feat: read-only API tokens, last-used, and less layout jump

[Zach Dunn (zachdunn)]

In plain terms

API tokens on /account/developers can be read-only, show when they were last used, and the page no longer hides the form and list until JavaScript finishes. CLI help no longer talks about a separate API key.

What it does / what it is not

• Create offers Read & write (default) or Read only (files:read).
• Successful token auth stamps last_used_at at most once an hour. The list shows last used or never used.
• The developers page loads workspaces and issued tokens on the server when a session cookie is present, and keeps the CLI setup card compact until it knows whether to show install steps.
• uploads config help is up_<workspace>_… only.
• Login still defaults to 90-day read+write. Admin enrollment is unchanged.

How to try it

After API (with the D1 migration) + web deploy:

1. Open /account/developers. The token form and list should be there on first paint.
2. Create a Read only token and confirm the row says read-only.
3. Use a token once, wait for the hourly stamp, refresh — last used should appear.

export UPLOADS_TOKEN=up_<workspace>_...
uploads put ./shot.png

A read-only token will refuse the put.

Technical notes

Migration apps/api/migrations/20260817180000_token_last_used.sql adds auth_tokens.last_used_at. deploy:api applies it. Touch is a conditional UPDATE so busy tokens do not write D1 on every request.

Test plan

• Token mint / issued-list tests including lastUsedAt
• touchTokenLastUsed unit test
• GitHub link/comment/promote auth tests after the touch write
• Web parse + list HTML tests
• astro check (0 errors)
• Direct PUT to prod with UPLOADS_TOKEN_DEFAULT — 201 on buildinternet
• Click through /account/developers after deploy

[changeset-bot]

🦋 Changeset detected

Latest commit: 062849e

The changes in this PR will be included in the next version bump.

This PR includes changesets to release 1 package

Name	Type
@buildinternet/uploads	Patch

Not sure what this means? Click here to learn what changesets are.

Click here if you're a maintainer who wants to add another changeset to this PR

[coderabbitai]

Important

Review skipped

Auto reviews are limited based on label configuration.

🏷️ Required labels (at least one) (2)

• coderabbit:review
• review

🚫 Excluded labels (none allowed) (1)

• wip

Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro Plus

Run ID: 0fa7ce56-6d93-4844-a35c-7cf8f166770a

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}