@stacksjs/ts-cloud 0.7.56 → 0.7.58

package/dist/cost/resource-optimization.d.ts

@@ -0,0 +1,59 @@
+import type { CloudResource, ResourceInventoryResult } from './resource-inventory';
+export interface ResourceSignals {
+    cpuAverage?: number;
+    connectionsAverage?: number;
+    iopsAverage?: number;
+    invocations?: number;
+    objectCount?: number;
+    requests?: number;
+    storageBytes?: number;
+    cacheHitRate?: number;
+}
+export interface IdleResourceFinding {
+    resource: CloudResource;
+    signal: string;
+    recommendation: string;
+    monthlySavings: number | null;
+}
+export type OptimizationCategory = 'unused' | 'right-size' | 'commitment' | 'storage' | 'cdn';
+export interface OptimizationRecommendation {
+    category: OptimizationCategory;
+    resource: CloudResource;
+    recommendation: string;
+    sourceSignal: string;
+    currentCost: number | null;
+    projectedCost: number | null;
+    monthlySavings: number | null;
+}
+export interface OptimizationResult {
+    recommendations: OptimizationRecommendation[];
+    inventory: ResourceInventoryResult;
+    savingsAvailable: boolean;
+    warnings: string[];
+}
+export declare function resourceOptimizationRecommendations(resource: CloudResource, signals: ResourceSignals, currentCost: number | null, includeCommitments?: boolean): OptimizationRecommendation[];
+export declare function cloudFrontOptimizationRecommendation(monthlyTransferCost: number, usageTypes: string[]): OptimizationRecommendation | null;
+export declare function evaluateIdleResource(resource: CloudResource, signals: ResourceSignals, monthlySavings?: number | null): IdleResourceFinding | null;
+export declare class ResourceOptimizationService {
+    private inventory;
+    private costs;
+    private profile?;
+    private region;
+    constructor(profile?: string, region?: string);
+    private metric;
+    private signals;
+    private resourceCosts;
+    private resourceCost;
+    private cloudFrontTransfer;
+    unused(options?: {
+        type?: string;
+    }): Promise<{
+        findings: IdleResourceFinding[];
+        inventory: ResourceInventoryResult;
+        savingsAvailable: boolean;
+    }>;
+    optimize(options?: {
+        type?: string;
+        includeCommitments?: boolean;
+    }): Promise<OptimizationResult>;
+}

package/dist/cost/resource-optimization.test.d.ts

@@ -0,0 +1 @@
+export {};

package/dist/data-services/adapters.d.ts

@@ -0,0 +1,39 @@
+import type { JsonValue } from '../control-plane';
+import type { QueueExecutionContext } from '../queue';
+import type { DataAction, DataService } from './model';
+import type { DataServiceAdapter } from './service';
+export interface DataProviderTransport {
+    observe(id: string): Promise<Record<string, JsonValue>>;
+    apply(input: Record<string, JsonValue>, credential?: string): Promise<Record<string, JsonValue>>;
+    execute(id: string, action: DataAction, input: Record<string, JsonValue>, credential?: string, context?: QueueExecutionContext): Promise<Record<string, JsonValue>>;
+}
+declare abstract class TransportAdapter implements DataServiceAdapter {
+    protected transport: DataProviderTransport;
+    abstract provider: DataService['provider'];
+    abstract engines: DataService['engine'][];
+    constructor(transport: DataProviderTransport);
+    observe(service: DataService): Promise<Record<string, JsonValue>>;
+    apply(service: DataService, credential?: string): Promise<Record<string, JsonValue>>;
+    action(service: DataService, action: DataAction, input: Record<string, JsonValue>, credential: string | undefined, context: QueueExecutionContext): Promise<Record<string, JsonValue>>;
+}
+export declare class AwsRdsDataAdapter extends TransportAdapter {
+    provider: 'aws_rds';
+    engines: DataService['engine'][];
+}
+export declare class AwsAuroraDataAdapter extends TransportAdapter {
+    provider: 'aws_aurora';
+    engines: DataService['engine'][];
+}
+export declare class AwsElastiCacheDataAdapter extends TransportAdapter {
+    provider: 'aws_elasticache';
+    engines: DataService['engine'][];
+}
+export declare class ServerDataAdapter extends TransportAdapter {
+    provider: 'server';
+    engines: DataService['engine'][];
+}
+export declare class ContainerDataAdapter extends TransportAdapter {
+    provider: 'container';
+    engines: DataService['engine'][];
+}
+export {};

package/dist/data-services/aws-transports.d.ts

@@ -0,0 +1,29 @@
+import type { JsonValue } from '../control-plane';
+import type { QueueExecutionContext } from '../queue';
+import type { DataProviderTransport } from './adapters';
+import type { DataAction } from './model';
+import { ElastiCacheClient } from '../aws/elasticache';
+import { RDSClient } from '../aws/rds';
+type Input = Record<string, JsonValue>;
+export declare class AwsRdsTransport implements DataProviderTransport {
+    private readonly client;
+    constructor(client?: RDSClient);
+    observe(id: string): Promise<Input>;
+    apply(input: Input, credential?: string): Promise<Input>;
+    execute(id: string, action: DataAction, input: Input, credential?: string, _context?: QueueExecutionContext): Promise<Input>;
+}
+export declare class AwsAuroraTransport implements DataProviderTransport {
+    private readonly client;
+    constructor(client?: RDSClient);
+    observe(id: string): Promise<Input>;
+    apply(input: Input, credential?: string): Promise<Input>;
+    execute(id: string, action: DataAction, input: Input, credential?: string): Promise<Input>;
+}
+export declare class AwsElastiCacheTransport implements DataProviderTransport {
+    private readonly client;
+    constructor(client?: ElastiCacheClient);
+    observe(id: string): Promise<Input>;
+    apply(input: Input): Promise<Input>;
+    execute(id: string, action: DataAction, input: Input): Promise<Input>;
+}
+export {};

package/dist/data-services/aws-transports.test.d.ts

@@ -0,0 +1 @@
+export {};

package/dist/data-services/capabilities.d.ts

@@ -0,0 +1,2 @@
+import type { DataEngine, DataProvider, DataServiceCapabilities } from './model';
+export declare function dataServiceCapabilities(engine: DataEngine, provider: DataProvider): DataServiceCapabilities;

package/dist/data-services/data-services.test.d.ts

@@ -0,0 +1 @@
+export {};

package/dist/data-services/docker-transport.d.ts

@@ -0,0 +1,55 @@
+import type { JsonValue } from '../control-plane';
+import type { DataProviderTransport } from './adapters';
+import type { DataAction } from './model';
+type Input = Record<string, JsonValue>;
+export interface DockerRuntime {
+    ensureNetwork(name: string): Promise<void>;
+    seedSecret(volume: string, content: string): Promise<void>;
+    removeVolume(name: string): Promise<void>;
+    inspect(name: string): Promise<Record<string, any> | undefined>;
+    run(args: string[]): Promise<void>;
+    exec(name: string, args: string[], stdin?: string): Promise<string>;
+    update(name: string, args: string[]): Promise<void>;
+    restart(name: string): Promise<void>;
+    remove(name: string): Promise<void>;
+    logs(name: string, lines: number): Promise<string>;
+    stats(name: string): Promise<Record<string, JsonValue>>;
+}
+export declare class BunDockerRuntime implements DockerRuntime {
+    ensureNetwork(name: string): Promise<void>;
+    seedSecret(volume: string, content: string): Promise<void>;
+    removeVolume(name: string): Promise<void>;
+    inspect(name: string): Promise<Record<string, any> | undefined>;
+    run(args: string[]): Promise<void>;
+    exec(name: string, args: string[], stdin?: string): Promise<string>;
+    update(name: string, args: string[]): Promise<void>;
+    restart(name: string): Promise<void>;
+    remove(name: string): Promise<void>;
+    logs(name: string, lines: number): Promise<string>;
+    stats(name: string): Promise<Record<string, JsonValue>>;
+}
+export declare class DockerDataTransport implements DataProviderTransport {
+    private readonly runtime;
+    private readonly backupRoot;
+    constructor(runtime?: DockerRuntime, backupRoot?: string);
+    observe(id: string): Promise<Input>;
+    apply(input: Input, credential?: string): Promise<Input>;
+    exportLogicalBackup(id: string): Promise<{
+        body: Uint8Array;
+        engine: 'postgres' | 'mysql' | 'mariadb';
+        database: string;
+        username: string;
+        engineVersion?: string;
+    }>;
+    restoreLogicalBackup(input: {
+        sourceId: string;
+        targetId: string;
+        body: Uint8Array;
+        credential: string;
+        inPlace?: boolean;
+    }): Promise<Input>;
+    removeRestoredService(id: string): Promise<void>;
+    private backup;
+    execute(id: string, action: DataAction, input: Input, credential?: string): Promise<Input>;
+}
+export {};

package/dist/data-services/docker-transport.test.d.ts

@@ -0,0 +1 @@
+export {};

package/dist/data-services/index.d.ts

@@ -0,0 +1,8 @@
+export * from './model';
+export * from './capabilities';
+export * from './store';
+export * from './service';
+export * from './adapters';
+export * from './aws-transports';
+export * from './docker-transport';
+export * from './secrets';

package/dist/data-services/model.d.ts

@@ -0,0 +1,79 @@
+import type { JsonValue } from '../control-plane';
+export type DataEngine = 'postgres' | 'mysql' | 'mariadb' | 'redis' | 'mongodb' | 'libsql';
+export type DataProvider = 'aws_rds' | 'aws_aurora' | 'aws_elasticache' | 'server' | 'container' | 'external';
+export type DataAction = 'create' | 'observe' | 'connect' | 'backup' | 'restore' | 'restart' | 'resize' | 'version' | 'rotate' | 'expose' | 'delete' | 'logs' | 'slow_queries' | 'users' | 'databases';
+export interface DataActionCapability {
+    supported: boolean;
+    downtime: 'none' | 'possible' | 'required';
+    destructive: boolean;
+    explanation: string;
+}
+export interface DataServiceCapabilities {
+    actions: Record<DataAction, DataActionCapability>;
+    endpointTypes: Array<'internal' | 'external' | 'tunnel'>;
+    metrics: string[];
+}
+export interface DataEndpoint {
+    type: 'internal' | 'external' | 'tunnel';
+    host: string;
+    port: number;
+    database?: string;
+    tls: boolean;
+}
+export interface DataService {
+    id: string;
+    organizationId: string;
+    projectId: string;
+    environmentId?: string;
+    resourceId?: string;
+    name: string;
+    engine: DataEngine;
+    provider: DataProvider;
+    placement: string;
+    engineVersion?: string;
+    plan: string;
+    storageGb?: number;
+    highAvailability: boolean;
+    publicExposure: boolean;
+    allowedCidrs: string[];
+    desiredState: Record<string, JsonValue>;
+    observedState: Record<string, JsonValue>;
+    capabilities: DataServiceCapabilities;
+    credentialRef?: string;
+    status: 'draft' | 'planning' | 'provisioning' | 'available' | 'modifying' | 'degraded' | 'failed' | 'deleting' | 'retained' | 'adopted';
+    origin: 'managed' | 'config' | 'adopted';
+    managementEnabled: boolean;
+    ownerActorId?: string;
+    version: number;
+    createdAt: string;
+    updatedAt: string;
+}
+export interface DataCredential {
+    id: string;
+    serviceId: string;
+    username: string;
+    secretRef: string;
+    version: number;
+    createdAt: string;
+    rotatedAt?: string;
+}
+export interface DataDependency {
+    serviceId: string;
+    resourceId: string;
+    secretRef: string;
+    requiresRedeploy: boolean;
+    createdAt: string;
+}
+export interface DataServicePlan {
+    service: DataService;
+    action: DataAction;
+    capability: DataActionCapability;
+    changes: Record<string, JsonValue>;
+    preflight: {
+        backupRequired: boolean;
+        compatibilityRequired: boolean;
+        typedConfirmation?: string;
+        retentionChoiceRequired: boolean;
+    };
+    warnings: string[];
+}

package/dist/data-services/secrets.d.ts

@@ -0,0 +1,13 @@
+import type { ControlPlaneStore } from '../control-plane';
+import type { SecretBackend } from './service';
+export declare class EncryptedDataSecretStore implements SecretBackend {
+    private readonly controlPlane;
+    private readonly now;
+    private readonly key;
+    constructor(controlPlane: ControlPlaneStore, encryptionKey: string, now?: () => Date);
+    private encrypt;
+    private decrypt;
+    put(reference: string, value: string): Promise<void>;
+    resolve(reference: string): Promise<string>;
+    remove(reference: string): Promise<void>;
+}

package/dist/data-services/secrets.test.d.ts

@@ -0,0 +1 @@
+export {};

package/dist/data-services/service.d.ts

@@ -0,0 +1,51 @@
+import type { JsonValue } from '../control-plane';
+import type { QueueExecutionContext, QueueOperationHandler } from '../queue';
+import type { DataAction, DataEndpoint, DataService, DataServicePlan } from './model';
+import { DurableOperationQueue } from '../queue';
+import { DataServiceStore } from './store';
+export interface SecretBackend {
+    put(reference: string, value: string): Promise<void>;
+    resolve(reference: string): Promise<string>;
+    remove(reference: string): Promise<void>;
+}
+export interface DataServiceAdapter {
+    provider: DataService['provider'];
+    engines: DataService['engine'][];
+    observe(service: DataService): Promise<Record<string, JsonValue>>;
+    apply(service: DataService, credential?: string, context?: QueueExecutionContext): Promise<Record<string, JsonValue>>;
+    action(service: DataService, action: DataAction, input: Record<string, JsonValue>, credential: string | undefined, context: QueueExecutionContext): Promise<Record<string, JsonValue>>;
+}
+export interface OneTimeCredential {
+    username: string;
+    password: string;
+    secretRef: string;
+}
+export declare function connectionGuidance(service: DataService, endpoints: DataEndpoint[]): Array<{
+    type: string;
+    command: string;
+    secretRef?: string;
+}>;
+export declare class DataServiceLifecycle {
+    readonly store: DataServiceStore;
+    readonly queue: DurableOperationQueue;
+    readonly secrets: SecretBackend;
+    constructor(store: DataServiceStore, queue: DurableOperationQueue, secrets: SecretBackend);
+    create(input: Omit<DataService, 'id' | 'capabilities' | 'credentialRef' | 'version' | 'createdAt' | 'updatedAt' | 'status'> & {
+        username?: string;
+    }): Promise<{
+        service: DataService;
+        credential?: OneTimeCredential;
+        operationId: string;
+    }>;
+    plan(service: DataService, action: DataAction, changes?: Record<string, JsonValue>): DataServicePlan;
+    enqueue(service: DataService, action: DataAction, input: Record<string, JsonValue>, actorId?: string): string;
+    rotate(service: DataService, adapter: DataServiceAdapter, context: QueueExecutionContext): Promise<{
+        credential: OneTimeCredential;
+        dependencies: string[];
+    }>;
+}
+export declare function createDataServiceQueueHandlers(input: {
+    store: DataServiceStore;
+    secrets: SecretBackend;
+    resolveAdapter: (service: DataService) => DataServiceAdapter | undefined;
+}): Record<string, QueueOperationHandler>;

package/dist/data-services/store.d.ts

@@ -0,0 +1,17 @@
+import type { ControlPlaneStore } from '../control-plane';
+import type { DataCredential, DataDependency, DataService } from './model';
+export declare class DataServiceStore {
+    readonly controlPlane: ControlPlaneStore;
+    private readonly now;
+    constructor(controlPlane: ControlPlaneStore, now?: () => Date);
+    create(input: Omit<DataService, 'id' | 'capabilities' | 'version' | 'createdAt' | 'updatedAt'>): DataService;
+    get(id: string): DataService | undefined;
+    list(projectId: string, environmentId?: string): DataService[];
+    update(id: string, expectedVersion: number, patch: Partial<Pick<DataService, 'plan' | 'storageGb' | 'engineVersion' | 'highAvailability' | 'publicExposure' | 'allowedCidrs' | 'desiredState' | 'observedState' | 'status' | 'managementEnabled' | 'credentialRef'>>): DataService;
+    credential(serviceId: string): DataCredential | undefined;
+    saveCredential(serviceId: string, username: string, secretRef: string): DataCredential;
+    addDependency(input: Omit<DataDependency, 'createdAt'>): DataDependency;
+    dependencies(serviceId: string): DataDependency[];
+    removeDependency(serviceId: string, resourceId: string): boolean;
+    remove(id: string): void;
+}

package/dist/deploy/container-image.d.ts

@@ -0,0 +1,28 @@
+import { ECRClient } from '../aws/ecr';
+export interface BuildContainerImageOptions {
+    context: string;
+    dockerfile?: string;
+    repository: string;
+    region?: string;
+    profile?: string;
+    platform?: 'linux/amd64' | 'linux/arm64';
+}
+export interface BuiltContainerImage {
+    repository: string;
+    tag: string;
+    imageUri: string;
+    digest: string;
+    digestUri: string;
+    contextSha256: string;
+}
+export interface ContainerImageDependencies {
+    ecr: Pick<ECRClient, 'describeRepositories' | 'createRepository' | 'putLifecyclePolicy' | 'getAuthorizationToken' | 'describeImages'>;
+    run: (command: string, args: string[], options?: {
+        cwd?: string;
+        env?: NodeJS.ProcessEnv;
+        stdio?: 'ignore' | 'inherit';
+    }) => void;
+}
+export declare function hashContainerContext(context: string): string;
+export declare function createContainerImageDependencies(options: Pick<BuildContainerImageOptions, 'region' | 'profile'>): ContainerImageDependencies;
+export declare function buildAndPushContainerImage(options: BuildContainerImageOptions, injected?: ContainerImageDependencies): Promise<BuiltContainerImage>;

package/dist/deploy/container-image.test.d.ts

@@ -0,0 +1 @@
+export {};

package/dist/deploy/dashboard-audit.test.d.ts

@@ -0,0 +1 @@
+export {};

package/dist/deploy/dashboard-auth.d.ts

@@ -1,26 +1,3 @@
-/**
- * Identity and authorization for the management dashboard.
- *
- * The dashboard hosts sites for more than one party: Stacks owns the box, and
- * collaborators are invited to individual sites. That makes authorization a
- * security boundary rather than a convenience — a site collaborator must never
- * reach another tenant's data, and must never reach the box itself.
- *
- * The model has two levels:
- * - Box role: `admin` (owns the box — everything) or `member` (only what they
- *   have been granted).
- * - Site grants: a member holds a {@link SiteRole} per site. `owner` may change
- *   the site's settings; `collaborator` may view and deploy it.
- *
- * Box-level capabilities (shell, terminal, SSH keys, firewall, databases,
- * cloud-config edits) are **admin-only and never grantable per site**. Each of
- * them yields root on the box, which would hand a single site's collaborator
- * control of every other tenant's site. There is deliberately no grant that
- * unlocks them for a member.
- *
- * Authorization is deny-by-default: {@link authorize} answers `false` for any
- * capability it does not explicitly recognize.
- */
 /** Box-wide role. `admin` owns the server and everything hosted on it. */
 export type BoxRole = 'admin' | 'member';
 /**
@@ -37,6 +14,8 @@ export interface DashboardUser {
     sites: Record<string, SiteRole>;
     /** Display name shown in the UI. Defaults to the username. */
     name?: string;
+    /** Verified once an emailed invitation or verification link is consumed. */
+    email?: string;
     createdAt?: string;
 }
 /**
@@ -78,5 +57,7 @@ export declare function hashPassword(password: string): string;
  * the login, not crash the server.
  */
 export declare function verifyPassword(password: string, stored: string): boolean;
+/** Whether a valid legacy hash should be transparently upgraded after login. */
+export declare function passwordNeedsRehash(stored: string): boolean;
 /** A URL-safe generated password, for invites and the bootstrap admin. */
 export declare function generatePassword(): string;

package/dist/deploy/dashboard-backups.integration.test.d.ts

@@ -0,0 +1 @@
+export {};

package/dist/deploy/dashboard-configuration.integration.test.d.ts

@@ -0,0 +1 @@
+export {};

package/dist/deploy/dashboard-control-plane.d.ts

@@ -0,0 +1,37 @@
+import type { CloudConfig, EnvironmentType } from '@ts-cloud/core';
+import type { ControlPlaneActor, ControlPlaneEnvironment, ControlPlaneOperation, ControlPlaneOrganization, ControlPlaneProject, JsonValue } from '../control-plane';
+import type { DashboardUser } from './dashboard-auth';
+import { ControlPlaneStore } from '../control-plane';
+export interface DashboardControlPlane {
+    store: ControlPlaneStore;
+    organization: ControlPlaneOrganization;
+    project: ControlPlaneProject;
+    environments: Map<string, ControlPlaneEnvironment>;
+    reconciliation: {
+        requeued: number;
+        failed: number;
+    };
+}
+export interface TrackDashboardOperationInput<T extends {
+    ok: boolean;
+}> {
+    controlPlane: DashboardControlPlane;
+    environment: EnvironmentType;
+    actor: DashboardUser;
+    kind: string;
+    resourceSlug?: string;
+    input?: JsonValue;
+    execute: () => Promise<T>;
+}
+export interface TrackedDashboardOperationResult<T extends {
+    ok: boolean;
+}> {
+    result: T;
+    operation: ControlPlaneOperation;
+}
+export declare function ensureDashboardActor(store: ControlPlaneStore, user: DashboardUser): ControlPlaneActor;
+export declare function initializeDashboardControlPlane(cwd: string, config: CloudConfig): DashboardControlPlane;
+export declare function synchronizeDashboardUsers(controlPlane: DashboardControlPlane, users: readonly DashboardUser[]): void;
+export declare function trackDashboardOperation<T extends {
+    ok: boolean;
+}>(input: TrackDashboardOperationInput<T>): Promise<TrackedDashboardOperationResult<T>>;

package/dist/deploy/dashboard-control-plane.test.d.ts

@@ -0,0 +1 @@
+export {};

package/dist/deploy/dashboard-data-services.integration.test.d.ts

@@ -0,0 +1 @@
+export {};

package/dist/deploy/dashboard-environment-scope.test.d.ts

@@ -0,0 +1 @@
+export {};

package/dist/deploy/dashboard-guard.d.ts

@@ -6,6 +6,8 @@
  * this file and {@link import('./dashboard-policy')} together are the complete
  * authorization story for the HTTP API.
  */
+import type { AuthenticationStore, AuthSession } from '../auth';
+import type { ControlPlaneStore } from '../control-plane';
 import type { DashboardUser } from './dashboard-auth';
 /**
  * A synthetic admin used only when auth is explicitly disabled for local
@@ -17,6 +19,13 @@ export interface GuardOptions {
     /** When false, every request is treated as {@link LOCAL_ADMIN}. */
     enabled: boolean;
     secret: string;
+    authentication?: AuthenticationStore;
+    authorization: {
+        store: ControlPlaneStore;
+        organizationId: string;
+        projectId: string;
+        defaultEnvironment: string;
+    };
 }
 export interface GuardDecision {
     ok: boolean;
@@ -29,10 +38,13 @@ export interface DashboardGuard {
     enabled: boolean;
     /** The user for this request, or null when unauthenticated. */
     resolveUser: (req: Request) => DashboardUser | null;
+    /** Durable v2 session metadata, when this request did not use a legacy cookie. */
+    resolveSession: (req: Request) => AuthSession | null;
     /** Whether `user` may perform `req`. `site` is required for site-scoped routes. */
     check: (req: Request, pathname: string, user: DashboardUser | null, site?: string) => GuardDecision;
 }
 export declare function createDashboardGuard(options: GuardOptions): DashboardGuard;
+export declare function dashboardMembershipVersions(store: ControlPlaneStore, organizationId: string, user: DashboardUser): Record<string, number>;
 /**
  * Read the site name a site-scoped route acts on, without consuming the body
  * the handler will read (the request is cloned).

package/dist/deploy/dashboard-guard.test.d.ts

@@ -0,0 +1 @@
+export {};

package/dist/deploy/dashboard-identities.d.ts

@@ -0,0 +1,15 @@
+import type { AuthenticationStore, AuthIdentity, VerifiedOidcIdentity } from '../auth';
+import type { DashboardUser } from './dashboard-auth';
+import type { DashboardControlPlane } from './dashboard-control-plane';
+/**
+ * Non-breaking bridge from the original local user file into durable auth.
+ * The control-plane identity becomes authoritative after the first migration;
+ * memberships remain a separate authorization concern.
+ */
+export declare function synchronizeDashboardIdentities(authentication: AuthenticationStore, controlPlane: DashboardControlPlane, users: DashboardUser[]): void;
+export declare function resolveOidcDashboardIdentity(authentication: AuthenticationStore, controlPlane: DashboardControlPlane, cwd: string, verified: VerifiedOidcIdentity): {
+    identity: AuthIdentity;
+    user: DashboardUser;
+    provisioned: boolean;
+};
+export declare function localLoginRequiresSso(authentication: AuthenticationStore, controlPlane: DashboardControlPlane, identity: AuthIdentity): boolean;

package/dist/deploy/dashboard-identities.test.d.ts

@@ -0,0 +1 @@
+export {};

package/dist/deploy/dashboard-jobs.integration.test.d.ts

@@ -0,0 +1 @@
+export {};

package/dist/deploy/dashboard-login-page.d.ts

@@ -9,8 +9,8 @@
  * It mirrors the cockpit's existing design tokens so the two don't read as
  * different products.
  */
-/**
- * The page. `serverless` only picks the post-login landing route, matching the
- * redirect the server already does for a serverless deployment.
- */
-export declare function renderLoginPage(serverless?: boolean): string;
+export declare function renderLoginPage(serverless?: boolean, oidcProviders?: readonly {
+    slug: string;
+    name: string;
+}[]): string;
+export declare function renderPasswordRecoveryPage(mode: 'request' | 'reset'): string;

package/dist/deploy/dashboard-login-page.test.d.ts

@@ -0,0 +1 @@
+export {};

package/dist/deploy/dashboard-oidc.integration.test.d.ts

@@ -0,0 +1 @@
+export {};

package/dist/deploy/dashboard-onboarding.integration.test.d.ts

@@ -0,0 +1 @@
+export {};

package/dist/deploy/dashboard-policy.d.ts

@@ -12,9 +12,11 @@
  * Site-scoped routes take their site from the request body, so their entry sets
  * `siteFrom: 'body'` and the caller supplies the parsed name.
  */
-import type { Capability } from './dashboard-auth';
+import type { AuthorizationCapability } from '../control-plane';
 export interface RoutePolicy {
-    capability: Capability;
+    capability: AuthorizationCapability;
+    /** Resource ancestry used when evaluating the capability. Defaults to project. */
+    scope?: 'organization' | 'project' | 'site';
     /** Where the site name comes from, for `site:*` capabilities. */
     siteFrom?: 'body';
     /** Any authenticated user may call it, regardless of role. */

package/dist/deploy/dashboard-queue-worker.integration.test.d.ts

@@ -0,0 +1 @@
+export {};

package/dist/deploy/dashboard-release.integration.test.d.ts

@@ -0,0 +1 @@
+export {};

package/dist/deploy/dashboard-route-manifest.d.ts

@@ -0,0 +1,14 @@
+export type DashboardMode = 'server' | 'serverless';
+export type DashboardNavigationGroup = 'overview' | 'applications' | 'operations' | 'infrastructure' | 'compute-data' | 'settings' | 'organization';
+export interface DashboardPageRoute {
+    id: string;
+    path: string;
+    label: string;
+    group: DashboardNavigationGroup;
+    modes: readonly DashboardMode[];
+    adminOnly: boolean;
+    legacyPaths?: readonly string[];
+}
+export declare const dashboardPageRoutes: readonly DashboardPageRoute[];
+export declare function resolveLegacyDashboardRoute(path: string): string | undefined;
+export declare function routesForDashboard(mode: DashboardMode, member: boolean): DashboardPageRoute[];

package/dist/deploy/dashboard-route-manifest.test.d.ts

@@ -0,0 +1 @@
+export {};

package/dist/deploy/dashboard-security.integration.test.d.ts

@@ -0,0 +1 @@
+export {};