: 9px 12px; color: var(--txt); font-family: inherit; font-size: 13.5px;
+    }
+    .grant select:focus { outline: none; border-color: var(--accent); box-shadow: 0 0 0 3px rgba(90,139,224,0.12); }
+    .issued {
+      display: grid; gap: 7px; margin-top: 16px; padding: 14px 16px;
+      border: 1px solid rgba(53,209,155,0.28); background: var(--okbg); border-radius: 12px;
+    }
+    .uname { margin-left: 8px; color: var(--txt3); }
+    .issued strong { font-size: 13px; color: var(--ok); }
+    .issued code {
+      font-family: var(--mono); font-size: 14px; color: var(--txt); user-select: all;
+      background: rgba(0,0,0,0.25); border-radius: 8px; padding: 8px 10px; overflow-wrap: anywhere;
+    }
+    .issued span { color: var(--txt2); font-size: 12px; line-height: 1.5; }
+    @media (max-width: 640px) { .grant { grid-template-columns: 1fr; gap: 6px; } }
+  </style>
+</body>
+</html>

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@stacksjs/ts-cloud",
   "type": "module",
-  "version": "0.7.18",
+  "version": "0.7.20",
   "description": "A lightweight, performant infrastructure-as-code library and CLI for deploying both server-based (EC2) and serverless applications.",
   "author": "Chris Breuer <chris@stacksjs.com>",
   "license": "MIT",
@@ -89,8 +89,8 @@
     "test": "bun test"
   },
   "dependencies": {
-    "@ts-cloud/aws-types": "0.7.18",
-    "@ts-cloud/core": "0.7.18",
+    "@ts-cloud/aws-types": "0.7.20",
+    "@ts-cloud/core": "0.7.20",
     "@stacksjs/ts-xml": "^0.1.0"
   },
   "devDependencies": {