dkimkit 0.0.0-stage → 0.6.1

package/dist/src/providers/dns/route53.d.ts

@@ -0,0 +1,34 @@
+import { type FetchLike } from '../../http.js';
+import type { DnsProvider, DnsRecord, PlannedChange } from '../../types.js';
+import { type AwsCredentials } from './aws.js';
+export interface Route53Options {
+    /** Static credentials, or a loader called once on first use (e.g. `() => loadAwsCredentials()`). */
+    credentials: AwsCredentials | (() => Promise<AwsCredentials>);
+    /** Use this hosted zone instead of looking one up by name. */
+    hostedZoneId?: string;
+    baseUrl?: string;
+    fetch?: FetchLike;
+}
+/**
+ * Route53 stores one record set per (name, type) holding every value, so
+ * writes rebuild the whole set (keeping values we didn't create) and UPSERT it.
+ */
+export declare class Route53Dns implements DnsProvider {
+    private readonly opts;
+    readonly name = "route53";
+    private readonly baseUrl;
+    private readonly fetchImpl;
+    private credentials?;
+    private readonly zoneIds;
+    private readonly knownZones;
+    constructor(opts: Route53Options);
+    plan(records: DnsRecord[], opts?: {
+        overwrite?: boolean;
+    }): Promise<PlannedChange[]>;
+    apply(changes: PlannedChange[]): Promise<void>;
+    /** Finds the public hosted zone holding `name` by trying it and each parent domain. */
+    zoneFor(name: string): Promise<string>;
+    private lookupZone;
+    private listSets;
+    private call;
+}

package/dist/src/providers/dns/route53.js

@@ -0,0 +1,176 @@
+import { ConfigError, DnsConflictError } from '../../errors.js';
+import { requestText } from '../../http.js';
+import { decideChange, normalizeName } from '../../records.js';
+import { decodeXml, encodeXml, xmlTags, xmlText } from '../../xml.js';
+import { signRequest } from './aws.js';
+const API_VERSION = '2013-04-01';
+const DEFAULT_TTL = 300;
+/**
+ * Route53 stores one record set per (name, type) holding every value, so
+ * writes rebuild the whole set (keeping values we didn't create) and UPSERT it.
+ */
+export class Route53Dns {
+    opts;
+    name = 'route53';
+    baseUrl;
+    fetchImpl;
+    credentials;
+    zoneIds = new Map();
+    knownZones = new Map();
+    constructor(opts) {
+        this.opts = opts;
+        this.baseUrl = opts.baseUrl ?? 'https://route53.amazonaws.com';
+        this.fetchImpl = opts.fetch ?? fetch;
+    }
+    async plan(records, opts = {}) {
+        const changes = [];
+        for (const record of records) {
+            const zoneId = await this.zoneFor(record.name);
+            const existing = (await this.listSets(zoneId, record.name)).flatMap(toExisting);
+            changes.push(decideChange(record, existing, opts.overwrite, records));
+        }
+        return changes;
+    }
+    async apply(changes) {
+        const conflicts = changes.filter((c) => c.action === 'conflict');
+        if (conflicts.length > 0)
+            throw new DnsConflictError(conflicts);
+        // zone → (name|type → changes)
+        const byZone = new Map();
+        for (const change of changes) {
+            if (change.action === 'noop')
+                continue;
+            const zoneId = await this.zoneFor(change.record.name);
+            const sets = byZone.get(zoneId) ?? new Map();
+            byZone.set(zoneId, sets);
+            const key = `${change.record.name}|${change.record.type}`;
+            sets.set(key, [...(sets.get(key) ?? []), change]);
+        }
+        for (const [zoneId, sets] of byZone) {
+            const upserts = [];
+            for (const group of sets.values()) {
+                const { name, type } = group[0].record;
+                // Re-read so values added since planning aren't dropped.
+                const current = (await this.listSets(zoneId, name)).find((s) => s.type === type);
+                let values = type === 'CNAME' ? [] : [...(current?.values ?? [])];
+                for (const change of group) {
+                    if (change.action === 'update' && change.existingId)
+                        values = values.filter((v) => v !== change.existingId);
+                    values.push(formatValue(change.record));
+                }
+                upserts.push({ name, type, ttl: current?.ttl ?? DEFAULT_TTL, values: [...new Set(values)] });
+            }
+            await this.call('POST', `/hostedzone/${zoneId}/rrset`, changeBatchXml(upserts));
+        }
+    }
+    /** Finds the public hosted zone holding `name` by trying it and each parent domain. */
+    async zoneFor(name) {
+        if (this.opts.hostedZoneId)
+            return this.opts.hostedZoneId.replace(/^\/hostedzone\//, '');
+        const labels = normalizeName(name).split('.');
+        const candidates = labels.slice(0, -1).map((_, i) => labels.slice(i).join('.'));
+        const known = candidates.find((c) => this.knownZones.has(c));
+        if (known)
+            return this.knownZones.get(known);
+        for (const candidate of candidates) {
+            const id = await this.lookupZone(candidate);
+            if (id) {
+                this.knownZones.set(candidate, id);
+                return id;
+            }
+        }
+        throw new ConfigError(`No public Route53 hosted zone found for ${name}. Check the AWS account, or pass a hosted zone id.`);
+    }
+    lookupZone(zoneName) {
+        let id = this.zoneIds.get(zoneName);
+        if (!id) {
+            id = this.call('GET', `/hostedzonesbyname?dnsname=${encodeURIComponent(zoneName)}&maxitems=10`).then((xml) => {
+                // Results start at dnsname and continue alphabetically, so match exactly.
+                const zone = xmlTags(xml, 'HostedZone').find((z) => decodeName(xmlText(z, 'Name') ?? '') === zoneName && xmlText(z, 'PrivateZone') !== 'true');
+                return zone ? xmlText(zone, 'Id').replace(/^\/hostedzone\//, '') : null;
+            });
+            this.zoneIds.set(zoneName, id);
+        }
+        return id;
+    }
+    async listSets(zoneId, name) {
+        // Listing starts at `name`; all of a name's sets are adjacent.
+        const xml = await this.call('GET', `/hostedzone/${zoneId}/rrset?name=${encodeURIComponent(name)}&maxitems=20`);
+        return xmlTags(xml, 'ResourceRecordSet')
+            .map((s) => {
+            const ttl = xmlText(s, 'TTL');
+            const alias = xmlTags(s, 'AliasTarget')[0];
+            return {
+                name: decodeName(xmlText(s, 'Name') ?? ''),
+                type: xmlText(s, 'Type') ?? '',
+                ...(ttl ? { ttl: Number(ttl) } : {}),
+                values: xmlTags(s, 'Value').map((v) => decodeXml(v.trim())),
+                ...(alias ? { alias: normalizeName(xmlText(alias, 'DNSName') ?? '') } : {}),
+            };
+        })
+            .filter((s) => s.name === name);
+    }
+    async call(method, path, body) {
+        this.credentials ??= Promise.resolve(typeof this.opts.credentials === 'function' ? this.opts.credentials() : this.opts.credentials);
+        const credentials = await this.credentials;
+        const url = `${this.baseUrl}/${API_VERSION}${path}`;
+        return requestText(this.fetchImpl, 'Route53', url, () => ({
+            method,
+            body,
+            headers: signRequest({ method, url, body, headers: body ? { 'content-type': 'application/xml' } : {} }, credentials, 'us-east-1', 'route53'),
+        }), describeRoute53Error);
+    }
+}
+function toExisting(set) {
+    if (set.alias)
+        return [{ id: `alias:${set.alias}`, type: set.type, value: set.alias }];
+    return set.values.map((raw) => {
+        if (set.type === 'MX') {
+            const [priority, host] = raw.split(/\s+/);
+            return { id: raw, type: 'MX', value: host ?? '', priority: Number(priority) };
+        }
+        return { id: raw, type: set.type, value: set.type === 'TXT' ? unquoteTxt(raw) : raw };
+    });
+}
+function formatValue(record) {
+    switch (record.type) {
+        case 'MX':
+            return `${record.priority ?? 10} ${record.value}`;
+        case 'TXT': {
+            // Route53 wants quoted strings, each at most 255 characters.
+            const escaped = record.value.replace(/\\/g, '\\\\').replace(/"/g, '\\"');
+            return (escaped.match(/[\s\S]{1,255}/g) ?? ['']).map((chunk) => `"${chunk}"`).join(' ');
+        }
+        default:
+            return record.value;
+    }
+}
+function unquoteTxt(raw) {
+    const chunks = [...raw.matchAll(/"((?:[^"\\]|\\.)*)"/g)].map((m) => m[1].replace(/\\(.)/g, '$1'));
+    return chunks.length > 0 ? chunks.join('') : raw;
+}
+/** Route53 returns names with a trailing dot and octal escapes (e.g. \052 for *). */
+function decodeName(name) {
+    return normalizeName(name.replace(/\\(\d{3})/g, (_, oct) => String.fromCharCode(parseInt(oct, 8))));
+}
+function changeBatchXml(sets) {
+    const changes = sets
+        .map((s) => `<Change><Action>UPSERT</Action><ResourceRecordSet><Name>${encodeXml(s.name)}</Name><Type>${s.type}</Type>` +
+        `<TTL>${s.ttl ?? DEFAULT_TTL}</TTL><ResourceRecords>` +
+        s.values.map((v) => `<ResourceRecord><Value>${encodeXml(v)}</Value></ResourceRecord>`).join('') +
+        `</ResourceRecords></ResourceRecordSet></Change>`)
+        .join('');
+    return (`<?xml version="1.0" encoding="UTF-8"?>` +
+        `<ChangeResourceRecordSetsRequest xmlns="https://route53.amazonaws.com/doc/${API_VERSION}/">` +
+        `<ChangeBatch><Comment>dkimkit</Comment><Changes>${changes}</Changes></ChangeBatch>` +
+        `</ChangeResourceRecordSetsRequest>`);
+}
+function describeRoute53Error(text) {
+    // InvalidChangeBatch nests per-change <Message>s; other errors have one.
+    const messages = xmlTags(text, 'Message').map((m) => decodeXml(m.trim()));
+    const code = xmlText(text, 'Code');
+    if (messages.length === 0)
+        return code;
+    return code ? `${code}: ${messages.join('; ')}` : messages.join('; ');
+}
+//# sourceMappingURL=route53.js.map

package/dist/src/providers/dns/route53.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"route53.js","sourceRoot":"","sources":["../../../../src/providers/dns/route53.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,WAAW,EAAE,gBAAgB,EAAE,MAAM,iBAAiB,CAAC;AAChE,OAAO,EAAE,WAAW,EAAkB,MAAM,eAAe,CAAC;AAC5D,OAAO,EAAE,YAAY,EAAE,aAAa,EAAuB,MAAM,kBAAkB,CAAC;AAEpF,OAAO,EAAE,SAAS,EAAE,SAAS,EAAE,OAAO,EAAE,OAAO,EAAE,MAAM,cAAc,CAAC;AACtE,OAAO,EAAE,WAAW,EAAuB,MAAM,UAAU,CAAC;AAE5D,MAAM,WAAW,GAAG,YAAY,CAAC;AACjC,MAAM,WAAW,GAAG,GAAG,CAAC;AAoBxB;;;GAGG;AACH,MAAM,OAAO,UAAU;IAQQ;IAPpB,IAAI,GAAG,SAAS,CAAC;IACT,OAAO,CAAS;IAChB,SAAS,CAAY;IAC9B,WAAW,CAA2B;IAC7B,OAAO,GAAG,IAAI,GAAG,EAAkC,CAAC;IACpD,UAAU,GAAG,IAAI,GAAG,EAAkB,CAAC;IAExD,YAA6B,IAAoB;QAApB,SAAI,GAAJ,IAAI,CAAgB;QAC/C,IAAI,CAAC,OAAO,GAAG,IAAI,CAAC,OAAO,IAAI,+BAA+B,CAAC;QAC/D,IAAI,CAAC,SAAS,GAAG,IAAI,CAAC,KAAK,IAAI,KAAK,CAAC;IACvC,CAAC;IAED,KAAK,CAAC,IAAI,CAAC,OAAoB,EAAE,OAAgC,EAAE;QACjE,MAAM,OAAO,GAAoB,EAAE,CAAC;QACpC,KAAK,MAAM,MAAM,IAAI,OAAO,EAAE,CAAC;YAC7B,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;YAC/C,MAAM,QAAQ,GAAG,CAAC,MAAM,IAAI,CAAC,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC;YAChF,OAAO,CAAC,IAAI,CAAC,YAAY,CAAC,MAAM,EAAE,QAAQ,EAAE,IAAI,CAAC,SAAS,EAAE,OAAO,CAAC,CAAC,CAAC;QACxE,CAAC;QACD,OAAO,OAAO,CAAC;IACjB,CAAC;IAED,KAAK,CAAC,KAAK,CAAC,OAAwB;QAClC,MAAM,SAAS,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,KAAK,UAAU,CAAC,CAAC;QACjE,IAAI,SAAS,CAAC,MAAM,GAAG,CAAC;YAAE,MAAM,IAAI,gBAAgB,CAAC,SAAS,CAAC,CAAC;QAEhE,+BAA+B;QAC/B,MAAM,MAAM,GAAG,IAAI,GAAG,EAAwC,CAAC;QAC/D,KAAK,MAAM,MAAM,IAAI,OAAO,EAAE,CAAC;YAC7B,IAAI,MAAM,CAAC,MAAM,KAAK,MAAM;gBAAE,SAAS;YACvC,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;YACtD,MAAM,IAAI,GAAG,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC,IAAI,IAAI,GAAG,EAA2B,CAAC;YACtE,MAAM,CAAC,GAAG,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC;YACzB,MAAM,GAAG,GAAG,GAAG,MAAM,CAAC,MAAM,CAAC,IAAI,IAAI,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC;YAC1D,IAAI,CAAC,GAAG,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,IAAI,EAAE,CAAC,EAAE,MAAM,CAAC,CAAC,CAAC;QACpD,CAAC;QAED,KAAK,MAAM,CAAC,MAAM,EAAE,IAAI,CAAC,IAAI,MAAM,EAAE,CAAC;YACpC,MAAM,OAAO,GAAgB,EAAE,CAAC;YAChC,KAAK,MAAM,KAAK,IAAI,IAAI,CAAC,MAAM,EAAE,EAAE,CAAC;gBAClC,MAAM,EAAE,IAAI,EAAE,IAAI,EAAE,GAAG,KAAK,CAAC,CAAC,CAAE,CAAC,MAAM,CAAC;gBACxC,yDAAyD;gBACzD,MAAM,OAAO,GAAG,CAAC,MAAM,IAAI,CAAC,QAAQ,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,IAAI,CAAC,CAAC;gBACjF,IAAI,MAAM,GAAG,IAAI,KAAK,OAAO,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,EAAE,MAAM,IAAI,EAAE,CAAC,CAAC,CAAC;gBAClE,KAAK,MAAM,MAAM,IAAI,KAAK,EAAE,CAAC;oBAC3B,IAAI,MAAM,CAAC,MAAM,KAAK,QAAQ,IAAI,MAAM,CAAC,UAAU;wBAAE,MAAM,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,KAAK,MAAM,CAAC,UAAU,CAAC,CAAC;oBAC5G,MAAM,CAAC,IAAI,CAAC,WAAW,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC;gBAC1C,CAAC;gBACD,OAAO,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,IAAI,EAAE,GAAG,EAAE,OAAO,EAAE,GAAG,IAAI,WAAW,EAAE,MAAM,EAAE,CAAC,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,CAAC,EAAE,CAAC,CAAC;YAC/F,CAAC;YACD,MAAM,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,eAAe,MAAM,QAAQ,EAAE,cAAc,CAAC,OAAO,CAAC,CAAC,CAAC;QAClF,CAAC;IACH,CAAC;IAED,uFAAuF;IACvF,KAAK,CAAC,OAAO,CAAC,IAAY;QACxB,IAAI,IAAI,CAAC,IAAI,CAAC,YAAY;YAAE,OAAO,IAAI,CAAC,IAAI,CAAC,YAAY,CAAC,OAAO,CAAC,iBAAiB,EAAE,EAAE,CAAC,CAAC;QACzF,MAAM,MAAM,GAAG,aAAa,CAAC,IAAI,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;QAC9C,MAAM,UAAU,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC;QAChF,MAAM,KAAK,GAAG,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;QAC7D,IAAI,KAAK;YAAE,OAAO,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,KAAK,CAAE,CAAC;QAC9C,KAAK,MAAM,SAAS,IAAI,UAAU,EAAE,CAAC;YACnC,MAAM,EAAE,GAAG,MAAM,IAAI,CAAC,UAAU,CAAC,SAAS,CAAC,CAAC;YAC5C,IAAI,EAAE,EAAE,CAAC;gBACP,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,SAAS,EAAE,EAAE,CAAC,CAAC;gBACnC,OAAO,EAAE,CAAC;YACZ,CAAC;QACH,CAAC;QACD,MAAM,IAAI,WAAW,CACnB,2CAA2C,IAAI,oDAAoD,CACpG,CAAC;IACJ,CAAC;IAEO,UAAU,CAAC,QAAgB;QACjC,IAAI,EAAE,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;QACpC,IAAI,CAAC,EAAE,EAAE,CAAC;YACR,EAAE,GAAG,IAAI,CAAC,IAAI,CAAC,KAAK,EAAE,8BAA8B,kBAAkB,CAAC,QAAQ,CAAC,cAAc,CAAC,CAAC,IAAI,CAAC,CAAC,GAAG,EAAE,EAAE;gBAC3G,0EAA0E;gBAC1E,MAAM,IAAI,GAAG,OAAO,CAAC,GAAG,EAAE,YAAY,CAAC,CAAC,IAAI,CAC1C,CAAC,CAAC,EAAE,EAAE,CAAC,UAAU,CAAC,OAAO,CAAC,CAAC,EAAE,MAAM,CAAC,IAAI,EAAE,CAAC,KAAK,QAAQ,IAAI,OAAO,CAAC,CAAC,EAAE,aAAa,CAAC,KAAK,MAAM,CACjG,CAAC;gBACF,OAAO,IAAI,CAAC,CAAC,CAAC,OAAO,CAAC,IAAI,EAAE,IAAI,CAAE,CAAC,OAAO,CAAC,iBAAiB,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;YAC3E,CAAC,CAAC,CAAC;YACH,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,QAAQ,EAAE,EAAE,CAAC,CAAC;QACjC,CAAC;QACD,OAAO,EAAE,CAAC;IACZ,CAAC;IAEO,KAAK,CAAC,QAAQ,CAAC,MAAc,EAAE,IAAY;QACjD,+DAA+D;QAC/D,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,KAAK,EAAE,eAAe,MAAM,eAAe,kBAAkB,CAAC,IAAI,CAAC,cAAc,CAAC,CAAC;QAC/G,OAAO,OAAO,CAAC,GAAG,EAAE,mBAAmB,CAAC;aACrC,GAAG,CAAC,CAAC,CAAC,EAAa,EAAE;YACpB,MAAM,GAAG,GAAG,OAAO,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC;YAC9B,MAAM,KAAK,GAAG,OAAO,CAAC,CAAC,EAAE,aAAa,CAAC,CAAC,CAAC,CAAC,CAAC;YAC3C,OAAO;gBACL,IAAI,EAAE,UAAU,CAAC,OAAO,CAAC,CAAC,EAAE,MAAM,CAAC,IAAI,EAAE,CAAC;gBAC1C,IAAI,EAAE,OAAO,CAAC,CAAC,EAAE,MAAM,CAAC,IAAI,EAAE;gBAC9B,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,GAAG,EAAE,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;gBACpC,MAAM,EAAE,OAAO,CAAC,CAAC,EAAE,OAAO,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC;gBAC3D,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,aAAa,CAAC,OAAO,CAAC,KAAK,EAAE,SAAS,CAAC,IAAI,EAAE,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;aAC5E,CAAC;QACJ,CAAC,CAAC;aACD,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,IAAI,CAAC,CAAC;IACpC,CAAC;IAEO,KAAK,CAAC,IAAI,CAAC,MAAc,EAAE,IAAY,EAAE,IAAa;QAC5D,IAAI,CAAC,WAAW,KAAK,OAAO,CAAC,OAAO,CAClC,OAAO,IAAI,CAAC,IAAI,CAAC,WAAW,KAAK,UAAU,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,WAAW,CAC9F,CAAC;QACF,MAAM,WAAW,GAAG,MAAM,IAAI,CAAC,WAAW,CAAC;QAC3C,MAAM,GAAG,GAAG,GAAG,IAAI,CAAC,OAAO,IAAI,WAAW,GAAG,IAAI,EAAE,CAAC;QACpD,OAAO,WAAW,CAChB,IAAI,CAAC,SAAS,EACd,SAAS,EACT,GAAG,EACH,GAAG,EAAE,CAAC,CAAC;YACL,MAAM;YACN,IAAI;YACJ,OAAO,EAAE,WAAW,CAClB,EAAE,MAAM,EAAE,GAAG,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI,CAAC,CAAC,CAAC,EAAE,cAAc,EAAE,iBAAiB,EAAE,CAAC,CAAC,CAAC,EAAE,EAAE,EACjF,WAAW,EACX,WAAW,EACX,SAAS,CACV;SACF,CAAC,EACF,oBAAoB,CACrB,CAAC;IACJ,CAAC;CACF;AAED,SAAS,UAAU,CAAC,GAAc;IAChC,IAAI,GAAG,CAAC,KAAK;QAAE,OAAO,CAAC,EAAE,EAAE,EAAE,SAAS,GAAG,CAAC,KAAK,EAAE,EAAE,IAAI,EAAE,GAAG,CAAC,IAAI,EAAE,KAAK,EAAE,GAAG,CAAC,KAAK,EAAE,CAAC,CAAC;IACvF,OAAO,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE;QAC5B,IAAI,GAAG,CAAC,IAAI,KAAK,IAAI,EAAE,CAAC;YACtB,MAAM,CAAC,QAAQ,EAAE,IAAI,CAAC,GAAG,GAAG,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;YAC1C,OAAO,EAAE,EAAE,EAAE,GAAG,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,IAAI,EAAE,EAAE,QAAQ,EAAE,MAAM,CAAC,QAAQ,CAAC,EAAE,CAAC;QAChF,CAAC;QACD,OAAO,EAAE,EAAE,EAAE,GAAG,EAAE,IAAI,EAAE,GAAG,CAAC,IAAI,EAAE,KAAK,EAAE,GAAG,CAAC,IAAI,KAAK,KAAK,CAAC,CAAC,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,EAAE,CAAC;IACxF,CAAC,CAAC,CAAC;AACL,CAAC;AAED,SAAS,WAAW,CAAC,MAAiB;IACpC,QAAQ,MAAM,CAAC,IAAI,EAAE,CAAC;QACpB,KAAK,IAAI;YACP,OAAO,GAAG,MAAM,CAAC,QAAQ,IAAI,EAAE,IAAI,MAAM,CAAC,KAAK,EAAE,CAAC;QACpD,KAAK,KAAK,CAAC,CAAC,CAAC;YACX,6DAA6D;YAC7D,MAAM,OAAO,GAAG,MAAM,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC,OAAO,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;YACzE,OAAO,CAAC,OAAO,CAAC,KAAK,CAAC,gBAAgB,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,IAAI,KAAK,GAAG,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QAC1F,CAAC;QACD;YACE,OAAO,MAAM,CAAC,KAAK,CAAC;IACxB,CAAC;AACH,CAAC;AAED,SAAS,UAAU,CAAC,GAAW;IAC7B,MAAM,MAAM,GAAG,CAAC,GAAG,GAAG,CAAC,QAAQ,CAAC,sBAAsB,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,CAAE,CAAC,OAAO,CAAC,QAAQ,EAAE,IAAI,CAAC,CAAC,CAAC;IACnG,OAAO,MAAM,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC;AACnD,CAAC;AAED,qFAAqF;AACrF,SAAS,UAAU,CAAC,IAAY;IAC9B,OAAO,aAAa,CAAC,IAAI,CAAC,OAAO,CAAC,YAAY,EAAE,CAAC,CAAC,EAAE,GAAW,EAAE,EAAE,CAAC,MAAM,CAAC,YAAY,CAAC,QAAQ,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;AAC9G,CAAC;AAED,SAAS,cAAc,CAAC,IAAiB;IACvC,MAAM,OAAO,GAAG,IAAI;SACjB,GAAG,CACF,CAAC,CAAC,EAAE,EAAE,CACJ,2DAA2D,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,gBAAgB,CAAC,CAAC,IAAI,SAAS;QAC3G,QAAQ,CAAC,CAAC,GAAG,IAAI,WAAW,yBAAyB;QACrD,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,0BAA0B,SAAS,CAAC,CAAC,CAAC,2BAA2B,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC;QAC/F,iDAAiD,CACpD;SACA,IAAI,CAAC,EAAE,CAAC,CAAC;IACZ,OAAO,CACL,wCAAwC;QACxC,6EAA6E,WAAW,KAAK;QAC7F,mDAAmD,OAAO,0BAA0B;QACpF,oCAAoC,CACrC,CAAC;AACJ,CAAC;AAED,SAAS,oBAAoB,CAAC,IAAY;IACxC,yEAAyE;IACzE,MAAM,QAAQ,GAAG,OAAO,CAAC,IAAI,EAAE,SAAS,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC;IAC1E,MAAM,IAAI,GAAG,OAAO,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;IACnC,IAAI,QAAQ,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,IAAI,CAAC;IACvC,OAAO,IAAI,CAAC,CAAC,CAAC,GAAG,IAAI,KAAK,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AACxE,CAAC"}

package/dist/src/providers/email/factory.d.ts

@@ -0,0 +1,29 @@
+import type { FetchLike } from '../../http.js';
+import type { EmailProvider } from '../../types.js';
+export declare const EMAIL_PROVIDERS: readonly ["sendgrid", "postmark", "mailgun", "ses"];
+export type EmailProviderName = (typeof EMAIL_PROVIDERS)[number];
+export declare const EMAIL_PROVIDER_LABELS: Record<EmailProviderName, string>;
+/** Credentials for any supported email provider; each uses its own fields. */
+export interface EmailCredentials {
+    /** SendGrid, Mailgun */
+    apiKey?: string;
+    /** Postmark account token */
+    accountToken?: string;
+    /** Postmark server that receives inbound mail */
+    inboundServerId?: string;
+    /** Mailgun: us | eu. SES: AWS region. */
+    region?: string;
+    /** SES */
+    accessKeyId?: string;
+    secretAccessKey?: string;
+    sessionToken?: string;
+}
+export declare function isEmailProvider(name: string): name is EmailProviderName;
+/** Throws a ConfigError naming what's missing for the provider. */
+export declare function assertEmailCredentials(provider: string, c: EmailCredentials): void;
+/** Keeps only the fields the provider uses, so nothing extra is stored. */
+export declare function pickEmailCredentials(provider: string, c: EmailCredentials): EmailCredentials;
+export declare function createEmailProvider(provider: string, credentials: EmailCredentials, opts?: {
+    subuser?: string | null;
+    fetch?: FetchLike;
+}): EmailProvider;

package/dist/src/providers/email/factory.js

@@ -0,0 +1,67 @@
+import { ConfigError } from '../../errors.js';
+import { MailgunProvider } from './mailgun.js';
+import { PostmarkProvider } from './postmark.js';
+import { SendGridProvider } from './sendgrid.js';
+import { SesProvider } from './ses.js';
+export const EMAIL_PROVIDERS = ['sendgrid', 'postmark', 'mailgun', 'ses'];
+export const EMAIL_PROVIDER_LABELS = {
+    sendgrid: 'SendGrid',
+    postmark: 'Postmark',
+    mailgun: 'Mailgun',
+    ses: 'Amazon SES',
+};
+export function isEmailProvider(name) {
+    return EMAIL_PROVIDERS.includes(name);
+}
+/** Throws a ConfigError naming what's missing for the provider. */
+export function assertEmailCredentials(provider, c) {
+    const need = (ok, message) => {
+        if (!ok)
+            throw new ConfigError(message);
+    };
+    switch (provider) {
+        case 'sendgrid':
+            return need(c.apiKey, 'SendGrid needs an API key.');
+        case 'postmark':
+            return need(c.accountToken, 'Postmark needs an account API token.');
+        case 'mailgun':
+            need(c.apiKey, 'Mailgun needs an API key.');
+            return need(!c.region || c.region === 'us' || c.region === 'eu', 'Mailgun region must be us or eu.');
+        case 'ses':
+            need(c.accessKeyId && c.secretAccessKey, 'Amazon SES needs an AWS access key id and secret access key.');
+            return need(c.region, 'Amazon SES needs an AWS region, e.g. us-east-1.');
+        default:
+            throw new ConfigError(`Email provider must be one of: ${EMAIL_PROVIDERS.join(', ')}.`);
+    }
+}
+/** Keeps only the fields the provider uses, so nothing extra is stored. */
+export function pickEmailCredentials(provider, c) {
+    const keys = {
+        sendgrid: ['apiKey'],
+        postmark: ['accountToken', 'inboundServerId'],
+        mailgun: ['apiKey', 'region'],
+        ses: ['accessKeyId', 'secretAccessKey', 'sessionToken', 'region'],
+    };
+    return Object.fromEntries((keys[provider] ?? []).filter((k) => c[k]).map((k) => [k, c[k]]));
+}
+export function createEmailProvider(provider, credentials, opts = {}) {
+    assertEmailCredentials(provider, credentials);
+    if (opts.subuser && provider !== 'sendgrid')
+        throw new ConfigError('Subusers only apply to SendGrid.');
+    const c = credentials;
+    switch (provider) {
+        case 'sendgrid':
+            return new SendGridProvider({ apiKey: c.apiKey, onBehalfOf: opts.subuser ?? undefined, fetch: opts.fetch });
+        case 'postmark':
+            return new PostmarkProvider({ accountToken: c.accountToken, inboundServerId: c.inboundServerId, fetch: opts.fetch });
+        case 'mailgun':
+            return new MailgunProvider({ apiKey: c.apiKey, region: c.region ?? 'us', fetch: opts.fetch });
+        default:
+            return new SesProvider({
+                credentials: { accessKeyId: c.accessKeyId, secretAccessKey: c.secretAccessKey, ...(c.sessionToken ? { sessionToken: c.sessionToken } : {}) },
+                region: c.region,
+                fetch: opts.fetch,
+            });
+    }
+}
+//# sourceMappingURL=factory.js.map

package/dist/src/providers/email/factory.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"factory.js","sourceRoot":"","sources":["../../../../src/providers/email/factory.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,WAAW,EAAE,MAAM,iBAAiB,CAAC;AAG9C,OAAO,EAAE,eAAe,EAAE,MAAM,cAAc,CAAC;AAC/C,OAAO,EAAE,gBAAgB,EAAE,MAAM,eAAe,CAAC;AACjD,OAAO,EAAE,gBAAgB,EAAE,MAAM,eAAe,CAAC;AACjD,OAAO,EAAE,WAAW,EAAE,MAAM,UAAU,CAAC;AAEvC,MAAM,CAAC,MAAM,eAAe,GAAG,CAAC,UAAU,EAAE,UAAU,EAAE,SAAS,EAAE,KAAK,CAAU,CAAC;AAGnF,MAAM,CAAC,MAAM,qBAAqB,GAAsC;IACtE,QAAQ,EAAE,UAAU;IACpB,QAAQ,EAAE,UAAU;IACpB,OAAO,EAAE,SAAS;IAClB,GAAG,EAAE,YAAY;CAClB,CAAC;AAkBF,MAAM,UAAU,eAAe,CAAC,IAAY;IAC1C,OAAQ,eAAqC,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC;AAC/D,CAAC;AAED,mEAAmE;AACnE,MAAM,UAAU,sBAAsB,CAAC,QAAgB,EAAE,CAAmB;IAC1E,MAAM,IAAI,GAAG,CAAC,EAAW,EAAE,OAAe,EAAE,EAAE;QAC5C,IAAI,CAAC,EAAE;YAAE,MAAM,IAAI,WAAW,CAAC,OAAO,CAAC,CAAC;IAC1C,CAAC,CAAC;IACF,QAAQ,QAAQ,EAAE,CAAC;QACjB,KAAK,UAAU;YACb,OAAO,IAAI,CAAC,CAAC,CAAC,MAAM,EAAE,4BAA4B,CAAC,CAAC;QACtD,KAAK,UAAU;YACb,OAAO,IAAI,CAAC,CAAC,CAAC,YAAY,EAAE,sCAAsC,CAAC,CAAC;QACtE,KAAK,SAAS;YACZ,IAAI,CAAC,CAAC,CAAC,MAAM,EAAE,2BAA2B,CAAC,CAAC;YAC5C,OAAO,IAAI,CAAC,CAAC,CAAC,CAAC,MAAM,IAAI,CAAC,CAAC,MAAM,KAAK,IAAI,IAAI,CAAC,CAAC,MAAM,KAAK,IAAI,EAAE,kCAAkC,CAAC,CAAC;QACvG,KAAK,KAAK;YACR,IAAI,CAAC,CAAC,CAAC,WAAW,IAAI,CAAC,CAAC,eAAe,EAAE,8DAA8D,CAAC,CAAC;YACzG,OAAO,IAAI,CAAC,CAAC,CAAC,MAAM,EAAE,iDAAiD,CAAC,CAAC;QAC3E;YACE,MAAM,IAAI,WAAW,CAAC,kCAAkC,eAAe,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IAC3F,CAAC;AACH,CAAC;AAED,2EAA2E;AAC3E,MAAM,UAAU,oBAAoB,CAAC,QAAgB,EAAE,CAAmB;IACxE,MAAM,IAAI,GAA+C;QACvD,QAAQ,EAAE,CAAC,QAAQ,CAAC;QACpB,QAAQ,EAAE,CAAC,cAAc,EAAE,iBAAiB,CAAC;QAC7C,OAAO,EAAE,CAAC,QAAQ,EAAE,QAAQ,CAAC;QAC7B,GAAG,EAAE,CAAC,aAAa,EAAE,iBAAiB,EAAE,cAAc,EAAE,QAAQ,CAAC;KAClE,CAAC;IACF,OAAO,MAAM,CAAC,WAAW,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;AAC9F,CAAC;AAED,MAAM,UAAU,mBAAmB,CACjC,QAAgB,EAChB,WAA6B,EAC7B,OAAuD,EAAE;IAEzD,sBAAsB,CAAC,QAAQ,EAAE,WAAW,CAAC,CAAC;IAC9C,IAAI,IAAI,CAAC,OAAO,IAAI,QAAQ,KAAK,UAAU;QAAE,MAAM,IAAI,WAAW,CAAC,kCAAkC,CAAC,CAAC;IACvG,MAAM,CAAC,GAAG,WAAW,CAAC;IACtB,QAAQ,QAAQ,EAAE,CAAC;QACjB,KAAK,UAAU;YACb,OAAO,IAAI,gBAAgB,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC,MAAO,EAAE,UAAU,EAAE,IAAI,CAAC,OAAO,IAAI,SAAS,EAAE,KAAK,EAAE,IAAI,CAAC,KAAK,EAAE,CAAC,CAAC;QAC/G,KAAK,UAAU;YACb,OAAO,IAAI,gBAAgB,CAAC,EAAE,YAAY,EAAE,CAAC,CAAC,YAAa,EAAE,eAAe,EAAE,CAAC,CAAC,eAAe,EAAE,KAAK,EAAE,IAAI,CAAC,KAAK,EAAE,CAAC,CAAC;QACxH,KAAK,SAAS;YACZ,OAAO,IAAI,eAAe,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC,MAAO,EAAE,MAAM,EAAG,CAAC,CAAC,MAAkC,IAAI,IAAI,EAAE,KAAK,EAAE,IAAI,CAAC,KAAK,EAAE,CAAC,CAAC;QAC9H;YACE,OAAO,IAAI,WAAW,CAAC;gBACrB,WAAW,EAAE,EAAE,WAAW,EAAE,CAAC,CAAC,WAAY,EAAE,eAAe,EAAE,CAAC,CAAC,eAAgB,EAAE,GAAG,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,EAAE,YAAY,EAAE,CAAC,CAAC,YAAY,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE;gBAC9I,MAAM,EAAE,CAAC,CAAC,MAAO;gBACjB,KAAK,EAAE,IAAI,CAAC,KAAK;aAClB,CAAC,CAAC;IACP,CAAC;AACH,CAAC"}

package/dist/src/providers/email/mailgun.d.ts

@@ -0,0 +1,36 @@
+import { type FetchLike } from '../../http.js';
+import type { DnsRecord, DomainAuthentication, EmailProvider, InboundAction, InboundParseOptions, ValidationResult } from '../../types.js';
+export interface MailgunOptions {
+    apiKey: string;
+    /** Where the Mailgun account lives. Default "us". */
+    region?: 'us' | 'eu';
+    baseUrl?: string;
+    fetch?: FetchLike;
+}
+/**
+ * Mailgun sending domains (usually a subdomain like mg.example.com): SPF and
+ * DKIM TXT records plus a tracking CNAME. Inbound mail is received on the
+ * Mailgun domain itself (MX to mxa/mxb.mailgun.org) and forwarded by a route.
+ */
+export declare class MailgunProvider implements EmailProvider {
+    private readonly opts;
+    readonly name = "mailgun";
+    readonly label = "Mailgun";
+    readonly supportsInbound = true;
+    private readonly baseUrl;
+    private readonly fetchImpl;
+    constructor(opts: MailgunOptions);
+    /** Mailgun only receives for domains added to it, so inbound goes to the sending domain itself. */
+    defaultInboundHostname(domain: string): string;
+    findDomain(domain: string): Promise<DomainAuthentication | null>;
+    ensureDomain(domain: string): Promise<DomainAuthentication>;
+    getDomain(id: string): Promise<DomainAuthentication>;
+    deleteDomain(id: string): Promise<void>;
+    validateDomain(id: string): Promise<ValidationResult>;
+    inboundRecords(hostname: string): DnsRecord[];
+    ensureInboundParse(opts: InboundParseOptions): Promise<InboundAction>;
+    deleteInboundParse(hostname: string): Promise<void>;
+    private routes;
+    /** Mailgun takes multipart form fields; repeated keys (e.g. `action`) come from arrays. */
+    private request;
+}

package/dist/src/providers/email/mailgun.js

@@ -0,0 +1,141 @@
+import { ConfigError, ApiError } from '../../errors.js';
+import { requestText } from '../../http.js';
+import { isSpf, normalizeName } from '../../records.js';
+const BASE_URLS = { us: 'https://api.mailgun.net', eu: 'https://api.eu.mailgun.net' };
+const RECEIVING_MX = ['mxa.mailgun.org', 'mxb.mailgun.org'];
+const routeDescription = (hostname) => `dkimkit inbound ${hostname}`;
+/**
+ * Mailgun sending domains (usually a subdomain like mg.example.com): SPF and
+ * DKIM TXT records plus a tracking CNAME. Inbound mail is received on the
+ * Mailgun domain itself (MX to mxa/mxb.mailgun.org) and forwarded by a route.
+ */
+export class MailgunProvider {
+    opts;
+    name = 'mailgun';
+    label = 'Mailgun';
+    supportsInbound = true;
+    baseUrl;
+    fetchImpl;
+    constructor(opts) {
+        this.opts = opts;
+        this.baseUrl = opts.baseUrl ?? BASE_URLS[opts.region ?? 'us'];
+        this.fetchImpl = opts.fetch ?? fetch;
+    }
+    /** Mailgun only receives for domains added to it, so inbound goes to the sending domain itself. */
+    defaultInboundHostname(domain) {
+        return normalizeName(domain);
+    }
+    async findDomain(domain) {
+        try {
+            return toAuthentication(await this.request('GET', `/v4/domains/${encodeURIComponent(normalizeName(domain))}`), false);
+        }
+        catch (err) {
+            if (err instanceof ApiError && err.status === 404)
+                return null;
+            throw err;
+        }
+    }
+    async ensureDomain(domain) {
+        const existing = await this.findDomain(domain);
+        if (existing)
+            return existing;
+        const created = await this.request('POST', '/v4/domains', { name: normalizeName(domain), web_scheme: 'https' });
+        return toAuthentication(created, true);
+    }
+    async getDomain(id) {
+        return toAuthentication(await this.request('GET', `/v4/domains/${encodeURIComponent(id)}`), false);
+    }
+    async deleteDomain(id) {
+        await this.request('DELETE', `/v3/domains/${encodeURIComponent(id)}`);
+    }
+    async validateDomain(id) {
+        const res = await this.request('PUT', `/v4/domains/${encodeURIComponent(id)}/verify`);
+        const records = toAuthentication(res, false).records;
+        return {
+            valid: res.domain.state === 'active',
+            results: (res.sending_dns_records ?? []).map((r, i) => {
+                const valid = r.valid === 'valid';
+                return { record: records[i]?.purpose ?? r.record_type.toLowerCase(), valid, ...(valid ? {} : { reason: 'Not found in DNS yet' }) };
+            }),
+        };
+    }
+    inboundRecords(hostname) {
+        return RECEIVING_MX.map((value, i) => ({
+            type: 'MX',
+            name: normalizeName(hostname),
+            value,
+            priority: 10,
+            purpose: i === 0 ? 'inbound_mx' : 'inbound_mx_2',
+        }));
+    }
+    async ensureInboundParse(opts) {
+        const hostname = normalizeName(opts.hostname);
+        if (!(await this.findDomain(hostname))) {
+            throw new ConfigError(`Mailgun only receives mail for domains added to Mailgun. Use the sending domain (such as mg.${hostname.split('.').slice(-2).join('.')}) as the inbound hostname.`);
+        }
+        if (/["\\]/.test(opts.url))
+            throw new ConfigError('The inbound webhook URL cannot contain quotes or backslashes.');
+        const expression = `match_recipient(".*@${hostname.replace(/\./g, '\\.')}")`;
+        const actions = [`forward("${opts.url}")`, 'stop()'];
+        const route = (await this.routes()).find((r) => r.description === routeDescription(hostname));
+        const form = { priority: '10', description: routeDescription(hostname), expression, action: actions };
+        if (!route) {
+            await this.request('POST', '/v3/routes', form);
+            return 'created';
+        }
+        if (route.expression === expression && JSON.stringify(route.actions ?? []) === JSON.stringify(actions))
+            return 'unchanged';
+        await this.request('PUT', `/v3/routes/${encodeURIComponent(route.id)}`, form);
+        return 'updated';
+    }
+    async deleteInboundParse(hostname) {
+        const route = (await this.routes()).find((r) => r.description === routeDescription(normalizeName(hostname)));
+        if (route)
+            await this.request('DELETE', `/v3/routes/${encodeURIComponent(route.id)}`);
+    }
+    async routes() {
+        return (await this.request('GET', '/v3/routes?limit=1000')).items ?? [];
+    }
+    /** Mailgun takes multipart form fields; repeated keys (e.g. `action`) come from arrays. */
+    async request(method, path, form) {
+        const text = await requestText(this.fetchImpl, 'Mailgun', this.baseUrl + path, () => {
+            let body;
+            if (form) {
+                body = new FormData();
+                for (const [k, v] of Object.entries(form))
+                    for (const item of [v].flat())
+                        body.append(k, item);
+            }
+            return {
+                method,
+                headers: { Authorization: `Basic ${Buffer.from(`api:${this.opts.apiKey}`).toString('base64')}`, Accept: 'application/json' },
+                body,
+            };
+        }, (t) => {
+            try {
+                return JSON.parse(t).message;
+            }
+            catch {
+                return undefined;
+            }
+        });
+        return (text ? JSON.parse(text) : {});
+    }
+}
+function toAuthentication(res, created) {
+    const domain = normalizeName(res.domain.name);
+    const records = (res.sending_dns_records ?? []).flatMap((r) => {
+        const type = r.record_type.toUpperCase();
+        if (type !== 'TXT' && type !== 'CNAME')
+            return [];
+        const name = normalizeName(r.name || domain);
+        if (type === 'CNAME')
+            return [{ type, name, value: normalizeName(r.value), purpose: 'tracking' }];
+        if (isSpf(r.value)) {
+            return [{ type, name, value: r.value, purpose: 'spf', note: 'If this name already has an SPF record (v=spf1 …), add include:mailgun.org to it instead of creating a second one.' }];
+        }
+        return [{ type, name, value: r.value, purpose: name.includes('._domainkey.') ? 'dkim' : 'txt' }];
+    });
+    return { id: domain, domain, valid: res.domain.state === 'active', records, created };
+}
+//# sourceMappingURL=mailgun.js.map

package/dist/src/providers/email/mailgun.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"mailgun.js","sourceRoot":"","sources":["../../../../src/providers/email/mailgun.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,WAAW,EAAE,QAAQ,EAAE,MAAM,iBAAiB,CAAC;AACxD,OAAO,EAAE,WAAW,EAAkB,MAAM,eAAe,CAAC;AAC5D,OAAO,EAAE,KAAK,EAAE,aAAa,EAAE,MAAM,kBAAkB,CAAC;AAGxD,MAAM,SAAS,GAAG,EAAE,EAAE,EAAE,yBAAyB,EAAE,EAAE,EAAE,4BAA4B,EAAE,CAAC;AACtF,MAAM,YAAY,GAAG,CAAC,iBAAiB,EAAE,iBAAiB,CAAC,CAAC;AA8B5D,MAAM,gBAAgB,GAAG,CAAC,QAAgB,EAAE,EAAE,CAAC,mBAAmB,QAAQ,EAAE,CAAC;AAE7E;;;;GAIG;AACH,MAAM,OAAO,eAAe;IAOG;IANpB,IAAI,GAAG,SAAS,CAAC;IACjB,KAAK,GAAG,SAAS,CAAC;IAClB,eAAe,GAAG,IAAI,CAAC;IACf,OAAO,CAAS;IAChB,SAAS,CAAY;IAEtC,YAA6B,IAAoB;QAApB,SAAI,GAAJ,IAAI,CAAgB;QAC/C,IAAI,CAAC,OAAO,GAAG,IAAI,CAAC,OAAO,IAAI,SAAS,CAAC,IAAI,CAAC,MAAM,IAAI,IAAI,CAAC,CAAC;QAC9D,IAAI,CAAC,SAAS,GAAG,IAAI,CAAC,KAAK,IAAI,KAAK,CAAC;IACvC,CAAC;IAED,mGAAmG;IACnG,sBAAsB,CAAC,MAAc;QACnC,OAAO,aAAa,CAAC,MAAM,CAAC,CAAC;IAC/B,CAAC;IAED,KAAK,CAAC,UAAU,CAAC,MAAc;QAC7B,IAAI,CAAC;YACH,OAAO,gBAAgB,CAAC,MAAM,IAAI,CAAC,OAAO,CAAmB,KAAK,EAAE,eAAe,kBAAkB,CAAC,aAAa,CAAC,MAAM,CAAC,CAAC,EAAE,CAAC,EAAE,KAAK,CAAC,CAAC;QAC1I,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,IAAI,GAAG,YAAY,QAAQ,IAAI,GAAG,CAAC,MAAM,KAAK,GAAG;gBAAE,OAAO,IAAI,CAAC;YAC/D,MAAM,GAAG,CAAC;QACZ,CAAC;IACH,CAAC;IAED,KAAK,CAAC,YAAY,CAAC,MAAc;QAC/B,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC;QAC/C,IAAI,QAAQ;YAAE,OAAO,QAAQ,CAAC;QAC9B,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,OAAO,CAAmB,MAAM,EAAE,aAAa,EAAE,EAAE,IAAI,EAAE,aAAa,CAAC,MAAM,CAAC,EAAE,UAAU,EAAE,OAAO,EAAE,CAAC,CAAC;QAClI,OAAO,gBAAgB,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC;IACzC,CAAC;IAED,KAAK,CAAC,SAAS,CAAC,EAAU;QACxB,OAAO,gBAAgB,CAAC,MAAM,IAAI,CAAC,OAAO,CAAmB,KAAK,EAAE,eAAe,kBAAkB,CAAC,EAAE,CAAC,EAAE,CAAC,EAAE,KAAK,CAAC,CAAC;IACvH,CAAC;IAED,KAAK,CAAC,YAAY,CAAC,EAAU;QAC3B,MAAM,IAAI,CAAC,OAAO,CAAC,QAAQ,EAAE,eAAe,kBAAkB,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC;IACxE,CAAC;IAED,KAAK,CAAC,cAAc,CAAC,EAAU;QAC7B,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,OAAO,CAAmB,KAAK,EAAE,eAAe,kBAAkB,CAAC,EAAE,CAAC,SAAS,CAAC,CAAC;QACxG,MAAM,OAAO,GAAG,gBAAgB,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC,OAAO,CAAC;QACrD,OAAO;YACL,KAAK,EAAE,GAAG,CAAC,MAAM,CAAC,KAAK,KAAK,QAAQ;YACpC,OAAO,EAAE,CAAC,GAAG,CAAC,mBAAmB,IAAI,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE;gBACpD,MAAM,KAAK,GAAG,CAAC,CAAC,KAAK,KAAK,OAAO,CAAC;gBAClC,OAAO,EAAE,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC,EAAE,OAAO,IAAI,CAAC,CAAC,WAAW,CAAC,WAAW,EAAE,EAAE,KAAK,EAAE,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,sBAAsB,EAAE,CAAC,EAAE,CAAC;YACrI,CAAC,CAAC;SACH,CAAC;IACJ,CAAC;IAED,cAAc,CAAC,QAAgB;QAC7B,OAAO,YAAY,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC;YACrC,IAAI,EAAE,IAAa;YACnB,IAAI,EAAE,aAAa,CAAC,QAAQ,CAAC;YAC7B,KAAK;YACL,QAAQ,EAAE,EAAE;YACZ,OAAO,EAAE,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,cAAc;SACjD,CAAC,CAAC,CAAC;IACN,CAAC;IAED,KAAK,CAAC,kBAAkB,CAAC,IAAyB;QAChD,MAAM,QAAQ,GAAG,aAAa,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;QAC9C,IAAI,CAAC,CAAC,MAAM,IAAI,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC,EAAE,CAAC;YACvC,MAAM,IAAI,WAAW,CAAC,+FAA+F,QAAQ,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,4BAA4B,CAAC,CAAC;QAC5L,CAAC;QACD,IAAI,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC;YAAE,MAAM,IAAI,WAAW,CAAC,+DAA+D,CAAC,CAAC;QACnH,MAAM,UAAU,GAAG,uBAAuB,QAAQ,CAAC,OAAO,CAAC,KAAK,EAAE,KAAK,CAAC,IAAI,CAAC;QAC7E,MAAM,OAAO,GAAG,CAAC,YAAY,IAAI,CAAC,GAAG,IAAI,EAAE,QAAQ,CAAC,CAAC;QACrD,MAAM,KAAK,GAAG,CAAC,MAAM,IAAI,CAAC,MAAM,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,WAAW,KAAK,gBAAgB,CAAC,QAAQ,CAAC,CAAC,CAAC;QAC9F,MAAM,IAAI,GAAG,EAAE,QAAQ,EAAE,IAAI,EAAE,WAAW,EAAE,gBAAgB,CAAC,QAAQ,CAAC,EAAE,UAAU,EAAE,MAAM,EAAE,OAAO,EAAE,CAAC;QACtG,IAAI,CAAC,KAAK,EAAE,CAAC;YACX,MAAM,IAAI,CAAC,OAAO,CAAC,MAAM,EAAE,YAAY,EAAE,IAAI,CAAC,CAAC;YAC/C,OAAO,SAAS,CAAC;QACnB,CAAC;QACD,IAAI,KAAK,CAAC,UAAU,KAAK,UAAU,IAAI,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,OAAO,IAAI,EAAE,CAAC,KAAK,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC;YAAE,OAAO,WAAW,CAAC;QAC3H,MAAM,IAAI,CAAC,OAAO,CAAC,KAAK,EAAE,cAAc,kBAAkB,CAAC,KAAK,CAAC,EAAE,CAAC,EAAE,EAAE,IAAI,CAAC,CAAC;QAC9E,OAAO,SAAS,CAAC;IACnB,CAAC;IAED,KAAK,CAAC,kBAAkB,CAAC,QAAgB;QACvC,MAAM,KAAK,GAAG,CAAC,MAAM,IAAI,CAAC,MAAM,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,WAAW,KAAK,gBAAgB,CAAC,aAAa,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC;QAC7G,IAAI,KAAK;YAAE,MAAM,IAAI,CAAC,OAAO,CAAC,QAAQ,EAAE,cAAc,kBAAkB,CAAC,KAAK,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC;IACxF,CAAC;IAEO,KAAK,CAAC,MAAM;QAClB,OAAO,CAAC,MAAM,IAAI,CAAC,OAAO,CAAwB,KAAK,EAAE,uBAAuB,CAAC,CAAC,CAAC,KAAK,IAAI,EAAE,CAAC;IACjG,CAAC;IAED,2FAA2F;IACnF,KAAK,CAAC,OAAO,CAAI,MAAc,EAAE,IAAY,EAAE,IAAwC;QAC7F,MAAM,IAAI,GAAG,MAAM,WAAW,CAC5B,IAAI,CAAC,SAAS,EACd,SAAS,EACT,IAAI,CAAC,OAAO,GAAG,IAAI,EACnB,GAAG,EAAE;YACH,IAAI,IAA0B,CAAC;YAC/B,IAAI,IAAI,EAAE,CAAC;gBACT,IAAI,GAAG,IAAI,QAAQ,EAAE,CAAC;gBACtB,KAAK,MAAM,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC;oBAAE,KAAK,MAAM,IAAI,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE;wBAAE,IAAI,CAAC,MAAM,CAAC,CAAC,EAAE,IAAI,CAAC,CAAC;YACjG,CAAC;YACD,OAAO;gBACL,MAAM;gBACN,OAAO,EAAE,EAAE,aAAa,EAAE,SAAS,MAAM,CAAC,IAAI,CAAC,OAAO,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,CAAC,CAAC,QAAQ,CAAC,QAAQ,CAAC,EAAE,EAAE,MAAM,EAAE,kBAAkB,EAAE;gBAC5H,IAAI;aACL,CAAC;QACJ,CAAC,EACD,CAAC,CAAC,EAAE,EAAE;YACJ,IAAI,CAAC;gBACH,OAAQ,IAAI,CAAC,KAAK,CAAC,CAAC,CAA0B,CAAC,OAAO,CAAC;YACzD,CAAC;YAAC,MAAM,CAAC;gBACP,OAAO,SAAS,CAAC;YACnB,CAAC;QACH,CAAC,CACF,CAAC;QACF,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,EAAE,CAAM,CAAC;IAC7C,CAAC;CACF;AAED,SAAS,gBAAgB,CAAC,GAAqB,EAAE,OAAgB;IAC/D,MAAM,MAAM,GAAG,aAAa,CAAC,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;IAC9C,MAAM,OAAO,GAAG,CAAC,GAAG,CAAC,mBAAmB,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,EAAe,EAAE;QACzE,MAAM,IAAI,GAAG,CAAC,CAAC,WAAW,CAAC,WAAW,EAAgB,CAAC;QACvD,IAAI,IAAI,KAAK,KAAK,IAAI,IAAI,KAAK,OAAO;YAAE,OAAO,EAAE,CAAC;QAClD,MAAM,IAAI,GAAG,aAAa,CAAC,CAAC,CAAC,IAAI,IAAI,MAAM,CAAC,CAAC;QAC7C,IAAI,IAAI,KAAK,OAAO;YAAE,OAAO,CAAC,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,aAAa,CAAC,CAAC,CAAC,KAAK,CAAC,EAAE,OAAO,EAAE,UAAU,EAAE,CAAC,CAAC;QAClG,IAAI,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,EAAE,CAAC;YACnB,OAAO,CAAC,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC,KAAK,EAAE,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,oHAAoH,EAAE,CAAC,CAAC;QACtL,CAAC;QACD,OAAO,CAAC,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC,KAAK,EAAE,OAAO,EAAE,IAAI,CAAC,QAAQ,CAAC,cAAc,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,KAAK,EAAE,CAAC,CAAC;IACnG,CAAC,CAAC,CAAC;IACH,OAAO,EAAE,EAAE,EAAE,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,GAAG,CAAC,MAAM,CAAC,KAAK,KAAK,QAAQ,EAAE,OAAO,EAAE,OAAO,EAAE,CAAC;AACxF,CAAC"}

package/dist/src/providers/email/postmark.d.ts

@@ -0,0 +1,37 @@
+import { type FetchLike } from '../../http.js';
+import type { DnsRecord, DomainAuthentication, EmailProvider, InboundAction, InboundParseOptions, ValidationResult } from '../../types.js';
+export declare const POSTMARK_INBOUND_MX = "inbound.postmarkapp.com";
+export interface PostmarkOptions {
+    /** Account API token (X-Postmark-Account-Token). */
+    accountToken: string;
+    /** Server whose inbound stream receives mail. Postmark allows one inbound domain per server. */
+    inboundServerId?: string;
+    baseUrl?: string;
+    fetch?: FetchLike;
+}
+/**
+ * Postmark sender signatures for domains: a DKIM TXT record and a custom
+ * Return-Path CNAME. SPF is no longer required by Postmark.
+ */
+export declare class PostmarkProvider implements EmailProvider {
+    private readonly opts;
+    readonly name = "postmark";
+    readonly label = "Postmark";
+    readonly supportsInbound = true;
+    private readonly baseUrl;
+    private readonly fetchImpl;
+    constructor(opts: PostmarkOptions);
+    defaultInboundHostname(domain: string): string;
+    findDomain(domain: string): Promise<DomainAuthentication | null>;
+    ensureDomain(domain: string, opts?: {
+        subdomain?: string;
+    }): Promise<DomainAuthentication>;
+    getDomain(id: string): Promise<DomainAuthentication>;
+    deleteDomain(id: string): Promise<void>;
+    validateDomain(id: string): Promise<ValidationResult>;
+    inboundRecords(hostname: string): DnsRecord[];
+    ensureInboundParse(opts: InboundParseOptions): Promise<InboundAction>;
+    deleteInboundParse(hostname: string): Promise<void>;
+    private inboundServer;
+    private request;
+}