@gusnips/one-click-dns 0.0.0-stage → 0.1.0

package/dist/server/index.cjs

@@ -0,0 +1,1020 @@
+"use strict";
+var __defProp = Object.defineProperty;
+var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
+var __getOwnPropNames = Object.getOwnPropertyNames;
+var __hasOwnProp = Object.prototype.hasOwnProperty;
+var __export = (target, all) => {
+  for (var name in all)
+    __defProp(target, name, { get: all[name], enumerable: true });
+};
+var __copyProps = (to, from, except, desc) => {
+  if (from && typeof from === "object" || typeof from === "function") {
+    for (let key of __getOwnPropNames(from))
+      if (!__hasOwnProp.call(to, key) && key !== except)
+        __defProp(to, key, { get: () => from[key], enumerable: !(desc = __getOwnPropDesc(from, key)) || desc.enumerable });
+  }
+  return to;
+};
+var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: true }), mod);
+
+// src/server/index.ts
+var server_exports = {};
+__export(server_exports, {
+  CONNECT_PROVIDERS: () => CONNECT_PROVIDERS,
+  discoverConnect: () => discoverConnect,
+  dnsHostOf: () => dnsHostOf,
+  planConnection: () => planConnection,
+  readDnsZone: () => readDnsZone,
+  signedApplyUrl: () => signedApplyUrl,
+  systemDnsLookups: () => systemDnsLookups,
+  systemResolver: () => systemResolver
+});
+module.exports = __toCommonJS(server_exports);
+
+// src/server/dns.ts
+var import_promises = require("dns/promises");
+var ABSENT_CODES = /* @__PURE__ */ new Set(["ENOTFOUND", "ENODATA"]);
+var errorCode = (error) => typeof error === "object" && error !== null && "code" in error ? String(error.code) : "";
+function systemResolver(timeoutMs) {
+  const resolver = new import_promises.Resolver({ timeout: timeoutMs, tries: 1 });
+  return async (question) => {
+    let timer;
+    try {
+      return await Promise.race([
+        question(resolver),
+        new Promise((_, reject) => {
+          timer = setTimeout(() => {
+            reject(new Error("DNS lookup timed out"));
+          }, timeoutMs);
+        })
+      ]);
+    } catch (error) {
+      return ABSENT_CODES.has(errorCode(error)) ? "absent" : "failed";
+    } finally {
+      clearTimeout(timer);
+    }
+  };
+}
+function systemDnsLookups(timeoutMs) {
+  const ask2 = systemResolver(timeoutMs);
+  return {
+    async txt(name) {
+      const answer = await ask2((resolver) => resolver.resolveTxt(name));
+      return typeof answer === "string" ? answer : { txts: answer.map((parts) => parts.join("")) };
+    },
+    async cname(name) {
+      const answer = await ask2((resolver) => resolver.resolveCname(name));
+      if (typeof answer === "string") return answer;
+      const first = answer[0];
+      return first ? { name: first } : "absent";
+    },
+    async ns(name) {
+      const answer = await ask2((resolver) => resolver.resolveNs(name));
+      return typeof answer === "string" ? answer : { names: answer };
+    }
+  };
+}
+
+// src/dns-name.ts
+function normalizeDnsName(name) {
+  return name.trim().toLowerCase().replace(/\.$/, "");
+}
+
+// src/hosts.ts
+var DNS_HOST_IDS = [
+  "cloudflare",
+  "godaddy",
+  "namecheap",
+  "namecheap-hosting",
+  "squarespace",
+  "route53",
+  "google-cloud-dns",
+  "azure-dns",
+  "ionos",
+  "hostinger",
+  "porkbun",
+  "name-com",
+  "dynadot",
+  "namesilo",
+  "gandi",
+  "ovhcloud",
+  "digitalocean",
+  "hetzner",
+  "vercel",
+  "netlify",
+  "wix",
+  "wordpress-com",
+  "cpanel",
+  "bluehost",
+  "hostgator",
+  "hostgator-br",
+  "siteground",
+  "registro-br",
+  "locaweb",
+  "kinghost",
+  "uol-host",
+  "umbler",
+  "dnsimple"
+];
+var NO_FIELDS = { name: null, value: null };
+var SHORT = { kind: "shortName" };
+var TRAILING_DOT = { kind: "trailingDot" };
+var QUOTED_TXT = { kind: "quotedTxt" };
+var CPANEL_EDITOR = {
+  link: null,
+  open: "Zone Editor",
+  add: "Add Record",
+  save: "Save Record",
+  cname: { name: "Name", value: "Record" },
+  txt: { name: "Name", value: "Record" },
+  root: null,
+  traps: []
+};
+var DNS_HOSTS = {
+  cloudflare: {
+    name: "Cloudflare",
+    // Documented: <name>.ns.cloudflare.com, and <color>.foundationdns.{com,net,org}.
+    ns: [/^[a-z0-9-]+\.ns\.cloudflare\.com$/, /^[a-z0-9-]+\.foundationdns\.(com|net|org)$/],
+    link: "https://dash.cloudflare.com/?to=/:account/:zone/dns/records",
+    open: "DNS Records",
+    add: "Add record",
+    save: "Save",
+    cname: { name: "Name", value: "Target" },
+    // The dashboard's label for a TXT value is not on a docs page.
+    txt: { name: "Name", value: null },
+    root: "@",
+    traps: [{ kind: "proxyOff", field: "Proxy status", value: "DNS only" }, SHORT]
+  },
+  godaddy: {
+    name: "GoDaddy",
+    // Observed: ns<NN>.domaincontrol.com (GoDaddy's docs show only ns1).
+    ns: [/^ns\d{1,2}\.domaincontrol\.com$/],
+    link: null,
+    open: "DNS",
+    add: "Add New Record",
+    save: "Save",
+    cname: { name: "Name", value: "Value" },
+    txt: { name: "Name", value: "Value" },
+    root: "@",
+    traps: [SHORT]
+  },
+  namecheap: {
+    name: "Namecheap",
+    // Documented: dns1/2.registrar-servers.com (BasicDNS), pdns1/2 (PremiumDNS),
+    // freedns1-5 (FreeDNS).
+    ns: [/^(dns|pdns|freedns)\d\.registrar-servers\.com$/],
+    link: null,
+    open: "Advanced DNS",
+    add: "Add New Record",
+    save: "Save All Changes",
+    cname: { name: "Host", value: "Value" },
+    txt: { name: "Host", value: "Value" },
+    root: "@",
+    traps: [SHORT]
+  },
+  "namecheap-hosting": {
+    name: "Namecheap hosting",
+    // Documented: dns1/2.namecheaphosting.com. The records live in cPanel, not Advanced DNS.
+    ns: [/^dns\d\.namecheaphosting\.com$/],
+    ...CPANEL_EDITOR
+  },
+  squarespace: {
+    name: "Squarespace",
+    ns: [
+      // Documented: Google Cloud DNS nameservers "ending in squarespacedns.com".
+      /^[a-z0-9-]+\.squarespacedns\.com$/,
+      // Observed, listed so that these names read as ambiguous (domains moved from Google
+      // Domains sit on Google's names; older Squarespace domains on NS1's).
+      /^ns-cloud-[a-z]\d\.googledomains\.com$/,
+      /^dns\d\.p\d{2}\.nsone\.net$/
+    ],
+    link: null,
+    open: "DNS Settings",
+    add: "Add record",
+    save: "Save",
+    cname: { name: "Name", value: "Data" },
+    txt: { name: "Name", value: "Text" },
+    root: "@",
+    traps: [SHORT]
+  },
+  route53: {
+    name: "Amazon Route 53",
+    // Documented: ns-<n>.awsdns-<nn>.{com,net,org,co.uk}.
+    ns: [/^ns-\d+\.awsdns-\d+\.(com|net|org|co\.uk)$/],
+    link: "https://console.aws.amazon.com/route53/v2/hostedzones",
+    open: "Hosted zones",
+    add: "Create record",
+    save: "Create records",
+    cname: { name: "Record name", value: "Value" },
+    txt: { name: "Record name", value: "Value" },
+    // "don't enter a value (for example, an @ symbol) in the Name field".
+    root: "",
+    traps: [SHORT, QUOTED_TXT]
+  },
+  "google-cloud-dns": {
+    name: "Google Cloud DNS",
+    // Documented: ns-cloud-<a-d><1-4>.googledomains.com. Squarespace domains moved from
+    // Google Domains use the same names, so a set of them is ambiguous.
+    ns: [/^ns-cloud-[a-z]\d\.googledomains\.com$/],
+    link: null,
+    open: null,
+    add: "Add standard",
+    save: "Create",
+    cname: { name: "DNS name", value: null },
+    txt: { name: "DNS name", value: null },
+    // "To create a resource record at the domain apex, leave the DNS name field blank."
+    root: "",
+    traps: [SHORT]
+  },
+  "azure-dns": {
+    name: "Azure DNS",
+    // Documented: ns<1-4>-<nn>.azure-dns.{com,net,org,info}.
+    ns: [/^ns\d-\d+\.azure-dns\.(com|net|org|info)$/],
+    link: null,
+    open: "Record sets",
+    add: "Add",
+    save: "Add",
+    cname: { name: "Name", value: null },
+    txt: { name: "Name", value: null },
+    root: "@",
+    traps: [SHORT]
+  },
+  ionos: {
+    name: "IONOS",
+    // Documented: ns1<ZZZ>.ui-dns.{de,biz,org,com}, ZZZ from 016 to 126.
+    ns: [/^ns1\d{3}\.ui-dns\.(de|biz|org|com)$/],
+    link: null,
+    open: "DNS",
+    add: "Add Record",
+    save: "Save",
+    // The two articles spell the name box differently.
+    cname: { name: "Hostname", value: "Point to" },
+    txt: { name: "Host name", value: "Value" },
+    root: "@",
+    traps: [SHORT]
+  },
+  hostinger: {
+    name: "Hostinger",
+    // No pattern: ns1/2.dns-parking.com is a search snippet, never confirmed on a page of
+    // theirs. The picker reaches Hostinger.
+    ns: [],
+    link: null,
+    open: "DNS Zone Editor",
+    add: null,
+    save: "Add Record",
+    cname: { name: "Name", value: "Points to" },
+    txt: { name: "Name", value: "TXT value" },
+    root: "@",
+    traps: [SHORT, { kind: "oneSpf" }]
+  },
+  porkbun: {
+    name: "Porkbun",
+    // Documented: <city>.ns.porkbun.com.
+    ns: [/^[a-z]+\.ns\.porkbun\.com$/],
+    link: null,
+    open: "DNS",
+    add: "Add Record",
+    save: "Add",
+    cname: { name: "Host", value: "Answer" },
+    txt: { name: "Host", value: "Answer" },
+    // "If you're adding DNS records to your root domain, you will leave this field blank."
+    root: "",
+    traps: [SHORT]
+  },
+  "name-com": {
+    name: "Name.com",
+    // Observed: ns1<abc>.name.com to ns4<abc>.name.com.
+    ns: [/^ns[1-4][a-z]{3}\.name\.com$/],
+    link: null,
+    open: "Manage DNS Records",
+    add: null,
+    save: "Add Record",
+    cname: { name: "Host", value: "Answer" },
+    txt: { name: "Host", value: "Answer" },
+    root: null,
+    traps: [SHORT]
+  },
+  dynadot: {
+    name: "Dynadot",
+    // A Dynadot staff answer on its forum: ns1/2.dyna-ns.net.
+    ns: [/^ns\d\.dyna-ns\.net$/],
+    link: null,
+    open: "DNS Settings",
+    add: null,
+    save: "Save Settings",
+    cname: { name: "Subdomain Record", value: "IP Address or Target Host" },
+    txt: NO_FIELDS,
+    // The zone's own name goes in a separate "Domain Record" section, never as "@".
+    root: null,
+    traps: [SHORT]
+  },
+  namesilo: {
+    name: "NameSilo",
+    // Documented: ns1-3.dnsowl.com.
+    ns: [/^ns\d\.dnsowl\.com$/],
+    link: null,
+    open: null,
+    add: null,
+    save: "Submit",
+    cname: NO_FIELDS,
+    txt: NO_FIELDS,
+    // "You can leave the hostname blank ... If you do enter an "@", we will convert that".
+    root: "",
+    traps: []
+  },
+  gandi: {
+    name: "Gandi",
+    // Observed: ns-<n>-<a|b|c>.gandi.net.
+    ns: [/^ns-\d+-[abc]\.gandi\.net$/],
+    link: null,
+    open: "DNS Records",
+    add: "Add",
+    save: null,
+    cname: NO_FIELDS,
+    txt: NO_FIELDS,
+    root: null,
+    traps: [SHORT]
+  },
+  ovhcloud: {
+    name: "OVHcloud",
+    // Documented: (ns|dns)<nn or nnn>.ovh.net, and (ns|dns)200.anycast.me.
+    ns: [/^(ns|dns)\d{2,3}\.ovh\.net$/, /^(ns|dns)200\.anycast\.me$/],
+    link: null,
+    open: "DNS zone",
+    add: "Add an entry",
+    save: null,
+    cname: { name: "Subdomain", value: "Target" },
+    txt: { name: "Subdomain", value: "Target" },
+    root: null,
+    traps: [SHORT, TRAILING_DOT]
+  },
+  digitalocean: {
+    name: "DigitalOcean",
+    // Documented: ns1-3.digitalocean.com.
+    ns: [/^ns[1-3]\.digitalocean\.com$/],
+    link: null,
+    open: "Domains",
+    add: "Create a record",
+    save: "Create Record",
+    cname: { name: "Hostname", value: "Is an alias of" },
+    txt: { name: "Hostname", value: "TXT Value" },
+    root: "@",
+    traps: [SHORT, TRAILING_DOT]
+  },
+  hetzner: {
+    name: "Hetzner",
+    ns: [
+      // Documented: the primary, secondary (still used by older zones) and konsoleH names.
+      /^(hydrogen|oxygen|helium)\.ns\.hetzner\.(com|de)$/,
+      /^[a-z0-9]+\.first-ns\.de$/,
+      /^[a-z0-9]+\.second-ns\.(de|com)$/,
+      /^ns1\.your-server\.de$/
+    ],
+    link: null,
+    open: "DNS",
+    add: null,
+    save: "Add",
+    cname: { name: "Name", value: "Alias / Value" },
+    txt: { name: "Name", value: null },
+    root: "@",
+    traps: [SHORT, TRAILING_DOT, QUOTED_TXT]
+  },
+  vercel: {
+    name: "Vercel",
+    // Documented: ns1-4.vercel-dns.com (the "alternates" are not named).
+    ns: [/^ns[1-4]\.vercel-dns\.com$/],
+    link: "https://vercel.com/d?to=%2F%5Bteam%5D%2F%7E%2Fdomains",
+    open: "Domains",
+    add: null,
+    save: "Add",
+    cname: { name: "Name", value: "Value" },
+    txt: { name: "Name", value: "Value" },
+    // "Leave Name blank for the root domain."
+    root: "",
+    traps: [SHORT]
+  },
+  netlify: {
+    name: "Netlify",
+    // Documented: "a format similar to dns1.p01.nsone.net". NS1's names are shared with
+    // older Squarespace zones, so a set of them is ambiguous.
+    ns: [/^dns\d\.p\d{2}\.nsone\.net$/],
+    link: null,
+    open: "DNS",
+    add: "Add new record",
+    save: "Save",
+    cname: NO_FIELDS,
+    txt: NO_FIELDS,
+    root: null,
+    traps: []
+  },
+  wix: {
+    name: "Wix",
+    // Observed: ns<n>.wixdns.net. A domain "connected to Wix via pointing" keeps its old
+    // name servers, so it never matches here.
+    ns: [/^ns\d+\.wixdns\.net$/],
+    link: null,
+    open: "Manage DNS Records",
+    add: "Add Record",
+    save: "Save",
+    cname: { name: "Host Name", value: "Value" },
+    txt: { name: "Host Name", value: "Value" },
+    // "Leave this field blank if you were instructed to add an @ sign."
+    root: "",
+    traps: []
+  },
+  "wordpress-com": {
+    name: "WordPress.com",
+    // Documented: ns1-3.wordpress.com.
+    ns: [/^ns[1-3]\.wordpress\.com$/],
+    link: "https://wordpress.com/domains/",
+    open: "DNS records",
+    add: "Add record",
+    save: null,
+    cname: { name: "Name (host)", value: "Alias of (points to)" },
+    txt: { name: "Name", value: "Text" },
+    root: "@",
+    // The Name box takes the label or the whole name, and ignores quotes around a TXT value.
+    traps: []
+  },
+  cpanel: {
+    // Hosting companies run their own name servers, so there is no pattern: the picker
+    // reaches it.
+    name: "cPanel",
+    ns: [],
+    ...CPANEL_EDITOR
+  },
+  bluehost: {
+    name: "Bluehost",
+    // Documented: ns1/2.bluehost.com. Its help is behind a captcha and the menu path was
+    // read from a 2024 archive, so no label is quoted.
+    ns: [/^ns[12]\.bluehost\.com$/],
+    link: null,
+    open: null,
+    add: null,
+    save: null,
+    cname: NO_FIELDS,
+    txt: NO_FIELDS,
+    root: null,
+    traps: []
+  },
+  hostgator: {
+    name: "HostGator",
+    // Documented: hgns1/2.hostgator.com for new customers, ns<NNNN>.hostgator.com before
+    // November 2023.
+    ns: [/^hgns\d\.hostgator\.com$/, /^ns\d{4}\.hostgator\.com$/],
+    link: null,
+    open: "DNS",
+    add: "+ ADD RECORD",
+    save: "ADD",
+    cname: NO_FIELDS,
+    txt: NO_FIELDS,
+    root: null,
+    traps: []
+  },
+  "hostgator-br": {
+    name: "HostGator Brasil",
+    // Documented: dns3/4.hostgator.com.br for a registered domain with no plan yet. A plan's
+    // names come in its activation email and are not on a page.
+    ns: [/^dns[34]\.hostgator\.com\.br$/],
+    link: null,
+    open: "Editar Zona Avan\xE7ada de DNS",
+    add: "Adicionar registro",
+    save: "Adicionar",
+    // The value box's name changes with the type ("O nome é alterado conforme o Tipo").
+    cname: { name: "Nome", value: null },
+    txt: { name: "Nome", value: null },
+    root: null,
+    traps: []
+  },
+  siteground: {
+    name: "SiteGround",
+    // Documented: ns1/2.siteground.net.
+    ns: [/^ns[12]\.siteground\.net$/],
+    link: null,
+    open: "DNS Zone Editor",
+    add: null,
+    save: "Create",
+    cname: { name: "Name", value: null },
+    txt: { name: "Name", value: null },
+    root: null,
+    traps: [SHORT]
+  },
+  "registro-br": {
+    name: "Registro.br",
+    // Observed: a.auto.dns.br and b.auto.dns.br.
+    ns: [/^[ab]\.auto\.dns\.br$/],
+    link: null,
+    open: "CONFIGURAR ZONA DNS",
+    add: null,
+    save: null,
+    cname: NO_FIELDS,
+    txt: NO_FIELDS,
+    root: null,
+    traps: [{ kind: "advancedMode", mode: "Modo Avan\xE7ado" }]
+  },
+  locaweb: {
+    name: "Locaweb",
+    // Documented: ns1-3.locaweb.com.br.
+    ns: [/^ns[1-3]\.locaweb\.com\.br$/],
+    link: null,
+    open: "Editar zona DNS",
+    add: "Adicionar entrada",
+    save: null,
+    cname: { name: "Entrada", value: "Conte\xFAdo" },
+    txt: { name: "Entrada", value: "Conte\xFAdo" },
+    // "o campo Entrada é preenchido por padrão com apenas um ponto (.)".
+    root: ".",
+    traps: []
+  },
+  kinghost: {
+    name: "KingHost",
+    // Documented: dns1-6.kinghost.com.br.
+    ns: [/^dns[1-6]\.kinghost\.com\.br$/],
+    link: null,
+    open: "Gerenciar DNS",
+    add: "+ ADICIONAR DNS",
+    save: "ADICIONAR DNS",
+    // The form is a screenshot, so the case of "host" and "destino" is unconfirmed.
+    cname: NO_FIELDS,
+    txt: NO_FIELDS,
+    root: "@",
+    traps: [{ kind: "secondSave", button: "SALVAR ALTERA\xC7\xD5ES" }]
+  },
+  "uol-host": {
+    name: "UOL Host",
+    // Documented: ns1-3.dominios.uol.com.br.
+    ns: [/^ns[1-3]\.dominios\.uol\.com\.br$/],
+    link: null,
+    open: "Administrar DNS",
+    add: "Criar nova entrada",
+    save: "Salvar entrada",
+    cname: { name: "Entrada", value: "Destino" },
+    txt: { name: "Entrada", value: "Valor" },
+    root: "",
+    traps: []
+  },
+  umbler: {
+    name: "Umbler",
+    // Documented: ns<NNN>.umbler.{com,in,com.br,co.uk}.
+    ns: [/^ns\d{3}\.umbler\.(com|in|com\.br|co\.uk)$/],
+    link: null,
+    open: "Editor de DNS",
+    add: "Adicionar",
+    save: "Salvar",
+    cname: { name: "Nome", value: "Endere\xE7o" },
+    txt: { name: "Nome", value: "Dados" },
+    root: "@",
+    traps: [SHORT]
+  },
+  dnsimple: {
+    name: "DNSimple",
+    // Documented: ns1-4.dnsimple-edge.{com,net,io,org}, and the legacy ns1-4.dnsimple.com.
+    ns: [/^ns[1-4]\.dnsimple-edge\.(com|net|io|org)$/, /^ns[1-4]\.dnsimple\.com$/],
+    link: null,
+    open: "Record editor",
+    add: "Add record",
+    save: "Add Record",
+    cname: { name: "Name", value: "Content" },
+    txt: { name: "Name", value: "Content" },
+    root: "",
+    traps: [SHORT]
+  }
+};
+function detectDnsHosts(nameservers) {
+  const names = nameservers.map(normalizeDnsName).filter(Boolean);
+  if (!names.length) return [];
+  return DNS_HOST_IDS.filter(
+    (id) => names.every((name) => DNS_HOSTS[id].ns.some((pattern) => pattern.test(name)))
+  );
+}
+
+// src/server/zone.ts
+function dnsHostOf(zone) {
+  return { ...zone, hosts: detectDnsHosts(zone.nameservers) };
+}
+async function readDnsZone(lookups, hostname, budgetMs) {
+  let timer;
+  const outOfTime = new Promise((resolve) => {
+    timer = setTimeout(() => resolve(null), budgetMs);
+  });
+  try {
+    return await Promise.race([walk(lookups, hostname), outOfTime]);
+  } finally {
+    clearTimeout(timer);
+  }
+}
+async function walk(lookups, hostname) {
+  const labels = normalizeDnsName(hostname).split(".");
+  for (let start = 0; start < labels.length - 1; start++) {
+    const zone = labels.slice(start).join(".");
+    const answer = await lookups.ns(zone);
+    if (answer === "failed") return null;
+    if (answer === "absent" || !answer.names.length) continue;
+    const alias = await lookups.cname(zone);
+    if (alias === "failed") return null;
+    if (alias !== "absent") continue;
+    return { zone, nameservers: [...new Set(answer.names.map(normalizeDnsName))].sort() };
+  }
+  return null;
+}
+
+// src/server/connect/providers.ts
+var CONNECT_PROVIDERS = [
+  // `_domainconnect.colding.app` read 2026-10-29; settings answer `urlSyncUX`
+  // https://dash.cloudflare.com/domainconnect.
+  {
+    id: "cloudflare",
+    txt: "api.cloudflare.com/client/v4/dns/domainconnect",
+    api: "https://api.cloudflare.com/client/v4/dns/domainconnect",
+    syncHost: "dash.cloudflare.com"
+  },
+  // `_domainconnect.nextjs.org` read 2026-10-29: a CNAME to `_domainconnect.vercel-dns.com`, whose
+  // TXT is `domainconnect.vercel.com`. The settings name another address for the API.
+  {
+    id: "vercel",
+    txt: "domainconnect.vercel.com",
+    api: "https://vercel.com/api/domain-connect",
+    syncHost: "vercel.com"
+  },
+  // `_domainconnect.simply.com` read 2026-10-29.
+  {
+    id: "simply",
+    txt: "domainconnect.simply.com",
+    api: "https://domainconnect.simply.com",
+    syncHost: "domainconnect.simply.com"
+  },
+  // Settings read 2026-10-29 from domainconnect.api.godaddy.com (`urlSyncUX`
+  // https://dcc.godaddy.com/manage). The TXT value on a customer's zone is not read yet: if it
+  // differs, GoDaddy answers "not offered", which is the safe way to be wrong.
+  {
+    id: "godaddy",
+    txt: "domainconnect.api.godaddy.com",
+    api: "https://domainconnect.api.godaddy.com",
+    syncHost: "dcc.godaddy.com"
+  }
+];
+
+// src/bounded-fetch.ts
+var import_server = require("@gusnips/server");
+async function fetchBounded(doFetch, url, init, limits) {
+  try {
+    const res = await doFetch(url, {
+      ...init,
+      redirect: "manual",
+      signal: AbortSignal.timeout(limits.timeoutMs)
+    });
+    if (res.type === "opaqueredirect" || res.status >= 300 && res.status < 400) {
+      await res.body?.cancel().catch(() => void 0);
+      return { status: res.status || 302, text: "" };
+    }
+    const { bytes, truncated } = await (0, import_server.readBounded)(res.body, limits.maxBytes);
+    if (truncated) return null;
+    return { status: res.status, text: new TextDecoder().decode(bytes) };
+  } catch {
+    return null;
+  }
+}
+
+// src/guards.ts
+function isObject(value) {
+  return typeof value === "object" && value !== null;
+}
+
+// src/server/connect/discover.ts
+var MAX_ANSWER_BYTES = 64 * 1024;
+var NOT_OFFERED = { found: false, reason: "not_offered" };
+var UNANSWERED = { found: false, reason: "unanswered" };
+var ZONE = /^(?=.{1,253}$)(?:[a-z0-9](?:[a-z0-9-]{0,61}[a-z0-9])?\.)+[a-z0-9](?:[a-z0-9-]{0,61}[a-z0-9])?$/;
+var text = (value, max) => typeof value === "string" && value.length <= max ? value : void 0;
+function readSettings(body) {
+  if (!isObject(body)) return null;
+  const providerName = text(body.providerName, 100);
+  const urlAPI = text(body.urlAPI, 512);
+  if (!providerName || !urlAPI) return null;
+  return {
+    providerName,
+    providerDisplayName: text(body.providerDisplayName, 100),
+    urlSyncUX: text(body.urlSyncUX, 512),
+    urlAPI
+  };
+}
+var normalizeTxt = (value) => value.trim().replace(/^"+|"+$/g, "").trim().toLowerCase().replace(/\/+$/, "");
+function plainHttps(raw) {
+  try {
+    const url = new URL(raw);
+    const plain = url.protocol === "https:" && !url.username && !url.password && !url.port;
+    return plain ? url : null;
+  } catch {
+    return null;
+  }
+}
+var withoutTrailingSlash = (url) => `${url.origin}${url.pathname}`.replace(/\/+$/, "");
+var transient = (status) => status === 429 || status >= 500;
+async function discoverConnect(io, args) {
+  if (!ZONE.test(args.zone)) return NOT_OFFERED;
+  const deadline = Date.now() + args.budgetMs;
+  let timer;
+  const outOfTime = new Promise((resolve) => {
+    timer = setTimeout(() => resolve(UNANSWERED), args.budgetMs);
+  });
+  try {
+    return await Promise.race([ask(io, args, deadline), outOfTime]);
+  } catch {
+    return UNANSWERED;
+  } finally {
+    clearTimeout(timer);
+  }
+}
+async function ask(io, args, deadline) {
+  const { zone, providerId, serviceId, providers = CONNECT_PROVIDERS } = args;
+  const get = (url) => {
+    const left = deadline - Date.now();
+    if (left <= 0) return Promise.resolve(null);
+    return fetchBounded(
+      io.fetch ?? fetch,
+      url,
+      { method: "GET", headers: { Accept: "application/json" } },
+      { timeoutMs: left, maxBytes: MAX_ANSWER_BYTES }
+    );
+  };
+  const published = await io.txt(`_domainconnect.${zone}`);
+  if (published === "failed") return UNANSWERED;
+  if (published === "absent") return NOT_OFFERED;
+  const values = published.txts.map(normalizeTxt);
+  const provider = providers.find((entry) => values.includes(entry.txt));
+  if (!provider) return NOT_OFFERED;
+  const settings = await get(`https://${provider.txt}/v2/${zone}/settings`);
+  if (!settings) return UNANSWERED;
+  if (settings.status !== 200) return transient(settings.status) ? UNANSWERED : NOT_OFFERED;
+  let body;
+  try {
+    body = JSON.parse(settings.text);
+  } catch {
+    return NOT_OFFERED;
+  }
+  const parsed = readSettings(body);
+  if (!parsed) return NOT_OFFERED;
+  const api = plainHttps(parsed.urlAPI);
+  const sync = parsed.urlSyncUX ? plainHttps(parsed.urlSyncUX) : null;
+  if (!api || withoutTrailingSlash(api) !== provider.api) return NOT_OFFERED;
+  if (!sync || sync.hostname !== provider.syncHost || sync.search || sync.hash) return NOT_OFFERED;
+  const template = await get(
+    `${provider.api}/v2/domainTemplates/providers/${providerId}/services/${serviceId}`
+  );
+  if (!template) return UNANSWERED;
+  if (template.status !== 200) return transient(template.status) ? UNANSWERED : NOT_OFFERED;
+  return {
+    found: true,
+    id: provider.id,
+    provider: parsed.providerDisplayName?.trim() || parsed.providerName,
+    syncUrl: withoutTrailingSlash(sync)
+  };
+}
+
+// src/server/connect/sign.ts
+var import_node_crypto = require("crypto");
+var encode = (value) => encodeURIComponent(value).replace(/[!'()*]/g, (char) => `%${char.charCodeAt(0).toString(16).toUpperCase()}`).replace(/%20/g, "+");
+function signedApplyUrl(args) {
+  const query = Object.entries(args.params).sort(([a], [b]) => a < b ? -1 : a > b ? 1 : 0).map(([name, value]) => `${encode(name)}=${encode(value)}`).join("&");
+  const signature = (0, import_node_crypto.sign)(
+    "sha256",
+    Buffer.from(query, "utf8"),
+    (0, import_node_crypto.createPrivateKey)(args.privateKeyPem)
+  ).toString("base64");
+  const path = `/v2/domainTemplates/providers/${args.providerId}/services/${args.serviceId}/apply`;
+  return `${args.syncUrl}${path}?${query}&key=${args.keyId}&sig=${encode(signature)}`;
+}
+
+// src/writers/types.ts
+var DnsWriteError = class extends Error {
+  constructor(code, params = {}) {
+    super(MESSAGES[code](params));
+    this.code = code;
+    this.params = params;
+    this.name = "DnsWriteError";
+  }
+  code;
+  params;
+};
+var MESSAGES = {
+  token_invalid: () => "The DNS host didn't accept that token",
+  zone_read_missing: () => "That token can't read your domains",
+  dns_edit_missing: () => "That token can't change DNS records",
+  zone_not_found: (p) => `No zone holds ${p.hostname ?? "that name"}`,
+  conflict: (p) => `${p.hostname ?? "That name"} already has a record (type ${p.type ?? "?"})`,
+  unavailable: () => "Couldn't reach the DNS host"
+};
+
+// src/writers/cloudflare.ts
+var API = "https://api.cloudflare.com/client/v4";
+var TIMEOUT_MS = 1e4;
+var MAX_BODY_BYTES = 256 * 1024;
+var TOKEN_CODES = /* @__PURE__ */ new Set([1e3, 6003, 6111, 1e4]);
+var CONFLICT_CODES = /* @__PURE__ */ new Set([81053, 81054, 81057]);
+var ID = /^[A-Za-z0-9]{1,64}$/;
+var RECORD_TYPE = /^[A-Z0-9]{1,12}$/;
+function readEnvelope(json) {
+  if (!isObject(json) || typeof json.success !== "boolean") return null;
+  const codes = [];
+  if (Array.isArray(json.errors)) {
+    for (const error of json.errors) {
+      if (!isObject(error)) return null;
+      if (typeof error.code === "number") codes.push(error.code);
+      if (Array.isArray(error.error_chain)) {
+        for (const link of error.error_chain)
+          if (isObject(link) && typeof link.code === "number") codes.push(link.code);
+      }
+    }
+  }
+  return { success: json.success, codes, result: json.result };
+}
+async function call(doFetch, token, path, send) {
+  const res = await fetchBounded(
+    doFetch,
+    `${API}${path}`,
+    {
+      method: send?.method ?? "GET",
+      headers: {
+        Authorization: `Bearer ${token}`,
+        Accept: "application/json",
+        ...send ? { "Content-Type": "application/json" } : {}
+      },
+      body: send ? JSON.stringify(send.body) : void 0
+    },
+    { timeoutMs: TIMEOUT_MS, maxBytes: MAX_BODY_BYTES }
+  );
+  if (!res) return { status: 0, body: null };
+  let json = null;
+  try {
+    json = JSON.parse(res.text);
+  } catch {
+  }
+  return { status: res.status, body: readEnvelope(json) };
+}
+function refusal(answer, stage, subject) {
+  const codes = answer.body?.codes ?? [];
+  const refusedToken = answer.status === 401 || codes.some((c) => TOKEN_CODES.has(c));
+  if (stage === "zones" && refusedToken) return new DnsWriteError("token_invalid");
+  if (codes.some((c) => CONFLICT_CODES.has(c)))
+    return new DnsWriteError("conflict", { ...subject });
+  if (answer.status === 403 || refusedToken) {
+    if (stage === "zones") return new DnsWriteError("zone_read_missing");
+    return new DnsWriteError("dns_edit_missing");
+  }
+  return new DnsWriteError("unavailable");
+}
+function resultOf(answer, stage, subject) {
+  const ok = answer.status >= 200 && answer.status < 300 && answer.body?.success === true;
+  if (!ok) throw refusal(answer, stage, subject);
+  return answer.body?.result;
+}
+function zonesOf(result) {
+  if (!Array.isArray(result)) throw new DnsWriteError("unavailable");
+  return result.map((row) => {
+    if (!isObject(row) || typeof row.id !== "string" || typeof row.name !== "string")
+      throw new DnsWriteError("unavailable");
+    if (!ID.test(row.id)) throw new DnsWriteError("unavailable");
+    return { id: row.id, name: row.name };
+  });
+}
+function recordsOf(result) {
+  if (!Array.isArray(result)) throw new DnsWriteError("unavailable");
+  return result.map((row) => {
+    if (!isObject(row) || typeof row.id !== "string" || typeof row.type !== "string" || typeof row.content !== "string" || !ID.test(row.id) || !RECORD_TYPE.test(row.type))
+      throw new DnsWriteError("unavailable");
+    return {
+      id: row.id,
+      type: row.type,
+      content: row.content,
+      proxied: typeof row.proxied === "boolean" ? row.proxied : void 0
+    };
+  });
+}
+function zoneCandidates(hostname) {
+  const labels = hostname.split(".");
+  const names = [];
+  for (let start = 0; start < labels.length - 1; start++) names.push(labels.slice(start).join("."));
+  return names;
+}
+var unquoted = (content) => content.replace(/"\s+"/g, "").replace(/^"|"$/g, "");
+var sameValue = (record, existing) => record.type === "CNAME" ? normalizeDnsName(existing.content) === normalizeDnsName(record.value) : unquoted(existing.content) === record.value;
+var isSpf = (text2) => /^v=spf1(?:\s|$)/i.test(unquoted(text2).trim());
+function blocks(record, existing) {
+  if (record.type === "CNAME" || existing.type === "CNAME") return true;
+  return existing.type === "TXT" && isSpf(record.value) && isSpf(existing.content);
+}
+var cloudflare = {
+  host: "cloudflare",
+  /** Add the record (DNS only) to the Cloudflare zone that holds its name. An identical record
+   *  is left as it is; the same CNAME behind the proxy gets the proxy turned off. */
+  async addRecord({ token, record, comment, fetch: doFetch = fetch }) {
+    const hostname = normalizeDnsName(record.name);
+    const subject = { hostname, type: record.type };
+    let zoneId;
+    for (const candidate of zoneCandidates(hostname)) {
+      const query = new URLSearchParams({ name: candidate });
+      const zones = zonesOf(
+        resultOf(await call(doFetch, token, `/zones?${query}`), "zones", subject)
+      );
+      zoneId = zones.find((z) => normalizeDnsName(z.name) === candidate)?.id;
+      if (zoneId) break;
+    }
+    if (!zoneId) throw new DnsWriteError("zone_not_found", { hostname });
+    const existing = recordsOf(
+      resultOf(
+        await call(
+          doFetch,
+          token,
+          `/zones/${zoneId}/dns_records?${new URLSearchParams({ name: hostname })}`
+        ),
+        "records",
+        subject
+      )
+    );
+    const ours = existing.find((r) => r.type === record.type && sameValue(record, r));
+    if (ours) {
+      if (record.type !== "CNAME" || ours.proxied !== true) return "unchanged";
+      resultOf(
+        await call(doFetch, token, `/zones/${zoneId}/dns_records/${ours.id}`, {
+          method: "PATCH",
+          body: { proxied: false }
+        }),
+        "records",
+        subject
+      );
+      return "unproxied";
+    }
+    const blocker = existing.find((r) => blocks(record, r));
+    if (blocker) throw new DnsWriteError("conflict", { hostname, type: blocker.type });
+    resultOf(
+      await call(doFetch, token, `/zones/${zoneId}/dns_records`, {
+        method: "POST",
+        body: {
+          type: record.type,
+          name: hostname,
+          content: record.value,
+          // A proxied record hides the CNAME our checker reads.
+          ...record.type === "CNAME" ? { proxied: false } : {},
+          // 1 is Cloudflare's "automatic".
+          ttl: 1,
+          ...comment ? { comment } : {}
+        }
+      }),
+      "records",
+      subject
+    );
+    return "created";
+  }
+};
+
+// src/writers/index.ts
+var writers = { cloudflare };
+
+// src/server/plan.ts
+async function planConnection(input, io) {
+  const budgetMs = input.budgetMs ?? 3e3;
+  const zone = await readDnsZone(io, input.hostname, budgetMs);
+  if (!zone)
+    return { reading: null, methods: [{ kind: "manual", hosts: [] }], connectUnanswered: false };
+  const reading = dnsHostOf(zone);
+  const methods = [];
+  let connectUnanswered = false;
+  const { connect } = input;
+  if (connect) {
+    const found = await discoverConnect(io, {
+      zone: zone.zone,
+      providerId: connect.providerId,
+      serviceId: connect.serviceId,
+      budgetMs
+    });
+    if (found.found)
+      methods.push({
+        kind: "domain-connect",
+        provider: found.provider,
+        url: signedApplyUrl({
+          providerId: connect.providerId,
+          keyId: connect.keyId,
+          serviceId: connect.serviceId,
+          privateKeyPem: connect.privateKeyPem,
+          syncUrl: found.syncUrl,
+          params: connect.params(zone.zone)
+        })
+      });
+    else connectUnanswered = found.reason === "unanswered";
+  }
+  const [only, ...others] = reading.hosts;
+  if (only && !others.length && writers[only]) methods.push({ kind: "api-token", host: only });
+  methods.push({ kind: "manual", hosts: reading.hosts });
+  return { reading, methods, connectUnanswered };
+}
+// Annotate the CommonJS export names for ESM import in node:
+0 && (module.exports = {
+  CONNECT_PROVIDERS,
+  discoverConnect,
+  dnsHostOf,
+  planConnection,
+  readDnsZone,
+  signedApplyUrl,
+  systemDnsLookups,
+  systemResolver
+});