@stacksjs/ts-cloud 0.9.4 → 0.11.0

package/dist/{chunk-xt3s24vr.js → chunk-spx89gaw.js}

@@ -1,2 +1,2 @@
 import{createRequire as a}from"node:module";var c=a(import.meta.url);
-export{c as qt};
+export{c as zt};

package/dist/chunk-t0kh8haz.js

@@ -0,0 +1,2 @@
+import{Yh as l,Zh as a}from"./chunk-gk58959n.js";class g{client;region;constructor(e="us-east-1"){this.region=e,this.client=new l}async describeDBInstances(e){let r={Action:"DescribeDBInstances",Version:"2014-10-31"};if(e?.DBInstanceIdentifier)r.DBInstanceIdentifier=e.DBInstanceIdentifier;if(e?.MaxRecords)r.MaxRecords=e.MaxRecords;if(e?.Marker)r.Marker=e.Marker;if(e?.Filters)e.Filters.forEach((o,c)=>{r[`Filters.Filter.${c+1}.Name`]=o.Name,o.Values.forEach((u,d)=>{r[`Filters.Filter.${c+1}.Values.Value.${d+1}`]=u})});let t=new URLSearchParams(a(r)).toString(),n=await this.client.request({service:"rds",region:this.region,method:"POST",path:"/",headers:{"Content-Type":"application/x-www-form-urlencoded"},body:t}),i=n.DescribeDBInstancesResult||n,s=i.DBInstances?.DBInstance||[];if(!Array.isArray(s))s=s?[s]:[];return{DBInstances:s,Marker:i.Marker}}async describeDBInstance(e){return(await this.describeDBInstances({DBInstanceIdentifier:e})).DBInstances?.[0]}async describeDBClusters(e){let r={Action:"DescribeDBClusters",Version:"2014-10-31"};if(e?.DBClusterIdentifier)r.DBClusterIdentifier=e.DBClusterIdentifier;if(e?.MaxRecords)r.MaxRecords=e.MaxRecords;if(e?.Marker)r.Marker=e.Marker;if(e?.Filters)e.Filters.forEach((o,c)=>{r[`Filters.Filter.${c+1}.Name`]=o.Name,o.Values.forEach((u,d)=>{r[`Filters.Filter.${c+1}.Values.Value.${d+1}`]=u})});let t=new URLSearchParams(a(r)).toString(),n=await this.client.request({service:"rds",region:this.region,method:"POST",path:"/",headers:{"Content-Type":"application/x-www-form-urlencoded"},body:t}),i=n.DescribeDBClustersResult||n,s=i.DBClusters?.DBCluster||[];if(!Array.isArray(s))s=s?[s]:[];return{DBClusters:s,Marker:i.Marker}}async describeDBSnapshots(e){let r={Action:"DescribeDBSnapshots",Version:"2014-10-31"};if(e?.DBInstanceIdentifier)r.DBInstanceIdentifier=e.DBInstanceIdentifier;if(e?.DBSnapshotIdentifier)r.DBSnapshotIdentifier=e.DBSnapshotIdentifier;if(e?.SnapshotType)r.SnapshotType=e.SnapshotType;if(e?.MaxRecords)r.MaxRecords=e.MaxRecords;if(e?.Marker)r.Marker=e.Marker;let t=new URLSearchParams(a(r)).toString(),n=await this.client.request({service:"rds",region:this.region,method:"POST",path:"/",headers:{"Content-Type":"application/x-www-form-urlencoded"},body:t}),i=n.DescribeDBSnapshotsResult||n,s=i.DBSnapshots?.DBSnapshot||[];if(!Array.isArray(s))s=s?[s]:[];return{DBSnapshots:s,Marker:i.Marker}}async describeDBSubnetGroups(e){let r={Action:"DescribeDBSubnetGroups",Version:"2014-10-31"};if(e?.DBSubnetGroupName)r.DBSubnetGroupName=e.DBSubnetGroupName;if(e?.MaxRecords)r.MaxRecords=e.MaxRecords;if(e?.Marker)r.Marker=e.Marker;let t=new URLSearchParams(a(r)).toString(),n=await this.client.request({service:"rds",region:this.region,method:"POST",path:"/",headers:{"Content-Type":"application/x-www-form-urlencoded"},body:t}),i=n.DescribeDBSubnetGroupsResult||n,s=i.DBSubnetGroups?.DBSubnetGroup||[];if(!Array.isArray(s))s=s?[s]:[];return{DBSubnetGroups:s,Marker:i.Marker}}async createDBInstance(e){let r={Action:"CreateDBInstance",Version:"2014-10-31",DBInstanceIdentifier:e.DBInstanceIdentifier,DBInstanceClass:e.DBInstanceClass,Engine:e.Engine};if(e.DBClusterIdentifier)r.DBClusterIdentifier=e.DBClusterIdentifier;if(e.MasterUsername)r.MasterUsername=e.MasterUsername;if(e.MasterUserPassword)r.MasterUserPassword=e.MasterUserPassword;if(e.DBName)r.DBName=e.DBName;if(e.AllocatedStorage)r.AllocatedStorage=e.AllocatedStorage;if(e.DBSubnetGroupName)r.DBSubnetGroupName=e.DBSubnetGroupName;if(e.AvailabilityZone)r.AvailabilityZone=e.AvailabilityZone;if(e.PreferredMaintenanceWindow)r.PreferredMaintenanceWindow=e.PreferredMaintenanceWindow;if(e.PreferredBackupWindow)r.PreferredBackupWindow=e.PreferredBackupWindow;if(e.BackupRetentionPeriod!==void 0)r.BackupRetentionPeriod=e.BackupRetentionPeriod;if(e.MultiAZ!==void 0)r.MultiAZ=e.MultiAZ;if(e.EngineVersion)r.EngineVersion=e.EngineVersion;if(e.AutoMinorVersionUpgrade!==void 0)r.AutoMinorVersionUpgrade=e.AutoMinorVersionUpgrade;if(e.LicenseModel)r.LicenseModel=e.LicenseModel;if(e.PubliclyAccessible!==void 0)r.PubliclyAccessible=e.PubliclyAccessible;if(e.StorageType)r.StorageType=e.StorageType;if(e.StorageEncrypted!==void 0)r.StorageEncrypted=e.StorageEncrypted;if(e.KmsKeyId)r.KmsKeyId=e.KmsKeyId;if(e.DeletionProtection!==void 0)r.DeletionProtection=e.DeletionProtection;if(e.VpcSecurityGroupIds)e.VpcSecurityGroupIds.forEach((s,o)=>{r[`VpcSecurityGroupIds.VpcSecurityGroupId.${o+1}`]=s});if(e.Tags)e.Tags.forEach((s,o)=>{r[`Tags.Tag.${o+1}.Key`]=s.Key,r[`Tags.Tag.${o+1}.Value`]=s.Value});let t=new URLSearchParams(a(r)).toString(),n=await this.client.request({service:"rds",region:this.region,method:"POST",path:"/",headers:{"Content-Type":"application/x-www-form-urlencoded"},body:t});return{DBInstance:(n.CreateDBInstanceResult||n).DBInstance}}async createDBCluster(e){let r={Action:"CreateDBCluster",Version:"2014-10-31",DBClusterIdentifier:e.DBClusterIdentifier,Engine:e.Engine};if(e.EngineVersion)r.EngineVersion=e.EngineVersion;if(e.MasterUsername)r.MasterUsername=e.MasterUsername;if(e.MasterUserPassword)r.MasterUserPassword=e.MasterUserPassword;if(e.DatabaseName)r.DatabaseName=e.DatabaseName;if(e.DBSubnetGroupName)r.DBSubnetGroupName=e.DBSubnetGroupName;if(e.BackupRetentionPeriod!==void 0)r.BackupRetentionPeriod=e.BackupRetentionPeriod;if(e.StorageEncrypted!==void 0)r.StorageEncrypted=e.StorageEncrypted;if(e.KmsKeyId)r.KmsKeyId=e.KmsKeyId;if(e.DeletionProtection!==void 0)r.DeletionProtection=e.DeletionProtection;if(e.ServerlessV2ScalingConfiguration)r["ServerlessV2ScalingConfiguration.MinCapacity"]=e.ServerlessV2ScalingConfiguration.MinCapacity,r["ServerlessV2ScalingConfiguration.MaxCapacity"]=e.ServerlessV2ScalingConfiguration.MaxCapacity;e.VpcSecurityGroupIds?.forEach((i,s)=>{r[`VpcSecurityGroupIds.VpcSecurityGroupId.${s+1}`]=i});let t=await this.client.request({service:"rds",region:this.region,method:"POST",path:"/",headers:{"Content-Type":"application/x-www-form-urlencoded"},body:new URLSearchParams(a(r)).toString()});return{DBCluster:(t.CreateDBClusterResult||t).DBCluster}}async deleteDBInstance(e){let r={Action:"DeleteDBInstance",Version:"2014-10-31",DBInstanceIdentifier:e.DBInstanceIdentifier};if(e.SkipFinalSnapshot!==void 0)r.SkipFinalSnapshot=e.SkipFinalSnapshot;if(e.FinalDBSnapshotIdentifier)r.FinalDBSnapshotIdentifier=e.FinalDBSnapshotIdentifier;if(e.DeleteAutomatedBackups!==void 0)r.DeleteAutomatedBackups=e.DeleteAutomatedBackups;let t=new URLSearchParams(a(r)).toString(),n=await this.client.request({service:"rds",region:this.region,method:"POST",path:"/",headers:{"Content-Type":"application/x-www-form-urlencoded"},body:t});return{DBInstance:(n.DeleteDBInstanceResult||n).DBInstance}}async modifyDBInstance(e){let r={Action:"ModifyDBInstance",Version:"2014-10-31",DBInstanceIdentifier:e.DBInstanceIdentifier};if(e.DBInstanceClass)r.DBInstanceClass=e.DBInstanceClass;if(e.AllocatedStorage)r.AllocatedStorage=e.AllocatedStorage;if(e.MasterUserPassword)r.MasterUserPassword=e.MasterUserPassword;if(e.BackupRetentionPeriod!==void 0)r.BackupRetentionPeriod=e.BackupRetentionPeriod;if(e.PreferredBackupWindow)r.PreferredBackupWindow=e.PreferredBackupWindow;if(e.PreferredMaintenanceWindow)r.PreferredMaintenanceWindow=e.PreferredMaintenanceWindow;if(e.MultiAZ!==void 0)r.MultiAZ=e.MultiAZ;if(e.EngineVersion)r.EngineVersion=e.EngineVersion;if(e.AutoMinorVersionUpgrade!==void 0)r.AutoMinorVersionUpgrade=e.AutoMinorVersionUpgrade;if(e.PubliclyAccessible!==void 0)r.PubliclyAccessible=e.PubliclyAccessible;if(e.ApplyImmediately!==void 0)r.ApplyImmediately=e.ApplyImmediately;if(e.StorageType)r.StorageType=e.StorageType;if(e.DeletionProtection!==void 0)r.DeletionProtection=e.DeletionProtection;if(e.VpcSecurityGroupIds)e.VpcSecurityGroupIds.forEach((s,o)=>{r[`VpcSecurityGroupIds.VpcSecurityGroupId.${o+1}`]=s});let t=new URLSearchParams(a(r)).toString(),n=await this.client.request({service:"rds",region:this.region,method:"POST",path:"/",headers:{"Content-Type":"application/x-www-form-urlencoded"},body:t});return{DBInstance:(n.ModifyDBInstanceResult||n).DBInstance}}async modifyDBCluster(e){let r={Action:"ModifyDBCluster",Version:"2014-10-31",DBClusterIdentifier:e.DBClusterIdentifier};if(e.ServerlessV2ScalingConfiguration)r["ServerlessV2ScalingConfiguration.MinCapacity"]=e.ServerlessV2ScalingConfiguration.MinCapacity,r["ServerlessV2ScalingConfiguration.MaxCapacity"]=e.ServerlessV2ScalingConfiguration.MaxCapacity;if(e.BackupRetentionPeriod!==void 0)r.BackupRetentionPeriod=e.BackupRetentionPeriod;if(e.EngineVersion)r.EngineVersion=e.EngineVersion;if(e.MasterUserPassword)r.MasterUserPassword=e.MasterUserPassword;if(e.DeletionProtection!==void 0)r.DeletionProtection=e.DeletionProtection;if(e.ApplyImmediately!==void 0)r.ApplyImmediately=e.ApplyImmediately;let t=new URLSearchParams(a(r)).toString(),n=await this.client.request({service:"rds",region:this.region,method:"POST",path:"/",headers:{"Content-Type":"application/x-www-form-urlencoded"},body:t});return{DBCluster:(n.ModifyDBClusterResult||n).DBCluster}}async rebootDBCluster(e){let r={Action:"FailoverDBCluster",Version:"2014-10-31",DBClusterIdentifier:e},t=await this.client.request({service:"rds",region:this.region,method:"POST",path:"/",headers:{"Content-Type":"application/x-www-form-urlencoded"},body:new URLSearchParams(a(r)).toString()});return{DBCluster:(t.FailoverDBClusterResult||t).DBCluster}}async createDBClusterSnapshot(e,r){let t={Action:"CreateDBClusterSnapshot",Version:"2014-10-31",DBClusterIdentifier:e,DBClusterSnapshotIdentifier:r};return this.client.request({service:"rds",region:this.region,method:"POST",path:"/",headers:{"Content-Type":"application/x-www-form-urlencoded"},body:new URLSearchParams(a(t)).toString()})}async describeDBClusterSnapshots(e={}){let r={Action:"DescribeDBClusterSnapshots",Version:"2014-10-31",...e},t=await this.client.request({service:"rds",region:this.region,method:"POST",path:"/",headers:{"Content-Type":"application/x-www-form-urlencoded"},body:new URLSearchParams(a(r)).toString()}),n=t.DescribeDBClusterSnapshotsResult||t,i=n.DBClusterSnapshots?.DBClusterSnapshot??n.DBClusterSnapshots??[];return{DBClusterSnapshots:Array.isArray(i)?i:[i]}}async deleteDBClusterSnapshot(e){await this.client.request({service:"rds",region:this.region,method:"POST",path:"/",headers:{"Content-Type":"application/x-www-form-urlencoded"},body:new URLSearchParams(a({Action:"DeleteDBClusterSnapshot",Version:"2014-10-31",DBClusterSnapshotIdentifier:e})).toString()})}async deleteDBCluster(e,r){let t={Action:"DeleteDBCluster",Version:"2014-10-31",DBClusterIdentifier:e,SkipFinalSnapshot:!r};if(r)t.FinalDBSnapshotIdentifier=r;let n=await this.client.request({service:"rds",region:this.region,method:"POST",path:"/",headers:{"Content-Type":"application/x-www-form-urlencoded"},body:new URLSearchParams(a(t)).toString()});return{DBCluster:(n.DeleteDBClusterResult||n).DBCluster}}async restoreDBClusterToPointInTime(e){let r={Action:"RestoreDBClusterToPointInTime",Version:"2014-10-31",DBClusterIdentifier:e.DBClusterIdentifier,SourceDBClusterIdentifier:e.SourceDBClusterIdentifier};if(e.RestoreToTime)r.RestoreToTime=e.RestoreToTime.toISOString();if(e.UseLatestRestorableTime)r.UseLatestRestorableTime=!0;if(e.DBSubnetGroupName)r.DBSubnetGroupName=e.DBSubnetGroupName;if(e.VpcSecurityGroupIds)e.VpcSecurityGroupIds.forEach((s,o)=>{r[`VpcSecurityGroupIds.VpcSecurityGroupId.${o+1}`]=s});let t=new URLSearchParams(a(r)).toString(),n=await this.client.request({service:"rds",region:this.region,method:"POST",path:"/",headers:{"Content-Type":"application/x-www-form-urlencoded"},body:t});return{DBCluster:(n.RestoreDBClusterToPointInTimeResult||n).DBCluster}}async restoreDBClusterFromSnapshot(e){let r={Action:"RestoreDBClusterFromSnapshot",Version:"2014-10-31",DBClusterIdentifier:e.DBClusterIdentifier,SnapshotIdentifier:e.SnapshotIdentifier,Engine:e.Engine};if(e.EngineVersion)r.EngineVersion=e.EngineVersion;if(e.DBSubnetGroupName)r.DBSubnetGroupName=e.DBSubnetGroupName;if(e.DeletionProtection!==void 0)r.DeletionProtection=e.DeletionProtection;if(e.VpcSecurityGroupIds?.forEach((i,s)=>{r[`VpcSecurityGroupIds.VpcSecurityGroupId.${s+1}`]=i}),e.ServerlessV2ScalingConfiguration)r["ServerlessV2ScalingConfiguration.MinCapacity"]=e.ServerlessV2ScalingConfiguration.MinCapacity,r["ServerlessV2ScalingConfiguration.MaxCapacity"]=e.ServerlessV2ScalingConfiguration.MaxCapacity;let t=await this.client.request({service:"rds",region:this.region,method:"POST",path:"/",headers:{"Content-Type":"application/x-www-form-urlencoded"},body:new URLSearchParams(a(r)).toString()});return{DBCluster:(t.RestoreDBClusterFromSnapshotResult||t).DBCluster}}async startDBInstance(e){let t=new URLSearchParams(a({Action:"StartDBInstance",Version:"2014-10-31",DBInstanceIdentifier:e})).toString(),n=await this.client.request({service:"rds",region:this.region,method:"POST",path:"/",headers:{"Content-Type":"application/x-www-form-urlencoded"},body:t});return{DBInstance:(n.StartDBInstanceResult||n).DBInstance}}async stopDBInstance(e){let r={Action:"StopDBInstance",Version:"2014-10-31",DBInstanceIdentifier:e.DBInstanceIdentifier};if(e.DBSnapshotIdentifier)r.DBSnapshotIdentifier=e.DBSnapshotIdentifier;let t=new URLSearchParams(a(r)).toString(),n=await this.client.request({service:"rds",region:this.region,method:"POST",path:"/",headers:{"Content-Type":"application/x-www-form-urlencoded"},body:t});return{DBInstance:(n.StopDBInstanceResult||n).DBInstance}}async rebootDBInstance(e){let r={Action:"RebootDBInstance",Version:"2014-10-31",DBInstanceIdentifier:e.DBInstanceIdentifier};if(e.ForceFailover!==void 0)r.ForceFailover=e.ForceFailover;let t=new URLSearchParams(a(r)).toString(),n=await this.client.request({service:"rds",region:this.region,method:"POST",path:"/",headers:{"Content-Type":"application/x-www-form-urlencoded"},body:t});return{DBInstance:(n.RebootDBInstanceResult||n).DBInstance}}async createDBSnapshot(e){let r={Action:"CreateDBSnapshot",Version:"2014-10-31",DBInstanceIdentifier:e.DBInstanceIdentifier,DBSnapshotIdentifier:e.DBSnapshotIdentifier};if(e.Tags)e.Tags.forEach((s,o)=>{r[`Tags.Tag.${o+1}.Key`]=s.Key,r[`Tags.Tag.${o+1}.Value`]=s.Value});let t=new URLSearchParams(a(r)).toString(),n=await this.client.request({service:"rds",region:this.region,method:"POST",path:"/",headers:{"Content-Type":"application/x-www-form-urlencoded"},body:t});return{DBSnapshot:(n.CreateDBSnapshotResult||n).DBSnapshot}}async deleteDBSnapshot(e){let t=new URLSearchParams(a({Action:"DeleteDBSnapshot",Version:"2014-10-31",DBSnapshotIdentifier:e})).toString(),n=await this.client.request({service:"rds",region:this.region,method:"POST",path:"/",headers:{"Content-Type":"application/x-www-form-urlencoded"},body:t});return{DBSnapshot:(n.DeleteDBSnapshotResult||n).DBSnapshot}}async restoreDBInstanceFromDBSnapshot(e){let r={Action:"RestoreDBInstanceFromDBSnapshot",Version:"2014-10-31",DBInstanceIdentifier:e.DBInstanceIdentifier,DBSnapshotIdentifier:e.DBSnapshotIdentifier};if(e.DBInstanceClass)r.DBInstanceClass=e.DBInstanceClass;if(e.Port)r.Port=e.Port;if(e.AvailabilityZone)r.AvailabilityZone=e.AvailabilityZone;if(e.DBSubnetGroupName)r.DBSubnetGroupName=e.DBSubnetGroupName;if(e.MultiAZ!==void 0)r.MultiAZ=e.MultiAZ;if(e.PubliclyAccessible!==void 0)r.PubliclyAccessible=e.PubliclyAccessible;if(e.AutoMinorVersionUpgrade!==void 0)r.AutoMinorVersionUpgrade=e.AutoMinorVersionUpgrade;if(e.StorageType)r.StorageType=e.StorageType;if(e.DeletionProtection!==void 0)r.DeletionProtection=e.DeletionProtection;if(e.VpcSecurityGroupIds)e.VpcSecurityGroupIds.forEach((s,o)=>{r[`VpcSecurityGroupIds.VpcSecurityGroupId.${o+1}`]=s});if(e.Tags)e.Tags.forEach((s,o)=>{r[`Tags.Tag.${o+1}.Key`]=s.Key,r[`Tags.Tag.${o+1}.Value`]=s.Value});let t=new URLSearchParams(a(r)).toString(),n=await this.client.request({service:"rds",region:this.region,method:"POST",path:"/",headers:{"Content-Type":"application/x-www-form-urlencoded"},body:t});return{DBInstance:(n.RestoreDBInstanceFromDBSnapshotResult||n).DBInstance}}async waitForDBInstanceAvailable(e,r=60,t=30000){for(let n=0;n<r;n++){let i=await this.describeDBInstance(e);if(i?.DBInstanceStatus==="available")return i;if(["deleted","failed","incompatible-restore","incompatible-parameters"].includes(i?.DBInstanceStatus||""))throw Error(`DB instance ${e} is in terminal state: ${i?.DBInstanceStatus}`);await new Promise((s)=>setTimeout(s,t))}throw Error(`Timeout waiting for DB instance ${e} to become available`)}async waitForDBInstanceDeleted(e,r=60,t=30000){for(let n=0;n<r;n++)try{let i=await this.describeDBInstance(e);if(i?.DBInstanceStatus==="deleting"){await new Promise((s)=>setTimeout(s,t));continue}throw Error(`DB instance ${e} is in state: ${i?.DBInstanceStatus}`)}catch(i){if(i.code==="DBInstanceNotFound"||i.code==="DBInstanceNotFoundFault")return;throw i}throw Error(`Timeout waiting for DB instance ${e} to be deleted`)}}
+export{g as uf};

package/dist/chunk-vz95qy3n.js

@@ -0,0 +1 @@
+import{rl as w}from"./chunk-b10cbk8z.js";var L="\x00";function k(t,i){if(t==="*"||t==="**")return!0;let e=t.replace(/[.+^${}()|[\]\\]/g,"\\$&").replace(/\*\*/g,"\x01").replace(/\*/g,"[^/]*").replace(/\u0001/g,".*");return new RegExp(`^${e}$`).test(i)}function y(t,i){if(t.startsWith("*.")){let e=t.slice(1);return i.endsWith(e)&&i.length>e.length}return t===i}function d(t,i){if(t.enabled===!1)return!1;if(t.methods?.length&&!t.methods.some((e)=>e.toUpperCase()===i.method.toUpperCase()))return!1;if(t.path&&!k(t.path,i.path))return!1;if(t.host&&!y(t.host,i.host??""))return!1;return!0}function m(t,i){let e=t.key??{source:"ip"},o=e.fallbackToIp!==!1,r;if(e.source==="ip")r=i.ip;else if(e.source==="global")r="global";else if(e.source==="host")r=i.host??"";else if(e.source==="path")r=i.path;else if(e.source==="header")r=e.name?i.headers?.[e.name.toLowerCase()]:void 0;else if(e.source==="cookie")r=e.name?i.cookies?.[e.name]:void 0;if(!r&&e.source!=="global")r=o?i.ip:"__missing__";return`${t.id}\x00${r}`}class A{clock;maxTrackedKeys;buckets=new Map;windows=new Map;rules;constructor(t,i=()=>Date.now(),e=1e5){this.clock=i;this.maxTrackedKeys=e;this.rules=[...t].sort((o,r)=>(o.priority??0)-(r.priority??0))}check(t){let i=this.clock(),e=this.rules.filter((n)=>d(n,t)),o;for(let n of e){let s=this.test(n,t,i);if(s.allowed)continue;if(!o||p(s.action)>p(o.action))o=s}if(o)return o;let r={action:"allow",allowed:!0};for(let n of e){let s=this.consume(n,t,i);if(s.remaining!=null&&(r.remaining??1/0)>s.remaining)r=s}return r}test(t,i,e){let o=m(t,i);if((t.algorithm??"token_bucket")==="token_bucket"){let n=t.burst??t.limit,s=this.buckets.get(o),a=s?Math.min(n,s.tokens+this.refill(t,e-s.updatedAt)):n;if(a>=1)return{action:"allow",allowed:!0};return this.blocked(t,o,0,this.msPerToken(t)*(1-a),e)}let r=(this.windows.get(o)?.hits??[]).filter((n)=>n>e-t.windowMs);if(r.length<t.limit)return{action:"allow",allowed:!0};return this.blocked(t,o,0,r[0]+t.windowMs-e,e)}peek(t){let i=this.clock();for(let e of this.rules){if(!d(e,t))continue;let o=this.test(e,t,i);if(!o.allowed)return o}return{action:"allow",allowed:!0}}msPerToken(t){return t.windowMs/Math.max(1,t.limit)}refill(t,i){return Math.max(0,i)/this.msPerToken(t)}blocked(t,i,e,o,r){let n=t.action??"deny";return{action:n,allowed:n==="allow"||n==="log",ruleId:t.id,limit:t.limit,remaining:e,retryAfterMs:Math.max(0,Math.ceil(o)),resetAt:r+Math.max(0,o),key:i}}consume(t,i,e){let o=m(t,i);if((t.algorithm??"token_bucket")==="token_bucket"){let l=t.burst??t.limit,u=this.buckets.get(o)??{tokens:l,updatedAt:e},c=Math.min(l,u.tokens+this.refill(t,e-u.updatedAt));if(c<1)return this.buckets.set(o,{tokens:c,updatedAt:e}),this.blocked(t,o,0,this.msPerToken(t)*(1-c),e);return this.evictIfNeeded(this.buckets),this.buckets.set(o,{tokens:c-1,updatedAt:e}),{action:"allow",allowed:!0,ruleId:t.id,limit:l,remaining:Math.floor(c-1),resetAt:e+this.msPerToken(t)*(l-(c-1)),key:o}}let n=this.windows.get(o)??{hits:[]},s=e-t.windowMs,a=n.hits.filter((l)=>l>s);if(a.length>=t.limit)return this.windows.set(o,{hits:a}),this.blocked(t,o,0,a[0]+t.windowMs-e,e);return a.push(e),this.evictIfNeeded(this.windows),this.windows.set(o,{hits:a}),{action:"allow",allowed:!0,ruleId:t.id,limit:t.limit,remaining:t.limit-a.length,resetAt:a[0]+t.windowMs,key:o}}evictIfNeeded(t){if(t.size<this.maxTrackedKeys)return;let i=t.size-this.maxTrackedKeys+1,e=0;for(let o of t.keys())if(t.delete(o),++e>=i)break}sweep(){let t=this.clock(),i=0;for(let[e,o]of this.windows){let r=e.split("\x00")[0],n=this.rules.find((s)=>s.id===r);if(!n){this.windows.delete(e),i++;continue}if(o.hits.every((s)=>s<=t-n.windowMs))this.windows.delete(e),i++}for(let[e,o]of this.buckets){let r=e.split("\x00")[0],n=this.rules.find((s)=>s.id===r);if(!n||t-o.updatedAt>n.windowMs*2)this.buckets.delete(e),i++}return i}get trackedKeys(){return this.buckets.size+this.windows.size}}function p(t){return{allow:0,log:1,throttle:2,challenge:3,deny:4}[t]}function I(t){let i={};if(t.limit!=null)i["ratelimit-limit"]=String(t.limit);if(t.remaining!=null)i["ratelimit-remaining"]=String(t.remaining);if(t.resetAt!=null)i["ratelimit-reset"]=String(Math.max(0,Math.ceil((t.resetAt-Date.now())/1000)));if(!t.allowed&&t.retryAfterMs!=null)i["retry-after"]=String(Math.max(1,Math.ceil(t.retryAfterMs/1000)));return i}function C(){return[{id:"global-ip",limit:600,windowMs:60000,burst:100,key:{source:"ip"},action:"deny",priority:100},{id:"api-ip",limit:120,windowMs:60000,burst:30,path:"/api/**",key:{source:"ip"},action:"deny",priority:50},{id:"auth-ip",limit:10,windowMs:60000,algorithm:"sliding_window",path:"/auth/**",methods:["POST"],key:{source:"ip"},action:"challenge",priority:10}]}var h="protection.controls",b=24,x=4,M={ipRules:{allow:[],block:[]}};function f(t,i){if(!t?.enabled)return;return new Date(t.expiresAt).getTime()>i.getTime()?t:void 0}function g(t,i){let e=Number.isFinite(t)?Number(t):i;return Math.min(b,Math.max(0.25,e))}var R=500;class P{controlPlane;options;constructor(t,i={}){this.controlPlane=t;this.options=i}now(){return this.options.now?.()??new Date}read(){let t=this.controlPlane.getSetting(h);if(!t||typeof t!=="object"||Array.isArray(t))return{...M,ipRules:{allow:[],block:[]}};let i=t;return{attackMode:i.attackMode,mitigationPause:i.mitigationPause,ipRules:{allow:Array.isArray(i.ipRules?.allow)?i.ipRules.allow:[],block:Array.isArray(i.ipRules?.block)?i.ipRules.block:[]},updatedAt:i.updatedAt}}write(t){let i={...t,updatedAt:this.now().toISOString()};return this.controlPlane.setSetting(h,i),i}raw(){return this.read()}current(){let t=this.now(),i=this.read();return{attackMode:f(i.attackMode,t),mitigationPause:f(i.mitigationPause,t),ipRules:i.ipRules}}enableAttackMode(t){let i=this.now(),e={enabled:!0,startedAt:i.toISOString(),expiresAt:new Date(i.getTime()+g(t.hours,x)*3600000).toISOString(),reason:t.reason.trim()||"Attack mode enabled by an operator.",actorId:t.actorId};return this.write({...this.read(),attackMode:e}),e}disableAttackMode(){let t=this.read();if(!t.attackMode?.enabled)return!1;return this.write({...t,attackMode:{...t.attackMode,enabled:!1}}),!0}pauseMitigations(t){let i=t.reason.trim();if(!i)throw Error("Pausing mitigations requires a reason: you are liable for the traffic it admits.");let e=this.now(),o={enabled:!0,startedAt:e.toISOString(),expiresAt:new Date(e.getTime()+g(t.hours,b)*3600000).toISOString(),reason:i,actorId:t.actorId};return this.write({...this.read(),mitigationPause:o}),o}resumeMitigations(){let t=this.read();if(!t.mitigationPause?.enabled)return!1;return this.write({...t,mitigationPause:{...t.mitigationPause,enabled:!1}}),!0}addIpRule(t,i){let e=i.trim();if(!w(e))throw Error(`Not a valid IP or CIDR: ${i}`);let o=this.read(),r={...o.ipRules,[t]:[...new Set([...o.ipRules[t],e])]};if(r[t].length>R)throw Error(`At most ${R} ${t} rules are supported.`);let n=t==="allow"?"block":"allow";return r[n]=r[n].filter((s)=>s!==e),this.write({...o,ipRules:r}),r}removeIpRule(t,i){let e=this.read(),o={...e.ipRules,[t]:e.ipRules[t].filter((r)=>r!==i.trim())};return this.write({...e,ipRules:o}),o}}function D(t){if(t.mitigationPause)return{attackMode:!!t.attackMode,mitigationPaused:!0,summary:`Automatic mitigation is paused until ${t.mitigationPause.expiresAt}. All traffic is being served and billed.`,expiresAt:t.mitigationPause.expiresAt};if(t.attackMode)return{attackMode:!0,mitigationPaused:!1,summary:`Attack mode is on until ${t.attackMode.expiresAt}. Every visitor is being challenged.`,expiresAt:t.attackMode.expiresAt};return{attackMode:!1,mitigationPaused:!1,summary:"Protection is in its normal posture."}}function E(t,i){if(i.mitigationPause)return t.map((e)=>({...e,enabled:!1}));if(!i.attackMode)return[...t];return t.map((e)=>({...e,action:e.action==="deny"?"deny":"challenge",burst:Math.max(1,Math.min(e.burst??e.limit,5))}))}function T(t,i){let e=[...new Set([...t.allowlist??[],...i.ipRules.allow])],o=[...new Set([...t.blocklist??[],...i.ipRules.block])];if(i.mitigationPause)return{...t,allowlist:e,blocklist:o,monitorOnly:!0};if(!i.attackMode)return{...t,allowlist:e,blocklist:o};let r=t.thresholds??{};return{...t,allowlist:e,blocklist:o,thresholds:{...r,newConnectionsPerSecond:Math.max(1,Math.floor((r.newConnectionsPerSecond??50)/5)),concurrentPerSource:Math.max(1,Math.floor((r.concurrentPerSource??100)/5))}}}function v(t,i){let e=t?.infrastructure?.compute;if(!e||e.ddos===!1)return t;let o=typeof e.ddos==="object"&&e.ddos!==null?e.ddos:{};return{...t,infrastructure:{...t.infrastructure,compute:{...e,ddos:T(o,i)}}}}export{L as Xk,k as Yk,d as Zk,m as _k,A as $k,I as al,C as bl,h as cl,b as dl,x as el,P as fl,D as gl,E as hl,T as il,v as jl};

package/dist/deploy/attach-credentials.d.ts

@@ -1,13 +1,9 @@
+import type { ReachableResource } from '@ts-cloud/core';
 /**
- * The minimum a driver has to produce for a server to be attributed.
- *
- * Structural rather than a provider type so a Hetzner server satisfies it as-is
- * and another driver can satisfy it without importing anything.
+ * The minimum a driver has to produce for a server to be attributed — the shape
+ * `CloudDriver.listReachableResources()` returns.
  */
-export interface ReachableServer {
-    name: string;
-    labels?: Record<string, string>;
-}
+export type ReachableServer = ReachableResource;
 export interface CredentialReach {
     /** Every server the credential enumerated. */
     total: number;

package/dist/deploy/index.js

@@ -1 +1 @@
-import{Ac as Z,Bc as $,Cc as aa,Dc as ba,Ec as ca,Fc as da,Gc as ea,Hc as fa,Ic as ga,Jc as ha,Kc as ia,Lc as ja,Mc as ka,Nc as la,Oc as ma,ic as y,jc as z,kc as A,lc as B,mc as C,nc as D,oc as E,od as na,pc as O,pd as oa,qc as P,qd as pa,rc as Q,rd as qa,sc as R,tc as S,uc as T,vc as U,wc as V,xc as W,yc as X,zc as Y}from"../chunk-1egjn203.js";import{Ad as N,sd as F,td as G,ud as H,vd as I,wd as J,xd as K,yd as L,zd as M}from"../chunk-v0p3hpc3.js";import{Id as _}from"../chunk-2wx29qga.js";import"../chunk-8ea5022g.js";import"../chunk-hg3c48cp.js";import"../chunk-sdqa9ghv.js";import"../chunk-bggt4n6e.js";import"../chunk-m5azeva3.js";import"../chunk-8xqn3c0w.js";import"../chunk-wdzjbecg.js";import{Ah as u,Bh as v,Ch as w,Dh as x,Qf as a,Rf as b,Sf as c,Tf as d,Uf as e,Vf as f,Wf as g,bg as h,cg as i,dg as j,eg as k,fg as l,gg as m,hg as n,ig as o,jg as p,kg as q,lg as r,yh as s,zh as t}from"../chunk-xrebj679.js";import"../chunk-y21zk0pn.js";import"../chunk-b4esxhmw.js";import"../chunk-r3qf56b3.js";import"../chunk-0ccta6z6.js";import"../chunk-gahsdmxf.js";import"../chunk-cwkg37rs.js";import"../chunk-b8e5wzwn.js";import"../chunk-dskvqt67.js";import"../chunk-xt3s24vr.js";export{R as verifyStaticApiOrigin,g as verifyAddressRecord,o as validateDeploymentConfig,K as uploadStaticFiles,B as trackDashboardOperation,A as synchronizeDashboardUsers,qa as startLocalDashboardServer,h as siteInstallBase,q as shipsToBucket,p as shipsARelease,ea as setMaintenance,na as sanitizeCloudConfig,fa as runRemoteCommand,E as routesForDashboard,da as rollbackServerlessApp,v as resolveUiSource,m as resolveSiteKind,l as resolveSiteDeployTarget,j as resolveProxyUpstreams,D as resolveLegacyDashboardRoute,ja as resolveDashboardData,u as resolveDashboardAuth,pa as resolveDashboardAction,b as removeStaleServerAddressRecords,ca as redeployServerlessApp,f as reconcileAddressRecords,c as normalizePublicIpv6,i as isPhpSite,L as invalidateCache,z as initializeDashboardControlPlane,$ as infraEnvFromOutputs,e as hostAcceptsIpv6,X as hashContainerContext,k as hasProxyUpstream,n as hasComputeConfigured,I as generateStaticSiteTemplate,F as generateExternalDnsStaticSiteTemplate,U as generateExistingStaticFullStackTemplate,la as fetchEgressReport,S as estimateStaticApiOriginMonthlyCost,W as estimateExistingStaticFullStackMonthlyCost,w as ensureManagementDashboard,y as ensureDashboardActor,ka as egressReportMetrics,H as deployStaticSiteWithExternalDnsFull,G as deployStaticSiteWithExternalDns,N as deployStaticSiteFull,J as deployStaticSite,Q as deployStaticApiOrigin,O as deploySite,r as deployShipsFiles,ba as deployServerlessApp,V as deployExistingStaticFullStack,M as deleteStaticSite,C as dashboardPageRoutes,t as dashboardCredentialsFile,oa as dashboardActions,P as createStaticApiOriginDependencies,T as createExistingStaticFullStackDependencies,Y as createContainerImageDependencies,a as collectServerDnsDomains,ma as collectEgressMetrics,ia as buildTopology,ha as buildServerlessTopology,ga as buildServerTopology,x as buildManagementDashboardArtifact,aa as buildFunctionEnv,_ as buildAndPushServerlessImage,Z as buildAndPushContainerImage,s as MANAGEMENT_DASHBOARD_SITE,d as IPV6_EXCLUDED_HOST_LABELS};
+import{Ac as Z,Bc as aa,Cc as ba,Dc as ca,Ec as da,Fc as ea,Gc as fa,Hc as ga,Ic as ha,Jc as ia,Kc as ja,Lc as ka,Mc as la,Nc as ma,Oc as na,ic as y,jc as z,kc as A,lc as B,mc as C,nc as D,oc as E,od as oa,pc as O,pd as pa,qc as P,qd as qa,rc as Q,rd as ra,sc as R,tc as S,uc as T,vc as U,wc as V,xc as W,yc as X,zc as Y}from"../chunk-rcxq9aaa.js";import{Ad as N,sd as F,td as G,ud as H,vd as I,wd as J,xd as K,yd as L,zd as M}from"../chunk-2m09t0c0.js";import{Id as _}from"../chunk-1ypkh8g6.js";import"../chunk-h1rc94df.js";import"../chunk-nnqxmh7f.js";import"../chunk-q2njk4hx.js";import"../chunk-ky5c6t5y.js";import"../chunk-t0kh8haz.js";import"../chunk-qtp90j44.js";import"../chunk-qjk1v1gs.js";import{Dh as s,Eh as t,Fh as u,Gh as v,Hh as w,Ih as x,Uf as a,Vf as b,Wf as c,Xf as d,Yf as e,Zf as f,_f as g,gg as h,hg as i,ig as j,jg as k,kg as l,lg as m,mg as n,ng as o,og as p,pg as q,qg as r}from"../chunk-7xpxzbkr.js";import"../chunk-hbhxk5a0.js";import"../chunk-8e0az001.js";import"../chunk-p6vszgc2.js";import"../chunk-gk58959n.js";import"../chunk-s3rpd72x.js";import"../chunk-r5natbed.js";import"../chunk-b10cbk8z.js";import"../chunk-0hj552t7.js";import"../chunk-spx89gaw.js";export{d as IPV6_EXCLUDED_HOST_LABELS,s as MANAGEMENT_DASHBOARD_SITE,Z as buildAndPushContainerImage,_ as buildAndPushServerlessImage,ba as buildFunctionEnv,x as buildManagementDashboardArtifact,ha as buildServerTopology,ia as buildServerlessTopology,ja as buildTopology,na as collectEgressMetrics,a as collectServerDnsDomains,Y as createContainerImageDependencies,T as createExistingStaticFullStackDependencies,P as createStaticApiOriginDependencies,pa as dashboardActions,t as dashboardCredentialsFile,C as dashboardPageRoutes,M as deleteStaticSite,V as deployExistingStaticFullStack,ca as deployServerlessApp,r as deployShipsFiles,O as deploySite,Q as deployStaticApiOrigin,J as deployStaticSite,N as deployStaticSiteFull,G as deployStaticSiteWithExternalDns,H as deployStaticSiteWithExternalDnsFull,la as egressReportMetrics,y as ensureDashboardActor,w as ensureManagementDashboard,W as estimateExistingStaticFullStackMonthlyCost,S as estimateStaticApiOriginMonthlyCost,ma as fetchEgressReport,U as generateExistingStaticFullStackTemplate,F as generateExternalDnsStaticSiteTemplate,I as generateStaticSiteTemplate,n as hasComputeConfigured,k as hasProxyUpstream,X as hashContainerContext,e as hostAcceptsIpv6,aa as infraEnvFromOutputs,z as initializeDashboardControlPlane,L as invalidateCache,i as isPhpSite,c as normalizePublicIpv6,f as reconcileAddressRecords,da as redeployServerlessApp,b as removeStaleServerAddressRecords,qa as resolveDashboardAction,u as resolveDashboardAuth,ka as resolveDashboardData,D as resolveLegacyDashboardRoute,j as resolveProxyUpstreams,l as resolveSiteDeployTarget,m as resolveSiteKind,v as resolveUiSource,ea as rollbackServerlessApp,E as routesForDashboard,ga as runRemoteCommand,oa as sanitizeCloudConfig,fa as setMaintenance,p as shipsARelease,q as shipsToBucket,h as siteInstallBase,ra as startLocalDashboardServer,A as synchronizeDashboardUsers,B as trackDashboardOperation,K as uploadStaticFiles,o as validateDeploymentConfig,g as verifyAddressRecord,R as verifyStaticApiOrigin};

package/dist/dns/cloudflare.d.ts

@@ -104,6 +104,33 @@ export declare class CloudflareProvider implements DnsProvider {
      * List all domains (zones) managed by this Cloudflare account
      */
     listDomains(): Promise<string[]>;
+    /**
+     * Create a zone in this account, or return the one already there.
+     *
+     * Idempotent on purpose. A zone migration is re-run far more often than it
+     * succeeds first time — a too-narrow token, a half-imported record set, a
+     * nameserver flip that has not propagated — and every one of those reruns
+     * would otherwise die on Cloudflare's "zone already exists" (code 1061)
+     * before reaching the import that actually needed fixing.
+     *
+     * `accountId` is required by the API for anything but a single-account token,
+     * so it falls back to {@link CloudflareProviderOptions.accountId} and fails
+     * loudly rather than letting Cloudflare pick an account for you.
+     *
+     * The returned `nameServers` are the pair the registrar has to be pointed at.
+     * They are assigned at creation and never change for the life of the zone, so
+     * they can be read once here and used to drive the registrar update.
+     */
+    createZone(domain: string, options?: {
+        accountId?: string;
+        jumpStart?: boolean;
+    }): Promise<{
+        id: string;
+        name: string;
+        status: string;
+        nameServers: string[];
+        created: boolean;
+    }>;
     /**
      * Get zone details (Cloudflare-specific)
      */

package/dist/dns/godaddy.d.ts

@@ -49,7 +49,24 @@ export declare class GoDaddyProvider implements DnsProvider {
         expires?: string;
     } | null>;
     /**
-     * Update nameservers for a domain (GoDaddy-specific)
+     * Read the nameservers the REGISTRY has this domain delegated to.
+     *
+     * Note this is the delegation, not the zone's own `NS` records. The two can
+     * disagree — that is exactly the state a half-finished migration leaves
+     * behind — and only the delegation decides who actually answers queries.
+     */
+    getNameServers(domain: string): Promise<string[]>;
+    /**
+     * Delegate a domain to a different set of nameservers.
+     *
+     * This PATCHes the DOMAIN, which is the registrar operation that changes the
+     * delegation at the registry. The obvious-looking alternative —
+     * `PUT /v1/domains/{domain}/records/NS` — writes `NS` records into GoDaddy's
+     * own hosted zone instead. That call succeeds, returns 200, and changes
+     * nothing about who is authoritative: the registry still points at the old
+     * provider. For a migration whose whole purpose is the cutover, that is the
+     * worst possible failure, because every check short of an external `dig +trace`
+     * reports success.
      */
     updateNameServers(domain: string, nameservers: string[]): Promise<boolean>;
     /**

package/dist/dns/index.d.ts

@@ -9,6 +9,8 @@ export { CloudflareProvider } from './cloudflare';
 export type { DeclaredRecord, DeclaredRecordInput, DeclaredRecordOutcome, DeclaredRecordsReport, } from './declared-records';
 export { policyTag, qualifyName, reconcileDeclaredRecords, resolveDeclaredRecords, } from './declared-records';
 export { Route53Provider } from './route53-adapter';
+export type { MigratedRecord, SkippedRecord, ZoneMigrationPlan, ZoneMigrationReport, ZoneParityReport, } from './zone-migration';
+export { applyZoneMigration, exportRoute53Zone, planZoneMigration, verifyZoneParity, } from './zone-migration';
 export { UnifiedDnsValidator, createPorkbunValidator, createGoDaddyValidator, createRoute53Validator, } from './validator';
 import type { DnsProvider, DnsProviderConfig } from './types';
 /**

package/dist/dns/index.js

@@ -1 +1 @@
-import{Af as e,Bf as f,Cf as g,Df as h,Ef as i,Ff as j,Gf as k,Hf as l,If as m,Jf as n,Kf as o,Lf as p,Mf as q,vf as a,wf as b,xf as c,zf as d}from"../chunk-8xqn3c0w.js";import"../chunk-wdzjbecg.js";import"../chunk-0ccta6z6.js";import"../chunk-xt3s24vr.js";export{g as resolveDeclaredRecords,h as reconcileDeclaredRecords,f as qualifyName,e as policyTag,q as dnsProviders,o as detectDnsProvider,m as createRoute53Validator,k as createPorkbunValidator,l as createGoDaddyValidator,n as createDnsProvider,j as UnifiedDnsValidator,i as Route53Provider,b as PorkbunProvider,a as PROXIABLE_RECORD_TYPES,c as GoDaddyProvider,p as DnsProviderFactory,d as CloudflareProvider};
+import{Af as e,Bf as f,Cf as g,Df as h,Ef as i,Ff as j,Gf as k,Hf as l,If as m,Jf as n,Kf as o,Lf as p,Mf as q,Nf as r,Of as s,Pf as t,Qf as u,vf as a,wf as b,xf as c,zf as d}from"../chunk-qtp90j44.js";import"../chunk-qjk1v1gs.js";import"../chunk-gk58959n.js";import"../chunk-spx89gaw.js";export{d as CloudflareProvider,t as DnsProviderFactory,c as GoDaddyProvider,a as PROXIABLE_RECORD_TYPES,b as PorkbunProvider,i as Route53Provider,n as UnifiedDnsValidator,l as applyZoneMigration,r as createDnsProvider,p as createGoDaddyValidator,o as createPorkbunValidator,q as createRoute53Validator,s as detectDnsProvider,u as dnsProviders,j as exportRoute53Zone,k as planZoneMigration,e as policyTag,f as qualifyName,h as reconcileDeclaredRecords,g as resolveDeclaredRecords,m as verifyZoneParity};

package/dist/dns/zone-migration.d.ts

@@ -0,0 +1,92 @@
+/**
+ * Zone migration — move a whole zone onto another provider, record for record.
+ *
+ * This exists because the interesting part of a nameserver migration is not the
+ * nameserver change, it is everything that silently fails to come with it. A
+ * deploy derives the address records for the sites it owns; it knows nothing
+ * about mail, domain-verification tokens, certificate-validation CNAMEs or the
+ * service records a calendar client autodiscovers with. Those are exactly the
+ * records nobody notices are gone until someone reports that mail stopped, and
+ * by then the old zone may already have been deleted.
+ *
+ * So the flow here is deliberately: **export everything → translate → import →
+ * diff → only then flip the nameservers.** The diff is the point. A migration
+ * that reports "imported 91 records" without comparing against the source is
+ * indistinguishable from one that dropped seven of them.
+ */
+import type { DnsProvider, DnsRecord, DnsRecordType } from './types';
+import type { ResourceRecordSet, Route53Client } from '../aws/route53';
+/** A record as it will exist at the destination. */
+export interface MigratedRecord extends DnsRecord {
+    name: string;
+    type: DnsRecordType;
+    content: string;
+    /**
+     * Set when this record is not a faithful copy but a translation — an ALIAS
+     * flattened to a CNAME, for instance. Carried through to the report so the
+     * operator sees which records changed shape rather than having to spot it.
+     */
+    translatedFrom?: string;
+}
+export interface SkippedRecord {
+    name: string;
+    type: string;
+    reason: string;
+}
+export interface ZoneMigrationPlan {
+    zone: string;
+    records: MigratedRecord[];
+    skipped: SkippedRecord[];
+    warnings: string[];
+}
+export interface ZoneMigrationReport {
+    applied: MigratedRecord[];
+    failed: Array<{
+        record: MigratedRecord;
+        message: string;
+    }>;
+}
+export interface ZoneParityReport {
+    /** Planned records confirmed present at the destination. */
+    matched: MigratedRecord[];
+    /** Planned records absent, or present with different content. */
+    missing: Array<{
+        record: MigratedRecord;
+        found?: string;
+    }>;
+    ok: boolean;
+}
+/**
+ * Read every record set in a Route53 hosted zone.
+ *
+ * Paginates to exhaustion rather than taking the first page. Route53 returns
+ * 100 record sets by default and a zone that has quietly grown past that is
+ * precisely the zone whose tail records — added last, so most likely to be the
+ * recent mail or verification entries — would be dropped by a single call.
+ */
+export declare function exportRoute53Zone(client: Route53Client, hostedZoneId: string): Promise<ResourceRecordSet[]>;
+/**
+ * Translate a Route53 zone into records another provider can hold.
+ *
+ * Nothing is written here. The plan is the reviewable artifact — a migration
+ * that cannot be read before it runs is one that gets run twice.
+ */
+export declare function planZoneMigration(sets: ResourceRecordSet[], zone: string): ZoneMigrationPlan;
+/**
+ * Write a plan to the destination provider.
+ *
+ * Upserts rather than creates, so a half-finished migration can simply be run
+ * again. Failures are collected instead of thrown: one rejected record should
+ * not strand the other ninety, and the parity check afterwards is what decides
+ * whether the migration is actually complete.
+ */
+export declare function applyZoneMigration(provider: DnsProvider, plan: ZoneMigrationPlan): Promise<ZoneMigrationReport>;
+/**
+ * Compare what was planned against what the destination actually holds.
+ *
+ * This is the step that makes a migration safe to act on. Provider writes
+ * report success far more reliably than they take effect — a silently coerced
+ * value, a record rejected by a rule, a name written into the wrong zone — and
+ * the only way to know the new zone can replace the old one is to read it back.
+ */
+export declare function verifyZoneParity(provider: DnsProvider, plan: ZoneMigrationPlan): Promise<ZoneParityReport>;

package/dist/dns/zone-migration.test.d.ts

@@ -0,0 +1 @@
+export {};

package/dist/drivers/hetzner/driver.d.ts

@@ -1,4 +1,4 @@
-import type { CloudDriver, ComputeStackOutputs, ComputeTarget, FindComputeTargetsOptions, ProvisionComputeOptions, RemoteDeployResult, RunRemoteDeployOptions, UploadReleaseOptions, UploadReleaseResult } from '@ts-cloud/core';
+import type { CloudDriver, ComputeStackOutputs, ComputeTarget, FindComputeTargetsOptions, ProvisionComputeOptions, ReachableResource, RemoteDeployResult, RunRemoteDeployOptions, UploadReleaseOptions, UploadReleaseResult } from '@ts-cloud/core';
 import { HetznerClient } from './client';
 export declare function formatSshFailure(error: unknown): string;
 export interface HetznerDriverOptions {
@@ -102,6 +102,13 @@ export declare class HetznerDriver implements CloudDriver {
      * even when several unrelated managed boxes exist in the Hetzner project.
      */
     private attachToComputeInfrastructure;
+    /**
+     * Every server this token can see. On Hetzner that is every server in the
+     * provider project, because a Cloud API token is project-scoped with Read or
+     * Read & Write and no per-resource scoping — so "can see" and "can delete"
+     * are the same set, and the count is the honest blast radius.
+     */
+    listReachableResources(): Promise<ReachableResource[]>;
     runRemoteDeploy(options: RunRemoteDeployOptions): Promise<RemoteDeployResult>;
     /**
      * Ensure the local SSH public key is registered in the Hetzner project and

package/dist/drivers/index.js

@@ -1 +1 @@
-import{$g as O,Ag as o,Cg as p,Dg as q,Eg as r,Fg as s,Fh as ja,Gg as t,Gh as ka,Hg as u,Hh as la,Ig as v,Ih as ma,Jg as w,Jh as na,Kg as x,Kh as oa,Lg as y,Lh as pa,Mg as z,Mh as qa,Ng as A,Og as B,Pg as C,Qg as D,Rg as E,Sg as F,Tg as G,Ug as H,Vg as I,Wg as J,Xg as K,Yg as L,Zg as M,_g as N,ah as P,bh as Q,ch as R,dh as S,eh as T,fh as U,gh as V,hh as W,ih as X,jh as Y,kh as Z,lh as _,mg as a,mh as $,ng as b,nh as aa,og as c,oh as ba,pg as d,qg as e,rg as f,rh as ca,sg as g,sh as da,tg as h,th as ea,ug as i,uh as fa,vg as j,vh as ga,wg as k,wh as ha,xg as l,xh as ia,yg as m,zg as n}from"../chunk-xrebj679.js";import"../chunk-y21zk0pn.js";import"../chunk-b4esxhmw.js";import"../chunk-r3qf56b3.js";import"../chunk-0ccta6z6.js";import"../chunk-cwkg37rs.js";import"../chunk-b8e5wzwn.js";import"../chunk-dskvqt67.js";import"../chunk-xt3s24vr.js";export{T as writeResizeCheckpoint,s as wrapCloudInitUserData,G as waitForSsh,H as waitForCloudInit,K as verifyHetznerResize,P as verifyHetznerHostOptimization,E as sshExecOrThrow,D as sshExec,Y as serverPublicIpv4,F as scpUpload,L as resolveHetznerHostOptimizationPlan,q as resolveHetznerApiToken,ca as resolveExecStart,R as resizeLockPath,Q as resizeCheckpointPath,ma as renewRpxCertificates,h as renderRpxLauncher,la as reloadRpxGateway,fa as releaseTarballTmpPath,S as readResizeCheckpoint,J as prepareHetznerResize,z as planHetznerServerResize,r as normalizeSshPublicKey,d as normalizeRoutePath,A as isHetznerCapacityError,v as isBoxMode,b as hasAutoWwwVariant,n as generateUbuntuAppCloudInit,c as gatewayHostnames,B as executeHetznerServerResize,V as ensureSshKey,X as ensureServer,W as ensureFirewall,e as deriveRouteId,ja as deploySiteRelease,ka as deployAllComputeSites,w as createCloudDriver,ba as createBoxProvisioner,I as collectHetznerResizeManifest,O as collectHetznerHostOptimizationReport,y as cloudDrivers,ea as buildStaticSiteDeployScript,C as buildSshArgs,da as buildSiteDeployScript,l as buildRpxProvisionScript,g as buildRpxLbConfig,m as buildRpxFragmentRefreshScript,f as buildRpxConfig,ha as buildLocalArtifactFetch,ia as buildHostCleanupScript,M as buildHetznerHostOptimizationScript,qa as buildCloudFrontOriginConfig,_ as buildBoxUserData,ga as buildAwsArtifactFetch,N as applyHetznerHostOptimization,U as acquireResizeLock,Z as UBUNTU_2404_AMI_PARAM,k as RPX_SERVICE_NAME,j as RPX_LAUNCHER_PATH,i as RPX_DIR,pa as MANAGED_ORIGIN_REQUEST_POLICY_ALL_VIEWER,na as MANAGED_CACHE_POLICY_OPTIMIZED,oa as MANAGED_CACHE_POLICY_DISABLED,u as LocalBoxDriver,t as HetznerDriver,p as HetznerClient,$ as HetznerBoxProvisioner,a as DEFAULT_RPX_CERTS_DIR,x as CloudDriverFactory,o as AwsDriver,aa as AwsBoxProvisioner};
+import{$g as J,Ag as j,Ah as ha,Bg as k,Bh as ia,Cg as l,Ch as ja,Dg as m,Eg as n,Fg as o,Hg as p,Ig as q,Jg as r,Kg as s,Kh as ka,Lg as t,Lh as la,Mg as u,Mh as ma,Ng as v,Nh as na,Og as w,Oh as oa,Pg as x,Ph as pa,Qg as y,Qh as qa,Rg as z,Rh as ra,Sg as A,Tg as B,Ug as C,Vg as D,Wg as E,Xg as F,Yg as G,Zg as H,_g as I,ah as K,bh as L,ch as M,dh as N,eh as O,fh as P,gh as Q,hh as R,ih as S,jh as T,kh as U,lh as V,mh as W,nh as X,oh as Y,ph as Z,qh as _,rg as a,rh as aa,sg as b,sh as ba,tg as c,th as ca,ug as d,vg as e,wg as f,wh as da,xg as g,xh as ea,yg as h,yh as fa,zg as i,zh as ga}from"../chunk-7xpxzbkr.js";import"../chunk-hbhxk5a0.js";import"../chunk-8e0az001.js";import"../chunk-p6vszgc2.js";import"../chunk-gk58959n.js";import"../chunk-r5natbed.js";import"../chunk-b10cbk8z.js";import"../chunk-0hj552t7.js";import"../chunk-spx89gaw.js";export{ba as AwsBoxProvisioner,o as AwsDriver,x as CloudDriverFactory,a as DEFAULT_RPX_CERTS_DIR,aa as HetznerBoxProvisioner,p as HetznerClient,t as HetznerDriver,u as LocalBoxDriver,pa as MANAGED_CACHE_POLICY_DISABLED,oa as MANAGED_CACHE_POLICY_OPTIMIZED,qa as MANAGED_ORIGIN_REQUEST_POLICY_ALL_VIEWER,i as RPX_DIR,j as RPX_LAUNCHER_PATH,k as RPX_SERVICE_NAME,Z as UBUNTU_2404_AMI_PARAM,U as acquireResizeLock,N as applyHetznerHostOptimization,ha as buildAwsArtifactFetch,_ as buildBoxUserData,ra as buildCloudFrontOriginConfig,M as buildHetznerHostOptimizationScript,ja as buildHostCleanupScript,ia as buildLocalArtifactFetch,f as buildRpxConfig,m as buildRpxFragmentRefreshScript,g as buildRpxLbConfig,l as buildRpxProvisionScript,ea as buildSiteDeployScript,C as buildSshArgs,fa as buildStaticSiteDeployScript,y as cloudDrivers,O as collectHetznerHostOptimizationReport,I as collectHetznerResizeManifest,ca as createBoxProvisioner,w as createCloudDriver,la as deployAllComputeSites,ka as deploySiteRelease,e as deriveRouteId,W as ensureFirewall,X as ensureServer,V as ensureSshKey,B as executeHetznerServerResize,c as gatewayHostnames,n as generateUbuntuAppCloudInit,b as hasAutoWwwVariant,v as isBoxMode,A as isHetznerCapacityError,d as normalizeRoutePath,r as normalizeSshPublicKey,z as planHetznerServerResize,J as prepareHetznerResize,S as readResizeCheckpoint,ga as releaseTarballTmpPath,ma as reloadRpxGateway,h as renderRpxLauncher,na as renewRpxCertificates,Q as resizeCheckpointPath,R as resizeLockPath,da as resolveExecStart,q as resolveHetznerApiToken,L as resolveHetznerHostOptimizationPlan,F as scpUpload,Y as serverPublicIpv4,D as sshExec,E as sshExecOrThrow,P as verifyHetznerHostOptimization,K as verifyHetznerResize,H as waitForCloudInit,G as waitForSsh,s as wrapCloudInitUserData,T as writeResizeCheckpoint};

package/dist/drivers/shared/app-updates.d.ts

@@ -0,0 +1,36 @@
+/**
+ * Keep self-updating binaries current on a box.
+ *
+ * A tool that ships as a GitHub release and knows how to replace itself
+ * (`<binary> upgrade`) still needs something to *call* it on a schedule. Every
+ * project was writing that something by hand — a systemd service, a timer, an
+ * env file, a daemon-reload — into its own `userData`. That is boilerplate the
+ * framework should own: it is identical everywhere except for the binary path
+ * and the unit to restart, and both of those are already config.
+ *
+ * So `compute.appUpdates` takes the two facts that differ and renders the rest:
+ *
+ * ```ts
+ * compute: {
+ *   appUpdates: [{ service: 'mail', binary: '/opt/mail/mail-server' }],
+ * }
+ * ```
+ *
+ * Safety is delegated, deliberately. This module schedules; it does not swap
+ * binaries. The tool's own `upgrade` command is responsible for skipping when
+ * it is already current (so a daily tick does not restart a live service for
+ * nothing), for refusing to move backwards, and for rolling back if the new
+ * binary will not start. A tool without those properties should not be listed
+ * here.
+ */
+import type { ComputeAppUpdateTarget } from '@ts-cloud/core';
+/** Where the per-target pause switch lives. */
+export declare function appUpdateEnvPath(service: string): string;
+/** Unit basename for a target's updater. */
+export declare function appUpdateUnitBase(service: string): string;
+/**
+ * Render the provisioning lines for every configured target. Returns `[]` when
+ * nothing is configured, matching every other builder in this directory, so the
+ * caller can splat it unconditionally.
+ */
+export declare function buildAppUpdatesScript(targets?: ComputeAppUpdateTarget[]): string[];

package/dist/drivers/shared/compute-provision.d.ts

@@ -19,11 +19,23 @@ export interface ComputeProvisionScripts {
     phpBox: boolean;
     /** nginx + php-fpm + Composer install commands (undefined for non-PHP boxes). */
     phpProvision?: string[];
-    /** services + db + firewall + updates + monitoring + ssh + notifier + backups. */
+    /** services + db + mail + firewall + updates + monitoring + ssh + notifier + backups. */
     servicesProvision?: string[];
 }
+/** Which environment the box is being provisioned for. See {@link buildComputeProvisionScripts}. */
+export interface ComputeProvisionOptions {
+    /**
+     * The environment name, e.g. `'production'`.
+     *
+     * Only mail reads it today, and it reads it for a reason worth stating: an
+     * omitted environment resolves to a mail **catcher**, never a server. The
+     * caller that forgets to pass it gets a box that traps its own mail rather
+     * than one that offers SMTP to the internet.
+     */
+    environment?: string;
+}
 /**
  * Build the machine provisioning scripts from a CloudConfig. Returns the
  * pieces the Ubuntu bootstrap (and the image bake) splice in.
  */
-export declare function buildComputeProvisionScripts(config: CloudConfig): ComputeProvisionScripts;
+export declare function buildComputeProvisionScripts(config: CloudConfig, options?: ComputeProvisionOptions): ComputeProvisionScripts;

package/dist/drivers/shared/db-provision.d.ts

@@ -10,7 +10,7 @@
  * are on PATH via `pantry env`. Admin commands (db setup, dumps, restores)
  * connect over the engine's local unix socket — see {@link pgAdminCommand}.
  */
-import type { ComputeServicesConfig, DatabaseConfig } from '@ts-cloud/core';
+import type { ComputeServicesConfig, DatabaseConfig, ResolvedMailService } from '@ts-cloud/core';
 /**
  * True when the database is co-located with the box (the managed-services
  * engine): no host configured, or an explicit loopback host. Anything else is
@@ -42,8 +42,9 @@ export declare function pgAdminCommand(database: DatabaseConfig | undefined, too
  * `options.bindPrivate` is accepted for fleet compatibility; pantry's services
  * already bind all interfaces behind the firewall.
  */
-export declare function buildServicesProvisionScript(services?: ComputeServicesConfig, _options?: {
+export declare function buildServicesProvisionScript(services?: ComputeServicesConfig, options?: {
     bindPrivate?: boolean;
+    mail?: ResolvedMailService;
 }): string[];
 /**
  * Build the commands that create the application database + user on the on-box

package/dist/drivers/shared/mail-provision.d.ts

@@ -0,0 +1,116 @@
+/**
+ * Mail server provisioning — `mail`, the Zig SMTP/IMAP server, installed from
+ * pantry and run as a systemd unit, with its own webmail UI.
+ *
+ * ## One binary, two jobs
+ *
+ * Development mail traps and production mail servers are conventionally two
+ * different programs, and that difference is where mail breaks: a message that
+ * renders in mailpit has been through a parser nothing in production will ever
+ * run, and a `From` that mailpit accepts is one no MTA would. The bugs that
+ * costs are the ones nobody can reproduce locally.
+ *
+ * So a `'catcher'` here is not a different program. It is the same binary with
+ * delivery switched off, authentication switched off, bound to loopback, on
+ * mailpit's ports — one parser, one Maildir, one UI, all the way from a
+ * developer's laptop to production. See {@link ResolvedMailService}.
+ *
+ * ## What is deliberately not automated
+ *
+ * **DNS.** The MX, SPF and DMARC records, and the DKIM record for the key
+ * generated below, are printed rather than published. They belong to a zone
+ * this provisioner may not own, and a wrong MX does not fail — it silently
+ * routes somebody's mail somewhere else, which is discovered days later by the
+ * person who did not get it. {@link mailDnsRecords} returns them so the CLI
+ * and the dashboard can show the same set.
+ *
+ * **The DKIM private key is generated once and never rewritten.** Regenerating
+ * it on every provision would invalidate every signature already in flight,
+ * so the key is created only when the file is absent.
+ */
+import type { ResolvedMailService } from '@ts-cloud/core';
+/** Where the generated config, environment file and DKIM keys live. */
+export declare const MAIL_CONFIG_DIR = "/etc/mail";
+/** The unprivileged account the mail server runs as. */
+export declare const MAIL_USER = "mail-server";
+/** systemd unit name, so callers can restart it without re-deriving the string. */
+export declare const MAIL_UNIT = "mail";
+/** The package spec to install, honouring a pinned version. */
+export declare function mailPackages(mail: ResolvedMailService): string[];
+/** Absolute path of a domain's DKIM private key. */
+export declare function dkimKeyPath(mail: ResolvedMailService, domain: string): string;
+/**
+ * The mail server's `config.toml`.
+ *
+ * Only the keys the server actually reads (`packages/zig/src/core/config.zig`)
+ * are written. Everything the TOML has no section for — webmail, IMAP, DKIM
+ * keys, delivery method — goes in the environment file instead; see
+ * {@link buildMailEnvFile}. Splitting them is not a choice, it is where the
+ * server looks.
+ */
+export declare function buildMailConfigToml(mail: ResolvedMailService): string;
+/**
+ * The systemd `EnvironmentFile`.
+ *
+ * Everything the server configures through the environment rather than the
+ * TOML: the webmail listener, IMAP and submission ports, DKIM keys, the
+ * delivery method, and the database path.
+ */
+export declare function buildMailEnvFile(mail: ResolvedMailService): string;
+/** The systemd unit that runs the server. */
+export declare function buildMailUnit(mail: ResolvedMailService): string;
+/** A DNS record an operator has to publish for mail to work. */
+export interface MailDnsRecord {
+    type: 'MX' | 'TXT' | 'CNAME';
+    /** Record name, e.g. `example.com` or `default._domainkey.example.com`. */
+    name: string;
+    /**
+     * Record value. For DKIM this is a placeholder — the real one is derived
+     * from the public key on the box, which does not exist until provisioning
+     * has run. The shell prints the actual value; see {@link buildDkimScript}.
+     */
+    value: string;
+    /** MX preference, when the type is MX. */
+    priority?: number;
+    /** Why this record exists, shown beside it wherever it is presented. */
+    note: string;
+}
+/**
+ * The records an operator has to publish. Returned rather than created: see
+ * the module comment for why DNS is not automated here.
+ */
+export declare function mailDnsRecords(mail: ResolvedMailService): MailDnsRecord[];
+/**
+ * Generate a DKIM key per domain, once, and print the record to publish.
+ *
+ * Guarded on the file's absence rather than on a flag: a re-provision that
+ * regenerated the key would invalidate every signature already in flight, and
+ * the mail affected is mail that was already accepted by somebody's server and
+ * is now failing verification at their end.
+ */
+export declare function buildDkimScript(mail: ResolvedMailService): string[];
+/**
+ * Create the declared mailboxes.
+ *
+ * Both `create` and `change-password` run, unconditionally, and that is not
+ * belt-and-braces. `mail user:local create` on an existing account prints
+ * "already exists" and **exits 0**, so a `create || change-password` chain
+ * would never reach the second command — an operator who rotated a password in
+ * the config and redeployed would get a box that kept the old one and reported
+ * success. Running both means the declaration is the truth on every deploy.
+ *
+ * Each is tolerated failing so one bad account cannot abort a provision that
+ * has already installed and started the server, and each runs as the service
+ * account with the server's own `SMTP_DB_PATH` — as root it would create a
+ * second database beside the one the server reads, and the accounts would
+ * exist in a file nothing opens.
+ */
+export declare function buildMailAccountScript(mail: ResolvedMailService): string[];
+/**
+ * The whole provisioning sequence for the mail service.
+ *
+ * Idempotent throughout: every step is guarded, so this runs on a cold boot,
+ * on a golden-image bake, and on every redeploy with the same result. Returns
+ * `[]` when mail is not declared.
+ */
+export declare function buildMailProvisionScript(mail: ResolvedMailService): string[];

package/dist/drivers/shared/mail-provision.test.d.ts

@@ -0,0 +1 @@
+export {};

package/dist/drivers/shared/managed-services-probe.d.ts

@@ -0,0 +1,47 @@
+/**
+ * Check that a box actually runs the on-box services a project declares.
+ *
+ * This exists for attach mode (`cloud.attachTo`). A project that attaches rides
+ * a box its OWNER provisioned, and attach mode deliberately provisions nothing:
+ * installing engines on someone else's server is not a tenant's business. But
+ * the tenant's config still carries `managedServices`, and ts-cloud used to act
+ * on it regardless — creating a role and database against an engine that was
+ * never there. The result was a deploy that shipped every release and then
+ * failed at the database step, with no statement anywhere that the two settings
+ * are structurally incompatible.
+ *
+ * A declared service is considered present when its binary is on PATH (pantry
+ * puts the engines there) OR something is listening on its port. Either alone
+ * is enough on purpose: a stopped service and an engine installed outside
+ * pantry are both "the owner has this", and a preflight that fails on those
+ * would block deploys it has no business blocking. The case worth catching is
+ * the unambiguous one — no binary, no listener, no engine.
+ */
+import type { ComputeServicesConfig } from '@ts-cloud/core';
+/**
+ * The service names a config declares, in a stable order. Unknown keys are
+ * skipped rather than guessed at: a service this module cannot recognize is one
+ * it cannot honestly report as missing.
+ */
+export declare function declaredManagedServices(services: ComputeServicesConfig | undefined): string[];
+/**
+ * Shell that reports which of `names` the box provides, one `ts-cloud-service:`
+ * line each. Always exits 0 — a missing service is a finding to report, not a
+ * remote command failure to guess at.
+ */
+export declare function buildManagedServicesProbeScript(names: readonly string[]): string[];
+/**
+ * The declared services the box reported as missing.
+ *
+ * A service the probe said nothing about is NOT reported missing: silence means
+ * the probe did not run (an older box, a truncated capture), and inventing a
+ * failure from missing evidence would block deploys that are perfectly fine.
+ */
+export declare function parseMissingManagedServices(output: string | undefined, declared: readonly string[]): string[];
+/**
+ * The message an operator gets when the host does not provide what the tenant
+ * declared. Names the setting, the owner, the host, and the two ways out —
+ * because the one thing that is NOT an option is waiting for ts-cloud to
+ * install it.
+ */
+export declare function formatMissingManagedServicesError(missing: readonly string[], ownerSlug: string, host: string | undefined): string;

package/dist/drivers/shared/managed-services-probe.test.d.ts

@@ -0,0 +1 @@
+export {};

package/dist/drivers/shared/package-manager.d.ts

@@ -32,6 +32,7 @@ export declare const PANTRY_PACKAGES: {
     readonly redis: 'redis.io';
     readonly memcached: 'memcached.org';
     readonly meilisearch: 'meilisearch.com';
+    readonly mail: 'github.com/mail-os/mail';
     readonly git: 'git-scm.com';
     readonly certbot: 'certbot.eff.org';
     readonly bun: 'bun.sh';

package/dist/drivers/shared/remote-failure.d.ts

@@ -0,0 +1,21 @@
+/**
+ * Turn per-instance remote-execution results into ONE operator-facing error.
+ *
+ * Both drivers used to collapse a failed remote run to a fixed sentence —
+ * "One or more SSH deploy commands failed" — while the thing that explains the
+ * failure (the remote command's stderr) sat right there in `perInstance`. The
+ * operator was left with a deploy that had failed for no stated reason, and no
+ * flag, not even `--verbose`, would print it: nothing had kept it.
+ *
+ * The remote output is already redacted where it is captured (the deploy script
+ * embeds a here-document with the full runtime environment; see
+ * `formatSshFailure`), so this only has to decide what is worth showing.
+ */
+import type { RemoteDeployInstanceResult } from '@ts-cloud/core';
+/**
+ * Build the `error` for a {@link import('@ts-cloud/core').RemoteDeployResult}
+ * whose run did not fully succeed. `summary` is the one-line what-failed (e.g.
+ * "One or more SSH deploy commands failed"); the detail of each failing
+ * instance is appended beneath it.
+ */
+export declare function summarizeRemoteFailures(perInstance: readonly RemoteDeployInstanceResult[], summary: string): string;