@stacksjs/ts-cloud 0.7.85 → 0.7.87

package/dist/{chunk-1qjyqrc5.js → chunk-24kwnpe5.js}

@@ -22000,6 +22000,8 @@ function resolveManagementDashboardSites(config, environment, opts) {
       start: `bun ${DASHBOARD_ENTRY} dashboard:serve --box --host 127.0.0.1 --port ${port}`,
       port,
       env: {
+        APP_ENV: "production",
+        NODE_ENV: "production",
         TS_CLOUD_DASHBOARD_TELEMETRY: "1"
       },
       zeroDowntime: false,

package/dist/{chunk-703nkybg.js → chunk-7m60qnc8.js}

@@ -1087,6 +1087,15 @@ class EC2Client {
       return [];
     return Array.isArray(item) ? item : [item];
   }
+  parseFirstIpv6Address(item) {
+    for (const eni of this.parseArray(item)) {
+      for (const entry of this.parseArray(eni?.ipv6AddressesSet?.item)) {
+        if (entry?.ipv6Address)
+          return entry.ipv6Address;
+      }
+    }
+    return;
+  }
   parseTags(item) {
     return this.parseArray(item).map((t) => ({
       Key: t.key,
@@ -1110,6 +1119,7 @@ class EC2Client {
       } : undefined,
       PrivateIpAddress: i.privateIpAddress,
       PublicIpAddress: i.ipAddress,
+      Ipv6Address: this.parseFirstIpv6Address(i.networkInterfaceSet?.item),
       SubnetId: i.subnetId,
       VpcId: i.vpcId,
       SecurityGroups: this.parseArray(i.groupSet?.item).map((g) => ({

package/dist/{chunk-d2aw5vyv.js → chunk-aqmdexc3.js}

@@ -8,7 +8,7 @@ import {
   phpRuntimeLayerAssets,
   runPhpBuildHooks,
   sha256
-} from "./chunk-1qjyqrc5.js";
+} from "./chunk-24kwnpe5.js";
 
 // src/deploy/serverless-image.ts
 import { execFileSync } from "node:child_process";

package/dist/{chunk-qbj74thz.js → chunk-cj3qrktr.js}

@@ -9,7 +9,7 @@ import {
   step,
   success,
   warn
-} from "./chunk-d2aw5vyv.js";
+} from "./chunk-aqmdexc3.js";
 import {
   AwsBackupClient,
   CloudWatchLogsClient,
@@ -45,7 +45,7 @@ import {
   resolveSiteKind,
   resolveUiSource,
   siteInstallBase
-} from "./chunk-gx4288t5.js";
+} from "./chunk-tcr4xba6.js";
 import {
   artifactKey,
   buildCloudFormationTemplate,
@@ -67,10 +67,10 @@ import {
   resolveStatePath,
   setStateDir,
   statePath
-} from "./chunk-1qjyqrc5.js";
+} from "./chunk-24kwnpe5.js";
 import {
   SSMClient
-} from "./chunk-703nkybg.js";
+} from "./chunk-7m60qnc8.js";
 import {
   CloudFormationClient
 } from "./chunk-4cjrg98a.js";
@@ -8324,7 +8324,7 @@ async function deployServerlessApp(config, environment2, opts = {}) {
   }
   if (imageMode) {
     step("Building + pushing container image");
-    const { buildAndPushServerlessImage } = await import("./chunk-tq4v58zp.js");
+    const { buildAndPushServerlessImage } = await import("./chunk-w61hh7n3.js");
     const built = await buildAndPushServerlessImage({
       app,
       projectRoot,

package/dist/{chunk-gx4288t5.js → chunk-tcr4xba6.js}

@@ -8,11 +8,11 @@ import {
   resolveProjectStackName,
   resolveStatePath,
   statePath
-} from "./chunk-1qjyqrc5.js";
+} from "./chunk-24kwnpe5.js";
 import {
   EC2Client,
   SSMClient
-} from "./chunk-703nkybg.js";
+} from "./chunk-7m60qnc8.js";
 import {
   CloudFormationClient
 } from "./chunk-4cjrg98a.js";
@@ -27,6 +27,98 @@ import {
 import { readFileSync } from "node:fs";
 import { join } from "node:path";
 
+// src/deploy/server-dns.ts
+function collectServerDnsDomains(sites = {}) {
+  const domains = new Set;
+  for (const site of Object.values(sites)) {
+    if (!site.domain)
+      continue;
+    if (site.redirect || site.deploy === "server" || site.start)
+      domains.add(site.domain);
+  }
+  return domains;
+}
+function normalizeName(name) {
+  return name.replace(/\.$/, "").toLowerCase();
+}
+function matchesHostname(record, zone, hostname) {
+  const recordName = normalizeName(record.name);
+  const normalizedZone = normalizeName(zone);
+  const normalizedHostname = normalizeName(hostname);
+  const relativeName = normalizedHostname === normalizedZone ? "@" : normalizedHostname.endsWith(`.${normalizedZone}`) ? normalizedHostname.slice(0, -(normalizedZone.length + 1)) : normalizedHostname;
+  return recordName === normalizedHostname || recordName === relativeName || relativeName === "@" && (recordName === "" || recordName === normalizedZone);
+}
+async function removeStaleServerAddressRecords(provider, zone, hostname, desiredAddress, recordType = "A") {
+  const listed = await provider.listRecords(zone);
+  if (!listed.success)
+    return [`could not list ${recordType} records: ${listed.message || "unknown provider error"}`];
+  const matching = listed.records.filter((record) => record.type === recordType && matchesHostname(record, zone, hostname));
+  const desiredIndex = matching.findIndex((record) => record.content === desiredAddress);
+  if (matching.length <= 1 || desiredIndex === -1)
+    return [];
+  const warnings = [];
+  for (const [index, record] of matching.entries()) {
+    if (index === desiredIndex)
+      continue;
+    const result = await provider.deleteRecord(zone, record);
+    if (!result.success)
+      warnings.push(`could not remove stale ${record.name} ${recordType} ${record.content}: ${result.message || "unknown provider error"}`);
+  }
+  return warnings;
+}
+function normalizePublicIpv6(reported) {
+  if (!reported)
+    return;
+  const trimmed = reported.trim();
+  if (!trimmed)
+    return;
+  if (!trimmed.includes("/"))
+    return trimmed;
+  const [block] = trimmed.split("/");
+  if (!block.endsWith("::"))
+    return block || undefined;
+  return `${block}1`;
+}
+var IPV6_EXCLUDED_HOST_LABELS = new Set(["mail", "smtp", "imap", "mx"]);
+function hostAcceptsIpv6(fqdn) {
+  return !IPV6_EXCLUDED_HOST_LABELS.has(fqdn.split(".")[0] ?? "");
+}
+async function reconcileAddressRecords(options) {
+  const { provider, zone, fqdn, ipv4, ipv6, ttl = 600 } = options;
+  const report = { published: [], warnings: [] };
+  const families = [{ type: "A", content: ipv4 }];
+  if (ipv6 && hostAcceptsIpv6(fqdn))
+    families.push({ type: "AAAA", content: ipv6 });
+  for (const { type, content } of families) {
+    const result = await provider.upsertRecord(zone, { name: fqdn, type, content, ttl });
+    if (result?.success === false) {
+      report.warnings.push(`${fqdn} → ${content} failed: ${result.error || result.message || "unknown error"}`);
+      continue;
+    }
+    report.warnings.push(...(await removeStaleServerAddressRecords(provider, zone, fqdn, content, type)).map((warning) => `${fqdn} cleanup: ${warning}`));
+    if (await verifyAddressRecord(provider, zone, fqdn, content, type))
+      report.published.push({ fqdn, type, content });
+    else
+      report.warnings.push(`${fqdn} → ${content} reported success at ${provider.name} but no matching ${type} record exists — create it manually: ${type} ${fqdn} → ${content}`);
+  }
+  return report;
+}
+async function verifyAddressRecord(provider, zone, fqdn, content, recordType) {
+  try {
+    if (typeof provider?.listRecords !== "function")
+      return true;
+    const listed = await provider.listRecords(zone);
+    if (!listed?.success || !Array.isArray(listed.records))
+      return true;
+    return listed.records.some((record) => {
+      const name = typeof record?.name === "string" ? record.name.replace(/\.$/, "") : "";
+      return record?.type === recordType && name === fqdn && record?.content === content;
+    });
+  } catch {
+    return true;
+  }
+}
+
 // src/drivers/shared/package-manager.ts
 var PANTRY_PACKAGES = {
   php: "php.net",
@@ -1163,6 +1255,7 @@ function usesRpxProxy(compute) {
 var RPX_DIR = "/etc/rpx";
 var RPX_INSTALL_DIR = "/opt/rpx-gateway";
 var RPX_LAUNCHER_PATH = "/etc/rpx/gateway.ts";
+var RPX_BINARY_PATH = "/etc/rpx/gateway";
 var RPX_SERVICE_NAME = "rpx-gateway.service";
 var RPX_SITES_DIR = "/etc/rpx/sites.d";
 function renderRpxAssembler(sitesDir = RPX_SITES_DIR, defaultCertsDir = DEFAULT_RPX_CERTS_DIR) {
@@ -1368,6 +1461,9 @@ function buildRpxProvisionScript(options) {
     `ln -sfn ${RPX_INSTALL_DIR}/node_modules ${RPX_DIR}/node_modules`,
     ...writeFileHeredoc(`${RPX_SITES_DIR}/${slug}.json`, fragment, "TS_CLOUD_RPX_FRAGMENT_EOF", "0600"),
     ...writeFileHeredoc(RPX_LAUNCHER_PATH, assembler, "TS_CLOUD_RPX_EOF"),
+    `${bunBin} build --production --compile --outfile ${RPX_BINARY_PATH}.next ${RPX_LAUNCHER_PATH}`,
+    `chmod 0755 ${RPX_BINARY_PATH}.next`,
+    `mv -f ${RPX_BINARY_PATH}.next ${RPX_BINARY_PATH}`,
     ...writeFileHeredoc(`/etc/systemd/system/${RPX_SERVICE_NAME}`, [
       "[Unit]",
       "Description=rpx reverse-proxy gateway (managed by ts-cloud)",
@@ -1376,9 +1472,11 @@ function buildRpxProvisionScript(options) {
       "",
       "[Service]",
       "Type=simple",
-      `ExecStart=${bunBin} ${RPX_LAUNCHER_PATH}`,
+      `ExecStart=${RPX_BINARY_PATH}`,
       `WorkingDirectory=${RPX_INSTALL_DIR}`,
       `Environment=BUN_INSTALL=/root/.bun`,
+      `Environment=APP_ENV=production`,
+      `Environment=NODE_ENV=production`,
       ...poolEnv,
       "MemoryAccounting=true",
       `MemoryHigh=${memoryHigh}`,
@@ -1752,6 +1850,7 @@ class AwsDriver {
       return {
         appInstanceId: first.id,
         appPublicIp: first.publicIp,
+        appPublicIpv6: first.publicIpv6,
         sshUser: "ubuntu",
         deployStoragePath: "/var/ts-cloud/staging"
       };
@@ -1834,6 +1933,7 @@ class AwsDriver {
     return {
       appInstanceId: instanceId,
       appPublicIp: running.PublicIpAddress,
+      appPublicIpv6: normalizePublicIpv6(running.Ipv6Address),
       sshUser: "ubuntu",
       deployStoragePath: "/var/ts-cloud/staging"
     };
@@ -1892,6 +1992,7 @@ class AwsDriver {
       return {
         appInstanceId: first?.id,
         appPublicIp: first?.publicIp,
+        appPublicIpv6: first?.publicIpv6,
         sshUser: "ubuntu",
         deployStoragePath: "/var/ts-cloud/staging"
       };
@@ -1961,6 +2062,7 @@ class AwsDriver {
           id: instance.InstanceId,
           name: nameTag,
           publicIp: instance.PublicIpAddress,
+          publicIpv6: normalizePublicIpv6(instance.Ipv6Address),
           privateIp: instance.PrivateIpAddress,
           status: instance.State?.Name
         });
@@ -2045,59 +2147,6 @@ import { execSync } from "node:child_process";
 import { randomUUID } from "node:crypto";
 import { existsSync, readFileSync as readFileSync2 } from "node:fs";
 
-// src/deploy/server-dns.ts
-function collectServerDnsDomains(sites = {}) {
-  const domains = new Set;
-  for (const site of Object.values(sites)) {
-    if (!site.domain)
-      continue;
-    if (site.redirect || site.deploy === "server" || site.start)
-      domains.add(site.domain);
-  }
-  return domains;
-}
-function normalizeName(name) {
-  return name.replace(/\.$/, "").toLowerCase();
-}
-function matchesHostname(record, zone, hostname) {
-  const recordName = normalizeName(record.name);
-  const normalizedZone = normalizeName(zone);
-  const normalizedHostname = normalizeName(hostname);
-  const relativeName = normalizedHostname === normalizedZone ? "@" : normalizedHostname.endsWith(`.${normalizedZone}`) ? normalizedHostname.slice(0, -(normalizedZone.length + 1)) : normalizedHostname;
-  return recordName === normalizedHostname || recordName === relativeName || relativeName === "@" && (recordName === "" || recordName === normalizedZone);
-}
-async function removeStaleServerAddressRecords(provider, zone, hostname, desiredAddress, recordType = "A") {
-  const listed = await provider.listRecords(zone);
-  if (!listed.success)
-    return [`could not list ${recordType} records: ${listed.message || "unknown provider error"}`];
-  const matching = listed.records.filter((record) => record.type === recordType && matchesHostname(record, zone, hostname));
-  const desiredIndex = matching.findIndex((record) => record.content === desiredAddress);
-  if (matching.length <= 1 || desiredIndex === -1)
-    return [];
-  const warnings = [];
-  for (const [index, record] of matching.entries()) {
-    if (index === desiredIndex)
-      continue;
-    const result = await provider.deleteRecord(zone, record);
-    if (!result.success)
-      warnings.push(`could not remove stale ${record.name} ${recordType} ${record.content}: ${result.message || "unknown provider error"}`);
-  }
-  return warnings;
-}
-function hetznerBoxIpv6(reported) {
-  if (!reported)
-    return;
-  const trimmed = reported.trim();
-  if (!trimmed)
-    return;
-  if (!trimmed.includes("/"))
-    return trimmed;
-  const [block] = trimmed.split("/");
-  if (!block.endsWith("::"))
-    return block || undefined;
-  return `${block}1`;
-}
-
 // src/drivers/shared/fleet.ts
 function resolveFleetTopology(compute = {}) {
   const appServers = Math.max(1, compute.appServers ?? compute.instances ?? 1);
@@ -2666,7 +2715,7 @@ class HetznerDriver {
         serverId: alreadyRunning.id,
         serverName: alreadyRunning.name,
         publicIp: alreadyRunning.public_net.ipv4?.ip,
-        publicIpv6: hetznerBoxIpv6(alreadyRunning.public_net.ipv6?.ip),
+        publicIpv6: normalizePublicIpv6(alreadyRunning.public_net.ipv6?.ip),
         deployStoragePath: "/var/ts-cloud/staging",
         sshUser: this.sshUser
       };
@@ -2714,7 +2763,7 @@ class HetznerDriver {
       serverName: running.name,
       firewallId: firewall.id,
       publicIp: running.public_net.ipv4?.ip,
-      publicIpv6: hetznerBoxIpv6(running.public_net.ipv6?.ip),
+      publicIpv6: normalizePublicIpv6(running.public_net.ipv6?.ip),
       deployStoragePath: "/var/ts-cloud/staging",
       sshUser: this.sshUser
     };
@@ -3216,6 +3265,7 @@ class HetznerDriver {
       id: String(server.id),
       name: server.name,
       publicIp: server.public_net.ipv4?.ip,
+      publicIpv6: normalizePublicIpv6(server.public_net.ipv6?.ip),
       privateIp: server.private_net?.[0]?.ip,
       status: server.status
     });
@@ -3428,7 +3478,7 @@ ${out}`);
       deployStoragePath: state.deployStoragePath || "/var/ts-cloud/staging",
       appInstanceId: state.serverId ? String(state.serverId) : undefined,
       appPublicIp: server?.public_net.ipv4?.ip || state.publicIp,
-      appPublicIpv6: hetznerBoxIpv6(server?.public_net.ipv6?.ip) || state.publicIpv6,
+      appPublicIpv6: normalizePublicIpv6(server?.public_net.ipv6?.ip) || state.publicIpv6,
       sshUser: state.sshUser || this.sshUser,
       servicesPrivateIp: state.servicesPrivateIp
     };
@@ -5172,7 +5222,12 @@ var STACKS_CLI = "storage/framework/core/buddy/src/cli.ts";
 var stacksDriver = {
   id: "stacks",
   wrapExec: (command) => command,
-  execEnv: { PATH: "/usr/local/bin:/usr/bin:/bin", BUN_INSTALL: "/root/.bun" },
+  execEnv: {
+    PATH: "/usr/local/bin:/usr/bin:/bin",
+    BUN_INSTALL: "/root/.bun",
+    APP_ENV: "production",
+    NODE_ENV: "production"
+  },
   schedulerMode: "daemon",
   schedulerCommand: () => `${BUN_BIN} ${STACKS_CLI} schedule:run`,
   queueWorkerCommand: (worker, { current }) => {
@@ -5658,7 +5713,13 @@ async function deploySiteRelease(driver, options, logger = noopLogger2) {
   const dbEnv = outputs.servicesPrivateIp ? buildFleetServicesEnv(outputs.servicesPrivateIp, resolveAppDatabase(config)) : buildManagedDbEnv(resolveAppDatabase(config));
   const compute = config.infrastructure?.compute;
   const proxyEnv = usesRpxProxy(compute) ? { HOST: "127.0.0.1" } : {};
-  const envWithServices = { ...dbEnv, ...proxyEnv, ...site.env || {} };
+  const productionEnv = environment === "production" ? { APP_ENV: "production", NODE_ENV: "production" } : {};
+  const envWithServices = {
+    ...dbEnv,
+    ...proxyEnv,
+    ...site.env || {},
+    ...productionEnv
+  };
   if (isPhpSite(site)) {
     const phpVersion = site.phpVersion ?? compute?.php?.default ?? compute?.php?.versions?.[0];
     const appBase2 = siteInstallBase(slug, siteName);
@@ -6254,4 +6315,4 @@ function buildCloudFrontOriginConfig(options) {
     CustomErrorResponses: { Quantity: 0 }
   };
 }
-export { PANTRY_PROJECT_DIR, pgAdminCommand, BACKUP_RUNNER_PATH, buildBackupRestoreScript, siteInstallBase, isPhpSite, resolveSiteDeployTarget, resolveSiteKind, validateDeploymentConfig, shipsARelease, DEFAULT_RPX_CERTS_DIR, normalizeRoutePath, deriveRouteId, buildRpxConfig, buildRpxLbConfig, renderRpxLauncher, RPX_DIR, RPX_LAUNCHER_PATH, RPX_SERVICE_NAME, buildRpxProvisionScript, buildRpxFragmentRefreshScript, buildUbuntuBootstrapScript, AwsDriver, collectServerDnsDomains, removeStaleServerAddressRecords, hetznerBoxIpv6, resolveHetznerLocation, HetznerClient, resolveHetznerApiToken2 as resolveHetznerApiToken, normalizeSshPublicKey, wrapCloudInitUserData, HetznerDriver, LocalBoxDriver, isBoxMode, createCloudDriver, CloudDriverFactory, cloudDrivers, planHetznerServerResize, isHetznerCapacityError, executeHetznerServerResize, buildSshArgs, sshExec, sshExecOrThrow, scpUpload, waitForSsh, waitForCloudInit, collectHetznerResizeManifest, prepareHetznerResize, verifyHetznerResize, resolveHetznerHostOptimizationPlan, buildHetznerHostOptimizationScript, applyHetznerHostOptimization, collectHetznerHostOptimizationReport, verifyHetznerHostOptimization, resizeCheckpointPath, resizeLockPath, readResizeCheckpoint, writeResizeCheckpoint, acquireResizeLock, ensureSshKey, ensureFirewall, ensureServer, serverPublicIpv4, UBUNTU_2404_AMI_PARAM, buildBoxUserData, HetznerBoxProvisioner, AwsBoxProvisioner, createBoxProvisioner, releasePaths, buildRollbackScript, resolveExecStart, buildSiteDeployScript, buildStaticSiteDeployScript, releaseTarballTmpPath, buildAwsArtifactFetch, buildLocalArtifactFetch, buildHostCleanupScript, MANAGEMENT_DASHBOARD_SITE, dashboardCredentialsFile, resolveDashboardAuth, resolveUiSource, ensureManagementDashboard, buildManagementDashboardArtifact, resolveSiteFramework, deploySiteRelease, deployAllComputeSites, reloadRpxGateway, renewRpxCertificates, MANAGED_CACHE_POLICY_OPTIMIZED, MANAGED_CACHE_POLICY_DISABLED, MANAGED_ORIGIN_REQUEST_POLICY_ALL_VIEWER, buildCloudFrontOriginConfig };
+export { collectServerDnsDomains, removeStaleServerAddressRecords, normalizePublicIpv6, IPV6_EXCLUDED_HOST_LABELS, hostAcceptsIpv6, reconcileAddressRecords, verifyAddressRecord, PANTRY_PROJECT_DIR, pgAdminCommand, BACKUP_RUNNER_PATH, buildBackupRestoreScript, siteInstallBase, isPhpSite, resolveSiteDeployTarget, resolveSiteKind, validateDeploymentConfig, shipsARelease, DEFAULT_RPX_CERTS_DIR, normalizeRoutePath, deriveRouteId, buildRpxConfig, buildRpxLbConfig, renderRpxLauncher, RPX_DIR, RPX_LAUNCHER_PATH, RPX_SERVICE_NAME, buildRpxProvisionScript, buildRpxFragmentRefreshScript, buildUbuntuBootstrapScript, AwsDriver, resolveHetznerLocation, HetznerClient, resolveHetznerApiToken2 as resolveHetznerApiToken, normalizeSshPublicKey, wrapCloudInitUserData, HetznerDriver, LocalBoxDriver, isBoxMode, createCloudDriver, CloudDriverFactory, cloudDrivers, planHetznerServerResize, isHetznerCapacityError, executeHetznerServerResize, buildSshArgs, sshExec, sshExecOrThrow, scpUpload, waitForSsh, waitForCloudInit, collectHetznerResizeManifest, prepareHetznerResize, verifyHetznerResize, resolveHetznerHostOptimizationPlan, buildHetznerHostOptimizationScript, applyHetznerHostOptimization, collectHetznerHostOptimizationReport, verifyHetznerHostOptimization, resizeCheckpointPath, resizeLockPath, readResizeCheckpoint, writeResizeCheckpoint, acquireResizeLock, ensureSshKey, ensureFirewall, ensureServer, serverPublicIpv4, UBUNTU_2404_AMI_PARAM, buildBoxUserData, HetznerBoxProvisioner, AwsBoxProvisioner, createBoxProvisioner, releasePaths, buildRollbackScript, resolveExecStart, buildSiteDeployScript, buildStaticSiteDeployScript, releaseTarballTmpPath, buildAwsArtifactFetch, buildLocalArtifactFetch, buildHostCleanupScript, MANAGEMENT_DASHBOARD_SITE, dashboardCredentialsFile, resolveDashboardAuth, resolveUiSource, ensureManagementDashboard, buildManagementDashboardArtifact, resolveSiteFramework, deploySiteRelease, deployAllComputeSites, reloadRpxGateway, renewRpxCertificates, MANAGED_CACHE_POLICY_OPTIMIZED, MANAGED_CACHE_POLICY_DISABLED, MANAGED_ORIGIN_REQUEST_POLICY_ALL_VIEWER, buildCloudFrontOriginConfig };

package/dist/{chunk-tq4v58zp.js → chunk-w61hh7n3.js}

@@ -1,8 +1,8 @@
 import {
   buildAndPushServerlessImage
-} from "./chunk-d2aw5vyv.js";
+} from "./chunk-aqmdexc3.js";
 import"./chunk-50jpda9q.js";
-import"./chunk-1qjyqrc5.js";
+import"./chunk-24kwnpe5.js";
 import"./chunk-zqtpg06c.js";
 import"./chunk-v0bahtg2.js";
 export {

package/dist/deploy/index.js

@@ -30,7 +30,7 @@ import {
   synchronizeDashboardUsers,
   trackDashboardOperation,
   verifyStaticApiOrigin
-} from "../chunk-qbj74thz.js";
+} from "../chunk-cj3qrktr.js";
 import {
   deleteStaticSite,
   deployStaticSite,
@@ -44,20 +44,23 @@ import {
 } from "../chunk-ef2dwfrg.js";
 import {
   buildAndPushServerlessImage
-} from "../chunk-d2aw5vyv.js";
+} from "../chunk-aqmdexc3.js";
 import"../chunk-ybcz6sxc.js";
 import"../chunk-01d86gt1.js";
 import"../chunk-50jpda9q.js";
 import"../chunk-he9a874b.js";
 import"../chunk-gttvakpv.js";
 import {
+  IPV6_EXCLUDED_HOST_LABELS,
   MANAGEMENT_DASHBOARD_SITE,
   buildManagementDashboardArtifact,
   collectServerDnsDomains,
   dashboardCredentialsFile,
   ensureManagementDashboard,
-  hetznerBoxIpv6,
+  hostAcceptsIpv6,
   isPhpSite,
+  normalizePublicIpv6,
+  reconcileAddressRecords,
   removeStaleServerAddressRecords,
   resolveDashboardAuth,
   resolveSiteDeployTarget,
@@ -65,10 +68,11 @@ import {
   resolveUiSource,
   shipsARelease,
   siteInstallBase,
-  validateDeploymentConfig
-} from "../chunk-gx4288t5.js";
-import"../chunk-1qjyqrc5.js";
-import"../chunk-703nkybg.js";
+  validateDeploymentConfig,
+  verifyAddressRecord
+} from "../chunk-tcr4xba6.js";
+import"../chunk-24kwnpe5.js";
+import"../chunk-7m60qnc8.js";
 import"../chunk-4cjrg98a.js";
 import"../chunk-hpv68b4a.js";
 import"../chunk-32e7ya18.js";
@@ -77,6 +81,7 @@ import"../chunk-zqtpg06c.js";
 import"../chunk-v0bahtg2.js";
 export {
   verifyStaticApiOrigin,
+  verifyAddressRecord,
   validateDeploymentConfig,
   uploadStaticFiles,
   trackDashboardOperation,
@@ -98,11 +103,13 @@ export {
   resolveDashboardAction,
   removeStaleServerAddressRecords,
   redeployServerlessApp,
+  reconcileAddressRecords,
+  normalizePublicIpv6,
   isPhpSite,
   invalidateCache,
   initializeDashboardControlPlane,
   infraEnvFromOutputs,
-  hetznerBoxIpv6,
+  hostAcceptsIpv6,
   hashContainerContext,
   generateStaticSiteTemplate,
   generateExternalDnsStaticSiteTemplate,
@@ -131,5 +138,6 @@ export {
   buildFunctionEnv,
   buildAndPushServerlessImage,
   buildAndPushContainerImage,
-  MANAGEMENT_DASHBOARD_SITE
+  MANAGEMENT_DASHBOARD_SITE,
+  IPV6_EXCLUDED_HOST_LABELS
 };

package/dist/deploy/server-dns.d.ts

@@ -19,13 +19,72 @@ export declare function collectServerDnsDomains(sites?: Record<string, ServerSit
  */
 export declare function removeStaleServerAddressRecords(provider: DnsProvider, zone: string, hostname: string, desiredAddress: string, recordType?: 'A' | 'AAAA'): Promise<string[]>;
 /**
- * Hetzner hands a cloud server a routed /64 and configures `::1` inside it on
- * the interface, but the API reports the block (`2a01:4f8:c014:6186::/64`), not
- * the address. Publishing the block verbatim as an AAAA record yields a host
- * nothing answers on, so turn it into the address the box actually holds.
+ * Turn whatever a provider reports as a box's IPv6 into an address an AAAA
+ * record can point at.
  *
- * A plain address (no prefix) is returned unchanged, so this is safe to apply
- * to whatever the driver surfaced.
+ * Providers disagree on what "the server's IPv6" means. Hetzner hands out a
+ * routed /64 and reports the block (`2a01:4f8:c014:6186::/64`) while the
+ * interface actually holds `::1` inside it; AWS reports a plain address per
+ * network interface. Publishing a block verbatim gives an AAAA record nothing
+ * answers on, which is the kind of failure that only shows up for the fraction
+ * of visitors whose network prefers IPv6 — so every driver runs its value
+ * through here rather than reinventing the narrowing.
+ *
+ * A plain address passes through unchanged.
+ */
+export declare function normalizePublicIpv6(reported: string | undefined | null): string | undefined;
+/**
+ * Hostname labels that must stay IPv4-only.
+ *
+ * A box typically runs its mail server on IPv4 alone, and its IPv6 address
+ * usually has no PTR — both of which make an AAAA on a mail host actively
+ * harmful: senders try the v6 address first, find nothing listening (or get
+ * rejected for the missing reverse record) and defer the message. Web traffic
+ * has no such constraint, so the exclusion is per-host rather than per-zone.
+ */
+export declare const IPV6_EXCLUDED_HOST_LABELS: ReadonlySet<string>;
+/** Whether `fqdn` should get an AAAA record pointing at the box. */
+export declare function hostAcceptsIpv6(fqdn: string): boolean;
+export interface AddressRecordReport {
+    /** Records confirmed present at the provider after the write. */
+    published: Array<{
+        fqdn: string;
+        type: 'A' | 'AAAA';
+        content: string;
+    }>;
+    /** Anything the caller should surface: failed writes, unverified writes, stale-record cleanup problems. */
+    warnings: string[];
+}
+interface ReconcileAddressRecordsOptions {
+    provider: DnsProvider;
+    zone: string;
+    fqdn: string;
+    ipv4: string;
+    /** Omit when the box has no public IPv6; the AAAA pass is then skipped entirely. */
+    ipv6?: string;
+    ttl?: number;
+}
+/**
+ * Point one hostname at a box on every address family the box actually has.
+ *
+ * Shared by every driver and by the framework's deploy command so the rules
+ * live in one place: upsert, then remove the *other* records of that family for
+ * the same hostname (a leftover address round-robins traffic to a dead host —
+ * and a stale AAAA is the worse of the two, because dual-stack clients prefer
+ * IPv6), then verify against the provider rather than trusting the write.
+ */
+export declare function reconcileAddressRecords(options: ReconcileAddressRecordsOptions): Promise<AddressRecordReport>;
+/**
+ * Best-effort post-write check that the record exists at the provider.
+ *
+ * Returns true when the provider offers no list API or the listing itself
+ * fails: verification must never turn a possibly-good write into a false
+ * alarm. It exists to catch phantom successes — an upsert that reported OK
+ * while editing the wrong record — at providers that can list their zone.
+ *
+ * The listing is deliberately untyped. Typed listings map to endpoints like
+ * Porkbun's retrieveByNameType, whose subdomain-less form returns apex records
+ * only, which made verification blind to every non-apex record.
  */
-export declare function hetznerBoxIpv6(reported: string | undefined | null): string | undefined;
+export declare function verifyAddressRecord(provider: DnsProvider, zone: string, fqdn: string, content: string, recordType: 'A' | 'AAAA'): Promise<boolean>;
 export {};

package/dist/drivers/index.js

@@ -68,9 +68,9 @@ import {
   waitForSsh,
   wrapCloudInitUserData,
   writeResizeCheckpoint
-} from "../chunk-gx4288t5.js";
-import"../chunk-1qjyqrc5.js";
-import"../chunk-703nkybg.js";
+} from "../chunk-tcr4xba6.js";
+import"../chunk-24kwnpe5.js";
+import"../chunk-7m60qnc8.js";
 import"../chunk-4cjrg98a.js";
 import"../chunk-wj3s95p9.js";
 import"../chunk-zqtpg06c.js";

package/dist/drivers/shared/rpx-gateway.d.ts

@@ -230,6 +230,7 @@ export declare function usesRpxProxy(compute?: {
 export declare const RPX_DIR = "/etc/rpx";
 export declare const RPX_INSTALL_DIR = "/opt/rpx-gateway";
 export declare const RPX_LAUNCHER_PATH = "/etc/rpx/gateway.ts";
+export declare const RPX_BINARY_PATH = "/etc/rpx/gateway";
 export declare const RPX_SERVICE_NAME = "rpx-gateway.service";
 /**
  * Per-app gateway registry. Each project's deploy writes ONLY its own fragment

package/dist/index.d.ts

@@ -30,7 +30,8 @@ export { keyMatchesFilters, migrateObjectStorage, remapKey } from './object-stor
 export type { MigrateEndpoint, MigrateError, MigrateOptions, MigratePlanItem, MigrateProgress, MigrateResult, MigrateVerification, } from './object-storage/migrate';
 export * from './ssl';
 export { deployStaticSite, deployStaticSiteFull, uploadStaticFiles, invalidateCache, deleteStaticSite, generateStaticSiteTemplate, deployStaticSiteWithExternalDns, deployStaticSiteWithExternalDnsFull, generateExternalDnsStaticSiteTemplate, deploySite, resolveSiteDeployTarget, resolveSiteKind, validateDeploymentConfig, buildAndPushServerlessImage, buildFunctionEnv, deployServerlessApp, infraEnvFromOutputs, redeployServerlessApp, rollbackServerlessApp, runRemoteCommand, setMaintenance, buildManagementDashboardArtifact, dashboardCredentialsFile, ensureManagementDashboard, MANAGEMENT_DASHBOARD_SITE, resolveDashboardAuth, resolveUiSource, } from './deploy';
-export { collectServerDnsDomains, hetznerBoxIpv6, removeStaleServerAddressRecords } from './deploy/server-dns';
+export { collectServerDnsDomains, hostAcceptsIpv6, IPV6_EXCLUDED_HOST_LABELS, normalizePublicIpv6, reconcileAddressRecords, removeStaleServerAddressRecords, verifyAddressRecord, } from './deploy/server-dns';
+export type { AddressRecordReport } from './deploy/server-dns';
 export type { EnsureDashboardLogger, ResolvedDashboardAuth, StaticSiteConfig, DeployResult, UploadOptions, ExternalDnsStaticSiteConfig, ExternalDnsDeployResult, DeploySiteConfig, DeploySiteResult, StaticSiteDnsProvider, SiteDeployKind, DeploymentValidationResult, BuildImageOptions, BuiltImage, CodeSource, DeployServerlessOptions, ResolvedContext, } from './deploy';
 export { createCloudDriver, CloudDriverFactory, cloudDrivers, AwsDriver, HetznerDriver, HetznerClient, resolveHetznerApiToken, normalizeSshPublicKey, ensureFirewall, ensureServer, ensureSshKey, serverPublicIpv4, sshExec, sshExecOrThrow, scpUpload, waitForSsh, waitForCloudInit, buildSshArgs, generateUbuntuAppCloudInit, wrapCloudInitUserData, buildHostCleanupScript, buildSiteDeployScript, buildStaticSiteDeployScript, resolveExecStart, deployAllComputeSites, deploySiteRelease, } from './drivers';
 export type { CreateCloudDriverOptions } from './drivers/factory';