@gusnips/one-click-dns 0.0.0-stage → 0.1.0

package/dist/chunk-FGM7S7GQ.js

@@ -0,0 +1,222 @@
+import {
+  normalizeDnsName
+} from "./chunk-P2O7INDB.js";
+
+// src/bounded-fetch.ts
+import { readBounded } from "@gusnips/server";
+async function fetchBounded(doFetch, url, init, limits) {
+  try {
+    const res = await doFetch(url, {
+      ...init,
+      redirect: "manual",
+      signal: AbortSignal.timeout(limits.timeoutMs)
+    });
+    if (res.type === "opaqueredirect" || res.status >= 300 && res.status < 400) {
+      await res.body?.cancel().catch(() => void 0);
+      return { status: res.status || 302, text: "" };
+    }
+    const { bytes, truncated } = await readBounded(res.body, limits.maxBytes);
+    if (truncated) return null;
+    return { status: res.status, text: new TextDecoder().decode(bytes) };
+  } catch {
+    return null;
+  }
+}
+
+// src/guards.ts
+function isObject(value) {
+  return typeof value === "object" && value !== null;
+}
+
+// src/writers/types.ts
+var DnsWriteError = class extends Error {
+  constructor(code, params = {}) {
+    super(MESSAGES[code](params));
+    this.code = code;
+    this.params = params;
+    this.name = "DnsWriteError";
+  }
+  code;
+  params;
+};
+var MESSAGES = {
+  token_invalid: () => "The DNS host didn't accept that token",
+  zone_read_missing: () => "That token can't read your domains",
+  dns_edit_missing: () => "That token can't change DNS records",
+  zone_not_found: (p) => `No zone holds ${p.hostname ?? "that name"}`,
+  conflict: (p) => `${p.hostname ?? "That name"} already has a record (type ${p.type ?? "?"})`,
+  unavailable: () => "Couldn't reach the DNS host"
+};
+
+// src/writers/cloudflare.ts
+var API = "https://api.cloudflare.com/client/v4";
+var TIMEOUT_MS = 1e4;
+var MAX_BODY_BYTES = 256 * 1024;
+var TOKEN_CODES = /* @__PURE__ */ new Set([1e3, 6003, 6111, 1e4]);
+var CONFLICT_CODES = /* @__PURE__ */ new Set([81053, 81054, 81057]);
+var ID = /^[A-Za-z0-9]{1,64}$/;
+var RECORD_TYPE = /^[A-Z0-9]{1,12}$/;
+function readEnvelope(json) {
+  if (!isObject(json) || typeof json.success !== "boolean") return null;
+  const codes = [];
+  if (Array.isArray(json.errors)) {
+    for (const error of json.errors) {
+      if (!isObject(error)) return null;
+      if (typeof error.code === "number") codes.push(error.code);
+      if (Array.isArray(error.error_chain)) {
+        for (const link of error.error_chain)
+          if (isObject(link) && typeof link.code === "number") codes.push(link.code);
+      }
+    }
+  }
+  return { success: json.success, codes, result: json.result };
+}
+async function call(doFetch, token, path, send) {
+  const res = await fetchBounded(
+    doFetch,
+    `${API}${path}`,
+    {
+      method: send?.method ?? "GET",
+      headers: {
+        Authorization: `Bearer ${token}`,
+        Accept: "application/json",
+        ...send ? { "Content-Type": "application/json" } : {}
+      },
+      body: send ? JSON.stringify(send.body) : void 0
+    },
+    { timeoutMs: TIMEOUT_MS, maxBytes: MAX_BODY_BYTES }
+  );
+  if (!res) return { status: 0, body: null };
+  let json = null;
+  try {
+    json = JSON.parse(res.text);
+  } catch {
+  }
+  return { status: res.status, body: readEnvelope(json) };
+}
+function refusal(answer, stage, subject) {
+  const codes = answer.body?.codes ?? [];
+  const refusedToken = answer.status === 401 || codes.some((c) => TOKEN_CODES.has(c));
+  if (stage === "zones" && refusedToken) return new DnsWriteError("token_invalid");
+  if (codes.some((c) => CONFLICT_CODES.has(c)))
+    return new DnsWriteError("conflict", { ...subject });
+  if (answer.status === 403 || refusedToken) {
+    if (stage === "zones") return new DnsWriteError("zone_read_missing");
+    return new DnsWriteError("dns_edit_missing");
+  }
+  return new DnsWriteError("unavailable");
+}
+function resultOf(answer, stage, subject) {
+  const ok = answer.status >= 200 && answer.status < 300 && answer.body?.success === true;
+  if (!ok) throw refusal(answer, stage, subject);
+  return answer.body?.result;
+}
+function zonesOf(result) {
+  if (!Array.isArray(result)) throw new DnsWriteError("unavailable");
+  return result.map((row) => {
+    if (!isObject(row) || typeof row.id !== "string" || typeof row.name !== "string")
+      throw new DnsWriteError("unavailable");
+    if (!ID.test(row.id)) throw new DnsWriteError("unavailable");
+    return { id: row.id, name: row.name };
+  });
+}
+function recordsOf(result) {
+  if (!Array.isArray(result)) throw new DnsWriteError("unavailable");
+  return result.map((row) => {
+    if (!isObject(row) || typeof row.id !== "string" || typeof row.type !== "string" || typeof row.content !== "string" || !ID.test(row.id) || !RECORD_TYPE.test(row.type))
+      throw new DnsWriteError("unavailable");
+    return {
+      id: row.id,
+      type: row.type,
+      content: row.content,
+      proxied: typeof row.proxied === "boolean" ? row.proxied : void 0
+    };
+  });
+}
+function zoneCandidates(hostname) {
+  const labels = hostname.split(".");
+  const names = [];
+  for (let start = 0; start < labels.length - 1; start++) names.push(labels.slice(start).join("."));
+  return names;
+}
+var unquoted = (content) => content.replace(/"\s+"/g, "").replace(/^"|"$/g, "");
+var sameValue = (record, existing) => record.type === "CNAME" ? normalizeDnsName(existing.content) === normalizeDnsName(record.value) : unquoted(existing.content) === record.value;
+var isSpf = (text) => /^v=spf1(?:\s|$)/i.test(unquoted(text).trim());
+function blocks(record, existing) {
+  if (record.type === "CNAME" || existing.type === "CNAME") return true;
+  return existing.type === "TXT" && isSpf(record.value) && isSpf(existing.content);
+}
+var cloudflare = {
+  host: "cloudflare",
+  /** Add the record (DNS only) to the Cloudflare zone that holds its name. An identical record
+   *  is left as it is; the same CNAME behind the proxy gets the proxy turned off. */
+  async addRecord({ token, record, comment, fetch: doFetch = fetch }) {
+    const hostname = normalizeDnsName(record.name);
+    const subject = { hostname, type: record.type };
+    let zoneId;
+    for (const candidate of zoneCandidates(hostname)) {
+      const query = new URLSearchParams({ name: candidate });
+      const zones = zonesOf(
+        resultOf(await call(doFetch, token, `/zones?${query}`), "zones", subject)
+      );
+      zoneId = zones.find((z) => normalizeDnsName(z.name) === candidate)?.id;
+      if (zoneId) break;
+    }
+    if (!zoneId) throw new DnsWriteError("zone_not_found", { hostname });
+    const existing = recordsOf(
+      resultOf(
+        await call(
+          doFetch,
+          token,
+          `/zones/${zoneId}/dns_records?${new URLSearchParams({ name: hostname })}`
+        ),
+        "records",
+        subject
+      )
+    );
+    const ours = existing.find((r) => r.type === record.type && sameValue(record, r));
+    if (ours) {
+      if (record.type !== "CNAME" || ours.proxied !== true) return "unchanged";
+      resultOf(
+        await call(doFetch, token, `/zones/${zoneId}/dns_records/${ours.id}`, {
+          method: "PATCH",
+          body: { proxied: false }
+        }),
+        "records",
+        subject
+      );
+      return "unproxied";
+    }
+    const blocker = existing.find((r) => blocks(record, r));
+    if (blocker) throw new DnsWriteError("conflict", { hostname, type: blocker.type });
+    resultOf(
+      await call(doFetch, token, `/zones/${zoneId}/dns_records`, {
+        method: "POST",
+        body: {
+          type: record.type,
+          name: hostname,
+          content: record.value,
+          // A proxied record hides the CNAME our checker reads.
+          ...record.type === "CNAME" ? { proxied: false } : {},
+          // 1 is Cloudflare's "automatic".
+          ttl: 1,
+          ...comment ? { comment } : {}
+        }
+      }),
+      "records",
+      subject
+    );
+    return "created";
+  }
+};
+
+// src/writers/index.ts
+var writers = { cloudflare };
+
+export {
+  fetchBounded,
+  isObject,
+  DnsWriteError,
+  cloudflare,
+  writers
+};

package/dist/chunk-P2O7INDB.js

@@ -0,0 +1,8 @@
+// src/dns-name.ts
+function normalizeDnsName(name) {
+  return name.trim().toLowerCase().replace(/\.$/, "");
+}
+
+export {
+  normalizeDnsName
+};

package/dist/hosts-B0_V4Ned.d.cts

@@ -0,0 +1,106 @@
+/**
+ * The DNS hosts we know steps for. A closed list. Order is the order a picker shows them and a
+ * detection lists them in.
+ *
+ * `cpanel` and `namecheap-hosting` both hand the person cPanel's Zone Editor. `hostinger` and
+ * `cpanel` have no name server pattern, so DNS alone never names them: a person picks them by
+ * hand.
+ */
+declare const DNS_HOST_IDS: readonly ["cloudflare", "godaddy", "namecheap", "namecheap-hosting", "squarespace", "route53", "google-cloud-dns", "azure-dns", "ionos", "hostinger", "porkbun", "name-com", "dynadot", "namesilo", "gandi", "ovhcloud", "digitalocean", "hetzner", "vercel", "netlify", "wix", "wordpress-com", "cpanel", "bluehost", "hostgator", "hostgator-br", "siteground", "registro-br", "locaweb", "kinghost", "uol-host", "umbler", "dnsimple"];
+type DnsHostId = (typeof DNS_HOST_IDS)[number];
+/** The labels on the form of one record type. */
+interface DnsFields {
+    /** The box that takes the record's name. */
+    name: string | null;
+    /** The box that takes its value: a CNAME's target, or a TXT's text. */
+    value: string | null;
+}
+/**
+ * What goes wrong at a host, each with a sentence of its own in the app.
+ *
+ * - `proxyOff`: a record is proxied by default and the proxy hides it (Cloudflare);
+ * - `trailingDot`: without a dot at the end, the host adds the zone to a CNAME's target
+ *   (OVHcloud, Hetzner, DigitalOcean);
+ * - `quotedTxt`: the host wants straight quotes around a TXT value (Route 53, Hetzner);
+ * - `secondSave`: adding the record is not saving it (KingHost);
+ * - `advancedMode`: the basic mode can't add the record (Registro.br);
+ * - `oneSpf`: the host may already hold an SPF record, and a domain may have only one;
+ * - `shortName`: the name box takes only the part before the zone, and the host adds the rest.
+ *
+ * `trailingDot` and `quotedTxt` also change the value we hand over (`records.ts`).
+ */
+type DnsTrap = {
+    kind: "proxyOff";
+    field: string;
+    value: string;
+} | {
+    kind: "trailingDot";
+} | {
+    kind: "quotedTxt";
+} | {
+    kind: "secondSave";
+    button: string;
+} | {
+    kind: "advancedMode";
+    mode: string;
+} | {
+    kind: "oneSpf";
+} | {
+    kind: "shortName";
+};
+type DnsTrapKind = DnsTrap["kind"];
+interface DnsHost {
+    /** The brand, as the company writes it. */
+    name: string;
+    /** The host's name servers, as patterns over a lowercase name with no trailing dot. A set
+     *  of names belongs to this host only when every name matches one of them. Empty: no
+     *  pattern we may trust, so the host is reached by the picker alone. */
+    ns: readonly RegExp[];
+    /** The host's page for a zone's records, only where its own docs link one. */
+    link: string | null;
+    /** The menu, tab or button that opens the zone's records. */
+    open: string | null;
+    /** The button that starts a new record. */
+    add: string | null;
+    /** The button that saves it. */
+    save: string | null;
+    cname: DnsFields;
+    txt: DnsFields;
+    /** How the host writes the zone's own name in the name box: `"@"`, empty, or `"."`. `null`
+     *  when no page of the host says. */
+    root: "@" | "" | "." | null;
+    traps: readonly DnsTrap[];
+}
+declare const DNS_HOSTS: Record<DnsHostId, DnsHost>;
+/** The first trap of a kind a host has. */
+declare function trapOf<K extends DnsTrapKind>(host: DnsHost, kind: K): Extract<DnsTrap, {
+    kind: K;
+}> | undefined;
+/**
+ * The hosts a zone's name servers point at. A host fits when every name matches one of its
+ * patterns, so a set that mixes two hosts, or holds one name nobody claims, fits none. Names that
+ * several hosts share answer with all of them, in `DNS_HOST_IDS` order: the app shows the
+ * choice and never guesses. An empty list is a host we don't know.
+ */
+declare function detectDnsHosts(nameservers: readonly string[]): DnsHostId[];
+/** The zone whose name servers answered: the nearest name at or above the hostname that has NS
+ *  records of its own. Records are added in this zone, named relative to it. */
+interface DnsZone {
+    zone: string;
+    /** The zone's name servers, lowercase, without the trailing dot, sorted. */
+    nameservers: string[];
+}
+/**
+ * What we read from DNS about where a domain's records are edited. `hosts` says what the names
+ * mean:
+ * - one id: a host we know;
+ * - several: the names fit more than one (Netlify and older Squarespace zones share NS1's
+ *   names, Google Cloud DNS and Squarespace domains moved from Google Domains share Google's),
+ *   so we do not guess;
+ * - none: names no host we know uses, or a mix of hosts. Show the names and ask.
+ */
+interface DnsHostReading extends DnsZone {
+    hosts: DnsHostId[];
+}
+
+export { type DnsHostId as D, DNS_HOSTS as a, DNS_HOST_IDS as b, type DnsFields as c, type DnsHost as d, type DnsHostReading as e, type DnsTrap as f, type DnsTrapKind as g, type DnsZone as h, detectDnsHosts as i, trapOf as t };

package/dist/hosts-B0_V4Ned.d.ts

@@ -0,0 +1,106 @@
+/**
+ * The DNS hosts we know steps for. A closed list. Order is the order a picker shows them and a
+ * detection lists them in.
+ *
+ * `cpanel` and `namecheap-hosting` both hand the person cPanel's Zone Editor. `hostinger` and
+ * `cpanel` have no name server pattern, so DNS alone never names them: a person picks them by
+ * hand.
+ */
+declare const DNS_HOST_IDS: readonly ["cloudflare", "godaddy", "namecheap", "namecheap-hosting", "squarespace", "route53", "google-cloud-dns", "azure-dns", "ionos", "hostinger", "porkbun", "name-com", "dynadot", "namesilo", "gandi", "ovhcloud", "digitalocean", "hetzner", "vercel", "netlify", "wix", "wordpress-com", "cpanel", "bluehost", "hostgator", "hostgator-br", "siteground", "registro-br", "locaweb", "kinghost", "uol-host", "umbler", "dnsimple"];
+type DnsHostId = (typeof DNS_HOST_IDS)[number];
+/** The labels on the form of one record type. */
+interface DnsFields {
+    /** The box that takes the record's name. */
+    name: string | null;
+    /** The box that takes its value: a CNAME's target, or a TXT's text. */
+    value: string | null;
+}
+/**
+ * What goes wrong at a host, each with a sentence of its own in the app.
+ *
+ * - `proxyOff`: a record is proxied by default and the proxy hides it (Cloudflare);
+ * - `trailingDot`: without a dot at the end, the host adds the zone to a CNAME's target
+ *   (OVHcloud, Hetzner, DigitalOcean);
+ * - `quotedTxt`: the host wants straight quotes around a TXT value (Route 53, Hetzner);
+ * - `secondSave`: adding the record is not saving it (KingHost);
+ * - `advancedMode`: the basic mode can't add the record (Registro.br);
+ * - `oneSpf`: the host may already hold an SPF record, and a domain may have only one;
+ * - `shortName`: the name box takes only the part before the zone, and the host adds the rest.
+ *
+ * `trailingDot` and `quotedTxt` also change the value we hand over (`records.ts`).
+ */
+type DnsTrap = {
+    kind: "proxyOff";
+    field: string;
+    value: string;
+} | {
+    kind: "trailingDot";
+} | {
+    kind: "quotedTxt";
+} | {
+    kind: "secondSave";
+    button: string;
+} | {
+    kind: "advancedMode";
+    mode: string;
+} | {
+    kind: "oneSpf";
+} | {
+    kind: "shortName";
+};
+type DnsTrapKind = DnsTrap["kind"];
+interface DnsHost {
+    /** The brand, as the company writes it. */
+    name: string;
+    /** The host's name servers, as patterns over a lowercase name with no trailing dot. A set
+     *  of names belongs to this host only when every name matches one of them. Empty: no
+     *  pattern we may trust, so the host is reached by the picker alone. */
+    ns: readonly RegExp[];
+    /** The host's page for a zone's records, only where its own docs link one. */
+    link: string | null;
+    /** The menu, tab or button that opens the zone's records. */
+    open: string | null;
+    /** The button that starts a new record. */
+    add: string | null;
+    /** The button that saves it. */
+    save: string | null;
+    cname: DnsFields;
+    txt: DnsFields;
+    /** How the host writes the zone's own name in the name box: `"@"`, empty, or `"."`. `null`
+     *  when no page of the host says. */
+    root: "@" | "" | "." | null;
+    traps: readonly DnsTrap[];
+}
+declare const DNS_HOSTS: Record<DnsHostId, DnsHost>;
+/** The first trap of a kind a host has. */
+declare function trapOf<K extends DnsTrapKind>(host: DnsHost, kind: K): Extract<DnsTrap, {
+    kind: K;
+}> | undefined;
+/**
+ * The hosts a zone's name servers point at. A host fits when every name matches one of its
+ * patterns, so a set that mixes two hosts, or holds one name nobody claims, fits none. Names that
+ * several hosts share answer with all of them, in `DNS_HOST_IDS` order: the app shows the
+ * choice and never guesses. An empty list is a host we don't know.
+ */
+declare function detectDnsHosts(nameservers: readonly string[]): DnsHostId[];
+/** The zone whose name servers answered: the nearest name at or above the hostname that has NS
+ *  records of its own. Records are added in this zone, named relative to it. */
+interface DnsZone {
+    zone: string;
+    /** The zone's name servers, lowercase, without the trailing dot, sorted. */
+    nameservers: string[];
+}
+/**
+ * What we read from DNS about where a domain's records are edited. `hosts` says what the names
+ * mean:
+ * - one id: a host we know;
+ * - several: the names fit more than one (Netlify and older Squarespace zones share NS1's
+ *   names, Google Cloud DNS and Squarespace domains moved from Google Domains share Google's),
+ *   so we do not guess;
+ * - none: names no host we know uses, or a mix of hosts. Show the names and ask.
+ */
+interface DnsHostReading extends DnsZone {
+    hosts: DnsHostId[];
+}
+
+export { type DnsHostId as D, DNS_HOSTS as a, DNS_HOST_IDS as b, type DnsFields as c, type DnsHost as d, type DnsHostReading as e, type DnsTrap as f, type DnsTrapKind as g, type DnsZone as h, detectDnsHosts as i, trapOf as t };