@stacksjs/ts-cloud 0.7.83 → 0.7.85

package/dist/{chunk-838t87x3.js → chunk-gx4288t5.js}

@@ -2045,6 +2045,59 @@ import { execSync } from "node:child_process";
 import { randomUUID } from "node:crypto";
 import { existsSync, readFileSync as readFileSync2 } from "node:fs";
 
+// src/deploy/server-dns.ts
+function collectServerDnsDomains(sites = {}) {
+  const domains = new Set;
+  for (const site of Object.values(sites)) {
+    if (!site.domain)
+      continue;
+    if (site.redirect || site.deploy === "server" || site.start)
+      domains.add(site.domain);
+  }
+  return domains;
+}
+function normalizeName(name) {
+  return name.replace(/\.$/, "").toLowerCase();
+}
+function matchesHostname(record, zone, hostname) {
+  const recordName = normalizeName(record.name);
+  const normalizedZone = normalizeName(zone);
+  const normalizedHostname = normalizeName(hostname);
+  const relativeName = normalizedHostname === normalizedZone ? "@" : normalizedHostname.endsWith(`.${normalizedZone}`) ? normalizedHostname.slice(0, -(normalizedZone.length + 1)) : normalizedHostname;
+  return recordName === normalizedHostname || recordName === relativeName || relativeName === "@" && (recordName === "" || recordName === normalizedZone);
+}
+async function removeStaleServerAddressRecords(provider, zone, hostname, desiredAddress, recordType = "A") {
+  const listed = await provider.listRecords(zone);
+  if (!listed.success)
+    return [`could not list ${recordType} records: ${listed.message || "unknown provider error"}`];
+  const matching = listed.records.filter((record) => record.type === recordType && matchesHostname(record, zone, hostname));
+  const desiredIndex = matching.findIndex((record) => record.content === desiredAddress);
+  if (matching.length <= 1 || desiredIndex === -1)
+    return [];
+  const warnings = [];
+  for (const [index, record] of matching.entries()) {
+    if (index === desiredIndex)
+      continue;
+    const result = await provider.deleteRecord(zone, record);
+    if (!result.success)
+      warnings.push(`could not remove stale ${record.name} ${recordType} ${record.content}: ${result.message || "unknown provider error"}`);
+  }
+  return warnings;
+}
+function hetznerBoxIpv6(reported) {
+  if (!reported)
+    return;
+  const trimmed = reported.trim();
+  if (!trimmed)
+    return;
+  if (!trimmed.includes("/"))
+    return trimmed;
+  const [block] = trimmed.split("/");
+  if (!block.endsWith("::"))
+    return block || undefined;
+  return `${block}1`;
+}
+
 // src/drivers/shared/fleet.ts
 function resolveFleetTopology(compute = {}) {
   const appServers = Math.max(1, compute.appServers ?? compute.instances ?? 1);
@@ -2613,6 +2666,7 @@ class HetznerDriver {
         serverId: alreadyRunning.id,
         serverName: alreadyRunning.name,
         publicIp: alreadyRunning.public_net.ipv4?.ip,
+        publicIpv6: hetznerBoxIpv6(alreadyRunning.public_net.ipv6?.ip),
         deployStoragePath: "/var/ts-cloud/staging",
         sshUser: this.sshUser
       };
@@ -2660,6 +2714,7 @@ class HetznerDriver {
       serverName: running.name,
       firewallId: firewall.id,
       publicIp: running.public_net.ipv4?.ip,
+      publicIpv6: hetznerBoxIpv6(running.public_net.ipv6?.ip),
       deployStoragePath: "/var/ts-cloud/staging",
       sshUser: this.sshUser
     };
@@ -3373,6 +3428,7 @@ ${out}`);
       deployStoragePath: state.deployStoragePath || "/var/ts-cloud/staging",
       appInstanceId: state.serverId ? String(state.serverId) : undefined,
       appPublicIp: server?.public_net.ipv4?.ip || state.publicIp,
+      appPublicIpv6: hetznerBoxIpv6(server?.public_net.ipv6?.ip) || state.publicIpv6,
       sshUser: state.sshUser || this.sshUser,
       servicesPrivateIp: state.servicesPrivateIp
     };
@@ -6198,4 +6254,4 @@ function buildCloudFrontOriginConfig(options) {
     CustomErrorResponses: { Quantity: 0 }
   };
 }
-export { PANTRY_PROJECT_DIR, pgAdminCommand, BACKUP_RUNNER_PATH, buildBackupRestoreScript, siteInstallBase, isPhpSite, resolveSiteDeployTarget, resolveSiteKind, validateDeploymentConfig, shipsARelease, DEFAULT_RPX_CERTS_DIR, normalizeRoutePath, deriveRouteId, buildRpxConfig, buildRpxLbConfig, renderRpxLauncher, RPX_DIR, RPX_LAUNCHER_PATH, RPX_SERVICE_NAME, buildRpxProvisionScript, buildRpxFragmentRefreshScript, buildUbuntuBootstrapScript, AwsDriver, resolveHetznerLocation, HetznerClient, resolveHetznerApiToken2 as resolveHetznerApiToken, normalizeSshPublicKey, wrapCloudInitUserData, HetznerDriver, LocalBoxDriver, isBoxMode, createCloudDriver, CloudDriverFactory, cloudDrivers, planHetznerServerResize, isHetznerCapacityError, executeHetznerServerResize, buildSshArgs, sshExec, sshExecOrThrow, scpUpload, waitForSsh, waitForCloudInit, collectHetznerResizeManifest, prepareHetznerResize, verifyHetznerResize, resolveHetznerHostOptimizationPlan, buildHetznerHostOptimizationScript, applyHetznerHostOptimization, collectHetznerHostOptimizationReport, verifyHetznerHostOptimization, resizeCheckpointPath, resizeLockPath, readResizeCheckpoint, writeResizeCheckpoint, acquireResizeLock, ensureSshKey, ensureFirewall, ensureServer, serverPublicIpv4, UBUNTU_2404_AMI_PARAM, buildBoxUserData, HetznerBoxProvisioner, AwsBoxProvisioner, createBoxProvisioner, releasePaths, buildRollbackScript, resolveExecStart, buildSiteDeployScript, buildStaticSiteDeployScript, releaseTarballTmpPath, buildAwsArtifactFetch, buildLocalArtifactFetch, buildHostCleanupScript, MANAGEMENT_DASHBOARD_SITE, dashboardCredentialsFile, resolveDashboardAuth, resolveUiSource, ensureManagementDashboard, buildManagementDashboardArtifact, resolveSiteFramework, deploySiteRelease, deployAllComputeSites, reloadRpxGateway, renewRpxCertificates, MANAGED_CACHE_POLICY_OPTIMIZED, MANAGED_CACHE_POLICY_DISABLED, MANAGED_ORIGIN_REQUEST_POLICY_ALL_VIEWER, buildCloudFrontOriginConfig };
+export { PANTRY_PROJECT_DIR, pgAdminCommand, BACKUP_RUNNER_PATH, buildBackupRestoreScript, siteInstallBase, isPhpSite, resolveSiteDeployTarget, resolveSiteKind, validateDeploymentConfig, shipsARelease, DEFAULT_RPX_CERTS_DIR, normalizeRoutePath, deriveRouteId, buildRpxConfig, buildRpxLbConfig, renderRpxLauncher, RPX_DIR, RPX_LAUNCHER_PATH, RPX_SERVICE_NAME, buildRpxProvisionScript, buildRpxFragmentRefreshScript, buildUbuntuBootstrapScript, AwsDriver, collectServerDnsDomains, removeStaleServerAddressRecords, hetznerBoxIpv6, resolveHetznerLocation, HetznerClient, resolveHetznerApiToken2 as resolveHetznerApiToken, normalizeSshPublicKey, wrapCloudInitUserData, HetznerDriver, LocalBoxDriver, isBoxMode, createCloudDriver, CloudDriverFactory, cloudDrivers, planHetznerServerResize, isHetznerCapacityError, executeHetznerServerResize, buildSshArgs, sshExec, sshExecOrThrow, scpUpload, waitForSsh, waitForCloudInit, collectHetznerResizeManifest, prepareHetznerResize, verifyHetznerResize, resolveHetznerHostOptimizationPlan, buildHetznerHostOptimizationScript, applyHetznerHostOptimization, collectHetznerHostOptimizationReport, verifyHetznerHostOptimization, resizeCheckpointPath, resizeLockPath, readResizeCheckpoint, writeResizeCheckpoint, acquireResizeLock, ensureSshKey, ensureFirewall, ensureServer, serverPublicIpv4, UBUNTU_2404_AMI_PARAM, buildBoxUserData, HetznerBoxProvisioner, AwsBoxProvisioner, createBoxProvisioner, releasePaths, buildRollbackScript, resolveExecStart, buildSiteDeployScript, buildStaticSiteDeployScript, releaseTarballTmpPath, buildAwsArtifactFetch, buildLocalArtifactFetch, buildHostCleanupScript, MANAGEMENT_DASHBOARD_SITE, dashboardCredentialsFile, resolveDashboardAuth, resolveUiSource, ensureManagementDashboard, buildManagementDashboardArtifact, resolveSiteFramework, deploySiteRelease, deployAllComputeSites, reloadRpxGateway, renewRpxCertificates, MANAGED_CACHE_POLICY_OPTIMIZED, MANAGED_CACHE_POLICY_DISABLED, MANAGED_ORIGIN_REQUEST_POLICY_ALL_VIEWER, buildCloudFrontOriginConfig };

package/dist/{chunk-ptf1hhsd.js → chunk-qbj74thz.js}

@@ -45,7 +45,7 @@ import {
   resolveSiteKind,
   resolveUiSource,
   siteInstallBase
-} from "./chunk-838t87x3.js";
+} from "./chunk-gx4288t5.js";
 import {
   artifactKey,
   buildCloudFormationTemplate,
@@ -88,45 +88,6 @@ import {
 import {
   __require
 } from "./chunk-v0bahtg2.js";
-// src/deploy/server-dns.ts
-function collectServerDnsDomains(sites = {}) {
-  const domains = new Set;
-  for (const site of Object.values(sites)) {
-    if (!site.domain)
-      continue;
-    if (site.redirect || site.deploy === "server" || site.start)
-      domains.add(site.domain);
-  }
-  return domains;
-}
-function normalizeName(name) {
-  return name.replace(/\.$/, "").toLowerCase();
-}
-function matchesHostname(record, zone, hostname) {
-  const recordName = normalizeName(record.name);
-  const normalizedZone = normalizeName(zone);
-  const normalizedHostname = normalizeName(hostname);
-  const relativeName = normalizedHostname === normalizedZone ? "@" : normalizedHostname.endsWith(`.${normalizedZone}`) ? normalizedHostname.slice(0, -(normalizedZone.length + 1)) : normalizedHostname;
-  return recordName === normalizedHostname || recordName === relativeName || relativeName === "@" && (recordName === "" || recordName === normalizedZone);
-}
-async function removeStaleServerAddressRecords(provider, zone, hostname, desiredAddress) {
-  const listed = await provider.listRecords(zone);
-  if (!listed.success)
-    return [`could not list A records: ${listed.message || "unknown provider error"}`];
-  const matching = listed.records.filter((record) => record.type === "A" && matchesHostname(record, zone, hostname));
-  const desiredIndex = matching.findIndex((record) => record.content === desiredAddress);
-  if (matching.length <= 1 || desiredIndex === -1)
-    return [];
-  const warnings = [];
-  for (const [index, record] of matching.entries()) {
-    if (index === desiredIndex)
-      continue;
-    const result = await provider.deleteRecord(zone, record);
-    if (!result.success)
-      warnings.push(`could not remove stale ${record.name} A ${record.content}: ${result.message || "unknown provider error"}`);
-  }
-  return warnings;
-}
 // src/deploy/dashboard-control-plane.ts
 import { createHash as createHash5 } from "node:crypto";
 
@@ -13016,7 +12977,7 @@ function normalizeHost(value) {
     throw new Error("Source host must use HTTPS");
   return `${url.protocol}//${url.host}${url.pathname.replace(/\/$/, "")}`;
 }
-function normalizeName2(value) {
+function normalizeName(value) {
   const name = value.trim();
   if (name.length < 2 || name.length > 80)
     throw new Error("Connection name must contain 2-80 characters");
@@ -13207,7 +13168,7 @@ class SourceConnectionStore {
       id,
       input.organizationId,
       input.provider,
-      normalizeName2(input.name),
+      normalizeName(input.name),
       normalizeHost(input.host),
       input.owner?.trim() || null,
       input.authKind ?? (encoded ? "access_token" : "none"),
@@ -13340,7 +13301,7 @@ class SourceConnectionStore {
     this.run(`INSERT INTO source_deploy_keys (id, connection_id, name, public_key, public_key_fingerprint, private_key_ciphertext, host, host_key, host_key_fingerprint, created_by_actor_id, created_at, updated_at) VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)`, [
       id,
       input.connectionId,
-      normalizeName2(input.name),
+      normalizeName(input.name),
       input.publicKey.trim(),
       publicFingerprint,
       this.encrypt(input.privateKey),
@@ -43156,7 +43117,7 @@ function authorizationScope(body) {
   const id2 = String(body.scopeId ?? "").trim();
   return id2 ? { type, id: id2 } : undefined;
 }
-async function resolveLiveDashboardData(config6, environment2) {
+async function resolveLiveDashboardData(config6, environment2, options = {}) {
   const mode = resolveDeploymentMode(config6);
   const meta = {
     mode,
@@ -43165,12 +43126,24 @@ async function resolveLiveDashboardData(config6, environment2) {
     project: { name: config6.project.name, slug: config6.project.slug, region: config6.project.region }
   };
   try {
-    const data = mode === "serverless" ? await resolveDashboardData(config6, environment2) : await resolveServerDashboardData(config6, environment2);
+    const data = mode === "serverless" ? await resolveDashboardData(config6, environment2) : await resolveServerDashboardData(config6, environment2, {
+      includeSiteHealth: options.includeSiteHealth
+    });
     return { ...data ?? {}, ...meta };
   } catch {
     return { ...meta };
   }
 }
+function preserveDashboardSiteSnapshot(previous, next) {
+  if (!previous)
+    return next;
+  return {
+    ...next,
+    ...Array.isArray(previous.sites) ? { sites: previous.sites } : {},
+    ...Array.isArray(previous.sitesDetail) ? { sitesDetail: previous.sitesDetail } : {},
+    ...Array.isArray(previous.siteHealth) ? { siteHealth: previous.siteHealth } : {}
+  };
+}
 function resolveUiSourceDir(cwd) {
   const candidates = [
     join13(cwd, "packages", "ui"),
@@ -43524,8 +43497,13 @@ async function startLocalDashboardServer(options = {}) {
   const initialData = await resolveLiveDashboardData(config6, defaultEnvironment);
   const latestDataByEnvironment = new Map([[defaultEnvironment, initialData]]);
   const latestDataRefreshedAtByEnvironment = new Map([[defaultEnvironment, Date.now()]]);
+  const latestSiteHealthRefreshedAtByEnvironment = new Map([
+    [defaultEnvironment, Date.now()]
+  ]);
   const liveDataRefreshesByEnvironment = new Map;
   const dashboardDataMinimumRefreshMs = Math.min(5 * 60000, Math.max(5000, Number(process.env.TS_CLOUD_DASHBOARD_REFRESH_MS) || 30000));
+  const dashboardSiteHealthMinimumRefreshMs = Math.min(30 * 60000, Math.max(60000, Number(process.env.TS_CLOUD_DASHBOARD_SITE_REFRESH_MS) || 5 * 60000));
+  const computeDashboard = resolveDeploymentMode(config6) !== "serverless";
   const refreshLatestDashboardData = (environment2) => {
     const previous = latestDataByEnvironment.get(environment2);
     if (previous && !dashboardDataRefreshDue(latestDataRefreshedAtByEnvironment.get(environment2), Date.now(), dashboardDataMinimumRefreshMs))
@@ -43533,10 +43511,14 @@ async function startLocalDashboardServer(options = {}) {
     const running = liveDataRefreshesByEnvironment.get(environment2);
     if (running)
       return running;
-    const refresh = resolveLiveDashboardData(config6, environment2).then((data) => {
+    const includeSiteHealth = !computeDashboard || dashboardDataRefreshDue(latestSiteHealthRefreshedAtByEnvironment.get(environment2), Date.now(), dashboardSiteHealthMinimumRefreshMs);
+    const refresh = resolveLiveDashboardData(config6, environment2, { includeSiteHealth }).then((refreshedData) => {
       const previous2 = latestDataByEnvironment.get(environment2);
+      const data = includeSiteHealth ? refreshedData : preserveDashboardSiteSnapshot(previous2, refreshedData);
       latestDataByEnvironment.set(environment2, data);
       latestDataRefreshedAtByEnvironment.set(environment2, Date.now());
+      if (includeSiteHealth)
+        latestSiteHealthRefreshedAtByEnvironment.set(environment2, Date.now());
       if (previous2?._serverReachable !== data._serverReachable || previous2?._metricsStatus !== data._metricsStatus || (previous2?.sitesDetail?.length ?? 0) !== (data.sitesDetail?.length ?? 0))
         clearUiCache();
       return data;
@@ -43549,7 +43531,7 @@ async function startLocalDashboardServer(options = {}) {
   const backgroundTelemetryEnabled = options.box && telemetryPreference !== "0" && (telemetryPreference === "1" || !config6.cloud?.attachTo);
   if (backgroundTelemetryEnabled) {
     let telemetryCollectionRunning = false;
-    let nextSiteHealthCollectionAt = 0;
+    let nextSiteHealthCollectionAt = Date.now() + 5 * 60000;
     const collectHostHistory = async () => {
       if (telemetryCollectionRunning)
         return;
@@ -49135,4 +49117,4 @@ data: ${JSON.stringify({ cursor: position, at: new Date().toISOString() })}
   };
   return { server, url: `http://${host2}:${server.port}/` };
 }
-export { defaultConfig4 as defaultConfig, getConfig, loadCloudConfig, config5 as config, encodeBase32, decodeBase32, hotp, totp, verifyTotp, matchTotpCounter, totpUri, AUTH_SESSION_IDLE_TTL_MS, AUTH_SESSION_ABSOLUTE_TTL_MS, AUTH_ACTION_TOKEN_TTL_MS, AUTH_MFA_CHALLENGE_TTL_MS, AUTH_OIDC_TRANSACTION_TTL_MS, AuthenticationStore, sendAuthenticationEmail, authEncryptionKeyFile, resolveAuthEncryptionKey, sanitizeOidcReturnPath, discoverOidcProvider, beginOidcAuthorization, completeOidcAuthorization, CONTROL_PLANE_SCHEMA_VERSION, controlPlaneMigrations, AUTHORIZATION_CAPABILITIES, roleCapabilities, scopeContains, authorizeOrganization, effectiveCapabilities, OptimisticConcurrencyError, InvalidOperationTransitionError, UnsupportedSchemaVersionError, controlPlaneDatabaseFile, MAX_CONTROL_PLANE_JSON_BYTES, MAX_CONTROL_PLANE_ERROR_BYTES, sanitizeControlPlaneValue, ControlPlaneStore, searchControlPlane, API_TOKEN_DEFAULT_TTL_MS, API_TOKEN_MAX_TTL_MS, API_IDEMPOTENCY_TTL_MS, AutomationIdentityStore, TsCloudApiError, TsCloudClient, parseCompose, exportCompose, diffCompose, listComposeTemplates, getComposeTemplate, renderComposeTemplate, parseComposeCatalog, planComposeTemplateUpgrade, composeProjectName, buildComposeRuntimeCommand, buildComposeScaleCommand, buildComposeLogsCommand, buildComposeShellCommand, QueueCancellationError, QueueTimeoutError, RetryableOperationError, DurableOperationQueue, DurableQueueWorker, PreviewEnvironmentStore, PreviewEnvironmentService, DEPLOYMENT_QUEUE_KINDS, resolveQueuedDeploymentCommand, createDeploymentQueueHandlers, unsupportedVolumeCapabilities, volumeCapabilities, validateMountPath, validateAttachment, VolumeService, createVolumeQueueHandlers, DockerNamedVolumeDriver, ServerPathVolumeDriver, CloudBlockVolumeDriver, VolumeStore, synchronizeComposeVolumes, completeComposeVolumeDeletion, ComposeApplicationStore, ComposeApplicationService, releaseStrategyCapabilities, assertReleaseStrategy, ReleaseStore, ReleaseService, releaseTrafficPlan, activateImmutableRelease, rollbackImmutableRelease, RELEASE_QUEUE_KINDS, createReleaseQueueHandlers, SourceConnectionStore, SourceProviderError, GithubSourceAdapter, GitlabSourceAdapter, BitbucketSourceAdapter, GiteaSourceAdapter, createSourceAdapter, normalizeSourceEvent, processSourceWebhook, webhookEndpoint, discoverGitRefs, cloneSourceBinding, testSourceConnection, syncSourceRepositories, listSourceReferences, reconcileSourceWebhook, removeSourceWebhook, API_VERSION, openApiDocument, ApiServiceError, requestHash, AutomationApiService, createApiV1Handler, SecurityPostureStore, SECRET_PATTERNS, PreDeployScanner, scanForSecrets, formatScanResults, SecurityScannerRunner, SecretFindingScanner, TrivyImageScanner, AwsIamCapabilityScanner, generateCycloneDxSbom, generateImageSbom, attachSbomToRelease, attachVulnerabilitySummary, createReleaseProvenance, attachProvenanceToRelease, verifyArtifactSignature, securityScope, ensureDefaultSecurityPolicies, recordPreDeploySecretScan, recordSkippedSecretScan, recordDashboardHostPosture, productionChangeReview, secureContainerRelease, runtimeId2 as runtimeId, unsupportedCapabilities, capabilities2 as capabilities, normalizeRuntimeStatus, redactRuntimeConfig, ageSeconds, bytes, discoverRuntimeInventory, ecsWorkloads, lambdaWorkloads, parseDockerInspect, dockerWorkloads, DockerDiscoveryAdapter, parseSystemdRecords, systemdWorkloads, SystemdDiscoveryAdapter, EcsRuntimeAdapter, LambdaRuntimeAdapter, createRuntimeAdapters, resolveRuntimeInventory, authorizeRuntimePath, DIAGNOSTIC_PRESETS, RuntimeOperationService, RuntimeStreamRegistry, DEFAULT_TELEMETRY_POLICY, normalizeTelemetryPolicy, telemetryPolicyKey, loadTelemetryPolicy, saveTelemetryPolicy, telemetryEstimatedMonthlyCost, redactTelemetryText, redactTelemetryValue, pathTemplate, telemetryCursor, telemetryPercentile, telemetryBucketLabel, TelemetryStore, AlertStore, AlertEvaluator, isQuietHours, NotificationRouter, HealthCheckRunner, evaluateTelemetryAlertRules, normalizeScheduleExpression, nextScheduleRuns, previewSchedule, jobProviderCapability, renderServerCron, eventBridgeScheduleInput, reconcileJobObservation, desiredState, ServerCronJobAdapter, EventBridgeJobAdapter, JobProviderReconciler, synchronizeConfiguredJobs, JobService, createJobQueueHandlers, JobStore, dataServiceCapabilities, DataServiceStore, connectionGuidance, DataServiceLifecycle, createDataServiceQueueHandlers, AwsRdsDataAdapter, AwsAuroraDataAdapter, AwsElastiCacheDataAdapter, ServerDataAdapter, ContainerDataAdapter, AwsRdsTransport, AwsAuroraTransport, AwsElastiCacheTransport, BunDockerRuntime, DockerDataTransport, EncryptedDataSecretStore, SystemFleetSshTransport, SshFleetDriver, createFleetQueueHandlers, FleetStore, FleetService, zeroCapacity, capacity, PlacementStore, PlacementService, RemoteBuildService, createRemoteBuildQueueHandlers, TransportRemoteBuildDriver, createServerBuildDriver, createEcsBuildDriver, createAsgBuildDriver, RegionStore, RegionService, createRegionQueueHandlers, AwsRegionalDriver, UnavailableRegionalDriver, canonicalJson, manifestDigest, documentDigest, publicKeyFingerprint, verifyUpdateSignature, updateCompatibility, MaintenanceStore, maintenanceWindowOpen, MaintenanceService, createMaintenanceQueueHandlers, TransportPlatformMaintenanceDriver, ControlPlaneCleanupDriver, TransportDisasterRecoveryDriver, collectServerDnsDomains, removeStaleServerAddressRecords, ensureDashboardActor, initializeDashboardControlPlane, synchronizeDashboardUsers, trackDashboardOperation, dashboardPageRoutes, resolveLegacyDashboardRoute, routesForDashboard, deploySite, createStaticApiOriginDependencies, deployStaticApiOrigin, verifyStaticApiOrigin, estimateStaticApiOriginMonthlyCost, createExistingStaticFullStackDependencies, generateExistingStaticFullStackTemplate, deployExistingStaticFullStack, estimateExistingStaticFullStackMonthlyCost, hashContainerContext, createContainerImageDependencies, buildAndPushContainerImage, infraEnvFromOutputs, buildFunctionEnv, deployServerlessApp, redeployServerlessApp, rollbackServerlessApp, setMaintenance, runRemoteCommand, resolveDashboardData, validateBackupDestination, BackupStore, encryptBackup, decryptBackup, backupCredentialStatus, S3BackupDestinationAdapter, BackupCoordinator, createBackupQueueHandlers, AwsDatabaseBackupSource, compressBackup, decompressBackup, BunFilesystemArchiveRuntime, FilesystemBackupSource, LogicalDatabaseBackupSource, BunDockerVolumeRuntime, DockerVolumeBackupSource, ControlPlaneBackupSource, AwsInfrastructureBackupSource, ConfigurationStore, parseDotenv, serializeDotenv, LocalEncryptedConfigurationBackend, AwsSecretsManagerConfigurationBackend, AwsSsmConfigurationBackend, ExternalConfigurationBackend, ConfigurationService, synchronizeConfiguredConfiguration, sanitizeCloudConfig, dashboardActions, resolveDashboardAction, startLocalDashboardServer };
+export { defaultConfig4 as defaultConfig, getConfig, loadCloudConfig, config5 as config, encodeBase32, decodeBase32, hotp, totp, verifyTotp, matchTotpCounter, totpUri, AUTH_SESSION_IDLE_TTL_MS, AUTH_SESSION_ABSOLUTE_TTL_MS, AUTH_ACTION_TOKEN_TTL_MS, AUTH_MFA_CHALLENGE_TTL_MS, AUTH_OIDC_TRANSACTION_TTL_MS, AuthenticationStore, sendAuthenticationEmail, authEncryptionKeyFile, resolveAuthEncryptionKey, sanitizeOidcReturnPath, discoverOidcProvider, beginOidcAuthorization, completeOidcAuthorization, CONTROL_PLANE_SCHEMA_VERSION, controlPlaneMigrations, AUTHORIZATION_CAPABILITIES, roleCapabilities, scopeContains, authorizeOrganization, effectiveCapabilities, OptimisticConcurrencyError, InvalidOperationTransitionError, UnsupportedSchemaVersionError, controlPlaneDatabaseFile, MAX_CONTROL_PLANE_JSON_BYTES, MAX_CONTROL_PLANE_ERROR_BYTES, sanitizeControlPlaneValue, ControlPlaneStore, searchControlPlane, API_TOKEN_DEFAULT_TTL_MS, API_TOKEN_MAX_TTL_MS, API_IDEMPOTENCY_TTL_MS, AutomationIdentityStore, TsCloudApiError, TsCloudClient, parseCompose, exportCompose, diffCompose, listComposeTemplates, getComposeTemplate, renderComposeTemplate, parseComposeCatalog, planComposeTemplateUpgrade, composeProjectName, buildComposeRuntimeCommand, buildComposeScaleCommand, buildComposeLogsCommand, buildComposeShellCommand, QueueCancellationError, QueueTimeoutError, RetryableOperationError, DurableOperationQueue, DurableQueueWorker, PreviewEnvironmentStore, PreviewEnvironmentService, DEPLOYMENT_QUEUE_KINDS, resolveQueuedDeploymentCommand, createDeploymentQueueHandlers, unsupportedVolumeCapabilities, volumeCapabilities, validateMountPath, validateAttachment, VolumeService, createVolumeQueueHandlers, DockerNamedVolumeDriver, ServerPathVolumeDriver, CloudBlockVolumeDriver, VolumeStore, synchronizeComposeVolumes, completeComposeVolumeDeletion, ComposeApplicationStore, ComposeApplicationService, releaseStrategyCapabilities, assertReleaseStrategy, ReleaseStore, ReleaseService, releaseTrafficPlan, activateImmutableRelease, rollbackImmutableRelease, RELEASE_QUEUE_KINDS, createReleaseQueueHandlers, SourceConnectionStore, SourceProviderError, GithubSourceAdapter, GitlabSourceAdapter, BitbucketSourceAdapter, GiteaSourceAdapter, createSourceAdapter, normalizeSourceEvent, processSourceWebhook, webhookEndpoint, discoverGitRefs, cloneSourceBinding, testSourceConnection, syncSourceRepositories, listSourceReferences, reconcileSourceWebhook, removeSourceWebhook, API_VERSION, openApiDocument, ApiServiceError, requestHash, AutomationApiService, createApiV1Handler, SecurityPostureStore, SECRET_PATTERNS, PreDeployScanner, scanForSecrets, formatScanResults, SecurityScannerRunner, SecretFindingScanner, TrivyImageScanner, AwsIamCapabilityScanner, generateCycloneDxSbom, generateImageSbom, attachSbomToRelease, attachVulnerabilitySummary, createReleaseProvenance, attachProvenanceToRelease, verifyArtifactSignature, securityScope, ensureDefaultSecurityPolicies, recordPreDeploySecretScan, recordSkippedSecretScan, recordDashboardHostPosture, productionChangeReview, secureContainerRelease, runtimeId2 as runtimeId, unsupportedCapabilities, capabilities2 as capabilities, normalizeRuntimeStatus, redactRuntimeConfig, ageSeconds, bytes, discoverRuntimeInventory, ecsWorkloads, lambdaWorkloads, parseDockerInspect, dockerWorkloads, DockerDiscoveryAdapter, parseSystemdRecords, systemdWorkloads, SystemdDiscoveryAdapter, EcsRuntimeAdapter, LambdaRuntimeAdapter, createRuntimeAdapters, resolveRuntimeInventory, authorizeRuntimePath, DIAGNOSTIC_PRESETS, RuntimeOperationService, RuntimeStreamRegistry, DEFAULT_TELEMETRY_POLICY, normalizeTelemetryPolicy, telemetryPolicyKey, loadTelemetryPolicy, saveTelemetryPolicy, telemetryEstimatedMonthlyCost, redactTelemetryText, redactTelemetryValue, pathTemplate, telemetryCursor, telemetryPercentile, telemetryBucketLabel, TelemetryStore, AlertStore, AlertEvaluator, isQuietHours, NotificationRouter, HealthCheckRunner, evaluateTelemetryAlertRules, normalizeScheduleExpression, nextScheduleRuns, previewSchedule, jobProviderCapability, renderServerCron, eventBridgeScheduleInput, reconcileJobObservation, desiredState, ServerCronJobAdapter, EventBridgeJobAdapter, JobProviderReconciler, synchronizeConfiguredJobs, JobService, createJobQueueHandlers, JobStore, dataServiceCapabilities, DataServiceStore, connectionGuidance, DataServiceLifecycle, createDataServiceQueueHandlers, AwsRdsDataAdapter, AwsAuroraDataAdapter, AwsElastiCacheDataAdapter, ServerDataAdapter, ContainerDataAdapter, AwsRdsTransport, AwsAuroraTransport, AwsElastiCacheTransport, BunDockerRuntime, DockerDataTransport, EncryptedDataSecretStore, SystemFleetSshTransport, SshFleetDriver, createFleetQueueHandlers, FleetStore, FleetService, zeroCapacity, capacity, PlacementStore, PlacementService, RemoteBuildService, createRemoteBuildQueueHandlers, TransportRemoteBuildDriver, createServerBuildDriver, createEcsBuildDriver, createAsgBuildDriver, RegionStore, RegionService, createRegionQueueHandlers, AwsRegionalDriver, UnavailableRegionalDriver, canonicalJson, manifestDigest, documentDigest, publicKeyFingerprint, verifyUpdateSignature, updateCompatibility, MaintenanceStore, maintenanceWindowOpen, MaintenanceService, createMaintenanceQueueHandlers, TransportPlatformMaintenanceDriver, ControlPlaneCleanupDriver, TransportDisasterRecoveryDriver, ensureDashboardActor, initializeDashboardControlPlane, synchronizeDashboardUsers, trackDashboardOperation, dashboardPageRoutes, resolveLegacyDashboardRoute, routesForDashboard, deploySite, createStaticApiOriginDependencies, deployStaticApiOrigin, verifyStaticApiOrigin, estimateStaticApiOriginMonthlyCost, createExistingStaticFullStackDependencies, generateExistingStaticFullStackTemplate, deployExistingStaticFullStack, estimateExistingStaticFullStackMonthlyCost, hashContainerContext, createContainerImageDependencies, buildAndPushContainerImage, infraEnvFromOutputs, buildFunctionEnv, deployServerlessApp, redeployServerlessApp, rollbackServerlessApp, setMaintenance, runRemoteCommand, resolveDashboardData, validateBackupDestination, BackupStore, encryptBackup, decryptBackup, backupCredentialStatus, S3BackupDestinationAdapter, BackupCoordinator, createBackupQueueHandlers, AwsDatabaseBackupSource, compressBackup, decompressBackup, BunFilesystemArchiveRuntime, FilesystemBackupSource, LogicalDatabaseBackupSource, BunDockerVolumeRuntime, DockerVolumeBackupSource, ControlPlaneBackupSource, AwsInfrastructureBackupSource, ConfigurationStore, parseDotenv, serializeDotenv, LocalEncryptedConfigurationBackend, AwsSecretsManagerConfigurationBackend, AwsSsmConfigurationBackend, ExternalConfigurationBackend, ConfigurationService, synchronizeConfiguredConfiguration, sanitizeCloudConfig, dashboardActions, resolveDashboardAction, startLocalDashboardServer };

package/dist/deploy/index.js

@@ -1,7 +1,6 @@
 import {
   buildAndPushContainerImage,
   buildFunctionEnv,
-  collectServerDnsDomains,
   createContainerImageDependencies,
   createExistingStaticFullStackDependencies,
   createStaticApiOriginDependencies,
@@ -19,7 +18,6 @@ import {
   infraEnvFromOutputs,
   initializeDashboardControlPlane,
   redeployServerlessApp,
-  removeStaleServerAddressRecords,
   resolveDashboardAction,
   resolveDashboardData,
   resolveLegacyDashboardRoute,
@@ -32,7 +30,7 @@ import {
   synchronizeDashboardUsers,
   trackDashboardOperation,
   verifyStaticApiOrigin
-} from "../chunk-ptf1hhsd.js";
+} from "../chunk-qbj74thz.js";
 import {
   deleteStaticSite,
   deployStaticSite,
@@ -55,9 +53,12 @@ import"../chunk-gttvakpv.js";
 import {
   MANAGEMENT_DASHBOARD_SITE,
   buildManagementDashboardArtifact,
+  collectServerDnsDomains,
   dashboardCredentialsFile,
   ensureManagementDashboard,
+  hetznerBoxIpv6,
   isPhpSite,
+  removeStaleServerAddressRecords,
   resolveDashboardAuth,
   resolveSiteDeployTarget,
   resolveSiteKind,
@@ -65,7 +66,7 @@ import {
   shipsARelease,
   siteInstallBase,
   validateDeploymentConfig
-} from "../chunk-838t87x3.js";
+} from "../chunk-gx4288t5.js";
 import"../chunk-1qjyqrc5.js";
 import"../chunk-703nkybg.js";
 import"../chunk-4cjrg98a.js";
@@ -101,6 +102,7 @@ export {
   invalidateCache,
   initializeDashboardControlPlane,
   infraEnvFromOutputs,
+  hetznerBoxIpv6,
   hashContainerContext,
   generateStaticSiteTemplate,
   generateExternalDnsStaticSiteTemplate,

package/dist/deploy/local-dashboard-server.d.ts

@@ -48,6 +48,7 @@ export declare function resolveDashboardEnvironment(available: readonly string[]
 export declare function dashboardDataRefreshDue(lastRefreshedAt: number | undefined, now: number, minimumIntervalMs: number): boolean;
 /** Reject browser cross-site mutations while retaining header-light CLI access. */
 export declare function isTrustedMutationRequest(req: Request): boolean;
+export declare function preserveDashboardSiteSnapshot(previous: Record<string, any> | undefined, next: Record<string, any>): Record<string, any>;
 export declare function sanitizeCloudConfig(config: CloudConfig): Record<string, any>;
 export declare function dashboardActions(environment: EnvironmentType): DashboardAction[];
 export declare function resolveDashboardAction(id: string, environment: EnvironmentType): DashboardAction | undefined;

package/dist/deploy/server-dns.d.ts

@@ -9,8 +9,23 @@ interface ServerSite {
 export declare function collectServerDnsDomains(sites?: Record<string, ServerSite>): Set<string>;
 /**
  * A compute deployment owns one address per managed hostname. After an upsert,
- * remove only duplicate A records for that exact hostname, preserving one copy
- * of the desired address and leaving every unrelated record untouched.
+ * remove only duplicate address records for that exact hostname, preserving one
+ * copy of the desired address and leaving every unrelated record untouched.
+ *
+ * `recordType` selects the family. It used to be hardcoded to 'A', which meant
+ * a dual-stack box could clean up its stale IPv4 records but accumulated stale
+ * AAAA ones forever — and a stale AAAA is worse than a stale A, because
+ * dual-stack clients prefer IPv6 and would keep landing on the dead address.
  */
-export declare function removeStaleServerAddressRecords(provider: DnsProvider, zone: string, hostname: string, desiredAddress: string): Promise<string[]>;
+export declare function removeStaleServerAddressRecords(provider: DnsProvider, zone: string, hostname: string, desiredAddress: string, recordType?: 'A' | 'AAAA'): Promise<string[]>;
+/**
+ * Hetzner hands a cloud server a routed /64 and configures `::1` inside it on
+ * the interface, but the API reports the block (`2a01:4f8:c014:6186::/64`), not
+ * the address. Publishing the block verbatim as an AAAA record yields a host
+ * nothing answers on, so turn it into the address the box actually holds.
+ *
+ * A plain address (no prefix) is returned unchanged, so this is safe to apply
+ * to whatever the driver surfaced.
+ */
+export declare function hetznerBoxIpv6(reported: string | undefined | null): string | undefined;
 export {};

package/dist/drivers/hetzner/state.d.ts

@@ -6,6 +6,14 @@ export interface HetznerDriverState {
     serverName?: string;
     firewallId?: number;
     publicIp?: string;
+    /**
+     * The box's public IPv6 address, already narrowed from the routed /64 the
+     * API reports to the address the interface actually holds. Recorded so a
+     * deploy can publish AAAA records alongside the A records without having to
+     * call the Hetzner API again — attach-mode tenants read this state and never
+     * see the server object at all.
+     */
+    publicIpv6?: string;
     deployStoragePath?: string;
     sshUser?: string;
     /** Fleet: network/LB ids + the services box private IP, for deploy + teardown. */

package/dist/drivers/index.js

@@ -68,7 +68,7 @@ import {
   waitForSsh,
   wrapCloudInitUserData,
   writeResizeCheckpoint
-} from "../chunk-838t87x3.js";
+} from "../chunk-gx4288t5.js";
 import"../chunk-1qjyqrc5.js";
 import"../chunk-703nkybg.js";
 import"../chunk-4cjrg98a.js";

package/dist/index.d.ts

@@ -30,7 +30,7 @@ export { keyMatchesFilters, migrateObjectStorage, remapKey } from './object-stor
 export type { MigrateEndpoint, MigrateError, MigrateOptions, MigratePlanItem, MigrateProgress, MigrateResult, MigrateVerification, } from './object-storage/migrate';
 export * from './ssl';
 export { deployStaticSite, deployStaticSiteFull, uploadStaticFiles, invalidateCache, deleteStaticSite, generateStaticSiteTemplate, deployStaticSiteWithExternalDns, deployStaticSiteWithExternalDnsFull, generateExternalDnsStaticSiteTemplate, deploySite, resolveSiteDeployTarget, resolveSiteKind, validateDeploymentConfig, buildAndPushServerlessImage, buildFunctionEnv, deployServerlessApp, infraEnvFromOutputs, redeployServerlessApp, rollbackServerlessApp, runRemoteCommand, setMaintenance, buildManagementDashboardArtifact, dashboardCredentialsFile, ensureManagementDashboard, MANAGEMENT_DASHBOARD_SITE, resolveDashboardAuth, resolveUiSource, } from './deploy';
-export { collectServerDnsDomains, removeStaleServerAddressRecords } from './deploy/server-dns';
+export { collectServerDnsDomains, hetznerBoxIpv6, removeStaleServerAddressRecords } from './deploy/server-dns';
 export type { EnsureDashboardLogger, ResolvedDashboardAuth, StaticSiteConfig, DeployResult, UploadOptions, ExternalDnsStaticSiteConfig, ExternalDnsDeployResult, DeploySiteConfig, DeploySiteResult, StaticSiteDnsProvider, SiteDeployKind, DeploymentValidationResult, BuildImageOptions, BuiltImage, CodeSource, DeployServerlessOptions, ResolvedContext, } from './deploy';
 export { createCloudDriver, CloudDriverFactory, cloudDrivers, AwsDriver, HetznerDriver, HetznerClient, resolveHetznerApiToken, normalizeSshPublicKey, ensureFirewall, ensureServer, ensureSshKey, serverPublicIpv4, sshExec, sshExecOrThrow, scpUpload, waitForSsh, waitForCloudInit, buildSshArgs, generateUbuntuAppCloudInit, wrapCloudInitUserData, buildHostCleanupScript, buildSiteDeployScript, buildStaticSiteDeployScript, resolveExecStart, deployAllComputeSites, deploySiteRelease, } from './drivers';
 export type { CreateCloudDriverOptions } from './drivers/factory';

package/dist/index.js

@@ -139,7 +139,6 @@ import {
   capabilities,
   capacity,
   cloneSourceBinding,
-  collectServerDnsDomains,
   completeComposeVolumeDeletion,
   completeOidcAuthorization,
   composeProjectName,
@@ -234,7 +233,6 @@ import {
   releaseStrategyCapabilities,
   releaseTrafficPlan,
   removeSourceWebhook,
-  removeStaleServerAddressRecords,
   renderComposeTemplate,
   renderServerCron,
   requestHash,
@@ -285,7 +283,7 @@ import {
   volumeCapabilities,
   webhookEndpoint,
   zeroCapacity
-} from "./chunk-ptf1hhsd.js";
+} from "./chunk-qbj74thz.js";
 import {
   deleteStaticSite,
   deployStaticSite,
@@ -375,6 +373,7 @@ import {
   buildStaticSiteDeployScript,
   buildUbuntuBootstrapScript,
   cloudDrivers,
+  collectServerDnsDomains,
   createCloudDriver,
   dashboardCredentialsFile,
   deployAllComputeSites,
@@ -383,7 +382,9 @@ import {
   ensureManagementDashboard,
   ensureServer,
   ensureSshKey,
+  hetznerBoxIpv6,
   normalizeSshPublicKey,
+  removeStaleServerAddressRecords,
   resolveDashboardAuth,
   resolveExecStart,
   resolveHetznerApiToken,
@@ -398,7 +399,7 @@ import {
   waitForCloudInit,
   waitForSsh,
   wrapCloudInitUserData
-} from "./chunk-838t87x3.js";
+} from "./chunk-gx4288t5.js";
 import {
   ABTestManager,
   AI,
@@ -5345,6 +5346,7 @@ export {
   infraEnvFromOutputs,
   imageScanningManager,
   hotp,
+  hetznerBoxIpv6,
   healthCheckManager,
   hashString,
   hashManifest,