portal-mojo 0.1.0

package/src/admin/dns/certificate-data.ts

@@ -0,0 +1,221 @@
+import type { CertificateRow, DnsCapabilities, DnsCredentialRow, DomainRow } from './models';
+
+export const CERTIFICATE_STATUSES = ['pending', 'issuing', 'active', 'failed', 'revoked'] as const;
+export type CertificateStatus = (typeof CERTIFICATE_STATUSES)[number];
+
+export interface AcmeDelegationStatus {
+    id: number;
+    created: string | null;
+    modified: string | null;
+    domain: number | null;
+    domain_name: string;
+    source: string | null;
+    target: string | null;
+    state: 'pending' | 'verified' | 'broken' | 'retired' | 'unknown';
+    verified_at: string | null;
+    last_error_code: string | null;
+}
+
+export type CertificateRenewalHealth =
+    | 'pending' | 'issuing' | 'healthy' | 'due' | 'renewal-error'
+    | 'failed' | 'revoked' | 'unknown';
+
+export interface CertificateReadiness {
+    ready: boolean;
+    mode: 'direct' | 'delegated' | 'blocked';
+    label: string;
+    reason: string | null;
+}
+
+function object(value: unknown): Record<string, unknown> {
+    return value != null && typeof value === 'object' && !Array.isArray(value)
+        ? value as Record<string, unknown>
+        : {};
+}
+
+function finite(value: unknown): number | null {
+    return typeof value === 'number' && Number.isFinite(value) ? value : null;
+}
+
+function nullableText(value: unknown, limit: number): string | null {
+    if (value == null) return null;
+    if (typeof value !== 'string') return null;
+    const normalized = value.replace(/[\u0000-\u0008\u000b\u000c\u000e-\u001f\u007f]/g, '').trim();
+    if (!normalized) return null;
+    return normalized.length <= limit ? normalized : `${normalized.slice(0, limit)}…`;
+}
+
+/** Bound and redact provider/ACME exceptions before they enter Query cache. */
+export function sanitizeCertificateLastError(value: unknown): string | null {
+    const bounded = nullableText(value, 2_000);
+    if (!bounded) return null;
+    return bounded
+        .replace(/\b(Bearer|Basic)\s+[A-Za-z0-9._~+/=-]+/gi, '$1 [redacted]')
+        .replace(/([?&;](?:token|api_key|secret|password|credential)=)[^&#;\s]*/gi, '$1[redacted]')
+        .replace(/(^|[&;\s])((?:token|api_key|secret|password|credential)=)[^&;\s]*/gi, '$1$2[redacted]')
+        .replace(/\b(token|api[ _-]?key|client[ _-]?secret|password|credential)(\s*(?:is|:|=)?\s+)[A-Za-z0-9._~+/=-]{8,}/gi, '$1$2[redacted]');
+}
+
+export function normalizeCertificateStatus(value: unknown): CertificateStatus {
+    const status = String(value ?? '').trim().toLowerCase();
+    return (CERTIFICATE_STATUSES as readonly string[]).includes(status)
+        ? status as CertificateStatus
+        : 'failed';
+}
+
+/** DNS names are lowercase, ASCII, and have no trailing dot. */
+export function normalizeCertificateName(value: unknown): string {
+    const input = String(value ?? '').trim().toLowerCase().replace(/\.+$/, '');
+    if (!input) return '';
+    const wildcard = input.startsWith('*.');
+    const host = wildcard ? input.slice(2) : input;
+    try {
+        const ascii = new URL(`https://${host}`).hostname.toLowerCase().replace(/\.+$/, '');
+        return wildcard ? `*.${ascii}` : ascii;
+    } catch {
+        return input;
+    }
+}
+
+export function normalizeCertificateSans(value: unknown): string[] {
+    if (!Array.isArray(value)) return [];
+    const out: string[] = [];
+    for (const candidate of value) {
+        if (typeof candidate !== 'string') continue;
+        const name = normalizeCertificateName(candidate);
+        if (name && !out.includes(name)) out.push(name);
+        if (out.length >= 100) break;
+    }
+    return out;
+}
+
+function validDnsName(name: string): boolean {
+    if (!name || name.length > 253 || name.includes('/') || name.includes(':')) return false;
+    const wildcard = name.startsWith('*.');
+    if (name.includes('*') && !wildcard) return false;
+    const host = wildcard ? name.slice(2) : name;
+    return host.split('.').every((label) => label.length > 0 && label.length <= 63
+        && /^[a-z0-9](?:[a-z0-9-]*[a-z0-9])?$/i.test(label));
+}
+
+/** Normalize, dedupe and require every requested SAN to remain in-zone. */
+export function validateCertificateNames(zoneValue: string, values: readonly string[]): { names: string[]; errors: string[] } {
+    const zone = normalizeCertificateName(zoneValue).replace(/^\*\./, '');
+    const names = normalizeCertificateSans(values);
+    const effective = names.length ? names : [zone, `*.${zone}`];
+    const errors: string[] = [];
+    for (const name of effective) {
+        const host = name.startsWith('*.') ? name.slice(2) : name;
+        if (!validDnsName(name)) errors.push(`${name || 'Empty name'} is not a valid DNS name.`);
+        else if (host !== zone && !host.endsWith(`.${zone}`)) errors.push(`${name} is outside the ${zone} zone.`);
+    }
+    return { names: effective, errors };
+}
+
+export function sanitizeCertificateRow(row: unknown): CertificateRow {
+    const raw = object(row);
+    const domainRaw = typeof raw.domain === 'number' ? raw.domain : object(raw.domain);
+    const status = normalizeCertificateStatus(raw.status);
+    const commonName = normalizeCertificateName(raw.common_name);
+    return {
+        id: finite(raw.id) ?? 0,
+        created: finite(raw.created) ?? 0,
+        modified: finite(raw.modified) ?? 0,
+        common_name: commonName,
+        sans: normalizeCertificateSans(raw.sans),
+        status,
+        issuer: nullableText(raw.issuer, 255),
+        serial: nullableText(raw.serial, 128),
+        not_before: finite(raw.not_before),
+        not_after: finite(raw.not_after),
+        renew_after: finite(raw.renew_after),
+        last_error: sanitizeCertificateLastError(raw.last_error),
+        attempts: Math.max(0, Math.trunc(finite(raw.attempts) ?? 0)),
+        days_remaining: finite(raw.days_remaining),
+        domain: typeof domainRaw === 'number' ? domainRaw : {
+            id: finite(domainRaw.id) ?? 0,
+            name: normalizeCertificateName(domainRaw.name),
+            provider: nullableText(domainRaw.provider, 32) ?? 'unknown',
+            status: nullableText(domainRaw.status, 32) ?? 'unknown',
+            expires: finite(domainRaw.expires),
+        },
+    };
+}
+
+export function sanitizeAcmeDelegationStatus(value: unknown): AcmeDelegationStatus {
+    const raw = object(value);
+    const state = String(raw.state ?? '').toLowerCase();
+    return {
+        id: finite(raw.id) ?? 0,
+        created: nullableText(raw.created, 64),
+        modified: nullableText(raw.modified, 64),
+        domain: finite(raw.domain),
+        domain_name: normalizeCertificateName(raw.domain_name),
+        source: nullableText(raw.source, 253),
+        target: nullableText(raw.target, 253),
+        state: ['pending', 'verified', 'broken', 'retired'].includes(state)
+            ? state as AcmeDelegationStatus['state']
+            : 'unknown',
+        verified_at: nullableText(raw.verified_at, 64),
+        last_error_code: nullableText(raw.last_error_code, 64)?.replace(/[^a-z0-9_.-]/gi, '') || null,
+    };
+}
+
+/** `renew_after` is authoritative; days remaining is display-only. */
+export function deriveCertificateRenewalHealth(row: CertificateRow, nowSeconds = Date.now() / 1000): CertificateRenewalHealth {
+    if (row.status === 'pending') return 'pending';
+    if (row.status === 'issuing') return 'issuing';
+    if (row.status === 'failed') return 'failed';
+    if (row.status === 'revoked') return 'revoked';
+    if (row.status !== 'active') return 'unknown';
+    if (row.last_error) return 'renewal-error';
+    if (row.renew_after == null) return 'unknown';
+    return row.renew_after <= nowSeconds ? 'due' : 'healthy';
+}
+
+export function isHouseDomain(domain: Pick<DomainRow, 'group'>): boolean {
+    return domain.group == null;
+}
+
+export function canInspectHouseCertificate(domain: Pick<DomainRow, 'group'>, isSuperuser: boolean): boolean {
+    return !isHouseDomain(domain) || isSuperuser;
+}
+
+/**
+ * Readiness mirrors certs.py routing: once a delegation was verified it is
+ * sticky. A broken sticky delegation must be repaired; it never falls back to
+ * direct provider DNS.
+ */
+export function deriveCertificateReadiness(input: {
+    domain: DomainRow;
+    capabilities: DnsCapabilities;
+    delegations?: readonly AcmeDelegationStatus[];
+    credential?: Pick<DnsCredentialRow, 'is_active' | 'verified'> | null;
+}): CertificateReadiness {
+    const { domain, capabilities } = input;
+    if (!capabilities.acme.configured) return { ready: false, mode: 'blocked', label: 'ACME unavailable', reason: 'ACME is not configured on this deployment.' };
+    if (domain.status !== 'active') return { ready: false, mode: 'blocked', label: 'Domain unavailable', reason: 'Certificates can be requested only for active domains.' };
+    const delegations = input.delegations ?? [];
+    const sticky = delegations.find((row) => row.verified_at != null && row.state !== 'retired');
+    if (sticky) {
+        if (sticky.state !== 'verified') return { ready: false, mode: 'blocked', label: 'Delegation broken', reason: 'This verified ACME delegation is sticky and must be repaired; direct DNS fallback is intentionally disabled.' };
+        if (!capabilities.delegated_acme.available) return { ready: false, mode: 'blocked', label: 'Delegation unavailable', reason: 'The delegated ACME service is unavailable.' };
+        return { ready: true, mode: 'delegated', label: 'Delegated DNS-01', reason: null };
+    }
+    if (domain.provider === 'mojo') return { ready: false, mode: 'blocked', label: 'Delegation not verified', reason: 'Certificate-only domains require a verified ACME delegation.' };
+    if (domain.provider === 'godaddy') {
+        const relation = input.credential ?? (typeof domain.credential === 'object' ? domain.credential : null);
+        if (!relation?.is_active || !relation.verified) return { ready: false, mode: 'blocked', label: 'Credential unavailable', reason: 'Direct GoDaddy DNS-01 requires an active, verified provider credential.' };
+    } else if (domain.provider !== 'route53') {
+        return { ready: false, mode: 'blocked', label: 'Provider unsupported', reason: `Certificate issuance is unavailable for ${domain.provider}.` };
+    }
+    return { ready: true, mode: 'direct', label: 'Direct DNS-01', reason: null };
+}
+
+export function certificateStatusTone(value: string): 'success' | 'warning' | 'danger' | 'muted' {
+    const status = normalizeCertificateStatus(value);
+    if (status === 'active') return 'success';
+    if (status === 'failed' || status === 'revoked') return 'danger';
+    if (status === 'pending' || status === 'issuing') return 'warning';
+    return 'muted';
+}

package/src/admin/dns/data.ts

@@ -0,0 +1,32 @@
+import type { DnsCapabilities, DnsProviderCapability, DnsRecordRow, DomainRow } from './models';
+import { recordKey } from './dns-data';
+
+export function providerLabel(provider: string | null | undefined): string {
+    const key = String(provider ?? '').trim().toLowerCase();
+    if (key === 'route53') return 'Route 53';
+    if (key === 'godaddy') return 'GoDaddy';
+    return key ? key.charAt(0).toUpperCase() + key.slice(1) : '—';
+}
+
+export function providerCapability(caps: DnsCapabilities, provider: string): DnsProviderCapability | null {
+    const key = provider.trim().toLowerCase();
+    return caps.providers.find((entry) => entry.name.toLowerCase() === key) ?? null;
+}
+
+export function linkableProviders(caps: DnsCapabilities): DnsProviderCapability[] {
+    return caps.providers.filter((provider) => provider.requires_credential);
+}
+
+export function requiresCredential(provider: string, caps: DnsCapabilities): boolean {
+    return providerCapability(caps, provider)?.requires_credential === true;
+}
+
+export function isManagementOnly(domain: Pick<DomainRow, 'provider'> | string, caps: DnsCapabilities): boolean {
+    const provider = typeof domain === 'string' ? domain : domain.provider;
+    return providerCapability(caps, provider)?.purchase === false;
+}
+
+/** Provider records are live and id-less; type+normalized name is the stable set identity. */
+export function dnsRecordKey(record: Pick<DnsRecordRow, 'type' | 'name'>): string {
+    return recordKey(record);
+}

package/src/admin/dns/dns-data.ts

@@ -0,0 +1,266 @@
+import type { DnsCapabilities, DnsRecordRow } from './models';
+
+export const DNS_RECORD_TYPES = ['A', 'AAAA', 'CNAME', 'TXT', 'MX', 'SRV', 'CAA', 'NS'] as const;
+export type DnsRecordType = (typeof DNS_RECORD_TYPES)[number];
+export const CAA_TAGS = ['issue', 'issuewild', 'iodef'] as const;
+
+export type RecordFieldKind = 'ipv4' | 'ipv6' | 'hostname' | 'uint16' | 'uint8' | 'port' | 'enum' | 'quoted' | 'text';
+export interface RecordFieldSpec { key: string; label: string; kind: RecordFieldKind; default?: string; options?: readonly string[]; width?: string; grow?: boolean }
+export interface RecordSpec { multi: boolean; valuesLabel: string; fields: readonly RecordFieldSpec[] }
+export type StructuredRecordValue = Record<string, string>;
+
+export const RECORD_SPECS: Readonly<Record<DnsRecordType, RecordSpec>> = {
+    A: { multi: true, valuesLabel: 'IPv4 addresses', fields: [{ key: 'ip', label: 'IPv4 address', kind: 'ipv4', grow: true }] },
+    AAAA: { multi: true, valuesLabel: 'IPv6 addresses', fields: [{ key: 'ip', label: 'IPv6 address', kind: 'ipv6', grow: true }] },
+    CNAME: { multi: false, valuesLabel: 'Alias target', fields: [{ key: 'target', label: 'Target', kind: 'hostname', grow: true }] },
+    TXT: { multi: true, valuesLabel: 'Text values', fields: [{ key: 'text', label: 'Value', kind: 'text', grow: true }] },
+    MX: { multi: true, valuesLabel: 'Mail servers', fields: [{ key: 'priority', label: 'Priority', kind: 'uint16', default: '10', width: '96px' }, { key: 'target', label: 'Target', kind: 'hostname', grow: true }] },
+    SRV: { multi: true, valuesLabel: 'Service targets', fields: [{ key: 'priority', label: 'Priority', kind: 'uint16', default: '10', width: '96px' }, { key: 'weight', label: 'Weight', kind: 'uint16', default: '10', width: '96px' }, { key: 'port', label: 'Port', kind: 'port', width: '96px' }, { key: 'target', label: 'Target', kind: 'hostname', grow: true }] },
+    CAA: { multi: true, valuesLabel: 'Certificate authorities', fields: [{ key: 'flags', label: 'Flags', kind: 'uint8', default: '0', width: '86px' }, { key: 'tag', label: 'Tag', kind: 'enum', options: CAA_TAGS, default: 'issue', width: '130px' }, { key: 'value', label: 'Value', kind: 'quoted', grow: true }] },
+    NS: { multi: true, valuesLabel: 'Nameservers', fields: [{ key: 'target', label: 'Nameserver', kind: 'hostname', grow: true }] },
+};
+
+const text = (value: unknown): string => value == null ? '' : String(value);
+const stripDot = (value: string): string => value.replace(/\.+$/, '');
+const stripQuotes = (value: string): string => value.length >= 2 && value.startsWith('"') && value.endsWith('"') ? value.slice(1, -1) : value;
+const LABEL_RE = /^[a-z0-9_](?:[a-z0-9_-]*[a-z0-9_])?$/i;
+
+export function specFor(type: unknown): RecordSpec | null {
+    return RECORD_SPECS[text(type).toUpperCase() as DnsRecordType] ?? null;
+}
+export function blankRecordValue(type: unknown): StructuredRecordValue {
+    return Object.fromEntries((specFor(type)?.fields ?? []).map((field) => [field.key, field.default ?? '']));
+}
+/** Compatibility with the completed web-mojo contract. */
+export const blankValue = blankRecordValue;
+
+export function recordKey(record: Pick<DnsRecordRow, 'type' | 'name'>): string {
+    return `${text(record.type).trim().toUpperCase()}|${stripDot(text(record.name).trim().toLowerCase())}`;
+}
+export function isInZone(recordName: unknown, zone: unknown): boolean {
+    const name = stripDot(text(recordName).trim().toLowerCase());
+    const root = stripDot(text(zone).trim().toLowerCase());
+    return !!root && (name === root || name.endsWith(`.${root}`));
+}
+export function toFqdn(name: unknown, zone: unknown): string {
+    const raw = stripDot(text(name).trim().toLowerCase());
+    const root = stripDot(text(zone).trim().toLowerCase());
+    if (!raw || raw === '@') return root;
+    if (raw.includes('.')) return raw;
+    return root ? `${raw}.${root}` : raw;
+}
+export function relativeRecordName(name: unknown, zone: unknown): string {
+    const fqdn = stripDot(text(name).trim().toLowerCase());
+    const root = stripDot(text(zone).trim().toLowerCase());
+    if (fqdn === root) return '@';
+    return fqdn.endsWith(`.${root}`) ? fqdn.slice(0, -(root.length + 1)) : fqdn;
+}
+export function hasValidLabels(fqdn: unknown): boolean {
+    const raw = stripDot(text(fqdn));
+    return !!raw && raw.length <= 253 && raw.split('.').every((label, index) => label.length <= 63 && (label === '*' ? index === 0 : LABEL_RE.test(label)));
+}
+
+export function isIPv4(value: unknown): boolean {
+    const parts = text(value).trim().split('.');
+    return parts.length === 4 && parts.every((part) => /^(0|[1-9]\d{0,2})$/.test(part) && Number(part) <= 255);
+}
+function ipv6Words(part: string): number | null {
+    if (!part) return 0;
+    const groups = part.split(':');
+    let words = 0;
+    for (let i = 0; i < groups.length; i += 1) {
+        const group = groups[i]!;
+        if (/^[0-9a-f]{1,4}$/i.test(group)) { words += 1; continue; }
+        if (i === groups.length - 1 && isIPv4(group)) { words += 2; continue; }
+        return null;
+    }
+    return words;
+}
+export function isIPv6(value: unknown): boolean {
+    const raw = text(value).trim();
+    if (!raw || raw.includes('%') || !raw.includes(':') || (raw.match(/::/g) ?? []).length > 1) return false;
+    if (raw.includes(':::')) return false;
+    const compressed = raw.includes('::');
+    const [left = '', right = ''] = compressed ? raw.split('::') : [raw, ''];
+    const leftWords = ipv6Words(left);
+    const rightWords = compressed ? ipv6Words(right) : 0;
+    if (leftWords == null || rightWords == null) return false;
+    const total = leftWords + rightWords;
+    return compressed ? total < 8 : total === 8;
+}
+export const isIP = (value: unknown): boolean => isIPv4(value) || isIPv6(value);
+export function isHostname(value: unknown): boolean {
+    const raw = stripDot(text(value).trim());
+    return !!raw && raw.length <= 253 && !isIP(raw) && raw.split('.').length >= 2 && raw.split('.').every((label) => label.length <= 63 && LABEL_RE.test(label));
+}
+const isUint = (value: unknown, max: number): boolean => /^\d+$/.test(text(value).trim()) && Number(text(value).trim()) <= max;
+
+export function isSpentAcmeChallenge(provider: unknown, record: Pick<DnsRecordRow, 'type' | 'name' | 'record_values'>): boolean {
+    return text(provider).toLowerCase() === 'godaddy'
+        && text(record.type).toUpperCase() === 'TXT'
+        && (text(record.name).toLowerCase() === '_acme-challenge' || text(record.name).toLowerCase().startsWith('_acme-challenge.'))
+        && record.record_values.length === 1 && text(record.record_values[0]).trim() === 'retired';
+}
+export const isAcmeChallenge = (record: Pick<DnsRecordRow, 'type' | 'name'>): boolean => text(record.type).toUpperCase() === 'TXT' && text(record.name).toLowerCase().startsWith('_acme-challenge');
+
+export function parseRecordValue(type: unknown, wire: unknown): StructuredRecordValue {
+    const spec = specFor(type);
+    const raw = text(type).toUpperCase() === 'TXT' ? text(wire) : text(wire).trim();
+    if (!spec) return { text: raw };
+    if (spec.fields.length === 1) return { [spec.fields[0]!.key]: spec.fields[0]!.kind === 'quoted' ? stripQuotes(raw) : raw };
+    const parts = raw ? raw.split(/\s+/) : [];
+    return Object.fromEntries(spec.fields.map((field, index) => {
+        const part = index === spec.fields.length - 1 ? parts.slice(index).join(' ') : parts[index] ?? '';
+        return [field.key, field.kind === 'quoted' ? stripQuotes(part) : part];
+    }));
+}
+export function formatRecordValue(type: unknown, value: StructuredRecordValue): string {
+    const spec = specFor(type);
+    if (!spec) return text(value.text).trim();
+    if (text(type).toUpperCase() === 'TXT') return text(value.text);
+    return spec.fields.map((field) => {
+        const raw = text(value[field.key]).trim();
+        return field.kind === 'quoted' && raw ? `"${stripQuotes(raw)}"` : raw;
+    }).filter(Boolean).join(' ');
+}
+/** Shape conversion only: validation, never this helper, detects blanks/duplicates. */
+export function normalizeRecordValues(input: unknown): string[] {
+    if (Array.isArray(input)) return input.map(text);
+    if (input == null) return [];
+    return text(input).split('\n');
+}
+
+const ZERO_WIDTH_RE = /[\u200b\u200c\u200d\ufeff]/g;
+const SMART_REPLACEMENTS: Record<string, string> = { '\u2018': "'", '\u2019': "'", '\u201c': '"', '\u201d': '"' };
+export interface DnsCorrection { field: string; row: number | null; before: string; after: string; message: string }
+function correct(step: DnsCorrection[], field: string, row: number | null, before: string, after: string, message: string): string {
+    if (before !== after) step.push({ field, row, before, after, message });
+    return after;
+}
+export function autofixFieldValue(kind: RecordFieldKind, raw: unknown, field = 'value', row: number | null = null): { value: string; fixes: string[]; corrections: DnsCorrection[] } {
+    const corrections: DnsCorrection[] = [];
+    let value = text(raw);
+    let next = value.replace(ZERO_WIDTH_RE, ''); value = correct(corrections, field, row, value, next, 'Removed invisible characters');
+    next = value.replace(/\u00a0/g, ' '); value = correct(corrections, field, row, value, next, 'Replaced non-breaking spaces');
+    next = value.replace(/[\u2018\u2019\u201c\u201d]/g, (char) => SMART_REPLACEMENTS[char] ?? char); value = correct(corrections, field, row, value, next, 'Replaced curly quotes with plain quotes');
+    next = value.trim(); value = correct(corrections, field, row, value, next, 'Trimmed surrounding whitespace');
+    if (kind === 'hostname') {
+        next = value.replace(/^[a-z][a-z0-9+.-]*:\/\//i, ''); value = correct(corrections, field, row, value, next, 'Removed the URL scheme');
+        next = value.split('/')[0]!; value = correct(corrections, field, row, value, next, 'Removed the URL path');
+        next = stripDot(value); value = correct(corrections, field, row, value, next, 'Removed the trailing dot');
+        next = value.toLowerCase(); value = correct(corrections, field, row, value, next, 'Lowercased the hostname');
+    } else if (kind === 'ipv4' || kind === 'ipv6') {
+        next = value.startsWith('[') && value.endsWith(']') ? value.slice(1, -1) : value;
+        value = correct(corrections, field, row, value, next, 'Removed square brackets');
+    } else if (kind === 'text' || kind === 'quoted') {
+        next = stripQuotes(value); value = correct(corrections, field, row, value, next, 'Removed surrounding quotes');
+    } else if (kind === 'enum') {
+        next = value.toLowerCase(); value = correct(corrections, field, row, value, next, 'Lowercased the value');
+    }
+    return { value, fixes: corrections.map((entry) => entry.message), corrections };
+}
+export function autofixRecordValue(type: unknown, raw: unknown, row: number | null = null): { value: string; parts: StructuredRecordValue; fixes: string[]; corrections: DnsCorrection[] } {
+    const parsed = parseRecordValue(type, raw);
+    const spec = specFor(type);
+    if (!spec) {
+        const result = autofixFieldValue('text', raw, 'text', row);
+        return { value: result.value, parts: { text: result.value }, fixes: result.fixes, corrections: result.corrections };
+    }
+    const parts: StructuredRecordValue = {};
+    const corrections: DnsCorrection[] = [];
+    for (const field of spec.fields) {
+        const result = autofixFieldValue(field.kind, parsed[field.key], field.key, row);
+        parts[field.key] = result.value; corrections.push(...result.corrections);
+    }
+    return { value: formatRecordValue(type, parts), parts, fixes: [...new Set(corrections.map((entry) => entry.message))], corrections };
+}
+
+export interface DnsValidationFix { action: 'change-type' | 'set-name'; type?: string; name?: string; label: string }
+export interface DnsValidationError { index: number | null; field: string; message: string; fix?: DnsValidationFix }
+export interface ValidateRecordSetOptions { type: unknown; name: unknown; values: unknown; ttl: unknown; zone: unknown; existingRecords?: readonly DnsRecordRow[]; caps?: Pick<DnsCapabilities, 'allowed_record_types'> | null; original?: Pick<DnsRecordRow, 'type' | 'name'> | null }
+const validationError = (index: number | null, field: string, message: string, fix?: DnsValidationFix): DnsValidationError => ({ index, field, message, ...(fix ? { fix } : {}) });
+
+export function validateRecordSet(options: ValidateRecordSetOptions): { ok: boolean; errors: DnsValidationError[]; fqdn: string } {
+    const type = text(options.type).toUpperCase();
+    const zone = stripDot(text(options.zone).trim().toLowerCase());
+    const fqdn = toFqdn(options.name, zone);
+    const errors: DnsValidationError[] = [];
+    const allowed = options.caps?.allowed_record_types?.map((entry) => entry.toUpperCase()) ?? [...DNS_RECORD_TYPES];
+    if (!type) errors.push(validationError(null, 'type', 'A record type is required.'));
+    else if (!allowed.includes(type)) errors.push(validationError(null, 'type', `${type} is not an allowed record type (${allowed.join(', ')}).`));
+    if (!fqdn) errors.push(validationError(null, 'name', 'A record name is required.'));
+    else if (zone && !isInZone(fqdn, zone)) errors.push(validationError(null, 'name', `"${fqdn}" is not inside the ${zone} zone.`, { action: 'set-name', name: `${fqdn}.${zone}`, label: `Use ${fqdn}.${zone}` }));
+    else if (!hasValidLabels(fqdn)) errors.push(validationError(null, 'name', fqdn.split('.').includes('*') ? 'A wildcard may only be the leftmost label.' : `"${fqdn}" is not a valid record name.`));
+    const apex = !!zone && fqdn === zone;
+    if (apex && ['NS', 'SOA'].includes(type)) errors.push(validationError(null, 'type', `The apex ${type} record set cannot be changed.`));
+    if (apex && type === 'CNAME') errors.push(validationError(null, 'name', "A CNAME can't sit at the apex."));
+    if (options.original && (recordKey({ type, name: fqdn }) !== recordKey(options.original))) errors.push(validationError(null, 'identity', 'Existing record type and name are immutable.'));
+
+    const originalKey = options.original ? recordKey(options.original) : null;
+    const other = (options.existingRecords ?? []).filter((record) => recordKey(record) !== originalKey && stripDot(record.name.toLowerCase()) === fqdn);
+    if (type === 'CNAME' && other.length) errors.push(validationError(null, 'name', `${fqdn} already has ${other.map((record) => record.type.toUpperCase()).join(', ')}. A CNAME cannot coexist with another record.`));
+    if (type !== 'CNAME' && other.some((record) => record.type.toUpperCase() === 'CNAME')) errors.push(validationError(null, 'name', `${fqdn} is a CNAME. No other record type can share that name.`));
+
+    const values = normalizeRecordValues(options.values);
+    const spec = specFor(type);
+    if (!values.length) errors.push(validationError(null, 'values', 'At least one value is required.'));
+    if (spec && !spec.multi && values.length > 1) errors.push(validationError(null, 'values', `A ${type} record holds exactly one value.`));
+    const seen = new Set<string>();
+    values.forEach((wire, index) => {
+        if (!wire || wire.trim() === '') errors.push(validationError(index, 'value', 'A record value is required.'));
+        else if (type !== 'TXT' && wire.trim() !== wire) errors.push(validationError(index, 'value', 'Apply the visible correction before saving.'));
+        if (seen.has(wire)) errors.push(validationError(index, 'value', 'Duplicate values are not allowed.'));
+        seen.add(wire);
+        const parts = parseRecordValue(type, wire);
+        for (const field of spec?.fields ?? []) {
+            const value = parts[field.key] ?? '';
+            if (!value || (type === 'TXT' && value.trim() === '')) { errors.push(validationError(index, field.key, `${field.label} is required.`)); continue; }
+            if (field.kind === 'ipv4' && !isIPv4(value)) errors.push(validationError(index, field.key, isIPv6(value) ? "That's IPv6 — use AAAA." : `"${value}" is not a valid IPv4 address.`, isIPv6(value) ? { action: 'change-type', type: 'AAAA', label: 'Change type to AAAA' } : undefined));
+            if (field.kind === 'ipv6' && !isIPv6(value)) errors.push(validationError(index, field.key, isIPv4(value) ? "That's IPv4 — use A." : `"${value}" is not a valid IPv6 address.`, isIPv4(value) ? { action: 'change-type', type: 'A', label: 'Change type to A' } : undefined));
+            if (field.kind === 'hostname' && !isHostname(value)) errors.push(validationError(index, field.key, isIP(value) ? `${field.label} must be a hostname, not an IP address.` : `"${value}" is not a valid hostname.`));
+            if (field.kind === 'uint16' && !isUint(value, 65535)) errors.push(validationError(index, field.key, `${field.label} must be 0 to 65535.`));
+            if (field.kind === 'uint8' && !isUint(value, 255)) errors.push(validationError(index, field.key, `${field.label} must be 0 to 255.`));
+            if (field.kind === 'port' && (!isUint(value, 65535) || Number(value) === 0)) errors.push(validationError(index, field.key, 'Port must be 1 to 65535.'));
+            if (field.kind === 'enum' && field.options && !field.options.includes(value.toLowerCase())) errors.push(validationError(index, field.key, `${field.label} must be one of: ${field.options.join(', ')}.`));
+        }
+    });
+    const ttl = Number(options.ttl);
+    if (!Number.isInteger(ttl) || ttl < 60 || ttl > 86400) errors.push(validationError(null, 'ttl', 'TTL must be a whole number of seconds from 60 to 86400.'));
+    return { ok: errors.length === 0, errors, fqdn };
+}
+
+export interface RecordValueDiff { added: string[]; removed: string[]; unchanged: string[] }
+export function diffRecordValues(before: readonly string[] | unknown, after: readonly string[] | unknown): RecordValueDiff {
+    const from = normalizeRecordValues(before); const to = normalizeRecordValues(after);
+    return { added: to.filter((value) => !from.includes(value)), removed: from.filter((value) => !to.includes(value)), unchanged: from.filter((value) => to.includes(value)) };
+}
+export interface RecordSetDiff extends RecordValueDiff { key: string; type: string; name: string; ttl: { before: number | null; after: number | null } }
+export function diffRecordSet(before: DnsRecordRow | null, after: DnsRecordRow | null): RecordSetDiff {
+    const identity = after ?? before ?? { type: '', name: '', record_values: [], ttl: 0 };
+    return { key: recordKey(identity), type: identity.type, name: identity.name, ...diffRecordValues(before?.record_values ?? [], after?.record_values ?? []), ttl: { before: before?.ttl ?? null, after: after?.ttl ?? null } };
+}
+export function recordWarnings(options: { provider?: string; type: unknown; name: unknown; values?: unknown; ttl?: unknown; zone: unknown; existingRecords?: readonly DnsRecordRow[]; before?: unknown; deleting?: boolean }): string[] {
+    const type = text(options.type).toUpperCase(); const fqdn = toFqdn(options.name, options.zone); const values = normalizeRecordValues(options.values); const warnings: string[] = [];
+    const current = (options.existingRecords ?? []).find((record) => recordKey(record) === recordKey({ type, name: fqdn }));
+    if (current && isAcmeChallenge(current) && !isSpentAcmeChallenge(options.provider, current)) warnings.push('This is a live _acme-challenge record. Changing it can fail certificate issuance.');
+    if (['A', 'AAAA'].includes(type) && (fqdn === stripDot(text(options.zone)) || fqdn === `www.${stripDot(text(options.zone))}`) && (options.deleting || !values.length)) warnings.push(`Removing the ${type} record for ${fqdn} will take that address offline.`);
+    if (type === 'MX') warnings.push('Changing MX records changes where mail for this domain is delivered.');
+    if (fqdn.startsWith('*.')) warnings.push('This wildcard record answers for every name without a more specific record.');
+    if (Number(options.ttl) >= 60 && Number(options.ttl) < 300) warnings.push(`A TTL of ${options.ttl}s is very short.`);
+    if (type === 'SRV' && !/^_[^.]+\._[^.]+\./.test(fqdn)) warnings.push('SRV names are normally _service._protocol.name.');
+    const before = normalizeRecordValues(options.before); const removed = diffRecordValues(before, values).removed;
+    if (!options.deleting && removed.length && values.length < before.length) warnings.push(`${before.length - values.length} existing ${before.length - values.length === 1 ? 'value' : 'values'} will be removed.`);
+    return warnings;
+}
+
+export interface RecordOwnerSnapshot { key: string; owner: string; exact: DnsRecordRow | null; ownerRecords: DnsRecordRow[] }
+const cloneRecord = (record: DnsRecordRow): DnsRecordRow => ({ type: record.type, name: record.name, record_values: [...record.record_values], ttl: record.ttl });
+export function snapshotRecordOwner(records: readonly DnsRecordRow[], type: string, name: string): RecordOwnerSnapshot {
+    const key = recordKey({ type, name }); const owner = stripDot(name.toLowerCase());
+    const ownerRecords = records.filter((record) => stripDot(record.name.toLowerCase()) === owner).map(cloneRecord);
+    return { key, owner, exact: ownerRecords.find((record) => recordKey(record) === key) ?? null, ownerRecords };
+}
+export function sameRecordOwnerSnapshot(a: RecordOwnerSnapshot, b: RecordOwnerSnapshot): boolean {
+    const canonical = (snapshot: RecordOwnerSnapshot) => JSON.stringify(snapshot.ownerRecords.map((record) => ({ ...record, type: record.type.toUpperCase(), name: stripDot(record.name.toLowerCase()) })).sort((x, y) => recordKey(x).localeCompare(recordKey(y))));
+    return a.key === b.key && a.owner === b.owner && canonical(a) === canonical(b);
+}

package/src/admin/dns/dns-integration.ts

@@ -0,0 +1,24 @@
+/** Dependency-free DNS composition seam. Keep this safe for client/mock import order. */
+export interface ManagedDnsRecordInput { type: string; name: string; record_values: string[]; ttl: number }
+export interface DnsAdminIntegration {
+    resolveDomainByName?: (normalizedName: string) => Promise<number | null>;
+    recordsHref?: (domainId: number) => string;
+    applyManagedDnsRecords?: (domainId: number, records: readonly ManagedDnsRecordInput[]) => void | Promise<void>;
+}
+
+let integration: DnsAdminIntegration = {};
+export function registerDnsAdminIntegration(adapter: DnsAdminIntegration): () => void {
+    const previous: DnsAdminIntegration = {};
+    for (const key of Object.keys(adapter) as (keyof DnsAdminIntegration)[]) {
+        Object.assign(previous, { [key]: integration[key] });
+        Object.assign(integration, { [key]: adapter[key] });
+    }
+    return () => {
+        for (const key of Object.keys(adapter) as (keyof DnsAdminIntegration)[]) {
+            if (integration[key] === adapter[key]) Object.assign(integration, { [key]: previous[key] });
+        }
+    };
+}
+export function getDnsAdminIntegration(): DnsAdminIntegration | null {
+    return Object.keys(integration).length ? integration : null;
+}

package/src/admin/dns/domain-links.ts

@@ -0,0 +1,37 @@
+import { useSyncExternalStore } from 'react';
+import type { DnsCapabilities, DomainRow } from './models';
+
+export interface DnsDomainLink {
+    key: string;
+    label: string;
+    icon: string;
+    route: string | ((domain: DomainRow) => string);
+    permissions?: string | string[];
+    when?: (domain: DomainRow, capabilities: DnsCapabilities) => boolean;
+    order?: number;
+}
+export const DNS_DOMAIN_LINK_ORDER: Readonly<Record<string, number>> = {
+    domains: 10,
+    records: 20,
+    certificates: 30,
+    purchases: 40,
+    registrant: 50,
+    credentials: 60,
+};
+const links = new Map<string, DnsDomainLink>();
+const listeners = new Set<() => void>();
+let snapshot: readonly DnsDomainLink[] = [];
+const emit = () => {
+    snapshot = [...links.values()].sort((a, b) => (a.order ?? DNS_DOMAIN_LINK_ORDER[a.key] ?? 100) - (b.order ?? DNS_DOMAIN_LINK_ORDER[b.key] ?? 100));
+    listeners.forEach((listener) => listener());
+};
+export function registerDnsDomainLinks(...entries: DnsDomainLink[]): () => void {
+    const prior = new Map<string, DnsDomainLink | undefined>();
+    entries.forEach((entry) => { prior.set(entry.key, links.get(entry.key)); links.set(entry.key, entry); });
+    emit();
+    return () => { entries.forEach((entry) => { if (links.get(entry.key) !== entry) return; const old = prior.get(entry.key); if (old) links.set(entry.key, old); else links.delete(entry.key); }); emit(); };
+}
+export function getDnsDomainLinks(): readonly DnsDomainLink[] { return snapshot; }
+export function useDnsDomainLinks(): readonly DnsDomainLink[] {
+    return useSyncExternalStore((listener) => { listeners.add(listener); return () => listeners.delete(listener); }, getDnsDomainLinks, getDnsDomainLinks);
+}