@stacksjs/ts-cloud 0.7.84 → 0.7.85

package/dist/{chunk-838t87x3.js → chunk-gx4288t5.js}

@@ -2045,6 +2045,59 @@ import { execSync } from "node:child_process";
 import { randomUUID } from "node:crypto";
 import { existsSync, readFileSync as readFileSync2 } from "node:fs";
 
+// src/deploy/server-dns.ts
+function collectServerDnsDomains(sites = {}) {
+  const domains = new Set;
+  for (const site of Object.values(sites)) {
+    if (!site.domain)
+      continue;
+    if (site.redirect || site.deploy === "server" || site.start)
+      domains.add(site.domain);
+  }
+  return domains;
+}
+function normalizeName(name) {
+  return name.replace(/\.$/, "").toLowerCase();
+}
+function matchesHostname(record, zone, hostname) {
+  const recordName = normalizeName(record.name);
+  const normalizedZone = normalizeName(zone);
+  const normalizedHostname = normalizeName(hostname);
+  const relativeName = normalizedHostname === normalizedZone ? "@" : normalizedHostname.endsWith(`.${normalizedZone}`) ? normalizedHostname.slice(0, -(normalizedZone.length + 1)) : normalizedHostname;
+  return recordName === normalizedHostname || recordName === relativeName || relativeName === "@" && (recordName === "" || recordName === normalizedZone);
+}
+async function removeStaleServerAddressRecords(provider, zone, hostname, desiredAddress, recordType = "A") {
+  const listed = await provider.listRecords(zone);
+  if (!listed.success)
+    return [`could not list ${recordType} records: ${listed.message || "unknown provider error"}`];
+  const matching = listed.records.filter((record) => record.type === recordType && matchesHostname(record, zone, hostname));
+  const desiredIndex = matching.findIndex((record) => record.content === desiredAddress);
+  if (matching.length <= 1 || desiredIndex === -1)
+    return [];
+  const warnings = [];
+  for (const [index, record] of matching.entries()) {
+    if (index === desiredIndex)
+      continue;
+    const result = await provider.deleteRecord(zone, record);
+    if (!result.success)
+      warnings.push(`could not remove stale ${record.name} ${recordType} ${record.content}: ${result.message || "unknown provider error"}`);
+  }
+  return warnings;
+}
+function hetznerBoxIpv6(reported) {
+  if (!reported)
+    return;
+  const trimmed = reported.trim();
+  if (!trimmed)
+    return;
+  if (!trimmed.includes("/"))
+    return trimmed;
+  const [block] = trimmed.split("/");
+  if (!block.endsWith("::"))
+    return block || undefined;
+  return `${block}1`;
+}
+
 // src/drivers/shared/fleet.ts
 function resolveFleetTopology(compute = {}) {
   const appServers = Math.max(1, compute.appServers ?? compute.instances ?? 1);
@@ -2613,6 +2666,7 @@ class HetznerDriver {
         serverId: alreadyRunning.id,
         serverName: alreadyRunning.name,
         publicIp: alreadyRunning.public_net.ipv4?.ip,
+        publicIpv6: hetznerBoxIpv6(alreadyRunning.public_net.ipv6?.ip),
         deployStoragePath: "/var/ts-cloud/staging",
         sshUser: this.sshUser
       };
@@ -2660,6 +2714,7 @@ class HetznerDriver {
       serverName: running.name,
       firewallId: firewall.id,
       publicIp: running.public_net.ipv4?.ip,
+      publicIpv6: hetznerBoxIpv6(running.public_net.ipv6?.ip),
       deployStoragePath: "/var/ts-cloud/staging",
       sshUser: this.sshUser
     };
@@ -3373,6 +3428,7 @@ ${out}`);
       deployStoragePath: state.deployStoragePath || "/var/ts-cloud/staging",
       appInstanceId: state.serverId ? String(state.serverId) : undefined,
       appPublicIp: server?.public_net.ipv4?.ip || state.publicIp,
+      appPublicIpv6: hetznerBoxIpv6(server?.public_net.ipv6?.ip) || state.publicIpv6,
       sshUser: state.sshUser || this.sshUser,
       servicesPrivateIp: state.servicesPrivateIp
     };
@@ -6198,4 +6254,4 @@ function buildCloudFrontOriginConfig(options) {
     CustomErrorResponses: { Quantity: 0 }
   };
 }
-export { PANTRY_PROJECT_DIR, pgAdminCommand, BACKUP_RUNNER_PATH, buildBackupRestoreScript, siteInstallBase, isPhpSite, resolveSiteDeployTarget, resolveSiteKind, validateDeploymentConfig, shipsARelease, DEFAULT_RPX_CERTS_DIR, normalizeRoutePath, deriveRouteId, buildRpxConfig, buildRpxLbConfig, renderRpxLauncher, RPX_DIR, RPX_LAUNCHER_PATH, RPX_SERVICE_NAME, buildRpxProvisionScript, buildRpxFragmentRefreshScript, buildUbuntuBootstrapScript, AwsDriver, resolveHetznerLocation, HetznerClient, resolveHetznerApiToken2 as resolveHetznerApiToken, normalizeSshPublicKey, wrapCloudInitUserData, HetznerDriver, LocalBoxDriver, isBoxMode, createCloudDriver, CloudDriverFactory, cloudDrivers, planHetznerServerResize, isHetznerCapacityError, executeHetznerServerResize, buildSshArgs, sshExec, sshExecOrThrow, scpUpload, waitForSsh, waitForCloudInit, collectHetznerResizeManifest, prepareHetznerResize, verifyHetznerResize, resolveHetznerHostOptimizationPlan, buildHetznerHostOptimizationScript, applyHetznerHostOptimization, collectHetznerHostOptimizationReport, verifyHetznerHostOptimization, resizeCheckpointPath, resizeLockPath, readResizeCheckpoint, writeResizeCheckpoint, acquireResizeLock, ensureSshKey, ensureFirewall, ensureServer, serverPublicIpv4, UBUNTU_2404_AMI_PARAM, buildBoxUserData, HetznerBoxProvisioner, AwsBoxProvisioner, createBoxProvisioner, releasePaths, buildRollbackScript, resolveExecStart, buildSiteDeployScript, buildStaticSiteDeployScript, releaseTarballTmpPath, buildAwsArtifactFetch, buildLocalArtifactFetch, buildHostCleanupScript, MANAGEMENT_DASHBOARD_SITE, dashboardCredentialsFile, resolveDashboardAuth, resolveUiSource, ensureManagementDashboard, buildManagementDashboardArtifact, resolveSiteFramework, deploySiteRelease, deployAllComputeSites, reloadRpxGateway, renewRpxCertificates, MANAGED_CACHE_POLICY_OPTIMIZED, MANAGED_CACHE_POLICY_DISABLED, MANAGED_ORIGIN_REQUEST_POLICY_ALL_VIEWER, buildCloudFrontOriginConfig };
+export { PANTRY_PROJECT_DIR, pgAdminCommand, BACKUP_RUNNER_PATH, buildBackupRestoreScript, siteInstallBase, isPhpSite, resolveSiteDeployTarget, resolveSiteKind, validateDeploymentConfig, shipsARelease, DEFAULT_RPX_CERTS_DIR, normalizeRoutePath, deriveRouteId, buildRpxConfig, buildRpxLbConfig, renderRpxLauncher, RPX_DIR, RPX_LAUNCHER_PATH, RPX_SERVICE_NAME, buildRpxProvisionScript, buildRpxFragmentRefreshScript, buildUbuntuBootstrapScript, AwsDriver, collectServerDnsDomains, removeStaleServerAddressRecords, hetznerBoxIpv6, resolveHetznerLocation, HetznerClient, resolveHetznerApiToken2 as resolveHetznerApiToken, normalizeSshPublicKey, wrapCloudInitUserData, HetznerDriver, LocalBoxDriver, isBoxMode, createCloudDriver, CloudDriverFactory, cloudDrivers, planHetznerServerResize, isHetznerCapacityError, executeHetznerServerResize, buildSshArgs, sshExec, sshExecOrThrow, scpUpload, waitForSsh, waitForCloudInit, collectHetznerResizeManifest, prepareHetznerResize, verifyHetznerResize, resolveHetznerHostOptimizationPlan, buildHetznerHostOptimizationScript, applyHetznerHostOptimization, collectHetznerHostOptimizationReport, verifyHetznerHostOptimization, resizeCheckpointPath, resizeLockPath, readResizeCheckpoint, writeResizeCheckpoint, acquireResizeLock, ensureSshKey, ensureFirewall, ensureServer, serverPublicIpv4, UBUNTU_2404_AMI_PARAM, buildBoxUserData, HetznerBoxProvisioner, AwsBoxProvisioner, createBoxProvisioner, releasePaths, buildRollbackScript, resolveExecStart, buildSiteDeployScript, buildStaticSiteDeployScript, releaseTarballTmpPath, buildAwsArtifactFetch, buildLocalArtifactFetch, buildHostCleanupScript, MANAGEMENT_DASHBOARD_SITE, dashboardCredentialsFile, resolveDashboardAuth, resolveUiSource, ensureManagementDashboard, buildManagementDashboardArtifact, resolveSiteFramework, deploySiteRelease, deployAllComputeSites, reloadRpxGateway, renewRpxCertificates, MANAGED_CACHE_POLICY_OPTIMIZED, MANAGED_CACHE_POLICY_DISABLED, MANAGED_ORIGIN_REQUEST_POLICY_ALL_VIEWER, buildCloudFrontOriginConfig };

package/dist/{chunk-8m38yfba.js → chunk-qbj74thz.js}

@@ -45,7 +45,7 @@ import {
   resolveSiteKind,
   resolveUiSource,
   siteInstallBase
-} from "./chunk-838t87x3.js";
+} from "./chunk-gx4288t5.js";
 import {
   artifactKey,
   buildCloudFormationTemplate,
@@ -88,45 +88,6 @@ import {
 import {
   __require
 } from "./chunk-v0bahtg2.js";
-// src/deploy/server-dns.ts
-function collectServerDnsDomains(sites = {}) {
-  const domains = new Set;
-  for (const site of Object.values(sites)) {
-    if (!site.domain)
-      continue;
-    if (site.redirect || site.deploy === "server" || site.start)
-      domains.add(site.domain);
-  }
-  return domains;
-}
-function normalizeName(name) {
-  return name.replace(/\.$/, "").toLowerCase();
-}
-function matchesHostname(record, zone, hostname) {
-  const recordName = normalizeName(record.name);
-  const normalizedZone = normalizeName(zone);
-  const normalizedHostname = normalizeName(hostname);
-  const relativeName = normalizedHostname === normalizedZone ? "@" : normalizedHostname.endsWith(`.${normalizedZone}`) ? normalizedHostname.slice(0, -(normalizedZone.length + 1)) : normalizedHostname;
-  return recordName === normalizedHostname || recordName === relativeName || relativeName === "@" && (recordName === "" || recordName === normalizedZone);
-}
-async function removeStaleServerAddressRecords(provider, zone, hostname, desiredAddress) {
-  const listed = await provider.listRecords(zone);
-  if (!listed.success)
-    return [`could not list A records: ${listed.message || "unknown provider error"}`];
-  const matching = listed.records.filter((record) => record.type === "A" && matchesHostname(record, zone, hostname));
-  const desiredIndex = matching.findIndex((record) => record.content === desiredAddress);
-  if (matching.length <= 1 || desiredIndex === -1)
-    return [];
-  const warnings = [];
-  for (const [index, record] of matching.entries()) {
-    if (index === desiredIndex)
-      continue;
-    const result = await provider.deleteRecord(zone, record);
-    if (!result.success)
-      warnings.push(`could not remove stale ${record.name} A ${record.content}: ${result.message || "unknown provider error"}`);
-  }
-  return warnings;
-}
 // src/deploy/dashboard-control-plane.ts
 import { createHash as createHash5 } from "node:crypto";
 
@@ -13016,7 +12977,7 @@ function normalizeHost(value) {
     throw new Error("Source host must use HTTPS");
   return `${url.protocol}//${url.host}${url.pathname.replace(/\/$/, "")}`;
 }
-function normalizeName2(value) {
+function normalizeName(value) {
   const name = value.trim();
   if (name.length < 2 || name.length > 80)
     throw new Error("Connection name must contain 2-80 characters");
@@ -13207,7 +13168,7 @@ class SourceConnectionStore {
       id,
       input.organizationId,
       input.provider,
-      normalizeName2(input.name),
+      normalizeName(input.name),
       normalizeHost(input.host),
       input.owner?.trim() || null,
       input.authKind ?? (encoded ? "access_token" : "none"),
@@ -13340,7 +13301,7 @@ class SourceConnectionStore {
     this.run(`INSERT INTO source_deploy_keys (id, connection_id, name, public_key, public_key_fingerprint, private_key_ciphertext, host, host_key, host_key_fingerprint, created_by_actor_id, created_at, updated_at) VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)`, [
       id,
       input.connectionId,
-      normalizeName2(input.name),
+      normalizeName(input.name),
       input.publicKey.trim(),
       publicFingerprint,
       this.encrypt(input.privateKey),
@@ -49156,4 +49117,4 @@ data: ${JSON.stringify({ cursor: position, at: new Date().toISOString() })}
   };
   return { server, url: `http://${host2}:${server.port}/` };
 }
-export { defaultConfig4 as defaultConfig, getConfig, loadCloudConfig, config5 as config, encodeBase32, decodeBase32, hotp, totp, verifyTotp, matchTotpCounter, totpUri, AUTH_SESSION_IDLE_TTL_MS, AUTH_SESSION_ABSOLUTE_TTL_MS, AUTH_ACTION_TOKEN_TTL_MS, AUTH_MFA_CHALLENGE_TTL_MS, AUTH_OIDC_TRANSACTION_TTL_MS, AuthenticationStore, sendAuthenticationEmail, authEncryptionKeyFile, resolveAuthEncryptionKey, sanitizeOidcReturnPath, discoverOidcProvider, beginOidcAuthorization, completeOidcAuthorization, CONTROL_PLANE_SCHEMA_VERSION, controlPlaneMigrations, AUTHORIZATION_CAPABILITIES, roleCapabilities, scopeContains, authorizeOrganization, effectiveCapabilities, OptimisticConcurrencyError, InvalidOperationTransitionError, UnsupportedSchemaVersionError, controlPlaneDatabaseFile, MAX_CONTROL_PLANE_JSON_BYTES, MAX_CONTROL_PLANE_ERROR_BYTES, sanitizeControlPlaneValue, ControlPlaneStore, searchControlPlane, API_TOKEN_DEFAULT_TTL_MS, API_TOKEN_MAX_TTL_MS, API_IDEMPOTENCY_TTL_MS, AutomationIdentityStore, TsCloudApiError, TsCloudClient, parseCompose, exportCompose, diffCompose, listComposeTemplates, getComposeTemplate, renderComposeTemplate, parseComposeCatalog, planComposeTemplateUpgrade, composeProjectName, buildComposeRuntimeCommand, buildComposeScaleCommand, buildComposeLogsCommand, buildComposeShellCommand, QueueCancellationError, QueueTimeoutError, RetryableOperationError, DurableOperationQueue, DurableQueueWorker, PreviewEnvironmentStore, PreviewEnvironmentService, DEPLOYMENT_QUEUE_KINDS, resolveQueuedDeploymentCommand, createDeploymentQueueHandlers, unsupportedVolumeCapabilities, volumeCapabilities, validateMountPath, validateAttachment, VolumeService, createVolumeQueueHandlers, DockerNamedVolumeDriver, ServerPathVolumeDriver, CloudBlockVolumeDriver, VolumeStore, synchronizeComposeVolumes, completeComposeVolumeDeletion, ComposeApplicationStore, ComposeApplicationService, releaseStrategyCapabilities, assertReleaseStrategy, ReleaseStore, ReleaseService, releaseTrafficPlan, activateImmutableRelease, rollbackImmutableRelease, RELEASE_QUEUE_KINDS, createReleaseQueueHandlers, SourceConnectionStore, SourceProviderError, GithubSourceAdapter, GitlabSourceAdapter, BitbucketSourceAdapter, GiteaSourceAdapter, createSourceAdapter, normalizeSourceEvent, processSourceWebhook, webhookEndpoint, discoverGitRefs, cloneSourceBinding, testSourceConnection, syncSourceRepositories, listSourceReferences, reconcileSourceWebhook, removeSourceWebhook, API_VERSION, openApiDocument, ApiServiceError, requestHash, AutomationApiService, createApiV1Handler, SecurityPostureStore, SECRET_PATTERNS, PreDeployScanner, scanForSecrets, formatScanResults, SecurityScannerRunner, SecretFindingScanner, TrivyImageScanner, AwsIamCapabilityScanner, generateCycloneDxSbom, generateImageSbom, attachSbomToRelease, attachVulnerabilitySummary, createReleaseProvenance, attachProvenanceToRelease, verifyArtifactSignature, securityScope, ensureDefaultSecurityPolicies, recordPreDeploySecretScan, recordSkippedSecretScan, recordDashboardHostPosture, productionChangeReview, secureContainerRelease, runtimeId2 as runtimeId, unsupportedCapabilities, capabilities2 as capabilities, normalizeRuntimeStatus, redactRuntimeConfig, ageSeconds, bytes, discoverRuntimeInventory, ecsWorkloads, lambdaWorkloads, parseDockerInspect, dockerWorkloads, DockerDiscoveryAdapter, parseSystemdRecords, systemdWorkloads, SystemdDiscoveryAdapter, EcsRuntimeAdapter, LambdaRuntimeAdapter, createRuntimeAdapters, resolveRuntimeInventory, authorizeRuntimePath, DIAGNOSTIC_PRESETS, RuntimeOperationService, RuntimeStreamRegistry, DEFAULT_TELEMETRY_POLICY, normalizeTelemetryPolicy, telemetryPolicyKey, loadTelemetryPolicy, saveTelemetryPolicy, telemetryEstimatedMonthlyCost, redactTelemetryText, redactTelemetryValue, pathTemplate, telemetryCursor, telemetryPercentile, telemetryBucketLabel, TelemetryStore, AlertStore, AlertEvaluator, isQuietHours, NotificationRouter, HealthCheckRunner, evaluateTelemetryAlertRules, normalizeScheduleExpression, nextScheduleRuns, previewSchedule, jobProviderCapability, renderServerCron, eventBridgeScheduleInput, reconcileJobObservation, desiredState, ServerCronJobAdapter, EventBridgeJobAdapter, JobProviderReconciler, synchronizeConfiguredJobs, JobService, createJobQueueHandlers, JobStore, dataServiceCapabilities, DataServiceStore, connectionGuidance, DataServiceLifecycle, createDataServiceQueueHandlers, AwsRdsDataAdapter, AwsAuroraDataAdapter, AwsElastiCacheDataAdapter, ServerDataAdapter, ContainerDataAdapter, AwsRdsTransport, AwsAuroraTransport, AwsElastiCacheTransport, BunDockerRuntime, DockerDataTransport, EncryptedDataSecretStore, SystemFleetSshTransport, SshFleetDriver, createFleetQueueHandlers, FleetStore, FleetService, zeroCapacity, capacity, PlacementStore, PlacementService, RemoteBuildService, createRemoteBuildQueueHandlers, TransportRemoteBuildDriver, createServerBuildDriver, createEcsBuildDriver, createAsgBuildDriver, RegionStore, RegionService, createRegionQueueHandlers, AwsRegionalDriver, UnavailableRegionalDriver, canonicalJson, manifestDigest, documentDigest, publicKeyFingerprint, verifyUpdateSignature, updateCompatibility, MaintenanceStore, maintenanceWindowOpen, MaintenanceService, createMaintenanceQueueHandlers, TransportPlatformMaintenanceDriver, ControlPlaneCleanupDriver, TransportDisasterRecoveryDriver, collectServerDnsDomains, removeStaleServerAddressRecords, ensureDashboardActor, initializeDashboardControlPlane, synchronizeDashboardUsers, trackDashboardOperation, dashboardPageRoutes, resolveLegacyDashboardRoute, routesForDashboard, deploySite, createStaticApiOriginDependencies, deployStaticApiOrigin, verifyStaticApiOrigin, estimateStaticApiOriginMonthlyCost, createExistingStaticFullStackDependencies, generateExistingStaticFullStackTemplate, deployExistingStaticFullStack, estimateExistingStaticFullStackMonthlyCost, hashContainerContext, createContainerImageDependencies, buildAndPushContainerImage, infraEnvFromOutputs, buildFunctionEnv, deployServerlessApp, redeployServerlessApp, rollbackServerlessApp, setMaintenance, runRemoteCommand, resolveDashboardData, validateBackupDestination, BackupStore, encryptBackup, decryptBackup, backupCredentialStatus, S3BackupDestinationAdapter, BackupCoordinator, createBackupQueueHandlers, AwsDatabaseBackupSource, compressBackup, decompressBackup, BunFilesystemArchiveRuntime, FilesystemBackupSource, LogicalDatabaseBackupSource, BunDockerVolumeRuntime, DockerVolumeBackupSource, ControlPlaneBackupSource, AwsInfrastructureBackupSource, ConfigurationStore, parseDotenv, serializeDotenv, LocalEncryptedConfigurationBackend, AwsSecretsManagerConfigurationBackend, AwsSsmConfigurationBackend, ExternalConfigurationBackend, ConfigurationService, synchronizeConfiguredConfiguration, sanitizeCloudConfig, dashboardActions, resolveDashboardAction, startLocalDashboardServer };
+export { defaultConfig4 as defaultConfig, getConfig, loadCloudConfig, config5 as config, encodeBase32, decodeBase32, hotp, totp, verifyTotp, matchTotpCounter, totpUri, AUTH_SESSION_IDLE_TTL_MS, AUTH_SESSION_ABSOLUTE_TTL_MS, AUTH_ACTION_TOKEN_TTL_MS, AUTH_MFA_CHALLENGE_TTL_MS, AUTH_OIDC_TRANSACTION_TTL_MS, AuthenticationStore, sendAuthenticationEmail, authEncryptionKeyFile, resolveAuthEncryptionKey, sanitizeOidcReturnPath, discoverOidcProvider, beginOidcAuthorization, completeOidcAuthorization, CONTROL_PLANE_SCHEMA_VERSION, controlPlaneMigrations, AUTHORIZATION_CAPABILITIES, roleCapabilities, scopeContains, authorizeOrganization, effectiveCapabilities, OptimisticConcurrencyError, InvalidOperationTransitionError, UnsupportedSchemaVersionError, controlPlaneDatabaseFile, MAX_CONTROL_PLANE_JSON_BYTES, MAX_CONTROL_PLANE_ERROR_BYTES, sanitizeControlPlaneValue, ControlPlaneStore, searchControlPlane, API_TOKEN_DEFAULT_TTL_MS, API_TOKEN_MAX_TTL_MS, API_IDEMPOTENCY_TTL_MS, AutomationIdentityStore, TsCloudApiError, TsCloudClient, parseCompose, exportCompose, diffCompose, listComposeTemplates, getComposeTemplate, renderComposeTemplate, parseComposeCatalog, planComposeTemplateUpgrade, composeProjectName, buildComposeRuntimeCommand, buildComposeScaleCommand, buildComposeLogsCommand, buildComposeShellCommand, QueueCancellationError, QueueTimeoutError, RetryableOperationError, DurableOperationQueue, DurableQueueWorker, PreviewEnvironmentStore, PreviewEnvironmentService, DEPLOYMENT_QUEUE_KINDS, resolveQueuedDeploymentCommand, createDeploymentQueueHandlers, unsupportedVolumeCapabilities, volumeCapabilities, validateMountPath, validateAttachment, VolumeService, createVolumeQueueHandlers, DockerNamedVolumeDriver, ServerPathVolumeDriver, CloudBlockVolumeDriver, VolumeStore, synchronizeComposeVolumes, completeComposeVolumeDeletion, ComposeApplicationStore, ComposeApplicationService, releaseStrategyCapabilities, assertReleaseStrategy, ReleaseStore, ReleaseService, releaseTrafficPlan, activateImmutableRelease, rollbackImmutableRelease, RELEASE_QUEUE_KINDS, createReleaseQueueHandlers, SourceConnectionStore, SourceProviderError, GithubSourceAdapter, GitlabSourceAdapter, BitbucketSourceAdapter, GiteaSourceAdapter, createSourceAdapter, normalizeSourceEvent, processSourceWebhook, webhookEndpoint, discoverGitRefs, cloneSourceBinding, testSourceConnection, syncSourceRepositories, listSourceReferences, reconcileSourceWebhook, removeSourceWebhook, API_VERSION, openApiDocument, ApiServiceError, requestHash, AutomationApiService, createApiV1Handler, SecurityPostureStore, SECRET_PATTERNS, PreDeployScanner, scanForSecrets, formatScanResults, SecurityScannerRunner, SecretFindingScanner, TrivyImageScanner, AwsIamCapabilityScanner, generateCycloneDxSbom, generateImageSbom, attachSbomToRelease, attachVulnerabilitySummary, createReleaseProvenance, attachProvenanceToRelease, verifyArtifactSignature, securityScope, ensureDefaultSecurityPolicies, recordPreDeploySecretScan, recordSkippedSecretScan, recordDashboardHostPosture, productionChangeReview, secureContainerRelease, runtimeId2 as runtimeId, unsupportedCapabilities, capabilities2 as capabilities, normalizeRuntimeStatus, redactRuntimeConfig, ageSeconds, bytes, discoverRuntimeInventory, ecsWorkloads, lambdaWorkloads, parseDockerInspect, dockerWorkloads, DockerDiscoveryAdapter, parseSystemdRecords, systemdWorkloads, SystemdDiscoveryAdapter, EcsRuntimeAdapter, LambdaRuntimeAdapter, createRuntimeAdapters, resolveRuntimeInventory, authorizeRuntimePath, DIAGNOSTIC_PRESETS, RuntimeOperationService, RuntimeStreamRegistry, DEFAULT_TELEMETRY_POLICY, normalizeTelemetryPolicy, telemetryPolicyKey, loadTelemetryPolicy, saveTelemetryPolicy, telemetryEstimatedMonthlyCost, redactTelemetryText, redactTelemetryValue, pathTemplate, telemetryCursor, telemetryPercentile, telemetryBucketLabel, TelemetryStore, AlertStore, AlertEvaluator, isQuietHours, NotificationRouter, HealthCheckRunner, evaluateTelemetryAlertRules, normalizeScheduleExpression, nextScheduleRuns, previewSchedule, jobProviderCapability, renderServerCron, eventBridgeScheduleInput, reconcileJobObservation, desiredState, ServerCronJobAdapter, EventBridgeJobAdapter, JobProviderReconciler, synchronizeConfiguredJobs, JobService, createJobQueueHandlers, JobStore, dataServiceCapabilities, DataServiceStore, connectionGuidance, DataServiceLifecycle, createDataServiceQueueHandlers, AwsRdsDataAdapter, AwsAuroraDataAdapter, AwsElastiCacheDataAdapter, ServerDataAdapter, ContainerDataAdapter, AwsRdsTransport, AwsAuroraTransport, AwsElastiCacheTransport, BunDockerRuntime, DockerDataTransport, EncryptedDataSecretStore, SystemFleetSshTransport, SshFleetDriver, createFleetQueueHandlers, FleetStore, FleetService, zeroCapacity, capacity, PlacementStore, PlacementService, RemoteBuildService, createRemoteBuildQueueHandlers, TransportRemoteBuildDriver, createServerBuildDriver, createEcsBuildDriver, createAsgBuildDriver, RegionStore, RegionService, createRegionQueueHandlers, AwsRegionalDriver, UnavailableRegionalDriver, canonicalJson, manifestDigest, documentDigest, publicKeyFingerprint, verifyUpdateSignature, updateCompatibility, MaintenanceStore, maintenanceWindowOpen, MaintenanceService, createMaintenanceQueueHandlers, TransportPlatformMaintenanceDriver, ControlPlaneCleanupDriver, TransportDisasterRecoveryDriver, ensureDashboardActor, initializeDashboardControlPlane, synchronizeDashboardUsers, trackDashboardOperation, dashboardPageRoutes, resolveLegacyDashboardRoute, routesForDashboard, deploySite, createStaticApiOriginDependencies, deployStaticApiOrigin, verifyStaticApiOrigin, estimateStaticApiOriginMonthlyCost, createExistingStaticFullStackDependencies, generateExistingStaticFullStackTemplate, deployExistingStaticFullStack, estimateExistingStaticFullStackMonthlyCost, hashContainerContext, createContainerImageDependencies, buildAndPushContainerImage, infraEnvFromOutputs, buildFunctionEnv, deployServerlessApp, redeployServerlessApp, rollbackServerlessApp, setMaintenance, runRemoteCommand, resolveDashboardData, validateBackupDestination, BackupStore, encryptBackup, decryptBackup, backupCredentialStatus, S3BackupDestinationAdapter, BackupCoordinator, createBackupQueueHandlers, AwsDatabaseBackupSource, compressBackup, decompressBackup, BunFilesystemArchiveRuntime, FilesystemBackupSource, LogicalDatabaseBackupSource, BunDockerVolumeRuntime, DockerVolumeBackupSource, ControlPlaneBackupSource, AwsInfrastructureBackupSource, ConfigurationStore, parseDotenv, serializeDotenv, LocalEncryptedConfigurationBackend, AwsSecretsManagerConfigurationBackend, AwsSsmConfigurationBackend, ExternalConfigurationBackend, ConfigurationService, synchronizeConfiguredConfiguration, sanitizeCloudConfig, dashboardActions, resolveDashboardAction, startLocalDashboardServer };

package/dist/deploy/index.js

@@ -1,7 +1,6 @@
 import {
   buildAndPushContainerImage,
   buildFunctionEnv,
-  collectServerDnsDomains,
   createContainerImageDependencies,
   createExistingStaticFullStackDependencies,
   createStaticApiOriginDependencies,
@@ -19,7 +18,6 @@ import {
   infraEnvFromOutputs,
   initializeDashboardControlPlane,
   redeployServerlessApp,
-  removeStaleServerAddressRecords,
   resolveDashboardAction,
   resolveDashboardData,
   resolveLegacyDashboardRoute,
@@ -32,7 +30,7 @@ import {
   synchronizeDashboardUsers,
   trackDashboardOperation,
   verifyStaticApiOrigin
-} from "../chunk-8m38yfba.js";
+} from "../chunk-qbj74thz.js";
 import {
   deleteStaticSite,
   deployStaticSite,
@@ -55,9 +53,12 @@ import"../chunk-gttvakpv.js";
 import {
   MANAGEMENT_DASHBOARD_SITE,
   buildManagementDashboardArtifact,
+  collectServerDnsDomains,
   dashboardCredentialsFile,
   ensureManagementDashboard,
+  hetznerBoxIpv6,
   isPhpSite,
+  removeStaleServerAddressRecords,
   resolveDashboardAuth,
   resolveSiteDeployTarget,
   resolveSiteKind,
@@ -65,7 +66,7 @@ import {
   shipsARelease,
   siteInstallBase,
   validateDeploymentConfig
-} from "../chunk-838t87x3.js";
+} from "../chunk-gx4288t5.js";
 import"../chunk-1qjyqrc5.js";
 import"../chunk-703nkybg.js";
 import"../chunk-4cjrg98a.js";
@@ -101,6 +102,7 @@ export {
   invalidateCache,
   initializeDashboardControlPlane,
   infraEnvFromOutputs,
+  hetznerBoxIpv6,
   hashContainerContext,
   generateStaticSiteTemplate,
   generateExternalDnsStaticSiteTemplate,

package/dist/deploy/server-dns.d.ts

@@ -9,8 +9,23 @@ interface ServerSite {
 export declare function collectServerDnsDomains(sites?: Record<string, ServerSite>): Set<string>;
 /**
  * A compute deployment owns one address per managed hostname. After an upsert,
- * remove only duplicate A records for that exact hostname, preserving one copy
- * of the desired address and leaving every unrelated record untouched.
+ * remove only duplicate address records for that exact hostname, preserving one
+ * copy of the desired address and leaving every unrelated record untouched.
+ *
+ * `recordType` selects the family. It used to be hardcoded to 'A', which meant
+ * a dual-stack box could clean up its stale IPv4 records but accumulated stale
+ * AAAA ones forever — and a stale AAAA is worse than a stale A, because
+ * dual-stack clients prefer IPv6 and would keep landing on the dead address.
  */
-export declare function removeStaleServerAddressRecords(provider: DnsProvider, zone: string, hostname: string, desiredAddress: string): Promise<string[]>;
+export declare function removeStaleServerAddressRecords(provider: DnsProvider, zone: string, hostname: string, desiredAddress: string, recordType?: 'A' | 'AAAA'): Promise<string[]>;
+/**
+ * Hetzner hands a cloud server a routed /64 and configures `::1` inside it on
+ * the interface, but the API reports the block (`2a01:4f8:c014:6186::/64`), not
+ * the address. Publishing the block verbatim as an AAAA record yields a host
+ * nothing answers on, so turn it into the address the box actually holds.
+ *
+ * A plain address (no prefix) is returned unchanged, so this is safe to apply
+ * to whatever the driver surfaced.
+ */
+export declare function hetznerBoxIpv6(reported: string | undefined | null): string | undefined;
 export {};

package/dist/drivers/hetzner/state.d.ts

@@ -6,6 +6,14 @@ export interface HetznerDriverState {
     serverName?: string;
     firewallId?: number;
     publicIp?: string;
+    /**
+     * The box's public IPv6 address, already narrowed from the routed /64 the
+     * API reports to the address the interface actually holds. Recorded so a
+     * deploy can publish AAAA records alongside the A records without having to
+     * call the Hetzner API again — attach-mode tenants read this state and never
+     * see the server object at all.
+     */
+    publicIpv6?: string;
     deployStoragePath?: string;
     sshUser?: string;
     /** Fleet: network/LB ids + the services box private IP, for deploy + teardown. */

package/dist/drivers/index.js

@@ -68,7 +68,7 @@ import {
   waitForSsh,
   wrapCloudInitUserData,
   writeResizeCheckpoint
-} from "../chunk-838t87x3.js";
+} from "../chunk-gx4288t5.js";
 import"../chunk-1qjyqrc5.js";
 import"../chunk-703nkybg.js";
 import"../chunk-4cjrg98a.js";

package/dist/index.d.ts

@@ -30,7 +30,7 @@ export { keyMatchesFilters, migrateObjectStorage, remapKey } from './object-stor
 export type { MigrateEndpoint, MigrateError, MigrateOptions, MigratePlanItem, MigrateProgress, MigrateResult, MigrateVerification, } from './object-storage/migrate';
 export * from './ssl';
 export { deployStaticSite, deployStaticSiteFull, uploadStaticFiles, invalidateCache, deleteStaticSite, generateStaticSiteTemplate, deployStaticSiteWithExternalDns, deployStaticSiteWithExternalDnsFull, generateExternalDnsStaticSiteTemplate, deploySite, resolveSiteDeployTarget, resolveSiteKind, validateDeploymentConfig, buildAndPushServerlessImage, buildFunctionEnv, deployServerlessApp, infraEnvFromOutputs, redeployServerlessApp, rollbackServerlessApp, runRemoteCommand, setMaintenance, buildManagementDashboardArtifact, dashboardCredentialsFile, ensureManagementDashboard, MANAGEMENT_DASHBOARD_SITE, resolveDashboardAuth, resolveUiSource, } from './deploy';
-export { collectServerDnsDomains, removeStaleServerAddressRecords } from './deploy/server-dns';
+export { collectServerDnsDomains, hetznerBoxIpv6, removeStaleServerAddressRecords } from './deploy/server-dns';
 export type { EnsureDashboardLogger, ResolvedDashboardAuth, StaticSiteConfig, DeployResult, UploadOptions, ExternalDnsStaticSiteConfig, ExternalDnsDeployResult, DeploySiteConfig, DeploySiteResult, StaticSiteDnsProvider, SiteDeployKind, DeploymentValidationResult, BuildImageOptions, BuiltImage, CodeSource, DeployServerlessOptions, ResolvedContext, } from './deploy';
 export { createCloudDriver, CloudDriverFactory, cloudDrivers, AwsDriver, HetznerDriver, HetznerClient, resolveHetznerApiToken, normalizeSshPublicKey, ensureFirewall, ensureServer, ensureSshKey, serverPublicIpv4, sshExec, sshExecOrThrow, scpUpload, waitForSsh, waitForCloudInit, buildSshArgs, generateUbuntuAppCloudInit, wrapCloudInitUserData, buildHostCleanupScript, buildSiteDeployScript, buildStaticSiteDeployScript, resolveExecStart, deployAllComputeSites, deploySiteRelease, } from './drivers';
 export type { CreateCloudDriverOptions } from './drivers/factory';

package/dist/index.js

@@ -139,7 +139,6 @@ import {
   capabilities,
   capacity,
   cloneSourceBinding,
-  collectServerDnsDomains,
   completeComposeVolumeDeletion,
   completeOidcAuthorization,
   composeProjectName,
@@ -234,7 +233,6 @@ import {
   releaseStrategyCapabilities,
   releaseTrafficPlan,
   removeSourceWebhook,
-  removeStaleServerAddressRecords,
   renderComposeTemplate,
   renderServerCron,
   requestHash,
@@ -285,7 +283,7 @@ import {
   volumeCapabilities,
   webhookEndpoint,
   zeroCapacity
-} from "./chunk-8m38yfba.js";
+} from "./chunk-qbj74thz.js";
 import {
   deleteStaticSite,
   deployStaticSite,
@@ -375,6 +373,7 @@ import {
   buildStaticSiteDeployScript,
   buildUbuntuBootstrapScript,
   cloudDrivers,
+  collectServerDnsDomains,
   createCloudDriver,
   dashboardCredentialsFile,
   deployAllComputeSites,
@@ -383,7 +382,9 @@ import {
   ensureManagementDashboard,
   ensureServer,
   ensureSshKey,
+  hetznerBoxIpv6,
   normalizeSshPublicKey,
+  removeStaleServerAddressRecords,
   resolveDashboardAuth,
   resolveExecStart,
   resolveHetznerApiToken,
@@ -398,7 +399,7 @@ import {
   waitForCloudInit,
   waitForSsh,
   wrapCloudInitUserData
-} from "./chunk-838t87x3.js";
+} from "./chunk-gx4288t5.js";
 import {
   ABTestManager,
   AI,
@@ -5345,6 +5346,7 @@ export {
   infraEnvFromOutputs,
   imageScanningManager,
   hotp,
+  hetznerBoxIpv6,
   healthCheckManager,
   hashString,
   hashManifest,