dkimkit 0.0.0-stage → 0.6.1

package/dist/src/http.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"http.js","sourceRoot":"","sources":["../../src/http.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,IAAI,KAAK,EAAE,MAAM,sBAAsB,CAAC;AAC3D,OAAO,EAAE,QAAQ,EAAE,MAAM,aAAa,CAAC;AAUvC,MAAM,SAAS,GAAG,IAAI,GAAG,CAAC,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,CAAC,CAAC,CAAC;AACrD,MAAM,kBAAkB,GAAG,MAAM,CAAC;AAElC,MAAM,CAAC,MAAM,KAAK,GAAG,CAAC,EAAU,EAAE,MAAoB,EAAE,EAAE,CAAC,KAAK,CAAC,EAAE,EAAE,SAAS,EAAE,EAAE,MAAM,EAAE,CAAC,CAAC;AAE5F,4EAA4E;AAC5E,MAAM,CAAC,KAAK,UAAU,WAAW,CAC/B,SAAoB,EACpB,QAAgB,EAChB,GAAW,EACX,IAAoB,EACpB,aAAoD,EACpD,OAAO,GAAG,CAAC;IAEX,MAAM,OAAO,GAAG,IAAI,CAAC,IAAI,KAAK,SAAS,CAAC;IACxC,MAAM,IAAI,GAAgB;QACxB,MAAM,EAAE,IAAI,CAAC,MAAM,IAAI,KAAK;QAC5B,OAAO,EAAE;YACP,MAAM,EAAE,kBAAkB;YAC1B,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,cAAc,EAAE,kBAAkB,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YAC1D,GAAG,IAAI,CAAC,OAAO;SAChB;QACD,IAAI,EAAE,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,SAAS;KACtD,CAAC;IACF,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,SAAS,EAAE,QAAQ,EAAE,GAAG,EAAE,GAAG,EAAE,CAAC,IAAI,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,aAAa,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,EAAE,OAAO,CAAC,CAAC;IAC3G,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,SAAS,CAAM,CAAC;AACnD,CAAC;AAED;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,WAAW,CAC/B,SAAoB,EACpB,QAAgB,EAChB,GAAW,EACX,SAA4B,EAC5B,aAAmD,EACnD,OAAO,GAAG,CAAC;IAEX,OAAO,IAAI,CAAC,SAAS,EAAE,QAAQ,EAAE,GAAG,EAAE,SAAS,EAAE,aAAa,EAAE,OAAO,CAAC,CAAC;AAC3E,CAAC;AAED,KAAK,UAAU,IAAI,CACjB,SAAoB,EACpB,QAAgB,EAChB,GAAW,EACX,SAA4B,EAC5B,aAAmD,EACnD,OAAe;IAEf,KAAK,IAAI,OAAO,GAAG,CAAC,GAAI,OAAO,EAAE,EAAE,CAAC;QAClC,MAAM,GAAG,GAAG,MAAM,SAAS,CAAC,GAAG,EAAE,SAAS,EAAE,CAAC,CAAC;QAC9C,MAAM,IAAI,GAAG,MAAM,GAAG,CAAC,IAAI,EAAE,CAAC;QAC9B,IAAI,GAAG,CAAC,EAAE;YAAE,OAAO,IAAI,CAAC;QACxB,IAAI,SAAS,CAAC,GAAG,CAAC,GAAG,CAAC,MAAM,CAAC,IAAI,OAAO,GAAG,OAAO,EAAE,CAAC;YACnD,MAAM,KAAK,CAAC,UAAU,CAAC,GAAG,EAAE,OAAO,CAAC,CAAC,CAAC;YACtC,SAAS;QACX,CAAC;QACD,MAAM,IAAI,QAAQ,CAAC,QAAQ,EAAE,GAAG,CAAC,MAAM,EAAE,aAAa,CAAC,IAAI,CAAC,IAAI,GAAG,CAAC,UAAU,IAAI,QAAQ,GAAG,CAAC,MAAM,EAAE,EAAE,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC;IAC3H,CAAC;AACH,CAAC;AAED,SAAS,SAAS,CAAC,IAAY;IAC7B,IAAI,CAAC;QACH,OAAO,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;IAC1B,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED,SAAS,UAAU,CAAC,GAAa,EAAE,OAAe;IAChD,MAAM,UAAU,GAAG,MAAM,CAAC,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,aAAa,CAAC,CAAC,CAAC;IAC1D,MAAM,EAAE,GAAG,MAAM,CAAC,QAAQ,CAAC,UAAU,CAAC,IAAI,UAAU,GAAG,CAAC,CAAC,CAAC,CAAC,UAAU,GAAG,IAAI,CAAC,CAAC,CAAC,IAAI,GAAG,CAAC,IAAI,OAAO,CAAC;IACnG,OAAO,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,kBAAkB,CAAC,CAAC;AAC1C,CAAC"}

package/dist/src/index.d.ts

@@ -0,0 +1,19 @@
+export * from './types.js';
+export * from './errors.js';
+export { decideChange, describeRecord, isValidDomain, normalizeName, normalizeValue, sameValue, type ExistingRecord } from './records.js';
+export { authoritativeLookup, ResolverLookup, waitForPropagation, type DnsLookup, type WaitOptions } from './propagation.js';
+export { setupDomain, checkStatus, type SetupOptions, type SetupResult, type SetupEvent, type SetupStatus, type StatusResult } from './orchestrator.js';
+export { SendGridProvider, SENDGRID_INBOUND_MX, type SendGridOptions } from './providers/email/sendgrid.js';
+export { CloudflareDns, type CloudflareOptions } from './providers/dns/cloudflare.js';
+export { ManualDns } from './providers/dns/manual.js';
+export type { FetchLike } from './http.js';
+export { Route53Dns, type Route53Options } from './providers/dns/route53.js';
+export { loadAwsCredentials, signRequest, type AwsCredentials } from './providers/dns/aws.js';
+export { createDnsProvider, DNS_PROVIDERS, type DnsProviderName, type DnsProviderConfig } from './providers/factory.js';
+export { startUiServer, parseSetupRequest, type UiServer, type UiServerOptions, type SetupRequest } from './server.js';
+export { verifyWebhookSignature, signWebhook, WEBHOOK_SIGNATURE_HEADER } from './hosted/crypto.js';
+export { detectDnsHost, type DnsHost } from './dns-host.js';
+export { PostmarkProvider, type PostmarkOptions } from './providers/email/postmark.js';
+export { MailgunProvider, type MailgunOptions } from './providers/email/mailgun.js';
+export { SesProvider, type SesOptions } from './providers/email/ses.js';
+export { createEmailProvider, EMAIL_PROVIDERS, type EmailCredentials, type EmailProviderName } from './providers/email/factory.js';

package/dist/src/index.js

@@ -0,0 +1,19 @@
+export * from './types.js';
+export * from './errors.js';
+export { decideChange, describeRecord, isValidDomain, normalizeName, normalizeValue, sameValue } from './records.js';
+export { authoritativeLookup, ResolverLookup, waitForPropagation } from './propagation.js';
+export { setupDomain, checkStatus } from './orchestrator.js';
+export { SendGridProvider, SENDGRID_INBOUND_MX } from './providers/email/sendgrid.js';
+export { CloudflareDns } from './providers/dns/cloudflare.js';
+export { ManualDns } from './providers/dns/manual.js';
+export { Route53Dns } from './providers/dns/route53.js';
+export { loadAwsCredentials, signRequest } from './providers/dns/aws.js';
+export { createDnsProvider, DNS_PROVIDERS } from './providers/factory.js';
+export { startUiServer, parseSetupRequest } from './server.js';
+export { verifyWebhookSignature, signWebhook, WEBHOOK_SIGNATURE_HEADER } from './hosted/crypto.js';
+export { detectDnsHost } from './dns-host.js';
+export { PostmarkProvider } from './providers/email/postmark.js';
+export { MailgunProvider } from './providers/email/mailgun.js';
+export { SesProvider } from './providers/email/ses.js';
+export { createEmailProvider, EMAIL_PROVIDERS } from './providers/email/factory.js';
+//# sourceMappingURL=index.js.map

package/dist/src/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/index.ts"],"names":[],"mappings":"AAAA,cAAc,YAAY,CAAC;AAC3B,cAAc,aAAa,CAAC;AAC5B,OAAO,EAAE,YAAY,EAAE,cAAc,EAAE,aAAa,EAAE,aAAa,EAAE,cAAc,EAAE,SAAS,EAAuB,MAAM,cAAc,CAAC;AAC1I,OAAO,EAAE,mBAAmB,EAAE,cAAc,EAAE,kBAAkB,EAAoC,MAAM,kBAAkB,CAAC;AAC7H,OAAO,EAAE,WAAW,EAAE,WAAW,EAA6F,MAAM,mBAAmB,CAAC;AACxJ,OAAO,EAAE,gBAAgB,EAAE,mBAAmB,EAAwB,MAAM,+BAA+B,CAAC;AAC5G,OAAO,EAAE,aAAa,EAA0B,MAAM,+BAA+B,CAAC;AACtF,OAAO,EAAE,SAAS,EAAE,MAAM,2BAA2B,CAAC;AAEtD,OAAO,EAAE,UAAU,EAAuB,MAAM,4BAA4B,CAAC;AAC7E,OAAO,EAAE,kBAAkB,EAAE,WAAW,EAAuB,MAAM,wBAAwB,CAAC;AAC9F,OAAO,EAAE,iBAAiB,EAAE,aAAa,EAAgD,MAAM,wBAAwB,CAAC;AACxH,OAAO,EAAE,aAAa,EAAE,iBAAiB,EAA0D,MAAM,aAAa,CAAC;AACvH,OAAO,EAAE,sBAAsB,EAAE,WAAW,EAAE,wBAAwB,EAAE,MAAM,oBAAoB,CAAC;AACnG,OAAO,EAAE,aAAa,EAAgB,MAAM,eAAe,CAAC;AAC5D,OAAO,EAAE,gBAAgB,EAAwB,MAAM,+BAA+B,CAAC;AACvF,OAAO,EAAE,eAAe,EAAuB,MAAM,8BAA8B,CAAC;AACpF,OAAO,EAAE,WAAW,EAAmB,MAAM,0BAA0B,CAAC;AACxE,OAAO,EAAE,mBAAmB,EAAE,eAAe,EAAiD,MAAM,8BAA8B,CAAC"}

package/dist/src/orchestrator.d.ts

@@ -0,0 +1,70 @@
+import { type DnsLookup } from './propagation.js';
+import type { DnsProvider, DnsRecord, DomainAuthentication, EmailProvider, InboundAction, InboundParseOptions, PlannedChange, ValidationResult } from './types.js';
+export type SetupEvent = {
+    type: 'domain';
+    auth: DomainAuthentication;
+} | {
+    type: 'plan';
+    changes: PlannedChange[];
+} | {
+    type: 'applied';
+    changes: PlannedChange[];
+} | {
+    type: 'propagation';
+    pending: DnsRecord[];
+    total: number;
+    elapsedMs: number;
+} | {
+    type: 'validation';
+    attempt: number;
+    result: ValidationResult;
+} | {
+    type: 'inbound';
+    hostname: string;
+    url: string;
+    action: InboundAction;
+};
+export interface SetupOptions {
+    domain: string;
+    subdomain?: string;
+    inbound?: InboundParseOptions;
+    /** Replace existing CNAME/MX records that point elsewhere. */
+    overwrite?: boolean;
+    /** Plan only: create nothing in DNS. Note the provider may still create the domain to learn its records. */
+    dryRun?: boolean;
+    /** Called before writing DNS when there are changes; return false to abort. */
+    confirm?: (changes: PlannedChange[]) => Promise<boolean>;
+    propagation?: {
+        timeoutMs?: number;
+        intervalMs?: number;
+        lookup?: DnsLookup;
+    };
+    validation?: {
+        attempts?: number;
+        intervalMs?: number;
+    };
+    onEvent?: (event: SetupEvent) => void;
+    /** Stops waiting (propagation, validation retries) and rejects with an AbortError. */
+    signal?: AbortSignal;
+}
+export type SetupStatus = 'complete' | 'dry-run' | 'aborted' | 'dns-pending' | 'validation-failed';
+export interface SetupResult {
+    status: SetupStatus;
+    domain: DomainAuthentication;
+    changes: PlannedChange[];
+    pending?: DnsRecord[];
+    validation?: ValidationResult;
+    inbound?: InboundAction;
+}
+/**
+ * Runs the full lifecycle: provider domain → DNS plan/apply → propagation →
+ * provider validation → inbound parse. Idempotent, so it is safe to re-run
+ * after a `dns-pending` or `validation-failed` result.
+ */
+export declare function setupDomain(email: EmailProvider, dns: DnsProvider, opts: SetupOptions): Promise<SetupResult>;
+export interface StatusResult {
+    domain: DomainAuthentication | null;
+    validation?: ValidationResult;
+}
+/** Read-only check: finds the domain and asks the provider to re-validate it. */
+export declare function checkStatus(email: EmailProvider, domain: string, subdomain?: string): Promise<StatusResult>;

package/dist/src/orchestrator.js

@@ -0,0 +1,69 @@
+import { DnsConflictError } from './errors.js';
+import { sleep } from './http.js';
+import { authoritativeLookup, waitForPropagation } from './propagation.js';
+/**
+ * Runs the full lifecycle: provider domain → DNS plan/apply → propagation →
+ * provider validation → inbound parse. Idempotent, so it is safe to re-run
+ * after a `dns-pending` or `validation-failed` result.
+ */
+export async function setupDomain(email, dns, opts) {
+    const emit = opts.onEvent ?? (() => { });
+    const { signal } = opts;
+    const auth = await email.ensureDomain(opts.domain, { subdomain: opts.subdomain });
+    emit({ type: 'domain', auth });
+    const records = [...auth.records, ...(opts.inbound ? email.inboundRecords(opts.inbound.hostname) : [])];
+    const changes = await dns.plan(records, { overwrite: opts.overwrite });
+    emit({ type: 'plan', changes });
+    const conflicts = changes.filter((c) => c.action === 'conflict');
+    if (conflicts.length > 0)
+        throw new DnsConflictError(conflicts);
+    if (opts.dryRun)
+        return { status: 'dry-run', domain: auth, changes };
+    const writes = changes.filter((c) => c.action === 'create' || c.action === 'update');
+    if (writes.length > 0) {
+        if (opts.confirm && !(await opts.confirm(changes)))
+            return { status: 'aborted', domain: auth, changes };
+        await dns.apply(changes);
+        emit({ type: 'applied', changes: writes });
+    }
+    // Wait for the planned values, which can differ from the provider's (e.g. an SPF record merged into an existing one).
+    const planned = changes.map((c) => c.record);
+    const lookup = opts.propagation?.lookup ?? (await authoritativeLookup(opts.domain));
+    const pending = await waitForPropagation(planned, lookup, {
+        timeoutMs: opts.propagation?.timeoutMs,
+        intervalMs: opts.propagation?.intervalMs,
+        onProgress: (p, elapsedMs) => emit({ type: 'propagation', pending: p, total: planned.length, elapsedMs }),
+        signal,
+    });
+    if (pending.length > 0)
+        return { status: 'dns-pending', domain: auth, changes, pending };
+    // The provider's resolvers can lag behind the authoritative servers, so retry.
+    const { attempts = 6, intervalMs = 10_000 } = opts.validation ?? {};
+    let validation;
+    for (let attempt = 1; attempt <= attempts; attempt++) {
+        signal?.throwIfAborted();
+        validation = await email.validateDomain(auth.id);
+        emit({ type: 'validation', attempt, result: validation });
+        if (validation.valid)
+            break;
+        if (attempt < attempts)
+            await sleep(intervalMs, signal);
+    }
+    if (!validation?.valid)
+        return { status: 'validation-failed', domain: auth, changes, validation };
+    let inbound;
+    if (opts.inbound) {
+        signal?.throwIfAborted();
+        inbound = await email.ensureInboundParse(opts.inbound);
+        emit({ type: 'inbound', hostname: opts.inbound.hostname, url: opts.inbound.url, action: inbound });
+    }
+    return { status: 'complete', domain: { ...auth, valid: true }, changes, validation, inbound };
+}
+/** Read-only check: finds the domain and asks the provider to re-validate it. */
+export async function checkStatus(email, domain, subdomain) {
+    const auth = await email.findDomain(domain, subdomain);
+    if (!auth)
+        return { domain: null };
+    return { domain: auth, validation: await email.validateDomain(auth.id) };
+}
+//# sourceMappingURL=orchestrator.js.map

package/dist/src/orchestrator.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"orchestrator.js","sourceRoot":"","sources":["../../src/orchestrator.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,gBAAgB,EAAE,MAAM,aAAa,CAAC;AAC/C,OAAO,EAAE,KAAK,EAAE,MAAM,WAAW,CAAC;AAClC,OAAO,EAAE,mBAAmB,EAAE,kBAAkB,EAAkB,MAAM,kBAAkB,CAAC;AAgD3F;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,WAAW,CAAC,KAAoB,EAAE,GAAgB,EAAE,IAAkB;IAC1F,MAAM,IAAI,GAAG,IAAI,CAAC,OAAO,IAAI,CAAC,GAAG,EAAE,GAAE,CAAC,CAAC,CAAC;IACxC,MAAM,EAAE,MAAM,EAAE,GAAG,IAAI,CAAC;IAExB,MAAM,IAAI,GAAG,MAAM,KAAK,CAAC,YAAY,CAAC,IAAI,CAAC,MAAM,EAAE,EAAE,SAAS,EAAE,IAAI,CAAC,SAAS,EAAE,CAAC,CAAC;IAClF,IAAI,CAAC,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC,CAAC;IAE/B,MAAM,OAAO,GAAG,CAAC,GAAG,IAAI,CAAC,OAAO,EAAE,GAAG,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,KAAK,CAAC,cAAc,CAAC,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;IACxG,MAAM,OAAO,GAAG,MAAM,GAAG,CAAC,IAAI,CAAC,OAAO,EAAE,EAAE,SAAS,EAAE,IAAI,CAAC,SAAS,EAAE,CAAC,CAAC;IACvE,IAAI,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,CAAC,CAAC;IAEhC,MAAM,SAAS,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,KAAK,UAAU,CAAC,CAAC;IACjE,IAAI,SAAS,CAAC,MAAM,GAAG,CAAC;QAAE,MAAM,IAAI,gBAAgB,CAAC,SAAS,CAAC,CAAC;IAChE,IAAI,IAAI,CAAC,MAAM;QAAE,OAAO,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,IAAI,EAAE,OAAO,EAAE,CAAC;IAErE,MAAM,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,KAAK,QAAQ,IAAI,CAAC,CAAC,MAAM,KAAK,QAAQ,CAAC,CAAC;IACrF,IAAI,MAAM,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACtB,IAAI,IAAI,CAAC,OAAO,IAAI,CAAC,CAAC,MAAM,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC;YAAE,OAAO,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,IAAI,EAAE,OAAO,EAAE,CAAC;QACxG,MAAM,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;QACzB,IAAI,CAAC,EAAE,IAAI,EAAE,SAAS,EAAE,OAAO,EAAE,MAAM,EAAE,CAAC,CAAC;IAC7C,CAAC;IAED,sHAAsH;IACtH,MAAM,OAAO,GAAG,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC;IAC7C,MAAM,MAAM,GAAG,IAAI,CAAC,WAAW,EAAE,MAAM,IAAI,CAAC,MAAM,mBAAmB,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC;IACpF,MAAM,OAAO,GAAG,MAAM,kBAAkB,CAAC,OAAO,EAAE,MAAM,EAAE;QACxD,SAAS,EAAE,IAAI,CAAC,WAAW,EAAE,SAAS;QACtC,UAAU,EAAE,IAAI,CAAC,WAAW,EAAE,UAAU;QACxC,UAAU,EAAE,CAAC,CAAC,EAAE,SAAS,EAAE,EAAE,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,aAAa,EAAE,OAAO,EAAE,CAAC,EAAE,KAAK,EAAE,OAAO,CAAC,MAAM,EAAE,SAAS,EAAE,CAAC;QACzG,MAAM;KACP,CAAC,CAAC;IACH,IAAI,OAAO,CAAC,MAAM,GAAG,CAAC;QAAE,OAAO,EAAE,MAAM,EAAE,aAAa,EAAE,MAAM,EAAE,IAAI,EAAE,OAAO,EAAE,OAAO,EAAE,CAAC;IAEzF,+EAA+E;IAC/E,MAAM,EAAE,QAAQ,GAAG,CAAC,EAAE,UAAU,GAAG,MAAM,EAAE,GAAG,IAAI,CAAC,UAAU,IAAI,EAAE,CAAC;IACpE,IAAI,UAAwC,CAAC;IAC7C,KAAK,IAAI,OAAO,GAAG,CAAC,EAAE,OAAO,IAAI,QAAQ,EAAE,OAAO,EAAE,EAAE,CAAC;QACrD,MAAM,EAAE,cAAc,EAAE,CAAC;QACzB,UAAU,GAAG,MAAM,KAAK,CAAC,cAAc,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;QACjD,IAAI,CAAC,EAAE,IAAI,EAAE,YAAY,EAAE,OAAO,EAAE,MAAM,EAAE,UAAU,EAAE,CAAC,CAAC;QAC1D,IAAI,UAAU,CAAC,KAAK;YAAE,MAAM;QAC5B,IAAI,OAAO,GAAG,QAAQ;YAAE,MAAM,KAAK,CAAC,UAAU,EAAE,MAAM,CAAC,CAAC;IAC1D,CAAC;IACD,IAAI,CAAC,UAAU,EAAE,KAAK;QAAE,OAAO,EAAE,MAAM,EAAE,mBAAmB,EAAE,MAAM,EAAE,IAAI,EAAE,OAAO,EAAE,UAAU,EAAE,CAAC;IAElG,IAAI,OAAkC,CAAC;IACvC,IAAI,IAAI,CAAC,OAAO,EAAE,CAAC;QACjB,MAAM,EAAE,cAAc,EAAE,CAAC;QACzB,OAAO,GAAG,MAAM,KAAK,CAAC,kBAAkB,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;QACvD,IAAI,CAAC,EAAE,IAAI,EAAE,SAAS,EAAE,QAAQ,EAAE,IAAI,CAAC,OAAO,CAAC,QAAQ,EAAE,GAAG,EAAE,IAAI,CAAC,OAAO,CAAC,GAAG,EAAE,MAAM,EAAE,OAAO,EAAE,CAAC,CAAC;IACrG,CAAC;IAED,OAAO,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,EAAE,EAAE,GAAG,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,EAAE,OAAO,EAAE,UAAU,EAAE,OAAO,EAAE,CAAC;AAChG,CAAC;AAOD,iFAAiF;AACjF,MAAM,CAAC,KAAK,UAAU,WAAW,CAAC,KAAoB,EAAE,MAAc,EAAE,SAAkB;IACxF,MAAM,IAAI,GAAG,MAAM,KAAK,CAAC,UAAU,CAAC,MAAM,EAAE,SAAS,CAAC,CAAC;IACvD,IAAI,CAAC,IAAI;QAAE,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC;IACnC,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,UAAU,EAAE,MAAM,KAAK,CAAC,cAAc,CAAC,IAAI,CAAC,EAAE,CAAC,EAAE,CAAC;AAC3E,CAAC"}

package/dist/src/propagation.d.ts

@@ -0,0 +1,30 @@
+import { Resolver } from 'node:dns/promises';
+import type { DnsRecord } from './types.js';
+export interface DnsLookup {
+    /** True when `record` is currently visible with the expected value. */
+    check(record: DnsRecord): Promise<boolean>;
+}
+export declare class ResolverLookup implements DnsLookup {
+    private readonly resolver;
+    constructor(resolver: Resolver);
+    check(record: DnsRecord): Promise<boolean>;
+}
+/** The zone apex holding `domain` and its nameservers, found by walking up the labels. */
+export declare function findZoneNameservers(domain: string, resolveNs?: (name: string) => Promise<string[]>): Promise<{
+    zone: string;
+    nameservers: string[];
+} | null>;
+/**
+ * Queries the domain's authoritative nameservers directly, so results reflect
+ * what was just written rather than a recursive resolver's cache. Falls back
+ * to public resolvers if the nameservers can't be found.
+ */
+export declare function authoritativeLookup(domain: string): Promise<DnsLookup>;
+export interface WaitOptions {
+    timeoutMs?: number;
+    intervalMs?: number;
+    onProgress?: (pending: DnsRecord[], elapsedMs: number) => void;
+    signal?: AbortSignal;
+}
+/** Polls until every record is visible or the timeout passes. Returns the records still missing. */
+export declare function waitForPropagation(records: DnsRecord[], lookup: DnsLookup, opts?: WaitOptions): Promise<DnsRecord[]>;

package/dist/src/propagation.js

@@ -0,0 +1,76 @@
+import { Resolver } from 'node:dns/promises';
+import { sleep } from './http.js';
+import { normalizeValue, sameValue } from './records.js';
+const PUBLIC_RESOLVERS = ['1.1.1.1', '8.8.8.8'];
+export class ResolverLookup {
+    resolver;
+    constructor(resolver) {
+        this.resolver = resolver;
+    }
+    async check(record) {
+        try {
+            switch (record.type) {
+                case 'CNAME':
+                    return (await this.resolver.resolveCname(record.name)).some((v) => sameValue('CNAME', v, record.value));
+                case 'MX':
+                    return (await this.resolver.resolveMx(record.name)).some((mx) => sameValue('MX', mx.exchange, record.value));
+                case 'TXT': {
+                    const wanted = normalizeValue('TXT', record.value);
+                    return (await this.resolver.resolveTxt(record.name)).some((chunks) => chunks.join('') === wanted);
+                }
+            }
+        }
+        catch (err) {
+            // NXDOMAIN, NODATA, SERVFAIL, timeouts: not visible yet.
+            if (typeof err.code === 'string')
+                return false;
+            throw err;
+        }
+    }
+}
+/** The zone apex holding `domain` and its nameservers, found by walking up the labels. */
+export async function findZoneNameservers(domain, resolveNs = (name) => new Resolver().resolveNs(name)) {
+    const labels = domain.split('.');
+    for (let i = 0; i < labels.length - 1; i++) {
+        const zone = labels.slice(i).join('.');
+        try {
+            const nameservers = await resolveNs(zone);
+            if (nameservers.length > 0)
+                return { zone, nameservers: nameservers.map((n) => n.toLowerCase()) };
+        }
+        catch {
+            // Not a zone apex; try the parent.
+        }
+    }
+    return null;
+}
+/**
+ * Queries the domain's authoritative nameservers directly, so results reflect
+ * what was just written rather than a recursive resolver's cache. Falls back
+ * to public resolvers if the nameservers can't be found.
+ */
+export async function authoritativeLookup(domain) {
+    const system = new Resolver();
+    const found = await findZoneNameservers(domain);
+    const ips = found ? (await Promise.all(found.nameservers.map((ns) => system.resolve4(ns).catch(() => [])))).flat() : [];
+    const resolver = new Resolver({ timeout: 3000, tries: 2 });
+    resolver.setServers(ips.length > 0 ? ips : PUBLIC_RESOLVERS);
+    return new ResolverLookup(resolver);
+}
+/** Polls until every record is visible or the timeout passes. Returns the records still missing. */
+export async function waitForPropagation(records, lookup, opts = {}) {
+    const { timeoutMs = 300_000, intervalMs = 5_000, onProgress, signal } = opts;
+    const started = Date.now();
+    let pending = records;
+    for (;;) {
+        signal?.throwIfAborted();
+        const visible = await Promise.all(pending.map((r) => lookup.check(r)));
+        pending = pending.filter((_, i) => !visible[i]);
+        const elapsed = Date.now() - started;
+        onProgress?.(pending, elapsed);
+        if (pending.length === 0 || elapsed + intervalMs > timeoutMs)
+            return pending;
+        await sleep(intervalMs, signal);
+    }
+}
+//# sourceMappingURL=propagation.js.map

package/dist/src/propagation.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"propagation.js","sourceRoot":"","sources":["../../src/propagation.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,MAAM,mBAAmB,CAAC;AAC7C,OAAO,EAAE,KAAK,EAAE,MAAM,WAAW,CAAC;AAClC,OAAO,EAAE,cAAc,EAAE,SAAS,EAAE,MAAM,cAAc,CAAC;AAQzD,MAAM,gBAAgB,GAAG,CAAC,SAAS,EAAE,SAAS,CAAC,CAAC;AAEhD,MAAM,OAAO,cAAc;IACI;IAA7B,YAA6B,QAAkB;QAAlB,aAAQ,GAAR,QAAQ,CAAU;IAAG,CAAC;IAEnD,KAAK,CAAC,KAAK,CAAC,MAAiB;QAC3B,IAAI,CAAC;YACH,QAAQ,MAAM,CAAC,IAAI,EAAE,CAAC;gBACpB,KAAK,OAAO;oBACV,OAAO,CAAC,MAAM,IAAI,CAAC,QAAQ,CAAC,YAAY,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,SAAS,CAAC,OAAO,EAAE,CAAC,EAAE,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC;gBAC1G,KAAK,IAAI;oBACP,OAAO,CAAC,MAAM,IAAI,CAAC,QAAQ,CAAC,SAAS,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,SAAS,CAAC,IAAI,EAAE,EAAE,CAAC,QAAQ,EAAE,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC;gBAC/G,KAAK,KAAK,CAAC,CAAC,CAAC;oBACX,MAAM,MAAM,GAAG,cAAc,CAAC,KAAK,EAAE,MAAM,CAAC,KAAK,CAAC,CAAC;oBACnD,OAAO,CAAC,MAAM,IAAI,CAAC,QAAQ,CAAC,UAAU,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE,CAAC,KAAK,MAAM,CAAC,CAAC;gBACpG,CAAC;YACH,CAAC;QACH,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,yDAAyD;YACzD,IAAI,OAAQ,GAA6B,CAAC,IAAI,KAAK,QAAQ;gBAAE,OAAO,KAAK,CAAC;YAC1E,MAAM,GAAG,CAAC;QACZ,CAAC;IACH,CAAC;CACF;AAED,0FAA0F;AAC1F,MAAM,CAAC,KAAK,UAAU,mBAAmB,CACvC,MAAc,EACd,YAAiD,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,QAAQ,EAAE,CAAC,SAAS,CAAC,IAAI,CAAC;IAEzF,MAAM,MAAM,GAAG,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IACjC,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,MAAM,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC;QAC3C,MAAM,IAAI,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QACvC,IAAI,CAAC;YACH,MAAM,WAAW,GAAG,MAAM,SAAS,CAAC,IAAI,CAAC,CAAC;YAC1C,IAAI,WAAW,CAAC,MAAM,GAAG,CAAC;gBAAE,OAAO,EAAE,IAAI,EAAE,WAAW,EAAE,WAAW,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC,EAAE,CAAC;QACpG,CAAC;QAAC,MAAM,CAAC;YACP,mCAAmC;QACrC,CAAC;IACH,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,mBAAmB,CAAC,MAAc;IACtD,MAAM,MAAM,GAAG,IAAI,QAAQ,EAAE,CAAC;IAC9B,MAAM,KAAK,GAAG,MAAM,mBAAmB,CAAC,MAAM,CAAC,CAAC;IAChD,MAAM,GAAG,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC,MAAM,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,MAAM,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;IACxH,MAAM,QAAQ,GAAG,IAAI,QAAQ,CAAC,EAAE,OAAO,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,EAAE,CAAC,CAAC;IAC3D,QAAQ,CAAC,UAAU,CAAC,GAAG,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,gBAAgB,CAAC,CAAC;IAC7D,OAAO,IAAI,cAAc,CAAC,QAAQ,CAAC,CAAC;AACtC,CAAC;AASD,oGAAoG;AACpG,MAAM,CAAC,KAAK,UAAU,kBAAkB,CACtC,OAAoB,EACpB,MAAiB,EACjB,OAAoB,EAAE;IAEtB,MAAM,EAAE,SAAS,GAAG,OAAO,EAAE,UAAU,GAAG,KAAK,EAAE,UAAU,EAAE,MAAM,EAAE,GAAG,IAAI,CAAC;IAC7E,MAAM,OAAO,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;IAC3B,IAAI,OAAO,GAAG,OAAO,CAAC;IACtB,SAAS,CAAC;QACR,MAAM,EAAE,cAAc,EAAE,CAAC;QACzB,MAAM,OAAO,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;QACvE,OAAO,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC;QAChD,MAAM,OAAO,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,OAAO,CAAC;QACrC,UAAU,EAAE,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;QAC/B,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC,IAAI,OAAO,GAAG,UAAU,GAAG,SAAS;YAAE,OAAO,OAAO,CAAC;QAC7E,MAAM,KAAK,CAAC,UAAU,EAAE,MAAM,CAAC,CAAC;IAClC,CAAC;AACH,CAAC"}

package/dist/src/providers/dns/aws.d.ts

@@ -0,0 +1,28 @@
+export interface AwsCredentials {
+    accessKeyId: string;
+    secretAccessKey: string;
+    sessionToken?: string;
+}
+export interface SignableRequest {
+    method: string;
+    url: string;
+    headers?: Record<string, string>;
+    body?: string;
+}
+/**
+ * AWS Signature Version 4. Returns the headers to send (everything except
+ * `host`, which fetch sets itself to the same value that was signed).
+ */
+export declare function signRequest(req: SignableRequest, credentials: AwsCredentials, region: string, service: string, now?: Date): Record<string, string>;
+export interface LoadCredentialsOptions {
+    /** Named profile in the shared credentials file. Overrides environment keys. */
+    profile?: string;
+    env?: NodeJS.ProcessEnv;
+}
+/**
+ * Static credentials from AWS_ACCESS_KEY_ID/AWS_SECRET_ACCESS_KEY, or a profile
+ * in ~/.aws/credentials (AWS_PROFILE, AWS_SHARED_CREDENTIALS_FILE honored).
+ * SSO and instance roles are not supported; export keys for those
+ * (e.g. `aws configure export-credentials --format env`).
+ */
+export declare function loadAwsCredentials(opts?: LoadCredentialsOptions): Promise<AwsCredentials>;

package/dist/src/providers/dns/aws.js

@@ -0,0 +1,103 @@
+import { createHash, createHmac } from 'node:crypto';
+import { readFile } from 'node:fs/promises';
+import { homedir } from 'node:os';
+import { join } from 'node:path';
+const sha256Hex = (data) => createHash('sha256').update(data, 'utf8').digest('hex');
+const hmac = (key, data) => createHmac('sha256', key).update(data, 'utf8').digest();
+/** encodeURIComponent plus the reserved characters SigV4 requires escaped. */
+function uriEncode(s) {
+    return encodeURIComponent(s).replace(/[!'()*]/g, (c) => `%${c.charCodeAt(0).toString(16).toUpperCase()}`);
+}
+/**
+ * AWS Signature Version 4. Returns the headers to send (everything except
+ * `host`, which fetch sets itself to the same value that was signed).
+ */
+export function signRequest(req, credentials, region, service, now = new Date()) {
+    const url = new URL(req.url);
+    const amzDate = now.toISOString().replace(/[:-]|\.\d{3}/g, '');
+    const date = amzDate.slice(0, 8);
+    const headers = { ...req.headers, 'x-amz-date': amzDate };
+    if (credentials.sessionToken)
+        headers['x-amz-security-token'] = credentials.sessionToken;
+    const canonical = { host: url.host };
+    for (const [k, v] of Object.entries(headers))
+        canonical[k.toLowerCase()] = v.trim().replace(/\s+/g, ' ');
+    const names = Object.keys(canonical).sort();
+    const signedHeaders = names.join(';');
+    const query = [...url.searchParams]
+        .map(([k, v]) => [uriEncode(k), uriEncode(v)])
+        .sort(([ak, av], [bk, bv]) => (ak === bk ? (av < bv ? -1 : av > bv ? 1 : 0) : ak < bk ? -1 : 1))
+        .map(([k, v]) => `${k}=${v}`)
+        .join('&');
+    // url.pathname is already encoded once; non-S3 services expect it encoded again.
+    const path = url.pathname.split('/').map(uriEncode).join('/') || '/';
+    const canonicalRequest = [
+        req.method.toUpperCase(),
+        path,
+        query,
+        names.map((n) => `${n}:${canonical[n]}\n`).join(''),
+        signedHeaders,
+        sha256Hex(req.body ?? ''),
+    ].join('\n');
+    const scope = `${date}/${region}/${service}/aws4_request`;
+    const stringToSign = ['AWS4-HMAC-SHA256', amzDate, scope, sha256Hex(canonicalRequest)].join('\n');
+    const key = hmac(hmac(hmac(hmac(`AWS4${credentials.secretAccessKey}`, date), region), service), 'aws4_request');
+    const signature = createHmac('sha256', key).update(stringToSign, 'utf8').digest('hex');
+    return {
+        ...headers,
+        Authorization: `AWS4-HMAC-SHA256 Credential=${credentials.accessKeyId}/${scope}, SignedHeaders=${signedHeaders}, Signature=${signature}`,
+    };
+}
+/**
+ * Static credentials from AWS_ACCESS_KEY_ID/AWS_SECRET_ACCESS_KEY, or a profile
+ * in ~/.aws/credentials (AWS_PROFILE, AWS_SHARED_CREDENTIALS_FILE honored).
+ * SSO and instance roles are not supported; export keys for those
+ * (e.g. `aws configure export-credentials --format env`).
+ */
+export async function loadAwsCredentials(opts = {}) {
+    const env = opts.env ?? process.env;
+    if (!opts.profile && env.AWS_ACCESS_KEY_ID && env.AWS_SECRET_ACCESS_KEY) {
+        return {
+            accessKeyId: env.AWS_ACCESS_KEY_ID,
+            secretAccessKey: env.AWS_SECRET_ACCESS_KEY,
+            ...(env.AWS_SESSION_TOKEN ? { sessionToken: env.AWS_SESSION_TOKEN } : {}),
+        };
+    }
+    const profile = opts.profile ?? env.AWS_PROFILE ?? 'default';
+    const file = env.AWS_SHARED_CREDENTIALS_FILE ?? join(homedir(), '.aws', 'credentials');
+    let text;
+    try {
+        text = await readFile(file, 'utf8');
+    }
+    catch {
+        throw new Error(`No AWS credentials: set AWS_ACCESS_KEY_ID and AWS_SECRET_ACCESS_KEY, or create ${file}.`);
+    }
+    const section = parseIni(text)[profile];
+    if (!section?.aws_access_key_id || !section.aws_secret_access_key) {
+        throw new Error(`AWS profile "${profile}" in ${file} has no aws_access_key_id/aws_secret_access_key.`);
+    }
+    return {
+        accessKeyId: section.aws_access_key_id,
+        secretAccessKey: section.aws_secret_access_key,
+        ...(section.aws_session_token ? { sessionToken: section.aws_session_token } : {}),
+    };
+}
+function parseIni(text) {
+    const sections = {};
+    let current;
+    for (const raw of text.split(/\r?\n/)) {
+        const line = raw.trim();
+        if (!line || line.startsWith('#') || line.startsWith(';'))
+            continue;
+        const header = /^\[\s*(?:profile\s+)?([^\]]+?)\s*\]$/.exec(line);
+        if (header) {
+            current = sections[header[1]] ??= {};
+            continue;
+        }
+        const eq = line.indexOf('=');
+        if (current && eq > 0)
+            current[line.slice(0, eq).trim().toLowerCase()] = line.slice(eq + 1).trim();
+    }
+    return sections;
+}
+//# sourceMappingURL=aws.js.map

package/dist/src/providers/dns/aws.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"aws.js","sourceRoot":"","sources":["../../../../src/providers/dns/aws.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACrD,OAAO,EAAE,QAAQ,EAAE,MAAM,kBAAkB,CAAC;AAC5C,OAAO,EAAE,OAAO,EAAE,MAAM,SAAS,CAAC;AAClC,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AAQjC,MAAM,SAAS,GAAG,CAAC,IAAY,EAAE,EAAE,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;AAC5F,MAAM,IAAI,GAAG,CAAC,GAAoB,EAAE,IAAY,EAAE,EAAE,CAAC,UAAU,CAAC,QAAQ,EAAE,GAAG,CAAC,CAAC,MAAM,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC,MAAM,EAAE,CAAC;AAE7G,8EAA8E;AAC9E,SAAS,SAAS,CAAC,CAAS;IAC1B,OAAO,kBAAkB,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,UAAU,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,IAAI,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,WAAW,EAAE,EAAE,CAAC,CAAC;AAC5G,CAAC;AASD;;;GAGG;AACH,MAAM,UAAU,WAAW,CACzB,GAAoB,EACpB,WAA2B,EAC3B,MAAc,EACd,OAAe,EACf,GAAG,GAAG,IAAI,IAAI,EAAE;IAEhB,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;IAC7B,MAAM,OAAO,GAAG,GAAG,CAAC,WAAW,EAAE,CAAC,OAAO,CAAC,eAAe,EAAE,EAAE,CAAC,CAAC;IAC/D,MAAM,IAAI,GAAG,OAAO,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;IAEjC,MAAM,OAAO,GAA2B,EAAE,GAAG,GAAG,CAAC,OAAO,EAAE,YAAY,EAAE,OAAO,EAAE,CAAC;IAClF,IAAI,WAAW,CAAC,YAAY;QAAE,OAAO,CAAC,sBAAsB,CAAC,GAAG,WAAW,CAAC,YAAY,CAAC;IAEzF,MAAM,SAAS,GAA2B,EAAE,IAAI,EAAE,GAAG,CAAC,IAAI,EAAE,CAAC;IAC7D,KAAK,MAAM,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,OAAO,CAAC;QAAE,SAAS,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,CAAC,OAAO,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC;IACzG,MAAM,KAAK,GAAG,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,IAAI,EAAE,CAAC;IAC5C,MAAM,aAAa,GAAG,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IAEtC,MAAM,KAAK,GAAG,CAAC,GAAG,GAAG,CAAC,YAAY,CAAC;SAChC,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,SAAS,CAAC,CAAC,CAAC,CAAU,CAAC;SACtD,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,EAAE,CAAC,EAAE,EAAE,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE,GAAG,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,GAAG,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,GAAG,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;SAC/F,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC;SAC5B,IAAI,CAAC,GAAG,CAAC,CAAC;IACb,iFAAiF;IACjF,MAAM,IAAI,GAAG,GAAG,CAAC,QAAQ,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,GAAG,CAAC;IAErE,MAAM,gBAAgB,GAAG;QACvB,GAAG,CAAC,MAAM,CAAC,WAAW,EAAE;QACxB,IAAI;QACJ,KAAK;QACL,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,GAAG,CAAC,IAAI,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC;QACnD,aAAa;QACb,SAAS,CAAC,GAAG,CAAC,IAAI,IAAI,EAAE,CAAC;KAC1B,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAEb,MAAM,KAAK,GAAG,GAAG,IAAI,IAAI,MAAM,IAAI,OAAO,eAAe,CAAC;IAC1D,MAAM,YAAY,GAAG,CAAC,kBAAkB,EAAE,OAAO,EAAE,KAAK,EAAE,SAAS,CAAC,gBAAgB,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAClG,MAAM,GAAG,GAAG,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,OAAO,WAAW,CAAC,eAAe,EAAE,EAAE,IAAI,CAAC,EAAE,MAAM,CAAC,EAAE,OAAO,CAAC,EAAE,cAAc,CAAC,CAAC;IAChH,MAAM,SAAS,GAAG,UAAU,CAAC,QAAQ,EAAE,GAAG,CAAC,CAAC,MAAM,CAAC,YAAY,EAAE,MAAM,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;IAEvF,OAAO;QACL,GAAG,OAAO;QACV,aAAa,EAAE,+BAA+B,WAAW,CAAC,WAAW,IAAI,KAAK,mBAAmB,aAAa,eAAe,SAAS,EAAE;KACzI,CAAC;AACJ,CAAC;AAQD;;;;;GAKG;AACH,MAAM,CAAC,KAAK,UAAU,kBAAkB,CAAC,OAA+B,EAAE;IACxE,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,IAAI,OAAO,CAAC,GAAG,CAAC;IACpC,IAAI,CAAC,IAAI,CAAC,OAAO,IAAI,GAAG,CAAC,iBAAiB,IAAI,GAAG,CAAC,qBAAqB,EAAE,CAAC;QACxE,OAAO;YACL,WAAW,EAAE,GAAG,CAAC,iBAAiB;YAClC,eAAe,EAAE,GAAG,CAAC,qBAAqB;YAC1C,GAAG,CAAC,GAAG,CAAC,iBAAiB,CAAC,CAAC,CAAC,EAAE,YAAY,EAAE,GAAG,CAAC,iBAAiB,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SAC1E,CAAC;IACJ,CAAC;IAED,MAAM,OAAO,GAAG,IAAI,CAAC,OAAO,IAAI,GAAG,CAAC,WAAW,IAAI,SAAS,CAAC;IAC7D,MAAM,IAAI,GAAG,GAAG,CAAC,2BAA2B,IAAI,IAAI,CAAC,OAAO,EAAE,EAAE,MAAM,EAAE,aAAa,CAAC,CAAC;IACvF,IAAI,IAAY,CAAC;IACjB,IAAI,CAAC;QACH,IAAI,GAAG,MAAM,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;IACtC,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,IAAI,KAAK,CAAC,kFAAkF,IAAI,GAAG,CAAC,CAAC;IAC7G,CAAC;IACD,MAAM,OAAO,GAAG,QAAQ,CAAC,IAAI,CAAC,CAAC,OAAO,CAAC,CAAC;IACxC,IAAI,CAAC,OAAO,EAAE,iBAAiB,IAAI,CAAC,OAAO,CAAC,qBAAqB,EAAE,CAAC;QAClE,MAAM,IAAI,KAAK,CAAC,gBAAgB,OAAO,QAAQ,IAAI,kDAAkD,CAAC,CAAC;IACzG,CAAC;IACD,OAAO;QACL,WAAW,EAAE,OAAO,CAAC,iBAAiB;QACtC,eAAe,EAAE,OAAO,CAAC,qBAAqB;QAC9C,GAAG,CAAC,OAAO,CAAC,iBAAiB,CAAC,CAAC,CAAC,EAAE,YAAY,EAAE,OAAO,CAAC,iBAAiB,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KAClF,CAAC;AACJ,CAAC;AAED,SAAS,QAAQ,CAAC,IAAY;IAC5B,MAAM,QAAQ,GAA2C,EAAE,CAAC;IAC5D,IAAI,OAA2C,CAAC;IAChD,KAAK,MAAM,GAAG,IAAI,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,EAAE,CAAC;QACtC,MAAM,IAAI,GAAG,GAAG,CAAC,IAAI,EAAE,CAAC;QACxB,IAAI,CAAC,IAAI,IAAI,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC;YAAE,SAAS;QACpE,MAAM,MAAM,GAAG,sCAAsC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACjE,IAAI,MAAM,EAAE,CAAC;YACX,OAAO,GAAG,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAE,CAAC,KAAK,EAAE,CAAC;YACtC,SAAS;QACX,CAAC;QACD,MAAM,EAAE,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;QAC7B,IAAI,OAAO,IAAI,EAAE,GAAG,CAAC;YAAE,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC,EAAE,GAAG,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;IACrG,CAAC;IACD,OAAO,QAAQ,CAAC;AAClB,CAAC"}

package/dist/src/providers/dns/cloudflare.d.ts

@@ -0,0 +1,26 @@
+import { type FetchLike } from '../../http.js';
+import type { DnsProvider, DnsRecord, PlannedChange } from '../../types.js';
+export interface CloudflareOptions {
+    /** Needs Zone:Read and DNS:Edit on the target zone. */
+    apiToken: string;
+    baseUrl?: string;
+    fetch?: FetchLike;
+}
+export declare class CloudflareDns implements DnsProvider {
+    private readonly opts;
+    readonly name = "cloudflare";
+    private readonly baseUrl;
+    private readonly fetchImpl;
+    private readonly zoneIds;
+    /** Zones confirmed to exist, by name. */
+    private readonly knownZones;
+    constructor(opts: CloudflareOptions);
+    plan(records: DnsRecord[], opts?: {
+        overwrite?: boolean;
+    }): Promise<PlannedChange[]>;
+    apply(changes: PlannedChange[]): Promise<void>;
+    /** Finds the zone holding `name` by trying it and each parent domain. */
+    zoneFor(name: string): Promise<string>;
+    private lookupZone;
+    private request;
+}

package/dist/src/providers/dns/cloudflare.js

@@ -0,0 +1,97 @@
+import { ConfigError, DnsConflictError } from '../../errors.js';
+import { requestJson } from '../../http.js';
+import { decideChange, normalizeName } from '../../records.js';
+export class CloudflareDns {
+    opts;
+    name = 'cloudflare';
+    baseUrl;
+    fetchImpl;
+    zoneIds = new Map();
+    /** Zones confirmed to exist, by name. */
+    knownZones = new Map();
+    constructor(opts) {
+        this.opts = opts;
+        this.baseUrl = opts.baseUrl ?? 'https://api.cloudflare.com/client/v4';
+        this.fetchImpl = opts.fetch ?? fetch;
+    }
+    async plan(records, opts = {}) {
+        const changes = [];
+        for (const record of records) {
+            const zoneId = await this.zoneFor(record.name);
+            const existing = await this.request(`/zones/${zoneId}/dns_records?name=${encodeURIComponent(record.name)}&per_page=100`);
+            const neutral = existing.map((e) => ({
+                id: e.id,
+                type: e.type,
+                value: e.content,
+                priority: e.priority,
+                proxied: e.proxied,
+            }));
+            changes.push(decideChange(record, neutral, opts.overwrite, records));
+        }
+        return changes;
+    }
+    async apply(changes) {
+        const conflicts = changes.filter((c) => c.action === 'conflict');
+        if (conflicts.length > 0)
+            throw new DnsConflictError(conflicts);
+        for (const change of changes) {
+            if (change.action === 'noop')
+                continue;
+            const zoneId = await this.zoneFor(change.record.name);
+            const body = toCloudflareBody(change.record);
+            if (change.action === 'update') {
+                await this.request(`/zones/${zoneId}/dns_records/${change.existingId}`, { method: 'PUT', body });
+            }
+            else {
+                await this.request(`/zones/${zoneId}/dns_records`, { method: 'POST', body });
+            }
+        }
+    }
+    /** Finds the zone holding `name` by trying it and each parent domain. */
+    async zoneFor(name) {
+        const labels = normalizeName(name).split('.');
+        const candidates = labels.slice(0, -1).map((_, i) => labels.slice(i).join('.'));
+        // Records usually share a zone; reuse one already found before calling the API.
+        const known = candidates.find((c) => this.knownZones.has(c));
+        if (known)
+            return this.knownZones.get(known);
+        for (const candidate of candidates) {
+            const id = await this.lookupZone(candidate);
+            if (id) {
+                this.knownZones.set(candidate, id);
+                return id;
+            }
+        }
+        throw new ConfigError(`No Cloudflare zone found for ${name}. Check the domain is on this Cloudflare account and the token has Zone:Read access.`);
+    }
+    lookupZone(zoneName) {
+        let id = this.zoneIds.get(zoneName);
+        if (!id) {
+            id = this.request(`/zones?name=${encodeURIComponent(zoneName)}`).then((z) => z[0]?.id ?? null);
+            this.zoneIds.set(zoneName, id);
+        }
+        return id;
+    }
+    async request(path, opts = {}) {
+        const envelope = await requestJson(this.fetchImpl, 'Cloudflare', this.baseUrl + path, { ...opts, headers: { Authorization: `Bearer ${this.opts.apiToken}` } }, describeCloudflareError);
+        return envelope.result;
+    }
+}
+function toCloudflareBody(record) {
+    return {
+        type: record.type,
+        name: record.name,
+        content: record.value,
+        ttl: 1, // automatic
+        // Proxied CNAMEs resolve to Cloudflare IPs, which fails provider verification.
+        ...(record.type === 'CNAME' ? { proxied: false } : {}),
+        ...(record.type === 'MX' ? { priority: record.priority ?? 10 } : {}),
+    };
+}
+function describeCloudflareError(body) {
+    const errors = body?.errors;
+    if (!Array.isArray(errors) || errors.length === 0)
+        return undefined;
+    return errors.map((e) => `${e.message} (code ${e.code})`).join('; ');
+}
+//# sourceMappingURL=cloudflare.js.map

package/dist/src/providers/dns/cloudflare.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"cloudflare.js","sourceRoot":"","sources":["../../../../src/providers/dns/cloudflare.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,WAAW,EAAE,gBAAgB,EAAE,MAAM,iBAAiB,CAAC;AAChE,OAAO,EAAE,WAAW,EAAuC,MAAM,eAAe,CAAC;AACjF,OAAO,EAAE,YAAY,EAAE,aAAa,EAAE,MAAM,kBAAkB,CAAC;AAyB/D,MAAM,OAAO,aAAa;IAQK;IAPpB,IAAI,GAAG,YAAY,CAAC;IACZ,OAAO,CAAS;IAChB,SAAS,CAAY;IACrB,OAAO,GAAG,IAAI,GAAG,EAAkC,CAAC;IACrE,yCAAyC;IACxB,UAAU,GAAG,IAAI,GAAG,EAAkB,CAAC;IAExD,YAA6B,IAAuB;QAAvB,SAAI,GAAJ,IAAI,CAAmB;QAClD,IAAI,CAAC,OAAO,GAAG,IAAI,CAAC,OAAO,IAAI,sCAAsC,CAAC;QACtE,IAAI,CAAC,SAAS,GAAG,IAAI,CAAC,KAAK,IAAI,KAAK,CAAC;IACvC,CAAC;IAED,KAAK,CAAC,IAAI,CAAC,OAAoB,EAAE,OAAgC,EAAE;QACjE,MAAM,OAAO,GAAoB,EAAE,CAAC;QACpC,KAAK,MAAM,MAAM,IAAI,OAAO,EAAE,CAAC;YAC7B,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;YAC/C,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,OAAO,CACjC,UAAU,MAAM,qBAAqB,kBAAkB,CAAC,MAAM,CAAC,IAAI,CAAC,eAAe,CACpF,CAAC;YACF,MAAM,OAAO,GAAG,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;gBACnC,EAAE,EAAE,CAAC,CAAC,EAAE;gBACR,IAAI,EAAE,CAAC,CAAC,IAAI;gBACZ,KAAK,EAAE,CAAC,CAAC,OAAO;gBAChB,QAAQ,EAAE,CAAC,CAAC,QAAQ;gBACpB,OAAO,EAAE,CAAC,CAAC,OAAO;aACnB,CAAC,CAAC,CAAC;YACJ,OAAO,CAAC,IAAI,CAAC,YAAY,CAAC,MAAM,EAAE,OAAO,EAAE,IAAI,CAAC,SAAS,EAAE,OAAO,CAAC,CAAC,CAAC;QACvE,CAAC;QACD,OAAO,OAAO,CAAC;IACjB,CAAC;IAED,KAAK,CAAC,KAAK,CAAC,OAAwB;QAClC,MAAM,SAAS,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,KAAK,UAAU,CAAC,CAAC;QACjE,IAAI,SAAS,CAAC,MAAM,GAAG,CAAC;YAAE,MAAM,IAAI,gBAAgB,CAAC,SAAS,CAAC,CAAC;QAEhE,KAAK,MAAM,MAAM,IAAI,OAAO,EAAE,CAAC;YAC7B,IAAI,MAAM,CAAC,MAAM,KAAK,MAAM;gBAAE,SAAS;YACvC,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;YACtD,MAAM,IAAI,GAAG,gBAAgB,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;YAC7C,IAAI,MAAM,CAAC,MAAM,KAAK,QAAQ,EAAE,CAAC;gBAC/B,MAAM,IAAI,CAAC,OAAO,CAAC,UAAU,MAAM,gBAAgB,MAAM,CAAC,UAAU,EAAE,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;YACnG,CAAC;iBAAM,CAAC;gBACN,MAAM,IAAI,CAAC,OAAO,CAAC,UAAU,MAAM,cAAc,EAAE,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC;YAC/E,CAAC;QACH,CAAC;IACH,CAAC;IAED,yEAAyE;IACzE,KAAK,CAAC,OAAO,CAAC,IAAY;QACxB,MAAM,MAAM,GAAG,aAAa,CAAC,IAAI,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;QAC9C,MAAM,UAAU,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC;QAChF,gFAAgF;QAChF,MAAM,KAAK,GAAG,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;QAC7D,IAAI,KAAK;YAAE,OAAO,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,KAAK,CAAE,CAAC;QAC9C,KAAK,MAAM,SAAS,IAAI,UAAU,EAAE,CAAC;YACnC,MAAM,EAAE,GAAG,MAAM,IAAI,CAAC,UAAU,CAAC,SAAS,CAAC,CAAC;YAC5C,IAAI,EAAE,EAAE,CAAC;gBACP,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,SAAS,EAAE,EAAE,CAAC,CAAC;gBACnC,OAAO,EAAE,CAAC;YACZ,CAAC;QACH,CAAC;QACD,MAAM,IAAI,WAAW,CACnB,gCAAgC,IAAI,sFAAsF,CAC3H,CAAC;IACJ,CAAC;IAEO,UAAU,CAAC,QAAgB;QACjC,IAAI,EAAE,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;QACpC,IAAI,CAAC,EAAE,EAAE,CAAC;YACR,EAAE,GAAG,IAAI,CAAC,OAAO,CAAmB,eAAe,kBAAkB,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,EAAE,IAAI,IAAI,CAAC,CAAC;YACjH,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,QAAQ,EAAE,EAAE,CAAC,CAAC;QACjC,CAAC;QACD,OAAO,EAAE,CAAC;IACZ,CAAC;IAEO,KAAK,CAAC,OAAO,CAAI,IAAY,EAAE,OAAuB,EAAE;QAC9D,MAAM,QAAQ,GAAG,MAAM,WAAW,CAChC,IAAI,CAAC,SAAS,EACd,YAAY,EACZ,IAAI,CAAC,OAAO,GAAG,IAAI,EACnB,EAAE,GAAG,IAAI,EAAE,OAAO,EAAE,EAAE,aAAa,EAAE,UAAU,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,EAAE,EAAE,EACvE,uBAAuB,CACxB,CAAC;QACF,OAAO,QAAQ,CAAC,MAAM,CAAC;IACzB,CAAC;CACF;AAED,SAAS,gBAAgB,CAAC,MAAiB;IACzC,OAAO;QACL,IAAI,EAAE,MAAM,CAAC,IAAI;QACjB,IAAI,EAAE,MAAM,CAAC,IAAI;QACjB,OAAO,EAAE,MAAM,CAAC,KAAK;QACrB,GAAG,EAAE,CAAC,EAAE,YAAY;QACpB,+EAA+E;QAC/E,GAAG,CAAC,MAAM,CAAC,IAAI,KAAK,OAAO,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACtD,GAAG,CAAC,MAAM,CAAC,IAAI,KAAK,IAAI,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,MAAM,CAAC,QAAQ,IAAI,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KACrE,CAAC;AACJ,CAAC;AAED,SAAS,uBAAuB,CAAC,IAAa;IAC5C,MAAM,MAAM,GAAI,IAAwC,EAAE,MAAM,CAAC;IACjE,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,SAAS,CAAC;IACpE,OAAO,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,GAAG,CAAC,CAAC,OAAO,UAAU,CAAC,CAAC,IAAI,GAAG,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AACvE,CAAC"}

package/dist/src/providers/dns/manual.d.ts

@@ -0,0 +1,12 @@
+import type { DnsProvider, DnsRecord, PlannedChange } from '../../types.js';
+/**
+ * For DNS hosts without an API integration: hands the records to a callback
+ * (e.g. print them and wait for the user), then relies on propagation polling.
+ */
+export declare class ManualDns implements DnsProvider {
+    private readonly onRecords;
+    readonly name = "manual";
+    constructor(onRecords: (records: DnsRecord[]) => Promise<void>);
+    plan(records: DnsRecord[]): Promise<PlannedChange[]>;
+    apply(changes: PlannedChange[]): Promise<void>;
+}

package/dist/src/providers/dns/manual.js

@@ -0,0 +1,18 @@
+/**
+ * For DNS hosts without an API integration: hands the records to a callback
+ * (e.g. print them and wait for the user), then relies on propagation polling.
+ */
+export class ManualDns {
+    onRecords;
+    name = 'manual';
+    constructor(onRecords) {
+        this.onRecords = onRecords;
+    }
+    async plan(records) {
+        return records.map((record) => ({ record, action: 'create' }));
+    }
+    async apply(changes) {
+        await this.onRecords(changes.filter((c) => c.action !== 'noop').map((c) => c.record));
+    }
+}
+//# sourceMappingURL=manual.js.map

package/dist/src/providers/dns/manual.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"manual.js","sourceRoot":"","sources":["../../../../src/providers/dns/manual.ts"],"names":[],"mappings":"AAEA;;;GAGG;AACH,MAAM,OAAO,SAAS;IAGS;IAFpB,IAAI,GAAG,QAAQ,CAAC;IAEzB,YAA6B,SAAkD;QAAlD,cAAS,GAAT,SAAS,CAAyC;IAAG,CAAC;IAEnF,KAAK,CAAC,IAAI,CAAC,OAAoB;QAC7B,OAAO,OAAO,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,QAAQ,EAAE,CAAC,CAAC,CAAC;IACjE,CAAC;IAED,KAAK,CAAC,KAAK,CAAC,OAAwB;QAClC,MAAM,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,KAAK,MAAM,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC;IACxF,CAAC;CACF"}