@stacksjs/ts-cloud 0.7.84 → 0.7.86

package/dist/{chunk-8m38yfba.js → chunk-4erbrg3e.js}

@@ -45,7 +45,7 @@ import {
   resolveSiteKind,
   resolveUiSource,
   siteInstallBase
-} from "./chunk-838t87x3.js";
+} from "./chunk-ztbn47we.js";
 import {
   artifactKey,
   buildCloudFormationTemplate,
@@ -70,7 +70,7 @@ import {
 } from "./chunk-1qjyqrc5.js";
 import {
   SSMClient
-} from "./chunk-703nkybg.js";
+} from "./chunk-7m60qnc8.js";
 import {
   CloudFormationClient
 } from "./chunk-4cjrg98a.js";
@@ -88,45 +88,6 @@ import {
 import {
   __require
 } from "./chunk-v0bahtg2.js";
-// src/deploy/server-dns.ts
-function collectServerDnsDomains(sites = {}) {
-  const domains = new Set;
-  for (const site of Object.values(sites)) {
-    if (!site.domain)
-      continue;
-    if (site.redirect || site.deploy === "server" || site.start)
-      domains.add(site.domain);
-  }
-  return domains;
-}
-function normalizeName(name) {
-  return name.replace(/\.$/, "").toLowerCase();
-}
-function matchesHostname(record, zone, hostname) {
-  const recordName = normalizeName(record.name);
-  const normalizedZone = normalizeName(zone);
-  const normalizedHostname = normalizeName(hostname);
-  const relativeName = normalizedHostname === normalizedZone ? "@" : normalizedHostname.endsWith(`.${normalizedZone}`) ? normalizedHostname.slice(0, -(normalizedZone.length + 1)) : normalizedHostname;
-  return recordName === normalizedHostname || recordName === relativeName || relativeName === "@" && (recordName === "" || recordName === normalizedZone);
-}
-async function removeStaleServerAddressRecords(provider, zone, hostname, desiredAddress) {
-  const listed = await provider.listRecords(zone);
-  if (!listed.success)
-    return [`could not list A records: ${listed.message || "unknown provider error"}`];
-  const matching = listed.records.filter((record) => record.type === "A" && matchesHostname(record, zone, hostname));
-  const desiredIndex = matching.findIndex((record) => record.content === desiredAddress);
-  if (matching.length <= 1 || desiredIndex === -1)
-    return [];
-  const warnings = [];
-  for (const [index, record] of matching.entries()) {
-    if (index === desiredIndex)
-      continue;
-    const result = await provider.deleteRecord(zone, record);
-    if (!result.success)
-      warnings.push(`could not remove stale ${record.name} A ${record.content}: ${result.message || "unknown provider error"}`);
-  }
-  return warnings;
-}
 // src/deploy/dashboard-control-plane.ts
 import { createHash as createHash5 } from "node:crypto";
 
@@ -13016,7 +12977,7 @@ function normalizeHost(value) {
     throw new Error("Source host must use HTTPS");
   return `${url.protocol}//${url.host}${url.pathname.replace(/\/$/, "")}`;
 }
-function normalizeName2(value) {
+function normalizeName(value) {
   const name = value.trim();
   if (name.length < 2 || name.length > 80)
     throw new Error("Connection name must contain 2-80 characters");
@@ -13207,7 +13168,7 @@ class SourceConnectionStore {
       id,
       input.organizationId,
       input.provider,
-      normalizeName2(input.name),
+      normalizeName(input.name),
       normalizeHost(input.host),
       input.owner?.trim() || null,
       input.authKind ?? (encoded ? "access_token" : "none"),
@@ -13340,7 +13301,7 @@ class SourceConnectionStore {
     this.run(`INSERT INTO source_deploy_keys (id, connection_id, name, public_key, public_key_fingerprint, private_key_ciphertext, host, host_key, host_key_fingerprint, created_by_actor_id, created_at, updated_at) VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)`, [
       id,
       input.connectionId,
-      normalizeName2(input.name),
+      normalizeName(input.name),
       input.publicKey.trim(),
       publicFingerprint,
       this.encrypt(input.privateKey),
@@ -49156,4 +49117,4 @@ data: ${JSON.stringify({ cursor: position, at: new Date().toISOString() })}
   };
   return { server, url: `http://${host2}:${server.port}/` };
 }
-export { defaultConfig4 as defaultConfig, getConfig, loadCloudConfig, config5 as config, encodeBase32, decodeBase32, hotp, totp, verifyTotp, matchTotpCounter, totpUri, AUTH_SESSION_IDLE_TTL_MS, AUTH_SESSION_ABSOLUTE_TTL_MS, AUTH_ACTION_TOKEN_TTL_MS, AUTH_MFA_CHALLENGE_TTL_MS, AUTH_OIDC_TRANSACTION_TTL_MS, AuthenticationStore, sendAuthenticationEmail, authEncryptionKeyFile, resolveAuthEncryptionKey, sanitizeOidcReturnPath, discoverOidcProvider, beginOidcAuthorization, completeOidcAuthorization, CONTROL_PLANE_SCHEMA_VERSION, controlPlaneMigrations, AUTHORIZATION_CAPABILITIES, roleCapabilities, scopeContains, authorizeOrganization, effectiveCapabilities, OptimisticConcurrencyError, InvalidOperationTransitionError, UnsupportedSchemaVersionError, controlPlaneDatabaseFile, MAX_CONTROL_PLANE_JSON_BYTES, MAX_CONTROL_PLANE_ERROR_BYTES, sanitizeControlPlaneValue, ControlPlaneStore, searchControlPlane, API_TOKEN_DEFAULT_TTL_MS, API_TOKEN_MAX_TTL_MS, API_IDEMPOTENCY_TTL_MS, AutomationIdentityStore, TsCloudApiError, TsCloudClient, parseCompose, exportCompose, diffCompose, listComposeTemplates, getComposeTemplate, renderComposeTemplate, parseComposeCatalog, planComposeTemplateUpgrade, composeProjectName, buildComposeRuntimeCommand, buildComposeScaleCommand, buildComposeLogsCommand, buildComposeShellCommand, QueueCancellationError, QueueTimeoutError, RetryableOperationError, DurableOperationQueue, DurableQueueWorker, PreviewEnvironmentStore, PreviewEnvironmentService, DEPLOYMENT_QUEUE_KINDS, resolveQueuedDeploymentCommand, createDeploymentQueueHandlers, unsupportedVolumeCapabilities, volumeCapabilities, validateMountPath, validateAttachment, VolumeService, createVolumeQueueHandlers, DockerNamedVolumeDriver, ServerPathVolumeDriver, CloudBlockVolumeDriver, VolumeStore, synchronizeComposeVolumes, completeComposeVolumeDeletion, ComposeApplicationStore, ComposeApplicationService, releaseStrategyCapabilities, assertReleaseStrategy, ReleaseStore, ReleaseService, releaseTrafficPlan, activateImmutableRelease, rollbackImmutableRelease, RELEASE_QUEUE_KINDS, createReleaseQueueHandlers, SourceConnectionStore, SourceProviderError, GithubSourceAdapter, GitlabSourceAdapter, BitbucketSourceAdapter, GiteaSourceAdapter, createSourceAdapter, normalizeSourceEvent, processSourceWebhook, webhookEndpoint, discoverGitRefs, cloneSourceBinding, testSourceConnection, syncSourceRepositories, listSourceReferences, reconcileSourceWebhook, removeSourceWebhook, API_VERSION, openApiDocument, ApiServiceError, requestHash, AutomationApiService, createApiV1Handler, SecurityPostureStore, SECRET_PATTERNS, PreDeployScanner, scanForSecrets, formatScanResults, SecurityScannerRunner, SecretFindingScanner, TrivyImageScanner, AwsIamCapabilityScanner, generateCycloneDxSbom, generateImageSbom, attachSbomToRelease, attachVulnerabilitySummary, createReleaseProvenance, attachProvenanceToRelease, verifyArtifactSignature, securityScope, ensureDefaultSecurityPolicies, recordPreDeploySecretScan, recordSkippedSecretScan, recordDashboardHostPosture, productionChangeReview, secureContainerRelease, runtimeId2 as runtimeId, unsupportedCapabilities, capabilities2 as capabilities, normalizeRuntimeStatus, redactRuntimeConfig, ageSeconds, bytes, discoverRuntimeInventory, ecsWorkloads, lambdaWorkloads, parseDockerInspect, dockerWorkloads, DockerDiscoveryAdapter, parseSystemdRecords, systemdWorkloads, SystemdDiscoveryAdapter, EcsRuntimeAdapter, LambdaRuntimeAdapter, createRuntimeAdapters, resolveRuntimeInventory, authorizeRuntimePath, DIAGNOSTIC_PRESETS, RuntimeOperationService, RuntimeStreamRegistry, DEFAULT_TELEMETRY_POLICY, normalizeTelemetryPolicy, telemetryPolicyKey, loadTelemetryPolicy, saveTelemetryPolicy, telemetryEstimatedMonthlyCost, redactTelemetryText, redactTelemetryValue, pathTemplate, telemetryCursor, telemetryPercentile, telemetryBucketLabel, TelemetryStore, AlertStore, AlertEvaluator, isQuietHours, NotificationRouter, HealthCheckRunner, evaluateTelemetryAlertRules, normalizeScheduleExpression, nextScheduleRuns, previewSchedule, jobProviderCapability, renderServerCron, eventBridgeScheduleInput, reconcileJobObservation, desiredState, ServerCronJobAdapter, EventBridgeJobAdapter, JobProviderReconciler, synchronizeConfiguredJobs, JobService, createJobQueueHandlers, JobStore, dataServiceCapabilities, DataServiceStore, connectionGuidance, DataServiceLifecycle, createDataServiceQueueHandlers, AwsRdsDataAdapter, AwsAuroraDataAdapter, AwsElastiCacheDataAdapter, ServerDataAdapter, ContainerDataAdapter, AwsRdsTransport, AwsAuroraTransport, AwsElastiCacheTransport, BunDockerRuntime, DockerDataTransport, EncryptedDataSecretStore, SystemFleetSshTransport, SshFleetDriver, createFleetQueueHandlers, FleetStore, FleetService, zeroCapacity, capacity, PlacementStore, PlacementService, RemoteBuildService, createRemoteBuildQueueHandlers, TransportRemoteBuildDriver, createServerBuildDriver, createEcsBuildDriver, createAsgBuildDriver, RegionStore, RegionService, createRegionQueueHandlers, AwsRegionalDriver, UnavailableRegionalDriver, canonicalJson, manifestDigest, documentDigest, publicKeyFingerprint, verifyUpdateSignature, updateCompatibility, MaintenanceStore, maintenanceWindowOpen, MaintenanceService, createMaintenanceQueueHandlers, TransportPlatformMaintenanceDriver, ControlPlaneCleanupDriver, TransportDisasterRecoveryDriver, collectServerDnsDomains, removeStaleServerAddressRecords, ensureDashboardActor, initializeDashboardControlPlane, synchronizeDashboardUsers, trackDashboardOperation, dashboardPageRoutes, resolveLegacyDashboardRoute, routesForDashboard, deploySite, createStaticApiOriginDependencies, deployStaticApiOrigin, verifyStaticApiOrigin, estimateStaticApiOriginMonthlyCost, createExistingStaticFullStackDependencies, generateExistingStaticFullStackTemplate, deployExistingStaticFullStack, estimateExistingStaticFullStackMonthlyCost, hashContainerContext, createContainerImageDependencies, buildAndPushContainerImage, infraEnvFromOutputs, buildFunctionEnv, deployServerlessApp, redeployServerlessApp, rollbackServerlessApp, setMaintenance, runRemoteCommand, resolveDashboardData, validateBackupDestination, BackupStore, encryptBackup, decryptBackup, backupCredentialStatus, S3BackupDestinationAdapter, BackupCoordinator, createBackupQueueHandlers, AwsDatabaseBackupSource, compressBackup, decompressBackup, BunFilesystemArchiveRuntime, FilesystemBackupSource, LogicalDatabaseBackupSource, BunDockerVolumeRuntime, DockerVolumeBackupSource, ControlPlaneBackupSource, AwsInfrastructureBackupSource, ConfigurationStore, parseDotenv, serializeDotenv, LocalEncryptedConfigurationBackend, AwsSecretsManagerConfigurationBackend, AwsSsmConfigurationBackend, ExternalConfigurationBackend, ConfigurationService, synchronizeConfiguredConfiguration, sanitizeCloudConfig, dashboardActions, resolveDashboardAction, startLocalDashboardServer };
+export { defaultConfig4 as defaultConfig, getConfig, loadCloudConfig, config5 as config, encodeBase32, decodeBase32, hotp, totp, verifyTotp, matchTotpCounter, totpUri, AUTH_SESSION_IDLE_TTL_MS, AUTH_SESSION_ABSOLUTE_TTL_MS, AUTH_ACTION_TOKEN_TTL_MS, AUTH_MFA_CHALLENGE_TTL_MS, AUTH_OIDC_TRANSACTION_TTL_MS, AuthenticationStore, sendAuthenticationEmail, authEncryptionKeyFile, resolveAuthEncryptionKey, sanitizeOidcReturnPath, discoverOidcProvider, beginOidcAuthorization, completeOidcAuthorization, CONTROL_PLANE_SCHEMA_VERSION, controlPlaneMigrations, AUTHORIZATION_CAPABILITIES, roleCapabilities, scopeContains, authorizeOrganization, effectiveCapabilities, OptimisticConcurrencyError, InvalidOperationTransitionError, UnsupportedSchemaVersionError, controlPlaneDatabaseFile, MAX_CONTROL_PLANE_JSON_BYTES, MAX_CONTROL_PLANE_ERROR_BYTES, sanitizeControlPlaneValue, ControlPlaneStore, searchControlPlane, API_TOKEN_DEFAULT_TTL_MS, API_TOKEN_MAX_TTL_MS, API_IDEMPOTENCY_TTL_MS, AutomationIdentityStore, TsCloudApiError, TsCloudClient, parseCompose, exportCompose, diffCompose, listComposeTemplates, getComposeTemplate, renderComposeTemplate, parseComposeCatalog, planComposeTemplateUpgrade, composeProjectName, buildComposeRuntimeCommand, buildComposeScaleCommand, buildComposeLogsCommand, buildComposeShellCommand, QueueCancellationError, QueueTimeoutError, RetryableOperationError, DurableOperationQueue, DurableQueueWorker, PreviewEnvironmentStore, PreviewEnvironmentService, DEPLOYMENT_QUEUE_KINDS, resolveQueuedDeploymentCommand, createDeploymentQueueHandlers, unsupportedVolumeCapabilities, volumeCapabilities, validateMountPath, validateAttachment, VolumeService, createVolumeQueueHandlers, DockerNamedVolumeDriver, ServerPathVolumeDriver, CloudBlockVolumeDriver, VolumeStore, synchronizeComposeVolumes, completeComposeVolumeDeletion, ComposeApplicationStore, ComposeApplicationService, releaseStrategyCapabilities, assertReleaseStrategy, ReleaseStore, ReleaseService, releaseTrafficPlan, activateImmutableRelease, rollbackImmutableRelease, RELEASE_QUEUE_KINDS, createReleaseQueueHandlers, SourceConnectionStore, SourceProviderError, GithubSourceAdapter, GitlabSourceAdapter, BitbucketSourceAdapter, GiteaSourceAdapter, createSourceAdapter, normalizeSourceEvent, processSourceWebhook, webhookEndpoint, discoverGitRefs, cloneSourceBinding, testSourceConnection, syncSourceRepositories, listSourceReferences, reconcileSourceWebhook, removeSourceWebhook, API_VERSION, openApiDocument, ApiServiceError, requestHash, AutomationApiService, createApiV1Handler, SecurityPostureStore, SECRET_PATTERNS, PreDeployScanner, scanForSecrets, formatScanResults, SecurityScannerRunner, SecretFindingScanner, TrivyImageScanner, AwsIamCapabilityScanner, generateCycloneDxSbom, generateImageSbom, attachSbomToRelease, attachVulnerabilitySummary, createReleaseProvenance, attachProvenanceToRelease, verifyArtifactSignature, securityScope, ensureDefaultSecurityPolicies, recordPreDeploySecretScan, recordSkippedSecretScan, recordDashboardHostPosture, productionChangeReview, secureContainerRelease, runtimeId2 as runtimeId, unsupportedCapabilities, capabilities2 as capabilities, normalizeRuntimeStatus, redactRuntimeConfig, ageSeconds, bytes, discoverRuntimeInventory, ecsWorkloads, lambdaWorkloads, parseDockerInspect, dockerWorkloads, DockerDiscoveryAdapter, parseSystemdRecords, systemdWorkloads, SystemdDiscoveryAdapter, EcsRuntimeAdapter, LambdaRuntimeAdapter, createRuntimeAdapters, resolveRuntimeInventory, authorizeRuntimePath, DIAGNOSTIC_PRESETS, RuntimeOperationService, RuntimeStreamRegistry, DEFAULT_TELEMETRY_POLICY, normalizeTelemetryPolicy, telemetryPolicyKey, loadTelemetryPolicy, saveTelemetryPolicy, telemetryEstimatedMonthlyCost, redactTelemetryText, redactTelemetryValue, pathTemplate, telemetryCursor, telemetryPercentile, telemetryBucketLabel, TelemetryStore, AlertStore, AlertEvaluator, isQuietHours, NotificationRouter, HealthCheckRunner, evaluateTelemetryAlertRules, normalizeScheduleExpression, nextScheduleRuns, previewSchedule, jobProviderCapability, renderServerCron, eventBridgeScheduleInput, reconcileJobObservation, desiredState, ServerCronJobAdapter, EventBridgeJobAdapter, JobProviderReconciler, synchronizeConfiguredJobs, JobService, createJobQueueHandlers, JobStore, dataServiceCapabilities, DataServiceStore, connectionGuidance, DataServiceLifecycle, createDataServiceQueueHandlers, AwsRdsDataAdapter, AwsAuroraDataAdapter, AwsElastiCacheDataAdapter, ServerDataAdapter, ContainerDataAdapter, AwsRdsTransport, AwsAuroraTransport, AwsElastiCacheTransport, BunDockerRuntime, DockerDataTransport, EncryptedDataSecretStore, SystemFleetSshTransport, SshFleetDriver, createFleetQueueHandlers, FleetStore, FleetService, zeroCapacity, capacity, PlacementStore, PlacementService, RemoteBuildService, createRemoteBuildQueueHandlers, TransportRemoteBuildDriver, createServerBuildDriver, createEcsBuildDriver, createAsgBuildDriver, RegionStore, RegionService, createRegionQueueHandlers, AwsRegionalDriver, UnavailableRegionalDriver, canonicalJson, manifestDigest, documentDigest, publicKeyFingerprint, verifyUpdateSignature, updateCompatibility, MaintenanceStore, maintenanceWindowOpen, MaintenanceService, createMaintenanceQueueHandlers, TransportPlatformMaintenanceDriver, ControlPlaneCleanupDriver, TransportDisasterRecoveryDriver, ensureDashboardActor, initializeDashboardControlPlane, synchronizeDashboardUsers, trackDashboardOperation, dashboardPageRoutes, resolveLegacyDashboardRoute, routesForDashboard, deploySite, createStaticApiOriginDependencies, deployStaticApiOrigin, verifyStaticApiOrigin, estimateStaticApiOriginMonthlyCost, createExistingStaticFullStackDependencies, generateExistingStaticFullStackTemplate, deployExistingStaticFullStack, estimateExistingStaticFullStackMonthlyCost, hashContainerContext, createContainerImageDependencies, buildAndPushContainerImage, infraEnvFromOutputs, buildFunctionEnv, deployServerlessApp, redeployServerlessApp, rollbackServerlessApp, setMaintenance, runRemoteCommand, resolveDashboardData, validateBackupDestination, BackupStore, encryptBackup, decryptBackup, backupCredentialStatus, S3BackupDestinationAdapter, BackupCoordinator, createBackupQueueHandlers, AwsDatabaseBackupSource, compressBackup, decompressBackup, BunFilesystemArchiveRuntime, FilesystemBackupSource, LogicalDatabaseBackupSource, BunDockerVolumeRuntime, DockerVolumeBackupSource, ControlPlaneBackupSource, AwsInfrastructureBackupSource, ConfigurationStore, parseDotenv, serializeDotenv, LocalEncryptedConfigurationBackend, AwsSecretsManagerConfigurationBackend, AwsSsmConfigurationBackend, ExternalConfigurationBackend, ConfigurationService, synchronizeConfiguredConfiguration, sanitizeCloudConfig, dashboardActions, resolveDashboardAction, startLocalDashboardServer };

package/dist/{chunk-703nkybg.js → chunk-7m60qnc8.js}

@@ -1087,6 +1087,15 @@ class EC2Client {
       return [];
     return Array.isArray(item) ? item : [item];
   }
+  parseFirstIpv6Address(item) {
+    for (const eni of this.parseArray(item)) {
+      for (const entry of this.parseArray(eni?.ipv6AddressesSet?.item)) {
+        if (entry?.ipv6Address)
+          return entry.ipv6Address;
+      }
+    }
+    return;
+  }
   parseTags(item) {
     return this.parseArray(item).map((t) => ({
       Key: t.key,
@@ -1110,6 +1119,7 @@ class EC2Client {
       } : undefined,
       PrivateIpAddress: i.privateIpAddress,
       PublicIpAddress: i.ipAddress,
+      Ipv6Address: this.parseFirstIpv6Address(i.networkInterfaceSet?.item),
       SubnetId: i.subnetId,
       VpcId: i.vpcId,
       SecurityGroups: this.parseArray(i.groupSet?.item).map((g) => ({

package/dist/{chunk-838t87x3.js → chunk-ztbn47we.js}

@@ -12,7 +12,7 @@ import {
 import {
   EC2Client,
   SSMClient
-} from "./chunk-703nkybg.js";
+} from "./chunk-7m60qnc8.js";
 import {
   CloudFormationClient
 } from "./chunk-4cjrg98a.js";
@@ -27,6 +27,98 @@ import {
 import { readFileSync } from "node:fs";
 import { join } from "node:path";
 
+// src/deploy/server-dns.ts
+function collectServerDnsDomains(sites = {}) {
+  const domains = new Set;
+  for (const site of Object.values(sites)) {
+    if (!site.domain)
+      continue;
+    if (site.redirect || site.deploy === "server" || site.start)
+      domains.add(site.domain);
+  }
+  return domains;
+}
+function normalizeName(name) {
+  return name.replace(/\.$/, "").toLowerCase();
+}
+function matchesHostname(record, zone, hostname) {
+  const recordName = normalizeName(record.name);
+  const normalizedZone = normalizeName(zone);
+  const normalizedHostname = normalizeName(hostname);
+  const relativeName = normalizedHostname === normalizedZone ? "@" : normalizedHostname.endsWith(`.${normalizedZone}`) ? normalizedHostname.slice(0, -(normalizedZone.length + 1)) : normalizedHostname;
+  return recordName === normalizedHostname || recordName === relativeName || relativeName === "@" && (recordName === "" || recordName === normalizedZone);
+}
+async function removeStaleServerAddressRecords(provider, zone, hostname, desiredAddress, recordType = "A") {
+  const listed = await provider.listRecords(zone);
+  if (!listed.success)
+    return [`could not list ${recordType} records: ${listed.message || "unknown provider error"}`];
+  const matching = listed.records.filter((record) => record.type === recordType && matchesHostname(record, zone, hostname));
+  const desiredIndex = matching.findIndex((record) => record.content === desiredAddress);
+  if (matching.length <= 1 || desiredIndex === -1)
+    return [];
+  const warnings = [];
+  for (const [index, record] of matching.entries()) {
+    if (index === desiredIndex)
+      continue;
+    const result = await provider.deleteRecord(zone, record);
+    if (!result.success)
+      warnings.push(`could not remove stale ${record.name} ${recordType} ${record.content}: ${result.message || "unknown provider error"}`);
+  }
+  return warnings;
+}
+function normalizePublicIpv6(reported) {
+  if (!reported)
+    return;
+  const trimmed = reported.trim();
+  if (!trimmed)
+    return;
+  if (!trimmed.includes("/"))
+    return trimmed;
+  const [block] = trimmed.split("/");
+  if (!block.endsWith("::"))
+    return block || undefined;
+  return `${block}1`;
+}
+var IPV6_EXCLUDED_HOST_LABELS = new Set(["mail", "smtp", "imap", "mx"]);
+function hostAcceptsIpv6(fqdn) {
+  return !IPV6_EXCLUDED_HOST_LABELS.has(fqdn.split(".")[0] ?? "");
+}
+async function reconcileAddressRecords(options) {
+  const { provider, zone, fqdn, ipv4, ipv6, ttl = 600 } = options;
+  const report = { published: [], warnings: [] };
+  const families = [{ type: "A", content: ipv4 }];
+  if (ipv6 && hostAcceptsIpv6(fqdn))
+    families.push({ type: "AAAA", content: ipv6 });
+  for (const { type, content } of families) {
+    const result = await provider.upsertRecord(zone, { name: fqdn, type, content, ttl });
+    if (result?.success === false) {
+      report.warnings.push(`${fqdn} → ${content} failed: ${result.error || result.message || "unknown error"}`);
+      continue;
+    }
+    report.warnings.push(...(await removeStaleServerAddressRecords(provider, zone, fqdn, content, type)).map((warning) => `${fqdn} cleanup: ${warning}`));
+    if (await verifyAddressRecord(provider, zone, fqdn, content, type))
+      report.published.push({ fqdn, type, content });
+    else
+      report.warnings.push(`${fqdn} → ${content} reported success at ${provider.name} but no matching ${type} record exists — create it manually: ${type} ${fqdn} → ${content}`);
+  }
+  return report;
+}
+async function verifyAddressRecord(provider, zone, fqdn, content, recordType) {
+  try {
+    if (typeof provider?.listRecords !== "function")
+      return true;
+    const listed = await provider.listRecords(zone);
+    if (!listed?.success || !Array.isArray(listed.records))
+      return true;
+    return listed.records.some((record) => {
+      const name = typeof record?.name === "string" ? record.name.replace(/\.$/, "") : "";
+      return record?.type === recordType && name === fqdn && record?.content === content;
+    });
+  } catch {
+    return true;
+  }
+}
+
 // src/drivers/shared/package-manager.ts
 var PANTRY_PACKAGES = {
   php: "php.net",
@@ -1752,6 +1844,7 @@ class AwsDriver {
       return {
         appInstanceId: first.id,
         appPublicIp: first.publicIp,
+        appPublicIpv6: first.publicIpv6,
         sshUser: "ubuntu",
         deployStoragePath: "/var/ts-cloud/staging"
       };
@@ -1834,6 +1927,7 @@ class AwsDriver {
     return {
       appInstanceId: instanceId,
       appPublicIp: running.PublicIpAddress,
+      appPublicIpv6: normalizePublicIpv6(running.Ipv6Address),
       sshUser: "ubuntu",
       deployStoragePath: "/var/ts-cloud/staging"
     };
@@ -1892,6 +1986,7 @@ class AwsDriver {
       return {
         appInstanceId: first?.id,
         appPublicIp: first?.publicIp,
+        appPublicIpv6: first?.publicIpv6,
         sshUser: "ubuntu",
         deployStoragePath: "/var/ts-cloud/staging"
       };
@@ -1961,6 +2056,7 @@ class AwsDriver {
           id: instance.InstanceId,
           name: nameTag,
           publicIp: instance.PublicIpAddress,
+          publicIpv6: normalizePublicIpv6(instance.Ipv6Address),
           privateIp: instance.PrivateIpAddress,
           status: instance.State?.Name
         });
@@ -2613,6 +2709,7 @@ class HetznerDriver {
         serverId: alreadyRunning.id,
         serverName: alreadyRunning.name,
         publicIp: alreadyRunning.public_net.ipv4?.ip,
+        publicIpv6: normalizePublicIpv6(alreadyRunning.public_net.ipv6?.ip),
         deployStoragePath: "/var/ts-cloud/staging",
         sshUser: this.sshUser
       };
@@ -2660,6 +2757,7 @@ class HetznerDriver {
       serverName: running.name,
       firewallId: firewall.id,
       publicIp: running.public_net.ipv4?.ip,
+      publicIpv6: normalizePublicIpv6(running.public_net.ipv6?.ip),
       deployStoragePath: "/var/ts-cloud/staging",
       sshUser: this.sshUser
     };
@@ -3161,6 +3259,7 @@ class HetznerDriver {
       id: String(server.id),
       name: server.name,
       publicIp: server.public_net.ipv4?.ip,
+      publicIpv6: normalizePublicIpv6(server.public_net.ipv6?.ip),
       privateIp: server.private_net?.[0]?.ip,
       status: server.status
     });
@@ -3373,6 +3472,7 @@ ${out}`);
       deployStoragePath: state.deployStoragePath || "/var/ts-cloud/staging",
       appInstanceId: state.serverId ? String(state.serverId) : undefined,
       appPublicIp: server?.public_net.ipv4?.ip || state.publicIp,
+      appPublicIpv6: normalizePublicIpv6(server?.public_net.ipv6?.ip) || state.publicIpv6,
       sshUser: state.sshUser || this.sshUser,
       servicesPrivateIp: state.servicesPrivateIp
     };
@@ -6198,4 +6298,4 @@ function buildCloudFrontOriginConfig(options) {
     CustomErrorResponses: { Quantity: 0 }
   };
 }
-export { PANTRY_PROJECT_DIR, pgAdminCommand, BACKUP_RUNNER_PATH, buildBackupRestoreScript, siteInstallBase, isPhpSite, resolveSiteDeployTarget, resolveSiteKind, validateDeploymentConfig, shipsARelease, DEFAULT_RPX_CERTS_DIR, normalizeRoutePath, deriveRouteId, buildRpxConfig, buildRpxLbConfig, renderRpxLauncher, RPX_DIR, RPX_LAUNCHER_PATH, RPX_SERVICE_NAME, buildRpxProvisionScript, buildRpxFragmentRefreshScript, buildUbuntuBootstrapScript, AwsDriver, resolveHetznerLocation, HetznerClient, resolveHetznerApiToken2 as resolveHetznerApiToken, normalizeSshPublicKey, wrapCloudInitUserData, HetznerDriver, LocalBoxDriver, isBoxMode, createCloudDriver, CloudDriverFactory, cloudDrivers, planHetznerServerResize, isHetznerCapacityError, executeHetznerServerResize, buildSshArgs, sshExec, sshExecOrThrow, scpUpload, waitForSsh, waitForCloudInit, collectHetznerResizeManifest, prepareHetznerResize, verifyHetznerResize, resolveHetznerHostOptimizationPlan, buildHetznerHostOptimizationScript, applyHetznerHostOptimization, collectHetznerHostOptimizationReport, verifyHetznerHostOptimization, resizeCheckpointPath, resizeLockPath, readResizeCheckpoint, writeResizeCheckpoint, acquireResizeLock, ensureSshKey, ensureFirewall, ensureServer, serverPublicIpv4, UBUNTU_2404_AMI_PARAM, buildBoxUserData, HetznerBoxProvisioner, AwsBoxProvisioner, createBoxProvisioner, releasePaths, buildRollbackScript, resolveExecStart, buildSiteDeployScript, buildStaticSiteDeployScript, releaseTarballTmpPath, buildAwsArtifactFetch, buildLocalArtifactFetch, buildHostCleanupScript, MANAGEMENT_DASHBOARD_SITE, dashboardCredentialsFile, resolveDashboardAuth, resolveUiSource, ensureManagementDashboard, buildManagementDashboardArtifact, resolveSiteFramework, deploySiteRelease, deployAllComputeSites, reloadRpxGateway, renewRpxCertificates, MANAGED_CACHE_POLICY_OPTIMIZED, MANAGED_CACHE_POLICY_DISABLED, MANAGED_ORIGIN_REQUEST_POLICY_ALL_VIEWER, buildCloudFrontOriginConfig };
+export { collectServerDnsDomains, removeStaleServerAddressRecords, normalizePublicIpv6, IPV6_EXCLUDED_HOST_LABELS, hostAcceptsIpv6, reconcileAddressRecords, verifyAddressRecord, PANTRY_PROJECT_DIR, pgAdminCommand, BACKUP_RUNNER_PATH, buildBackupRestoreScript, siteInstallBase, isPhpSite, resolveSiteDeployTarget, resolveSiteKind, validateDeploymentConfig, shipsARelease, DEFAULT_RPX_CERTS_DIR, normalizeRoutePath, deriveRouteId, buildRpxConfig, buildRpxLbConfig, renderRpxLauncher, RPX_DIR, RPX_LAUNCHER_PATH, RPX_SERVICE_NAME, buildRpxProvisionScript, buildRpxFragmentRefreshScript, buildUbuntuBootstrapScript, AwsDriver, resolveHetznerLocation, HetznerClient, resolveHetznerApiToken2 as resolveHetznerApiToken, normalizeSshPublicKey, wrapCloudInitUserData, HetznerDriver, LocalBoxDriver, isBoxMode, createCloudDriver, CloudDriverFactory, cloudDrivers, planHetznerServerResize, isHetznerCapacityError, executeHetznerServerResize, buildSshArgs, sshExec, sshExecOrThrow, scpUpload, waitForSsh, waitForCloudInit, collectHetznerResizeManifest, prepareHetznerResize, verifyHetznerResize, resolveHetznerHostOptimizationPlan, buildHetznerHostOptimizationScript, applyHetznerHostOptimization, collectHetznerHostOptimizationReport, verifyHetznerHostOptimization, resizeCheckpointPath, resizeLockPath, readResizeCheckpoint, writeResizeCheckpoint, acquireResizeLock, ensureSshKey, ensureFirewall, ensureServer, serverPublicIpv4, UBUNTU_2404_AMI_PARAM, buildBoxUserData, HetznerBoxProvisioner, AwsBoxProvisioner, createBoxProvisioner, releasePaths, buildRollbackScript, resolveExecStart, buildSiteDeployScript, buildStaticSiteDeployScript, releaseTarballTmpPath, buildAwsArtifactFetch, buildLocalArtifactFetch, buildHostCleanupScript, MANAGEMENT_DASHBOARD_SITE, dashboardCredentialsFile, resolveDashboardAuth, resolveUiSource, ensureManagementDashboard, buildManagementDashboardArtifact, resolveSiteFramework, deploySiteRelease, deployAllComputeSites, reloadRpxGateway, renewRpxCertificates, MANAGED_CACHE_POLICY_OPTIMIZED, MANAGED_CACHE_POLICY_DISABLED, MANAGED_ORIGIN_REQUEST_POLICY_ALL_VIEWER, buildCloudFrontOriginConfig };

package/dist/deploy/index.js

@@ -1,7 +1,6 @@
 import {
   buildAndPushContainerImage,
   buildFunctionEnv,
-  collectServerDnsDomains,
   createContainerImageDependencies,
   createExistingStaticFullStackDependencies,
   createStaticApiOriginDependencies,
@@ -19,7 +18,6 @@ import {
   infraEnvFromOutputs,
   initializeDashboardControlPlane,
   redeployServerlessApp,
-  removeStaleServerAddressRecords,
   resolveDashboardAction,
   resolveDashboardData,
   resolveLegacyDashboardRoute,
@@ -32,7 +30,7 @@ import {
   synchronizeDashboardUsers,
   trackDashboardOperation,
   verifyStaticApiOrigin
-} from "../chunk-8m38yfba.js";
+} from "../chunk-4erbrg3e.js";
 import {
   deleteStaticSite,
   deployStaticSite,
@@ -53,21 +51,28 @@ import"../chunk-50jpda9q.js";
 import"../chunk-he9a874b.js";
 import"../chunk-gttvakpv.js";
 import {
+  IPV6_EXCLUDED_HOST_LABELS,
   MANAGEMENT_DASHBOARD_SITE,
   buildManagementDashboardArtifact,
+  collectServerDnsDomains,
   dashboardCredentialsFile,
   ensureManagementDashboard,
+  hostAcceptsIpv6,
   isPhpSite,
+  normalizePublicIpv6,
+  reconcileAddressRecords,
+  removeStaleServerAddressRecords,
   resolveDashboardAuth,
   resolveSiteDeployTarget,
   resolveSiteKind,
   resolveUiSource,
   shipsARelease,
   siteInstallBase,
-  validateDeploymentConfig
-} from "../chunk-838t87x3.js";
+  validateDeploymentConfig,
+  verifyAddressRecord
+} from "../chunk-ztbn47we.js";
 import"../chunk-1qjyqrc5.js";
-import"../chunk-703nkybg.js";
+import"../chunk-7m60qnc8.js";
 import"../chunk-4cjrg98a.js";
 import"../chunk-hpv68b4a.js";
 import"../chunk-32e7ya18.js";
@@ -76,6 +81,7 @@ import"../chunk-zqtpg06c.js";
 import"../chunk-v0bahtg2.js";
 export {
   verifyStaticApiOrigin,
+  verifyAddressRecord,
   validateDeploymentConfig,
   uploadStaticFiles,
   trackDashboardOperation,
@@ -97,10 +103,13 @@ export {
   resolveDashboardAction,
   removeStaleServerAddressRecords,
   redeployServerlessApp,
+  reconcileAddressRecords,
+  normalizePublicIpv6,
   isPhpSite,
   invalidateCache,
   initializeDashboardControlPlane,
   infraEnvFromOutputs,
+  hostAcceptsIpv6,
   hashContainerContext,
   generateStaticSiteTemplate,
   generateExternalDnsStaticSiteTemplate,
@@ -129,5 +138,6 @@ export {
   buildFunctionEnv,
   buildAndPushServerlessImage,
   buildAndPushContainerImage,
-  MANAGEMENT_DASHBOARD_SITE
+  MANAGEMENT_DASHBOARD_SITE,
+  IPV6_EXCLUDED_HOST_LABELS
 };

package/dist/deploy/server-dns.d.ts

@@ -9,8 +9,82 @@ interface ServerSite {
 export declare function collectServerDnsDomains(sites?: Record<string, ServerSite>): Set<string>;
 /**
  * A compute deployment owns one address per managed hostname. After an upsert,
- * remove only duplicate A records for that exact hostname, preserving one copy
- * of the desired address and leaving every unrelated record untouched.
+ * remove only duplicate address records for that exact hostname, preserving one
+ * copy of the desired address and leaving every unrelated record untouched.
+ *
+ * `recordType` selects the family. It used to be hardcoded to 'A', which meant
+ * a dual-stack box could clean up its stale IPv4 records but accumulated stale
+ * AAAA ones forever — and a stale AAAA is worse than a stale A, because
+ * dual-stack clients prefer IPv6 and would keep landing on the dead address.
  */
-export declare function removeStaleServerAddressRecords(provider: DnsProvider, zone: string, hostname: string, desiredAddress: string): Promise<string[]>;
+export declare function removeStaleServerAddressRecords(provider: DnsProvider, zone: string, hostname: string, desiredAddress: string, recordType?: 'A' | 'AAAA'): Promise<string[]>;
+/**
+ * Turn whatever a provider reports as a box's IPv6 into an address an AAAA
+ * record can point at.
+ *
+ * Providers disagree on what "the server's IPv6" means. Hetzner hands out a
+ * routed /64 and reports the block (`2a01:4f8:c014:6186::/64`) while the
+ * interface actually holds `::1` inside it; AWS reports a plain address per
+ * network interface. Publishing a block verbatim gives an AAAA record nothing
+ * answers on, which is the kind of failure that only shows up for the fraction
+ * of visitors whose network prefers IPv6 — so every driver runs its value
+ * through here rather than reinventing the narrowing.
+ *
+ * A plain address passes through unchanged.
+ */
+export declare function normalizePublicIpv6(reported: string | undefined | null): string | undefined;
+/**
+ * Hostname labels that must stay IPv4-only.
+ *
+ * A box typically runs its mail server on IPv4 alone, and its IPv6 address
+ * usually has no PTR — both of which make an AAAA on a mail host actively
+ * harmful: senders try the v6 address first, find nothing listening (or get
+ * rejected for the missing reverse record) and defer the message. Web traffic
+ * has no such constraint, so the exclusion is per-host rather than per-zone.
+ */
+export declare const IPV6_EXCLUDED_HOST_LABELS: ReadonlySet<string>;
+/** Whether `fqdn` should get an AAAA record pointing at the box. */
+export declare function hostAcceptsIpv6(fqdn: string): boolean;
+export interface AddressRecordReport {
+    /** Records confirmed present at the provider after the write. */
+    published: Array<{
+        fqdn: string;
+        type: 'A' | 'AAAA';
+        content: string;
+    }>;
+    /** Anything the caller should surface: failed writes, unverified writes, stale-record cleanup problems. */
+    warnings: string[];
+}
+interface ReconcileAddressRecordsOptions {
+    provider: DnsProvider;
+    zone: string;
+    fqdn: string;
+    ipv4: string;
+    /** Omit when the box has no public IPv6; the AAAA pass is then skipped entirely. */
+    ipv6?: string;
+    ttl?: number;
+}
+/**
+ * Point one hostname at a box on every address family the box actually has.
+ *
+ * Shared by every driver and by the framework's deploy command so the rules
+ * live in one place: upsert, then remove the *other* records of that family for
+ * the same hostname (a leftover address round-robins traffic to a dead host —
+ * and a stale AAAA is the worse of the two, because dual-stack clients prefer
+ * IPv6), then verify against the provider rather than trusting the write.
+ */
+export declare function reconcileAddressRecords(options: ReconcileAddressRecordsOptions): Promise<AddressRecordReport>;
+/**
+ * Best-effort post-write check that the record exists at the provider.
+ *
+ * Returns true when the provider offers no list API or the listing itself
+ * fails: verification must never turn a possibly-good write into a false
+ * alarm. It exists to catch phantom successes — an upsert that reported OK
+ * while editing the wrong record — at providers that can list their zone.
+ *
+ * The listing is deliberately untyped. Typed listings map to endpoints like
+ * Porkbun's retrieveByNameType, whose subdomain-less form returns apex records
+ * only, which made verification blind to every non-apex record.
+ */
+export declare function verifyAddressRecord(provider: DnsProvider, zone: string, fqdn: string, content: string, recordType: 'A' | 'AAAA'): Promise<boolean>;
 export {};

package/dist/drivers/hetzner/state.d.ts

@@ -6,6 +6,14 @@ export interface HetznerDriverState {
     serverName?: string;
     firewallId?: number;
     publicIp?: string;
+    /**
+     * The box's public IPv6 address, already narrowed from the routed /64 the
+     * API reports to the address the interface actually holds. Recorded so a
+     * deploy can publish AAAA records alongside the A records without having to
+     * call the Hetzner API again — attach-mode tenants read this state and never
+     * see the server object at all.
+     */
+    publicIpv6?: string;
     deployStoragePath?: string;
     sshUser?: string;
     /** Fleet: network/LB ids + the services box private IP, for deploy + teardown. */

package/dist/drivers/index.js

@@ -68,9 +68,9 @@ import {
   waitForSsh,
   wrapCloudInitUserData,
   writeResizeCheckpoint
-} from "../chunk-838t87x3.js";
+} from "../chunk-ztbn47we.js";
 import"../chunk-1qjyqrc5.js";
-import"../chunk-703nkybg.js";
+import"../chunk-7m60qnc8.js";
 import"../chunk-4cjrg98a.js";
 import"../chunk-wj3s95p9.js";
 import"../chunk-zqtpg06c.js";

package/dist/index.d.ts

@@ -30,7 +30,8 @@ export { keyMatchesFilters, migrateObjectStorage, remapKey } from './object-stor
 export type { MigrateEndpoint, MigrateError, MigrateOptions, MigratePlanItem, MigrateProgress, MigrateResult, MigrateVerification, } from './object-storage/migrate';
 export * from './ssl';
 export { deployStaticSite, deployStaticSiteFull, uploadStaticFiles, invalidateCache, deleteStaticSite, generateStaticSiteTemplate, deployStaticSiteWithExternalDns, deployStaticSiteWithExternalDnsFull, generateExternalDnsStaticSiteTemplate, deploySite, resolveSiteDeployTarget, resolveSiteKind, validateDeploymentConfig, buildAndPushServerlessImage, buildFunctionEnv, deployServerlessApp, infraEnvFromOutputs, redeployServerlessApp, rollbackServerlessApp, runRemoteCommand, setMaintenance, buildManagementDashboardArtifact, dashboardCredentialsFile, ensureManagementDashboard, MANAGEMENT_DASHBOARD_SITE, resolveDashboardAuth, resolveUiSource, } from './deploy';
-export { collectServerDnsDomains, removeStaleServerAddressRecords } from './deploy/server-dns';
+export { collectServerDnsDomains, hostAcceptsIpv6, IPV6_EXCLUDED_HOST_LABELS, normalizePublicIpv6, reconcileAddressRecords, removeStaleServerAddressRecords, verifyAddressRecord, } from './deploy/server-dns';
+export type { AddressRecordReport } from './deploy/server-dns';
 export type { EnsureDashboardLogger, ResolvedDashboardAuth, StaticSiteConfig, DeployResult, UploadOptions, ExternalDnsStaticSiteConfig, ExternalDnsDeployResult, DeploySiteConfig, DeploySiteResult, StaticSiteDnsProvider, SiteDeployKind, DeploymentValidationResult, BuildImageOptions, BuiltImage, CodeSource, DeployServerlessOptions, ResolvedContext, } from './deploy';
 export { createCloudDriver, CloudDriverFactory, cloudDrivers, AwsDriver, HetznerDriver, HetznerClient, resolveHetznerApiToken, normalizeSshPublicKey, ensureFirewall, ensureServer, ensureSshKey, serverPublicIpv4, sshExec, sshExecOrThrow, scpUpload, waitForSsh, waitForCloudInit, buildSshArgs, generateUbuntuAppCloudInit, wrapCloudInitUserData, buildHostCleanupScript, buildSiteDeployScript, buildStaticSiteDeployScript, resolveExecStart, deployAllComputeSites, deploySiteRelease, } from './drivers';
 export type { CreateCloudDriverOptions } from './drivers/factory';

package/dist/index.js

@@ -139,7 +139,6 @@ import {
   capabilities,
   capacity,
   cloneSourceBinding,
-  collectServerDnsDomains,
   completeComposeVolumeDeletion,
   completeOidcAuthorization,
   composeProjectName,
@@ -234,7 +233,6 @@ import {
   releaseStrategyCapabilities,
   releaseTrafficPlan,
   removeSourceWebhook,
-  removeStaleServerAddressRecords,
   renderComposeTemplate,
   renderServerCron,
   requestHash,
@@ -285,7 +283,7 @@ import {
   volumeCapabilities,
   webhookEndpoint,
   zeroCapacity
-} from "./chunk-8m38yfba.js";
+} from "./chunk-4erbrg3e.js";
 import {
   deleteStaticSite,
   deployStaticSite,
@@ -367,6 +365,7 @@ import {
   CloudDriverFactory,
   HetznerClient,
   HetznerDriver,
+  IPV6_EXCLUDED_HOST_LABELS,
   MANAGEMENT_DASHBOARD_SITE,
   buildHostCleanupScript,
   buildManagementDashboardArtifact,
@@ -375,6 +374,7 @@ import {
   buildStaticSiteDeployScript,
   buildUbuntuBootstrapScript,
   cloudDrivers,
+  collectServerDnsDomains,
   createCloudDriver,
   dashboardCredentialsFile,
   deployAllComputeSites,
@@ -383,7 +383,11 @@ import {
   ensureManagementDashboard,
   ensureServer,
   ensureSshKey,
+  hostAcceptsIpv6,
+  normalizePublicIpv6,
   normalizeSshPublicKey,
+  reconcileAddressRecords,
+  removeStaleServerAddressRecords,
   resolveDashboardAuth,
   resolveExecStart,
   resolveHetznerApiToken,
@@ -395,10 +399,11 @@ import {
   sshExec,
   sshExecOrThrow,
   validateDeploymentConfig,
+  verifyAddressRecord,
   waitForCloudInit,
   waitForSsh,
   wrapCloudInitUserData
-} from "./chunk-838t87x3.js";
+} from "./chunk-ztbn47we.js";
 import {
   ABTestManager,
   AI,
@@ -816,7 +821,7 @@ import {
 import {
   EC2Client,
   SSMClient
-} from "./chunk-703nkybg.js";
+} from "./chunk-7m60qnc8.js";
 import {
   CloudFormationClient
 } from "./chunk-4cjrg98a.js";
@@ -5124,6 +5129,7 @@ export {
   verifyTotp,
   verifyMediaAccessToken,
   verifyArtifactSignature,
+  verifyAddressRecord,
   validateTemplateSize,
   validateTemplate,
   validateResourceLimits,
@@ -5265,6 +5271,7 @@ export {
   recordDashboardHostPosture,
   reconcileSourceWebhook,
   reconcileJobObservation,
+  reconcileAddressRecords,
   quickHash,
   queueManagementManager,
   publicKeyFingerprint,
@@ -5301,6 +5308,7 @@ export {
   normalizeSourceEvent,
   normalizeScheduleExpression,
   normalizeRuntimeStatus,
+  normalizePublicIpv6,
   nextScheduleRuns,
   networkSecurityManager,
   needsRenewal,
@@ -5345,6 +5353,7 @@ export {
   infraEnvFromOutputs,
   imageScanningManager,
   hotp,
+  hostAcceptsIpv6,
   healthCheckManager,
   hashString,
   hashManifest,
@@ -5773,6 +5782,7 @@ export {
   InvalidOperationTransitionError,
   InfrastructureGenerator,
   ImageScanningManager,
+  IPV6_EXCLUDED_HOST_LABELS,
   IAMClient,
   HetznerDriver,
   HetznerClient,