@stacksjs/ts-cloud 0.9.1 → 0.9.2

package/dist/{chunk-5nr95wpj.js → chunk-728jvrr0.js}

@@ -7,7 +7,7 @@ import {
   Route53Provider,
   UnifiedDnsValidator,
   createDnsProvider
-} from "./chunk-atbgd8wz.js";
+} from "./chunk-qr803fye.js";
 import {
   Route53Client
 } from "./chunk-32e7ya18.js";
@@ -815,7 +815,7 @@ async function deployStaticSiteWithExternalDnsFull(config) {
     }
   }
   onProgress?.("upload", "Uploading files to S3...");
-  const { uploadStaticFiles } = await import("./chunk-ws47smxr.js");
+  const { uploadStaticFiles } = await import("./chunk-k4px0bnv.js");
   const uploadResult = await uploadStaticFiles({
     sourceDir,
     bucket: infraResult.bucket,
@@ -835,7 +835,7 @@ async function deployStaticSiteWithExternalDnsFull(config) {
   }
   if (infraResult.distributionId && uploadResult.uploaded > 0) {
     onProgress?.("invalidate", "Invalidating CloudFront cache...");
-    const { invalidateCache } = await import("./chunk-ws47smxr.js");
+    const { invalidateCache } = await import("./chunk-k4px0bnv.js");
     await invalidateCache(infraResult.distributionId);
   }
   onProgress?.("complete", "Deployment complete!");

package/dist/{chunk-ws47smxr.js → chunk-k4px0bnv.js}

@@ -5,9 +5,9 @@ import {
   generateStaticSiteTemplate,
   invalidateCache,
   uploadStaticFiles
-} from "./chunk-5nr95wpj.js";
+} from "./chunk-728jvrr0.js";
 import"./chunk-01d86gt1.js";
-import"./chunk-atbgd8wz.js";
+import"./chunk-qr803fye.js";
 import"./chunk-32e7ya18.js";
 import"./chunk-4cjrg98a.js";
 import"./chunk-rds0sy87.js";

package/dist/{chunk-atbgd8wz.js → chunk-qr803fye.js}

@@ -956,6 +956,117 @@ function deepEqual(a, b) {
   const bRecord = b;
   return Object.keys(bRecord).every((key) => deepEqual(aRecord[key], bRecord[key]));
 }
+// src/dns/declared-records.ts
+var SINGLETON_TYPES = new Set(["A", "AAAA", "CNAME", "ALIAS"]);
+function policyTag(content) {
+  const normalized = content.trim().replace(/^"|"$/g, "").toLowerCase();
+  if (normalized.startsWith("v=spf1"))
+    return "v=spf1";
+  if (normalized.startsWith("v=dmarc1"))
+    return "v=dmarc1";
+  return;
+}
+function unquote(value) {
+  return value.trim().replace(/^"(.*)"$/s, "$1");
+}
+function normalizeName(name) {
+  return name.replace(/\.$/, "").toLowerCase();
+}
+function qualifyName(name, zone) {
+  const z = normalizeName(zone);
+  const raw = (name ?? "@").trim();
+  if (!raw || raw === "@")
+    return z;
+  const n = normalizeName(raw);
+  if (n === z || n.endsWith(`.${z}`))
+    return n;
+  return `${n}.${z}`;
+}
+function resolveDeclaredRecords(records, zone) {
+  return records.map((record) => ({
+    ...record,
+    name: qualifyName(record.name, zone),
+    proxied: record.proxied ?? false
+  }));
+}
+function matches(existing, record) {
+  if (existing.type !== record.type)
+    return false;
+  if (normalizeName(existing.name) !== normalizeName(record.name))
+    return false;
+  if (SINGLETON_TYPES.has(record.type))
+    return true;
+  if (record.type === "TXT") {
+    const tag = policyTag(record.content);
+    if (tag)
+      return policyTag(unquote(existing.content)) === tag;
+    return unquote(existing.content) === unquote(record.content);
+  }
+  return unquote(existing.content) === unquote(record.content);
+}
+function isCurrent(existing, record) {
+  if (unquote(existing.content) !== unquote(record.content))
+    return false;
+  if (record.priority !== undefined && existing.priority !== record.priority)
+    return false;
+  if (record.proxied !== undefined && existing.proxied !== undefined && existing.proxied !== record.proxied)
+    return false;
+  return true;
+}
+async function reconcileDeclaredRecords(options) {
+  const { provider, zone, records } = options;
+  const report = { outcomes: [], warnings: [] };
+  if (records.length === 0)
+    return report;
+  const listed = await provider.listRecords(zone);
+  if (!listed.success) {
+    report.warnings.push(`could not list ${zone}: ${listed.message || "unknown provider error"} — records not reconciled`);
+    return report;
+  }
+  const existing = listed.records;
+  for (const record of records) {
+    const current = existing.filter((e) => matches(e, record));
+    if (current.length > 0 && current.every((e) => isCurrent(e, record))) {
+      report.outcomes.push({ record, action: "unchanged" });
+      continue;
+    }
+    const wire = {
+      name: record.name,
+      type: record.type,
+      content: record.content,
+      ttl: record.ttl ?? 3600,
+      ...record.priority !== undefined ? { priority: record.priority } : {},
+      ...record.proxied !== undefined ? { proxied: record.proxied } : {}
+    };
+    const supersedes = record.type === "TXT" && policyTag(record.content) !== undefined;
+    if (supersedes) {
+      for (const stale of current) {
+        const removed = await provider.deleteRecord(zone, {
+          name: stale.name,
+          type: stale.type,
+          content: stale.content
+        });
+        if (!removed.success)
+          report.warnings.push(`could not remove superseded ${stale.type} at ${stale.name}: ${removed.message || "unknown error"}`);
+      }
+    }
+    const result = supersedes || current.length === 0 ? await provider.createRecord(zone, wire) : await provider.upsertRecord(zone, wire);
+    if (result.success)
+      report.outcomes.push({ record, action: current.length > 0 ? "updated" : "created" });
+    else
+      report.outcomes.push({ record, action: "failed", message: result.message });
+  }
+  for (const type of ["MX"]) {
+    const declaredNames = new Set(records.filter((r) => r.type === type).map((r) => normalizeName(r.name)));
+    for (const name of declaredNames) {
+      const declaredValues = new Set(records.filter((r) => r.type === type && normalizeName(r.name) === name).map((r) => unquote(r.content).toLowerCase()));
+      const strays = existing.filter((e) => e.type === type && normalizeName(e.name) === name && !declaredValues.has(unquote(e.content).toLowerCase()));
+      for (const stray of strays)
+        report.warnings.push(`${name} has an undeclared ${type} record (${stray.content}) alongside the declared one — mail will be split between them. Remove it at the provider if it is stale.`);
+    }
+  }
+  return report;
+}
 // src/dns/route53-adapter.ts
 class Route53Provider {
   name = "route53";
@@ -2008,4 +2119,4 @@ class DnsProviderFactory {
 }
 var dnsProviders = new DnsProviderFactory;
 
-export { PROXIABLE_RECORD_TYPES, PorkbunProvider, GoDaddyProvider, CLOUDFLARE_MANAGED_RULE_PREFIX, CloudflareProvider, Route53Provider, UnifiedDnsValidator, createPorkbunValidator, createGoDaddyValidator, createRoute53Validator, createDnsProvider, detectDnsProvider, DnsProviderFactory, dnsProviders, ACMClient, ACMDnsValidator };
+export { PROXIABLE_RECORD_TYPES, PorkbunProvider, GoDaddyProvider, CLOUDFLARE_MANAGED_RULE_PREFIX, CloudflareProvider, policyTag, qualifyName, resolveDeclaredRecords, reconcileDeclaredRecords, Route53Provider, UnifiedDnsValidator, createPorkbunValidator, createGoDaddyValidator, createRoute53Validator, createDnsProvider, detectDnsProvider, DnsProviderFactory, dnsProviders, ACMClient, ACMDnsValidator };

package/dist/{chunk-hygwq9y2.js → chunk-rxgchb08.js}

@@ -1,6 +1,6 @@
 import {
   deployStaticSiteWithExternalDnsFull
-} from "./chunk-5nr95wpj.js";
+} from "./chunk-728jvrr0.js";
 import {
   box,
   error,

package/dist/deploy/index.js

@@ -36,7 +36,7 @@ import {
   synchronizeDashboardUsers,
   trackDashboardOperation,
   verifyStaticApiOrigin
-} from "../chunk-hygwq9y2.js";
+} from "../chunk-rxgchb08.js";
 import {
   deleteStaticSite,
   deployStaticSite,
@@ -47,7 +47,7 @@ import {
   generateStaticSiteTemplate,
   invalidateCache,
   uploadStaticFiles
-} from "../chunk-5nr95wpj.js";
+} from "../chunk-728jvrr0.js";
 import {
   buildAndPushServerlessImage
 } from "../chunk-fgk8cqew.js";
@@ -56,7 +56,7 @@ import"../chunk-nsgqsmrh.js";
 import"../chunk-01d86gt1.js";
 import"../chunk-50jpda9q.js";
 import"../chunk-he9a874b.js";
-import"../chunk-atbgd8wz.js";
+import"../chunk-qr803fye.js";
 import"../chunk-32e7ya18.js";
 import {
   IPV6_EXCLUDED_HOST_LABELS,

package/dist/dns/declared-records.d.ts

@@ -0,0 +1,87 @@
+/**
+ * Publish the records a deploy cannot infer: mail, verification tokens,
+ * third-party CNAMEs — everything in `infrastructure.dns.records`.
+ *
+ * The address records for `sites` are derived from the deploy itself and live in
+ * {@link import('../deploy/server-dns')}. This module covers the other half of a
+ * zone, which is precisely the half that silently disappears in a nameserver
+ * migration: nothing in a normal deploy reads or writes MX or SPF, so their
+ * absence is invisible until someone reports that mail stopped days later.
+ *
+ * The whole module is upsert-only. A real zone holds records owned by other
+ * tools and other people, so "not declared here" never implies "safe to
+ * delete". The single deliberate exception is a policy TXT record — see
+ * {@link policyTag}.
+ */
+import type { DnsProvider, DnsRecordType } from './types';
+/** A record to publish, already resolved to a fully-qualified name. */
+export interface DeclaredRecord {
+    type: DnsRecordType;
+    /** Fully-qualified record name. */
+    name: string;
+    content: string;
+    ttl?: number;
+    priority?: number;
+    proxied?: boolean;
+    comment?: string;
+}
+/** The config shape, before names are qualified against the zone. */
+export interface DeclaredRecordInput {
+    type: DnsRecordType;
+    name?: string;
+    content: string;
+    ttl?: number;
+    priority?: number;
+    proxied?: boolean;
+    comment?: string;
+}
+/**
+ * The policy tag opening a TXT record whose duplicates are harmful, or
+ * `undefined` for an ordinary TXT.
+ *
+ * This is the one case where publishing a second record is not additive but
+ * destructive. Two `v=spf1` records at a name are a permerror: receivers do not
+ * merge them, they conclude the domain has no usable SPF, and mail that would
+ * have passed starts failing. Two `v=DMARC1` records are discarded wholesale,
+ * silently disabling the policy. So a policy record must REPLACE its
+ * predecessor, while every other TXT at that name is left alone.
+ */
+export declare function policyTag(content: string): string | undefined;
+/**
+ * Qualify a configured record name against the zone.
+ *
+ * `'@'`, `''` and an omitted name all mean the apex; a bare label is joined to
+ * the zone; an already-qualified name is left alone.
+ */
+export declare function qualifyName(name: string | undefined, zone: string): string;
+/** Resolve config records into fully-qualified {@link DeclaredRecord}s. */
+export declare function resolveDeclaredRecords(records: DeclaredRecordInput[], zone: string): DeclaredRecord[];
+/** What the reconcile did with one record. */
+export interface DeclaredRecordOutcome {
+    record: DeclaredRecord;
+    action: 'created' | 'updated' | 'unchanged' | 'failed';
+    message?: string;
+}
+export interface DeclaredRecordsReport {
+    outcomes: DeclaredRecordOutcome[];
+    /**
+     * Undeclared values sitting beside a declared multi-value record — a second
+     * MX from a previous provider, say. Reported and never removed: a stray MX
+     * splits mail delivery and the operator must see it, but silently deleting a
+     * record on a shared zone is the worse failure.
+     */
+    warnings: string[];
+}
+/**
+ * Publish `records` into `zone`, updating what exists and creating what does
+ * not.
+ *
+ * Never throws: this runs at the tail of a deploy that has already shipped, so a
+ * provider rejecting one record is reported per-record rather than failing the
+ * whole run — and the outcome list says exactly which ones landed.
+ */
+export declare function reconcileDeclaredRecords(options: {
+    provider: DnsProvider;
+    zone: string;
+    records: DeclaredRecord[];
+}): Promise<DeclaredRecordsReport>;

package/dist/dns/declared-records.test.d.ts

@@ -0,0 +1 @@
+export {};

package/dist/dns/index.d.ts

@@ -6,6 +6,8 @@ export * from './types';
 export { PorkbunProvider } from './porkbun';
 export { GoDaddyProvider } from './godaddy';
 export { CloudflareProvider } from './cloudflare';
+export type { DeclaredRecord, DeclaredRecordInput, DeclaredRecordOutcome, DeclaredRecordsReport, } from './declared-records';
+export { policyTag, qualifyName, reconcileDeclaredRecords, resolveDeclaredRecords, } from './declared-records';
 export { Route53Provider } from './route53-adapter';
 export { UnifiedDnsValidator, createPorkbunValidator, createGoDaddyValidator, createRoute53Validator, } from './validator';
 import type { DnsProvider, DnsProviderConfig } from './types';

package/dist/dns/index.js

@@ -11,12 +11,20 @@ import {
   createPorkbunValidator,
   createRoute53Validator,
   detectDnsProvider,
-  dnsProviders
-} from "../chunk-atbgd8wz.js";
+  dnsProviders,
+  policyTag,
+  qualifyName,
+  reconcileDeclaredRecords,
+  resolveDeclaredRecords
+} from "../chunk-qr803fye.js";
 import"../chunk-32e7ya18.js";
 import"../chunk-zqtpg06c.js";
 import"../chunk-v0bahtg2.js";
 export {
+  resolveDeclaredRecords,
+  reconcileDeclaredRecords,
+  qualifyName,
+  policyTag,
   dnsProviders,
   detectDnsProvider,
   createRoute53Validator,

package/dist/index.d.ts

@@ -41,7 +41,7 @@ export { createCloudDriver, CloudDriverFactory, cloudDrivers, AwsDriver, Hetzner
 export type { CreateCloudDriverOptions } from './drivers/factory';
 export { dashboardActions, resolveDashboardAction, sanitizeCloudConfig, startLocalDashboardServer, } from './deploy/local-dashboard-server';
 export type { DashboardAction, LocalDashboardServer, LocalDashboardServerOptions, } from './deploy/local-dashboard-server';
-export { createDnsProvider, detectDnsProvider, DnsProviderFactory, dnsProviders, PorkbunProvider, GoDaddyProvider, Route53Provider, CloudflareProvider, UnifiedDnsValidator, createPorkbunValidator, createGoDaddyValidator, createRoute53Validator, } from './dns';
+export { createDnsProvider, detectDnsProvider, DnsProviderFactory, dnsProviders, PorkbunProvider, GoDaddyProvider, Route53Provider, CloudflareProvider, policyTag, qualifyName, reconcileDeclaredRecords, resolveDeclaredRecords, UnifiedDnsValidator, createPorkbunValidator, createGoDaddyValidator, createRoute53Validator, } from './dns';
 export type { CloudflareProviderOptions, CloudflareRule, CloudflareRulesetPhase, CloudflareZoneSetting, } from './dns/cloudflare';
 export { CLOUDFLARE_MANAGED_RULE_PREFIX } from './dns/cloudflare';
 export * from './source';
@@ -50,5 +50,6 @@ export * from './backups';
 export * from './configuration';
 export type { DnsProvider, DnsProviderConfig, DnsRecord, DnsRecordType, DnsRecordResult, CreateRecordResult, DeleteRecordResult, ListRecordsResult, } from './dns';
 export { PROXIABLE_RECORD_TYPES } from './dns';
+export type { DeclaredRecord, DeclaredRecordInput, DeclaredRecordOutcome, DeclaredRecordsReport, } from './dns';
 export * from '@ts-cloud/core';
 export type { S3Bucket, S3BucketPolicy, CloudFrontDistribution, CloudFrontOriginAccessControl, CloudFrontCacheBehavior, CloudFrontOrigin, } from '@ts-cloud/aws-types';

package/dist/index.js

@@ -208,7 +208,7 @@ import {
   verifyUpdateSignature,
   webhookEndpoint,
   zeroCapacity
-} from "./chunk-hygwq9y2.js";
+} from "./chunk-rxgchb08.js";
 import {
   deleteStaticSite,
   deployStaticSite,
@@ -219,7 +219,7 @@ import {
   generateStaticSiteTemplate,
   invalidateCache,
   uploadStaticFiles
-} from "./chunk-5nr95wpj.js";
+} from "./chunk-728jvrr0.js";
 import {
   buildAndPushServerlessImage
 } from "./chunk-fgk8cqew.js";
@@ -291,8 +291,12 @@ import {
   createPorkbunValidator,
   createRoute53Validator,
   detectDnsProvider,
-  dnsProviders
-} from "./chunk-atbgd8wz.js";
+  dnsProviders,
+  policyTag,
+  qualifyName,
+  reconcileDeclaredRecords,
+  resolveDeclaredRecords
+} from "./chunk-qr803fye.js";
 import {
   Route53Client
 } from "./chunk-32e7ya18.js";
@@ -5795,6 +5799,7 @@ export {
   resolveExecStart,
   resolveDeploymentMode,
   resolveDeployBucketName,
+  resolveDeclaredRecords,
   resolveDashboardDomains,
   resolveDashboardDomain,
   resolveDashboardAuth,
@@ -5834,12 +5839,14 @@ export {
   recordDashboardHostPosture,
   reconcileSourceWebhook,
   reconcileJobObservation,
+  reconcileDeclaredRecords,
   reconcileCloudflareCdn,
   reconcileAddressRecords,
   rateLimitKey,
   rateLimitHeaders,
   quickHash,
   queueManagementManager,
+  qualifyName,
   publicKeyFingerprint,
   providerEndpoint,
   propagationHeaders,
@@ -5855,6 +5862,7 @@ export {
   previewSchedule,
   previewNotifications,
   previewManager,
+  policyTag,
   planMitigation,
   planEnforcement,
   planComposeTemplateUpgrade,