@stacksjs/ts-cloud 0.7.103 → 0.7.104

package/dist/{chunk-ef2dwfrg.js → chunk-5cz14833.js}

@@ -7,7 +7,7 @@ import {
   Route53Provider,
   UnifiedDnsValidator,
   createDnsProvider
-} from "./chunk-gttvakpv.js";
+} from "./chunk-6hymgy61.js";
 import {
   CloudFormationClient
 } from "./chunk-4cjrg98a.js";
@@ -815,7 +815,7 @@ async function deployStaticSiteWithExternalDnsFull(config) {
     }
   }
   onProgress?.("upload", "Uploading files to S3...");
-  const { uploadStaticFiles } = await import("./chunk-s9c2x5jv.js");
+  const { uploadStaticFiles } = await import("./chunk-adgz2c49.js");
   const uploadResult = await uploadStaticFiles({
     sourceDir,
     bucket: infraResult.bucket,
@@ -835,7 +835,7 @@ async function deployStaticSiteWithExternalDnsFull(config) {
   }
   if (infraResult.distributionId && uploadResult.uploaded > 0) {
     onProgress?.("invalidate", "Invalidating CloudFront cache...");
-    const { invalidateCache } = await import("./chunk-s9c2x5jv.js");
+    const { invalidateCache } = await import("./chunk-adgz2c49.js");
     await invalidateCache(infraResult.distributionId);
   }
   onProgress?.("complete", "Deployment complete!");

package/dist/{chunk-gttvakpv.js → chunk-6hymgy61.js}

@@ -306,6 +306,90 @@ class PorkbunProvider {
     }
   }
 }
+// src/dns/mail-records.ts
+function buildSpfValue(options) {
+  const mechanisms = ["v=spf1"];
+  if (options.ip)
+    mechanisms.push(`ip4:${options.ip}`);
+  for (const include of options.spfIncludes || []) {
+    mechanisms.push(include.startsWith("include:") ? include : `include:${include}`);
+  }
+  mechanisms.push("~all");
+  return mechanisms.join(" ");
+}
+function normalizeDkimKey(key) {
+  return String(key || "").replace(/-----(?:BEGIN|END)[^-]*-----/g, "").replace(/\s+/g, "");
+}
+function buildDkimValue(publicKey) {
+  return `v=DKIM1; k=rsa; p=${normalizeDkimKey(publicKey)}`;
+}
+function buildDmarcValue(options) {
+  const parts = [`v=DMARC1`, `p=${options.dmarcPolicy || "none"}`];
+  if (options.dmarcReportTo)
+    parts.push(`rua=mailto:${options.dmarcReportTo}`);
+  return `${parts.join("; ")};`;
+}
+function buildMailDnsRecords(options) {
+  if (!options.domain)
+    throw new Error("A domain is required to build mail DNS records.");
+  if (!options.mailHost)
+    throw new Error("A mail host is required to build mail DNS records.");
+  const ttl = options.ttl ?? 600;
+  const selector = options.dkimSelector || "default";
+  const records = [
+    {
+      name: "@",
+      type: "MX",
+      content: options.mailHost,
+      priority: options.mxPriority ?? 10,
+      ttl
+    },
+    {
+      name: "@",
+      type: "TXT",
+      content: buildSpfValue(options),
+      ttl
+    },
+    {
+      name: "_dmarc",
+      type: "TXT",
+      content: buildDmarcValue(options),
+      ttl
+    }
+  ];
+  if (normalizeDkimKey(options.dkimPublicKey || "")) {
+    records.push({
+      name: `${selector}._domainkey`,
+      type: "TXT",
+      content: buildDkimValue(options.dkimPublicKey),
+      ttl
+    });
+  }
+  return records;
+}
+async function syncMailDns(provider, options) {
+  const records = buildMailDnsRecords(options);
+  const applied = [];
+  for (const record of records) {
+    try {
+      const result = await provider.upsertRecord(options.domain, record);
+      applied.push({
+        name: record.name,
+        type: record.type,
+        ok: Boolean(result.success),
+        message: result.message
+      });
+    } catch (error) {
+      applied.push({
+        name: record.name,
+        type: record.type,
+        ok: false,
+        message: error instanceof Error ? error.message : String(error)
+      });
+    }
+  }
+  return { domain: options.domain, applied, ok: applied.every((entry) => entry.ok) };
+}
 // src/dns/godaddy.ts
 var GODADDY_API_URL = "https://api.godaddy.com";
 var GODADDY_OTE_API_URL = "https://api.ote-godaddy.com";
@@ -1882,4 +1966,4 @@ class DnsProviderFactory {
 }
 var dnsProviders = new DnsProviderFactory;
 
-export { PorkbunProvider, GoDaddyProvider, CloudflareProvider, Route53Provider, UnifiedDnsValidator, createPorkbunValidator, createGoDaddyValidator, createRoute53Validator, createDnsProvider, detectDnsProvider, DnsProviderFactory, dnsProviders, ACMClient, ACMDnsValidator };
+export { PorkbunProvider, buildSpfValue, normalizeDkimKey, buildDkimValue, buildDmarcValue, buildMailDnsRecords, syncMailDns, GoDaddyProvider, CloudflareProvider, Route53Provider, UnifiedDnsValidator, createPorkbunValidator, createGoDaddyValidator, createRoute53Validator, createDnsProvider, detectDnsProvider, DnsProviderFactory, dnsProviders, ACMClient, ACMDnsValidator };

package/dist/{chunk-s9c2x5jv.js → chunk-adgz2c49.js}

@@ -5,9 +5,9 @@ import {
   generateStaticSiteTemplate,
   invalidateCache,
   uploadStaticFiles
-} from "./chunk-ef2dwfrg.js";
+} from "./chunk-5cz14833.js";
 import"./chunk-01d86gt1.js";
-import"./chunk-gttvakpv.js";
+import"./chunk-6hymgy61.js";
 import"./chunk-4cjrg98a.js";
 import"./chunk-32e7ya18.js";
 import"./chunk-wj3s95p9.js";

package/dist/{chunk-vkd2y0fs.js → chunk-gtz4jar2.js}

@@ -1,6 +1,6 @@
 import {
   deployStaticSiteWithExternalDnsFull
-} from "./chunk-ef2dwfrg.js";
+} from "./chunk-5cz14833.js";
 import {
   box,
   error,

package/dist/deploy/index.js

@@ -30,7 +30,7 @@ import {
   synchronizeDashboardUsers,
   trackDashboardOperation,
   verifyStaticApiOrigin
-} from "../chunk-vkd2y0fs.js";
+} from "../chunk-gtz4jar2.js";
 import {
   deleteStaticSite,
   deployStaticSite,
@@ -41,7 +41,7 @@ import {
   generateStaticSiteTemplate,
   invalidateCache,
   uploadStaticFiles
-} from "../chunk-ef2dwfrg.js";
+} from "../chunk-5cz14833.js";
 import {
   buildAndPushServerlessImage
 } from "../chunk-3g4r09dd.js";
@@ -49,7 +49,7 @@ import"../chunk-ybcz6sxc.js";
 import"../chunk-01d86gt1.js";
 import"../chunk-50jpda9q.js";
 import"../chunk-he9a874b.js";
-import"../chunk-gttvakpv.js";
+import"../chunk-6hymgy61.js";
 import {
   IPV6_EXCLUDED_HOST_LABELS,
   MANAGEMENT_DASHBOARD_SITE,

package/dist/dns/index.d.ts

@@ -4,6 +4,8 @@
  */
 export * from './types';
 export { PorkbunProvider } from './porkbun';
+export { buildDkimValue, buildDmarcValue, buildMailDnsRecords, buildSpfValue, normalizeDkimKey, syncMailDns, } from './mail-records';
+export type { MailDnsOptions, MailDnsSyncResult } from './mail-records';
 export { GoDaddyProvider } from './godaddy';
 export { CloudflareProvider } from './cloudflare';
 export { Route53Provider } from './route53-adapter';

package/dist/dns/index.js

@@ -5,23 +5,35 @@ import {
   PorkbunProvider,
   Route53Provider,
   UnifiedDnsValidator,
+  buildDkimValue,
+  buildDmarcValue,
+  buildMailDnsRecords,
+  buildSpfValue,
   createDnsProvider,
   createGoDaddyValidator,
   createPorkbunValidator,
   createRoute53Validator,
   detectDnsProvider,
-  dnsProviders
-} from "../chunk-gttvakpv.js";
+  dnsProviders,
+  normalizeDkimKey,
+  syncMailDns
+} from "../chunk-6hymgy61.js";
 import"../chunk-32e7ya18.js";
 import"../chunk-zqtpg06c.js";
 import"../chunk-v0bahtg2.js";
 export {
+  syncMailDns,
+  normalizeDkimKey,
   dnsProviders,
   detectDnsProvider,
   createRoute53Validator,
   createPorkbunValidator,
   createGoDaddyValidator,
   createDnsProvider,
+  buildSpfValue,
+  buildMailDnsRecords,
+  buildDmarcValue,
+  buildDkimValue,
   UnifiedDnsValidator,
   Route53Provider,
   PorkbunProvider,

package/dist/dns/mail-records.d.ts

@@ -0,0 +1,82 @@
+/**
+ * Mail DNS provisioning.
+ *
+ * A domain that sends mail needs four records, and getting any one of them
+ * wrong is not a visible error: mail simply arrives in spam, or is silently
+ * rejected by the receiving side. That failure mode is why this belongs in the
+ * deploy rather than in a runbook — a deploy that stands up a mail-sending app
+ * and leaves its DNS to be typed by hand has not finished the job.
+ *
+ * The record set is deliberately a pure function of its inputs, so what a
+ * deploy is about to publish can be inspected, diffed and tested without an
+ * API call or a live zone.
+ *
+ * @module ts-cloud/dns/mail-records
+ */
+import type { DnsProvider, DnsRecord } from './types';
+export interface MailDnsOptions {
+    /** The domain that sends mail, e.g. `example.com`. */
+    domain: string;
+    /** Hostname of the mail server that receives for it. */
+    mailHost: string;
+    /** Public IPv4 of the sending server, authorised in SPF. */
+    ip?: string;
+    /** Additional SPF mechanisms, e.g. `include:amazonses.com`. */
+    spfIncludes?: string[];
+    /** DKIM selector. Convention is `default`. */
+    dkimSelector?: string;
+    /**
+     * DKIM public key, base64, without PEM armour or newlines. Omit to skip the
+     * DKIM record: publishing an empty or malformed key is worse than publishing
+     * none, because receivers treat a broken signature as a stronger negative
+     * signal than an unsigned message.
+     */
+    dkimPublicKey?: string;
+    /** MX preference. */
+    mxPriority?: number;
+    /**
+     * DMARC policy. `none` by default: it asks receivers to report rather than
+     * to reject, which is the only safe setting to switch on automatically for a
+     * domain whose mail history nobody has checked yet.
+     */
+    dmarcPolicy?: 'none' | 'quarantine' | 'reject';
+    /** Where aggregate DMARC reports go. Omitted from the record when absent. */
+    dmarcReportTo?: string;
+    ttl?: number;
+}
+/** SPF is a single TXT record; more than one is a permanent error. */
+export declare function buildSpfValue(options: Pick<MailDnsOptions, 'ip' | 'spfIncludes'>): string;
+/** Strip PEM armour and whitespace, which a DKIM TXT record must not contain. */
+export declare function normalizeDkimKey(key: string): string;
+export declare function buildDkimValue(publicKey: string): string;
+export declare function buildDmarcValue(options: Pick<MailDnsOptions, 'dmarcPolicy' | 'dmarcReportTo'>): string;
+/**
+ * The full record set a mail-sending domain needs.
+ *
+ * Names are returned as the labels providers expect (`@` for the apex), since
+ * every provider in this package normalises from that form.
+ */
+export declare function buildMailDnsRecords(options: MailDnsOptions): DnsRecord[];
+export interface MailDnsSyncResult {
+    domain: string;
+    applied: Array<{
+        name: string;
+        type: string;
+        ok: boolean;
+        message?: string;
+    }>;
+    /** True when every record was written. */
+    ok: boolean;
+}
+/**
+ * Publish the record set, idempotently.
+ *
+ * Uses `upsertRecord` rather than create, so a redeploy converges instead of
+ * accumulating duplicate SPF records — two SPF TXT records on one domain is a
+ * permanent error under RFC 7208 and breaks mail that previously worked.
+ *
+ * Never throws. Mail DNS is one part of a deploy, and a zone that is
+ * momentarily unreachable should surface as a reported failure rather than
+ * roll back an otherwise healthy release.
+ */
+export declare function syncMailDns(provider: DnsProvider, options: MailDnsOptions): Promise<MailDnsSyncResult>;

package/dist/index.d.ts

@@ -37,7 +37,8 @@ export { createCloudDriver, CloudDriverFactory, cloudDrivers, AwsDriver, Hetzner
 export type { CreateCloudDriverOptions } from './drivers/factory';
 export { dashboardActions, resolveDashboardAction, sanitizeCloudConfig, startLocalDashboardServer, } from './deploy/local-dashboard-server';
 export type { DashboardAction, LocalDashboardServer, LocalDashboardServerOptions, } from './deploy/local-dashboard-server';
-export { createDnsProvider, detectDnsProvider, DnsProviderFactory, dnsProviders, PorkbunProvider, GoDaddyProvider, Route53Provider, UnifiedDnsValidator, createPorkbunValidator, createGoDaddyValidator, createRoute53Validator, } from './dns';
+export { createDnsProvider, detectDnsProvider, DnsProviderFactory, dnsProviders, PorkbunProvider, GoDaddyProvider, Route53Provider, UnifiedDnsValidator, createPorkbunValidator, createGoDaddyValidator, createRoute53Validator, buildMailDnsRecords, buildSpfValue, buildDkimValue, buildDmarcValue, normalizeDkimKey, syncMailDns, } from './dns';
+export type { MailDnsOptions, MailDnsSyncResult } from './dns';
 export * from './source';
 export * from './queue';
 export * from './backups';

package/dist/index.js

@@ -283,7 +283,7 @@ import {
   volumeCapabilities,
   webhookEndpoint,
   zeroCapacity
-} from "./chunk-vkd2y0fs.js";
+} from "./chunk-gtz4jar2.js";
 import {
   deleteStaticSite,
   deployStaticSite,
@@ -294,7 +294,7 @@ import {
   generateStaticSiteTemplate,
   invalidateCache,
   uploadStaticFiles
-} from "./chunk-ef2dwfrg.js";
+} from "./chunk-5cz14833.js";
 import {
   buildAndPushServerlessImage
 } from "./chunk-3g4r09dd.js";
@@ -353,13 +353,19 @@ import {
   PorkbunProvider,
   Route53Provider,
   UnifiedDnsValidator,
+  buildDkimValue,
+  buildDmarcValue,
+  buildMailDnsRecords,
+  buildSpfValue,
   createDnsProvider,
   createGoDaddyValidator,
   createPorkbunValidator,
   createRoute53Validator,
   detectDnsProvider,
-  dnsProviders
-} from "./chunk-gttvakpv.js";
+  dnsProviders,
+  normalizeDkimKey,
+  syncMailDns
+} from "./chunk-6hymgy61.js";
 import {
   AwsDriver,
   CloudDriverFactory,
@@ -5163,6 +5169,7 @@ export {
   synchronizeConfiguredConfiguration,
   synchronizeComposeVolumes,
   syncSourceRepositories,
+  syncMailDns,
   suggestRegions,
   suggestRegionPairs,
   suggestQuotaIncrease,
@@ -5313,6 +5320,7 @@ export {
   normalizeScheduleExpression,
   normalizeRuntimeStatus,
   normalizePublicIpv6,
+  normalizeDkimKey,
   nextScheduleRuns,
   networkSecurityManager,
   needsRenewal,
@@ -5586,14 +5594,18 @@ export {
   bytes,
   buildStaticSiteDeployScript,
   buildSshArgs,
+  buildSpfValue,
   buildSiteDeployScript,
   buildPhpRuntimeLayerZip,
   buildOptimizationManager,
   buildNodeRuntimeLayerZip,
   buildMediaCdnPlan,
   buildManagementDashboardArtifact,
+  buildMailDnsRecords,
   buildHostCleanupScript,
   buildFunctionEnv,
+  buildDmarcValue,
+  buildDkimValue,
   buildComposeShellCommand,
   buildComposeScaleCommand,
   buildComposeRuntimeCommand,