{{define "app_settings"}}{{template "top" .}}
{{if .Flash}}<p class="banner">{{.Flash}}</p>{{end}}
{{if .FlashErr}}<p class="banner error">{{.FlashErr}}</p>{{end}}
{{template "appnav" .}}

<div class="settings-layout">
<nav class="settings-nav" aria-label="Settings sections">
  {{range .SettingsNav}}<a href="{{.Href}}"{{if .Current}} aria-current="page"{{end}}>{{.Label}}</a>{{end}}
</nav>
<div class="settings-content">
{{if eq .SettingsSection "general"}}
<h2>Identity</h2>
<div class="tablewrap">
<table>
  <tr><th>App</th><th>Account</th></tr>
  <tr><td><code>{{.Detail.App}}</code></td><td>{{.Account.Name}} <code>{{.Account.Sqid}}</code></td></tr>
</table>
</div>
<p class="small"><a href="{{.Nav}}/apps/{{.Detail.App}}/settings/pipeline">Release pipeline</a> — the channels a
release moves through, and what each one takes to promote onto.</p>
{{if .IsOwner}}
{{if .Settings.ControlPlane}}
<p class="small">This app is marked as the <strong>control plane</strong> — it
is this deployment&rsquo;s own platform. Renaming, moving and deleting it are
refused while the flag is set, and a service credential cannot promote it.</p>
{{else if .Settings.CanRename}}
<form method="post" action="{{.Base}}/apps/{{.Detail.App}}/rename" class="settings-row">
  <input type="hidden" name="csrf" value="{{.CSRF}}">
  <label for="rename-to">New name</label>
  <input type="text" id="rename-to" name="to" value="{{.SettingsRenameTo}}" placeholder="new-name"
    required pattern="[A-Za-z][A-Za-z0-9-]{0,31}" maxlength="32">
  <button type="submit" class="btn-sm">Rename</button>
</form>
<p class="small">This app has never shipped, so its name is still only a
record here — after the first ship, the name is wired into addresses and
bucket keys and stays.</p>
{{else}}
<p class="small">Renaming: {{.Settings.RenameBlocked}}</p>
{{end}}
{{end}}

{{end}}
{{if eq .SettingsSection "domains"}}
<h2>Domains &amp; TLS</h2>
{{if .Settings.Domains}}
<div class="tablewrap">
<table>
  <tr><th>Domain</th><th>Type</th><th>Status</th><th>Certificate</th></tr>
  {{range $i, $d := .Settings.Domains}}
  <tr>
    <td><code>{{$d.Domain}}</code></td>
    <td>{{$d.Type}}</td>
    <td>{{with $d.Status}}{{.}}{{else}}<span title="unknown — not checked yet">—</span>{{end}}</td>
    <td>{{if $d.TLS}}{{$d.TLS}}{{else}}<span title="unknown">—</span>{{end}}</td>
  </tr>
  {{with $d.Explain}}
  <tr><td colspan="4" class="small">{{.}}</td></tr>
  {{end}}
  {{if and $.IsOwner $d.Claimed}}
  <tr><td colspan="4" class="small">
    <form method="post" action="{{$.Base}}/apps/{{$.Detail.App}}/domains/detach" class="settings-row">
      <input type="hidden" name="csrf" value="{{$.CSRF}}">
      <input type="hidden" name="host" value="{{$d.Domain}}">
      <label class="visually-hidden" for="detach-confirm-{{$i}}">Type {{$d.Domain}} to confirm detaching it</label>
      <input type="text" id="detach-confirm-{{$i}}" name="confirm"
        placeholder="type {{$d.Domain}} to confirm" autocomplete="off" required>
      <button type="submit" class="btn-sm btn-danger">Detach</button>
    </form>
  </td></tr>
  {{end}}
  {{end}}
</table>
</div>
{{else}}<p class="small">No domains yet — the first shipped route brings one.</p>{{end}}
{{if .IsOwner}}
<h3>Attach a custom domain</h3>
{{if .Settings.OnlyPlatformDomain}}<p class="small">This app already answers
at its platform domain; attaching adds addresses, it never removes one.</p>{{end}}
<form method="post" action="{{.Base}}/apps/{{.Detail.App}}/domains/attach" class="settings-row">
  <input type="hidden" name="csrf" value="{{.CSRF}}">
  <label for="attach-host">Domain</label>
  <input type="text" id="attach-host" name="host" value="{{.SettingsDomain}}" placeholder="www.example.com" required>
  {{if .Settings.NeedsChannel}}
  <label for="attach-channel">Channel</label>
  <input type="text" id="attach-channel" name="channel" value="{{.SettingsChannel}}" placeholder="channel (e.g. stable)">
  {{end}}
  <button type="submit" class="btn-sm">Attach domain</button>
</form>
<p class="small">Point the domain's DNS at this deployment — once it is
attached, the row above says exactly what to create. The platform obtains the
certificate itself and renews it, so nothing has to visit the domain
first.</p>
<p class="small">For an app with instances, attaching <code>*.example.com</code>
makes each instance also answer at <code>&lt;label&gt;.example.com</code>, where
the label is the first part of its own hostname. <code>example.com</code> must
already be attached to an app in this account, and a wildcard DNS record
(<code>*</code>) must point here.</p>
{{end}}

<h2>Password gate</h2>
<p class="small">One shared password in front of a hostname — for a static
site or a prototype that should not be world-readable. Visitors see a plain
page asking for it and stay signed in for a week. It is set per instance.</p>
{{if .Settings.GatesUnavailable}}<p class="small">{{.Settings.GatesUnavailable}}</p>
{{else if .Settings.Gates}}
<div class="tablewrap">
<table>
  <tr><th>Host</th><th>State</th><th></th></tr>
  {{range $i, $g := .Settings.Gates}}
  <tr>
    <td><code>{{$g.Host}}</code></td>
    <td>{{if $g.Gated}}Password set{{else}}Open{{end}}</td>
    <td>
      <form method="post" action="{{$.Base}}/apps/{{$.Detail.App}}/gate" class="settings-row">
        <input type="hidden" name="csrf" value="{{$.CSRF}}">
        <input type="hidden" name="host" value="{{$g.Host}}">
        <input type="hidden" name="action" value="set">
        <label class="visually-hidden" for="gate-pw-{{$i}}">Password for {{$g.Host}}</label>
        <input type="password" id="gate-pw-{{$i}}" name="password" minlength="8" maxlength="72"
          autocomplete="new-password" placeholder="password" required>
        <button type="submit" class="btn-sm">{{if $g.Gated}}Change{{else}}Set password{{end}}</button>
      </form>
      {{if $g.Gated}}
      <form method="post" action="{{$.Base}}/apps/{{$.Detail.App}}/gate" class="settings-row">
        <input type="hidden" name="csrf" value="{{$.CSRF}}">
        <input type="hidden" name="host" value="{{$g.Host}}">
        <input type="hidden" name="action" value="clear">
        <button type="submit" class="btn-sm btn-danger">Turn off</button>
      </form>
      {{end}}
    </td>
  </tr>
  {{end}}
</table>
</div>
{{else}}<p class="small">No instances yet. A password gate is set per instance.</p>{{end}}

{{end}}
{{if eq .SettingsSection "general"}}
{{if and .Settings .Settings.MismatchTarget}}
<h2>Account</h2>
<p>This app's hosts read releases from account
<code>{{.Settings.MismatchTarget}}</code>, but the console's record says
{{.Account.Name}} — so promotes from here reach nothing.</p>
{{if and .IsOwner .Settings.TargetKnown .Settings.ViewerInTarget}}
<p>Move the record to where the platform already deploys from:</p>
<form method="post" action="{{.Base}}/apps/{{.Detail.App}}/move">
  <input type="hidden" name="csrf" value="{{.CSRF}}">
  <button type="submit" class="btn-sm">Move to {{.Settings.MismatchTarget}}</button>
</form>
{{else}}
<p class="small">{{if not .IsOwner}}Moving the record is the account owner's
to do{{else if not .Settings.TargetKnown}}The routes name an account this
console does not know{{else}}You are not a member of that account{{end}} —
the operator path is <code>console migrate-app --app {{.Detail.App}} --to
{{.Settings.MismatchTarget}}</code> on the console's box.</p>
{{end}}
{{else if .AccountReview.NoInstances}}
<h2>Account</h2>
<p>{{.MismatchCopy.NoInstances}} <a href="{{.Nav}}/apps/{{.Detail.App}}/instances">Instances</a></p>
{{else}}{{if .IsOwner}}
<h2>Account</h2>
<p class="small">This app deploys from {{.Account.Name}}. Moving an app to a
different account moves its bucket objects and re-stamps its routes —
<code>carlos accounts migrate</code>, an operator act; once run, this page
offers the final console-record step.</p>
{{end}}{{end}}
{{end}}
{{if eq .SettingsSection "environments"}}
{{if .Settings.NoBucket}}<p class="banner error">no deployment bucket on this host — this console cannot read config</p>{{end}}
{{if .Settings.EnvsUnavailable}}<p class="banner error">Could not read this app's environments. Please try again.</p>{{end}}
{{if .Settings}}
<h2>Environments</h2>
<p class="small">A named environment is a config bundle that overlays this
app's default one, per key. An instance bound to it reads the app's config
with these values on top — which is how two instances of one app serve
different origins, and how one of them gets a bucket of its own.</p>
{{if .Settings.Envs}}
{{range .Settings.Envs}}
<h3><code>{{.Name}}</code></h3>
<div class="tablewrap">
<table>
  <tr><th>Sets</th><th>Read by</th><th>Object store</th></tr>
  <tr>
    <td>{{if .Vars}}{{range $i, $v := .Vars}}{{if $i}}, {{end}}<code>{{$v.Name}}</code>{{if $v.Secret}} <span class="small">sealed</span>{{end}}{{end}}{{else}}<span title="the bundle exists but sets nothing">&mdash;</span>{{end}}</td>
    <td>{{if .Hosts}}{{range $i, $h := .Hosts}}{{if $i}}, {{end}}<a href="{{$.Nav}}/apps/{{$.Detail.App}}/instances/{{$h}}">{{$h}}</a>{{end}}{{else}}<span title="no instance is bound to this bundle">no instances</span>{{end}}</td>
    <td>{{if .HasStore}}{{if .StoreBucket}}<code>{{.StoreBucket}}</code>{{else}}declared{{end}}{{else}}<span title="this environment has no store of its own">&mdash;</span>{{end}}</td>
  </tr>
</table>
</div>
{{if and .HasStore (not .Hosts)}}<p class="small">This environment has an object
store but no instance reads it. The bucket still exists and still costs —
destroying a store is always deliberate, so nothing has removed it. Its card is
under <a href="{{$.Nav}}/apps/{{$.Detail.App}}/settings/storage">Storage</a>.</p>{{end}}
{{end}}
<p class="small">Values are not shown here. Read them with <code>carlos env list
--app {{.Detail.App}} --environment &lt;name&gt;</code>; secrets list by name only,
wherever you ask.</p>
{{else}}{{if not .Settings.EnvsUnavailable}}
<p class="small">No named environments. Every instance of this app reads its
default config bundle. Add one with <code>carlos env set --app {{.Detail.App}}
--environment &lt;name&gt; KEY=value</code>, then bind an instance to it with
<code>carlos instances set-environment --app {{.Detail.App}} --host &lt;h&gt;
--environment &lt;name&gt;</code>.</p>
{{end}}{{end}}
{{end}}
{{end}}
{{if eq .SettingsSection "storage"}}
{{if .Settings.NoBucket}}<p class="banner error">no deployment bucket on this host — this console cannot serve object storage</p>{{end}}
{{if .Settings.StoreUnavailable}}<p class="banner error">Could not read platform state. Please try again.</p>{{end}}
{{if .Settings}}{{with .Settings.Store}}
<h2>Object storage</h2>
{{if or .Declared .Granted .Provisioned}}
<div class="tablewrap">
<table>
  <tr><th>Env prefix</th><th>Backend</th><th>Bucket</th><th>Access key</th><th>Key age</th></tr>
  <tr>
    <td>{{if .EnvPrefix}}<code>{{.EnvPrefix}}_*</code>{{else}}<span title="no declaration on the record">—</span>{{end}}</td>
    <td>{{if .Backend}}{{.Backend}}{{else}}<span title="not granted yet">—</span>{{end}}</td>
    <td>{{if .Bucket}}<code>{{.Bucket}}</code>{{else}}<span title="not granted yet">—</span>{{end}}</td>
    <td>{{if .KeyID}}<code>{{.KeyID}}</code>{{else}}<span title="no credentials delivered yet">—</span>{{end}}</td>
    <td>{{if .KeyAge}}{{.KeyAge}}{{else}}<span title="unknown">—</span>{{end}}</td>
  </tr>
</table>
</div>
{{if .Provisioned}}<p class="small">Key age is the last credential change — a
rotation and a repaired grant both move it, so it is not when the store was
created.</p>{{end}}
{{if and (not .Granted) (not .Provisioned)}}<p class="small">Declared and waiting:
an operator of this deployment creates the bucket and delivers the credentials.
Until then the {{if .EnvPrefix}}<code>{{.EnvPrefix}}_*</code>{{else}}store{{end}}
variables are not in this app's config.</p>{{end}}
{{if and .Granted (not .Provisioned)}}<p class="small">A grant is half-done: the
bucket was claimed but no credentials are recorded yet. Running the grant again
repairs it — an operator of this deployment does that.</p>{{end}}
{{if .PendingFinish}}<p class="small">A rotation is half-finished — two keys open
this bucket until you retire the old one:</p>
<pre><code>carlos store rotate --finish --app {{$.Detail.App}}</code></pre>{{end}}
{{if $.IsOwner}}
<h3 class="danger-head">Destroy this store</h3>
{{if .CanDestroy}}
<p class="small">Destroying empties and deletes
{{if .Bucket}}<code>{{.Bucket}}</code>{{else}}the store{{end}}, deletes the
credentials that opened it, and removes the delivered variables from this app's
config. There is no trash for a store: the objects in it are gone, and nothing
here brings them back.</p>
<form method="post" action="{{$.Base}}/apps/{{$.Detail.App}}/store/destroy" class="settings-row">
  <input type="hidden" name="csrf" value="{{$.CSRF}}">
  <label class="visually-hidden" for="store-destroy-confirm">Type {{if .Bucket}}the bucket name{{else}}the app's name{{end}} to confirm</label>
  <input type="text" id="store-destroy-confirm" name="confirm"
    placeholder="type {{if .Bucket}}{{.Bucket}}{{else}}{{$.Detail.App}}{{end}} to confirm" autocomplete="off" required>
  <button type="submit" class="btn-sm btn-danger">Destroy store</button>
</form>
<p class="small">Confirms with your passkey.</p>
{{else}}
<p class="small">This console has no storage backend configured
(<code>CARLOS_STORE_BACKEND</code>), so it cannot delete this bucket or its
credentials — an operator of this deployment has to tear it down.</p>
{{end}}
{{end}}
{{else}}
<p class="small">No object store. Ask for one with <code>carlos store create --app
{{$.Detail.App}}</code>; an operator of this deployment then creates the bucket
and delivers its credentials into this app's config.</p>
{{end}}
{{end}}{{end}}
{{with .Settings}}{{range .StoreEnvs}}
<h2>Object storage &mdash; {{.Environment}} environment</h2>
<p class="small">Its own bucket and its own credential, delivered into the
<code>{{.Environment}}</code> config bundle &mdash; so only the instances bound to
that environment can reach it.</p>
<div class="tablewrap">
<table>
  <tr><th>Env prefix</th><th>Backend</th><th>Bucket</th><th>Access key</th><th>Key age</th></tr>
  <tr>
    <td>{{if .EnvPrefix}}<code>{{.EnvPrefix}}_*</code>{{else}}<span title="no declaration on the record">&mdash;</span>{{end}}</td>
    <td>{{if .Backend}}{{.Backend}}{{else}}<span title="not granted yet">&mdash;</span>{{end}}</td>
    <td>{{if .Bucket}}<code>{{.Bucket}}</code>{{else}}<span title="not granted yet">&mdash;</span>{{end}}</td>
    <td>{{if .KeyID}}<code>{{.KeyID}}</code>{{else}}<span title="no credentials delivered yet">&mdash;</span>{{end}}</td>
    <td>{{if .KeyAge}}{{.KeyAge}}{{else}}<span title="unknown">&mdash;</span>{{end}}</td>
  </tr>
</table>
</div>
{{if and (not .Granted) (not .Provisioned)}}<p class="small">Declared and waiting:
an operator of this deployment creates the bucket and delivers the credentials.</p>{{end}}
{{if .PendingFinish}}<p class="small">A rotation is half-finished &mdash; two keys open
this bucket until you retire the old one:</p>
<pre><code>carlos store rotate --finish --app {{$.Detail.App}} --environment {{.Environment}}</code></pre>{{end}}
{{if $.IsOwner}}
<h3 class="danger-head">Destroy this store</h3>
{{if .CanDestroy}}
<p class="small">Destroying empties and deletes
{{if .Bucket}}<code>{{.Bucket}}</code>{{else}}the store{{end}}, deletes the
credentials that opened it, and removes the delivered variables from the
<code>{{.Environment}}</code> bundle. The app's own store is not touched. There is
no trash for a store: the objects in it are gone.</p>
<form method="post" action="{{$.Base}}/apps/{{$.Detail.App}}/store/destroy" class="settings-row">
  <input type="hidden" name="csrf" value="{{$.CSRF}}">
  <input type="hidden" name="environment" value="{{.Environment}}">
  <label class="visually-hidden" for="store-destroy-confirm-{{.Environment}}">Type {{if .Bucket}}the bucket name{{else}}the app's name{{end}} to confirm</label>
  <input type="text" id="store-destroy-confirm-{{.Environment}}" name="confirm"
    placeholder="type {{if .Bucket}}{{.Bucket}}{{else}}{{$.Detail.App}}{{end}} to confirm" autocomplete="off" required>
  <button type="submit" class="btn-sm btn-danger">Destroy store</button>
</form>
<p class="small">Confirms with your passkey.</p>
{{else}}
<p class="small">This console has no storage backend configured
(<code>CARLOS_STORE_BACKEND</code>), so it cannot delete this bucket or its
credentials &mdash; an operator of this deployment has to tear it down.</p>
{{end}}
{{end}}
{{end}}{{end}}
{{end}}
{{if eq .SettingsSection "general"}}
<h2>Errors</h2>
{{if .ErrLevelUnread}}
<p class="small">This app&rsquo;s Errors log level could not be read just now, so it is not shown
and cannot be changed from here. Reload before concluding anything.</p>
{{else if .IsOwner}}
<form method="post" action="{{.Base}}/apps/{{.Detail.App}}/errors/level" class="settings-row">
  <input type="hidden" name="csrf" value="{{.CSRF}}">
  <label>Log lines counted as errors:
    <select name="level">
      <option value="error"{{if eq .ErrLevelSetting.LogLevel "error"}} selected{{end}}>error and above</option>
      <option value="warn"{{if eq .ErrLevelSetting.LogLevel "warn"}} selected{{end}}>warn and above</option>
    </select>
  </label>
  <button type="submit" class="btn-sm">Save</button>
  <span class="small">currently {{.ErrLevelSetting.LogLevel}}, from the {{.ErrLevelSetting.LogLevelFrom}}</span>
</form>
{{else}}
<p class="small">Log lines at <code>{{.ErrLevelSetting.LogLevel}}</code> and above are counted as
errors for this app, from the {{.ErrLevelSetting.LogLevelFrom}}. Only the account owner can
change it.</p>
{{end}}
<p class="small">The <a href="{{.Base}}/apps/{{.Detail.App}}/errors">Errors tab</a> always lets you
widen one look to warn without changing this.</p>

<h2>Analytics</h2>
{{if .AnalyticsUnread}}
<p class="small">This app&rsquo;s analytics setting could not be read just now. Reload before
concluding anything.</p>
{{else if .IsOwner}}
<form method="post" action="{{.Base}}/apps/{{.Detail.App}}/analytics/setting" class="settings-row">
  <input type="hidden" name="csrf" value="{{.CSRF}}">
  <label>Count page views at the edge:
    <select name="count">
      <option value="off"{{if eq .AnalyticsSetting.Count "off"}} selected{{end}}>off</option>
      <option value="edge"{{if eq .AnalyticsSetting.Count "edge"}} selected{{end}}>on (edge)</option>
    </select>
  </label>
  <button type="submit" class="btn-sm">Save</button>
  <span class="small">currently {{.AnalyticsSetting.Count}}, from the {{.AnalyticsSetting.CountFrom}}</span>
</form>
{{else}}
<p class="small">Analytics counting is <code>{{.AnalyticsSetting.Count}}</code> for this app, from
the {{.AnalyticsSetting.CountFrom}}. Only the account owner can change it.</p>
{{end}}
<p class="small">When on, the edge counts HTML page views and daily visitors as it serves them: no
JavaScript, no cookie, no stored IP. A visitor is a salted hash that changes every day and cannot be
joined across days. Whether that needs consent where your visitors are is your call, which is why it
is off until you turn it on.</p>

<h2>{{.SwapCopy.Heading}}</h2>
{{if .SwapUnread}}
<p class="small">{{.SwapCopy.Unread}}</p>
{{else}}
<p class="small">{{.SwapCopy.Intro}}</p>
<form method="post" action="{{.Base}}/apps/{{.Detail.App}}/swap" class="settings-row">
  <input type="hidden" name="csrf" value="{{.CSRF}}">
  <label>{{.SwapCopy.SwapLabel}}
    <select name="swap">
      <option value="overlap"{{if eq .SwapPolicy.Swap "overlap"}} selected{{end}}>{{.SwapCopy.OverlapOption}}</option>
      <option value="hold"{{if eq .SwapPolicy.Swap "hold"}} selected{{end}}>{{.SwapCopy.HoldOption}}</option>
    </select>
  </label>
  <label>{{.SwapCopy.ConcurrencyLabel}}
    <input type="number" name="swap_concurrency" min="1" step="1" value="{{.SwapPolicy.Concurrency}}" required>
  </label>
  <button type="submit" class="btn-sm">Save</button>
</form>
<p class="small">{{.SwapCopy.MigrationsNote}}</p>
{{end}}

{{end}}
{{if eq .SettingsSection "features"}}
{{if .Settings.NoBucket}}<p class="banner error">no deployment bucket on this host — this console cannot read features</p>{{end}}
{{if .Settings.FeaturesUnavailable}}<p class="banner error">Could not read platform state. Please try again.</p>{{end}}
{{if .Settings}}{{with .Settings.Features}}
<h2>Feature flags</h2>
{{if .Flags}}
<div class="tablewrap">
<table>
  <tr><th>Key</th><th>Value</th></tr>
  {{range .Flags}}<tr><td><code>{{.Key}}</code></td><td><code>{{.Value}}</code></td></tr>
  {{end}}
</table>
</div>
<p class="small">Last changed {{.SetAt}}{{if .SetBy}} by {{.SetBy}}{{end}}. The platform
stores and serves these; what each one means is this app's own business. It
reads them off the deployment block its instance token fetches, so a change
lands on its next poll — no restart.</p>
{{else}}
<p class="small">No feature flags set.</p>
{{end}}
<p class="small">Set or clear one with
<code>carlos features set --app {{$.Detail.App}} key=value</code>
(<code>key=</code> clears); every change is audited under Activity.</p>
{{end}}{{end}}
{{end}}
{{if eq .SettingsSection "email"}}
{{if .Settings.NoBucket}}<p class="banner error">no deployment bucket on this host — this console cannot serve email</p>{{end}}
{{if .Settings.MailUnavailable}}<p class="banner error">Could not read platform state. Please try again.</p>{{end}}
{{if .Settings}}{{with .Settings.Mail}}
<h2>Email</h2>
{{if or .Declared .Granted .Provisioned .Standalone}}
<div class="tablewrap">
<table>
  <tr><th>Env prefix</th><th>From address</th><th>Sending domains</th><th>Daily cap</th><th>SMTP username</th><th>Key age</th></tr>
  <tr>
    <td>{{if .EnvPrefix}}<code>{{.EnvPrefix}}_*</code>{{else}}<span title="no declaration on the record">—</span>{{end}}</td>
    <td>{{if .From}}{{.From}}{{else}}<span title="no declaration on the record">—</span>{{end}}</td>
    <td>{{if .Domains}}{{range $i, $d := .Domains}}{{if $i}}, {{end}}<code>{{$d}}</code>{{end}}{{else}}<span title="not granted yet">—</span>{{end}}</td>
    <td>{{if .Granted}}{{.DailyCap}}{{else}}<span title="not granted yet">—</span>{{end}}</td>
    <td>{{if .KeyID}}<code>{{.KeyID}}</code>{{else}}<span title="no credentials delivered yet">—</span>{{end}}</td>
    <td>{{if .KeyAge}}{{.KeyAge}}{{else}}<span title="unknown">—</span>{{end}}</td>
  </tr>
</table>
</div>
{{if .Provisioned}}<p class="small">Key age is the last credential change — a
rotation moves it. The SMTP username above IS this credential's access key id;
there is no separate password to show here.</p>{{end}}
{{if .Paused}}
<p class="small banner error">Sending is paused for this app — no email goes
out right now.
{{if eq .PauseKind "cap"}}The daily send cap was hit; this clears itself on
the next UTC day roll.{{else if eq .PauseKind "rate"}}SES's bounce/complaint
rate tripped a safety pause; it does not clear itself — an operator has to
resume it.{{else}}An operator paused this deliberately; only an operator can
resume it.{{end}}</p>
{{end}}
{{if .PendingFinish}}<p class="small">A rotation is half-finished — two keys
open this credential until you retire the old one:</p>
<pre><code>carlos email rotate --finish --app {{$.Detail.App}}</code></pre>{{end}}
{{if and .Declared (not .Granted) (not .Provisioned)}}<p class="small">Declared
and waiting on a verified sending domain — add one with
<code>carlos email domains add --app {{$.Detail.App}} &lt;domain&gt;</code>,
then <code>carlos email enable --app {{$.Detail.App}}</code>.</p>{{end}}
{{if and .Granted (not .Provisioned)}}<p class="small">Authorised to send but
not provisioned yet — run
<code>carlos email enable --app {{$.Detail.App}}</code> to finish it.</p>{{end}}
{{if .Standalone}}
<h3>Standalone credentials</h3>
<div class="tablewrap">
<table>
  <tr><th>Name</th><th>SMTP username</th><th>Key age</th></tr>
  {{range .Standalone}}
  <tr>
    <td>{{.Name}}</td>
    <td><code>{{.KeyID}}</code></td>
    <td>{{if .Age}}{{.Age}}{{else}}<span title="unknown">—</span>{{end}}</td>
  </tr>
  {{end}}
</table>
</div>
<p class="small">No password is shown here — standalone credentials have
none on the record; it was handed over once, at creation.</p>
{{end}}
{{else}}
{{if .Available}}
<p class="small">No email for this app yet — get it with
<code>carlos email enable --app {{$.Detail.App}}</code>.</p>
{{else}}
<p class="small">Email is not available on this deployment.</p>
{{end}}
{{end}}
{{end}}{{end}}
{{end}}
{{if eq .SettingsSection "advanced"}}
{{if and .Settings .IsOwner}}

<h2 class="danger-head">Control plane</h2>
{{if .Settings.ControlPlane}}
<p class="small">{{.Detail.App}} is marked as the control plane: it is what
serves this deployment, so its release history is what the fleet is running.
Clearing the flag removes that protection — trash, permanent deletion, rename
and the account move all become available, and a service credential can promote
it again.</p>
<form method="post" action="{{.Base}}/apps/{{.Detail.App}}/control-plane/clear" class="settings-row">
  <input type="hidden" name="csrf" value="{{.CSRF}}">
  <button type="submit" class="btn-sm btn-danger">Clear the control-plane flag</button>
</form>
<p class="small">Confirms with your passkey — clearing is the dangerous
direction, so it is the one that asks. Marking an app again does not.</p>
{{else}}
<p class="small">{{.Detail.App}} is an ordinary app. Marking it as the control
plane says it IS this deployment&rsquo;s platform: trashing, permanent
deletion, renaming and the account move are then refused, the account holding
it cannot be retired, and a service credential can neither promote it nor
shorten its release history. A person with ops membership still deploys it
exactly as before.</p>
<form method="post" action="{{.Base}}/apps/{{.Detail.App}}/control-plane/set" class="settings-row">
  <input type="hidden" name="csrf" value="{{.CSRF}}">
  <button type="submit" class="btn-sm">Mark as control plane</button>
</form>
<p class="small">No passkey: marking only adds refusals, and it is undone from
this same card.</p>
{{end}}
{{end}}
{{end}}
{{if eq .SettingsSection "delete"}}
{{if .IsOwner}}

<h2 class="danger-head">Delete this app</h2>
<p class="small">Deleting puts {{.Detail.App}} in the account's
<a href="{{.Nav}}/trash">trash</a>: hosts stop serving it on their next pass
(custom domains included), and it is restorable for
<strong class="restore-days">{{if .ExpiresAt.IsZero}}{{trashCooloffDays}}{{else}}{{temporaryCooloffDays}}{{end}} days</strong>
before the platform destroys its releases for good.{{if not .ExpiresAt.IsZero}} It is a temporary app, so its
window is shorter than usual.{{end}}{{if .Detail.Production.On}} It is marked as production right now, which
blocks deletion — turn the safety delay off on the <a href="{{.Nav}}/apps/{{.AppName}}/releases">{{.DeploymentsCopy.History}}</a> tab first.{{end}}</p>
<form method="post" action="{{.Base}}/apps/{{.Detail.App}}/delete" class="settings-row">
  <input type="hidden" name="csrf" value="{{.CSRF}}">
  <label class="visually-hidden" for="delete-confirm">Type the app's name to confirm</label>
  <input type="text" id="delete-confirm" name="confirm" placeholder="type {{.Detail.App}} to confirm" autocomplete="off" required>
  <button type="submit" class="btn-sm btn-danger">Delete {{.Detail.App}}</button>
</form>
<p class="small">Confirms with your passkey.</p>
{{end}}
{{end}}
</div>
</div>
{{template "bottom" .}}{{end}}