@hasna/domains 0.0.47 → 0.1.0

package/dist/lib/app-home.d.ts

@@ -1,60 +1,48 @@
 /**
- * @hasna/domains home resolution — the legacy `~/.hasna/domains` root,
- * resolved through the @hasna/paths resolver (XDG / macOS home layout).
+ * @hasna/domains LOCAL data home resolution — the on-box SQLite store's root.
  *
- * The legacy `~/.hasna/domains` default stays the effective home until the
- * XDG data home is adopted — the operator sets `HASNA_DATA_HOME` (the
- * data-kind override — a deliberate opt-in to the XDG layout), or the store
- * has already been physically migrated there (`domains.db` exists at the
- * resolver home) — so an existing local store and config never become
- * invisible on upgrade. An exact-app override (`HASNA_DOMAINS_HOME` /
- * `DOMAINS_HOME`, and the pre-existing `HASNA_DOMAINS_DIR` / `DOMAINS_DIR`
- * names) wins unconditionally and keeps the legacy layout under the override
- * root.
+ * This is NOT a credential chain. Credentials and the service authority come
+ * from the ONE shared resolver in @hasna/contracts (see
+ * `../lib/domains-resolver.ts`); this module only answers where the local
+ * store lives when the operator explicitly opted into it.
+ *
+ * The default is the legacy `~/.hasna/domains` root, which IS the shared
+ * `~/.hasna` root the resolver's disk tier already reads
+ * (`~/.hasna/domains/config/credentials`), so the local data and the
+ * credential file stay under one operator-known namespace. When `HASNA_HOME`
+ * (the shared root override @hasna/contracts honours) is set, the local data
+ * root follows it: `$HASNA_HOME/domains`.
+ *
+ * STRIPPED (2026-09-06, hasna/apps#1720 class B): the in-package reimplementation
+ * of the deleted @hasna/paths resolver, the XDG data/config home layout,
+ * `~/.config/hasna` / `$XDG_CONFIG_HOME` / `$XDG_DATA_HOME` consultation, and
+ * the one-time migrations from the pre-XDG layout. Nothing in this package
+ * consults those locations any more. An exact-app override
+ * (`HASNA_DOMAINS_HOME` / `HASNA_DOMAINS_DIR` win over their legacy unprefixed
+ * aliases) still names a concrete local store root and keeps the legacy layout
+ * under it.
  *
  * Everything accepts an explicit env object (default `process.env`) so the
- * resolver is deterministic in tests and honors the same `$HOME`-first home
- * resolution the package has always used.
+ * resolver is deterministic in tests.
  */
 export declare const APP: "domains";
 /** The effective user home, mirroring the pre-existing domains resolution (`HOME` || `USERPROFILE` || os.homedir()). */
 export declare function effectiveHome(env?: NodeJS.ProcessEnv): string;
-/** Pre-XDG default home: ~/.hasna/domains. */
-export declare function legacyHomeDir(env?: NodeJS.ProcessEnv): string;
-/**
- * The @hasna/paths-resolved data home for domains (XDG / macOS home layout).
- * The home override mirrors the pre-existing `$HOME`-first resolution, and the
- * env object is passed through so `HASNA_DATA_HOME` in the caller's env (not
- * only process.env) is honored.
- */
-export declare function resolverHome(env?: NodeJS.ProcessEnv): string;
-/**
- * Whether the resolver (XDG) home should be adopted as the store home. The
- * resolver home is adopted only when the operator has set `HASNA_DATA_HOME`
- * (a deliberate opt-in to the XDG layout) or the store has already been
- * physically migrated there (`domains.db` exists). A machine that only
- * redirects another kind (e.g. cache to tmpfs) must NOT have its data home
- * moved, and a live store at the legacy home must never become invisible on
- * upgrade.
- */
-export declare function adoptResolverHome(resolved: string, env?: NodeJS.ProcessEnv): boolean;
 /**
- * The exact-app override root, when set: `HASNA_DOMAINS_HOME` / `DOMAINS_HOME`
- * (the wave-wide names), then the pre-existing `HASNA_DOMAINS_DIR` /
- * `DOMAINS_DIR` aliases. Wins unconditionally and keeps the legacy layout
- * under the override root.
+ * The exact-app override root, when set: `HASNA_DOMAINS_HOME` /
+ * `HASNA_DOMAINS_DIR` (the canonical names) win over the legacy unprefixed
+ * `DOMAINS_HOME` / `DOMAINS_DIR` aliases. Wins unconditionally and keeps the
+ * legacy layout under the override root.
  */
 export declare function exactAppOverride(env?: NodeJS.ProcessEnv): string | undefined;
 /**
- * The effective app home: the exact-app override wins unconditionally;
- * otherwise the resolver (XDG) data home once adopted (`HASNA_DATA_HOME` set,
- * or the store already migrated there); otherwise the legacy
- * `~/.hasna/domains` default — an existing store and config never become
- * invisible on upgrade.
+ * The effective local data home: the exact-app override wins unconditionally;
+ * otherwise `$HASNA_HOME/domains` (the shared-root override) or the legacy
+ * `~/.hasna/domains` default.
  */
-export declare function appHome(env?: NodeJS.ProcessEnv): string;
-/** The default SQLite db path, at the root of the effective home. */
+export declare function appDataHome(env?: NodeJS.ProcessEnv): string;
+/** The default SQLite db path, at the root of the effective data home. */
 export declare function getDefaultDbPath(env?: NodeJS.ProcessEnv): string;
-/** The default config path, at the root of the effective home. */
+/** The default config path, at the root of the effective data home. */
 export declare function getDefaultConfigPath(env?: NodeJS.ProcessEnv): string;
 //# sourceMappingURL=app-home.d.ts.map

package/dist/lib/app-home.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"app-home.d.ts","sourceRoot":"","sources":["../../src/lib/app-home.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;GAiBG;AAOH,eAAO,MAAM,GAAG,EAAG,SAAkB,CAAC;AAEtC,wHAAwH;AACxH,wBAAgB,aAAa,CAAC,GAAG,GAAE,MAAM,CAAC,UAAwB,GAAG,MAAM,CAE1E;AAED,8CAA8C;AAC9C,wBAAgB,aAAa,CAAC,GAAG,GAAE,MAAM,CAAC,UAAwB,GAAG,MAAM,CAE1E;AAED;;;;;GAKG;AACH,wBAAgB,YAAY,CAAC,GAAG,GAAE,MAAM,CAAC,UAAwB,GAAG,MAAM,CAGzE;AAED;;;;;;;;GAQG;AACH,wBAAgB,iBAAiB,CAC/B,QAAQ,EAAE,MAAM,EAChB,GAAG,GAAE,MAAM,CAAC,UAAwB,GACnC,OAAO,CAIT;AAED;;;;;GAKG;AACH,wBAAgB,gBAAgB,CAAC,GAAG,GAAE,MAAM,CAAC,UAAwB,GAAG,MAAM,GAAG,SAAS,CAOzF;AAED;;;;;;GAMG;AACH,wBAAgB,OAAO,CAAC,GAAG,GAAE,MAAM,CAAC,UAAwB,GAAG,MAAM,CAKpE;AAED,qEAAqE;AACrE,wBAAgB,gBAAgB,CAAC,GAAG,GAAE,MAAM,CAAC,UAAwB,GAAG,MAAM,CAE7E;AAED,kEAAkE;AAClE,wBAAgB,oBAAoB,CAAC,GAAG,GAAE,MAAM,CAAC,UAAwB,GAAG,MAAM,CAEjF"}
+{"version":3,"file":"app-home.d.ts","sourceRoot":"","sources":["../../src/lib/app-home.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;GA0BG;AAKH,eAAO,MAAM,GAAG,EAAG,SAAkB,CAAC;AAEtC,wHAAwH;AACxH,wBAAgB,aAAa,CAAC,GAAG,GAAE,MAAM,CAAC,UAAwB,GAAG,MAAM,CAE1E;AAED;;;;;GAKG;AACH,wBAAgB,gBAAgB,CAAC,GAAG,GAAE,MAAM,CAAC,UAAwB,GAAG,MAAM,GAAG,SAAS,CAOzF;AAED;;;;GAIG;AACH,wBAAgB,WAAW,CAAC,GAAG,GAAE,MAAM,CAAC,UAAwB,GAAG,MAAM,CAMxE;AAED,0EAA0E;AAC1E,wBAAgB,gBAAgB,CAAC,GAAG,GAAE,MAAM,CAAC,UAAwB,GAAG,MAAM,CAE7E;AAED,uEAAuE;AACvE,wBAAgB,oBAAoB,CAAC,GAAG,GAAE,MAAM,CAAC,UAAwB,GAAG,MAAM,CAEjF"}

package/dist/lib/client-storage-policy.d.ts

@@ -0,0 +1,10 @@
+/** Legacy variables that must no longer select a client database. */
+export declare const LOCAL_PATH_VARS: readonly ["HASNA_DOMAINS_DB_PATH", "DOMAINS_DB_PATH", "HASNA_DOMAINS_DIR", "DOMAINS_DIR"];
+export type LocalOptInEnv = Record<string, string | undefined>;
+/** The first local-path var this env sets, or undefined when none is set. */
+export declare function explicitLocalPathVar(env?: LocalOptInEnv): string | undefined;
+/** Every env name that can configure a domains authority or credential, resolver-derived. */
+export declare function domainsAuthorityEnvKeys(): string[];
+/** Refuse obsolete local database configuration without exposing its value. */
+export declare function assertDomainsClientStorage(env?: LocalOptInEnv): void;
+//# sourceMappingURL=client-storage-policy.d.ts.map

package/dist/lib/client-storage-policy.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"client-storage-policy.d.ts","sourceRoot":"","sources":["../../src/lib/client-storage-policy.ts"],"names":[],"mappings":"AASA,qEAAqE;AACrE,eAAO,MAAM,eAAe,2FAKlB,CAAC;AAEX,MAAM,MAAM,aAAa,GAAG,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS,CAAC,CAAC;AAE/D,6EAA6E;AAC7E,wBAAgB,oBAAoB,CAAC,GAAG,GAAE,aAA2B,GAAG,MAAM,GAAG,SAAS,CAEzF;AAED,6FAA6F;AAC7F,wBAAgB,uBAAuB,IAAI,MAAM,EAAE,CASlD;AAED,+EAA+E;AAC/E,wBAAgB,0BAA0B,CAAC,GAAG,GAAE,aAA2B,GAAG,IAAI,CAKjF"}

package/dist/lib/client-types.d.ts

@@ -0,0 +1,184 @@
+/** An environment as the client resolver reads it. */
+export type ClientEnv = Record<string, string | undefined>;
+/** The env-key spec for one app, in precedence order. */
+export interface ClientTransportEnvKeys {
+    /** API base-URL keys, in precedence order. */
+    apiUrlKeys: string[];
+    /** API-key keys, in precedence order. */
+    apiKeyKeys: string[];
+}
+/** Which tier of the credential chain supplied a key. */
+export type CredentialTier = "argument" | "override" | "pointer" | "profile" | "keychain" | "disk" | "env";
+/**
+ * A credential resolved from one tier of the chain.
+ *
+ * `apiKey` is non-enumerable and redacted by a custom-inspect hook in the
+ * resolver, so spreading or serializing a resolution drops it. That is a
+ * runtime property of the value, not something a type can carry.
+ */
+export interface ResolvedCredential {
+    readonly apiKey: string;
+    readonly tier: CredentialTier;
+    /** An env key NAME, an absolute file path, or `keychain:<service>@<account>`. Never a value. */
+    readonly source: string;
+    /** True for tiers an operator sets on purpose. These never fall through. */
+    readonly deliberate: boolean;
+    /** For `tier === "pointer"`, the vault ITEM KEY to resolve at request time. Never a value. */
+    readonly pointerVaultKey?: string;
+    /** The disk paths consulted before this credential was chosen. */
+    readonly diskCandidates: readonly string[];
+    /** Human-readable advisory. Never contains key material. */
+    readonly warning: string | null;
+}
+/**
+ * A per-request credential source.
+ *
+ * Prefer this over a bare string for a long-lived client: the transport calls
+ * it fresh for every request, so a key rotation heals without a rebuild.
+ */
+export type CredentialProvider = () => ResolvedCredential;
+/** The captured outcome of one `security` invocation. `stdout` IS the secret. */
+export interface KeychainCommandResult {
+    /** Exit status; null when the tool could not be started or was killed. */
+    status: number | null;
+    stdout: string;
+    stderr: string;
+}
+/** Runs `/usr/bin/security` with the given argv — no shell. Injected by tests. */
+export type KeychainCommandRunner = (argv: readonly string[]) => KeychainCommandResult;
+/** Keychain-tier controls. Every field is optional; production callers pass nothing. */
+export interface KeychainTierOptions {
+    /**
+     * Whether the Keychain is consulted for a caller-built env object. The tier is
+     * AMBIENT: by default it runs only for the live `process.env`. Injecting `run`
+     * implies `true`.
+     */
+    enabled?: boolean;
+    /** Defaults to `process.platform`; the tier exists only on `"darwin"`. */
+    platform?: string;
+    /** The machine's host name (label before the first dot), used when `HASNA_STATION` is unset. */
+    hostname?: () => string;
+    /** The `security` runner. Defaults to spawning `/usr/bin/security` by argv. */
+    run?: KeychainCommandRunner;
+}
+/** Tier-1 credential inputs (`--api-key` / `--profile`) plus the Keychain-tier seam. */
+export interface CredentialChainOptions {
+    /** Tier 1: an explicit key, e.g. from `--api-key`. */
+    apiKey?: string;
+    /** Tier 1: an explicit profile name, e.g. from `--profile`. Beats `HASNA_PROFILE`. */
+    profile?: string;
+    /** Tier 3: Keychain controls — a fake `security` runner in tests, an opt-out on CI. */
+    keychain?: KeychainTierOptions;
+}
+/** Where a client reads and writes. There is one: the authenticated service API. */
+export type ClientTransportKind = "http";
+/** The transport decision, with every source named and no key value in it. */
+export interface ClientTransportResolution {
+    /** Where the client should read/write from. */
+    transport: ClientTransportKind;
+    /** What selected the transport: an env key NAME, a Keychain item reference, a file PATH, or `"default"`. */
+    transportSource: string;
+    /** `<origin>/v1` base for the server API. */
+    baseUrl: string;
+    /** WHERE the API URL came from: an env key NAME, a Keychain item reference, a file PATH, `"default"`, or null. */
+    apiUrlSource: string | null;
+    /** Whether an API key is present (value never exposed). */
+    apiKeyPresent: boolean;
+    /** WHERE the API key came from: an env key NAME or an absolute file path. Never the value. */
+    apiKeySource: string | null;
+    /** Which tier of the credential chain supplied the key. */
+    apiKeyTier: CredentialTier;
+    /** Kept for diagnostic shape compatibility; a successful resolution is never misconfigured. */
+    misconfigured: boolean;
+    /** Human-readable warning, or null. Never contains secret values. */
+    warning: string | null;
+}
+/** Query string params appended to a request URL. */
+export type QueryParams = URLSearchParams | Record<string, string | number | boolean | null | undefined | ReadonlyArray<string | number | boolean>>;
+/** Retry policy for transient failures (network errors, timeouts, 5xx, 429). */
+export interface HasnaRetryOptions {
+    /** Max RETRY attempts after the first try. Default 2 (=> up to 3 total tries). */
+    retries?: number;
+    /** Base backoff in ms for exponential backoff. Default 200. */
+    baseDelayMs?: number;
+    /** Backoff ceiling in ms. Default 2000. */
+    maxDelayMs?: number;
+    /** HTTP statuses that trigger a retry. Default 408, 425, 429, 500, 502, 503, 504. */
+    retryStatuses?: number[];
+}
+/** Per-call request options: query, idempotency, timeout, retry, extra headers. */
+export interface HasnaRequestOptions {
+    /** Query string params appended to the URL. */
+    query?: QueryParams;
+    /** Idempotency key sent as `Idempotency-Key`, making an unsafe method safe to retry. */
+    idempotencyKey?: string;
+    /** Override the transport timeout for this call (ms). */
+    timeoutMs?: number;
+    /** Extra headers merged into this call (override transport headers). */
+    headers?: Record<string, string>;
+    /** Override or disable retry for this call. `false` disables retries. */
+    retry?: HasnaRetryOptions | false;
+    /** Caller abort signal, combined with the internal timeout. */
+    signal?: AbortSignal;
+}
+/** The authenticated HTTP transport. The API key lives inside it and is never returned. */
+export interface HasnaHttpTransport {
+    readonly baseUrl: string;
+    request<T = unknown>(method: string, path: string, body?: unknown, opts?: HasnaRequestOptions): Promise<T>;
+    get<T = unknown>(path: string, opts?: HasnaRequestOptions): Promise<T>;
+    post<T = unknown>(path: string, body?: unknown, opts?: HasnaRequestOptions): Promise<T>;
+    put<T = unknown>(path: string, body?: unknown, opts?: HasnaRequestOptions): Promise<T>;
+    patch<T = unknown>(path: string, body?: unknown, opts?: HasnaRequestOptions): Promise<T>;
+    del<T = unknown>(path: string, body?: unknown, opts?: HasnaRequestOptions): Promise<T>;
+}
+/** Options for a `list()` call: filters/pagination as query params. */
+export interface StorageListOptions extends Pick<HasnaRequestOptions, "timeoutMs" | "headers" | "retry" | "signal"> {
+    /** Query params (limit, offset, cursor, filters, ...). */
+    query?: QueryParams;
+}
+/** Options for a `get()` call. */
+export type StorageGetOptions = Pick<HasnaRequestOptions, "timeoutMs" | "headers" | "retry" | "signal" | "query">;
+/** Options for a `create()` call. */
+export interface StorageCreateOptions extends Pick<HasnaRequestOptions, "timeoutMs" | "headers" | "retry" | "signal" | "query"> {
+    /** Defaults to a fresh UUID so a retried POST is deduped rather than duplicated. */
+    idempotencyKey?: string;
+}
+/** Options for an `update()` call. */
+export interface StorageUpdateOptions extends Pick<HasnaRequestOptions, "timeoutMs" | "headers" | "retry" | "signal" | "query"> {
+    /** HTTP verb for the update. Default `PATCH` (partial); use `PUT` for replace. */
+    method?: "PATCH" | "PUT";
+    /** Idempotency key. Set this to make a PATCH retry-safe too. */
+    idempotencyKey?: string;
+}
+/** Options for a `delete()` call. */
+export type StorageDeleteOptions = Pick<HasnaRequestOptions, "timeoutMs" | "headers" | "retry" | "signal" | "query">;
+/** Result of a `list()` call. `items` is the extracted array; `raw` is the full envelope. */
+export interface StorageListResult<T> {
+    items: T[];
+    /** Total count when the server reports one (`total`/`count`), else null. */
+    total: number | null;
+    /** Opaque pagination cursor when the server reports one, else null. */
+    cursor: string | null;
+    /** The full parsed response body (envelope preserved). */
+    raw: unknown;
+}
+/** The app storage interface exposed by the authenticated service API. */
+export interface HasnaStorageClient {
+    /** App slug this client targets. */
+    readonly name: string;
+    /** `<origin>/v1` base URL. */
+    readonly baseUrl: string;
+    /** The underlying HTTP transport (escape hatch for non-CRUD routes). */
+    readonly transport: HasnaHttpTransport;
+    /** List a collection. Returns extracted `items` plus the raw envelope. */
+    list<T = unknown>(resource: string, options?: StorageListOptions): Promise<StorageListResult<T>>;
+    /** Fetch one entity by id. Returns `null` on 404. */
+    get<T = unknown>(resource: string, id: string, options?: StorageGetOptions): Promise<T | null>;
+    /** Create one entity. Retry-safe via an auto `Idempotency-Key`. */
+    create<T = unknown>(resource: string, body: unknown, options?: StorageCreateOptions): Promise<T>;
+    /** Update one entity by id (PATCH by default). */
+    update<T = unknown>(resource: string, id: string, patch: unknown, options?: StorageUpdateOptions): Promise<T>;
+    /** Delete one entity by id. Resolves for 2xx and 404 (already gone). */
+    delete(resource: string, id: string, options?: StorageDeleteOptions): Promise<void>;
+}
+//# sourceMappingURL=client-types.d.ts.map

package/dist/lib/client-types.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"client-types.d.ts","sourceRoot":"","sources":["../../src/lib/client-types.ts"],"names":[],"mappings":"AAsBA,sDAAsD;AACtD,MAAM,MAAM,SAAS,GAAG,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS,CAAC,CAAC;AAE3D,yDAAyD;AACzD,MAAM,WAAW,sBAAsB;IACrC,8CAA8C;IAC9C,UAAU,EAAE,MAAM,EAAE,CAAC;IACrB,yCAAyC;IACzC,UAAU,EAAE,MAAM,EAAE,CAAC;CACtB;AAED,yDAAyD;AACzD,MAAM,MAAM,cAAc,GACtB,UAAU,GACV,UAAU,GACV,SAAS,GACT,SAAS,GACT,UAAU,GACV,MAAM,GACN,KAAK,CAAC;AAEV;;;;;;GAMG;AACH,MAAM,WAAW,kBAAkB;IACjC,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,IAAI,EAAE,cAAc,CAAC;IAC9B,gGAAgG;IAChG,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,4EAA4E;IAC5E,QAAQ,CAAC,UAAU,EAAE,OAAO,CAAC;IAC7B,8FAA8F;IAC9F,QAAQ,CAAC,eAAe,CAAC,EAAE,MAAM,CAAC;IAClC,kEAAkE;IAClE,QAAQ,CAAC,cAAc,EAAE,SAAS,MAAM,EAAE,CAAC;IAC3C,4DAA4D;IAC5D,QAAQ,CAAC,OAAO,EAAE,MAAM,GAAG,IAAI,CAAC;CACjC;AAED;;;;;GAKG;AACH,MAAM,MAAM,kBAAkB,GAAG,MAAM,kBAAkB,CAAC;AAE1D,iFAAiF;AACjF,MAAM,WAAW,qBAAqB;IACpC,0EAA0E;IAC1E,MAAM,EAAE,MAAM,GAAG,IAAI,CAAC;IACtB,MAAM,EAAE,MAAM,CAAC;IACf,MAAM,EAAE,MAAM,CAAC;CAChB;AAED,kFAAkF;AAClF,MAAM,MAAM,qBAAqB,GAAG,CAAC,IAAI,EAAE,SAAS,MAAM,EAAE,KAAK,qBAAqB,CAAC;AAEvF,wFAAwF;AACxF,MAAM,WAAW,mBAAmB;IAClC;;;;OAIG;IACH,OAAO,CAAC,EAAE,OAAO,CAAC;IAClB,0EAA0E;IAC1E,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,gGAAgG;IAChG,QAAQ,CAAC,EAAE,MAAM,MAAM,CAAC;IACxB,+EAA+E;IAC/E,GAAG,CAAC,EAAE,qBAAqB,CAAC;CAC7B;AAED,wFAAwF;AACxF,MAAM,WAAW,sBAAsB;IACrC,sDAAsD;IACtD,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,sFAAsF;IACtF,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,uFAAuF;IACvF,QAAQ,CAAC,EAAE,mBAAmB,CAAC;CAChC;AAED,oFAAoF;AACpF,MAAM,MAAM,mBAAmB,GAAG,MAAM,CAAC;AAEzC,8EAA8E;AAC9E,MAAM,WAAW,yBAAyB;IACxC,+CAA+C;IAC/C,SAAS,EAAE,mBAAmB,CAAC;IAC/B,4GAA4G;IAC5G,eAAe,EAAE,MAAM,CAAC;IACxB,6CAA6C;IAC7C,OAAO,EAAE,MAAM,CAAC;IAChB,kHAAkH;IAClH,YAAY,EAAE,MAAM,GAAG,IAAI,CAAC;IAC5B,2DAA2D;IAC3D,aAAa,EAAE,OAAO,CAAC;IACvB,8FAA8F;IAC9F,YAAY,EAAE,MAAM,GAAG,IAAI,CAAC;IAC5B,2DAA2D;IAC3D,UAAU,EAAE,cAAc,CAAC;IAC3B,+FAA+F;IAC/F,aAAa,EAAE,OAAO,CAAC;IACvB,qEAAqE;IACrE,OAAO,EAAE,MAAM,GAAG,IAAI,CAAC;CACxB;AAED,qDAAqD;AACrD,MAAM,MAAM,WAAW,GACnB,eAAe,GACf,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,GAAG,OAAO,GAAG,IAAI,GAAG,SAAS,GAAG,aAAa,CAAC,MAAM,GAAG,MAAM,GAAG,OAAO,CAAC,CAAC,CAAC;AAE5G,gFAAgF;AAChF,MAAM,WAAW,iBAAiB;IAChC,kFAAkF;IAClF,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,+DAA+D;IAC/D,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,2CAA2C;IAC3C,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,qFAAqF;IACrF,aAAa,CAAC,EAAE,MAAM,EAAE,CAAC;CAC1B;AAED,mFAAmF;AACnF,MAAM,WAAW,mBAAmB;IAClC,+CAA+C;IAC/C,KAAK,CAAC,EAAE,WAAW,CAAC;IACpB,wFAAwF;IACxF,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,yDAAyD;IACzD,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,wEAAwE;IACxE,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACjC,yEAAyE;IACzE,KAAK,CAAC,EAAE,iBAAiB,GAAG,KAAK,CAAC;IAClC,+DAA+D;IAC/D,MAAM,CAAC,EAAE,WAAW,CAAC;CACtB;AAED,2FAA2F;AAC3F,MAAM,WAAW,kBAAkB;IACjC,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,OAAO,CAAC,CAAC,GAAG,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,OAAO,EAAE,IAAI,CAAC,EAAE,mBAAmB,GAAG,OAAO,CAAC,CAAC,CAAC,CAAC;IAC3G,GAAG,CAAC,CAAC,GAAG,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,mBAAmB,GAAG,OAAO,CAAC,CAAC,CAAC,CAAC;IACvE,IAAI,CAAC,CAAC,GAAG,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,OAAO,EAAE,IAAI,CAAC,EAAE,mBAAmB,GAAG,OAAO,CAAC,CAAC,CAAC,CAAC;IACxF,GAAG,CAAC,CAAC,GAAG,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,OAAO,EAAE,IAAI,CAAC,EAAE,mBAAmB,GAAG,OAAO,CAAC,CAAC,CAAC,CAAC;IACvF,KAAK,CAAC,CAAC,GAAG,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,OAAO,EAAE,IAAI,CAAC,EAAE,mBAAmB,GAAG,OAAO,CAAC,CAAC,CAAC,CAAC;IACzF,GAAG,CAAC,CAAC,GAAG,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,OAAO,EAAE,IAAI,CAAC,EAAE,mBAAmB,GAAG,OAAO,CAAC,CAAC,CAAC,CAAC;CACxF;AAED,uEAAuE;AACvE,MAAM,WAAW,kBAAmB,SAAQ,IAAI,CAAC,mBAAmB,EAAE,WAAW,GAAG,SAAS,GAAG,OAAO,GAAG,QAAQ,CAAC;IACjH,0DAA0D;IAC1D,KAAK,CAAC,EAAE,WAAW,CAAC;CACrB;AAED,kCAAkC;AAClC,MAAM,MAAM,iBAAiB,GAAG,IAAI,CAAC,mBAAmB,EAAE,WAAW,GAAG,SAAS,GAAG,OAAO,GAAG,QAAQ,GAAG,OAAO,CAAC,CAAC;AAElH,qCAAqC;AACrC,MAAM,WAAW,oBACf,SAAQ,IAAI,CAAC,mBAAmB,EAAE,WAAW,GAAG,SAAS,GAAG,OAAO,GAAG,QAAQ,GAAG,OAAO,CAAC;IACzF,oFAAoF;IACpF,cAAc,CAAC,EAAE,MAAM,CAAC;CACzB;AAED,sCAAsC;AACtC,MAAM,WAAW,oBACf,SAAQ,IAAI,CAAC,mBAAmB,EAAE,WAAW,GAAG,SAAS,GAAG,OAAO,GAAG,QAAQ,GAAG,OAAO,CAAC;IACzF,kFAAkF;IAClF,MAAM,CAAC,EAAE,OAAO,GAAG,KAAK,CAAC;IACzB,gEAAgE;IAChE,cAAc,CAAC,EAAE,MAAM,CAAC;CACzB;AAED,qCAAqC;AACrC,MAAM,MAAM,oBAAoB,GAAG,IAAI,CAAC,mBAAmB,EAAE,WAAW,GAAG,SAAS,GAAG,OAAO,GAAG,QAAQ,GAAG,OAAO,CAAC,CAAC;AAErH,6FAA6F;AAC7F,MAAM,WAAW,iBAAiB,CAAC,CAAC;IAClC,KAAK,EAAE,CAAC,EAAE,CAAC;IACX,4EAA4E;IAC5E,KAAK,EAAE,MAAM,GAAG,IAAI,CAAC;IACrB,uEAAuE;IACvE,MAAM,EAAE,MAAM,GAAG,IAAI,CAAC;IACtB,0DAA0D;IAC1D,GAAG,EAAE,OAAO,CAAC;CACd;AAED,0EAA0E;AAC1E,MAAM,WAAW,kBAAkB;IACjC,oCAAoC;IACpC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,8BAA8B;IAC9B,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,wEAAwE;IACxE,QAAQ,CAAC,SAAS,EAAE,kBAAkB,CAAC;IAEvC,0EAA0E;IAC1E,IAAI,CAAC,CAAC,GAAG,OAAO,EAAE,QAAQ,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,kBAAkB,GAAG,OAAO,CAAC,iBAAiB,CAAC,CAAC,CAAC,CAAC,CAAC;IACjG,qDAAqD;IACrD,GAAG,CAAC,CAAC,GAAG,OAAO,EAAE,QAAQ,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,iBAAiB,GAAG,OAAO,CAAC,CAAC,GAAG,IAAI,CAAC,CAAC;IAC/F,mEAAmE;IACnE,MAAM,CAAC,CAAC,GAAG,OAAO,EAAE,QAAQ,EAAE,MAAM,EAAE,IAAI,EAAE,OAAO,EAAE,OAAO,CAAC,EAAE,oBAAoB,GAAG,OAAO,CAAC,CAAC,CAAC,CAAC;IACjG,kDAAkD;IAClD,MAAM,CAAC,CAAC,GAAG,OAAO,EAAE,QAAQ,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE,OAAO,EAAE,OAAO,CAAC,EAAE,oBAAoB,GAAG,OAAO,CAAC,CAAC,CAAC,CAAC;IAC9G,wEAAwE;IACxE,MAAM,CAAC,QAAQ,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,oBAAoB,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;CACrF"}

package/dist/lib/cloudflare.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"cloudflare.d.ts","sourceRoot":"","sources":["../../src/lib/cloudflare.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,OAAO,KAAK,EAEV,WAAW,EACX,uBAAuB,EAIxB,MAAM,gBAAgB,CAAC;AACxB,OAAO,EAGL,KAAK,gBAAgB,EACtB,MAAM,sBAAsB,CAAC;AAE9B,YAAY,EAAE,gBAAgB,EAAE,CAAC;AAIjC,MAAM,WAAW,cAAc;IAC7B,EAAE,EAAE,MAAM,CAAC;IACX,IAAI,EAAE,MAAM,CAAC;IACb,MAAM,EAAE,MAAM,CAAC;IACf,WAAW,EAAE,MAAM,EAAE,CAAC;IACtB,oBAAoB,CAAC,EAAE,MAAM,EAAE,CAAC;CACjC;AAED,MAAM,WAAW,gBAAgB;IAC/B,EAAE,CAAC,EAAE,MAAM,CAAC;IACZ,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,EAAE,MAAM,CAAC;IAChB,GAAG,EAAE,MAAM,CAAC;IACZ,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,OAAO,CAAC,EAAE,OAAO,CAAC;CACnB;AAID,wBAAgB,SAAS,IAAI,gBAAgB,CAE5C;AAqCD,wBAAsB,SAAS,CAAC,MAAM,CAAC,EAAE,gBAAgB,GAAG,OAAO,CAAC,cAAc,EAAE,CAAC,CAkBpF;AAED,wBAAsB,OAAO,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,gBAAgB,GAAG,OAAO,CAAC,cAAc,GAAG,IAAI,CAAC,CAQvG;AAED,wBAAsB,UAAU,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,gBAAgB,GAAG,OAAO,CAAC,cAAc,CAAC,CAUnG;AAED;;;;;;;GAOG;AACH,wBAAsB,UAAU,CAC9B,MAAM,EAAE,MAAM,EACd,MAAM,CAAC,EAAE,gBAAgB,EACzB,IAAI,CAAC,EAAE;IACL,OAAO,EAAE,CAAC,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC,EAAE,gBAAgB,KAAK,OAAO,CAAC,cAAc,GAAG,IAAI,CAAC,CAAC;IAC7E,UAAU,EAAE,CAAC,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC,EAAE,gBAAgB,KAAK,OAAO,CAAC,cAAc,CAAC,CAAC;CAC1E,GACA,OAAO,CAAC,cAAc,CAAC,CASzB;AAED,wBAAsB,UAAU,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,gBAAgB,GAAG,OAAO,CAAC,IAAI,CAAC,CAEzF;AAID,wBAAsB,WAAW,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,gBAAgB,GAAG,OAAO,CAAC,gBAAgB,EAAE,CAAC,CAkBxG;AAkBD,wBAAsB,YAAY,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,gBAAgB,EAAE,MAAM,CAAC,EAAE,gBAAgB,GAAG,OAAO,CAAC,IAAI,CAAC,CAsBrH;AA+FD,wBAAsB,YAAY,CAAC,MAAM,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,gBAAgB,GAAG,OAAO,CAAC,IAAI,CAAC,CAE7G;AAED,wBAAsB,sBAAsB,CAAC,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,gBAAgB,GAAG,OAAO,CAAC,IAAI,CAAC,CAQjI;AA4BD,wBAAgB,wBAAwB,CAAC,MAAM,CAAC,EAAE,gBAAgB,GAAG,WAAW,GAAG,uBAAuB,CA6FzG"}
+{"version":3,"file":"cloudflare.d.ts","sourceRoot":"","sources":["../../src/lib/cloudflare.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,OAAO,KAAK,EAEV,WAAW,EACX,uBAAuB,EAIxB,MAAM,gBAAgB,CAAC;AACxB,OAAO,EAGL,KAAK,gBAAgB,EACtB,MAAM,sBAAsB,CAAC;AAE9B,YAAY,EAAE,gBAAgB,EAAE,CAAC;AAIjC,MAAM,WAAW,cAAc;IAC7B,EAAE,EAAE,MAAM,CAAC;IACX,IAAI,EAAE,MAAM,CAAC;IACb,MAAM,EAAE,MAAM,CAAC;IACf,WAAW,EAAE,MAAM,EAAE,CAAC;IACtB,oBAAoB,CAAC,EAAE,MAAM,EAAE,CAAC;CACjC;AAED,MAAM,WAAW,gBAAgB;IAC/B,EAAE,CAAC,EAAE,MAAM,CAAC;IACZ,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,EAAE,MAAM,CAAC;IAChB,GAAG,EAAE,MAAM,CAAC;IACZ,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,OAAO,CAAC,EAAE,OAAO,CAAC;CACnB;AAID,wBAAgB,SAAS,IAAI,gBAAgB,CAE5C;AAqCD,wBAAsB,SAAS,CAAC,MAAM,CAAC,EAAE,gBAAgB,GAAG,OAAO,CAAC,cAAc,EAAE,CAAC,CAkBpF;AAED,wBAAsB,OAAO,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,gBAAgB,GAAG,OAAO,CAAC,cAAc,GAAG,IAAI,CAAC,CAQvG;AAED,wBAAsB,UAAU,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,gBAAgB,GAAG,OAAO,CAAC,cAAc,CAAC,CAUnG;AAED;;;;;;;GAOG;AACH,wBAAsB,UAAU,CAC9B,MAAM,EAAE,MAAM,EACd,MAAM,CAAC,EAAE,gBAAgB,EACzB,IAAI,CAAC,EAAE;IACL,OAAO,EAAE,CAAC,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC,EAAE,gBAAgB,KAAK,OAAO,CAAC,cAAc,GAAG,IAAI,CAAC,CAAC;IAC7E,UAAU,EAAE,CAAC,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC,EAAE,gBAAgB,KAAK,OAAO,CAAC,cAAc,CAAC,CAAC;CAC1E,GACA,OAAO,CAAC,cAAc,CAAC,CASzB;AAED,wBAAsB,UAAU,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,gBAAgB,GAAG,OAAO,CAAC,IAAI,CAAC,CAEzF;AAID,wBAAsB,WAAW,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,gBAAgB,GAAG,OAAO,CAAC,gBAAgB,EAAE,CAAC,CAkBxG;AAkBD,wBAAsB,YAAY,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,gBAAgB,EAAE,MAAM,CAAC,EAAE,gBAAgB,GAAG,OAAO,CAAC,IAAI,CAAC,CAsBrH;AA+FD,wBAAsB,YAAY,CAAC,MAAM,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,gBAAgB,GAAG,OAAO,CAAC,IAAI,CAAC,CAE7G;AAED,wBAAsB,sBAAsB,CAAC,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,gBAAgB,GAAG,OAAO,CAAC,IAAI,CAAC,CAQjI;AA4BD,wBAAgB,wBAAwB,CAAC,MAAM,CAAC,EAAE,gBAAgB,GAAG,WAAW,GAAG,uBAAuB,CAuHzG"}

package/dist/lib/cloudflare.js

@@ -426,6 +426,29 @@ function createCloudflareProvider(config) {
         await replaceRecordsByNameType(zone.id, replacement, cfg);
       }
       return true;
+    },
+    async deleteDnsRecords(domain, records) {
+      const zone = await getZone(domain, cfg);
+      if (!zone)
+        throw new Error(`No Cloudflare zone found for ${domain}`);
+      const grouped = new Map;
+      for (const record of records) {
+        const key = `${record.type}|${record.name}`;
+        const group = grouped.get(key) ?? [];
+        group.push(record);
+        grouped.set(key, group);
+      }
+      for (const group of grouped.values()) {
+        const { type, name } = group[0];
+        const existing = await listRecordsByNameType(zone.id, type, name, cfg);
+        for (const record of group) {
+          const match = existing.find((candidate) => candidate.content === record.value && (candidate.priority ?? undefined) === (record.priority ?? undefined));
+          if (match?.id) {
+            await deleteRecord(zone.id, match.id, cfg);
+          }
+        }
+      }
+      return true;
     }
   };
 }

package/dist/lib/config.d.ts

@@ -1,5 +1,10 @@
 /**
  * Persistent config stored in the domains config directory.
+ *
+ * This is a SETTINGS store — registrant contact defaults, registrar/DNS
+ * defaults, the purchase AWS profile. It never holds an API key: credentials
+ * come from the shared @hasna/contracts resolver only (see
+ * `../lib/domains-resolver.ts`).
  */
 export interface DomainContact {
     first_name?: string;
@@ -28,24 +33,9 @@ export interface DomainsConfig {
 export declare function getPurchaseProfile(): string | undefined;
 /** Set AWS_PROFILE from config for purchase ops if no explicit creds are set. */
 export declare function applyPurchaseProfile(): string | undefined;
-export interface LegacyConfigMigrationReport {
-    dryRun: boolean;
-    wouldCopy: boolean;
-    copied: boolean;
-}
-/**
- * One-time migration from the previous XDG config default
- * ($XDG_CONFIG_HOME/open-domains/config.json) into the canonical
- * ~/.hasna/domains/config.json. Copies, verifies by size and sha256, records a
- * receipt, never deletes the source, never overwrites existing canonical data,
- * and is idempotent (receipt + canonical file both skip it). dryRun reports
- * whether the config would be copied and writes nothing.
- */
-export declare function migrateLegacyConfig(env?: NodeJS.ProcessEnv, dryRun?: boolean): LegacyConfigMigrationReport;
 /**
  * The default config location — `config.json` at the root of the effective
- * domains home, resolved through `@hasna/paths` (legacy `~/.hasna/domains`
- * until the XDG data home is adopted). Env overrides (DOMAINS_CONFIG_PATH /
+ * local data home (see `app-home.ts`). Env overrides (DOMAINS_CONFIG_PATH /
  * DOMAINS_CONFIG_DIR) are honored unchanged and win over the default.
  */
 export declare function getConfigPath(env?: NodeJS.ProcessEnv): string;

package/dist/lib/config.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"config.d.ts","sourceRoot":"","sources":["../../src/lib/config.ts"],"names":[],"mappings":"AAAA;;GAEG;AAQH,MAAM,WAAW,aAAa;IAC5B,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,iBAAiB,CAAC,EAAE,MAAM,CAAC;CAC5B;AAED,MAAM,WAAW,aAAa;IAC5B,iBAAiB,CAAC,EAAE,MAAM,CAAC;IAC3B,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,uEAAuE;IACvE,oBAAoB,CAAC,EAAE,MAAM,CAAC;IAC9B,OAAO,CAAC,EAAE,aAAa,CAAC;CACzB;AAED;;;;GAIG;AACH,wBAAgB,kBAAkB,IAAI,MAAM,GAAG,SAAS,CAIvD;AAED,iFAAiF;AACjF,wBAAgB,oBAAoB,IAAI,MAAM,GAAG,SAAS,CAKzD;AAMD,MAAM,WAAW,2BAA2B;IAC1C,MAAM,EAAE,OAAO,CAAC;IAChB,SAAS,EAAE,OAAO,CAAC;IACnB,MAAM,EAAE,OAAO,CAAC;CACjB;AAED;;;;;;;GAOG;AACH,wBAAgB,mBAAmB,CACjC,GAAG,GAAE,MAAM,CAAC,UAAwB,EACpC,MAAM,UAAQ,GACb,2BAA2B,CAuC7B;AAED;;;;;GAKG;AACH,wBAAgB,aAAa,CAAC,GAAG,GAAE,MAAM,CAAC,UAAwB,GAAG,MAAM,CAW1E;AAED,wBAAgB,UAAU,CAAC,GAAG,GAAE,MAAM,CAAC,UAAwB,GAAG,aAAa,CAQ9E;AAED,wBAAgB,UAAU,CAAC,MAAM,EAAE,aAAa,EAAE,GAAG,GAAE,MAAM,CAAC,UAAwB,GAAG,IAAI,CAK5F;AAED,wBAAgB,YAAY,CAAC,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,GAAG,GAAE,MAAM,CAAC,UAAwB,GAAG,aAAa,CAehH;AAED,mGAAmG;AACnG,wBAAgB,cAAc,CAAC,IAAI,EAAE;IACnC,KAAK,CAAC,EAAE,MAAM,CAAC;IAAC,SAAS,CAAC,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,EAAE,MAAM,CAAC;IACtD,KAAK,CAAC,EAAE,MAAM,CAAC;IAAC,OAAO,CAAC,EAAE,MAAM,CAAC;IAAC,IAAI,CAAC,EAAE,MAAM,CAAC;IAAC,KAAK,CAAC,EAAE,MAAM,CAAC;IAChE,OAAO,CAAC,EAAE,MAAM,CAAC;IAAC,GAAG,CAAC,EAAE,MAAM,CAAC;IAAC,GAAG,CAAC,EAAE,MAAM,CAAC;CAC9C,GAAG;IACF,UAAU,EAAE,MAAM,CAAC;IAAC,SAAS,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,MAAM,CAAC;IACpE,cAAc,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,MAAM,CAAC;IAAC,YAAY,EAAE,MAAM,CAAC;IAC1E,QAAQ,EAAE,MAAM,CAAC;IAAC,iBAAiB,CAAC,EAAE,MAAM,CAAC;CAC9C,CA2BA;AAED,wBAAgB,YAAY,CAAC,OAAO,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS,CAUhE"}
+{"version":3,"file":"config.d.ts","sourceRoot":"","sources":["../../src/lib/config.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAMH,MAAM,WAAW,aAAa;IAC5B,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,iBAAiB,CAAC,EAAE,MAAM,CAAC;CAC5B;AAED,MAAM,WAAW,aAAa;IAC5B,iBAAiB,CAAC,EAAE,MAAM,CAAC;IAC3B,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,uEAAuE;IACvE,oBAAoB,CAAC,EAAE,MAAM,CAAC;IAC9B,OAAO,CAAC,EAAE,aAAa,CAAC;CACzB;AAED;;;;GAIG;AACH,wBAAgB,kBAAkB,IAAI,MAAM,GAAG,SAAS,CAIvD;AAED,iFAAiF;AACjF,wBAAgB,oBAAoB,IAAI,MAAM,GAAG,SAAS,CAKzD;AAED;;;;GAIG;AACH,wBAAgB,aAAa,CAAC,GAAG,GAAE,MAAM,CAAC,UAAwB,GAAG,MAAM,CAM1E;AAED,wBAAgB,UAAU,CAAC,GAAG,GAAE,MAAM,CAAC,UAAwB,GAAG,aAAa,CAQ9E;AAED,wBAAgB,UAAU,CAAC,MAAM,EAAE,aAAa,EAAE,GAAG,GAAE,MAAM,CAAC,UAAwB,GAAG,IAAI,CAK5F;AAED,wBAAgB,YAAY,CAAC,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,GAAG,GAAE,MAAM,CAAC,UAAwB,GAAG,aAAa,CAehH;AAED,mGAAmG;AACnG,wBAAgB,cAAc,CAAC,IAAI,EAAE;IACnC,KAAK,CAAC,EAAE,MAAM,CAAC;IAAC,SAAS,CAAC,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,EAAE,MAAM,CAAC;IACtD,KAAK,CAAC,EAAE,MAAM,CAAC;IAAC,OAAO,CAAC,EAAE,MAAM,CAAC;IAAC,IAAI,CAAC,EAAE,MAAM,CAAC;IAAC,KAAK,CAAC,EAAE,MAAM,CAAC;IAChE,OAAO,CAAC,EAAE,MAAM,CAAC;IAAC,GAAG,CAAC,EAAE,MAAM,CAAC;IAAC,GAAG,CAAC,EAAE,MAAM,CAAC;CAC9C,GAAG;IACF,UAAU,EAAE,MAAM,CAAC;IAAC,SAAS,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,MAAM,CAAC;IACpE,cAAc,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,MAAM,CAAC;IAAC,YAAY,EAAE,MAAM,CAAC;IAC1E,QAAQ,EAAE,MAAM,CAAC;IAAC,iBAAiB,CAAC,EAAE,MAAM,CAAC;CAC9C,CA2BA;AAED,wBAAgB,YAAY,CAAC,OAAO,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS,CAUhE"}

package/dist/lib/dns-plan.d.ts

@@ -26,5 +26,5 @@ export declare function selectChangedDnsRecords(plan: DnsPlan, desired: Provider
 export declare function getDnsApplyBlockReason(plan: DnsPlan, opts: {
     yes?: boolean;
     allowDelete?: boolean;
-}): DnsApplyBlockReason | undefined;
+}, deleteSupported?: boolean): DnsApplyBlockReason | undefined;
 //# sourceMappingURL=dns-plan.d.ts.map

package/dist/lib/dns-plan.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"dns-plan.d.ts","sourceRoot":"","sources":["../../src/lib/dns-plan.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,gBAAgB,CAAC;AAExD,MAAM,WAAW,eAAe;IAC9B,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,OAAO,EAAE,iBAAiB,EAAE,CAAC;CAC9B;AAED,MAAM,MAAM,oBAAoB,GAAG,QAAQ,GAAG,QAAQ,GAAG,QAAQ,GAAG,WAAW,CAAC;AAEhF,MAAM,WAAW,gBAAgB;IAC/B,EAAE,EAAE,oBAAoB,CAAC;IACzB,MAAM,EAAE,iBAAiB,CAAC;IAC1B,OAAO,CAAC,EAAE,iBAAiB,CAAC;CAC7B;AAED,MAAM,WAAW,OAAO;IACtB,MAAM,EAAE,MAAM,CAAC;IACf,OAAO,EAAE,MAAM,CAAC;IAChB,OAAO,EAAE,MAAM,CAAC;IAChB,OAAO,EAAE,MAAM,CAAC;IAChB,SAAS,EAAE,MAAM,CAAC;IAClB,UAAU,EAAE,gBAAgB,EAAE,CAAC;CAChC;AAED,MAAM,MAAM,mBAAmB,GAAG,uBAAuB,GAAG,8BAA8B,GAAG,0BAA0B,CAAC;AAMxH,wBAAgB,kBAAkB,CAAC,MAAM,EAAE,iBAAiB,EAAE,MAAM,EAAE,MAAM,GAAG,iBAAiB,CAmB/F;AAED,wBAAgB,oBAAoB,CAAC,KAAK,EAAE,MAAM,EAAE,UAAU,CAAC,EAAE,MAAM,GAAG,eAAe,CA8BxF;AAUD,wBAAgB,aAAa,CAAC,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,iBAAiB,EAAE,EAAE,OAAO,EAAE,iBAAiB,EAAE,GAAG,OAAO,CAgCjH;AAED,wBAAgB,cAAc,CAAC,IAAI,EAAE,OAAO,GAAG,OAAO,CAErD;AAMD,wBAAgB,uBAAuB,CAAC,IAAI,EAAE,OAAO,EAAE,OAAO,EAAE,iBAAiB,EAAE,GAAG,iBAAiB,EAAE,CASxG;AAED,wBAAgB,sBAAsB,CAAC,IAAI,EAAE,OAAO,EAAE,IAAI,EAAE;IAAE,GAAG,CAAC,EAAE,OAAO,CAAC;IAAC,WAAW,CAAC,EAAE,OAAO,CAAA;CAAE,GAAG,mBAAmB,GAAG,SAAS,CAMrI"}
+{"version":3,"file":"dns-plan.d.ts","sourceRoot":"","sources":["../../src/lib/dns-plan.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,gBAAgB,CAAC;AAExD,MAAM,WAAW,eAAe;IAC9B,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,OAAO,EAAE,iBAAiB,EAAE,CAAC;CAC9B;AAED,MAAM,MAAM,oBAAoB,GAAG,QAAQ,GAAG,QAAQ,GAAG,QAAQ,GAAG,WAAW,CAAC;AAEhF,MAAM,WAAW,gBAAgB;IAC/B,EAAE,EAAE,oBAAoB,CAAC;IACzB,MAAM,EAAE,iBAAiB,CAAC;IAC1B,OAAO,CAAC,EAAE,iBAAiB,CAAC;CAC7B;AAED,MAAM,WAAW,OAAO;IACtB,MAAM,EAAE,MAAM,CAAC;IACf,OAAO,EAAE,MAAM,CAAC;IAChB,OAAO,EAAE,MAAM,CAAC;IAChB,OAAO,EAAE,MAAM,CAAC;IAChB,SAAS,EAAE,MAAM,CAAC;IAClB,UAAU,EAAE,gBAAgB,EAAE,CAAC;CAChC;AAED,MAAM,MAAM,mBAAmB,GAAG,uBAAuB,GAAG,8BAA8B,GAAG,0BAA0B,CAAC;AAMxH,wBAAgB,kBAAkB,CAAC,MAAM,EAAE,iBAAiB,EAAE,MAAM,EAAE,MAAM,GAAG,iBAAiB,CAmB/F;AAED,wBAAgB,oBAAoB,CAAC,KAAK,EAAE,MAAM,EAAE,UAAU,CAAC,EAAE,MAAM,GAAG,eAAe,CA8BxF;AAUD,wBAAgB,aAAa,CAAC,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,iBAAiB,EAAE,EAAE,OAAO,EAAE,iBAAiB,EAAE,GAAG,OAAO,CAgCjH;AAED,wBAAgB,cAAc,CAAC,IAAI,EAAE,OAAO,GAAG,OAAO,CAErD;AAMD,wBAAgB,uBAAuB,CAAC,IAAI,EAAE,OAAO,EAAE,OAAO,EAAE,iBAAiB,EAAE,GAAG,iBAAiB,EAAE,CASxG;AAED,wBAAgB,sBAAsB,CACpC,IAAI,EAAE,OAAO,EACb,IAAI,EAAE;IAAE,GAAG,CAAC,EAAE,OAAO,CAAC;IAAC,WAAW,CAAC,EAAE,OAAO,CAAA;CAAE,EAC9C,eAAe,UAAQ,GACtB,mBAAmB,GAAG,SAAS,CAMjC"}

package/dist/lib/domains-resolver.d.ts

@@ -0,0 +1,96 @@
+import type { ClientEnv, ClientTransportResolution, CredentialChainOptions, CredentialTier, HasnaStorageClient, ResolvedCredential } from "./client-types.js";
+/** The app slug the shared client seam resolves credentials and authority for. */
+export declare const DOMAINS_APP_NAME: "domains";
+export { domainsAuthorityEnvKeys } from "./client-storage-policy.js";
+/**
+ * The environment as the resolver should see it: every authority/credential
+ * variable that is DECLARED BUT BLANK removed.
+ *
+ * A blank has always been this package's spelling for "not configured" — it is
+ * how fixtures scrub an inherited environment and how wrappers spell
+ * `HASNA_DOMAINS_API_URL="${MAYBE_UNSET}"`. @hasna/contracts takes the
+ * opposite and, for its purposes, correct view: a declared-but-blank credential
+ * is a misconfiguration it refuses loudly rather than resolving around.
+ *
+ * Both are right at their own layer, and the mismatch is not hypothetical: an
+ * environment carrying a real `HASNA_DOMAINS_API_KEY` alongside a blank legacy
+ * alias — the exact shape a scrubbed-then-overridden fixture produces — is a
+ * complete, unambiguous configuration that would otherwise be refused for the
+ * alias nobody set. Normalising here keeps "blank means unset" true at the
+ * domains seam while leaving the resolver's stricter rule intact for
+ * everything it does receive: a value that is present is still policed, and
+ * two aliases that actually disagree still refuse.
+ */
+export declare function domainsResolverEnv<T extends ClientEnv>(env: T): T;
+/** The env object and credential options a domains surface hands @hasna/contracts. */
+export interface DomainsResolverInputs<T extends ClientEnv> {
+    /** The environment with every declared-but-blank authority variable removed. */
+    env: T;
+    /** The chain options, with the Keychain tier's ambient gate already decided. */
+    credentials: CredentialChainOptions;
+}
+/**
+ * Build the resolver's inputs: the normalised environment AND the credential
+ * options that keep the machine's Keychain tier reachable across it. See the
+ * module header for why the gate has to travel with the copy.
+ *
+ * An explicit `enabled` from the caller still wins, and an injected `run`
+ * (which @hasna/contracts already treats as "enabled") is left alone, so the
+ * hermetic seam tests rely on is untouched. When there is no blank to remove
+ * the inputs pass through by identity, exactly as before — the CLI hands the
+ * resolver `process.env` itself, never a copy.
+ */
+export declare function domainsResolverInputs<T extends ClientEnv>(env: T, credentials?: CredentialChainOptions): DomainsResolverInputs<T>;
+/**
+ * Options a domains surface forwards to the shared resolver: tier-1 credential
+ * inputs and the Keychain-tier seam.
+ */
+export interface DomainsResolverOptions {
+    /** Tier-1 credential inputs (`--api-key` / `--profile`) and Keychain controls. */
+    credentials?: CredentialChainOptions;
+}
+/**
+ * The transport report a caller can see — sources, tier, authority — with no
+ * key value in it. `baseUrl` is the `<origin>/v1` base the resolver produced.
+ */
+export interface DomainsTransportReport {
+    transport: "http";
+    /** `<origin>/v1` base for the server API. */
+    baseUrl: string;
+    /** WHERE the API URL came from: env key NAME, Keychain reference, file PATH, or `"default"`. */
+    apiUrlSource: string;
+    /** WHERE the API key came from: env key NAME, Keychain reference, or file PATH. Never a value. */
+    apiKeySource: string;
+    /** Which tier of the credential chain supplied the key. */
+    apiKeyTier: CredentialTier;
+}
+/**
+ * Resolve the domains authority and credential through the shared chain,
+ * FRESH, and return both the report and the credential VALUE.
+ *
+ * Throws a fail-closed `Error` (prefixed `domains fails closed: …`) that names
+ * the canonical env pair when no credential resolves from any tier, when a
+ * deliberate tier cannot be honoured, or when the configured authorities
+ * disagree — never a quiet fall-through to local data.
+ */
+export declare function resolveDomainsTransport(env?: ClientEnv, options?: DomainsResolverOptions): {
+    report: DomainsTransportReport;
+    credential: ResolvedCredential;
+};
+/** A resolved HTTP storage client plus the decision that produced it. */
+export interface ResolvedDomainsHttpClient {
+    transport: "http";
+    client: HasnaStorageClient;
+    resolution: ClientTransportResolution;
+}
+/**
+ * Resolve the authenticated domains HTTP client for this environment.
+ *
+ * The returned client resolves its credential FRESH on every request (the
+ * transport's per-request binding provider), so a key rotation heals a
+ * long-lived MCP server or daemon without a rebuild. Throws a fail-closed
+ * `Error` when no credential resolves from any tier — never a quiet
+ * fall-through to local data.
+ */
+export declare function resolveDomainsHttpClient(env?: ClientEnv, options?: DomainsResolverOptions): ResolvedDomainsHttpClient;
+//# sourceMappingURL=domains-resolver.d.ts.map

package/dist/lib/domains-resolver.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"domains-resolver.d.ts","sourceRoot":"","sources":["../../src/lib/domains-resolver.ts"],"names":[],"mappings":"AAqDA,OAAO,KAAK,EACV,SAAS,EACT,yBAAyB,EACzB,sBAAsB,EACtB,cAAc,EACd,kBAAkB,EAClB,kBAAkB,EACnB,MAAM,mBAAmB,CAAC;AAG3B,kFAAkF;AAClF,eAAO,MAAM,gBAAgB,EAAG,SAAkB,CAAC;AAEnD,OAAO,EAAE,uBAAuB,EAAE,MAAM,4BAA4B,CAAC;AAsBrE;;;;;;;;;;;;;;;;;;GAkBG;AACH,wBAAgB,kBAAkB,CAAC,CAAC,SAAS,SAAS,EAAE,GAAG,EAAE,CAAC,GAAG,CAAC,CAQjE;AAED,sFAAsF;AACtF,MAAM,WAAW,qBAAqB,CAAC,CAAC,SAAS,SAAS;IACxD,gFAAgF;IAChF,GAAG,EAAE,CAAC,CAAC;IACP,gFAAgF;IAChF,WAAW,EAAE,sBAAsB,CAAC;CACrC;AAED;;;;;;;;;;GAUG;AACH,wBAAgB,qBAAqB,CAAC,CAAC,SAAS,SAAS,EACvD,GAAG,EAAE,CAAC,EACN,WAAW,GAAE,sBAA2B,GACvC,qBAAqB,CAAC,CAAC,CAAC,CAS1B;AAED;;;GAGG;AACH,MAAM,WAAW,sBAAsB;IACrC,kFAAkF;IAClF,WAAW,CAAC,EAAE,sBAAsB,CAAC;CACtC;AAED;;;GAGG;AACH,MAAM,WAAW,sBAAsB;IACrC,SAAS,EAAE,MAAM,CAAC;IAClB,6CAA6C;IAC7C,OAAO,EAAE,MAAM,CAAC;IAChB,gGAAgG;IAChG,YAAY,EAAE,MAAM,CAAC;IACrB,kGAAkG;IAClG,YAAY,EAAE,MAAM,CAAC;IACrB,2DAA2D;IAC3D,UAAU,EAAE,cAAc,CAAC;CAC5B;AAED;;;;;;;;GAQG;AACH,wBAAgB,uBAAuB,CACrC,GAAG,GAAE,SAAuB,EAC5B,OAAO,GAAE,sBAA2B,GACnC;IAAE,MAAM,EAAE,sBAAsB,CAAC;IAAC,UAAU,EAAE,kBAAkB,CAAA;CAAE,CAGpE;AAoCD,yEAAyE;AACzE,MAAM,WAAW,yBAAyB;IACxC,SAAS,EAAE,MAAM,CAAC;IAClB,MAAM,EAAE,kBAAkB,CAAC;IAC3B,UAAU,EAAE,yBAAyB,CAAC;CACvC;AAED;;;;;;;;GAQG;AACH,wBAAgB,wBAAwB,CACtC,GAAG,GAAE,SAAuB,EAC5B,OAAO,GAAE,sBAA2B,GACnC,yBAAyB,CAiB3B"}

package/dist/lib/registrar.d.ts

@@ -100,6 +100,14 @@ export interface DnsProvider {
     dnsWriteScope?: DnsWriteScope;
     getDnsRecords(domain: string): Promise<ProviderDnsRecord[]>;
     setDnsRecords(domain: string, records: ProviderDnsRecord[]): Promise<boolean>;
+    /**
+     * Delete the EXACT live records matching the given records.
+     *
+     * Omission is conservative: `dns apply` refuses a delete plan
+     * (`delete-apply-unsupported`) unless the provider can converge on deletes through
+     * this route, so a non-deletable provider is never written into a partial state.
+     */
+    deleteDnsRecords?(domain: string, records: ProviderDnsRecord[]): Promise<boolean>;
 }
 /** A provider that does both — e.g. Route 53 */
 export type FullProvider = RegistrarProvider & DnsProvider;

package/dist/lib/registrar.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"registrar.d.ts","sourceRoot":"","sources":["../../src/lib/registrar.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,OAAO,KAAK,EAAE,MAAM,EAAE,iBAAiB,EAAE,iBAAiB,EAAE,MAAM,kBAAkB,CAAC;AAYrF,MAAM,WAAW,iBAAiB;IAChC,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,MAAM,CAAC;IACb,KAAK,EAAE,MAAM,CAAC;IACd,GAAG,EAAE,MAAM,CAAC;IACZ,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,OAAO,CAAC,EAAE,OAAO,CAAC;CACnB;AAED,MAAM,WAAW,kBAAkB;IACjC,MAAM,EAAE,MAAM,CAAC;IACf,SAAS,EAAE,MAAM,CAAC;IAClB,OAAO,EAAE,MAAM,CAAC;IAChB,OAAO,EAAE,MAAM,CAAC;IAChB,WAAW,EAAE,MAAM,EAAE,CAAC;IACtB,MAAM,EAAE,MAAM,CAAC;IACf,UAAU,EAAE,OAAO,CAAC;CACrB;AAED,MAAM,WAAW,mBAAmB;IAClC,MAAM,EAAE,MAAM,CAAC;IACf,OAAO,EAAE,OAAO,CAAC;IACjB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,aAAa,CAAC,EAAE,MAAM,CAAC;CACxB;AAED,MAAM,WAAW,2BAA2B;IAC1C,UAAU,EAAE,MAAM,CAAC;IACnB,SAAS,EAAE,MAAM,CAAC;IAClB,KAAK,EAAE,MAAM,CAAC;IACd,KAAK,EAAE,MAAM,CAAC;IACd,cAAc,EAAE,MAAM,CAAC;IACvB,IAAI,EAAE,MAAM,CAAC;IACb,KAAK,EAAE,MAAM,CAAC;IACd,YAAY,EAAE,MAAM,CAAC;IACrB,QAAQ,EAAE,MAAM,CAAC;IACjB,iBAAiB,CAAC,EAAE,MAAM,CAAC;CAC5B;AAED,MAAM,WAAW,2BAA2B;IAC1C,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,SAAS,CAAC,EAAE,OAAO,CAAC;IACpB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,WAAW,CAAC,EAAE,MAAM,EAAE,CAAC;IACvB,QAAQ,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IACnC,OAAO,CAAC,EAAE,OAAO,CAAC;CACnB;AAED,MAAM,WAAW,0BAA0B;IACzC,MAAM,EAAE,MAAM,CAAC;IACf,OAAO,EAAE,OAAO,CAAC;IACjB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,aAAa,CAAC,EAAE,MAAM,CAAC;CACxB;AAED,MAAM,WAAW,8BAA8B;IAC7C,MAAM,EAAE,MAAM,CAAC;IACf,OAAO,EAAE,OAAO,CAAC;IACjB,WAAW,CAAC,EAAE,MAAM,CAAC;CACtB;AAED,MAAM,WAAW,kBAAkB;IACjC,MAAM,EAAE,MAAM,CAAC;IACf,OAAO,EAAE,MAAM,CAAC;IAChB,OAAO,EAAE,MAAM,CAAC;IAChB,MAAM,EAAE,MAAM,EAAE,CAAC;CAClB;AAED,MAAM,WAAW,oBAAoB;IACnC,MAAM,EAAE,MAAM,CAAC;IACf,SAAS,EAAE,OAAO,CAAC;IACnB,UAAU,CAAC,EAAE,OAAO,CAAC;IACrB,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,EAAE,MAAM,CAAC;CACnB;AAED,MAAM,MAAM,WAAW,GAAG;IACxB,eAAe,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAAC;IAC1D,YAAY,EAAE,CAAC,KAAK,EAAE,iBAAiB,KAAK,OAAO,CAAC,MAAM,CAAC,CAAC;IAC5D,YAAY,EAAE,CAAC,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE,iBAAiB,KAAK,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAAC;CAChF,CAAC;AAEF,4EAA4E;AAC5E,MAAM,WAAW,uBAAuB;IACtC,IAAI,EAAE,MAAM,CAAC;IACb,WAAW,IAAI,OAAO,CAAC,kBAAkB,EAAE,CAAC,CAAC;IAC7C,aAAa,CAAC,KAAK,EAAE,WAAW,GAAG,OAAO,CAAC,kBAAkB,CAAC,CAAC;CAChE;AAED,oEAAoE;AACpE,MAAM,WAAW,iBAAkB,SAAQ,uBAAuB;IAChE,aAAa,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,kBAAkB,CAAC,CAAC;IAC3D,WAAW,CAAC,MAAM,EAAE,MAAM,EAAE,KAAK,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,mBAAmB,CAAC,CAAC;IAC1E,iBAAiB,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,oBAAoB,CAAC,CAAC;IACjE,cAAc,CAAC,CAAC,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,2BAA2B,EAAE,OAAO,CAAC,EAAE,2BAA2B,GAAG,OAAO,CAAC,0BAA0B,CAAC,CAAC;IAClJ,iBAAiB,CAAC,CAAC,MAAM,EAAE,MAAM,EAAE,WAAW,EAAE,MAAM,EAAE,GAAG,OAAO,CAAC,8BAA8B,CAAC,CAAC;CACpG;AAED,6CAA6C;AAC7C,MAAM,MAAM,aAAa,GAAG,WAAW,GAAG,gBAAgB,CAAC;AAE3D,MAAM,WAAW,WAAW;IAC1B,IAAI,EAAE,MAAM,CAAC;IACb,kFAAkF;IAClF,aAAa,CAAC,EAAE,aAAa,CAAC;IAC9B,aAAa,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,iBAAiB,EAAE,CAAC,CAAC;IAC5D,aAAa,CAAC,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,iBAAiB,EAAE,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;CAC/E;AAED,gDAAgD;AAChD,MAAM,MAAM,YAAY,GAAG,iBAAiB,GAAG,WAAW,CAAC;AAE3D,MAAM,WAAW,YAAY;IAC3B,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,WAAW,GAAG,KAAK,GAAG,MAAM,GAAG,aAAa,CAAC;IACnD,UAAU,EAAE,OAAO,CAAC;IACpB,SAAS,CAAC,EAAE,OAAO,CAAC;IACpB,OAAO,EAAE,MAAM,EAAE,CAAC;CACnB;AAED,MAAM,WAAW,aAAa;IAC5B,SAAS,EAAE;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,kBAAkB,CAAA;KAAE,EAAE,CAAC;IAC1D,WAAW,EAAE,MAAM,CAAC;IACpB,WAAW,EAAE,MAAM,EAAE,CAAC;CACvB;AAmND,UAAU,aAAa;IACrB,IAAI,EAAE,YAAY,CAAC;IACnB,eAAe,CAAC,EAAE,MAAM,uBAAuB,CAAC;IAChD,eAAe,CAAC,EAAE,MAAM,iBAAiB,CAAC;IAC1C,SAAS,CAAC,EAAE,MAAM,WAAW,CAAC;CAC/B;AAiED,wBAAgB,gBAAgB,CAAC,KAAK,EAAE,aAAa,GAAG,IAAI,CAE3D;AAED,wBAAgB,qBAAqB,IAAI,YAAY,EAAE,CAMtD;AAED,wBAAgB,eAAe,CAAC,IAAI,EAAE,MAAM,GAAG,YAAY,GAAG,IAAI,CAIjE;AAED,wBAAgB,oBAAoB,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAE1D;AAED,wBAAgB,cAAc,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAEpD;AAED,wBAAgB,oBAAoB,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAE1D;AAED,wBAAgB,0BAA0B,CAAC,IAAI,EAAE,MAAM,GAAG,uBAAuB,CAIhF;AAED,wBAAgB,oBAAoB,CAAC,IAAI,EAAE,MAAM,GAAG,iBAAiB,CAIpE;AAED,wBAAgB,cAAc,CAAC,IAAI,EAAE,MAAM,GAAG,WAAW,CAIxD;AAED,6CAA6C;AAC7C,wBAAgB,WAAW,CAAC,IAAI,EAAE,MAAM,GAAG,iBAAiB,CAE3D;AAED,wBAAsB,OAAO,CAAC,KAAK,EAAE,WAAW,GAAG,OAAO,CAAC,aAAa,CAAC,CAsBxE;AAED,wBAAsB,mBAAmB,CACvC,MAAM,EAAE,MAAM,EACd,eAAe,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,GACxD,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAYxB"}
+{"version":3,"file":"registrar.d.ts","sourceRoot":"","sources":["../../src/lib/registrar.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,OAAO,KAAK,EAAE,MAAM,EAAE,iBAAiB,EAAE,iBAAiB,EAAE,MAAM,kBAAkB,CAAC;AAYrF,MAAM,WAAW,iBAAiB;IAChC,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,MAAM,CAAC;IACb,KAAK,EAAE,MAAM,CAAC;IACd,GAAG,EAAE,MAAM,CAAC;IACZ,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,OAAO,CAAC,EAAE,OAAO,CAAC;CACnB;AAED,MAAM,WAAW,kBAAkB;IACjC,MAAM,EAAE,MAAM,CAAC;IACf,SAAS,EAAE,MAAM,CAAC;IAClB,OAAO,EAAE,MAAM,CAAC;IAChB,OAAO,EAAE,MAAM,CAAC;IAChB,WAAW,EAAE,MAAM,EAAE,CAAC;IACtB,MAAM,EAAE,MAAM,CAAC;IACf,UAAU,EAAE,OAAO,CAAC;CACrB;AAED,MAAM,WAAW,mBAAmB;IAClC,MAAM,EAAE,MAAM,CAAC;IACf,OAAO,EAAE,OAAO,CAAC;IACjB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,aAAa,CAAC,EAAE,MAAM,CAAC;CACxB;AAED,MAAM,WAAW,2BAA2B;IAC1C,UAAU,EAAE,MAAM,CAAC;IACnB,SAAS,EAAE,MAAM,CAAC;IAClB,KAAK,EAAE,MAAM,CAAC;IACd,KAAK,EAAE,MAAM,CAAC;IACd,cAAc,EAAE,MAAM,CAAC;IACvB,IAAI,EAAE,MAAM,CAAC;IACb,KAAK,EAAE,MAAM,CAAC;IACd,YAAY,EAAE,MAAM,CAAC;IACrB,QAAQ,EAAE,MAAM,CAAC;IACjB,iBAAiB,CAAC,EAAE,MAAM,CAAC;CAC5B;AAED,MAAM,WAAW,2BAA2B;IAC1C,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,SAAS,CAAC,EAAE,OAAO,CAAC;IACpB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,WAAW,CAAC,EAAE,MAAM,EAAE,CAAC;IACvB,QAAQ,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IACnC,OAAO,CAAC,EAAE,OAAO,CAAC;CACnB;AAED,MAAM,WAAW,0BAA0B;IACzC,MAAM,EAAE,MAAM,CAAC;IACf,OAAO,EAAE,OAAO,CAAC;IACjB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,aAAa,CAAC,EAAE,MAAM,CAAC;CACxB;AAED,MAAM,WAAW,8BAA8B;IAC7C,MAAM,EAAE,MAAM,CAAC;IACf,OAAO,EAAE,OAAO,CAAC;IACjB,WAAW,CAAC,EAAE,MAAM,CAAC;CACtB;AAED,MAAM,WAAW,kBAAkB;IACjC,MAAM,EAAE,MAAM,CAAC;IACf,OAAO,EAAE,MAAM,CAAC;IAChB,OAAO,EAAE,MAAM,CAAC;IAChB,MAAM,EAAE,MAAM,EAAE,CAAC;CAClB;AAED,MAAM,WAAW,oBAAoB;IACnC,MAAM,EAAE,MAAM,CAAC;IACf,SAAS,EAAE,OAAO,CAAC;IACnB,UAAU,CAAC,EAAE,OAAO,CAAC;IACrB,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,EAAE,MAAM,CAAC;CACnB;AAED,MAAM,MAAM,WAAW,GAAG;IACxB,eAAe,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAAC;IAC1D,YAAY,EAAE,CAAC,KAAK,EAAE,iBAAiB,KAAK,OAAO,CAAC,MAAM,CAAC,CAAC;IAC5D,YAAY,EAAE,CAAC,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE,iBAAiB,KAAK,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAAC;CAChF,CAAC;AAEF,4EAA4E;AAC5E,MAAM,WAAW,uBAAuB;IACtC,IAAI,EAAE,MAAM,CAAC;IACb,WAAW,IAAI,OAAO,CAAC,kBAAkB,EAAE,CAAC,CAAC;IAC7C,aAAa,CAAC,KAAK,EAAE,WAAW,GAAG,OAAO,CAAC,kBAAkB,CAAC,CAAC;CAChE;AAED,oEAAoE;AACpE,MAAM,WAAW,iBAAkB,SAAQ,uBAAuB;IAChE,aAAa,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,kBAAkB,CAAC,CAAC;IAC3D,WAAW,CAAC,MAAM,EAAE,MAAM,EAAE,KAAK,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,mBAAmB,CAAC,CAAC;IAC1E,iBAAiB,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,oBAAoB,CAAC,CAAC;IACjE,cAAc,CAAC,CAAC,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,2BAA2B,EAAE,OAAO,CAAC,EAAE,2BAA2B,GAAG,OAAO,CAAC,0BAA0B,CAAC,CAAC;IAClJ,iBAAiB,CAAC,CAAC,MAAM,EAAE,MAAM,EAAE,WAAW,EAAE,MAAM,EAAE,GAAG,OAAO,CAAC,8BAA8B,CAAC,CAAC;CACpG;AAED,6CAA6C;AAC7C,MAAM,MAAM,aAAa,GAAG,WAAW,GAAG,gBAAgB,CAAC;AAE3D,MAAM,WAAW,WAAW;IAC1B,IAAI,EAAE,MAAM,CAAC;IACb,kFAAkF;IAClF,aAAa,CAAC,EAAE,aAAa,CAAC;IAC9B,aAAa,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,iBAAiB,EAAE,CAAC,CAAC;IAC5D,aAAa,CAAC,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,iBAAiB,EAAE,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;IAC9E;;;;;;OAMG;IACH,gBAAgB,CAAC,CAAC,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,iBAAiB,EAAE,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;CACnF;AAED,gDAAgD;AAChD,MAAM,MAAM,YAAY,GAAG,iBAAiB,GAAG,WAAW,CAAC;AAE3D,MAAM,WAAW,YAAY;IAC3B,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,WAAW,GAAG,KAAK,GAAG,MAAM,GAAG,aAAa,CAAC;IACnD,UAAU,EAAE,OAAO,CAAC;IACpB,SAAS,CAAC,EAAE,OAAO,CAAC;IACpB,OAAO,EAAE,MAAM,EAAE,CAAC;CACnB;AAED,MAAM,WAAW,aAAa;IAC5B,SAAS,EAAE;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,kBAAkB,CAAA;KAAE,EAAE,CAAC;IAC1D,WAAW,EAAE,MAAM,CAAC;IACpB,WAAW,EAAE,MAAM,EAAE,CAAC;CACvB;AAmND,UAAU,aAAa;IACrB,IAAI,EAAE,YAAY,CAAC;IACnB,eAAe,CAAC,EAAE,MAAM,uBAAuB,CAAC;IAChD,eAAe,CAAC,EAAE,MAAM,iBAAiB,CAAC;IAC1C,SAAS,CAAC,EAAE,MAAM,WAAW,CAAC;CAC/B;AAiED,wBAAgB,gBAAgB,CAAC,KAAK,EAAE,aAAa,GAAG,IAAI,CAE3D;AAED,wBAAgB,qBAAqB,IAAI,YAAY,EAAE,CAMtD;AAED,wBAAgB,eAAe,CAAC,IAAI,EAAE,MAAM,GAAG,YAAY,GAAG,IAAI,CAIjE;AAED,wBAAgB,oBAAoB,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAE1D;AAED,wBAAgB,cAAc,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAEpD;AAED,wBAAgB,oBAAoB,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAE1D;AAED,wBAAgB,0BAA0B,CAAC,IAAI,EAAE,MAAM,GAAG,uBAAuB,CAIhF;AAED,wBAAgB,oBAAoB,CAAC,IAAI,EAAE,MAAM,GAAG,iBAAiB,CAIpE;AAED,wBAAgB,cAAc,CAAC,IAAI,EAAE,MAAM,GAAG,WAAW,CAIxD;AAED,6CAA6C;AAC7C,wBAAgB,WAAW,CAAC,IAAI,EAAE,MAAM,GAAG,iBAAiB,CAE3D;AAED,wBAAsB,OAAO,CAAC,KAAK,EAAE,WAAW,GAAG,OAAO,CAAC,aAAa,CAAC,CAsBxE;AAED,wBAAsB,mBAAmB,CACvC,MAAM,EAAE,MAAM,EACd,eAAe,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,GACxD,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAYxB"}

package/dist/lib/registrar.js

@@ -426,6 +426,29 @@ function createCloudflareProvider(config) {
         await replaceRecordsByNameType(zone.id, replacement, cfg);
       }
       return true;
+    },
+    async deleteDnsRecords(domain, records) {
+      const zone = await getZone(domain, cfg);
+      if (!zone)
+        throw new Error(`No Cloudflare zone found for ${domain}`);
+      const grouped = new Map;
+      for (const record of records) {
+        const key = `${record.type}|${record.name}`;
+        const group = grouped.get(key) ?? [];
+        group.push(record);
+        grouped.set(key, group);
+      }
+      for (const group of grouped.values()) {
+        const { type, name } = group[0];
+        const existing = await listRecordsByNameType(zone.id, type, name, cfg);
+        for (const record of group) {
+          const match = existing.find((candidate) => candidate.content === record.value && (candidate.priority ?? undefined) === (record.priority ?? undefined));
+          if (match?.id) {
+            await deleteRecord(zone.id, match.id, cfg);
+          }
+        }
+      }
+      return true;
     }
   };
 }