dkimkit 0.0.0-stage → 0.7.0

package/dist/src/server.js

@@ -0,0 +1,301 @@
+import { randomBytes, timingSafeEqual } from 'node:crypto';
+import { existsSync } from 'node:fs';
+import { readFile } from 'node:fs/promises';
+import { createServer } from 'node:http';
+import { homedir } from 'node:os';
+import { join } from 'node:path';
+import { ApiError, apiErrorHint, ConfigError, DnsConflictError } from './errors.js';
+import { checkStatus, setupDomain } from './orchestrator.js';
+import { loadAwsCredentials } from './providers/dns/aws.js';
+import { createEmailProvider, EMAIL_PROVIDERS, isEmailProvider } from './providers/email/factory.js';
+import { createDnsProvider, DNS_PROVIDERS } from './providers/factory.js';
+import { isValidDomain, normalizeName } from './records.js';
+const MAX_BODY_BYTES = 64 * 1024;
+const PAGE = new URL('../../web/index.html', import.meta.url);
+/**
+ * Local web UI. Binds to 127.0.0.1 only. A random token in the first URL is
+ * swapped for a SameSite=Strict cookie; the Host header is checked to block
+ * DNS rebinding; API calls must be JSON POSTs, which cross-origin pages can't
+ * send without a CORS preflight this server never approves.
+ */
+export async function startUiServer(opts = {}) {
+    const env = opts.env ?? process.env;
+    const token = opts.token ?? randomBytes(24).toString('base64url');
+    const page = await readFile(PAGE, 'utf8');
+    let port = 0;
+    const cookieName = () => `dkimkit_${port}`;
+    const tokenMatches = (candidate) => {
+        if (!candidate)
+            return false;
+        const a = Buffer.from(candidate);
+        const b = Buffer.from(token);
+        return a.length === b.length && timingSafeEqual(a, b);
+    };
+    const hostAllowed = (host) => host === `127.0.0.1:${port}` || host === `localhost:${port}` || host === `[::1]:${port}`;
+    const cookie = (req) => req.headers.cookie
+        ?.split(';')
+        .map((c) => c.trim().split('='))
+        .find(([k]) => k === cookieName())?.[1];
+    const buildProviders = opts.providers ??
+        (async (req) => {
+            const c = req.credentials ?? {};
+            const provider = req.emailProvider ?? 'sendgrid';
+            let credentials;
+            switch (provider) {
+                case 'postmark':
+                    credentials = { accountToken: c.postmarkAccountToken || env.POSTMARK_ACCOUNT_TOKEN, inboundServerId: c.postmarkInboundServerId || env.POSTMARK_INBOUND_SERVER_ID };
+                    break;
+                case 'mailgun':
+                    credentials = { apiKey: c.mailgunApiKey || env.MAILGUN_API_KEY, region: c.mailgunRegion || env.MAILGUN_REGION || 'us' };
+                    break;
+                case 'ses': {
+                    const aws = c.awsAccessKeyId && c.awsSecretAccessKey
+                        ? { accessKeyId: c.awsAccessKeyId, secretAccessKey: c.awsSecretAccessKey, sessionToken: c.awsSessionToken }
+                        : await loadAwsCredentials({ profile: c.awsProfile, env });
+                    credentials = { ...aws, region: c.sesRegion || env.AWS_REGION || env.AWS_DEFAULT_REGION };
+                    break;
+                }
+                default:
+                    credentials = { apiKey: c.sendgridApiKey || env.SENDGRID_API_KEY };
+            }
+            return {
+                email: createEmailProvider(provider, credentials, { subuser: req.onBehalfOf || undefined }),
+                dns: createDnsProvider(req.dns, {
+                    cloudflareApiToken: c.cloudflareApiToken,
+                    aws: { accessKeyId: c.awsAccessKeyId, secretAccessKey: c.awsSecretAccessKey, sessionToken: c.awsSessionToken },
+                    awsProfile: c.awsProfile,
+                    route53HostedZoneId: c.route53HostedZoneId,
+                    env,
+                }),
+            };
+        });
+    const runOptions = (req, email) => {
+        if (req.inbound && !email.supportsInbound)
+            throw new ConfigError(`Receiving email isn't supported with ${email.label} yet.`);
+        return {
+            domain: req.domain,
+            subdomain: req.subdomain,
+            overwrite: req.overwrite,
+            inbound: req.inbound && {
+                hostname: req.inbound.hostname || email.defaultInboundHostname(req.domain),
+                url: req.inbound.url,
+                spamCheck: req.inbound.spamCheck,
+                sendRaw: req.inbound.sendRaw,
+            },
+            ...opts.setupDefaults,
+            propagation: { timeoutMs: (req.waitSeconds ?? 300) * 1000, ...opts.setupDefaults?.propagation },
+        };
+    };
+    const routes = {
+        'GET /api/config': async (_req, res) => {
+            const awsFile = env.AWS_SHARED_CREDENTIALS_FILE ?? join(homedir(), '.aws', 'credentials');
+            sendJson(res, 200, {
+                version: opts.version,
+                providers: DNS_PROVIDERS,
+                emailProviders: EMAIL_PROVIDERS,
+                env: {
+                    sendgrid: Boolean(env.SENDGRID_API_KEY),
+                    postmark: Boolean(env.POSTMARK_ACCOUNT_TOKEN),
+                    mailgun: Boolean(env.MAILGUN_API_KEY),
+                    awsRegion: env.AWS_REGION || env.AWS_DEFAULT_REGION || null,
+                    cloudflare: Boolean(env.CLOUDFLARE_API_TOKEN),
+                    aws: Boolean(env.AWS_ACCESS_KEY_ID && env.AWS_SECRET_ACCESS_KEY) || existsSync(awsFile),
+                },
+            });
+        },
+        'POST /api/plan': async (req, res) => {
+            const body = parseSetupRequest(await readJson(req));
+            const { email, dns } = await buildProviders(body);
+            let domain;
+            let changes = [];
+            try {
+                await setupDomain(email, dns, {
+                    ...runOptions(body, email),
+                    dryRun: true,
+                    onEvent: (e) => {
+                        if (e.type === 'domain')
+                            domain = e.auth;
+                        if (e.type === 'plan')
+                            changes = e.changes;
+                    },
+                });
+            }
+            catch (err) {
+                if (!(err instanceof DnsConflictError))
+                    throw err;
+            }
+            sendJson(res, 200, { domain, changes, conflicts: changes.some((c) => c.action === 'conflict') });
+        },
+        'POST /api/setup': async (req, res) => {
+            const body = parseSetupRequest(await readJson(req));
+            const { email, dns } = await buildProviders(body);
+            const controller = new AbortController();
+            res.on('close', () => {
+                if (!res.writableFinished)
+                    controller.abort();
+            });
+            res.writeHead(200, { 'content-type': 'application/x-ndjson; charset=utf-8', 'cache-control': 'no-store' });
+            const write = (line) => res.write(JSON.stringify(line) + '\n');
+            try {
+                const result = await setupDomain(email, dns, {
+                    ...runOptions(body, email),
+                    onEvent: (event) => write({ type: 'event', event }),
+                    signal: controller.signal,
+                });
+                write({ type: 'result', result });
+            }
+            catch (err) {
+                if (!controller.signal.aborted)
+                    write({ type: 'error', ...serializeError(err) });
+            }
+            finally {
+                res.end();
+            }
+        },
+        'POST /api/status': async (req, res) => {
+            const body = parseSetupRequest(await readJson(req), { requireDns: false });
+            const { email } = await buildProviders({ ...body, dns: 'manual' });
+            sendJson(res, 200, await checkStatus(email, body.domain, body.subdomain));
+        },
+    };
+    const server = createServer(async (req, res) => {
+        try {
+            if (!hostAllowed(req.headers.host))
+                return sendText(res, 403, 'Forbidden host');
+            const url = new URL(req.url ?? '/', 'http://localhost');
+            if (url.pathname === '/' && req.method === 'GET') {
+                const fromQuery = url.searchParams.get('token');
+                if (tokenMatches(fromQuery)) {
+                    res.writeHead(303, {
+                        location: '/',
+                        'set-cookie': `${cookieName()}=${token}; HttpOnly; SameSite=Strict; Path=/`,
+                    });
+                    return void res.end();
+                }
+                if (!tokenMatches(cookie(req)))
+                    return sendHtml(res, 401, LOCKED_PAGE);
+                return sendHtml(res, 200, page);
+            }
+            const route = routes[`${req.method} ${url.pathname}`];
+            if (!route)
+                return sendJson(res, 404, { error: 'Not found' });
+            if (!tokenMatches(cookie(req))) {
+                return sendJson(res, 401, { error: 'Session expired: open the link printed in the terminal again.' });
+            }
+            if (req.method === 'POST' && !req.headers['content-type']?.startsWith('application/json')) {
+                return sendJson(res, 415, { error: 'Expected application/json' });
+            }
+            await route(req, res);
+        }
+        catch (err) {
+            if (res.headersSent)
+                return void res.end();
+            const status = err instanceof ConfigError ? 400 : err instanceof ApiError ? 502 : 500;
+            sendJson(res, status, serializeError(err));
+        }
+    });
+    await new Promise((resolve, reject) => {
+        server.once('error', reject);
+        server.listen(opts.port ?? 4545, '127.0.0.1', () => resolve());
+    });
+    port = server.address().port;
+    return {
+        url: `http://127.0.0.1:${port}/?token=${token}`,
+        port,
+        close: () => new Promise((resolve, reject) => {
+            server.closeAllConnections();
+            server.close((err) => (err ? reject(err) : resolve()));
+        }),
+    };
+}
+export function parseSetupRequest(input, { requireDns = true } = {}) {
+    if (!input || typeof input !== 'object')
+        throw new ConfigError('Expected a JSON object.');
+    const body = input;
+    const domain = typeof body.domain === 'string' ? normalizeName(body.domain) : '';
+    if (!isValidDomain(domain))
+        throw new ConfigError('Enter a valid domain, like example.com.');
+    if (requireDns && typeof body.dns !== 'string')
+        throw new ConfigError('Choose a DNS provider.');
+    const emailProvider = typeof body.emailProvider === 'string' && body.emailProvider ? body.emailProvider : 'sendgrid';
+    if (!isEmailProvider(emailProvider))
+        throw new ConfigError(`Email provider must be one of: ${EMAIL_PROVIDERS.join(', ')}.`);
+    let inbound;
+    if (body.inbound) {
+        const url = String(body.inbound.url ?? '');
+        if (!/^https:\/\/[^\s]+$/.test(url))
+            throw new ConfigError('The inbound webhook URL must start with https://.');
+        const hostname = body.inbound.hostname ? normalizeName(String(body.inbound.hostname)) : undefined;
+        if (hostname && !isValidDomain(hostname))
+            throw new ConfigError('Enter a valid inbound hostname.');
+        inbound = { url, hostname, spamCheck: Boolean(body.inbound.spamCheck), sendRaw: Boolean(body.inbound.sendRaw) };
+    }
+    const waitSeconds = body.waitSeconds === undefined ? undefined : Number(body.waitSeconds);
+    if (waitSeconds !== undefined && !(waitSeconds >= 0 && waitSeconds <= 3600)) {
+        throw new ConfigError('Wait time must be between 0 and 3600 seconds.');
+    }
+    const credentials = {};
+    for (const [k, v] of Object.entries(body.credentials ?? {})) {
+        if (typeof v === 'string' && v.trim())
+            credentials[k] = v.trim();
+    }
+    return {
+        domain,
+        subdomain: typeof body.subdomain === 'string' && body.subdomain.trim() ? body.subdomain.trim() : undefined,
+        dns: String(body.dns ?? 'manual'),
+        emailProvider,
+        onBehalfOf: typeof body.onBehalfOf === 'string' ? body.onBehalfOf.trim() : undefined,
+        credentials,
+        inbound,
+        overwrite: Boolean(body.overwrite),
+        waitSeconds,
+    };
+}
+function serializeError(err) {
+    if (err instanceof DnsConflictError)
+        return { kind: 'conflict', error: err.message, conflicts: err.conflicts };
+    if (err instanceof ApiError) {
+        return { kind: 'api', error: err.message, provider: err.provider, status: err.status, hint: apiErrorHint(err) };
+    }
+    if (err instanceof ConfigError)
+        return { kind: 'config', error: err.message };
+    return { kind: 'error', error: err instanceof Error ? err.message : String(err) };
+}
+async function readJson(req) {
+    const chunks = [];
+    let size = 0;
+    for await (const chunk of req) {
+        size += chunk.length;
+        if (size > MAX_BODY_BYTES)
+            throw new ConfigError('Request body too large.');
+        chunks.push(chunk);
+    }
+    try {
+        return JSON.parse(Buffer.concat(chunks).toString('utf8'));
+    }
+    catch {
+        throw new ConfigError('Request body is not valid JSON.');
+    }
+}
+function sendJson(res, status, body) {
+    res.writeHead(status, { 'content-type': 'application/json; charset=utf-8', 'cache-control': 'no-store' });
+    res.end(JSON.stringify(body));
+}
+function sendText(res, status, text) {
+    res.writeHead(status, { 'content-type': 'text/plain; charset=utf-8' });
+    res.end(text);
+}
+function sendHtml(res, status, html) {
+    res.writeHead(status, {
+        'content-type': 'text/html; charset=utf-8',
+        'cache-control': 'no-store',
+        'content-security-policy': "default-src 'self'; script-src 'unsafe-inline'; style-src 'unsafe-inline'; img-src 'self' data:; frame-ancestors 'none'",
+        'referrer-policy': 'no-referrer',
+    });
+    res.end(html);
+}
+const LOCKED_PAGE = `<!doctype html><meta charset="utf-8"><title>DKIMkit</title>
+<body style="font:16px system-ui;max-width:32rem;margin:15vh auto;padding:0 16px;color:#333">
+<h1 style="font-size:1.25rem">Open the link from your terminal</h1>
+<p>For security, this page only opens from the one-time link printed by <code>dkimkit ui</code>.</p></body>`;
+//# sourceMappingURL=server.js.map

package/dist/src/server.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"server.js","sourceRoot":"","sources":["../../src/server.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,WAAW,EAAE,eAAe,EAAE,MAAM,aAAa,CAAC;AAC3D,OAAO,EAAE,UAAU,EAAE,MAAM,SAAS,CAAC;AACrC,OAAO,EAAE,QAAQ,EAAE,MAAM,kBAAkB,CAAC;AAC5C,OAAO,EAAE,YAAY,EAA6C,MAAM,WAAW,CAAC;AAEpF,OAAO,EAAE,OAAO,EAAE,MAAM,SAAS,CAAC;AAClC,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AACjC,OAAO,EAAE,QAAQ,EAAE,YAAY,EAAE,WAAW,EAAE,gBAAgB,EAAE,MAAM,aAAa,CAAC;AACpF,OAAO,EAAE,WAAW,EAAE,WAAW,EAAqB,MAAM,mBAAmB,CAAC;AAChF,OAAO,EAAE,kBAAkB,EAAE,MAAM,wBAAwB,CAAC;AAC5D,OAAO,EAAE,mBAAmB,EAAE,eAAe,EAAE,eAAe,EAAyB,MAAM,8BAA8B,CAAC;AAC5H,OAAO,EAAE,iBAAiB,EAAE,aAAa,EAAE,MAAM,wBAAwB,CAAC;AAC1E,OAAO,EAAE,aAAa,EAAE,aAAa,EAAE,MAAM,cAAc,CAAC;AAkD5D,MAAM,cAAc,GAAG,EAAE,GAAG,IAAI,CAAC;AACjC,MAAM,IAAI,GAAG,IAAI,GAAG,CAAC,sBAAsB,EAAE,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;AAE9D;;;;;GAKG;AACH,MAAM,CAAC,KAAK,UAAU,aAAa,CAAC,OAAwB,EAAE;IAC5D,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,IAAI,OAAO,CAAC,GAAG,CAAC;IACpC,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,IAAI,WAAW,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;IAClE,MAAM,IAAI,GAAG,MAAM,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;IAC1C,IAAI,IAAI,GAAG,CAAC,CAAC;IACb,MAAM,UAAU,GAAG,GAAG,EAAE,CAAC,WAAW,IAAI,EAAE,CAAC;IAE3C,MAAM,YAAY,GAAG,CAAC,SAAoC,EAAE,EAAE;QAC5D,IAAI,CAAC,SAAS;YAAE,OAAO,KAAK,CAAC;QAC7B,MAAM,CAAC,GAAG,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;QACjC,MAAM,CAAC,GAAG,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QAC7B,OAAO,CAAC,CAAC,MAAM,KAAK,CAAC,CAAC,MAAM,IAAI,eAAe,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;IACxD,CAAC,CAAC;IACF,MAAM,WAAW,GAAG,CAAC,IAAwB,EAAE,EAAE,CAC/C,IAAI,KAAK,aAAa,IAAI,EAAE,IAAI,IAAI,KAAK,aAAa,IAAI,EAAE,IAAI,IAAI,KAAK,SAAS,IAAI,EAAE,CAAC;IAC3F,MAAM,MAAM,GAAG,CAAC,GAAoB,EAAE,EAAE,CACtC,GAAG,CAAC,OAAO,CAAC,MAAM;QAChB,EAAE,KAAK,CAAC,GAAG,CAAC;SACX,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;SAC/B,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,KAAK,UAAU,EAAE,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;IAE5C,MAAM,cAAc,GAClB,IAAI,CAAC,SAAS;QACd,CAAC,KAAK,EAAE,GAAiB,EAAE,EAAE;YAC3B,MAAM,CAAC,GAAG,GAAG,CAAC,WAAW,IAAI,EAAE,CAAC;YAChC,MAAM,QAAQ,GAAG,GAAG,CAAC,aAAa,IAAI,UAAU,CAAC;YACjD,IAAI,WAA6B,CAAC;YAClC,QAAQ,QAAQ,EAAE,CAAC;gBACjB,KAAK,UAAU;oBACb,WAAW,GAAG,EAAE,YAAY,EAAE,CAAC,CAAC,oBAAoB,IAAI,GAAG,CAAC,sBAAsB,EAAE,eAAe,EAAE,CAAC,CAAC,uBAAuB,IAAI,GAAG,CAAC,0BAA0B,EAAE,CAAC;oBACnK,MAAM;gBACR,KAAK,SAAS;oBACZ,WAAW,GAAG,EAAE,MAAM,EAAE,CAAC,CAAC,aAAa,IAAI,GAAG,CAAC,eAAe,EAAE,MAAM,EAAE,CAAC,CAAC,aAAa,IAAI,GAAG,CAAC,cAAc,IAAI,IAAI,EAAE,CAAC;oBACxH,MAAM;gBACR,KAAK,KAAK,CAAC,CAAC,CAAC;oBACX,MAAM,GAAG,GACP,CAAC,CAAC,cAAc,IAAI,CAAC,CAAC,kBAAkB;wBACtC,CAAC,CAAC,EAAE,WAAW,EAAE,CAAC,CAAC,cAAc,EAAE,eAAe,EAAE,CAAC,CAAC,kBAAkB,EAAE,YAAY,EAAE,CAAC,CAAC,eAAe,EAAE;wBAC3G,CAAC,CAAC,MAAM,kBAAkB,CAAC,EAAE,OAAO,EAAE,CAAC,CAAC,UAAU,EAAE,GAAG,EAAE,CAAC,CAAC;oBAC/D,WAAW,GAAG,EAAE,GAAG,GAAG,EAAE,MAAM,EAAE,CAAC,CAAC,SAAS,IAAI,GAAG,CAAC,UAAU,IAAI,GAAG,CAAC,kBAAkB,EAAE,CAAC;oBAC1F,MAAM;gBACR,CAAC;gBACD;oBACE,WAAW,GAAG,EAAE,MAAM,EAAE,CAAC,CAAC,cAAc,IAAI,GAAG,CAAC,gBAAgB,EAAE,CAAC;YACvE,CAAC;YACD,OAAO;gBACL,KAAK,EAAE,mBAAmB,CAAC,QAAQ,EAAE,WAAW,EAAE,EAAE,OAAO,EAAE,GAAG,CAAC,UAAU,IAAI,SAAS,EAAE,CAAC;gBAC3F,GAAG,EAAE,iBAAiB,CAAC,GAAG,CAAC,GAAG,EAAE;oBAC9B,kBAAkB,EAAE,CAAC,CAAC,kBAAkB;oBACxC,GAAG,EAAE,EAAE,WAAW,EAAE,CAAC,CAAC,cAAc,EAAE,eAAe,EAAE,CAAC,CAAC,kBAAkB,EAAE,YAAY,EAAE,CAAC,CAAC,eAAe,EAAE;oBAC9G,UAAU,EAAE,CAAC,CAAC,UAAU;oBACxB,mBAAmB,EAAE,CAAC,CAAC,mBAAmB;oBAC1C,GAAG;iBACJ,CAAC;aACH,CAAC;QACJ,CAAC,CAAC,CAAC;IAEL,MAAM,UAAU,GAAG,CAAC,GAAiB,EAAE,KAAoB,EAAgB,EAAE;QAC3E,IAAI,GAAG,CAAC,OAAO,IAAI,CAAC,KAAK,CAAC,eAAe;YAAE,MAAM,IAAI,WAAW,CAAC,wCAAwC,KAAK,CAAC,KAAK,OAAO,CAAC,CAAC;QAC7H,OAAO;YACP,MAAM,EAAE,GAAG,CAAC,MAAM;YAClB,SAAS,EAAE,GAAG,CAAC,SAAS;YACxB,SAAS,EAAE,GAAG,CAAC,SAAS;YACxB,OAAO,EAAE,GAAG,CAAC,OAAO,IAAI;gBACtB,QAAQ,EAAE,GAAG,CAAC,OAAO,CAAC,QAAQ,IAAI,KAAK,CAAC,sBAAsB,CAAC,GAAG,CAAC,MAAM,CAAC;gBAC1E,GAAG,EAAE,GAAG,CAAC,OAAO,CAAC,GAAG;gBACpB,SAAS,EAAE,GAAG,CAAC,OAAO,CAAC,SAAS;gBAChC,OAAO,EAAE,GAAG,CAAC,OAAO,CAAC,OAAO;aAC7B;YACD,GAAG,IAAI,CAAC,aAAa;YACrB,WAAW,EAAE,EAAE,SAAS,EAAE,CAAC,GAAG,CAAC,WAAW,IAAI,GAAG,CAAC,GAAG,IAAI,EAAE,GAAG,IAAI,CAAC,aAAa,EAAE,WAAW,EAAE;SAC9F,CAAC;IACJ,CAAC,CAAC;IAEF,MAAM,MAAM,GAAiF;QAC3F,iBAAiB,EAAE,KAAK,EAAE,IAAI,EAAE,GAAG,EAAE,EAAE;YACrC,MAAM,OAAO,GAAG,GAAG,CAAC,2BAA2B,IAAI,IAAI,CAAC,OAAO,EAAE,EAAE,MAAM,EAAE,aAAa,CAAC,CAAC;YAC1F,QAAQ,CAAC,GAAG,EAAE,GAAG,EAAE;gBACjB,OAAO,EAAE,IAAI,CAAC,OAAO;gBACrB,SAAS,EAAE,aAAa;gBACxB,cAAc,EAAE,eAAe;gBAC/B,GAAG,EAAE;oBACH,QAAQ,EAAE,OAAO,CAAC,GAAG,CAAC,gBAAgB,CAAC;oBACvC,QAAQ,EAAE,OAAO,CAAC,GAAG,CAAC,sBAAsB,CAAC;oBAC7C,OAAO,EAAE,OAAO,CAAC,GAAG,CAAC,eAAe,CAAC;oBACrC,SAAS,EAAE,GAAG,CAAC,UAAU,IAAI,GAAG,CAAC,kBAAkB,IAAI,IAAI;oBAC3D,UAAU,EAAE,OAAO,CAAC,GAAG,CAAC,oBAAoB,CAAC;oBAC7C,GAAG,EAAE,OAAO,CAAC,GAAG,CAAC,iBAAiB,IAAI,GAAG,CAAC,qBAAqB,CAAC,IAAI,UAAU,CAAC,OAAO,CAAC;iBACxF;aACF,CAAC,CAAC;QACL,CAAC;QAED,gBAAgB,EAAE,KAAK,EAAE,GAAG,EAAE,GAAG,EAAE,EAAE;YACnC,MAAM,IAAI,GAAG,iBAAiB,CAAC,MAAM,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC;YACpD,MAAM,EAAE,KAAK,EAAE,GAAG,EAAE,GAAG,MAAM,cAAc,CAAC,IAAI,CAAC,CAAC;YAClD,IAAI,MAAwC,CAAC;YAC7C,IAAI,OAAO,GAAoB,EAAE,CAAC;YAClC,IAAI,CAAC;gBACH,MAAM,WAAW,CAAC,KAAK,EAAE,GAAG,EAAE;oBAC5B,GAAG,UAAU,CAAC,IAAI,EAAE,KAAK,CAAC;oBAC1B,MAAM,EAAE,IAAI;oBACZ,OAAO,EAAE,CAAC,CAAC,EAAE,EAAE;wBACb,IAAI,CAAC,CAAC,IAAI,KAAK,QAAQ;4BAAE,MAAM,GAAG,CAAC,CAAC,IAAI,CAAC;wBACzC,IAAI,CAAC,CAAC,IAAI,KAAK,MAAM;4BAAE,OAAO,GAAG,CAAC,CAAC,OAAO,CAAC;oBAC7C,CAAC;iBACF,CAAC,CAAC;YACL,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACb,IAAI,CAAC,CAAC,GAAG,YAAY,gBAAgB,CAAC;oBAAE,MAAM,GAAG,CAAC;YACpD,CAAC;YACD,QAAQ,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,MAAM,EAAE,OAAO,EAAE,SAAS,EAAE,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,KAAK,UAAU,CAAC,EAAE,CAAC,CAAC;QACnG,CAAC;QAED,iBAAiB,EAAE,KAAK,EAAE,GAAG,EAAE,GAAG,EAAE,EAAE;YACpC,MAAM,IAAI,GAAG,iBAAiB,CAAC,MAAM,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC;YACpD,MAAM,EAAE,KAAK,EAAE,GAAG,EAAE,GAAG,MAAM,cAAc,CAAC,IAAI,CAAC,CAAC;YAClD,MAAM,UAAU,GAAG,IAAI,eAAe,EAAE,CAAC;YACzC,GAAG,CAAC,EAAE,CAAC,OAAO,EAAE,GAAG,EAAE;gBACnB,IAAI,CAAC,GAAG,CAAC,gBAAgB;oBAAE,UAAU,CAAC,KAAK,EAAE,CAAC;YAChD,CAAC,CAAC,CAAC;YACH,GAAG,CAAC,SAAS,CAAC,GAAG,EAAE,EAAE,cAAc,EAAE,qCAAqC,EAAE,eAAe,EAAE,UAAU,EAAE,CAAC,CAAC;YAC3G,MAAM,KAAK,GAAG,CAAC,IAAa,EAAE,EAAE,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,GAAG,IAAI,CAAC,CAAC;YACxE,IAAI,CAAC;gBACH,MAAM,MAAM,GAAG,MAAM,WAAW,CAAC,KAAK,EAAE,GAAG,EAAE;oBAC3C,GAAG,UAAU,CAAC,IAAI,EAAE,KAAK,CAAC;oBAC1B,OAAO,EAAE,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,EAAE,IAAI,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC;oBACnD,MAAM,EAAE,UAAU,CAAC,MAAM;iBAC1B,CAAC,CAAC;gBACH,KAAK,CAAC,EAAE,IAAI,EAAE,QAAQ,EAAE,MAAM,EAAE,CAAC,CAAC;YACpC,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACb,IAAI,CAAC,UAAU,CAAC,MAAM,CAAC,OAAO;oBAAE,KAAK,CAAC,EAAE,IAAI,EAAE,OAAO,EAAE,GAAG,cAAc,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;YACnF,CAAC;oBAAS,CAAC;gBACT,GAAG,CAAC,GAAG,EAAE,CAAC;YACZ,CAAC;QACH,CAAC;QAED,kBAAkB,EAAE,KAAK,EAAE,GAAG,EAAE,GAAG,EAAE,EAAE;YACrC,MAAM,IAAI,GAAG,iBAAiB,CAAC,MAAM,QAAQ,CAAC,GAAG,CAAC,EAAE,EAAE,UAAU,EAAE,KAAK,EAAE,CAAC,CAAC;YAC3E,MAAM,EAAE,KAAK,EAAE,GAAG,MAAM,cAAc,CAAC,EAAE,GAAG,IAAI,EAAE,GAAG,EAAE,QAAQ,EAAE,CAAC,CAAC;YACnE,QAAQ,CAAC,GAAG,EAAE,GAAG,EAAE,MAAM,WAAW,CAAC,KAAK,EAAE,IAAI,CAAC,MAAM,EAAE,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC;QAC5E,CAAC;KACF,CAAC;IAEF,MAAM,MAAM,GAAG,YAAY,CAAC,KAAK,EAAE,GAAG,EAAE,GAAG,EAAE,EAAE;QAC7C,IAAI,CAAC;YACH,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,OAAO,CAAC,IAAI,CAAC;gBAAE,OAAO,QAAQ,CAAC,GAAG,EAAE,GAAG,EAAE,gBAAgB,CAAC,CAAC;YAChF,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,GAAG,IAAI,GAAG,EAAE,kBAAkB,CAAC,CAAC;YAExD,IAAI,GAAG,CAAC,QAAQ,KAAK,GAAG,IAAI,GAAG,CAAC,MAAM,KAAK,KAAK,EAAE,CAAC;gBACjD,MAAM,SAAS,GAAG,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;gBAChD,IAAI,YAAY,CAAC,SAAS,CAAC,EAAE,CAAC;oBAC5B,GAAG,CAAC,SAAS,CAAC,GAAG,EAAE;wBACjB,QAAQ,EAAE,GAAG;wBACb,YAAY,EAAE,GAAG,UAAU,EAAE,IAAI,KAAK,qCAAqC;qBAC5E,CAAC,CAAC;oBACH,OAAO,KAAK,GAAG,CAAC,GAAG,EAAE,CAAC;gBACxB,CAAC;gBACD,IAAI,CAAC,YAAY,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;oBAAE,OAAO,QAAQ,CAAC,GAAG,EAAE,GAAG,EAAE,WAAW,CAAC,CAAC;gBACvE,OAAO,QAAQ,CAAC,GAAG,EAAE,GAAG,EAAE,IAAI,CAAC,CAAC;YAClC,CAAC;YAED,MAAM,KAAK,GAAG,MAAM,CAAC,GAAG,GAAG,CAAC,MAAM,IAAI,GAAG,CAAC,QAAQ,EAAE,CAAC,CAAC;YACtD,IAAI,CAAC,KAAK;gBAAE,OAAO,QAAQ,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,KAAK,EAAE,WAAW,EAAE,CAAC,CAAC;YAC9D,IAAI,CAAC,YAAY,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,EAAE,CAAC;gBAC/B,OAAO,QAAQ,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,KAAK,EAAE,+DAA+D,EAAE,CAAC,CAAC;YACxG,CAAC;YACD,IAAI,GAAG,CAAC,MAAM,KAAK,MAAM,IAAI,CAAC,GAAG,CAAC,OAAO,CAAC,cAAc,CAAC,EAAE,UAAU,CAAC,kBAAkB,CAAC,EAAE,CAAC;gBAC1F,OAAO,QAAQ,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,KAAK,EAAE,2BAA2B,EAAE,CAAC,CAAC;YACpE,CAAC;YACD,MAAM,KAAK,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;QACxB,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,IAAI,GAAG,CAAC,WAAW;gBAAE,OAAO,KAAK,GAAG,CAAC,GAAG,EAAE,CAAC;YAC3C,MAAM,MAAM,GAAG,GAAG,YAAY,WAAW,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,YAAY,QAAQ,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC;YACtF,QAAQ,CAAC,GAAG,EAAE,MAAM,EAAE,cAAc,CAAC,GAAG,CAAC,CAAC,CAAC;QAC7C,CAAC;IACH,CAAC,CAAC,CAAC;IAEH,MAAM,IAAI,OAAO,CAAO,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;QAC1C,MAAM,CAAC,IAAI,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;QAC7B,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,IAAI,IAAI,EAAE,WAAW,EAAE,GAAG,EAAE,CAAC,OAAO,EAAE,CAAC,CAAC;IACjE,CAAC,CAAC,CAAC;IACH,IAAI,GAAI,MAAM,CAAC,OAAO,EAAkB,CAAC,IAAI,CAAC;IAE9C,OAAO;QACL,GAAG,EAAE,oBAAoB,IAAI,WAAW,KAAK,EAAE;QAC/C,IAAI;QACJ,KAAK,EAAE,GAAG,EAAE,CACV,IAAI,OAAO,CAAO,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;YACpC,MAAM,CAAC,mBAAmB,EAAE,CAAC;YAC7B,MAAM,CAAC,KAAK,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC;QACzD,CAAC,CAAC;KACL,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,iBAAiB,CAAC,KAAc,EAAE,EAAE,UAAU,GAAG,IAAI,EAAE,GAAG,EAAE;IAC1E,IAAI,CAAC,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ;QAAE,MAAM,IAAI,WAAW,CAAC,yBAAyB,CAAC,CAAC;IAC1F,MAAM,IAAI,GAAG,KAA4B,CAAC;IAC1C,MAAM,MAAM,GAAG,OAAO,IAAI,CAAC,MAAM,KAAK,QAAQ,CAAC,CAAC,CAAC,aAAa,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;IACjF,IAAI,CAAC,aAAa,CAAC,MAAM,CAAC;QAAE,MAAM,IAAI,WAAW,CAAC,yCAAyC,CAAC,CAAC;IAC7F,IAAI,UAAU,IAAI,OAAO,IAAI,CAAC,GAAG,KAAK,QAAQ;QAAE,MAAM,IAAI,WAAW,CAAC,wBAAwB,CAAC,CAAC;IAChG,MAAM,aAAa,GAAG,OAAO,IAAI,CAAC,aAAa,KAAK,QAAQ,IAAI,IAAI,CAAC,aAAa,CAAC,CAAC,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC,CAAC,UAAU,CAAC;IACrH,IAAI,CAAC,eAAe,CAAC,aAAa,CAAC;QAAE,MAAM,IAAI,WAAW,CAAC,kCAAkC,eAAe,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IAE5H,IAAI,OAAgC,CAAC;IACrC,IAAI,IAAI,CAAC,OAAO,EAAE,CAAC;QACjB,MAAM,GAAG,GAAG,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,GAAG,IAAI,EAAE,CAAC,CAAC;QAC3C,IAAI,CAAC,oBAAoB,CAAC,IAAI,CAAC,GAAG,CAAC;YAAE,MAAM,IAAI,WAAW,CAAC,mDAAmD,CAAC,CAAC;QAChH,MAAM,QAAQ,GAAG,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC,CAAC,aAAa,CAAC,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;QAClG,IAAI,QAAQ,IAAI,CAAC,aAAa,CAAC,QAAQ,CAAC;YAAE,MAAM,IAAI,WAAW,CAAC,iCAAiC,CAAC,CAAC;QACnG,OAAO,GAAG,EAAE,GAAG,EAAE,QAAQ,EAAE,SAAS,EAAE,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,SAAS,CAAC,EAAE,OAAO,EAAE,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,EAAE,CAAC;IAClH,CAAC;IAED,MAAM,WAAW,GAAG,IAAI,CAAC,WAAW,KAAK,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC;IAC1F,IAAI,WAAW,KAAK,SAAS,IAAI,CAAC,CAAC,WAAW,IAAI,CAAC,IAAI,WAAW,IAAI,IAAI,CAAC,EAAE,CAAC;QAC5E,MAAM,IAAI,WAAW,CAAC,+CAA+C,CAAC,CAAC;IACzE,CAAC;IAED,MAAM,WAAW,GAA6C,EAAE,CAAC;IACjE,KAAK,MAAM,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,WAAW,IAAI,EAAE,CAAC,EAAE,CAAC;QAC5D,IAAI,OAAO,CAAC,KAAK,QAAQ,IAAI,CAAC,CAAC,IAAI,EAAE;YAAE,WAAW,CAAC,CAA6B,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,CAAC;IAC/F,CAAC;IAED,OAAO;QACL,MAAM;QACN,SAAS,EAAE,OAAO,IAAI,CAAC,SAAS,KAAK,QAAQ,IAAI,IAAI,CAAC,SAAS,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,SAAS;QAC1G,GAAG,EAAE,MAAM,CAAC,IAAI,CAAC,GAAG,IAAI,QAAQ,CAAC;QACjC,aAAa;QACb,UAAU,EAAE,OAAO,IAAI,CAAC,UAAU,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,UAAU,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,SAAS;QACpF,WAAW;QACX,OAAO;QACP,SAAS,EAAE,OAAO,CAAC,IAAI,CAAC,SAAS,CAAC;QAClC,WAAW;KACZ,CAAC;AACJ,CAAC;AAED,SAAS,cAAc,CAAC,GAAY;IAClC,IAAI,GAAG,YAAY,gBAAgB;QAAE,OAAO,EAAE,IAAI,EAAE,UAAU,EAAE,KAAK,EAAE,GAAG,CAAC,OAAO,EAAE,SAAS,EAAE,GAAG,CAAC,SAAS,EAAE,CAAC;IAC/G,IAAI,GAAG,YAAY,QAAQ,EAAE,CAAC;QAC5B,OAAO,EAAE,IAAI,EAAE,KAAK,EAAE,KAAK,EAAE,GAAG,CAAC,OAAO,EAAE,QAAQ,EAAE,GAAG,CAAC,QAAQ,EAAE,MAAM,EAAE,GAAG,CAAC,MAAM,EAAE,IAAI,EAAE,YAAY,CAAC,GAAG,CAAC,EAAE,CAAC;IAClH,CAAC;IACD,IAAI,GAAG,YAAY,WAAW;QAAE,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,KAAK,EAAE,GAAG,CAAC,OAAO,EAAE,CAAC;IAC9E,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,KAAK,EAAE,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC;AACpF,CAAC;AAED,KAAK,UAAU,QAAQ,CAAC,GAAoB;IAC1C,MAAM,MAAM,GAAa,EAAE,CAAC;IAC5B,IAAI,IAAI,GAAG,CAAC,CAAC;IACb,IAAI,KAAK,EAAE,MAAM,KAAK,IAAI,GAAG,EAAE,CAAC;QAC9B,IAAI,IAAK,KAAgB,CAAC,MAAM,CAAC;QACjC,IAAI,IAAI,GAAG,cAAc;YAAE,MAAM,IAAI,WAAW,CAAC,yBAAyB,CAAC,CAAC;QAC5E,MAAM,CAAC,IAAI,CAAC,KAAe,CAAC,CAAC;IAC/B,CAAC;IACD,IAAI,CAAC;QACH,OAAO,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC;IAC5D,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,IAAI,WAAW,CAAC,iCAAiC,CAAC,CAAC;IAC3D,CAAC;AACH,CAAC;AAED,SAAS,QAAQ,CAAC,GAAmB,EAAE,MAAc,EAAE,IAAa;IAClE,GAAG,CAAC,SAAS,CAAC,MAAM,EAAE,EAAE,cAAc,EAAE,iCAAiC,EAAE,eAAe,EAAE,UAAU,EAAE,CAAC,CAAC;IAC1G,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC;AAChC,CAAC;AAED,SAAS,QAAQ,CAAC,GAAmB,EAAE,MAAc,EAAE,IAAY;IACjE,GAAG,CAAC,SAAS,CAAC,MAAM,EAAE,EAAE,cAAc,EAAE,2BAA2B,EAAE,CAAC,CAAC;IACvE,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;AAChB,CAAC;AAED,SAAS,QAAQ,CAAC,GAAmB,EAAE,MAAc,EAAE,IAAY;IACjE,GAAG,CAAC,SAAS,CAAC,MAAM,EAAE;QACpB,cAAc,EAAE,0BAA0B;QAC1C,eAAe,EAAE,UAAU;QAC3B,yBAAyB,EACvB,yHAAyH;QAC3H,iBAAiB,EAAE,aAAa;KACjC,CAAC,CAAC;IACH,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;AAChB,CAAC;AAED,MAAM,WAAW,GAAG;;;4GAGwF,CAAC"}

package/dist/src/types.d.ts

@@ -0,0 +1,75 @@
+export type RecordType = 'CNAME' | 'TXT' | 'MX';
+export interface DnsRecord {
+    type: RecordType;
+    /** Fully qualified name, lowercase, no trailing dot. */
+    name: string;
+    value: string;
+    /** MX only. */
+    priority?: number;
+    /** What the record is for (e.g. "dkim1", "inbound_mx"). Display only. */
+    purpose?: string;
+    /** Guidance for people adding it by hand (e.g. merging into an existing SPF record). */
+    note?: string;
+}
+export interface DomainAuthentication {
+    id: string;
+    domain: string;
+    valid: boolean;
+    records: DnsRecord[];
+    /** True when this run created it, false when an existing one was reused. */
+    created: boolean;
+}
+export interface RecordValidation {
+    record: string;
+    valid: boolean;
+    reason?: string;
+}
+export interface ValidationResult {
+    valid: boolean;
+    results: RecordValidation[];
+}
+export interface InboundParseOptions {
+    hostname: string;
+    url: string;
+    spamCheck?: boolean;
+    sendRaw?: boolean;
+}
+export type InboundAction = 'created' | 'updated' | 'unchanged';
+/** An email service provider (SendGrid, Postmark, Mailgun, Amazon SES) that issues DNS records for a sending domain. */
+export interface EmailProvider {
+    readonly name: string;
+    /** Human-readable name, e.g. "Amazon SES". */
+    readonly label: string;
+    /** Whether inbound email (receiving and forwarding to a webhook) is supported. */
+    readonly supportsInbound: boolean;
+    /** Where inbound mail is received when the caller doesn't choose (e.g. parse.<domain>). */
+    defaultInboundHostname(domain: string): string;
+    findDomain(domain: string, subdomain?: string): Promise<DomainAuthentication | null>;
+    /** Returns the existing authentication for the domain, or creates one. */
+    ensureDomain(domain: string, opts?: {
+        subdomain?: string;
+    }): Promise<DomainAuthentication>;
+    getDomain(id: string): Promise<DomainAuthentication>;
+    deleteDomain(id: string): Promise<void>;
+    validateDomain(id: string): Promise<ValidationResult>;
+    /** DNS records needed to route inbound mail for `hostname` to the provider. */
+    inboundRecords(hostname: string): DnsRecord[];
+    ensureInboundParse(opts: InboundParseOptions): Promise<InboundAction>;
+    deleteInboundParse(hostname: string): Promise<void>;
+}
+export type ChangeAction = 'create' | 'update' | 'noop' | 'conflict';
+export interface PlannedChange {
+    record: DnsRecord;
+    action: ChangeAction;
+    /** Provider record id to update, for `update`. */
+    existingId?: string;
+    reason?: string;
+}
+/** A DNS host that can write records. */
+export interface DnsProvider {
+    readonly name: string;
+    plan(records: DnsRecord[], opts?: {
+        overwrite?: boolean;
+    }): Promise<PlannedChange[]>;
+    apply(changes: PlannedChange[]): Promise<void>;
+}

package/dist/src/types.js

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=types.js.map

package/dist/src/types.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.js","sourceRoot":"","sources":["../../src/types.ts"],"names":[],"mappings":""}

package/dist/src/xml.d.ts

@@ -0,0 +1,6 @@
+/** Inner content of every `<tag>…</tag>`. Assumes the tag doesn't nest inside itself. */
+export declare function xmlTags(xml: string, tag: string): string[];
+/** Decoded text of the first `<tag>`, if present. */
+export declare function xmlText(xml: string, tag: string): string | undefined;
+export declare function decodeXml(s: string): string;
+export declare function encodeXml(s: string): string;

package/dist/src/xml.js

@@ -0,0 +1,23 @@
+// Just enough XML for the flat, well-known shapes of the Route53 API.
+/** Inner content of every `<tag>…</tag>`. Assumes the tag doesn't nest inside itself. */
+export function xmlTags(xml, tag) {
+    const re = new RegExp(`<${tag}(?:\\s[^>]*)?>([\\s\\S]*?)</${tag}>`, 'g');
+    return [...xml.matchAll(re)].map((m) => m[1]);
+}
+/** Decoded text of the first `<tag>`, if present. */
+export function xmlText(xml, tag) {
+    const inner = xmlTags(xml, tag)[0];
+    return inner === undefined ? undefined : decodeXml(inner.trim());
+}
+const ENTITIES = { amp: '&', lt: '<', gt: '>', quot: '"', apos: "'" };
+export function decodeXml(s) {
+    return s.replace(/&(#x[0-9a-f]+|#\d+|\w+);/gi, (m, e) => {
+        if (e[0] === '#')
+            return String.fromCodePoint(e[1] === 'x' || e[1] === 'X' ? parseInt(e.slice(2), 16) : Number(e.slice(1)));
+        return ENTITIES[e] ?? m;
+    });
+}
+export function encodeXml(s) {
+    return s.replace(/&/g, '&amp;').replace(/</g, '&lt;').replace(/>/g, '&gt;').replace(/"/g, '&quot;').replace(/'/g, '&apos;');
+}
+//# sourceMappingURL=xml.js.map

package/dist/src/xml.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"xml.js","sourceRoot":"","sources":["../../src/xml.ts"],"names":[],"mappings":"AAAA,sEAAsE;AAEtE,yFAAyF;AACzF,MAAM,UAAU,OAAO,CAAC,GAAW,EAAE,GAAW;IAC9C,MAAM,EAAE,GAAG,IAAI,MAAM,CAAC,IAAI,GAAG,+BAA+B,GAAG,GAAG,EAAE,GAAG,CAAC,CAAC;IACzE,OAAO,CAAC,GAAG,GAAG,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,CAAE,CAAC,CAAC;AACjD,CAAC;AAED,qDAAqD;AACrD,MAAM,UAAU,OAAO,CAAC,GAAW,EAAE,GAAW;IAC9C,MAAM,KAAK,GAAG,OAAO,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;IACnC,OAAO,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC;AACnE,CAAC;AAED,MAAM,QAAQ,GAA2B,EAAE,GAAG,EAAE,GAAG,EAAE,EAAE,EAAE,GAAG,EAAE,EAAE,EAAE,GAAG,EAAE,IAAI,EAAE,GAAG,EAAE,IAAI,EAAE,GAAG,EAAE,CAAC;AAE9F,MAAM,UAAU,SAAS,CAAC,CAAS;IACjC,OAAO,CAAC,CAAC,OAAO,CAAC,4BAA4B,EAAE,CAAC,CAAC,EAAE,CAAS,EAAE,EAAE;QAC9D,IAAI,CAAC,CAAC,CAAC,CAAC,KAAK,GAAG;YAAE,OAAO,MAAM,CAAC,aAAa,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,GAAG,IAAI,CAAC,CAAC,CAAC,CAAC,KAAK,GAAG,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;QAC5H,OAAO,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;IAC1B,CAAC,CAAC,CAAC;AACL,CAAC;AAED,MAAM,UAAU,SAAS,CAAC,CAAS;IACjC,OAAO,CAAC,CAAC,OAAO,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC,OAAO,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC,OAAO,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC,OAAO,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAC,OAAO,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAC;AAC9H,CAAC"}

package/docs/billing.md

@@ -0,0 +1,43 @@
+# Plans and billing
+
+Start free, and pay only for what you use once you grow past the free allowance.
+
+| | Free | Pay as you go |
+|---|---|---|
+| Price | Free, no card needed | First {{FREE_DOMAINS}} active domains free, then **{{PRICE}} per active domain per month** |
+| Domains | Up to {{FREE_DOMAINS}} | Unlimited |
+| Features | API, embeddable widget, Cloudflare, Route 53 and manual DNS, webhooks, usage reports | Everything in Free |
+
+## What counts as an active domain
+
+A domain is **active** in a billing period if it was verified on at least one day of that period. Each domain counts once per period, however many days it was active.
+
+- A domain verified on the 3rd and deleted on the 10th counts once that month.
+- Deleting a domain doesn't remove it from a period it was already active in.
+- Domains that never verify, for example because the DNS records were never added, aren't counted.
+
+**Example:** you have 8 active domains this month. The first {{FREE_DOMAINS}} are free, so you pay for the rest, at {{PRICE}} each.
+
+## Upgrading
+
+Sign in to your [dashboard](/dashboard) and choose **Add payment method**. You'll go to our payment partner's secure checkout page. Once it's done, the domain cap is lifted immediately.
+
+On the free plan, creating more than {{FREE_DOMAINS}} domains returns `402 plan_limit_reached` from the API, with an `upgrade_url` that points to your dashboard. Your existing domains keep working either way.
+
+## Your bill
+
+You're billed monthly for the active domains in the previous period. Your dashboard shows this period's active domains and the estimated amount so far, and the [usage API](/docs/hosted-api#usage-and-billing) gives the same numbers, broken down by your own customers if you like.
+
+## Cancelling
+
+Cancel any time from **Manage billing** in the dashboard. Your existing domains keep working, and you go back to the free plan's limit for new domains. You're billed only for domains active during the period before you cancelled.
+
+## If a payment fails
+
+We keep your plan active while the payment is retried, and the dashboard asks you to update your payment method. If the payment can't be collected, the subscription ends and the account returns to the free plan.
+
+## Payments and tax
+
+Payments are processed by [Dodo Payments](https://dodopayments.com), our merchant of record. Dodo is the seller on your invoice, charges your payment method, and handles VAT, GST and sales tax for your country. Your card details go to Dodo and never reach our servers. Invoices and payment methods are available from **Manage billing** in the dashboard.
+
+Questions about a charge? See our [refund policy](/refunds) or [contact us](/contact).

package/docs/getting-started.md

@@ -0,0 +1,66 @@
+# Getting started
+
+{{APP_NAME}} authenticates your customers' sending domains with SendGrid, Postmark, Mailgun or Amazon SES. It creates the DNS records, writes them for your customers or shows them what to add, keeps checking until your email provider verifies the domain, and tells your app when each domain is ready. This guide takes you from sign-up to your first verified domain.
+
+## 1. Create an account
+
+[Sign up](/dashboard) with your email address. We email you a link; there's no password.{{#billing}} You start on the free plan, which includes {{FREE_DOMAINS}} domains.{{/billing}}
+
+## 2. Connect your email provider
+
+In the dashboard under **Settings**, choose your email provider and enter its credentials:
+
+| Provider | What to enter |
+|---|---|
+| SendGrid | An API key with full **Sender Authentication** access, plus **Inbound Parse** to receive email |
+| Postmark | An **account** API token (Account → API Tokens), plus a server ID if you want to receive email |
+| Mailgun | A private API key and your account's region (US or EU) |
+| Amazon SES | An IAM access key with SES permissions (create, get and delete identities, set MAIL FROM) and your SES region |
+
+Credentials are encrypted at rest and never shown again. Each account uses one provider; to switch, delete your domains first.
+
+Each provider asks for slightly different DNS records, and we handle the differences. For example, if a domain already has an SPF record, we add the provider to it rather than creating a second SPF record, which would break SPF.
+
+### No code: add your domains in the dashboard
+
+Bought domains at GoDaddy, Namecheap, Hostinger or anywhere else? Paste them into **Domains** in the dashboard, one per line, up to 100 at a time. Each one gets sender authentication at your email provider, plus inbound email if you tick **Also receive email** and enter the URL received mail should be posted to.
+
+We detect where each domain's DNS is hosted. Domains on Cloudflare or Route 53 can have their records written for you, if you enter a Cloudflare API token or AWS keys under **Write DNS records automatically**. For every other domain, the dashboard lists the records to add, grouped by DNS host, with a CSV and a zone file you can import. We keep checking and verify each domain as soon as its records are live.
+
+The steps below are for adding domains from your own app with the API.
+
+## 3. Create an API key
+
+Choose **Create new API key** in the dashboard and copy it. It's shown once. Use it from your backend as a bearer token:
+
+```bash
+export API_KEY=dk_live_…
+curl {{PUBLIC_URL}}/v1/account -H "Authorization: Bearer $API_KEY"
+```
+
+## 4. Register a domain
+
+```bash
+curl -X POST {{PUBLIC_URL}}/v1/domains \
+  -H "Authorization: Bearer $API_KEY" \
+  -H "Content-Type: application/json" \
+  -d '{"domain": "customer.com", "tenant_id": "cus_42", "dns": {"provider": "manual"}}'
+```
+
+The response includes the DNS records your customer needs to add. Then you have two options:
+
+- **Show the records:** show them in your app, so your customer can add them at their DNS host. We detect when they're live.
+- **Write them for the customer:** pass `"dns": {"provider": "cloudflare", "cloudflare_api_token": "…"}`, or the Route 53 equivalent, and we add the records to their DNS ourselves.
+
+Or skip building UI entirely and use the [embeddable widget](/docs/widget), which walks your customers through it, including connecting Cloudflare or Route 53.
+
+## 5. Find out when it's verified
+
+Check `GET /v1/domains/{id}`, or better, set a **Webhook URL** in the dashboard and we'll POST a signed `domain.verified` event as soon as your email provider confirms the domain. We keep checking in the background, and re-check verified domains daily so you hear about it if a record is later removed.
+
+## Next steps
+
+- [API reference](/docs/hosted-api): every endpoint, the domain lifecycle, errors and webhooks
+- [Embeddable widget](/docs/widget): let your customers connect their own DNS inside your app
+- [Node.js library and CLI](/docs/library): run the same setup from your own code or terminal, with your own keys
+{{#billing}}- [Plans and billing](/docs/billing): pricing and what counts as an active domain{{/billing}}