@gusnips/one-click-dns 0.0.0-stage → 0.1.0

package/dist/writers/index.cjs

@@ -0,0 +1,249 @@
+"use strict";
+var __defProp = Object.defineProperty;
+var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
+var __getOwnPropNames = Object.getOwnPropertyNames;
+var __hasOwnProp = Object.prototype.hasOwnProperty;
+var __export = (target, all) => {
+  for (var name in all)
+    __defProp(target, name, { get: all[name], enumerable: true });
+};
+var __copyProps = (to, from, except, desc) => {
+  if (from && typeof from === "object" || typeof from === "function") {
+    for (let key of __getOwnPropNames(from))
+      if (!__hasOwnProp.call(to, key) && key !== except)
+        __defProp(to, key, { get: () => from[key], enumerable: !(desc = __getOwnPropDesc(from, key)) || desc.enumerable });
+  }
+  return to;
+};
+var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: true }), mod);
+
+// src/writers/index.ts
+var writers_exports = {};
+__export(writers_exports, {
+  DnsWriteError: () => DnsWriteError,
+  cloudflare: () => cloudflare,
+  writers: () => writers
+});
+module.exports = __toCommonJS(writers_exports);
+
+// src/bounded-fetch.ts
+var import_server = require("@gusnips/server");
+async function fetchBounded(doFetch, url, init, limits) {
+  try {
+    const res = await doFetch(url, {
+      ...init,
+      redirect: "manual",
+      signal: AbortSignal.timeout(limits.timeoutMs)
+    });
+    if (res.type === "opaqueredirect" || res.status >= 300 && res.status < 400) {
+      await res.body?.cancel().catch(() => void 0);
+      return { status: res.status || 302, text: "" };
+    }
+    const { bytes, truncated } = await (0, import_server.readBounded)(res.body, limits.maxBytes);
+    if (truncated) return null;
+    return { status: res.status, text: new TextDecoder().decode(bytes) };
+  } catch {
+    return null;
+  }
+}
+
+// src/dns-name.ts
+function normalizeDnsName(name) {
+  return name.trim().toLowerCase().replace(/\.$/, "");
+}
+
+// src/guards.ts
+function isObject(value) {
+  return typeof value === "object" && value !== null;
+}
+
+// src/writers/types.ts
+var DnsWriteError = class extends Error {
+  constructor(code, params = {}) {
+    super(MESSAGES[code](params));
+    this.code = code;
+    this.params = params;
+    this.name = "DnsWriteError";
+  }
+  code;
+  params;
+};
+var MESSAGES = {
+  token_invalid: () => "The DNS host didn't accept that token",
+  zone_read_missing: () => "That token can't read your domains",
+  dns_edit_missing: () => "That token can't change DNS records",
+  zone_not_found: (p) => `No zone holds ${p.hostname ?? "that name"}`,
+  conflict: (p) => `${p.hostname ?? "That name"} already has a record (type ${p.type ?? "?"})`,
+  unavailable: () => "Couldn't reach the DNS host"
+};
+
+// src/writers/cloudflare.ts
+var API = "https://api.cloudflare.com/client/v4";
+var TIMEOUT_MS = 1e4;
+var MAX_BODY_BYTES = 256 * 1024;
+var TOKEN_CODES = /* @__PURE__ */ new Set([1e3, 6003, 6111, 1e4]);
+var CONFLICT_CODES = /* @__PURE__ */ new Set([81053, 81054, 81057]);
+var ID = /^[A-Za-z0-9]{1,64}$/;
+var RECORD_TYPE = /^[A-Z0-9]{1,12}$/;
+function readEnvelope(json) {
+  if (!isObject(json) || typeof json.success !== "boolean") return null;
+  const codes = [];
+  if (Array.isArray(json.errors)) {
+    for (const error of json.errors) {
+      if (!isObject(error)) return null;
+      if (typeof error.code === "number") codes.push(error.code);
+      if (Array.isArray(error.error_chain)) {
+        for (const link of error.error_chain)
+          if (isObject(link) && typeof link.code === "number") codes.push(link.code);
+      }
+    }
+  }
+  return { success: json.success, codes, result: json.result };
+}
+async function call(doFetch, token, path, send) {
+  const res = await fetchBounded(
+    doFetch,
+    `${API}${path}`,
+    {
+      method: send?.method ?? "GET",
+      headers: {
+        Authorization: `Bearer ${token}`,
+        Accept: "application/json",
+        ...send ? { "Content-Type": "application/json" } : {}
+      },
+      body: send ? JSON.stringify(send.body) : void 0
+    },
+    { timeoutMs: TIMEOUT_MS, maxBytes: MAX_BODY_BYTES }
+  );
+  if (!res) return { status: 0, body: null };
+  let json = null;
+  try {
+    json = JSON.parse(res.text);
+  } catch {
+  }
+  return { status: res.status, body: readEnvelope(json) };
+}
+function refusal(answer, stage, subject) {
+  const codes = answer.body?.codes ?? [];
+  const refusedToken = answer.status === 401 || codes.some((c) => TOKEN_CODES.has(c));
+  if (stage === "zones" && refusedToken) return new DnsWriteError("token_invalid");
+  if (codes.some((c) => CONFLICT_CODES.has(c)))
+    return new DnsWriteError("conflict", { ...subject });
+  if (answer.status === 403 || refusedToken) {
+    if (stage === "zones") return new DnsWriteError("zone_read_missing");
+    return new DnsWriteError("dns_edit_missing");
+  }
+  return new DnsWriteError("unavailable");
+}
+function resultOf(answer, stage, subject) {
+  const ok = answer.status >= 200 && answer.status < 300 && answer.body?.success === true;
+  if (!ok) throw refusal(answer, stage, subject);
+  return answer.body?.result;
+}
+function zonesOf(result) {
+  if (!Array.isArray(result)) throw new DnsWriteError("unavailable");
+  return result.map((row) => {
+    if (!isObject(row) || typeof row.id !== "string" || typeof row.name !== "string")
+      throw new DnsWriteError("unavailable");
+    if (!ID.test(row.id)) throw new DnsWriteError("unavailable");
+    return { id: row.id, name: row.name };
+  });
+}
+function recordsOf(result) {
+  if (!Array.isArray(result)) throw new DnsWriteError("unavailable");
+  return result.map((row) => {
+    if (!isObject(row) || typeof row.id !== "string" || typeof row.type !== "string" || typeof row.content !== "string" || !ID.test(row.id) || !RECORD_TYPE.test(row.type))
+      throw new DnsWriteError("unavailable");
+    return {
+      id: row.id,
+      type: row.type,
+      content: row.content,
+      proxied: typeof row.proxied === "boolean" ? row.proxied : void 0
+    };
+  });
+}
+function zoneCandidates(hostname) {
+  const labels = hostname.split(".");
+  const names = [];
+  for (let start = 0; start < labels.length - 1; start++) names.push(labels.slice(start).join("."));
+  return names;
+}
+var unquoted = (content) => content.replace(/"\s+"/g, "").replace(/^"|"$/g, "");
+var sameValue = (record, existing) => record.type === "CNAME" ? normalizeDnsName(existing.content) === normalizeDnsName(record.value) : unquoted(existing.content) === record.value;
+var isSpf = (text) => /^v=spf1(?:\s|$)/i.test(unquoted(text).trim());
+function blocks(record, existing) {
+  if (record.type === "CNAME" || existing.type === "CNAME") return true;
+  return existing.type === "TXT" && isSpf(record.value) && isSpf(existing.content);
+}
+var cloudflare = {
+  host: "cloudflare",
+  /** Add the record (DNS only) to the Cloudflare zone that holds its name. An identical record
+   *  is left as it is; the same CNAME behind the proxy gets the proxy turned off. */
+  async addRecord({ token, record, comment, fetch: doFetch = fetch }) {
+    const hostname = normalizeDnsName(record.name);
+    const subject = { hostname, type: record.type };
+    let zoneId;
+    for (const candidate of zoneCandidates(hostname)) {
+      const query = new URLSearchParams({ name: candidate });
+      const zones = zonesOf(
+        resultOf(await call(doFetch, token, `/zones?${query}`), "zones", subject)
+      );
+      zoneId = zones.find((z) => normalizeDnsName(z.name) === candidate)?.id;
+      if (zoneId) break;
+    }
+    if (!zoneId) throw new DnsWriteError("zone_not_found", { hostname });
+    const existing = recordsOf(
+      resultOf(
+        await call(
+          doFetch,
+          token,
+          `/zones/${zoneId}/dns_records?${new URLSearchParams({ name: hostname })}`
+        ),
+        "records",
+        subject
+      )
+    );
+    const ours = existing.find((r) => r.type === record.type && sameValue(record, r));
+    if (ours) {
+      if (record.type !== "CNAME" || ours.proxied !== true) return "unchanged";
+      resultOf(
+        await call(doFetch, token, `/zones/${zoneId}/dns_records/${ours.id}`, {
+          method: "PATCH",
+          body: { proxied: false }
+        }),
+        "records",
+        subject
+      );
+      return "unproxied";
+    }
+    const blocker = existing.find((r) => blocks(record, r));
+    if (blocker) throw new DnsWriteError("conflict", { hostname, type: blocker.type });
+    resultOf(
+      await call(doFetch, token, `/zones/${zoneId}/dns_records`, {
+        method: "POST",
+        body: {
+          type: record.type,
+          name: hostname,
+          content: record.value,
+          // A proxied record hides the CNAME our checker reads.
+          ...record.type === "CNAME" ? { proxied: false } : {},
+          // 1 is Cloudflare's "automatic".
+          ttl: 1,
+          ...comment ? { comment } : {}
+        }
+      }),
+      "records",
+      subject
+    );
+    return "created";
+  }
+};
+
+// src/writers/index.ts
+var writers = { cloudflare };
+// Annotate the CommonJS export names for ESM import in node:
+0 && (module.exports = {
+  DnsWriteError,
+  cloudflare,
+  writers
+});

package/dist/writers/index.d.cts

@@ -0,0 +1,57 @@
+import { D as DnsHostId } from '../hosts-B0_V4Ned.cjs';
+
+interface DnsWriteRecord {
+    type: "CNAME" | "TXT";
+    /** The record's whole name: `help.acme.com`. */
+    name: string;
+    /** The target (CNAME) or the text (TXT), as the app means it, with no quotes added. */
+    value: string;
+}
+/**
+ * - `created`: the record is there now;
+ * - `unchanged`: the same record was already there;
+ * - `unproxied`: the same record was there behind the host's proxy, and the proxy is off now,
+ *   because a proxied record hides the CNAME a checker reads (Cloudflare).
+ */
+type DnsWriteOutcome = "created" | "unchanged" | "unproxied";
+/**
+ * Why a write was refused. A person can act on each one:
+ * - `token_invalid`: the host didn't accept the token (paste it again);
+ * - `zone_read_missing`: the token can't list the domains (give it that permission);
+ * - `dns_edit_missing`: the token can't change DNS records (give it that permission);
+ * - `zone_not_found`: no zone the token can see holds the name (the domain is elsewhere, or the
+ *   token is for another account);
+ * - `conflict`: the name already has a record that isn't ours, and it is the owner's to resolve;
+ * - `unavailable`: the host didn't answer in a usable way (try again).
+ */
+type DnsWriteErrorCode = "token_invalid" | "zone_read_missing" | "dns_edit_missing" | "zone_not_found" | "conflict" | "unavailable";
+/** A refusal with a fixed message and no `cause`: an error from the host or from `fetch` can
+ *  quote the token, so none of it is kept. */
+declare class DnsWriteError extends Error {
+    readonly code: DnsWriteErrorCode;
+    /** `conflict` carries `hostname` and the `type` of the record in the way. */
+    readonly params: Readonly<Record<string, string>>;
+    constructor(code: DnsWriteErrorCode, 
+    /** `conflict` carries `hostname` and the `type` of the record in the way. */
+    params?: Readonly<Record<string, string>>);
+}
+interface DnsWriter {
+    host: DnsHostId;
+    /** Add the record to the person's own zone with a token they pasted. The token lives only in
+     *  this call: it is never stored, queued, logged, put in a URL or put in an error. A record
+     *  the person already has is never overwritten or deleted. */
+    addRecord(input: {
+        token: string;
+        record: DnsWriteRecord;
+        /** Shown beside the record in the host's panel, where the host has such a field. */
+        comment?: string;
+        fetch?: typeof fetch;
+    }): Promise<DnsWriteOutcome>;
+}
+
+declare const cloudflare: DnsWriter;
+
+/** The hosts that take a pasted token, by host id: `writers[host]` is undefined for the rest. */
+declare const writers: Partial<Record<DnsHostId, DnsWriter>>;
+
+export { DnsWriteError, type DnsWriteErrorCode, type DnsWriteOutcome, type DnsWriteRecord, type DnsWriter, cloudflare, writers };

package/dist/writers/index.d.ts

@@ -0,0 +1,57 @@
+import { D as DnsHostId } from '../hosts-B0_V4Ned.js';
+
+interface DnsWriteRecord {
+    type: "CNAME" | "TXT";
+    /** The record's whole name: `help.acme.com`. */
+    name: string;
+    /** The target (CNAME) or the text (TXT), as the app means it, with no quotes added. */
+    value: string;
+}
+/**
+ * - `created`: the record is there now;
+ * - `unchanged`: the same record was already there;
+ * - `unproxied`: the same record was there behind the host's proxy, and the proxy is off now,
+ *   because a proxied record hides the CNAME a checker reads (Cloudflare).
+ */
+type DnsWriteOutcome = "created" | "unchanged" | "unproxied";
+/**
+ * Why a write was refused. A person can act on each one:
+ * - `token_invalid`: the host didn't accept the token (paste it again);
+ * - `zone_read_missing`: the token can't list the domains (give it that permission);
+ * - `dns_edit_missing`: the token can't change DNS records (give it that permission);
+ * - `zone_not_found`: no zone the token can see holds the name (the domain is elsewhere, or the
+ *   token is for another account);
+ * - `conflict`: the name already has a record that isn't ours, and it is the owner's to resolve;
+ * - `unavailable`: the host didn't answer in a usable way (try again).
+ */
+type DnsWriteErrorCode = "token_invalid" | "zone_read_missing" | "dns_edit_missing" | "zone_not_found" | "conflict" | "unavailable";
+/** A refusal with a fixed message and no `cause`: an error from the host or from `fetch` can
+ *  quote the token, so none of it is kept. */
+declare class DnsWriteError extends Error {
+    readonly code: DnsWriteErrorCode;
+    /** `conflict` carries `hostname` and the `type` of the record in the way. */
+    readonly params: Readonly<Record<string, string>>;
+    constructor(code: DnsWriteErrorCode, 
+    /** `conflict` carries `hostname` and the `type` of the record in the way. */
+    params?: Readonly<Record<string, string>>);
+}
+interface DnsWriter {
+    host: DnsHostId;
+    /** Add the record to the person's own zone with a token they pasted. The token lives only in
+     *  this call: it is never stored, queued, logged, put in a URL or put in an error. A record
+     *  the person already has is never overwritten or deleted. */
+    addRecord(input: {
+        token: string;
+        record: DnsWriteRecord;
+        /** Shown beside the record in the host's panel, where the host has such a field. */
+        comment?: string;
+        fetch?: typeof fetch;
+    }): Promise<DnsWriteOutcome>;
+}
+
+declare const cloudflare: DnsWriter;
+
+/** The hosts that take a pasted token, by host id: `writers[host]` is undefined for the rest. */
+declare const writers: Partial<Record<DnsHostId, DnsWriter>>;
+
+export { DnsWriteError, type DnsWriteErrorCode, type DnsWriteOutcome, type DnsWriteRecord, type DnsWriter, cloudflare, writers };

package/dist/writers/index.js

@@ -0,0 +1,11 @@
+import {
+  DnsWriteError,
+  cloudflare,
+  writers
+} from "../chunk-FGM7S7GQ.js";
+import "../chunk-P2O7INDB.js";
+export {
+  DnsWriteError,
+  cloudflare,
+  writers
+};

package/package.json

@@ -1,6 +1,95 @@
 {
   "name": "@gusnips/one-click-dns",
-  "version": "0.0.0-stage",
-  "stub": true,
-  "description": "Temporary package placeholder for staged publishing"
-}
+  "version": "0.1.0",
+  "packageManager": "bun@1.4.2",
+  "description": "Put DNS records in a customer's zone: find their DNS host, send them to a signed Domain Connect link, write with an API token, or show the steps for that host",
+  "type": "module",
+  "main": "dist/index.cjs",
+  "module": "dist/index.js",
+  "types": "dist/index.d.ts",
+  "exports": {
+    ".": {
+      "import": {
+        "types": "./dist/index.d.ts",
+        "default": "./dist/index.js"
+      },
+      "require": {
+        "types": "./dist/index.d.cts",
+        "default": "./dist/index.cjs"
+      }
+    },
+    "./server": {
+      "import": {
+        "types": "./dist/server/index.d.ts",
+        "default": "./dist/server/index.js"
+      },
+      "require": {
+        "types": "./dist/server/index.d.cts",
+        "default": "./dist/server/index.cjs"
+      }
+    },
+    "./writers": {
+      "import": {
+        "types": "./dist/writers/index.d.ts",
+        "default": "./dist/writers/index.js"
+      },
+      "require": {
+        "types": "./dist/writers/index.d.cts",
+        "default": "./dist/writers/index.cjs"
+      }
+    }
+  },
+  "files": [
+    "dist",
+    "README.md",
+    "LICENSE"
+  ],
+  "scripts": {
+    "build": "tsup src/index.ts src/server/index.ts src/writers/index.ts --format cjs,esm --dts --clean",
+    "typecheck": "tsc --noEmit",
+    "lint": "eslint src",
+    "format": "prettier --write .",
+    "test": "bun test",
+    "prepublishOnly": "bun run lint && bun run typecheck && bun run build"
+  },
+  "keywords": [
+    "dns",
+    "domain-connect",
+    "custom-domain",
+    "cloudflare",
+    "godaddy",
+    "name-com",
+    "registro-br",
+    "typescript"
+  ],
+  "author": "Gustavo Salomé (gusnips)",
+  "license": "MIT",
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/gusnips/one-click-dns.git"
+  },
+  "bugs": {
+    "url": "https://github.com/gusnips/one-click-dns/issues"
+  },
+  "homepage": "https://github.com/gusnips/one-click-dns#readme",
+  "engines": {
+    "node": ">=20"
+  },
+  "publishConfig": {
+    "access": "public"
+  },
+  "peerDependencies": {
+    "@gusnips/server": ">=0.15.0"
+  },
+  "devDependencies": {
+    "@eslint/js": "^10.0.1",
+    "@gusnips/server": "^0.15.0",
+    "@types/bun": "^1.4.2",
+    "@types/node": "^26.6.5",
+    "eslint": "^10.12.0",
+    "prettier": "^3.9.10",
+    "tsup": "^8.5.1",
+    "typescript": "^5.9.3",
+    "typescript-eslint": "^8.71.1"
+  }
+}