groundmail 0.26.1 → 0.28.0

package/dist/authjs.d.ts

@@ -1,4 +1,4 @@
-import { G as Groundmail } from './client-DZNmwhee.js';
+import { G as Groundmail } from './client-DdtHUMEu.js';
 
 /** Subset of Auth.js theme used for the default magic-link email. */
 type AuthjsTheme = {

package/dist/authjs.js

@@ -1,7 +1,7 @@
 import {
   DEFAULT_API_BASE_URL,
   Groundmail
-} from "./chunk-E6G7G2PM.js";
+} from "./chunk-POS35D4J.js";
 
 // src/authjs.ts
 function escapeHtml(value) {

package/dist/better-auth.d.ts

@@ -1,4 +1,4 @@
-import { S as SendEmailResult, G as Groundmail } from './client-DZNmwhee.js';
+import { S as SendEmailResult, G as Groundmail } from './client-DdtHUMEu.js';
 
 type BetterAuthEmailUser = {
     email: string;

package/dist/better-auth.js

@@ -1,7 +1,7 @@
 import {
   DEFAULT_API_BASE_URL,
   Groundmail
-} from "./chunk-E6G7G2PM.js";
+} from "./chunk-POS35D4J.js";
 
 // src/better-auth.ts
 function linkHtml(label, url) {

package/dist/{chunk-E6G7G2PM.js → chunk-POS35D4J.js}

@@ -71,9 +71,9 @@ function isSpfRecord(value) {
 }
 
 // src/dns/cloudflare.ts
-function relativeName(fqdn, zone) {
+function relativeName(fqdn2, zone) {
   const domain = zone.replace(/\.$/, "").toLowerCase();
-  const host = fqdn.replace(/\.$/, "").toLowerCase();
+  const host = fqdn2.replace(/\.$/, "").toLowerCase();
   if (host === domain) return "@";
   if (host.endsWith(`.${domain}`)) return host.slice(0, -(domain.length + 1));
   return host;
@@ -301,10 +301,185 @@ function createCloudflareProvider(options) {
   };
 }
 
+// src/dns/record-store.ts
+function zoneNameCandidates2(domain) {
+  const labels = domain.replace(/\.$/, "").toLowerCase().split(".").filter(Boolean);
+  const candidates = [];
+  for (let i = 0; i <= labels.length - 2; i++) {
+    candidates.push(labels.slice(i).join("."));
+  }
+  return candidates;
+}
+function relativeName2(fqdn2, zone) {
+  const domain = zone.replace(/\.$/, "").toLowerCase();
+  const host = fqdn2.replace(/\.$/, "").toLowerCase();
+  if (host === domain) return "";
+  if (host.endsWith(`.${domain}`)) return host.slice(0, -(domain.length + 1));
+  return host;
+}
+function fqdn(name, zone) {
+  return name ? `${name}.${zone}` : zone;
+}
+function normalizeValue(type, value) {
+  const trimmed = value.trim();
+  if (type === "TXT") return trimmed.replace(/^"([\s\S]*)"$/, "$1").replace(/"\s+"/g, "");
+  return trimmed.replace(/\.$/, "").toLowerCase();
+}
+function ownedTxt(purpose, value) {
+  const lower = value.toLowerCase();
+  if (purpose === "Domain ownership") return lower.includes("groundmail-verify=");
+  if (purpose === "DKIM") return lower.includes("v=dkim1");
+  if (purpose === "DMARC") return lower.includes("v=dmarc1");
+  return false;
+}
+async function applyToRecordStore(zone, records, store) {
+  const results = [];
+  let cached = await store.list();
+  const at = (type, name) => cached.filter((row) => row.type.toUpperCase() === type && row.name === name);
+  for (const record of records) {
+    const type = record.type.toUpperCase();
+    const name = relativeName2(record.host, zone);
+    const value = normalizeValue(type, record.value);
+    const done = (action, detail) => results.push({ purpose: record.purpose, host: record.host, action, ...detail ? { detail } : {} });
+    if (type === "CNAME") {
+      const existing = at("CNAME", name)[0];
+      if (existing && normalizeValue(type, existing.value) === value) {
+        done("unchanged");
+        continue;
+      }
+      if (existing) {
+        await store.update(existing, { name, type, value });
+        done("updated");
+      } else {
+        await store.create({ name, type, value });
+        done("created");
+      }
+    } else if (type === "MX") {
+      const priority = record.priority ?? 10;
+      const sameName = at("MX", name);
+      if (sameName.some((row) => normalizeValue(type, row.value) === value && (row.priority ?? 10) === priority)) {
+        done("unchanged");
+        continue;
+      }
+      await store.create({ name, type, value, priority });
+      done(sameName.length > 0 ? "merged" : "created");
+    } else if (type !== "TXT") {
+      done("unchanged", `Skipped unsupported type ${record.type}`);
+      continue;
+    } else if (record.purpose === "SPF") {
+      const existing = at("TXT", name).find((row) => isSpfRecord(normalizeValue(type, row.value)));
+      const includeHost = record.value.match(/include:([^\s"]+)/i)?.[1] || "spf.groundmail.dev";
+      const current = existing ? normalizeValue(type, existing.value) : void 0;
+      const merged = mergeSpfInclude(current, includeHost);
+      if (existing && current?.trim() === merged.trim()) {
+        done("unchanged", "SPF already includes Groundmail");
+        continue;
+      }
+      if (existing) {
+        await store.update(existing, { name, type, value: merged });
+        done("merged", merged);
+      } else {
+        await store.create({ name, type, value: merged });
+        done("created", merged);
+      }
+    } else {
+      const sameName = at("TXT", name);
+      if (sameName.some((row) => normalizeValue(type, row.value) === value)) {
+        done("unchanged");
+        continue;
+      }
+      const replaceable = sameName.find((row) => ownedTxt(record.purpose, normalizeValue(type, row.value)));
+      if (replaceable) {
+        await store.update(replaceable, { name, type, value });
+        done("updated");
+      } else {
+        await store.create({ name, type, value });
+        done("created");
+      }
+    }
+    cached = await store.list();
+  }
+  return results;
+}
+async function resolveZone(domain, hostLabel, lookup) {
+  for (const candidate of zoneNameCandidates2(domain)) {
+    const info = await lookup(candidate);
+    if (info !== null) return { zone: candidate, info };
+  }
+  throw new Error(`No ${hostLabel} DNS zone found for ${domain}. The domain must use ${hostLabel} nameservers.`);
+}
+
+// src/dns/godaddy-token.ts
+function createGoDaddyTokenProvider(options) {
+  const fetchImpl = options.fetchImpl || fetch;
+  async function godaddy(path, init) {
+    const response = await fetchImpl(`https://api.godaddy.com/v3/domains${path}`, {
+      ...init,
+      headers: {
+        Authorization: `Bearer ${options.apiToken}`,
+        "Content-Type": "application/json",
+        Accept: "application/json",
+        ...init?.headers || {}
+      }
+    });
+    const body = response.status === 204 ? {} : await response.json().catch(() => ({}));
+    if (!response.ok && response.status !== 404) {
+      if (response.status === 401 || response.status === 403) {
+        throw new Error(
+          "GoDaddy refused the token. Create a Personal Access Token with the domains.domain:read and domains.dns:update scopes."
+        );
+      }
+      throw new Error(body.message || body.code || `GoDaddy HTTP ${response.status}`);
+    }
+    return { status: response.status, body };
+  }
+  return {
+    name: "godaddy",
+    async apply(domain, records) {
+      const { zone } = await resolveZone(domain, "GoDaddy", async (candidate) => {
+        const { status } = await godaddy(`/zones/${encodeURIComponent(candidate)}/dns-records?pageSize=1`);
+        return status === 404 ? null : true;
+      });
+      const path = `/zones/${encodeURIComponent(zone)}/dns-records`;
+      const body = (record) => ({
+        name: record.name || "@",
+        type: record.type,
+        data: record.value,
+        ttl: 600,
+        ...record.priority != null ? { priority: record.priority } : {}
+      });
+      const write = async (method, suffix, record) => {
+        const { status } = await godaddy(`${path}${suffix}`, { method, body: JSON.stringify(body(record)) });
+        if (status === 404) throw new Error(`GoDaddy lost the ${zone} zone mid-update`);
+      };
+      return applyToRecordStore(zone, records, {
+        async list() {
+          const rows = [];
+          for (let page = 1; page <= 20; page++) {
+            const { body: list } = await godaddy(`${path}?page=${page}&pageSize=100`);
+            const items = list.items || [];
+            rows.push(...items);
+            if (items.length < 100 || !list.links?.some((link) => link.rel === "next")) break;
+          }
+          return rows.map((row) => ({
+            id: row.recordId,
+            name: row.name === "@" ? "" : row.name.toLowerCase(),
+            type: row.type,
+            value: row.data,
+            priority: row.priority ?? void 0
+          }));
+        },
+        create: (record) => write("POST", "", record),
+        update: (existing, record) => write("PUT", `/${encodeURIComponent(existing.id)}`, record)
+      });
+    }
+  };
+}
+
 // src/dns/godaddy.ts
-function relativeName2(fqdn, zone) {
+function relativeName3(fqdn2, zone) {
   const domain = zone.replace(/\.$/, "").toLowerCase();
-  const host = fqdn.replace(/\.$/, "").toLowerCase();
+  const host = fqdn2.replace(/\.$/, "").toLowerCase();
   if (host === domain) return "@";
   if (host.endsWith(`.${domain}`)) return host.slice(0, -(domain.length + 1));
   return host;
@@ -318,7 +493,7 @@ function serializeGoDaddyMxRecords(name, rows) {
     ttl: Math.max(row.ttl || 600, 600)
   }));
 }
-function createGoDaddyProvider(options) {
+function createGoDaddyKeyProvider(options) {
   const fetchImpl = options.fetchImpl || fetch;
   const headers = {
     Authorization: `sso-key ${options.apiKey}:${options.apiSecret}`,
@@ -345,7 +520,7 @@ function createGoDaddyProvider(options) {
       const results = [];
       for (const record of records) {
         const recordType = record.type.toUpperCase();
-        const name = relativeName2(record.host, zone);
+        const name = relativeName3(record.host, zone);
         if (recordType === "CNAME") {
           const target = record.value.replace(/\.$/, "");
           const existing2 = await gd(
@@ -470,9 +645,192 @@ function createGoDaddyProvider(options) {
     }
   };
 }
+function createGoDaddyProvider(options) {
+  if ("apiToken" in options) return createGoDaddyTokenProvider({ apiToken: options.apiToken, fetchImpl: options.fetchImpl });
+  return createGoDaddyKeyProvider(options);
+}
+
+// src/dns/digitalocean.ts
+function createDigitalOceanProvider(options) {
+  const fetchImpl = options.fetchImpl || fetch;
+  async function digitalocean(path, init) {
+    const response = await fetchImpl(`https://api.digitalocean.com/v2${path}`, {
+      ...init,
+      headers: { Authorization: `Bearer ${options.apiToken}`, "Content-Type": "application/json", ...init?.headers || {} }
+    });
+    const body = await response.json().catch(() => ({}));
+    if (!response.ok && response.status !== 404) {
+      if (response.status === 403) {
+        throw new Error("DigitalOcean refused the DNS change. Reconnect DigitalOcean under Integrations to allow DNS.");
+      }
+      throw new Error(body.message || `DigitalOcean HTTP ${response.status}`);
+    }
+    return { status: response.status, body };
+  }
+  return {
+    name: "digitalocean",
+    async apply(domain, records) {
+      const { zone } = await resolveZone(domain, "DigitalOcean", async (candidate) => {
+        const { status } = await digitalocean(`/domains/${encodeURIComponent(candidate)}`);
+        return status === 404 ? null : true;
+      });
+      const path = `/domains/${encodeURIComponent(zone)}/records`;
+      const body = (record) => ({
+        type: record.type,
+        name: record.name || "@",
+        data: record.type === "TXT" ? record.value : `${record.value}.`,
+        ttl: 1800,
+        ...record.priority != null ? { priority: record.priority } : {}
+      });
+      const write = async (method, suffix, record) => {
+        const { status } = await digitalocean(`${path}${suffix}`, { method, body: JSON.stringify(body(record)) });
+        if (status === 404) throw new Error(`DigitalOcean lost the ${zone} zone mid-update`);
+      };
+      return applyToRecordStore(zone, records, {
+        async list() {
+          const rows = [];
+          for (let page = 1; page <= 20; page++) {
+            const { body: list } = await digitalocean(`${path}?per_page=200&page=${page}`);
+            rows.push(...list.domain_records || []);
+            if (!list.links?.pages?.next) break;
+          }
+          return rows.map((row) => ({
+            id: String(row.id),
+            name: row.name === "@" ? "" : row.name.toLowerCase(),
+            type: row.type,
+            value: row.data,
+            priority: row.priority ?? void 0
+          }));
+        },
+        create: (record) => write("POST", "", record),
+        update: (existing, record) => write("PUT", `/${existing.id}`, record)
+      });
+    }
+  };
+}
+
+// src/dns/dnsimple.ts
+function createDnsimpleProvider(options) {
+  const fetchImpl = options.fetchImpl || fetch;
+  const base = `https://api.dnsimple.com/v2/${encodeURIComponent(options.accountId)}`;
+  async function dnsimple(path, init) {
+    const response = await fetchImpl(`${base}${path}`, {
+      ...init,
+      headers: {
+        Authorization: `Bearer ${options.apiToken}`,
+        "Content-Type": "application/json",
+        Accept: "application/json",
+        ...init?.headers || {}
+      }
+    });
+    const body = await response.json().catch(() => ({}));
+    if (!response.ok && response.status !== 404) throw new Error(body.message || `DNSimple HTTP ${response.status}`);
+    return { status: response.status, body };
+  }
+  return {
+    name: "dnsimple",
+    async apply(domain, records) {
+      const { zone } = await resolveZone(domain, "DNSimple", async (candidate) => {
+        const { status } = await dnsimple(`/zones/${encodeURIComponent(candidate)}`);
+        return status === 404 ? null : true;
+      });
+      const path = `/zones/${encodeURIComponent(zone)}/records`;
+      const body = (record) => ({
+        name: record.name,
+        type: record.type,
+        content: record.value,
+        ttl: 3600,
+        ...record.priority != null ? { priority: record.priority } : {}
+      });
+      const write = async (method, suffix, record) => {
+        const { status } = await dnsimple(`${path}${suffix}`, { method, body: JSON.stringify(body(record)) });
+        if (status === 404) throw new Error(`DNSimple lost the ${zone} zone mid-update`);
+      };
+      return applyToRecordStore(zone, records, {
+        async list() {
+          const rows = [];
+          for (let page = 1; page <= 20; page++) {
+            const { body: list } = await dnsimple(`${path}?per_page=100&page=${page}`);
+            rows.push(...list.data || []);
+            if ((list.pagination?.total_pages ?? 1) <= page) break;
+          }
+          return rows.filter((row) => !row.system_record).map((row) => ({
+            id: String(row.id),
+            name: row.name.toLowerCase(),
+            type: row.type,
+            value: row.content,
+            priority: row.priority ?? void 0
+          }));
+        },
+        create: (record) => write("POST", "", record),
+        update: (existing, record) => write("PATCH", `/${existing.id}`, record)
+      });
+    }
+  };
+}
+
+// src/dns/netlify.ts
+function createNetlifyProvider(options) {
+  const fetchImpl = options.fetchImpl || fetch;
+  async function netlify(path, init) {
+    const response = await fetchImpl(`https://api.netlify.com/api/v1${path}`, {
+      ...init,
+      headers: { Authorization: `Bearer ${options.apiToken}`, "Content-Type": "application/json", ...init?.headers || {} }
+    });
+    const body = await response.json().catch(() => ({}));
+    if (!response.ok) throw new Error(body.message || `Netlify HTTP ${response.status}`);
+    return body;
+  }
+  return {
+    name: "netlify",
+    async apply(domain, records) {
+      const zones = await netlify("/dns_zones");
+      const { zone, info } = await resolveZone(
+        domain,
+        "Netlify",
+        async (candidate) => zones.find((z) => z.name.toLowerCase() === candidate) ?? null
+      );
+      const body = (record) => ({
+        type: record.type,
+        hostname: fqdn(record.name, zone),
+        value: record.value,
+        ttl: 3600,
+        ...record.priority != null ? { priority: record.priority } : {}
+      });
+      const create = async (record) => {
+        await netlify(`/dns_zones/${info.id}/dns_records`, { method: "POST", body: JSON.stringify(body(record)) });
+      };
+      return applyToRecordStore(zone, records, {
+        async list() {
+          const rows = await netlify(`/dns_zones/${info.id}/dns_records`);
+          return rows.filter((row) => !row.managed).map((row) => ({
+            id: row.id,
+            name: relativeName2(row.hostname, zone),
+            type: row.type,
+            value: row.value,
+            priority: row.priority ?? void 0
+          }));
+        },
+        create,
+        // TXT: add the new value before removing the old, so SPF never disappears. A
+        // name can only hold one CNAME, so that one goes the other way round.
+        async update(existing, record) {
+          const remove = () => netlify(`/dns_zones/${info.id}/dns_records/${existing.id}`, { method: "DELETE" });
+          if (record.type === "CNAME") {
+            await remove();
+            await create(record);
+          } else {
+            await create(record);
+            await remove();
+          }
+        }
+      });
+    }
+  };
+}
 
 // src/dns/vercel.ts
-function zoneNameCandidates2(domain) {
+function zoneNameCandidates3(domain) {
   const labels = domain.replace(/\.$/, "").toLowerCase().split(".").filter(Boolean);
   const candidates = [];
   for (let i = 0; i <= labels.length - 2; i++) {
@@ -480,9 +838,9 @@ function zoneNameCandidates2(domain) {
   }
   return candidates;
 }
-function relativeName3(fqdn, zone) {
+function relativeName4(fqdn2, zone) {
   const domain = zone.replace(/\.$/, "").toLowerCase();
-  const host = fqdn.replace(/\.$/, "").toLowerCase();
+  const host = fqdn2.replace(/\.$/, "").toLowerCase();
   if (host === domain) return "";
   if (host.endsWith(`.${domain}`)) return host.slice(0, -(domain.length + 1));
   return host;
@@ -530,7 +888,7 @@ function createVercelProvider(options) {
   }
   async function resolveDomain(domain) {
     const errors = [];
-    for (const candidate of zoneNameCandidates2(domain)) {
+    for (const candidate of zoneNameCandidates3(domain)) {
       try {
         await listRecords(candidate);
         return candidate;
@@ -554,7 +912,7 @@ function createVercelProvider(options) {
       };
       for (const record of records) {
         const recordType = record.type.toUpperCase();
-        const name = relativeName3(record.host, zone);
+        const name = relativeName4(record.host, zone);
         if (recordType === "CNAME") {
           const target = record.value.replace(/\.$/, "").toLowerCase();
           const existing = cached.find(
@@ -706,11 +1064,13 @@ function createDnsProvider(provider, credentials, fetchImpl) {
     });
   }
   if (provider === "godaddy") {
+    const apiToken = credentials.godaddyApiToken;
+    if (apiToken) return createGoDaddyProvider({ apiToken, fetchImpl });
     const apiKey = credentials.godaddyApiKey;
     const apiSecret = credentials.godaddyApiSecret;
     if (!apiKey || !apiSecret) {
       throw new Error(
-        "Missing GoDaddy credentials. Set GODADDY_API_KEY and GODADDY_API_SECRET."
+        "Missing GoDaddy credentials. Set GODADDY_PAT (a Personal Access Token), or GODADDY_API_KEY and GODADDY_API_SECRET."
       );
     }
     return createGoDaddyProvider({ apiKey, apiSecret, fetchImpl });
@@ -726,6 +1086,24 @@ function createDnsProvider(provider, credentials, fetchImpl) {
       fetchImpl
     });
   }
+  if (provider === "netlify") {
+    const apiToken = credentials.netlifyApiToken;
+    if (!apiToken) throw new Error("Missing Netlify token. Set NETLIFY_AUTH_TOKEN or pass netlifyApiToken.");
+    return createNetlifyProvider({ apiToken, fetchImpl });
+  }
+  if (provider === "digitalocean") {
+    const apiToken = credentials.digitaloceanApiToken;
+    if (!apiToken) throw new Error("Missing DigitalOcean token. Set DIGITALOCEAN_TOKEN or pass digitaloceanApiToken.");
+    return createDigitalOceanProvider({ apiToken, fetchImpl });
+  }
+  if (provider === "dnsimple") {
+    const apiToken = credentials.dnsimpleApiToken;
+    const accountId = credentials.dnsimpleAccountId;
+    if (!apiToken || !accountId) {
+      throw new Error("Missing DNSimple credentials. Set DNSIMPLE_TOKEN and DNSIMPLE_ACCOUNT_ID.");
+    }
+    return createDnsimpleProvider({ apiToken, accountId, fetchImpl });
+  }
   throw new Error(`Unsupported DNS provider: ${provider}`);
 }
 async function applyDnsRecords(input) {
@@ -1059,8 +1437,9 @@ var DomainsResource = class {
     });
   }
   /**
-   * Apply DNS using the public API. Cloudflare, Vercel, and GoDaddy can use stored dashboard
-   * credentials; GoDaddy also accepts one-time credentials on the request.
+   * Apply DNS using the public API with the DNS host connected in the dashboard (Cloudflare,
+   * Vercel, GoDaddy, Netlify, DigitalOcean or DNSimple). GoDaddy also accepts one-time
+   * credentials on the request.
    */
   async apply(idOrName, options = {}) {
     return this.client.request(`/domains/${encodeURIComponent(idOrName)}`, {
@@ -1073,8 +1452,8 @@ var DomainsResource = class {
     });
   }
   /**
-   * Fetch Groundmail DNS records, then write them at Cloudflare, Vercel, or GoDaddy
-   * using the caller's provider credentials (never sent to Groundmail).
+   * Fetch Groundmail DNS records, then write them at Cloudflare, Vercel, GoDaddy, Netlify,
+   * DigitalOcean or DNSimple using the caller's provider credentials (never sent to Groundmail).
    */
   async applyDns(params) {
     const detail = await this.get(params.idOrName);
@@ -1089,10 +1468,15 @@ var DomainsResource = class {
       credentials: {
         cloudflareApiToken: params.cloudflareApiToken,
         cloudflareZoneId: params.cloudflareZoneId,
+        godaddyApiToken: params.godaddyApiToken,
         godaddyApiKey: params.godaddyApiKey,
         godaddyApiSecret: params.godaddyApiSecret,
         vercelApiToken: params.vercelApiToken,
-        vercelTeamId: params.vercelTeamId
+        vercelTeamId: params.vercelTeamId,
+        netlifyApiToken: params.netlifyApiToken,
+        digitaloceanApiToken: params.digitaloceanApiToken,
+        dnsimpleApiToken: params.dnsimpleApiToken,
+        dnsimpleAccountId: params.dnsimpleAccountId
       },
       fetchImpl: this.client.fetchImpl
     });

package/dist/clerk.d.ts

@@ -1,4 +1,4 @@
-import { G as Groundmail, S as SendEmailResult } from './client-DZNmwhee.js';
+import { G as Groundmail, S as SendEmailResult } from './client-DdtHUMEu.js';
 
 /**
  * Subset of Clerk `email.created` webhook `data` used for delivery.

package/dist/clerk.js

@@ -1,7 +1,7 @@
 import {
   DEFAULT_API_BASE_URL,
   Groundmail
-} from "./chunk-E6G7G2PM.js";
+} from "./chunk-POS35D4J.js";
 
 // src/clerk.ts
 function resolveApiKey(options) {

package/dist/{client-DZNmwhee.d.ts → client-DdtHUMEu.d.ts}

@@ -1013,20 +1013,28 @@ type UpdateDomainParams = {
     /** What to do with received mail at or above the threshold. */
     inbound_spam_action?: 'flag' | 'drop';
 };
-type DnsProviderName = 'cloudflare' | 'godaddy' | 'vercel';
+type DnsProviderName = 'cloudflare' | 'godaddy' | 'vercel' | 'netlify' | 'digitalocean' | 'dnsimple';
 type RemoteApplyDnsCredentials = {
     /** Inline Cloudflare token instead of the stored dashboard integration. */
     apiToken?: string;
     zoneId?: string;
     cloudflareApiToken?: string;
     cloudflareZoneId?: string;
-    /** GoDaddy one-time credentials. */
+    /** GoDaddy one-time credentials: a Personal Access Token in apiToken, or the classic key and secret. */
+    godaddyApiToken?: string;
     apiKey?: string;
     apiSecret?: string;
     godaddyApiKey?: string;
     godaddyApiSecret?: string;
     vercelApiToken?: string;
     vercelTeamId?: string;
+    /** Inline token for netlify, digitalocean or dnsimple instead of the stored connection. */
+    netlifyApiToken?: string;
+    digitaloceanApiToken?: string;
+    dnsimpleApiToken?: string;
+    /** DNSimple account the inline token belongs to. */
+    dnsimpleAccountId?: string;
+    accountId?: string;
 };
 type ApplyDnsParams = {
     provider: DnsProviderName;
@@ -1034,10 +1042,16 @@ type ApplyDnsParams = {
     idOrName: string;
     cloudflareApiToken?: string;
     cloudflareZoneId?: string;
+    /** GoDaddy Personal Access Token (preferred over the key and secret). */
+    godaddyApiToken?: string;
     godaddyApiKey?: string;
     godaddyApiSecret?: string;
     vercelApiToken?: string;
     vercelTeamId?: string;
+    netlifyApiToken?: string;
+    digitaloceanApiToken?: string;
+    dnsimpleApiToken?: string;
+    dnsimpleAccountId?: string;
 };
 type ApplyDnsRecordResult = {
     purpose: string;
@@ -1514,7 +1528,7 @@ type DmarcMonitoringDisabled = {
 type DmarcStatus = DmarcMonitoring | DmarcMonitoringDisabled;
 type EnableDmarcParams = {
     /** Also write the record through a DNS provider connected under Settings → Integrations. */
-    apply?: 'cloudflare' | 'vercel' | 'godaddy';
+    apply?: DnsProviderName;
     digest_enabled?: boolean;
 };
 type EnableDmarcResult = {
@@ -1561,16 +1575,17 @@ declare class DomainsResource {
         ok: boolean;
     }>;
     /**
-     * Apply DNS using the public API. Cloudflare, Vercel, and GoDaddy can use stored dashboard
-     * credentials; GoDaddy also accepts one-time credentials on the request.
+     * Apply DNS using the public API with the DNS host connected in the dashboard (Cloudflare,
+     * Vercel, GoDaddy, Netlify, DigitalOcean or DNSimple). GoDaddy also accepts one-time
+     * credentials on the request.
      */
     apply(idOrName: string, options?: {
-        provider?: 'cloudflare' | 'godaddy' | 'vercel';
+        provider?: DnsProviderName;
         credentials?: RemoteApplyDnsCredentials;
     }): Promise<ApplyDnsResult>;
     /**
-     * Fetch Groundmail DNS records, then write them at Cloudflare, Vercel, or GoDaddy
-     * using the caller's provider credentials (never sent to Groundmail).
+     * Fetch Groundmail DNS records, then write them at Cloudflare, Vercel, GoDaddy, Netlify,
+     * DigitalOcean or DNSimple using the caller's provider credentials (never sent to Groundmail).
      */
     applyDns(params: ApplyDnsParams): Promise<ApplyDnsResult>;
 }

package/dist/index.d.ts

@@ -1,5 +1,5 @@
-import { A as ApiErrorBody, D as DnsRecord } from './client-DZNmwhee.js';
-export { a as ApiErrorCode, b as ApiKey, c as ApiKeyScope, d as ApplyDnsParams, e as ApplyDnsRecordResult, f as ApplyDnsResult, g as Asset, h as Automation, i as AutomationResult, j as AutomationRun, k as AutomationRunResponse, l as AutomationRunStatus, m as AutomationRunStep, n as AutomationRunStepStatus, o as AutomationStatus, p as AutomationStep, q as AutomationTrigger, B as BatchSendEmailResult, r as BounceType, C as CategoryOptOut, s as CategoryOptOutCategory, t as CategoryUnsubscribedErrorDetails, u as ConnectTwilioParams, v as ContactWebhookEventPayload, w as CreateApiKeyParams, x as CreateApiKeyResult, y as CreateAutomationParams, z as CreateDomainParams, E as CreateDomainResult, F as CreateMigrationParams, H as CreateSuppressionParams, I as CreateTemplateParams, J as CreateTenantParams, K as CreateWebhookParams, L as DEFAULT_API_BASE_URL, M as DailyRampLimitErrorDetails, N as DeleteTenantResult, O as DeliverabilityBucket, P as DeliverabilityDomainInsight, Q as DeliverabilityInsightsResult, R as DeliverabilityMailServerRelay, T as DeliverabilityWindow, U as DmarcDailyPoint, V as DmarcMonitoring, W as DmarcMonitoringDisabled, X as DmarcReadiness, Y as DmarcReadinessVerdict, Z as DmarcSource, _ as DmarcSourceStatus, $ as DmarcStatus, a0 as DnsProviderName, a1 as Domain, a2 as DomainBimiAnalysis, a3 as DomainDetailResult, a4 as DomainDmarcAnalysis, a5 as DomainDnsAnalysis, a6 as DomainStatus, a7 as DomainTlsMode, a8 as DomainTrackingDns, a9 as DomainTrackingStatus, aa as EmailListItem, ab as EmailWebhookEventPayload, ac as EmailWebhookEventType, ad as EnableDmarcParams, ae as EnableDmarcResult, af as EnrollmentSkip, ag as EventRecord, G as Groundmail, ah as GroundmailAccessToken, ai as GroundmailOptions, aj as GroundmailTokenOptions, ak as GroundmailTokenProvider, al as HeldBackErrorDetails, am as HeldBackReason, an as HeldBackRecipient, ao as ListApiKeysParams, ap as ListApiKeysResult, aq as ListAutomationRunsParams, ar as ListAutomationRunsResult, as as ListAutomationsResult, at as ListCategoryOptOutsParams, au as ListCategoryOptOutsResult, av as ListDomainsParams, aw as ListDomainsResult, ax as ListEmailsParams, ay as ListEmailsResult, az as ListReceivedEmailsParams, aA as ListReceivedEmailsResult, aB as ListSuppressionsParams, aC as ListSuppressionsResult, aD as ListTemplatesParams, aE as ListTemplatesResult, aF as ListTenantDomainsResult, aG as ListTenantsParams, aH as ListTenantsResult, aI as ListTestInboxEmailsParams, aJ as ListTestInboxEmailsResult, aK as MailServerSigningStatus, aL as MailStream, aM as Migration, aN as MigrationDnsChange, aO as MigrationDnsPlan, aP as MigrationDomainItem, aQ as MigrationItemStatus, aR as MigrationProvider, aS as MigrationResource, aT as MigrationSummary, aU as MigrationTemplateItem, aV as MigrationTotals, aW as MigrationWebhookItem, aX as ReceivedEmail, aY as ReceivedEmailAttachment, aZ as ReceivedEmailAttachmentMeta, a_ as RemoteApplyDnsCredentials, a$ as RemoveCategoryOptOutOptions, b0 as RunMigrationOptions, b1 as SendEmailParams, S as SendEmailResult, b2 as StreamDeliverability, b3 as SuppressedErrorDetails, b4 as Suppression, b5 as TEST_INBOX_WAIT_DEFAULT_MS, b6 as TEST_INBOX_WAIT_MAX_SECONDS, b7 as Template, b8 as TemplateFormat, b9 as TemplateLintWarning, ba as TemplateStarter, bb as TemplateStatus, bc as TemplateVersion, bd as Tenant, be as TenantPauseSource, bf as TenantRamp, bg as TenantStats, bh as TenantStatsResult, bi as TenantStatus, bj as TenantStreamPolicy, bk as TestEmailWebhookParams, bl as TestEmailWebhookResult, bm as TestInbox, bn as TestInboxAddressOptions, bo as TestInboxEmail, bp as TestInboxEmailDetail, bq as TestInboxHeader, br as TestInboxResource, bs as TestInboxUsage, bt as TriggerEventParams, bu as TriggerEventResult, bv as TwilioIntegrationResponse, bw as TwilioIntegrationStatus, bx as UpdateAutomationParams, by as UpdateDomainParams, bz as UpdateEmailParams, bA as UpdateTemplateParams, bB as UpdateTenantParams, bC as UpdateWebhookParams, bD as ValidateEmailResult, bE as ValidationReason, bF as ValidationVerdict, bG as VerifyDomainResult, bH as WaitForTestEmailParams, bI as WebhookEmailTag, bJ as WebhookEndpoint, bK as WebhookEndpointWithSecret, bL as WebhookEventType, bM as mergeMigrations, bN as normalizeAccessToken } from './client-DZNmwhee.js';
+import { A as ApiErrorBody, D as DnsRecord } from './client-DdtHUMEu.js';
+export { a as ApiErrorCode, b as ApiKey, c as ApiKeyScope, d as ApplyDnsParams, e as ApplyDnsRecordResult, f as ApplyDnsResult, g as Asset, h as Automation, i as AutomationResult, j as AutomationRun, k as AutomationRunResponse, l as AutomationRunStatus, m as AutomationRunStep, n as AutomationRunStepStatus, o as AutomationStatus, p as AutomationStep, q as AutomationTrigger, B as BatchSendEmailResult, r as BounceType, C as CategoryOptOut, s as CategoryOptOutCategory, t as CategoryUnsubscribedErrorDetails, u as ConnectTwilioParams, v as ContactWebhookEventPayload, w as CreateApiKeyParams, x as CreateApiKeyResult, y as CreateAutomationParams, z as CreateDomainParams, E as CreateDomainResult, F as CreateMigrationParams, H as CreateSuppressionParams, I as CreateTemplateParams, J as CreateTenantParams, K as CreateWebhookParams, L as DEFAULT_API_BASE_URL, M as DailyRampLimitErrorDetails, N as DeleteTenantResult, O as DeliverabilityBucket, P as DeliverabilityDomainInsight, Q as DeliverabilityInsightsResult, R as DeliverabilityMailServerRelay, T as DeliverabilityWindow, U as DmarcDailyPoint, V as DmarcMonitoring, W as DmarcMonitoringDisabled, X as DmarcReadiness, Y as DmarcReadinessVerdict, Z as DmarcSource, _ as DmarcSourceStatus, $ as DmarcStatus, a0 as DnsProviderName, a1 as Domain, a2 as DomainBimiAnalysis, a3 as DomainDetailResult, a4 as DomainDmarcAnalysis, a5 as DomainDnsAnalysis, a6 as DomainStatus, a7 as DomainTlsMode, a8 as DomainTrackingDns, a9 as DomainTrackingStatus, aa as EmailListItem, ab as EmailWebhookEventPayload, ac as EmailWebhookEventType, ad as EnableDmarcParams, ae as EnableDmarcResult, af as EnrollmentSkip, ag as EventRecord, G as Groundmail, ah as GroundmailAccessToken, ai as GroundmailOptions, aj as GroundmailTokenOptions, ak as GroundmailTokenProvider, al as HeldBackErrorDetails, am as HeldBackReason, an as HeldBackRecipient, ao as ListApiKeysParams, ap as ListApiKeysResult, aq as ListAutomationRunsParams, ar as ListAutomationRunsResult, as as ListAutomationsResult, at as ListCategoryOptOutsParams, au as ListCategoryOptOutsResult, av as ListDomainsParams, aw as ListDomainsResult, ax as ListEmailsParams, ay as ListEmailsResult, az as ListReceivedEmailsParams, aA as ListReceivedEmailsResult, aB as ListSuppressionsParams, aC as ListSuppressionsResult, aD as ListTemplatesParams, aE as ListTemplatesResult, aF as ListTenantDomainsResult, aG as ListTenantsParams, aH as ListTenantsResult, aI as ListTestInboxEmailsParams, aJ as ListTestInboxEmailsResult, aK as MailServerSigningStatus, aL as MailStream, aM as Migration, aN as MigrationDnsChange, aO as MigrationDnsPlan, aP as MigrationDomainItem, aQ as MigrationItemStatus, aR as MigrationProvider, aS as MigrationResource, aT as MigrationSummary, aU as MigrationTemplateItem, aV as MigrationTotals, aW as MigrationWebhookItem, aX as ReceivedEmail, aY as ReceivedEmailAttachment, aZ as ReceivedEmailAttachmentMeta, a_ as RemoteApplyDnsCredentials, a$ as RemoveCategoryOptOutOptions, b0 as RunMigrationOptions, b1 as SendEmailParams, S as SendEmailResult, b2 as StreamDeliverability, b3 as SuppressedErrorDetails, b4 as Suppression, b5 as TEST_INBOX_WAIT_DEFAULT_MS, b6 as TEST_INBOX_WAIT_MAX_SECONDS, b7 as Template, b8 as TemplateFormat, b9 as TemplateLintWarning, ba as TemplateStarter, bb as TemplateStatus, bc as TemplateVersion, bd as Tenant, be as TenantPauseSource, bf as TenantRamp, bg as TenantStats, bh as TenantStatsResult, bi as TenantStatus, bj as TenantStreamPolicy, bk as TestEmailWebhookParams, bl as TestEmailWebhookResult, bm as TestInbox, bn as TestInboxAddressOptions, bo as TestInboxEmail, bp as TestInboxEmailDetail, bq as TestInboxHeader, br as TestInboxResource, bs as TestInboxUsage, bt as TriggerEventParams, bu as TriggerEventResult, bv as TwilioIntegrationResponse, bw as TwilioIntegrationStatus, bx as UpdateAutomationParams, by as UpdateDomainParams, bz as UpdateEmailParams, bA as UpdateTemplateParams, bB as UpdateTenantParams, bC as UpdateWebhookParams, bD as ValidateEmailResult, bE as ValidationReason, bF as ValidationVerdict, bG as VerifyDomainResult, bH as WaitForTestEmailParams, bI as WebhookEmailTag, bJ as WebhookEndpoint, bK as WebhookEndpointWithSecret, bL as WebhookEventType, bM as mergeMigrations, bN as normalizeAccessToken } from './client-DdtHUMEu.js';
 
 type GroundmailErrorOptions = {
     code?: string;
@@ -80,7 +80,7 @@ declare function isTestApiKey(key: string | null | undefined): boolean;
 /** Merge `include:host` into an existing SPF record (or create a minimal one). */
 declare function mergeSpfInclude(existing: string | null | undefined, includeHost: string): string;
 
-type DnsProviderName = 'cloudflare' | 'godaddy' | 'vercel';
+type DnsProviderName = 'cloudflare' | 'godaddy' | 'vercel' | 'netlify' | 'digitalocean' | 'dnsimple';
 type ApplyDnsRecordResult = {
     purpose: string;
     host: string;
@@ -95,10 +95,16 @@ type ApplyDnsResult = {
 type ApplyDnsCredentials = {
     cloudflareApiToken?: string;
     cloudflareZoneId?: string;
+    /** GoDaddy Personal Access Token (preferred over the key and secret). */
+    godaddyApiToken?: string;
     godaddyApiKey?: string;
     godaddyApiSecret?: string;
     vercelApiToken?: string;
     vercelTeamId?: string;
+    netlifyApiToken?: string;
+    digitaloceanApiToken?: string;
+    dnsimpleApiToken?: string;
+    dnsimpleAccountId?: string;
 };
 
 declare function applyDnsRecords(input: {

package/dist/index.js

@@ -12,7 +12,7 @@ import {
   normalizeAccessToken,
   signWebhookPayload,
   verifyWebhookSignature
-} from "./chunk-E6G7G2PM.js";
+} from "./chunk-POS35D4J.js";
 
 // src/simulator.ts
 var SIMULATOR_DOMAIN = "simulator.groundmail.dev";

package/dist/payload.d.ts

@@ -1,4 +1,4 @@
-import { G as Groundmail } from './client-DZNmwhee.js';
+import { G as Groundmail } from './client-DdtHUMEu.js';
 
 /**
  * Minimal Payload `SendEmailOptions` / address shapes used by this adapter.

package/dist/payload.js

@@ -1,7 +1,7 @@
 import {
   DEFAULT_API_BASE_URL,
   Groundmail
-} from "./chunk-E6G7G2PM.js";
+} from "./chunk-POS35D4J.js";
 
 // src/payload.ts
 function resolveApiKey(args) {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "groundmail",
-  "version": "0.26.1",
+  "version": "0.28.0",
   "description": "Groundmail transactional email API client",
   "license": "MIT",
   "type": "module",
@@ -89,7 +89,7 @@
     "prepublishOnly": "npm run build && npm run build:nodemailer-bridge"
   },
   "dependencies": {
-    "groundmail-nodemailer": "0.15.14"
+    "groundmail-nodemailer": "0.15.16"
   },
   "devDependencies": {
     "@types/nodemailer": "^8.0.1",