dkimkit 0.0.0-stage → 0.6.1

package/dist/src/providers/email/postmark.js

@@ -0,0 +1,121 @@
+import { ConfigError } from '../../errors.js';
+import { requestJson } from '../../http.js';
+import { normalizeName } from '../../records.js';
+export const POSTMARK_INBOUND_MX = 'inbound.postmarkapp.com';
+const DEFAULT_RETURN_PATH_CNAME = 'pm.mtasv.net';
+/**
+ * Postmark sender signatures for domains: a DKIM TXT record and a custom
+ * Return-Path CNAME. SPF is no longer required by Postmark.
+ */
+export class PostmarkProvider {
+    opts;
+    name = 'postmark';
+    label = 'Postmark';
+    supportsInbound = true;
+    baseUrl;
+    fetchImpl;
+    constructor(opts) {
+        this.opts = opts;
+        this.baseUrl = opts.baseUrl ?? 'https://api.postmarkapp.com';
+        this.fetchImpl = opts.fetch ?? fetch;
+    }
+    defaultInboundHostname(domain) {
+        return `parse.${normalizeName(domain)}`;
+    }
+    async findDomain(domain) {
+        const wanted = normalizeName(domain);
+        for (let offset = 0;; offset += 500) {
+            const page = await this.request('GET', `/domains?count=500&offset=${offset}`);
+            const hit = page.Domains.find((d) => normalizeName(d.Name) === wanted);
+            if (hit)
+                return this.getDomain(String(hit.ID));
+            if (page.Domains.length === 0 || offset + page.Domains.length >= page.TotalCount)
+                return null;
+        }
+    }
+    async ensureDomain(domain, opts = {}) {
+        const existing = await this.findDomain(domain);
+        if (existing)
+            return existing;
+        const name = normalizeName(domain);
+        const created = await this.request('POST', '/domains', {
+            body: { Name: name, ReturnPathDomain: `${opts.subdomain ?? 'pm-bounces'}.${name}` },
+        });
+        return toAuthentication(created, true);
+    }
+    async getDomain(id) {
+        return toAuthentication(await this.request('GET', `/domains/${encodeURIComponent(id)}`), false);
+    }
+    async deleteDomain(id) {
+        await this.request('DELETE', `/domains/${encodeURIComponent(id)}`);
+    }
+    async validateDomain(id) {
+        await this.request('PUT', `/domains/${encodeURIComponent(id)}/verifyDkim`);
+        // Both calls return the domain; the second has both up-to-date flags.
+        const d = await this.request('PUT', `/domains/${encodeURIComponent(id)}/verifyReturnPath`);
+        const dkim = Boolean(d.DKIMVerified);
+        const returnPath = Boolean(d.ReturnPathDomainVerified);
+        return {
+            valid: dkim && returnPath,
+            results: [
+                { record: 'dkim', valid: dkim, ...(dkim ? {} : { reason: 'DKIM record not found yet' }) },
+                { record: 'return_path', valid: returnPath, ...(returnPath ? {} : { reason: 'Return-Path CNAME not found yet' }) },
+            ],
+        };
+    }
+    inboundRecords(hostname) {
+        return [{ type: 'MX', name: normalizeName(hostname), value: POSTMARK_INBOUND_MX, priority: 10, purpose: 'inbound_mx' }];
+    }
+    async ensureInboundParse(opts) {
+        const server = await this.inboundServer();
+        const hostname = normalizeName(opts.hostname);
+        const current = server.InboundDomain ? normalizeName(server.InboundDomain) : '';
+        if (current && current !== hostname) {
+            throw new ConfigError(`Postmark server ${server.ID} already receives mail for ${current}. Postmark allows one inbound domain per server, so use another server for ${hostname}.`);
+        }
+        if (current === hostname && server.InboundHookUrl === opts.url)
+            return 'unchanged';
+        await this.request('PUT', `/servers/${server.ID}`, { body: { InboundDomain: hostname, InboundHookUrl: opts.url } });
+        return current ? 'updated' : 'created';
+    }
+    async deleteInboundParse(hostname) {
+        if (!this.opts.inboundServerId)
+            return;
+        const server = await this.inboundServer();
+        if (server.InboundDomain && normalizeName(server.InboundDomain) === normalizeName(hostname)) {
+            await this.request('PUT', `/servers/${server.ID}`, { body: { InboundDomain: '', InboundHookUrl: '' } });
+        }
+    }
+    inboundServer() {
+        if (!this.opts.inboundServerId)
+            throw new ConfigError('Receiving email with Postmark needs the id of the Postmark server to receive on.');
+        return this.request('GET', `/servers/${encodeURIComponent(this.opts.inboundServerId)}`);
+    }
+    request(method, path, opts = {}) {
+        return requestJson(this.fetchImpl, 'Postmark', this.baseUrl + path, { ...opts, method, headers: { 'X-Postmark-Account-Token': this.opts.accountToken } }, (body) => body?.Message);
+    }
+}
+function toAuthentication(d, created) {
+    const domain = normalizeName(d.Name);
+    // Postmark may give hosts relative to the domain.
+    const qualify = (host) => {
+        const h = normalizeName(host);
+        return h === domain || h.endsWith(`.${domain}`) ? h : `${h}.${domain}`;
+    };
+    const records = [];
+    // A new or rotating key is published at the pending host first.
+    const dkimHost = d.DKIMPendingHost || d.DKIMHost;
+    const dkimValue = d.DKIMPendingTextValue || d.DKIMTextValue;
+    if (dkimHost && dkimValue)
+        records.push({ type: 'TXT', name: qualify(dkimHost), value: dkimValue, purpose: 'dkim' });
+    if (d.ReturnPathDomain) {
+        records.push({
+            type: 'CNAME',
+            name: qualify(d.ReturnPathDomain),
+            value: d.ReturnPathDomainCNAMEValue || DEFAULT_RETURN_PATH_CNAME,
+            purpose: 'return_path',
+        });
+    }
+    return { id: String(d.ID), domain, valid: Boolean(d.DKIMVerified && d.ReturnPathDomainVerified), records, created };
+}
+//# sourceMappingURL=postmark.js.map

package/dist/src/providers/email/postmark.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"postmark.js","sourceRoot":"","sources":["../../../../src/providers/email/postmark.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,WAAW,EAAE,MAAM,iBAAiB,CAAC;AAC9C,OAAO,EAAE,WAAW,EAAuC,MAAM,eAAe,CAAC;AACjF,OAAO,EAAE,aAAa,EAAE,MAAM,kBAAkB,CAAC;AAGjD,MAAM,CAAC,MAAM,mBAAmB,GAAG,yBAAyB,CAAC;AAC7D,MAAM,yBAAyB,GAAG,cAAc,CAAC;AAiCjD;;;GAGG;AACH,MAAM,OAAO,gBAAgB;IAOE;IANpB,IAAI,GAAG,UAAU,CAAC;IAClB,KAAK,GAAG,UAAU,CAAC;IACnB,eAAe,GAAG,IAAI,CAAC;IACf,OAAO,CAAS;IAChB,SAAS,CAAY;IAEtC,YAA6B,IAAqB;QAArB,SAAI,GAAJ,IAAI,CAAiB;QAChD,IAAI,CAAC,OAAO,GAAG,IAAI,CAAC,OAAO,IAAI,6BAA6B,CAAC;QAC7D,IAAI,CAAC,SAAS,GAAG,IAAI,CAAC,KAAK,IAAI,KAAK,CAAC;IACvC,CAAC;IAED,sBAAsB,CAAC,MAAc;QACnC,OAAO,SAAS,aAAa,CAAC,MAAM,CAAC,EAAE,CAAC;IAC1C,CAAC;IAED,KAAK,CAAC,UAAU,CAAC,MAAc;QAC7B,MAAM,MAAM,GAAG,aAAa,CAAC,MAAM,CAAC,CAAC;QACrC,KAAK,IAAI,MAAM,GAAG,CAAC,GAAI,MAAM,IAAI,GAAG,EAAE,CAAC;YACrC,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,OAAO,CAAqD,KAAK,EAAE,6BAA6B,MAAM,EAAE,CAAC,CAAC;YAClI,MAAM,GAAG,GAAG,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,aAAa,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,MAAM,CAAC,CAAC;YACvE,IAAI,GAAG;gBAAE,OAAO,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,CAAC;YAC/C,IAAI,IAAI,CAAC,OAAO,CAAC,MAAM,KAAK,CAAC,IAAI,MAAM,GAAG,IAAI,CAAC,OAAO,CAAC,MAAM,IAAI,IAAI,CAAC,UAAU;gBAAE,OAAO,IAAI,CAAC;QAChG,CAAC;IACH,CAAC;IAED,KAAK,CAAC,YAAY,CAAC,MAAc,EAAE,OAA+B,EAAE;QAClE,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC;QAC/C,IAAI,QAAQ;YAAE,OAAO,QAAQ,CAAC;QAC9B,MAAM,IAAI,GAAG,aAAa,CAAC,MAAM,CAAC,CAAC;QACnC,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,OAAO,CAAW,MAAM,EAAE,UAAU,EAAE;YAC/D,IAAI,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,gBAAgB,EAAE,GAAG,IAAI,CAAC,SAAS,IAAI,YAAY,IAAI,IAAI,EAAE,EAAE;SACpF,CAAC,CAAC;QACH,OAAO,gBAAgB,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC;IACzC,CAAC;IAED,KAAK,CAAC,SAAS,CAAC,EAAU;QACxB,OAAO,gBAAgB,CAAC,MAAM,IAAI,CAAC,OAAO,CAAW,KAAK,EAAE,YAAY,kBAAkB,CAAC,EAAE,CAAC,EAAE,CAAC,EAAE,KAAK,CAAC,CAAC;IAC5G,CAAC;IAED,KAAK,CAAC,YAAY,CAAC,EAAU;QAC3B,MAAM,IAAI,CAAC,OAAO,CAAC,QAAQ,EAAE,YAAY,kBAAkB,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC;IACrE,CAAC;IAED,KAAK,CAAC,cAAc,CAAC,EAAU;QAC7B,MAAM,IAAI,CAAC,OAAO,CAAC,KAAK,EAAE,YAAY,kBAAkB,CAAC,EAAE,CAAC,aAAa,CAAC,CAAC;QAC3E,sEAAsE;QACtE,MAAM,CAAC,GAAG,MAAM,IAAI,CAAC,OAAO,CAAW,KAAK,EAAE,YAAY,kBAAkB,CAAC,EAAE,CAAC,mBAAmB,CAAC,CAAC;QACrG,MAAM,IAAI,GAAG,OAAO,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC;QACrC,MAAM,UAAU,GAAG,OAAO,CAAC,CAAC,CAAC,wBAAwB,CAAC,CAAC;QACvD,OAAO;YACL,KAAK,EAAE,IAAI,IAAI,UAAU;YACzB,OAAO,EAAE;gBACP,EAAE,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,2BAA2B,EAAE,CAAC,EAAE;gBACzF,EAAE,MAAM,EAAE,aAAa,EAAE,KAAK,EAAE,UAAU,EAAE,GAAG,CAAC,UAAU,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,iCAAiC,EAAE,CAAC,EAAE;aACnH;SACF,CAAC;IACJ,CAAC;IAED,cAAc,CAAC,QAAgB;QAC7B,OAAO,CAAC,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,aAAa,CAAC,QAAQ,CAAC,EAAE,KAAK,EAAE,mBAAmB,EAAE,QAAQ,EAAE,EAAE,EAAE,OAAO,EAAE,YAAY,EAAE,CAAC,CAAC;IAC1H,CAAC;IAED,KAAK,CAAC,kBAAkB,CAAC,IAAyB;QAChD,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,aAAa,EAAE,CAAC;QAC1C,MAAM,QAAQ,GAAG,aAAa,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;QAC9C,MAAM,OAAO,GAAG,MAAM,CAAC,aAAa,CAAC,CAAC,CAAC,aAAa,CAAC,MAAM,CAAC,aAAa,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;QAChF,IAAI,OAAO,IAAI,OAAO,KAAK,QAAQ,EAAE,CAAC;YACpC,MAAM,IAAI,WAAW,CACnB,mBAAmB,MAAM,CAAC,EAAE,8BAA8B,OAAO,8EAA8E,QAAQ,GAAG,CAC3J,CAAC;QACJ,CAAC;QACD,IAAI,OAAO,KAAK,QAAQ,IAAI,MAAM,CAAC,cAAc,KAAK,IAAI,CAAC,GAAG;YAAE,OAAO,WAAW,CAAC;QACnF,MAAM,IAAI,CAAC,OAAO,CAAC,KAAK,EAAE,YAAY,MAAM,CAAC,EAAE,EAAE,EAAE,EAAE,IAAI,EAAE,EAAE,aAAa,EAAE,QAAQ,EAAE,cAAc,EAAE,IAAI,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC;QACpH,OAAO,OAAO,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC;IACzC,CAAC;IAED,KAAK,CAAC,kBAAkB,CAAC,QAAgB;QACvC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,eAAe;YAAE,OAAO;QACvC,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,aAAa,EAAE,CAAC;QAC1C,IAAI,MAAM,CAAC,aAAa,IAAI,aAAa,CAAC,MAAM,CAAC,aAAa,CAAC,KAAK,aAAa,CAAC,QAAQ,CAAC,EAAE,CAAC;YAC5F,MAAM,IAAI,CAAC,OAAO,CAAC,KAAK,EAAE,YAAY,MAAM,CAAC,EAAE,EAAE,EAAE,EAAE,IAAI,EAAE,EAAE,aAAa,EAAE,EAAE,EAAE,cAAc,EAAE,EAAE,EAAE,EAAE,CAAC,CAAC;QAC1G,CAAC;IACH,CAAC;IAEO,aAAa;QACnB,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,eAAe;YAAE,MAAM,IAAI,WAAW,CAAC,kFAAkF,CAAC,CAAC;QAC1I,OAAO,IAAI,CAAC,OAAO,CAAW,KAAK,EAAE,YAAY,kBAAkB,CAAC,IAAI,CAAC,IAAI,CAAC,eAAe,CAAC,EAAE,CAAC,CAAC;IACpG,CAAC;IAEO,OAAO,CAAI,MAAc,EAAE,IAAY,EAAE,OAAuB,EAAE;QACxE,OAAO,WAAW,CAChB,IAAI,CAAC,SAAS,EACd,UAAU,EACV,IAAI,CAAC,OAAO,GAAG,IAAI,EACnB,EAAE,GAAG,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,EAAE,0BAA0B,EAAE,IAAI,CAAC,IAAI,CAAC,YAAY,EAAE,EAAE,EACpF,CAAC,IAAI,EAAE,EAAE,CAAE,IAAyC,EAAE,OAAO,CAC9D,CAAC;IACJ,CAAC;CACF;AAED,SAAS,gBAAgB,CAAC,CAAW,EAAE,OAAgB;IACrD,MAAM,MAAM,GAAG,aAAa,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;IACrC,kDAAkD;IAClD,MAAM,OAAO,GAAG,CAAC,IAAY,EAAE,EAAE;QAC/B,MAAM,CAAC,GAAG,aAAa,CAAC,IAAI,CAAC,CAAC;QAC9B,OAAO,CAAC,KAAK,MAAM,IAAI,CAAC,CAAC,QAAQ,CAAC,IAAI,MAAM,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,IAAI,MAAM,EAAE,CAAC;IACzE,CAAC,CAAC;IACF,MAAM,OAAO,GAAgB,EAAE,CAAC;IAChC,gEAAgE;IAChE,MAAM,QAAQ,GAAG,CAAC,CAAC,eAAe,IAAI,CAAC,CAAC,QAAQ,CAAC;IACjD,MAAM,SAAS,GAAG,CAAC,CAAC,oBAAoB,IAAI,CAAC,CAAC,aAAa,CAAC;IAC5D,IAAI,QAAQ,IAAI,SAAS;QAAE,OAAO,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,OAAO,CAAC,QAAQ,CAAC,EAAE,KAAK,EAAE,SAAS,EAAE,OAAO,EAAE,MAAM,EAAE,CAAC,CAAC;IACrH,IAAI,CAAC,CAAC,gBAAgB,EAAE,CAAC;QACvB,OAAO,CAAC,IAAI,CAAC;YACX,IAAI,EAAE,OAAO;YACb,IAAI,EAAE,OAAO,CAAC,CAAC,CAAC,gBAAgB,CAAC;YACjC,KAAK,EAAE,CAAC,CAAC,0BAA0B,IAAI,yBAAyB;YAChE,OAAO,EAAE,aAAa;SACvB,CAAC,CAAC;IACL,CAAC;IACD,OAAO,EAAE,EAAE,EAAE,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,OAAO,CAAC,CAAC,CAAC,YAAY,IAAI,CAAC,CAAC,wBAAwB,CAAC,EAAE,OAAO,EAAE,OAAO,EAAE,CAAC;AACtH,CAAC"}

package/dist/src/providers/email/sendgrid.d.ts

@@ -0,0 +1,31 @@
+import { type FetchLike } from '../../http.js';
+import type { DnsRecord, DomainAuthentication, EmailProvider, InboundAction, InboundParseOptions, ValidationResult } from '../../types.js';
+export declare const SENDGRID_INBOUND_MX = "mx.sendgrid.net";
+export interface SendGridOptions {
+    apiKey: string;
+    /** Act on behalf of a subuser — how multi-tenant apps keep each customer's domains separate. */
+    onBehalfOf?: string;
+    baseUrl?: string;
+    fetch?: FetchLike;
+}
+export declare class SendGridProvider implements EmailProvider {
+    private readonly opts;
+    readonly name = "sendgrid";
+    readonly label = "SendGrid";
+    readonly supportsInbound = true;
+    defaultInboundHostname(domain: string): string;
+    private readonly baseUrl;
+    private readonly fetchImpl;
+    constructor(opts: SendGridOptions);
+    findDomain(domain: string, subdomain?: string): Promise<DomainAuthentication | null>;
+    ensureDomain(domain: string, opts?: {
+        subdomain?: string;
+    }): Promise<DomainAuthentication>;
+    getDomain(id: string): Promise<DomainAuthentication>;
+    deleteDomain(id: string): Promise<void>;
+    validateDomain(id: string): Promise<ValidationResult>;
+    inboundRecords(hostname: string): DnsRecord[];
+    ensureInboundParse(opts: InboundParseOptions): Promise<InboundAction>;
+    deleteInboundParse(hostname: string): Promise<void>;
+    private request;
+}

package/dist/src/providers/email/sendgrid.js

@@ -0,0 +1,109 @@
+import { requestJson } from '../../http.js';
+import { isRecordType, normalizeName } from '../../records.js';
+export const SENDGRID_INBOUND_MX = 'mx.sendgrid.net';
+export class SendGridProvider {
+    opts;
+    name = 'sendgrid';
+    label = 'SendGrid';
+    supportsInbound = true;
+    defaultInboundHostname(domain) {
+        return `parse.${normalizeName(domain)}`;
+    }
+    baseUrl;
+    fetchImpl;
+    constructor(opts) {
+        this.opts = opts;
+        this.baseUrl = opts.baseUrl ?? 'https://api.sendgrid.com/v3';
+        this.fetchImpl = opts.fetch ?? fetch;
+    }
+    async findDomain(domain, subdomain) {
+        // `domain` is a search filter on SendGrid's side, so match exactly here.
+        const wanted = normalizeName(domain);
+        const list = await this.request(`/whitelabel/domains?domain=${encodeURIComponent(wanted)}&limit=100`);
+        const match = list.find((d) => normalizeName(d.domain) === wanted &&
+            (!subdomain || d.subdomain?.toLowerCase() === subdomain.toLowerCase()));
+        return match ? toAuthentication(match, false) : null;
+    }
+    async ensureDomain(domain, opts = {}) {
+        const existing = await this.findDomain(domain, opts.subdomain);
+        if (existing)
+            return existing;
+        const created = await this.request('/whitelabel/domains', {
+            method: 'POST',
+            body: { domain: normalizeName(domain), subdomain: opts.subdomain, automatic_security: true },
+        });
+        return toAuthentication(created, true);
+    }
+    async getDomain(id) {
+        return toAuthentication(await this.request(`/whitelabel/domains/${encodeURIComponent(id)}`), false);
+    }
+    async deleteDomain(id) {
+        await this.request(`/whitelabel/domains/${encodeURIComponent(id)}`, { method: 'DELETE' });
+    }
+    async validateDomain(id) {
+        const res = await this.request(`/whitelabel/domains/${encodeURIComponent(id)}/validate`, {
+            method: 'POST',
+        });
+        return {
+            valid: res.valid,
+            results: Object.entries(res.validation_results ?? {}).map(([record, r]) => ({
+                record,
+                valid: r.valid,
+                ...(r.reason ? { reason: r.reason } : {}),
+            })),
+        };
+    }
+    inboundRecords(hostname) {
+        return [{ type: 'MX', name: normalizeName(hostname), value: SENDGRID_INBOUND_MX, priority: 10, purpose: 'inbound_mx' }];
+    }
+    async ensureInboundParse(opts) {
+        const hostname = normalizeName(opts.hostname);
+        const desired = { url: opts.url, spam_check: opts.spamCheck ?? false, send_raw: opts.sendRaw ?? false };
+        const { result = [] } = await this.request('/user/parse/settings');
+        const existing = result.find((s) => normalizeName(s.hostname) === hostname);
+        if (!existing) {
+            await this.request('/user/parse/settings', { method: 'POST', body: { hostname, ...desired } });
+            return 'created';
+        }
+        if (existing.url === desired.url &&
+            Boolean(existing.spam_check) === desired.spam_check &&
+            Boolean(existing.send_raw) === desired.send_raw) {
+            return 'unchanged';
+        }
+        await this.request(`/user/parse/settings/${encodeURIComponent(hostname)}`, { method: 'PATCH', body: desired });
+        return 'updated';
+    }
+    async deleteInboundParse(hostname) {
+        await this.request(`/user/parse/settings/${encodeURIComponent(normalizeName(hostname))}`, { method: 'DELETE' });
+    }
+    request(path, opts = {}) {
+        const headers = { Authorization: `Bearer ${this.opts.apiKey}` };
+        if (this.opts.onBehalfOf)
+            headers['on-behalf-of'] = this.opts.onBehalfOf;
+        return requestJson(this.fetchImpl, 'SendGrid', this.baseUrl + path, { ...opts, headers }, describeSendGridError);
+    }
+}
+function toAuthentication(d, created) {
+    const records = Object.entries(d.dns ?? {}).flatMap(([purpose, entry]) => {
+        const type = entry.type.toUpperCase();
+        if (!isRecordType(type))
+            return [];
+        return [
+            {
+                type,
+                name: normalizeName(entry.host),
+                value: entry.data,
+                purpose,
+                ...(type === 'MX' ? { priority: 10 } : {}),
+            },
+        ];
+    });
+    return { id: String(d.id), domain: d.domain, valid: d.valid, records, created };
+}
+function describeSendGridError(body) {
+    const errors = body?.errors;
+    if (!Array.isArray(errors) || errors.length === 0)
+        return undefined;
+    return errors.map((e) => (e.field ? `${e.message} (${e.field})` : e.message)).join('; ');
+}
+//# sourceMappingURL=sendgrid.js.map

package/dist/src/providers/email/sendgrid.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sendgrid.js","sourceRoot":"","sources":["../../../../src/providers/email/sendgrid.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,WAAW,EAAuC,MAAM,eAAe,CAAC;AACjF,OAAO,EAAE,YAAY,EAAE,aAAa,EAAE,MAAM,kBAAkB,CAAC;AAU/D,MAAM,CAAC,MAAM,mBAAmB,GAAG,iBAAiB,CAAC;AAsCrD,MAAM,OAAO,gBAAgB;IAWE;IAVpB,IAAI,GAAG,UAAU,CAAC;IAClB,KAAK,GAAG,UAAU,CAAC;IACnB,eAAe,GAAG,IAAI,CAAC;IAEhC,sBAAsB,CAAC,MAAc;QACnC,OAAO,SAAS,aAAa,CAAC,MAAM,CAAC,EAAE,CAAC;IAC1C,CAAC;IACgB,OAAO,CAAS;IAChB,SAAS,CAAY;IAEtC,YAA6B,IAAqB;QAArB,SAAI,GAAJ,IAAI,CAAiB;QAChD,IAAI,CAAC,OAAO,GAAG,IAAI,CAAC,OAAO,IAAI,6BAA6B,CAAC;QAC7D,IAAI,CAAC,SAAS,GAAG,IAAI,CAAC,KAAK,IAAI,KAAK,CAAC;IACvC,CAAC;IAED,KAAK,CAAC,UAAU,CAAC,MAAc,EAAE,SAAkB;QACjD,yEAAyE;QACzE,MAAM,MAAM,GAAG,aAAa,CAAC,MAAM,CAAC,CAAC;QACrC,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,OAAO,CAAa,8BAA8B,kBAAkB,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC;QAClH,MAAM,KAAK,GAAG,IAAI,CAAC,IAAI,CACrB,CAAC,CAAC,EAAE,EAAE,CACJ,aAAa,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,MAAM;YAClC,CAAC,CAAC,SAAS,IAAI,CAAC,CAAC,SAAS,EAAE,WAAW,EAAE,KAAK,SAAS,CAAC,WAAW,EAAE,CAAC,CACzE,CAAC;QACF,OAAO,KAAK,CAAC,CAAC,CAAC,gBAAgB,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;IACvD,CAAC;IAED,KAAK,CAAC,YAAY,CAAC,MAAc,EAAE,OAA+B,EAAE;QAClE,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,UAAU,CAAC,MAAM,EAAE,IAAI,CAAC,SAAS,CAAC,CAAC;QAC/D,IAAI,QAAQ;YAAE,OAAO,QAAQ,CAAC;QAC9B,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,OAAO,CAAW,qBAAqB,EAAE;YAClE,MAAM,EAAE,MAAM;YACd,IAAI,EAAE,EAAE,MAAM,EAAE,aAAa,CAAC,MAAM,CAAC,EAAE,SAAS,EAAE,IAAI,CAAC,SAAS,EAAE,kBAAkB,EAAE,IAAI,EAAE;SAC7F,CAAC,CAAC;QACH,OAAO,gBAAgB,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC;IACzC,CAAC;IAED,KAAK,CAAC,SAAS,CAAC,EAAU;QACxB,OAAO,gBAAgB,CAAC,MAAM,IAAI,CAAC,OAAO,CAAW,uBAAuB,kBAAkB,CAAC,EAAE,CAAC,EAAE,CAAC,EAAE,KAAK,CAAC,CAAC;IAChH,CAAC;IAED,KAAK,CAAC,YAAY,CAAC,EAAU;QAC3B,MAAM,IAAI,CAAC,OAAO,CAAC,uBAAuB,kBAAkB,CAAC,EAAE,CAAC,EAAE,EAAE,EAAE,MAAM,EAAE,QAAQ,EAAE,CAAC,CAAC;IAC5F,CAAC;IAED,KAAK,CAAC,cAAc,CAAC,EAAU;QAC7B,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,OAAO,CAAe,uBAAuB,kBAAkB,CAAC,EAAE,CAAC,WAAW,EAAE;YACrG,MAAM,EAAE,MAAM;SACf,CAAC,CAAC;QACH,OAAO;YACL,KAAK,EAAE,GAAG,CAAC,KAAK;YAChB,OAAO,EAAE,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,kBAAkB,IAAI,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;gBAC1E,MAAM;gBACN,KAAK,EAAE,CAAC,CAAC,KAAK;gBACd,GAAG,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;aAC1C,CAAC,CAAC;SACJ,CAAC;IACJ,CAAC;IAED,cAAc,CAAC,QAAgB;QAC7B,OAAO,CAAC,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,aAAa,CAAC,QAAQ,CAAC,EAAE,KAAK,EAAE,mBAAmB,EAAE,QAAQ,EAAE,EAAE,EAAE,OAAO,EAAE,YAAY,EAAE,CAAC,CAAC;IAC1H,CAAC;IAED,KAAK,CAAC,kBAAkB,CAAC,IAAyB;QAChD,MAAM,QAAQ,GAAG,aAAa,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;QAC9C,MAAM,OAAO,GAAG,EAAE,GAAG,EAAE,IAAI,CAAC,GAAG,EAAE,UAAU,EAAE,IAAI,CAAC,SAAS,IAAI,KAAK,EAAE,QAAQ,EAAE,IAAI,CAAC,OAAO,IAAI,KAAK,EAAE,CAAC;QACxG,MAAM,EAAE,MAAM,GAAG,EAAE,EAAE,GAAG,MAAM,IAAI,CAAC,OAAO,CAAgC,sBAAsB,CAAC,CAAC;QAClG,MAAM,QAAQ,GAAG,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,aAAa,CAAC,CAAC,CAAC,QAAQ,CAAC,KAAK,QAAQ,CAAC,CAAC;QAE5E,IAAI,CAAC,QAAQ,EAAE,CAAC;YACd,MAAM,IAAI,CAAC,OAAO,CAAC,sBAAsB,EAAE,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,EAAE,QAAQ,EAAE,GAAG,OAAO,EAAE,EAAE,CAAC,CAAC;YAC/F,OAAO,SAAS,CAAC;QACnB,CAAC;QACD,IACE,QAAQ,CAAC,GAAG,KAAK,OAAO,CAAC,GAAG;YAC5B,OAAO,CAAC,QAAQ,CAAC,UAAU,CAAC,KAAK,OAAO,CAAC,UAAU;YACnD,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAC,KAAK,OAAO,CAAC,QAAQ,EAC/C,CAAC;YACD,OAAO,WAAW,CAAC;QACrB,CAAC;QACD,MAAM,IAAI,CAAC,OAAO,CAAC,wBAAwB,kBAAkB,CAAC,QAAQ,CAAC,EAAE,EAAE,EAAE,MAAM,EAAE,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,CAAC,CAAC;QAC/G,OAAO,SAAS,CAAC;IACnB,CAAC;IAED,KAAK,CAAC,kBAAkB,CAAC,QAAgB;QACvC,MAAM,IAAI,CAAC,OAAO,CAAC,wBAAwB,kBAAkB,CAAC,aAAa,CAAC,QAAQ,CAAC,CAAC,EAAE,EAAE,EAAE,MAAM,EAAE,QAAQ,EAAE,CAAC,CAAC;IAClH,CAAC;IAEO,OAAO,CAAI,IAAY,EAAE,OAAuB,EAAE;QACxD,MAAM,OAAO,GAA2B,EAAE,aAAa,EAAE,UAAU,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,EAAE,CAAC;QACxF,IAAI,IAAI,CAAC,IAAI,CAAC,UAAU;YAAE,OAAO,CAAC,cAAc,CAAC,GAAG,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC;QACzE,OAAO,WAAW,CAAI,IAAI,CAAC,SAAS,EAAE,UAAU,EAAE,IAAI,CAAC,OAAO,GAAG,IAAI,EAAE,EAAE,GAAG,IAAI,EAAE,OAAO,EAAE,EAAE,qBAAqB,CAAC,CAAC;IACtH,CAAC;CACF;AAED,SAAS,gBAAgB,CAAC,CAAW,EAAE,OAAgB;IACrD,MAAM,OAAO,GAAG,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,GAAG,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,OAAO,EAAE,KAAK,CAAC,EAAe,EAAE;QACpF,MAAM,IAAI,GAAG,KAAK,CAAC,IAAI,CAAC,WAAW,EAAE,CAAC;QACtC,IAAI,CAAC,YAAY,CAAC,IAAI,CAAC;YAAE,OAAO,EAAE,CAAC;QACnC,OAAO;YACL;gBACE,IAAI;gBACJ,IAAI,EAAE,aAAa,CAAC,KAAK,CAAC,IAAI,CAAC;gBAC/B,KAAK,EAAE,KAAK,CAAC,IAAI;gBACjB,OAAO;gBACP,GAAG,CAAC,IAAI,KAAK,IAAI,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;aAC3C;SACF,CAAC;IACJ,CAAC,CAAC,CAAC;IACH,OAAO,EAAE,EAAE,EAAE,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,KAAK,EAAE,CAAC,CAAC,KAAK,EAAE,OAAO,EAAE,OAAO,EAAE,CAAC;AAClF,CAAC;AAED,SAAS,qBAAqB,CAAC,IAAa;IAC1C,MAAM,MAAM,GAAI,IAA+E,EAAE,MAAM,CAAC;IACxG,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,SAAS,CAAC;IACpE,OAAO,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,OAAO,KAAK,CAAC,CAAC,KAAK,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AAC3F,CAAC"}

package/dist/src/providers/email/ses.d.ts

@@ -0,0 +1,39 @@
+import { type FetchLike } from '../../http.js';
+import type { DnsRecord, DomainAuthentication, EmailProvider, InboundAction, ValidationResult } from '../../types.js';
+import { type AwsCredentials } from '../dns/aws.js';
+export interface SesOptions {
+    credentials: AwsCredentials;
+    /** The SES region, e.g. us-east-1. */
+    region: string;
+    baseUrl?: string;
+    fetch?: FetchLike;
+}
+/**
+ * Amazon SES (API v2) domain identities with Easy DKIM (three CNAMEs) and a
+ * custom MAIL FROM subdomain (an MX for bounces and an SPF TXT). SES checks DNS
+ * by itself, so "validate" reads the current status.
+ */
+export declare class SesProvider implements EmailProvider {
+    private readonly opts;
+    readonly name = "ses";
+    readonly label = "Amazon SES";
+    readonly supportsInbound = false;
+    private readonly baseUrl;
+    private readonly fetchImpl;
+    constructor(opts: SesOptions);
+    defaultInboundHostname(domain: string): string;
+    findDomain(domain: string): Promise<DomainAuthentication | null>;
+    /** `subdomain` is the MAIL FROM label (default "mail", giving mail.<domain>). */
+    ensureDomain(domain: string, opts?: {
+        subdomain?: string;
+    }): Promise<DomainAuthentication>;
+    getDomain(id: string): Promise<DomainAuthentication>;
+    deleteDomain(id: string): Promise<void>;
+    validateDomain(id: string): Promise<ValidationResult>;
+    inboundRecords(): DnsRecord[];
+    ensureInboundParse(): Promise<InboundAction>;
+    deleteInboundParse(): Promise<void>;
+    private identity;
+    private toAuthentication;
+    private request;
+}

package/dist/src/providers/email/ses.js

@@ -0,0 +1,123 @@
+import { ApiError, ConfigError } from '../../errors.js';
+import { requestText } from '../../http.js';
+import { normalizeName } from '../../records.js';
+import { signRequest } from '../dns/aws.js';
+const INBOUND_UNSUPPORTED = 'Receiving email with Amazon SES isn’t supported yet. Use SendGrid, Postmark or Mailgun for inbound mail.';
+/**
+ * Amazon SES (API v2) domain identities with Easy DKIM (three CNAMEs) and a
+ * custom MAIL FROM subdomain (an MX for bounces and an SPF TXT). SES checks DNS
+ * by itself, so "validate" reads the current status.
+ */
+export class SesProvider {
+    opts;
+    name = 'ses';
+    label = 'Amazon SES';
+    supportsInbound = false;
+    baseUrl;
+    fetchImpl;
+    constructor(opts) {
+        this.opts = opts;
+        if (!/^[a-z]{2}(-[a-z]+)+-\d$/.test(opts.region))
+            throw new ConfigError(`"${opts.region}" isn’t an AWS region (e.g. us-east-1).`);
+        this.baseUrl = opts.baseUrl ?? `https://email.${opts.region}.amazonaws.com`;
+        this.fetchImpl = opts.fetch ?? fetch;
+    }
+    defaultInboundHostname(domain) {
+        return `parse.${normalizeName(domain)}`;
+    }
+    async findDomain(domain) {
+        const name = normalizeName(domain);
+        try {
+            return this.toAuthentication(name, await this.identity(name), false);
+        }
+        catch (err) {
+            if (err instanceof ApiError && err.status === 404)
+                return null;
+            throw err;
+        }
+    }
+    /** `subdomain` is the MAIL FROM label (default "mail", giving mail.<domain>). */
+    async ensureDomain(domain, opts = {}) {
+        const existing = await this.findDomain(domain);
+        if (existing)
+            return existing;
+        const name = normalizeName(domain);
+        await this.request('POST', '/v2/email/identities', { EmailIdentity: name });
+        await this.request('PUT', `/v2/email/identities/${encodeURIComponent(name)}/mail-from`, {
+            MailFromDomain: `${opts.subdomain ?? 'mail'}.${name}`,
+            // Until the MX is in place, SES falls back to its own MAIL FROM rather than rejecting mail.
+            BehaviorOnMxFailure: 'USE_DEFAULT_VALUE',
+        });
+        return this.toAuthentication(name, await this.identity(name), true);
+    }
+    async getDomain(id) {
+        return this.toAuthentication(id, await this.identity(id), false);
+    }
+    async deleteDomain(id) {
+        await this.request('DELETE', `/v2/email/identities/${encodeURIComponent(id)}`);
+    }
+    async validateDomain(id) {
+        const identity = await this.identity(id);
+        const dkimStatus = identity.DkimAttributes?.Status ?? 'NOT_STARTED';
+        const dkim = dkimStatus === 'SUCCESS';
+        const results = [{ record: 'dkim', valid: dkim, ...(dkim ? {} : { reason: `DKIM status: ${dkimStatus.toLowerCase().replace(/_/g, ' ')}` }) }];
+        const mailFrom = identity.MailFromAttributes;
+        if (mailFrom?.MailFromDomain) {
+            const ok = mailFrom.MailFromDomainStatus === 'SUCCESS';
+            const status = (mailFrom.MailFromDomainStatus ?? 'PENDING').toLowerCase().replace(/_/g, ' ');
+            results.push({ record: 'mail_from', valid: ok, ...(ok ? {} : { reason: `MAIL FROM status: ${status}` }) });
+        }
+        // Sending is allowed once the identity (via DKIM) verifies; MAIL FROM falls back until its MX is found.
+        return { valid: Boolean(identity.VerifiedForSendingStatus) && dkim, results };
+    }
+    inboundRecords() {
+        throw new ConfigError(INBOUND_UNSUPPORTED);
+    }
+    async ensureInboundParse() {
+        throw new ConfigError(INBOUND_UNSUPPORTED);
+    }
+    async deleteInboundParse() { }
+    identity(name) {
+        return this.request('GET', `/v2/email/identities/${encodeURIComponent(name)}`);
+    }
+    toAuthentication(domain, identity, created) {
+        const records = (identity.DkimAttributes?.Tokens ?? []).map((token, i) => ({
+            type: 'CNAME',
+            name: `${token}._domainkey.${domain}`,
+            value: `${token}.dkim.amazonses.com`,
+            purpose: `dkim${i + 1}`,
+        }));
+        const mailFrom = identity.MailFromAttributes?.MailFromDomain;
+        if (mailFrom) {
+            const host = normalizeName(mailFrom);
+            records.push({ type: 'MX', name: host, value: `feedback-smtp.${this.opts.region}.amazonses.com`, priority: 10, purpose: 'mail_from_mx' });
+            records.push({
+                type: 'TXT',
+                name: host,
+                value: 'v=spf1 include:amazonses.com ~all',
+                purpose: 'mail_from_spf',
+                note: 'If this name already has an SPF record (v=spf1 …), add include:amazonses.com to it instead of creating a second one.',
+            });
+        }
+        return { id: domain, domain, valid: Boolean(identity.VerifiedForSendingStatus), records, created };
+    }
+    async request(method, path, body) {
+        const url = this.baseUrl + path;
+        const payload = body === undefined ? undefined : JSON.stringify(body);
+        const text = await requestText(this.fetchImpl, 'Amazon SES', url, () => ({
+            method,
+            body: payload,
+            headers: signRequest({ method, url, body: payload, headers: payload ? { 'content-type': 'application/json' } : {} }, this.opts.credentials, this.opts.region, 'ses'),
+        }), (t) => {
+            try {
+                const b = JSON.parse(t);
+                return b.message ?? b.Message;
+            }
+            catch {
+                return undefined;
+            }
+        });
+        return (text ? JSON.parse(text) : {});
+    }
+}
+//# sourceMappingURL=ses.js.map

package/dist/src/providers/email/ses.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"ses.js","sourceRoot":"","sources":["../../../../src/providers/email/ses.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,WAAW,EAAE,MAAM,iBAAiB,CAAC;AACxD,OAAO,EAAE,WAAW,EAAkB,MAAM,eAAe,CAAC;AAC5D,OAAO,EAAE,aAAa,EAAE,MAAM,kBAAkB,CAAC;AAEjD,OAAO,EAAE,WAAW,EAAuB,MAAM,eAAe,CAAC;AAiBjE,MAAM,mBAAmB,GAAG,0GAA0G,CAAC;AAEvI;;;;GAIG;AACH,MAAM,OAAO,WAAW;IAOO;IANpB,IAAI,GAAG,KAAK,CAAC;IACb,KAAK,GAAG,YAAY,CAAC;IACrB,eAAe,GAAG,KAAK,CAAC;IAChB,OAAO,CAAS;IAChB,SAAS,CAAY;IAEtC,YAA6B,IAAgB;QAAhB,SAAI,GAAJ,IAAI,CAAY;QAC3C,IAAI,CAAC,yBAAyB,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC;YAAE,MAAM,IAAI,WAAW,CAAC,IAAI,IAAI,CAAC,MAAM,yCAAyC,CAAC,CAAC;QAClI,IAAI,CAAC,OAAO,GAAG,IAAI,CAAC,OAAO,IAAI,iBAAiB,IAAI,CAAC,MAAM,gBAAgB,CAAC;QAC5E,IAAI,CAAC,SAAS,GAAG,IAAI,CAAC,KAAK,IAAI,KAAK,CAAC;IACvC,CAAC;IAED,sBAAsB,CAAC,MAAc;QACnC,OAAO,SAAS,aAAa,CAAC,MAAM,CAAC,EAAE,CAAC;IAC1C,CAAC;IAED,KAAK,CAAC,UAAU,CAAC,MAAc;QAC7B,MAAM,IAAI,GAAG,aAAa,CAAC,MAAM,CAAC,CAAC;QACnC,IAAI,CAAC;YACH,OAAO,IAAI,CAAC,gBAAgB,CAAC,IAAI,EAAE,MAAM,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,KAAK,CAAC,CAAC;QACvE,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,IAAI,GAAG,YAAY,QAAQ,IAAI,GAAG,CAAC,MAAM,KAAK,GAAG;gBAAE,OAAO,IAAI,CAAC;YAC/D,MAAM,GAAG,CAAC;QACZ,CAAC;IACH,CAAC;IAED,iFAAiF;IACjF,KAAK,CAAC,YAAY,CAAC,MAAc,EAAE,OAA+B,EAAE;QAClE,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC;QAC/C,IAAI,QAAQ;YAAE,OAAO,QAAQ,CAAC;QAC9B,MAAM,IAAI,GAAG,aAAa,CAAC,MAAM,CAAC,CAAC;QACnC,MAAM,IAAI,CAAC,OAAO,CAAC,MAAM,EAAE,sBAAsB,EAAE,EAAE,aAAa,EAAE,IAAI,EAAE,CAAC,CAAC;QAC5E,MAAM,IAAI,CAAC,OAAO,CAAC,KAAK,EAAE,wBAAwB,kBAAkB,CAAC,IAAI,CAAC,YAAY,EAAE;YACtF,cAAc,EAAE,GAAG,IAAI,CAAC,SAAS,IAAI,MAAM,IAAI,IAAI,EAAE;YACrD,4FAA4F;YAC5F,mBAAmB,EAAE,mBAAmB;SACzC,CAAC,CAAC;QACH,OAAO,IAAI,CAAC,gBAAgB,CAAC,IAAI,EAAE,MAAM,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,IAAI,CAAC,CAAC;IACtE,CAAC;IAED,KAAK,CAAC,SAAS,CAAC,EAAU;QACxB,OAAO,IAAI,CAAC,gBAAgB,CAAC,EAAE,EAAE,MAAM,IAAI,CAAC,QAAQ,CAAC,EAAE,CAAC,EAAE,KAAK,CAAC,CAAC;IACnE,CAAC;IAED,KAAK,CAAC,YAAY,CAAC,EAAU;QAC3B,MAAM,IAAI,CAAC,OAAO,CAAC,QAAQ,EAAE,wBAAwB,kBAAkB,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC;IACjF,CAAC;IAED,KAAK,CAAC,cAAc,CAAC,EAAU;QAC7B,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC;QACzC,MAAM,UAAU,GAAG,QAAQ,CAAC,cAAc,EAAE,MAAM,IAAI,aAAa,CAAC;QACpE,MAAM,IAAI,GAAG,UAAU,KAAK,SAAS,CAAC;QACtC,MAAM,OAAO,GAAG,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,gBAAgB,UAAU,CAAC,WAAW,EAAE,CAAC,OAAO,CAAC,IAAI,EAAE,GAAG,CAAC,EAAE,EAAE,CAAC,EAAE,CAAC,CAAC;QAC9I,MAAM,QAAQ,GAAG,QAAQ,CAAC,kBAAkB,CAAC;QAC7C,IAAI,QAAQ,EAAE,cAAc,EAAE,CAAC;YAC7B,MAAM,EAAE,GAAG,QAAQ,CAAC,oBAAoB,KAAK,SAAS,CAAC;YACvD,MAAM,MAAM,GAAG,CAAC,QAAQ,CAAC,oBAAoB,IAAI,SAAS,CAAC,CAAC,WAAW,EAAE,CAAC,OAAO,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC;YAC7F,OAAO,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,WAAW,EAAE,KAAK,EAAE,EAAE,EAAE,GAAG,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,qBAAqB,MAAM,EAAE,EAAE,CAAC,EAAE,CAAC,CAAC;QAC7G,CAAC;QACD,wGAAwG;QACxG,OAAO,EAAE,KAAK,EAAE,OAAO,CAAC,QAAQ,CAAC,wBAAwB,CAAC,IAAI,IAAI,EAAE,OAAO,EAAE,CAAC;IAChF,CAAC;IAED,cAAc;QACZ,MAAM,IAAI,WAAW,CAAC,mBAAmB,CAAC,CAAC;IAC7C,CAAC;IAED,KAAK,CAAC,kBAAkB;QACtB,MAAM,IAAI,WAAW,CAAC,mBAAmB,CAAC,CAAC;IAC7C,CAAC;IAED,KAAK,CAAC,kBAAkB,KAAmB,CAAC;IAEpC,QAAQ,CAAC,IAAY;QAC3B,OAAO,IAAI,CAAC,OAAO,CAAc,KAAK,EAAE,wBAAwB,kBAAkB,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IAC9F,CAAC;IAEO,gBAAgB,CAAC,MAAc,EAAE,QAAqB,EAAE,OAAgB;QAC9E,MAAM,OAAO,GAAgB,CAAC,QAAQ,CAAC,cAAc,EAAE,MAAM,IAAI,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC;YACtF,IAAI,EAAE,OAAO;YACb,IAAI,EAAE,GAAG,KAAK,eAAe,MAAM,EAAE;YACrC,KAAK,EAAE,GAAG,KAAK,qBAAqB;YACpC,OAAO,EAAE,OAAO,CAAC,GAAG,CAAC,EAAE;SACxB,CAAC,CAAC,CAAC;QACJ,MAAM,QAAQ,GAAG,QAAQ,CAAC,kBAAkB,EAAE,cAAc,CAAC;QAC7D,IAAI,QAAQ,EAAE,CAAC;YACb,MAAM,IAAI,GAAG,aAAa,CAAC,QAAQ,CAAC,CAAC;YACrC,OAAO,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,iBAAiB,IAAI,CAAC,IAAI,CAAC,MAAM,gBAAgB,EAAE,QAAQ,EAAE,EAAE,EAAE,OAAO,EAAE,cAAc,EAAE,CAAC,CAAC;YAC1I,OAAO,CAAC,IAAI,CAAC;gBACX,IAAI,EAAE,KAAK;gBACX,IAAI,EAAE,IAAI;gBACV,KAAK,EAAE,mCAAmC;gBAC1C,OAAO,EAAE,eAAe;gBACxB,IAAI,EAAE,sHAAsH;aAC7H,CAAC,CAAC;QACL,CAAC;QACD,OAAO,EAAE,EAAE,EAAE,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,OAAO,CAAC,QAAQ,CAAC,wBAAwB,CAAC,EAAE,OAAO,EAAE,OAAO,EAAE,CAAC;IACrG,CAAC;IAEO,KAAK,CAAC,OAAO,CAAI,MAAc,EAAE,IAAY,EAAE,IAAc;QACnE,MAAM,GAAG,GAAG,IAAI,CAAC,OAAO,GAAG,IAAI,CAAC;QAChC,MAAM,OAAO,GAAG,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC;QACtE,MAAM,IAAI,GAAG,MAAM,WAAW,CAC5B,IAAI,CAAC,SAAS,EACd,YAAY,EACZ,GAAG,EACH,GAAG,EAAE,CAAC,CAAC;YACL,MAAM;YACN,IAAI,EAAE,OAAO;YACb,OAAO,EAAE,WAAW,CAClB,EAAE,MAAM,EAAE,GAAG,EAAE,IAAI,EAAE,OAAO,EAAE,OAAO,EAAE,OAAO,CAAC,CAAC,CAAC,EAAE,cAAc,EAAE,kBAAkB,EAAE,CAAC,CAAC,CAAC,EAAE,EAAE,EAC9F,IAAI,CAAC,IAAI,CAAC,WAAW,EACrB,IAAI,CAAC,IAAI,CAAC,MAAM,EAChB,KAAK,CACN;SACF,CAAC,EACF,CAAC,CAAC,EAAE,EAAE;YACJ,IAAI,CAAC;gBACH,MAAM,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,CAA2C,CAAC;gBAClE,OAAO,CAAC,CAAC,OAAO,IAAI,CAAC,CAAC,OAAO,CAAC;YAChC,CAAC;YAAC,MAAM,CAAC;gBACP,OAAO,SAAS,CAAC;YACnB,CAAC;QACH,CAAC,CACF,CAAC;QACF,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,EAAE,CAAM,CAAC;IAC7C,CAAC;CACF"}

package/dist/src/providers/factory.d.ts

@@ -0,0 +1,14 @@
+import type { DnsProvider, DnsRecord } from '../types.js';
+import { type AwsCredentials } from './dns/aws.js';
+export declare const DNS_PROVIDERS: readonly ["cloudflare", "route53", "manual"];
+export type DnsProviderName = (typeof DNS_PROVIDERS)[number];
+export interface DnsProviderConfig {
+    cloudflareApiToken?: string;
+    /** Explicit AWS keys; otherwise environment or shared credentials file. */
+    aws?: Partial<AwsCredentials>;
+    awsProfile?: string;
+    route53HostedZoneId?: string;
+    onManualRecords?: (records: DnsRecord[]) => Promise<void>;
+    env?: NodeJS.ProcessEnv;
+}
+export declare function createDnsProvider(name: string, config?: DnsProviderConfig): DnsProvider;

package/dist/src/providers/factory.js

@@ -0,0 +1,32 @@
+import { ConfigError } from '../errors.js';
+import { loadAwsCredentials } from './dns/aws.js';
+import { CloudflareDns } from './dns/cloudflare.js';
+import { ManualDns } from './dns/manual.js';
+import { Route53Dns } from './dns/route53.js';
+export const DNS_PROVIDERS = ['cloudflare', 'route53', 'manual'];
+export function createDnsProvider(name, config = {}) {
+    const env = config.env ?? process.env;
+    switch (name) {
+        case 'cloudflare': {
+            const apiToken = config.cloudflareApiToken || env.CLOUDFLARE_API_TOKEN;
+            if (!apiToken)
+                throw new ConfigError('Cloudflare needs an API token (CLOUDFLARE_API_TOKEN).');
+            return new CloudflareDns({ apiToken });
+        }
+        case 'route53': {
+            const { accessKeyId, secretAccessKey, sessionToken } = config.aws ?? {};
+            if (Boolean(accessKeyId) !== Boolean(secretAccessKey)) {
+                throw new ConfigError('Route53 needs both an AWS access key id and a secret access key.');
+            }
+            const credentials = accessKeyId && secretAccessKey
+                ? { accessKeyId, secretAccessKey, ...(sessionToken ? { sessionToken } : {}) }
+                : () => loadAwsCredentials({ profile: config.awsProfile || undefined, env });
+            return new Route53Dns({ credentials, hostedZoneId: config.route53HostedZoneId || undefined });
+        }
+        case 'manual':
+            return new ManualDns(config.onManualRecords ?? (async () => { }));
+        default:
+            throw new ConfigError(`Unknown DNS provider "${name}". Use one of: ${DNS_PROVIDERS.join(', ')}.`);
+    }
+}
+//# sourceMappingURL=factory.js.map

package/dist/src/providers/factory.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"factory.js","sourceRoot":"","sources":["../../../src/providers/factory.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,WAAW,EAAE,MAAM,cAAc,CAAC;AAE3C,OAAO,EAAE,kBAAkB,EAAuB,MAAM,cAAc,CAAC;AACvE,OAAO,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAC;AACpD,OAAO,EAAE,SAAS,EAAE,MAAM,iBAAiB,CAAC;AAC5C,OAAO,EAAE,UAAU,EAAE,MAAM,kBAAkB,CAAC;AAE9C,MAAM,CAAC,MAAM,aAAa,GAAG,CAAC,YAAY,EAAE,SAAS,EAAE,QAAQ,CAAU,CAAC;AAa1E,MAAM,UAAU,iBAAiB,CAAC,IAAY,EAAE,SAA4B,EAAE;IAC5E,MAAM,GAAG,GAAG,MAAM,CAAC,GAAG,IAAI,OAAO,CAAC,GAAG,CAAC;IACtC,QAAQ,IAAI,EAAE,CAAC;QACb,KAAK,YAAY,CAAC,CAAC,CAAC;YAClB,MAAM,QAAQ,GAAG,MAAM,CAAC,kBAAkB,IAAI,GAAG,CAAC,oBAAoB,CAAC;YACvE,IAAI,CAAC,QAAQ;gBAAE,MAAM,IAAI,WAAW,CAAC,uDAAuD,CAAC,CAAC;YAC9F,OAAO,IAAI,aAAa,CAAC,EAAE,QAAQ,EAAE,CAAC,CAAC;QACzC,CAAC;QACD,KAAK,SAAS,CAAC,CAAC,CAAC;YACf,MAAM,EAAE,WAAW,EAAE,eAAe,EAAE,YAAY,EAAE,GAAG,MAAM,CAAC,GAAG,IAAI,EAAE,CAAC;YACxE,IAAI,OAAO,CAAC,WAAW,CAAC,KAAK,OAAO,CAAC,eAAe,CAAC,EAAE,CAAC;gBACtD,MAAM,IAAI,WAAW,CAAC,kEAAkE,CAAC,CAAC;YAC5F,CAAC;YACD,MAAM,WAAW,GACf,WAAW,IAAI,eAAe;gBAC5B,CAAC,CAAC,EAAE,WAAW,EAAE,eAAe,EAAE,GAAG,CAAC,YAAY,CAAC,CAAC,CAAC,EAAE,YAAY,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE;gBAC7E,CAAC,CAAC,GAAG,EAAE,CAAC,kBAAkB,CAAC,EAAE,OAAO,EAAE,MAAM,CAAC,UAAU,IAAI,SAAS,EAAE,GAAG,EAAE,CAAC,CAAC;YACjF,OAAO,IAAI,UAAU,CAAC,EAAE,WAAW,EAAE,YAAY,EAAE,MAAM,CAAC,mBAAmB,IAAI,SAAS,EAAE,CAAC,CAAC;QAChG,CAAC;QACD,KAAK,QAAQ;YACX,OAAO,IAAI,SAAS,CAAC,MAAM,CAAC,eAAe,IAAI,CAAC,KAAK,IAAI,EAAE,GAAE,CAAC,CAAC,CAAC,CAAC;QACnE;YACE,MAAM,IAAI,WAAW,CAAC,yBAAyB,IAAI,kBAAkB,aAAa,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IACtG,CAAC;AACH,CAAC"}

package/dist/src/records.d.ts

@@ -0,0 +1,35 @@
+import type { DnsRecord, PlannedChange, RecordType } from './types.js';
+export declare function isRecordType(type: string): type is RecordType;
+/** A normalized hostname with at least two labels (IDNs must be punycode). */
+export declare function isValidDomain(name: string): boolean;
+export declare function normalizeName(name: string): string;
+/** Hostnames compare case-insensitively without trailing dots; TXT values compare with quoting and chunking removed. */
+export declare function normalizeValue(type: RecordType, value: string): string;
+export declare function sameValue(type: RecordType, a: string, b: string): boolean;
+/** A record already present at the DNS host, in provider-neutral form. */
+export interface ExistingRecord {
+    id: string;
+    type: string;
+    value: string;
+    priority?: number;
+    proxied?: boolean;
+}
+export declare function isSpf(value: string): boolean;
+/**
+ * Adds the mechanisms of `desired` (e.g. "include:mailgun.org") to an existing
+ * SPF record, before its `all`/`redirect` term. Returns null when the existing
+ * record already has them all. A name must have exactly one SPF record, so
+ * providers' SPF records are merged in rather than added next to the old one.
+ */
+export declare function mergeSpf(existing: string, desired: string): {
+    value: string;
+    added: string[];
+} | null;
+/**
+ * Decides what to do with `record` given the records already at its name.
+ * Never replaces a record pointing elsewhere unless `overwrite` is set, and never
+ * deletes records of other types. `desired` is every record being planned, so
+ * a provider's own multi-value sets (e.g. two MX hosts) don't conflict with each other.
+ */
+export declare function decideChange(record: DnsRecord, existing: ExistingRecord[], overwrite?: boolean, desired?: DnsRecord[]): PlannedChange;
+export declare function describeRecord(record: DnsRecord): string;