@gusnips/one-click-dns 0.0.0-stage → 0.1.1

package/dist/chunk-56ZUD4EQ.js

@@ -0,0 +1,525 @@
+import {
+  normalizeDnsName
+} from "./chunk-P2O7INDB.js";
+
+// src/bounded-fetch.ts
+import { readBounded } from "@gusnips/server";
+async function fetchBounded(doFetch, url, init, limits) {
+  try {
+    const res = await doFetch(url, {
+      ...init,
+      redirect: "manual",
+      signal: AbortSignal.timeout(limits.timeoutMs)
+    });
+    if (res.type === "opaqueredirect" || res.status >= 300 && res.status < 400) {
+      await res.body?.cancel().catch(() => void 0);
+      return { status: res.status || 302, text: "" };
+    }
+    const { bytes, truncated } = await readBounded(res.body, limits.maxBytes);
+    if (truncated) return null;
+    return { status: res.status, text: new TextDecoder().decode(bytes) };
+  } catch {
+    return null;
+  }
+}
+
+// src/guards.ts
+function isObject(value) {
+  return typeof value === "object" && value !== null;
+}
+
+// src/writers/types.ts
+var DnsWriteError = class extends Error {
+  constructor(code, params = {}) {
+    super(MESSAGES[code](params));
+    this.code = code;
+    this.params = params;
+    this.name = "DnsWriteError";
+  }
+  code;
+  params;
+};
+var MESSAGES = {
+  token_invalid: () => "The DNS host didn't accept that token",
+  zone_read_missing: () => "That token can't read your domains",
+  dns_edit_missing: () => "That token can't change DNS records",
+  zone_not_found: (p) => `No zone holds ${p.hostname ?? "that name"}`,
+  conflict: (p) => `${p.hostname ?? "That name"} already has a record${p.type ? ` (type ${p.type})` : ""}`,
+  unavailable: () => "Couldn't reach the DNS host"
+};
+
+// src/writers/policy.ts
+function zoneCandidates(hostname) {
+  const labels = hostname.split(".");
+  const names = [];
+  for (let start = 0; start < labels.length - 1; start++) names.push(labels.slice(start).join("."));
+  return names;
+}
+var unquoted = (content) => content.replace(/"\s+"/g, "").replace(/^"|"$/g, "");
+var sameValue = (record, existing) => record.type === "CNAME" ? normalizeDnsName(existing.content) === normalizeDnsName(record.value) : unquoted(existing.content) === record.value;
+var isSpf = (text) => /^v=spf1(?:\s|$)/i.test(unquoted(text).trim());
+function blocks(record, existing) {
+  if (record.type === "CNAME" || existing.type === "CNAME") return true;
+  return existing.type === "TXT" && isSpf(record.value) && isSpf(existing.content);
+}
+function decide(record, existing, hostname) {
+  const ours = existing.find((r) => r.type === record.type && sameValue(record, r));
+  if (ours) {
+    if (record.type === "CNAME" && ours.proxied === true) return { kind: "unproxy", id: ours.id };
+    return { kind: "unchanged" };
+  }
+  const blocker = existing.find((r) => blocks(record, r));
+  if (blocker) throw new DnsWriteError("conflict", { hostname, type: blocker.type });
+  return { kind: "create" };
+}
+
+// src/writers/cloudflare.ts
+var API = "https://api.cloudflare.com/client/v4";
+var TIMEOUT_MS = 1e4;
+var MAX_BODY_BYTES = 256 * 1024;
+var TOKEN_CODES = /* @__PURE__ */ new Set([1e3, 6003, 6111, 1e4]);
+var CONFLICT_CODES = /* @__PURE__ */ new Set([81053, 81054, 81057]);
+var ID = /^[A-Za-z0-9]{1,64}$/;
+var RECORD_TYPE = /^[A-Z0-9]{1,12}$/;
+function readEnvelope(json) {
+  if (!isObject(json) || typeof json.success !== "boolean") return null;
+  const codes = [];
+  if (Array.isArray(json.errors)) {
+    for (const error of json.errors) {
+      if (!isObject(error)) return null;
+      if (typeof error.code === "number") codes.push(error.code);
+      if (Array.isArray(error.error_chain)) {
+        for (const link of error.error_chain)
+          if (isObject(link) && typeof link.code === "number") codes.push(link.code);
+      }
+    }
+  }
+  return { success: json.success, codes, result: json.result };
+}
+async function call(doFetch, token, path, send) {
+  const res = await fetchBounded(
+    doFetch,
+    `${API}${path}`,
+    {
+      method: send?.method ?? "GET",
+      headers: {
+        Authorization: `Bearer ${token}`,
+        Accept: "application/json",
+        ...send ? { "Content-Type": "application/json" } : {}
+      },
+      body: send ? JSON.stringify(send.body) : void 0
+    },
+    { timeoutMs: TIMEOUT_MS, maxBytes: MAX_BODY_BYTES }
+  );
+  if (!res) return { status: 0, body: null };
+  let json = null;
+  try {
+    json = JSON.parse(res.text);
+  } catch {
+  }
+  return { status: res.status, body: readEnvelope(json) };
+}
+function refusal(answer, stage, subject) {
+  const codes = answer.body?.codes ?? [];
+  const refusedToken = answer.status === 401 || codes.some((c) => TOKEN_CODES.has(c));
+  if (stage === "zones" && refusedToken) return new DnsWriteError("token_invalid");
+  if (codes.some((c) => CONFLICT_CODES.has(c)))
+    return new DnsWriteError("conflict", { ...subject });
+  if (answer.status === 403 || refusedToken) {
+    if (stage === "zones") return new DnsWriteError("zone_read_missing");
+    return new DnsWriteError("dns_edit_missing");
+  }
+  return new DnsWriteError("unavailable");
+}
+function resultOf(answer, stage, subject) {
+  const ok = answer.status >= 200 && answer.status < 300 && answer.body?.success === true;
+  if (!ok) throw refusal(answer, stage, subject);
+  return answer.body?.result;
+}
+function zonesOf(result) {
+  if (!Array.isArray(result)) throw new DnsWriteError("unavailable");
+  return result.map((row) => {
+    if (!isObject(row) || typeof row.id !== "string" || typeof row.name !== "string")
+      throw new DnsWriteError("unavailable");
+    if (!ID.test(row.id)) throw new DnsWriteError("unavailable");
+    return { id: row.id, name: row.name };
+  });
+}
+function recordsOf(result) {
+  if (!Array.isArray(result)) throw new DnsWriteError("unavailable");
+  return result.map((row) => {
+    if (!isObject(row) || typeof row.id !== "string" || typeof row.type !== "string" || typeof row.content !== "string" || !ID.test(row.id) || !RECORD_TYPE.test(row.type))
+      throw new DnsWriteError("unavailable");
+    return {
+      id: row.id,
+      type: row.type,
+      content: row.content,
+      proxied: typeof row.proxied === "boolean" ? row.proxied : void 0
+    };
+  });
+}
+var cloudflare = {
+  host: "cloudflare",
+  /** Add the record (DNS only) to the Cloudflare zone that holds its name. An identical record
+   *  is left as it is; the same CNAME behind the proxy gets the proxy turned off. */
+  async addRecord({ token, record, comment, fetch: doFetch = fetch }) {
+    const hostname = normalizeDnsName(record.name);
+    const subject = { hostname, type: record.type };
+    let zoneId;
+    for (const candidate of zoneCandidates(hostname)) {
+      const query = new URLSearchParams({ name: candidate });
+      const zones = zonesOf(
+        resultOf(await call(doFetch, token, `/zones?${query}`), "zones", subject)
+      );
+      zoneId = zones.find((z) => normalizeDnsName(z.name) === candidate)?.id;
+      if (zoneId) break;
+    }
+    if (!zoneId) throw new DnsWriteError("zone_not_found", { hostname });
+    const existing = recordsOf(
+      resultOf(
+        await call(
+          doFetch,
+          token,
+          `/zones/${zoneId}/dns_records?${new URLSearchParams({ name: hostname })}`
+        ),
+        "records",
+        subject
+      )
+    );
+    const decision = decide(record, existing, hostname);
+    if (decision.kind === "unchanged") return "unchanged";
+    if (decision.kind === "unproxy") {
+      resultOf(
+        await call(doFetch, token, `/zones/${zoneId}/dns_records/${decision.id}`, {
+          method: "PATCH",
+          body: { proxied: false }
+        }),
+        "records",
+        subject
+      );
+      return "unproxied";
+    }
+    resultOf(
+      await call(doFetch, token, `/zones/${zoneId}/dns_records`, {
+        method: "POST",
+        body: {
+          type: record.type,
+          name: hostname,
+          content: record.value,
+          // A proxied record hides the CNAME our checker reads.
+          ...record.type === "CNAME" ? { proxied: false } : {},
+          // 1 is Cloudflare's "automatic".
+          ttl: 1,
+          ...comment ? { comment } : {}
+        }
+      }),
+      "records",
+      subject
+    );
+    return "created";
+  }
+};
+
+// src/writers/digitalocean.ts
+var API2 = "https://api.digitalocean.com/v2";
+var TIMEOUT_MS2 = 1e4;
+var MAX_BODY_BYTES2 = 512 * 1024;
+var RECORD_TYPE2 = /^[A-Z0-9]{1,12}$/;
+async function call2(doFetch, token, path, send) {
+  const res = await fetchBounded(
+    doFetch,
+    `${API2}${path}`,
+    {
+      method: send ? "POST" : "GET",
+      headers: {
+        Authorization: `Bearer ${token}`,
+        Accept: "application/json",
+        ...send ? { "Content-Type": "application/json" } : {}
+      },
+      body: send ? JSON.stringify(send.body) : void 0
+    },
+    { timeoutMs: TIMEOUT_MS2, maxBytes: MAX_BODY_BYTES2 }
+  );
+  if (!res) return { status: 0, body: null };
+  let json = null;
+  try {
+    json = JSON.parse(res.text);
+  } catch {
+  }
+  return { status: res.status, body: isObject(json) ? json : null };
+}
+function refusal2(answer, stage, hostname) {
+  if (answer.status === 401) return new DnsWriteError("token_invalid");
+  if (answer.status === 403)
+    return new DnsWriteError(stage === "reading" ? "zone_read_missing" : "dns_edit_missing");
+  if (answer.status === 422 && stage === "writing")
+    return new DnsWriteError("conflict", { hostname });
+  return new DnsWriteError("unavailable");
+}
+function recordsOf2(body) {
+  const rows = body?.domain_records;
+  if (!Array.isArray(rows)) throw new DnsWriteError("unavailable");
+  return rows.map((row) => {
+    if (!isObject(row) || typeof row.id !== "number" || typeof row.type !== "string" || typeof row.data !== "string" || !RECORD_TYPE2.test(row.type))
+      throw new DnsWriteError("unavailable");
+    return { id: String(row.id), type: row.type, content: row.data };
+  });
+}
+var digitalocean = {
+  host: "digitalocean",
+  /** Add the record to the DigitalOcean domain that holds its name. An identical record is left
+   *  as it is. DigitalOcean has no proxy, so the outcome is `created` or `unchanged`. */
+  async addRecord({ token, record, fetch: doFetch = fetch }) {
+    const hostname = normalizeDnsName(record.name);
+    let zone;
+    let existing = [];
+    for (const candidate of zoneCandidates(hostname)) {
+      const query = new URLSearchParams({ name: hostname, per_page: "200" });
+      const answer = await call2(
+        doFetch,
+        token,
+        `/domains/${encodeURIComponent(candidate)}/records?${query}`
+      );
+      if (answer.status === 200) {
+        zone = candidate;
+        existing = recordsOf2(answer.body);
+        break;
+      }
+      if (answer.status !== 404) throw refusal2(answer, "reading", hostname);
+    }
+    if (!zone) throw new DnsWriteError("zone_not_found", { hostname });
+    const decision = decide(record, existing, hostname);
+    if (decision.kind === "unchanged") return "unchanged";
+    const name = hostname === zone ? "@" : hostname.slice(0, -(zone.length + 1));
+    const created = await call2(doFetch, token, `/domains/${encodeURIComponent(zone)}/records`, {
+      body: {
+        type: record.type,
+        name,
+        data: record.type === "CNAME" ? `${normalizeDnsName(record.value)}.` : record.value,
+        // The API lists these as required for a TXT; they mean nothing for one.
+        ...record.type === "TXT" ? { flags: null, tag: null } : {}
+      }
+    });
+    if (created.status !== 201) throw refusal2(created, "writing", hostname);
+    return "created";
+  }
+};
+
+// src/writers/namecom.ts
+var API3 = "https://api.name.com/core/v1";
+var TIMEOUT_MS3 = 1e4;
+var MAX_BODY_BYTES3 = 512 * 1024;
+var PER_PAGE = 500;
+var MAX_PAGES = 10;
+var TTL = 300;
+var RECORD_TYPE3 = /^[A-Z0-9]{1,12}$/;
+function basicOf(token) {
+  const at = token.indexOf(":");
+  return at > 0 && at < token.length - 1 && !/\s/.test(token) ? btoa(token) : null;
+}
+async function call3(doFetch, basic, path, send) {
+  const res = await fetchBounded(
+    doFetch,
+    `${API3}${path}`,
+    {
+      method: send ? "POST" : "GET",
+      headers: {
+        Authorization: `Basic ${basic}`,
+        Accept: "application/json",
+        ...send ? { "Content-Type": "application/json" } : {}
+      },
+      body: send ? JSON.stringify(send.body) : void 0
+    },
+    { timeoutMs: TIMEOUT_MS3, maxBytes: MAX_BODY_BYTES3 }
+  );
+  if (!res) return { status: 0, body: null };
+  let json = null;
+  try {
+    json = JSON.parse(res.text);
+  } catch {
+  }
+  return { status: res.status, body: isObject(json) ? json : null };
+}
+function refusal3(answer, stage, hostname) {
+  if (answer.status === 401) return new DnsWriteError("token_invalid");
+  if (answer.status === 403)
+    return new DnsWriteError(stage === "reading" ? "zone_read_missing" : "dns_edit_missing");
+  if (answer.status === 409) return new DnsWriteError("conflict", { hostname });
+  return new DnsWriteError("unavailable");
+}
+function pageOf(body) {
+  const rows = body?.records;
+  if (!Array.isArray(rows)) throw new DnsWriteError("unavailable");
+  const records = rows.map((row) => {
+    if (!isObject(row) || typeof row.id !== "number" || typeof row.type !== "string" || typeof row.answer !== "string" || typeof row.fqdn !== "string" || !RECORD_TYPE3.test(row.type))
+      throw new DnsWriteError("unavailable");
+    return { id: String(row.id), type: row.type, content: row.answer, name: row.fqdn };
+  });
+  return { records, more: typeof body?.nextPage === "number" };
+}
+var namecom = {
+  host: "name-com",
+  /** Add the record to the Name.com domain that holds its name. An identical record is left as
+   *  it is. Name.com has no proxy, so the outcome is `created` or `unchanged`. */
+  async addRecord({ token, record, fetch: doFetch = fetch }) {
+    const hostname = normalizeDnsName(record.name);
+    const basic = basicOf(token);
+    if (!basic) throw new DnsWriteError("token_invalid");
+    let zone;
+    let existing = [];
+    for (const candidate of zoneCandidates(hostname)) {
+      const path = `/domains/${encodeURIComponent(candidate)}/records`;
+      const first = await call3(doFetch, basic, `${path}?perPage=${PER_PAGE}`);
+      if (first.status === 404) continue;
+      if (first.status !== 200) throw refusal3(first, "reading", hostname);
+      zone = candidate;
+      let page = pageOf(first.body);
+      existing = page.records;
+      for (let next = 2; page.more && next <= MAX_PAGES; next++) {
+        const answer = await call3(doFetch, basic, `${path}?perPage=${PER_PAGE}&page=${next}`);
+        if (answer.status !== 200) throw refusal3(answer, "reading", hostname);
+        page = pageOf(answer.body);
+        existing = existing.concat(page.records);
+      }
+      if (page.more) throw new DnsWriteError("unavailable");
+      break;
+    }
+    if (!zone) throw new DnsWriteError("zone_not_found", { hostname });
+    const here = existing.filter(
+      (r) => r.name !== void 0 && normalizeDnsName(r.name) === hostname
+    );
+    const decision = decide(record, here, hostname);
+    if (decision.kind === "unchanged") return "unchanged";
+    const host = hostname === zone ? "@" : hostname.slice(0, -(zone.length + 1));
+    const created = await call3(doFetch, basic, `/domains/${encodeURIComponent(zone)}/records`, {
+      body: { host, type: record.type, answer: record.value, ttl: TTL }
+    });
+    if (created.status !== 200) throw refusal3(created, "writing", hostname);
+    const stored = created.body?.answer;
+    if (typeof stored !== "string" || !sameValue(record, { content: stored }))
+      throw new DnsWriteError("unavailable");
+    return "created";
+  }
+};
+
+// src/writers/porkbun.ts
+var API4 = "https://api.porkbun.com/api/json/v3";
+var TIMEOUT_MS4 = 1e4;
+var MAX_BODY_BYTES4 = 256 * 1024;
+var KEY_CODES = /* @__PURE__ */ new Set([
+  "API_KEY_REQUIRED",
+  "INVALID_API_KEYS_001",
+  "INVALID_TOKEN",
+  "INVALID_USER"
+]);
+var ACCESS_CODES = /* @__PURE__ */ new Set(["API_ACCESS_DISABLED", "IP_NOT_ALLOWED", "DOMAIN_NOT_ALLOWED"]);
+var NOT_A_ZONE_CODES = /* @__PURE__ */ new Set(["INVALID_DOMAIN", "DOMAIN_NOT_FOUND"]);
+var ID2 = /^[0-9]{1,20}$/;
+var RECORD_TYPE4 = /^[A-Z0-9]{1,12}$/;
+function keysOf(token) {
+  const at = token.indexOf(":");
+  const key = token.slice(0, at);
+  const secret = token.slice(at + 1);
+  return at > 0 && secret && !/\s/.test(token) ? { key, secret } : null;
+}
+async function call4(doFetch, keys, path, send) {
+  const res = await fetchBounded(
+    doFetch,
+    `${API4}${path}`,
+    {
+      method: send ? "POST" : "GET",
+      headers: {
+        "X-API-Key": keys.key,
+        "X-Secret-API-Key": keys.secret,
+        Accept: "application/json",
+        ...send ? { "Content-Type": "application/json" } : {}
+      },
+      body: send ? JSON.stringify(send.body) : void 0
+    },
+    { timeoutMs: TIMEOUT_MS4, maxBytes: MAX_BODY_BYTES4 }
+  );
+  if (!res) return { code: "", ok: false, body: null };
+  let json = null;
+  try {
+    json = JSON.parse(res.text);
+  } catch {
+  }
+  const body = isObject(json) ? json : null;
+  return {
+    code: typeof body?.code === "string" ? body.code : "",
+    ok: res.status === 200 && body?.status === "SUCCESS",
+    body
+  };
+}
+function refusal4(answer, hostname) {
+  if (KEY_CODES.has(answer.code)) return new DnsWriteError("token_invalid");
+  if (ACCESS_CODES.has(answer.code)) return new DnsWriteError("dns_edit_missing");
+  if (answer.code === "RECORD_CONFLICT") return new DnsWriteError("conflict", { hostname });
+  return new DnsWriteError("unavailable");
+}
+function recordsOf3(body) {
+  const rows = body?.records;
+  if (!Array.isArray(rows)) throw new DnsWriteError("unavailable");
+  return rows.map((row) => {
+    if (!isObject(row) || typeof row.id !== "string" || typeof row.name !== "string" || typeof row.type !== "string" || typeof row.content !== "string" || !ID2.test(row.id) || !RECORD_TYPE4.test(row.type))
+      throw new DnsWriteError("unavailable");
+    return { id: row.id, type: row.type, content: row.content, name: row.name };
+  });
+}
+var porkbun = {
+  host: "porkbun",
+  /** Add the record to the Porkbun domain that holds its name. An identical record is left as
+   *  it is. Porkbun has no proxy, so the outcome is `created` or `unchanged`. */
+  async addRecord({ token, record, comment, fetch: doFetch = fetch }) {
+    const hostname = normalizeDnsName(record.name);
+    const keys = keysOf(token);
+    if (!keys) throw new DnsWriteError("token_invalid");
+    let zone;
+    let existing = [];
+    for (const candidate of zoneCandidates(hostname)) {
+      const answer = await call4(doFetch, keys, `/dns/retrieve/${encodeURIComponent(candidate)}`);
+      if (answer.ok) {
+        zone = candidate;
+        existing = recordsOf3(answer.body).filter(
+          (r) => r.name !== void 0 && normalizeDnsName(r.name) === hostname
+        );
+        break;
+      }
+      if (!NOT_A_ZONE_CODES.has(answer.code)) throw refusal4(answer, hostname);
+    }
+    if (!zone) throw new DnsWriteError("zone_not_found", { hostname });
+    const decision = decide(record, existing, hostname);
+    if (decision.kind === "unchanged") return "unchanged";
+    const subdomain = hostname === zone ? "" : hostname.slice(0, -(zone.length + 1));
+    const created = await call4(doFetch, keys, `/dns/create/${encodeURIComponent(zone)}`, {
+      body: {
+        name: subdomain,
+        type: record.type,
+        content: record.value,
+        ...comment ? { notes: comment } : {}
+      }
+    });
+    if (created.code === "DUPLICATE_RECORD") return "unchanged";
+    if (!created.ok) throw refusal4(created, hostname);
+    return "created";
+  }
+};
+
+// src/writers/index.ts
+var writers = {
+  cloudflare,
+  digitalocean,
+  "name-com": namecom,
+  porkbun
+};
+
+export {
+  fetchBounded,
+  isObject,
+  DnsWriteError,
+  cloudflare,
+  digitalocean,
+  namecom,
+  porkbun,
+  writers
+};

package/dist/chunk-P2O7INDB.js

@@ -0,0 +1,8 @@
+// src/dns-name.ts
+function normalizeDnsName(name) {
+  return name.trim().toLowerCase().replace(/\.$/, "");
+}
+
+export {
+  normalizeDnsName
+};

package/dist/hosts-B0_V4Ned.d.cts

@@ -0,0 +1,106 @@
+/**
+ * The DNS hosts we know steps for. A closed list. Order is the order a picker shows them and a
+ * detection lists them in.
+ *
+ * `cpanel` and `namecheap-hosting` both hand the person cPanel's Zone Editor. `hostinger` and
+ * `cpanel` have no name server pattern, so DNS alone never names them: a person picks them by
+ * hand.
+ */
+declare const DNS_HOST_IDS: readonly ["cloudflare", "godaddy", "namecheap", "namecheap-hosting", "squarespace", "route53", "google-cloud-dns", "azure-dns", "ionos", "hostinger", "porkbun", "name-com", "dynadot", "namesilo", "gandi", "ovhcloud", "digitalocean", "hetzner", "vercel", "netlify", "wix", "wordpress-com", "cpanel", "bluehost", "hostgator", "hostgator-br", "siteground", "registro-br", "locaweb", "kinghost", "uol-host", "umbler", "dnsimple"];
+type DnsHostId = (typeof DNS_HOST_IDS)[number];
+/** The labels on the form of one record type. */
+interface DnsFields {
+    /** The box that takes the record's name. */
+    name: string | null;
+    /** The box that takes its value: a CNAME's target, or a TXT's text. */
+    value: string | null;
+}
+/**
+ * What goes wrong at a host, each with a sentence of its own in the app.
+ *
+ * - `proxyOff`: a record is proxied by default and the proxy hides it (Cloudflare);
+ * - `trailingDot`: without a dot at the end, the host adds the zone to a CNAME's target
+ *   (OVHcloud, Hetzner, DigitalOcean);
+ * - `quotedTxt`: the host wants straight quotes around a TXT value (Route 53, Hetzner);
+ * - `secondSave`: adding the record is not saving it (KingHost);
+ * - `advancedMode`: the basic mode can't add the record (Registro.br);
+ * - `oneSpf`: the host may already hold an SPF record, and a domain may have only one;
+ * - `shortName`: the name box takes only the part before the zone, and the host adds the rest.
+ *
+ * `trailingDot` and `quotedTxt` also change the value we hand over (`records.ts`).
+ */
+type DnsTrap = {
+    kind: "proxyOff";
+    field: string;
+    value: string;
+} | {
+    kind: "trailingDot";
+} | {
+    kind: "quotedTxt";
+} | {
+    kind: "secondSave";
+    button: string;
+} | {
+    kind: "advancedMode";
+    mode: string;
+} | {
+    kind: "oneSpf";
+} | {
+    kind: "shortName";
+};
+type DnsTrapKind = DnsTrap["kind"];
+interface DnsHost {
+    /** The brand, as the company writes it. */
+    name: string;
+    /** The host's name servers, as patterns over a lowercase name with no trailing dot. A set
+     *  of names belongs to this host only when every name matches one of them. Empty: no
+     *  pattern we may trust, so the host is reached by the picker alone. */
+    ns: readonly RegExp[];
+    /** The host's page for a zone's records, only where its own docs link one. */
+    link: string | null;
+    /** The menu, tab or button that opens the zone's records. */
+    open: string | null;
+    /** The button that starts a new record. */
+    add: string | null;
+    /** The button that saves it. */
+    save: string | null;
+    cname: DnsFields;
+    txt: DnsFields;
+    /** How the host writes the zone's own name in the name box: `"@"`, empty, or `"."`. `null`
+     *  when no page of the host says. */
+    root: "@" | "" | "." | null;
+    traps: readonly DnsTrap[];
+}
+declare const DNS_HOSTS: Record<DnsHostId, DnsHost>;
+/** The first trap of a kind a host has. */
+declare function trapOf<K extends DnsTrapKind>(host: DnsHost, kind: K): Extract<DnsTrap, {
+    kind: K;
+}> | undefined;
+/**
+ * The hosts a zone's name servers point at. A host fits when every name matches one of its
+ * patterns, so a set that mixes two hosts, or holds one name nobody claims, fits none. Names that
+ * several hosts share answer with all of them, in `DNS_HOST_IDS` order: the app shows the
+ * choice and never guesses. An empty list is a host we don't know.
+ */
+declare function detectDnsHosts(nameservers: readonly string[]): DnsHostId[];
+/** The zone whose name servers answered: the nearest name at or above the hostname that has NS
+ *  records of its own. Records are added in this zone, named relative to it. */
+interface DnsZone {
+    zone: string;
+    /** The zone's name servers, lowercase, without the trailing dot, sorted. */
+    nameservers: string[];
+}
+/**
+ * What we read from DNS about where a domain's records are edited. `hosts` says what the names
+ * mean:
+ * - one id: a host we know;
+ * - several: the names fit more than one (Netlify and older Squarespace zones share NS1's
+ *   names, Google Cloud DNS and Squarespace domains moved from Google Domains share Google's),
+ *   so we do not guess;
+ * - none: names no host we know uses, or a mix of hosts. Show the names and ask.
+ */
+interface DnsHostReading extends DnsZone {
+    hosts: DnsHostId[];
+}
+
+export { type DnsHostId as D, DNS_HOSTS as a, DNS_HOST_IDS as b, type DnsFields as c, type DnsHost as d, type DnsHostReading as e, type DnsTrap as f, type DnsTrapKind as g, type DnsZone as h, detectDnsHosts as i, trapOf as t };