ysk-server-core 1.0.0

package/dist/hosting/dns-validate.d.ts

@@ -0,0 +1,25 @@
+/**
+ * DNS record validation + conflict detection (control-plane honesty).
+ */
+export type DnsRecordLike = {
+    type: string;
+    name: string;
+    value: string;
+    ttl?: number;
+};
+export type DnsValidationIssue = {
+    level: 'error' | 'warn';
+    code: string;
+    message: string;
+    recordIndex?: number;
+};
+/**
+ * Validate a single record shape.
+ */
+export declare function validateDnsRecord(rec: DnsRecordLike, index?: number): DnsValidationIssue[];
+/**
+ * Validate a set of records for conflicts (same name).
+ */
+export declare function validateDnsRecordSet(records: DnsRecordLike[]): DnsValidationIssue[];
+export declare function hasDnsErrors(issues: DnsValidationIssue[]): boolean;
+//# sourceMappingURL=dns-validate.d.ts.map

package/dist/hosting/dns-validate.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"dns-validate.d.ts","sourceRoot":"","sources":["../../src/hosting/dns-validate.ts"],"names":[],"mappings":"AACA;;GAEG;AAEH,MAAM,MAAM,aAAa,GAAG;IAC1B,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,MAAM,CAAC;IACb,KAAK,EAAE,MAAM,CAAC;IACd,GAAG,CAAC,EAAE,MAAM,CAAC;CACd,CAAC;AAEF,MAAM,MAAM,kBAAkB,GAAG;IAC/B,KAAK,EAAE,OAAO,GAAG,MAAM,CAAC;IACxB,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,EAAE,MAAM,CAAC;IAChB,WAAW,CAAC,EAAE,MAAM,CAAC;CACtB,CAAC;AAgCF;;GAEG;AACH,wBAAgB,iBAAiB,CAC/B,GAAG,EAAE,aAAa,EAClB,KAAK,CAAC,EAAE,MAAM,GACb,kBAAkB,EAAE,CA0EtB;AAED;;GAEG;AACH,wBAAgB,oBAAoB,CAClC,OAAO,EAAE,aAAa,EAAE,GACvB,kBAAkB,EAAE,CAqCtB;AAED,wBAAgB,YAAY,CAAC,MAAM,EAAE,kBAAkB,EAAE,GAAG,OAAO,CAElE"}

package/dist/hosting/dns-validate.js

@@ -0,0 +1,145 @@
+import { tl } from 'ysk-server-shared';
+const ALLOWED_TYPES = new Set([
+    'A',
+    'AAAA',
+    'CNAME',
+    'MX',
+    'TXT',
+    'NS',
+    'SRV',
+    'CAA',
+]);
+function normName(n) {
+    const s = (n || '@').trim().toLowerCase();
+    if (!s || s === '@')
+        return '@';
+    return s.replace(/\.$/, '');
+}
+function isIpv4(v) {
+    return /^(\d{1,3}\.){3}\d{1,3}$/.test(v) &&
+        v.split('.').every((o) => {
+            const n = Number(o);
+            return n >= 0 && n <= 255;
+        });
+}
+function isIpv6(v) {
+    // Practical check (not full RFC)
+    return v.includes(':') && v.length >= 2 && v.length <= 45 && !/\s/.test(v);
+}
+/**
+ * Validate a single record shape.
+ */
+export function validateDnsRecord(rec, index) {
+    const issues = [];
+    const type = (rec.type || '').toUpperCase();
+    const name = normName(rec.name);
+    const value = (rec.value || '').trim();
+    const ttl = rec.ttl ?? 300;
+    if (!ALLOWED_TYPES.has(type)) {
+        issues.push({
+            level: 'error',
+            code: 'bad_type',
+            message: tl('notes.auto.t0420', { v0: (rec.type) }),
+            recordIndex: index,
+        });
+    }
+    if (!value) {
+        issues.push({
+            level: 'error',
+            code: 'empty_value',
+            message: tl('notes.auto.n1362'),
+            recordIndex: index,
+        });
+    }
+    if (!Number.isFinite(ttl) || ttl < 30 || ttl > 86400 * 7) {
+        issues.push({
+            level: 'warn',
+            code: 'ttl_range',
+            message: tl('notes.auto.t0421', { v0: (ttl) }),
+            recordIndex: index,
+        });
+    }
+    if (type === 'A' && value && !isIpv4(value)) {
+        issues.push({
+            level: 'error',
+            code: 'bad_a',
+            message: tl('notes.auto.n0070'),
+            recordIndex: index,
+        });
+    }
+    if (type === 'AAAA' && value && !isIpv6(value)) {
+        issues.push({
+            level: 'error',
+            code: 'bad_aaaa',
+            message: tl('notes.auto.n0072'),
+            recordIndex: index,
+        });
+    }
+    if (type === 'MX' && value && !/^\d+\s+\S+/.test(value)) {
+        issues.push({
+            level: 'error',
+            code: 'bad_mx',
+            message: tl('notes.auto.n0132'),
+            recordIndex: index,
+        });
+    }
+    if (type === 'CNAME' && name === '@') {
+        issues.push({
+            level: 'warn',
+            code: 'apex_cname',
+            message: tl('notes.auto.n0219'),
+            recordIndex: index,
+        });
+    }
+    if (type === 'SRV' && value && !/^\d+\s+\d+\s+\d+\s+\S+/.test(value)) {
+        issues.push({
+            level: 'warn',
+            code: 'bad_srv',
+            message: tl('notes.auto.n0184'),
+            recordIndex: index,
+        });
+    }
+    return issues;
+}
+/**
+ * Validate a set of records for conflicts (same name).
+ */
+export function validateDnsRecordSet(records) {
+    const issues = [];
+    records.forEach((r, i) => {
+        issues.push(...validateDnsRecord(r, i));
+    });
+    const byName = new Map();
+    for (const r of records) {
+        const k = normName(r.name);
+        const list = byName.get(k) ?? [];
+        list.push(r);
+        byName.set(k, list);
+    }
+    for (const [name, list] of byName) {
+        const types = list.map((r) => r.type.toUpperCase());
+        if (types.includes('CNAME') && types.some((t) => t !== 'CNAME')) {
+            issues.push({
+                level: 'error',
+                code: 'cname_conflict',
+                message: tl('notes.auto.t0422', { v0: (name) }),
+            });
+        }
+        if (types.filter((t) => t === 'CNAME').length > 1) {
+            // multiple CNAME same name is also bad
+            const cnames = list.filter((r) => r.type.toUpperCase() === 'CNAME');
+            if (new Set(cnames.map((c) => c.value)).size > 1) {
+                issues.push({
+                    level: 'error',
+                    code: 'multi_cname',
+                    message: tl('notes.auto.t0423', { v0: (name) }),
+                });
+            }
+        }
+    }
+    return issues;
+}
+export function hasDnsErrors(issues) {
+    return issues.some((i) => i.level === 'error');
+}
+//# sourceMappingURL=dns-validate.js.map

package/dist/hosting/dns-validate.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"dns-validate.js","sourceRoot":"","sources":["../../src/hosting/dns-validate.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,EAAE,EAAE,MAAM,mBAAmB,CAAC;AAmBvC,MAAM,aAAa,GAAG,IAAI,GAAG,CAAC;IAC5B,GAAG;IACH,MAAM;IACN,OAAO;IACP,IAAI;IACJ,KAAK;IACL,IAAI;IACJ,KAAK;IACL,KAAK;CACN,CAAC,CAAC;AAEH,SAAS,QAAQ,CAAC,CAAS;IACzB,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,GAAG,CAAC,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;IAC1C,IAAI,CAAC,CAAC,IAAI,CAAC,KAAK,GAAG;QAAE,OAAO,GAAG,CAAC;IAChC,OAAO,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;AAC9B,CAAC;AAED,SAAS,MAAM,CAAC,CAAS;IACvB,OAAO,yBAAyB,CAAC,IAAI,CAAC,CAAC,CAAC;QACtC,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,EAAE;YACvB,MAAM,CAAC,GAAG,MAAM,CAAC,CAAC,CAAC,CAAC;YACpB,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,GAAG,CAAC;QAC5B,CAAC,CAAC,CAAC;AACP,CAAC;AAED,SAAS,MAAM,CAAC,CAAS;IACvB,iCAAiC;IACjC,OAAO,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,MAAM,IAAI,CAAC,IAAI,CAAC,CAAC,MAAM,IAAI,EAAE,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;AAC7E,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,iBAAiB,CAC/B,GAAkB,EAClB,KAAc;IAEd,MAAM,MAAM,GAAyB,EAAE,CAAC;IACxC,MAAM,IAAI,GAAG,CAAC,GAAG,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC,WAAW,EAAE,CAAC;IAC5C,MAAM,IAAI,GAAG,QAAQ,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;IAChC,MAAM,KAAK,GAAG,CAAC,GAAG,CAAC,KAAK,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;IACvC,MAAM,GAAG,GAAG,GAAG,CAAC,GAAG,IAAI,GAAG,CAAC;IAE3B,IAAI,CAAC,aAAa,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC;QAC7B,MAAM,CAAC,IAAI,CAAC;YACV,KAAK,EAAE,OAAO;YACd,IAAI,EAAE,UAAU;YAChB,OAAO,EAAE,EAAE,CAAC,kBAAkB,EAAE,EAAE,EAAE,EAAE,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC;YACnD,WAAW,EAAE,KAAK;SACnB,CAAC,CAAC;IACL,CAAC;IACD,IAAI,CAAC,KAAK,EAAE,CAAC;QACX,MAAM,CAAC,IAAI,CAAC;YACV,KAAK,EAAE,OAAO;YACd,IAAI,EAAE,aAAa;YACnB,OAAO,EAAE,EAAE,CAAC,kBAAkB,CAAC;YAC/B,WAAW,EAAE,KAAK;SACnB,CAAC,CAAC;IACL,CAAC;IACD,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,GAAG,GAAG,EAAE,IAAI,GAAG,GAAG,KAAK,GAAG,CAAC,EAAE,CAAC;QACzD,MAAM,CAAC,IAAI,CAAC;YACV,KAAK,EAAE,MAAM;YACb,IAAI,EAAE,WAAW;YACjB,OAAO,EAAE,EAAE,CAAC,kBAAkB,EAAE,EAAE,EAAE,EAAE,CAAC,GAAG,CAAC,EAAE,CAAC;YAC9C,WAAW,EAAE,KAAK;SACnB,CAAC,CAAC;IACL,CAAC;IAED,IAAI,IAAI,KAAK,GAAG,IAAI,KAAK,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC;QAC5C,MAAM,CAAC,IAAI,CAAC;YACV,KAAK,EAAE,OAAO;YACd,IAAI,EAAE,OAAO;YACb,OAAO,EAAE,EAAE,CAAC,kBAAkB,CAAC;YAC/B,WAAW,EAAE,KAAK;SACnB,CAAC,CAAC;IACL,CAAC;IACD,IAAI,IAAI,KAAK,MAAM,IAAI,KAAK,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC;QAC/C,MAAM,CAAC,IAAI,CAAC;YACV,KAAK,EAAE,OAAO;YACd,IAAI,EAAE,UAAU;YAChB,OAAO,EAAE,EAAE,CAAC,kBAAkB,CAAC;YAC/B,WAAW,EAAE,KAAK;SACnB,CAAC,CAAC;IACL,CAAC;IACD,IAAI,IAAI,KAAK,IAAI,IAAI,KAAK,IAAI,CAAC,YAAY,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC;QACxD,MAAM,CAAC,IAAI,CAAC;YACV,KAAK,EAAE,OAAO;YACd,IAAI,EAAE,QAAQ;YACd,OAAO,EAAE,EAAE,CAAC,kBAAkB,CAAC;YAC/B,WAAW,EAAE,KAAK;SACnB,CAAC,CAAC;IACL,CAAC;IACD,IAAI,IAAI,KAAK,OAAO,IAAI,IAAI,KAAK,GAAG,EAAE,CAAC;QACrC,MAAM,CAAC,IAAI,CAAC;YACV,KAAK,EAAE,MAAM;YACb,IAAI,EAAE,YAAY;YAClB,OAAO,EAAE,EAAE,CAAC,kBAAkB,CAAC;YAC/B,WAAW,EAAE,KAAK;SACnB,CAAC,CAAC;IACL,CAAC;IACD,IAAI,IAAI,KAAK,KAAK,IAAI,KAAK,IAAI,CAAC,wBAAwB,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC;QACrE,MAAM,CAAC,IAAI,CAAC;YACV,KAAK,EAAE,MAAM;YACb,IAAI,EAAE,SAAS;YACf,OAAO,EAAE,EAAE,CAAC,kBAAkB,CAAC;YAC/B,WAAW,EAAE,KAAK;SACnB,CAAC,CAAC;IACL,CAAC;IAED,OAAO,MAAM,CAAC;AAChB,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,oBAAoB,CAClC,OAAwB;IAExB,MAAM,MAAM,GAAyB,EAAE,CAAC;IACxC,OAAO,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE;QACvB,MAAM,CAAC,IAAI,CAAC,GAAG,iBAAiB,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;IAC1C,CAAC,CAAC,CAAC;IAEH,MAAM,MAAM,GAAG,IAAI,GAAG,EAA2B,CAAC;IAClD,KAAK,MAAM,CAAC,IAAI,OAAO,EAAE,CAAC;QACxB,MAAM,CAAC,GAAG,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;QAC3B,MAAM,IAAI,GAAG,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;QACjC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QACb,MAAM,CAAC,GAAG,CAAC,CAAC,EAAE,IAAI,CAAC,CAAC;IACtB,CAAC;IAED,KAAK,MAAM,CAAC,IAAI,EAAE,IAAI,CAAC,IAAI,MAAM,EAAE,CAAC;QAClC,MAAM,KAAK,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,WAAW,EAAE,CAAC,CAAC;QACpD,IAAI,KAAK,CAAC,QAAQ,CAAC,OAAO,CAAC,IAAI,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,KAAK,OAAO,CAAC,EAAE,CAAC;YAChE,MAAM,CAAC,IAAI,CAAC;gBACV,KAAK,EAAE,OAAO;gBACd,IAAI,EAAE,gBAAgB;gBACtB,OAAO,EAAE,EAAE,CAAC,kBAAkB,EAAE,EAAE,EAAE,EAAE,CAAC,IAAI,CAAC,EAAE,CAAC;aAChD,CAAC,CAAC;QACL,CAAC;QACD,IAAI,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,KAAK,OAAO,CAAC,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YAClD,uCAAuC;YACvC,MAAM,MAAM,GAAG,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,WAAW,EAAE,KAAK,OAAO,CAAC,CAAC;YACpE,IAAI,IAAI,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,GAAG,CAAC,EAAE,CAAC;gBACjD,MAAM,CAAC,IAAI,CAAC;oBACV,KAAK,EAAE,OAAO;oBACd,IAAI,EAAE,aAAa;oBACnB,OAAO,EAAE,EAAE,CAAC,kBAAkB,EAAE,EAAE,EAAE,EAAE,CAAC,IAAI,CAAC,EAAE,CAAC;iBAChD,CAAC,CAAC;YACL,CAAC;QACH,CAAC;IACH,CAAC;IAED,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,MAAM,UAAU,YAAY,CAAC,MAA4B;IACvD,OAAO,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,KAAK,KAAK,OAAO,CAAC,CAAC;AACjD,CAAC"}

package/dist/hosting/dns-zone.d.ts

@@ -0,0 +1,112 @@
+/**
+ * Managed BIND-style zone files under dataDir.
+ * Never fakes success: named-checkzone / reload only when EXECUTE + binary present.
+ */
+import type { HostExecutor } from '../host/executor.js';
+import { type DnsRecordPlan, type DnsZoneTemplate } from './extras.js';
+export interface ZoneFileResult {
+    ok: boolean;
+    zone: string;
+    zonePath: string;
+    serial: number;
+    records: DnsRecordPlan['records'];
+    notes: string[];
+    written: string[];
+    commandResults: Array<{
+        argv: string[];
+        exitCode: number;
+        stderr: string;
+    }>;
+    requiresExecute: boolean;
+    validated?: boolean;
+    /** true only when nameserver reload succeeded */
+    reloaded?: boolean;
+    /** written | applied | failed (honest) */
+    applyStatus: 'written' | 'applied' | 'failed';
+}
+/**
+ * Render RFC1035 master zone: SOA + NS + ns1 A[/AAAA], then data records.
+ */
+export declare function renderBindZoneFile(input: {
+    zone: string;
+    serverIp: string;
+    /** Optional public IPv6 for AAAA (ns1 + apex template) */
+    serverIpv6?: string;
+    mailHost?: string;
+    serial?: number;
+    ttl?: number;
+    nsName?: string;
+    /** Optional secondary nameserver (FQDN, with or without trailing dot) */
+    ns2Name?: string;
+    /** SOA RNAME hostmaster mailbox (defaults hostmaster.<zone>.) */
+    hostmaster?: string;
+    /** SOA timing (seconds) */
+    soaRefresh?: number;
+    soaRetry?: number;
+    soaExpire?: number;
+    soaMinimum?: number;
+    /** Data records (A/MX/TXT/…); if omitted, uses planDnsZone template */
+    records?: DnsRecordPlan['records'];
+    template?: DnsZoneTemplate | string;
+}): {
+    body: string;
+    serial: number;
+    records: DnsRecordPlan['records'];
+};
+/**
+ * Write zone file under dataDir/dns/zones/<zone>.zone
+ * Optionally validate (named-checkzone) and reload nameserver.
+ */
+export declare function writeManagedDnsZone(input: {
+    dataDir: string;
+    zone: string;
+    serverIp: string;
+    serverIpv6?: string;
+    mailHost?: string;
+    host?: HostExecutor;
+    /** Run named-checkzone if available (needs EXECUTE) */
+    validate?: boolean;
+    /** Attempt named/bind9/pdns reload when EXECUTE */
+    tryReload?: boolean;
+    records?: DnsRecordPlan['records'];
+    template?: DnsZoneTemplate | string;
+    nsName?: string;
+    ns2Name?: string;
+    hostmaster?: string;
+    ttl?: number;
+    soaRefresh?: number;
+    soaRetry?: number;
+    soaExpire?: number;
+    soaMinimum?: number;
+}): Promise<ZoneFileResult>;
+/**
+ * Reload classic BIND (rndc/named/bind9). Optionally try pdns unit reload.
+ *
+ * Warning: `systemctl reload pdns` alone does NOT register zones for bindbackend.
+ * Callers that need PowerDNS authority must use syncPowerDnsBindZones first and
+ * must not treat pure pdns reload as "applied".
+ */
+export declare function tryReloadClassicNameserver(host: HostExecutor, notes: string[], commandResults: ZoneFileResult['commandResults'], opts?: {
+    includePdns?: boolean;
+}): Promise<boolean>;
+/**
+ * Remove managed zone file + meta under dataDir (does not touch PowerDNS by itself).
+ */
+export declare function removeManagedDnsZoneFiles(dataDir: string, zone: string): {
+    ok: boolean;
+    removed: string[];
+    notes: string[];
+};
+/**
+ * List managed zone files under dataDir/dns/zones.
+ */
+export declare function listManagedDnsZones(dataDir: string): Array<{
+    zone: string;
+    zonePath: string;
+    metaPath?: string;
+    serial?: number;
+    serverIp?: string;
+    updatedAt?: string;
+    template?: string;
+}>;
+//# sourceMappingURL=dns-zone.d.ts.map

package/dist/hosting/dns-zone.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"dns-zone.d.ts","sourceRoot":"","sources":["../../src/hosting/dns-zone.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAYH,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,qBAAqB,CAAC;AAExD,OAAO,EAGL,KAAK,aAAa,EAClB,KAAK,eAAe,EACrB,MAAM,aAAa,CAAC;AAErB,MAAM,WAAW,cAAc;IAC7B,EAAE,EAAE,OAAO,CAAC;IACZ,IAAI,EAAE,MAAM,CAAC;IACb,QAAQ,EAAE,MAAM,CAAC;IACjB,MAAM,EAAE,MAAM,CAAC;IACf,OAAO,EAAE,aAAa,CAAC,SAAS,CAAC,CAAC;IAClC,KAAK,EAAE,MAAM,EAAE,CAAC;IAChB,OAAO,EAAE,MAAM,EAAE,CAAC;IAClB,cAAc,EAAE,KAAK,CAAC;QAAE,IAAI,EAAE,MAAM,EAAE,CAAC;QAAC,QAAQ,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IAC5E,eAAe,EAAE,OAAO,CAAC;IACzB,SAAS,CAAC,EAAE,OAAO,CAAC;IACpB,iDAAiD;IACjD,QAAQ,CAAC,EAAE,OAAO,CAAC;IACnB,0CAA0C;IAC1C,WAAW,EAAE,SAAS,GAAG,SAAS,GAAG,QAAQ,CAAC;CAC/C;AAoCD;;GAEG;AACH,wBAAgB,kBAAkB,CAAC,KAAK,EAAE;IACxC,IAAI,EAAE,MAAM,CAAC;IACb,QAAQ,EAAE,MAAM,CAAC;IACjB,0DAA0D;IAC1D,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,yEAAyE;IACzE,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,iEAAiE;IACjE,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,2BAA2B;IAC3B,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,uEAAuE;IACvE,OAAO,CAAC,EAAE,aAAa,CAAC,SAAS,CAAC,CAAC;IACnC,QAAQ,CAAC,EAAE,eAAe,GAAG,MAAM,CAAC;CACrC,GAAG;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,aAAa,CAAC,SAAS,CAAC,CAAA;CAAE,CA+FtE;AAED;;;GAGG;AACH,wBAAsB,mBAAmB,CAAC,KAAK,EAAE;IAC/C,OAAO,EAAE,MAAM,CAAC;IAChB,IAAI,EAAE,MAAM,CAAC;IACb,QAAQ,EAAE,MAAM,CAAC;IACjB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,IAAI,CAAC,EAAE,YAAY,CAAC;IACpB,uDAAuD;IACvD,QAAQ,CAAC,EAAE,OAAO,CAAC;IACnB,mDAAmD;IACnD,SAAS,CAAC,EAAE,OAAO,CAAC;IACpB,OAAO,CAAC,EAAE,aAAa,CAAC,SAAS,CAAC,CAAC;IACnC,QAAQ,CAAC,EAAE,eAAe,GAAG,MAAM,CAAC;IACpC,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,UAAU,CAAC,EAAE,MAAM,CAAC;CACrB,GAAG,OAAO,CAAC,cAAc,CAAC,CA6H1B;AAED;;;;;;GAMG;AACH,wBAAsB,0BAA0B,CAC9C,IAAI,EAAE,YAAY,EAClB,KAAK,EAAE,MAAM,EAAE,EACf,cAAc,EAAE,cAAc,CAAC,gBAAgB,CAAC,EAChD,IAAI,CAAC,EAAE;IAAiE,WAAW,CAAC,EAAE,OAAO,CAAA;CAAE,GAC9F,OAAO,CAAC,OAAO,CAAC,CA6BlB;AAED;;GAEG;AACH,wBAAgB,yBAAyB,CACvC,OAAO,EAAE,MAAM,EACf,IAAI,EAAE,MAAM,GACX;IAAE,EAAE,EAAE,OAAO,CAAC;IAAC,OAAO,EAAE,MAAM,EAAE,CAAC;IAAC,KAAK,EAAE,MAAM,EAAE,CAAA;CAAE,CAoBrD;AAED;;GAEG;AACH,wBAAgB,mBAAmB,CAAC,OAAO,EAAE,MAAM,GAAG,KAAK,CAAC;IAC1D,IAAI,EAAE,MAAM,CAAC;IACb,QAAQ,EAAE,MAAM,CAAC;IACjB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,QAAQ,CAAC,EAAE,MAAM,CAAC;CACnB,CAAC,CAsCD"}

package/dist/hosting/dns-zone.js

@@ -0,0 +1,365 @@
+/**
+ * Managed BIND-style zone files under dataDir.
+ * Never fakes success: named-checkzone / reload only when EXECUTE + binary present.
+ */
+import { mkdirSync, writeFileSync, readdirSync, existsSync, readFileSync, unlinkSync, } from 'node:fs';
+import { join } from 'node:path';
+import { ErrorCodes, YskError, tl } from 'ysk-server-shared';
+import { ipFamily, isValidIp, normalizeIp } from '../net/ip.js';
+import { normalizeDnsZoneTemplate, planDnsZone, } from './extras.js';
+function assertZoneName(zone) {
+    const z = zone.trim().toLowerCase().replace(/\.$/, '');
+    if (!z || z.length > 253 || !/^[a-z0-9]([a-z0-9.-]*[a-z0-9])?$/i.test(z) || z.includes('..')) {
+        throw new YskError(ErrorCodes.VALIDATION, tl('notes.auto.n0483'), {
+            httpStatus: 400,
+            details: { zone },
+        });
+    }
+    return z;
+}
+function assertIpv4(ip) {
+    const n = normalizeIp(ip);
+    if (!n || ipFamily(n) !== 4) {
+        throw new YskError(ErrorCodes.VALIDATION, tl('notes.auto.n0429'), {
+            httpStatus: 400,
+            details: { ip },
+        });
+    }
+    return n;
+}
+function assertIpv6Optional(ip) {
+    if (ip == null || !String(ip).trim())
+        return undefined;
+    const n = normalizeIp(ip);
+    if (!n || ipFamily(n) !== 6) {
+        throw new YskError(ErrorCodes.VALIDATION, tl('notes.auto.n0430'), {
+            httpStatus: 400,
+            details: { ip },
+        });
+    }
+    return n;
+}
+/**
+ * Render RFC1035 master zone: SOA + NS + ns1 A[/AAAA], then data records.
+ */
+export function renderBindZoneFile(input) {
+    const zone = assertZoneName(input.zone);
+    const serverIp = assertIpv4(input.serverIp);
+    const serverIpv6 = assertIpv6Optional(input.serverIpv6);
+    const serial = input.serial ??
+        Number(`${new Date().getUTCFullYear()}${String(new Date().getUTCMonth() + 1).padStart(2, '0')}${String(new Date().getUTCDate()).padStart(2, '0')}${String(new Date().getUTCHours()).padStart(2, '0')}`);
+    const ttl = input.ttl ?? 300;
+    const clamp = (n, def, min, max) => {
+        if (n == null || !Number.isFinite(n))
+            return def;
+        return Math.min(max, Math.max(min, Math.floor(n)));
+    };
+    const refresh = clamp(input.soaRefresh, 7200, 300, 86400 * 7);
+    const retry = clamp(input.soaRetry, 3600, 300, 86400);
+    const expire = clamp(input.soaExpire, 1209600, 86400, 86400 * 365);
+    const minimum = clamp(input.soaMinimum, ttl, 30, 86400 * 7);
+    let ns = (input.nsName ?? `ns1.${zone}.`).trim();
+    if (!ns.endsWith('.'))
+        ns = `${ns}.`;
+    let ns2 = (input.ns2Name ?? '').trim();
+    if (ns2 && !ns2.endsWith('.'))
+        ns2 = `${ns2}.`;
+    let rname = (input.hostmaster ?? `hostmaster.${zone}.`).trim().replace(/@/g, '.');
+    if (!rname.endsWith('.'))
+        rname = `${rname}.`;
+    const dataRecords = input.records ??
+        planDnsZone({
+            zone,
+            serverIp,
+            serverIpv6,
+            mailHost: input.mailHost,
+            template: input.template,
+        }).records;
+    const lines = [
+        `; YSK Server managed zone — ${zone}`,
+        `; written ≠ authoritative until nameserver reloads this file`,
+        `$TTL ${ttl}`,
+        `$ORIGIN ${zone}.`,
+        `@\tIN\tSOA\t${ns}\t${rname}\t(`,
+        `\t\t${serial}\t; serial`,
+        `\t\t${refresh}\t\t; refresh`,
+        `\t\t${retry}\t\t; retry`,
+        `\t\t${expire}\t\t; expire`,
+        `\t\t${minimum}\t\t; minimum`,
+        `\t\t)`,
+        `@\tIN\tNS\t${ns}`,
+    ];
+    if (ns2) {
+        lines.push(`@\tIN\tNS\t${ns2}`);
+    }
+    lines.push(`ns1\tIN\tA\t${serverIp}`);
+    if (serverIpv6) {
+        lines.push(`ns1\tIN\tAAAA\t${serverIpv6}`);
+    }
+    for (const r of dataRecords) {
+        const name = r.name === '@' ? '@' : r.name.replace(/\.$/, '');
+        if (r.type === 'TXT') {
+            lines.push(`${name}\tIN\tTXT\t"${String(r.value).replace(/"/g, '\\"')}"`);
+        }
+        else if (r.type === 'CNAME') {
+            const v = r.value.endsWith('.') ? r.value : `${r.value}.`;
+            lines.push(`${name}\tIN\tCNAME\t${v}`);
+        }
+        else if (r.type === 'A' || r.type === 'AAAA') {
+            // Validate address family for safety
+            if (r.type === 'A' && isValidIp(r.value) && ipFamily(r.value) !== 4) {
+                throw new YskError(ErrorCodes.VALIDATION, tl('notes.auto.n0069'), {
+                    httpStatus: 400,
+                    details: { value: r.value },
+                });
+            }
+            if (r.type === 'AAAA' && isValidIp(r.value) && ipFamily(r.value) !== 6) {
+                throw new YskError(ErrorCodes.VALIDATION, tl('notes.auto.n0071'), {
+                    httpStatus: 400,
+                    details: { value: r.value },
+                });
+            }
+            lines.push(`${name}\tIN\t${r.type}\t${r.value}`);
+        }
+        else if (r.type === 'MX') {
+            lines.push(`${name}\tIN\tMX\t${r.value}`);
+        }
+        else if (r.type === 'NS') {
+            const v = r.value.endsWith('.') ? r.value : `${r.value}.`;
+            lines.push(`${name}\tIN\tNS\t${v}`);
+        }
+        else if (r.type === 'SRV' || r.type === 'CAA') {
+            lines.push(`${name}\tIN\t${r.type}\t${r.value}`);
+        }
+    }
+    // Optional apex/www AAAA when serverIpv6 set and template records lack AAAA
+    if (serverIpv6 && !dataRecords.some((r) => r.type === 'AAAA')) {
+        lines.push(`@\tIN\tAAAA\t${serverIpv6}`);
+        lines.push(`www\tIN\tAAAA\t${serverIpv6}`);
+    }
+    lines.push('');
+    return { body: lines.join('\n'), serial, records: dataRecords };
+}
+/**
+ * Write zone file under dataDir/dns/zones/<zone>.zone
+ * Optionally validate (named-checkzone) and reload nameserver.
+ */
+export async function writeManagedDnsZone(input) {
+    const zone = assertZoneName(input.zone);
+    const template = normalizeDnsZoneTemplate(input.template);
+    const rendered = renderBindZoneFile({
+        zone,
+        serverIp: input.serverIp,
+        serverIpv6: input.serverIpv6,
+        mailHost: input.mailHost,
+        records: input.records,
+        template,
+        nsName: input.nsName,
+        ns2Name: input.ns2Name,
+        hostmaster: input.hostmaster,
+        ttl: input.ttl,
+        soaRefresh: input.soaRefresh,
+        soaRetry: input.soaRetry,
+        soaExpire: input.soaExpire,
+        soaMinimum: input.soaMinimum,
+    });
+    const dir = join(input.dataDir, 'dns', 'zones');
+    mkdirSync(dir, { recursive: true });
+    const zonePath = join(dir, `${zone}.zone`);
+    writeFileSync(zonePath, rendered.body, 'utf8');
+    const metaPath = join(dir, `${zone}.json`);
+    writeFileSync(metaPath, JSON.stringify({
+        zone,
+        serverIp: input.serverIp,
+        ...(input.serverIpv6 ? { serverIpv6: input.serverIpv6 } : {}),
+        mailHost: input.mailHost ?? `mail.${zone}`,
+        serial: rendered.serial,
+        template,
+        nsName: input.nsName ?? `ns1.${zone}.`,
+        ttl: input.ttl ?? 300,
+        records: rendered.records,
+        zonePath,
+        updatedAt: new Date().toISOString(),
+    }, null, 2) + '\n', 'utf8');
+    const notes = [
+        `Zone file: ${zonePath}`,
+        `Serial: ${rendered.serial}`,
+        `Template data RRs: ${rendered.records.length}`,
+    ];
+    const written = [zonePath, metaPath];
+    const commandResults = [];
+    let validated;
+    let reloaded = false;
+    const wantValidate = Boolean(input.validate);
+    const wantReload = Boolean(input.tryReload);
+    const canExecute = Boolean(input.host?.executeEnabled());
+    if ((wantValidate || wantReload) && !canExecute) {
+        notes.push(tl('notes.auto.n0988'));
+    }
+    if (wantValidate && canExecute && input.host) {
+        const { binPresent } = await import('./software-probe/index.js');
+        if (await binPresent(input.host, 'named-checkzone')) {
+            const r = await input.host.runCommand(['named-checkzone', zone, zonePath], {
+                timeoutMs: 15_000,
+            });
+            commandResults.push({
+                argv: ['named-checkzone', zone, zonePath],
+                exitCode: r.exitCode,
+                stderr: r.stderr,
+            });
+            validated = r.exitCode === 0;
+            notes.push(validated
+                ? 'named-checkzone: OK'
+                : `named-checkzone failed: ${r.stderr || r.stdout}`);
+        }
+        else {
+            notes.push(tl('notes.auto.n0337'));
+            validated = undefined;
+        }
+    }
+    // Reload only if validation did not fail
+    if (wantReload && canExecute && input.host && validated !== false) {
+        // Prefer classic named/bind9; pure pdns reload alone does not load zones
+        reloaded = await tryReloadClassicNameserver(input.host, notes, commandResults, {
+            includePdns: true,
+        });
+    }
+    else if (wantReload && canExecute && validated === false) {
+        notes.push(tl('notes.auto.n1257'));
+    }
+    let applyStatus = 'written';
+    let ok = true;
+    if (validated === false) {
+        applyStatus = 'failed';
+        ok = false;
+    }
+    else if (reloaded) {
+        applyStatus = 'applied';
+        notes.push(tl('notes.auto.n1236'));
+    }
+    else {
+        applyStatus = 'written';
+        notes.push(tl('notes.auto.n1237'));
+    }
+    return {
+        ok,
+        zone,
+        zonePath,
+        serial: rendered.serial,
+        records: rendered.records,
+        notes,
+        written,
+        commandResults,
+        requiresExecute: (wantValidate || wantReload) && !canExecute,
+        validated,
+        reloaded,
+        applyStatus,
+    };
+}
+/**
+ * Reload classic BIND (rndc/named/bind9). Optionally try pdns unit reload.
+ *
+ * Warning: `systemctl reload pdns` alone does NOT register zones for bindbackend.
+ * Callers that need PowerDNS authority must use syncPowerDnsBindZones first and
+ * must not treat pure pdns reload as "applied".
+ */
+export async function tryReloadClassicNameserver(host, notes, commandResults, opts) {
+    const attempts = [
+        ['rndc', 'reload'],
+        ['systemctl', 'reload', 'named'],
+        ['systemctl', 'reload', 'bind9'],
+    ];
+    if (opts?.includePdns) {
+        attempts.push(['systemctl', 'reload', 'pdns']);
+    }
+    for (const argv of attempts) {
+        if (argv[0] !== 'systemctl') {
+            const { binPresent } = await import('./software-probe/index.js');
+            if (!(await binPresent(host, argv[0])))
+                continue;
+        }
+        if (argv[0] === 'systemctl') {
+            const unit = argv[2];
+            const active = await host.runCommand(['systemctl', 'is-active', unit], { timeoutMs: 5_000 });
+            if ((active.stdout || '').trim() !== 'active')
+                continue;
+        }
+        const r = await host.runCommand(argv, { timeoutMs: 15_000 });
+        commandResults.push({ argv, exitCode: r.exitCode, stderr: r.stderr });
+        if (r.exitCode === 0) {
+            notes.push(`nameserver reload OK: ${argv.join(' ')}`);
+            return true;
+        }
+        notes.push(tl('notes.auto.t0170', { v0: (argv.join(' ')), v1: ((r.stderr || r.stdout).trim()) }));
+    }
+    notes.push(tl('notes.auto.n0857'));
+    return false;
+}
+/**
+ * Remove managed zone file + meta under dataDir (does not touch PowerDNS by itself).
+ */
+export function removeManagedDnsZoneFiles(dataDir, zone) {
+    const z = zone.trim().toLowerCase().replace(/\.$/, '');
+    const removed = [];
+    const notes = [];
+    if (!z)
+        return { ok: false, removed, notes: ['empty zone'] };
+    const dir = join(dataDir, 'dns', 'zones');
+    for (const f of [`${z}.zone`, `${z}.json`]) {
+        const p = join(dir, f);
+        if (existsSync(p)) {
+            try {
+                unlinkSync(p);
+                removed.push(p);
+            }
+            catch (e) {
+                notes.push(`failed to remove ${p}: ${e instanceof Error ? e.message : String(e)}`);
+            }
+        }
+    }
+    if (removed.length === 0)
+        notes.push(`no managed files for ${z}`);
+    else
+        notes.push(`removed ${removed.length} file(s) for ${z}`);
+    return { ok: notes.every((n) => !n.startsWith('failed')), removed, notes };
+}
+/**
+ * List managed zone files under dataDir/dns/zones.
+ */
+export function listManagedDnsZones(dataDir) {
+    const dir = join(dataDir, 'dns', 'zones');
+    if (!existsSync(dir))
+        return [];
+    const files = readdirSync(dir).filter((f) => f.endsWith('.zone'));
+    return files.map((f) => {
+        const zone = f.replace(/\.zone$/, '');
+        const zonePath = join(dir, f);
+        const metaPath = join(dir, `${zone}.json`);
+        let serial;
+        let serverIp;
+        let updatedAt;
+        let template;
+        if (existsSync(metaPath)) {
+            try {
+                const meta = JSON.parse(readFileSync(metaPath, 'utf8'));
+                serial = meta.serial;
+                serverIp = meta.serverIp;
+                updatedAt = meta.updatedAt;
+                template = meta.template;
+            }
+            catch {
+                /* ignore */
+            }
+        }
+        return {
+            zone,
+            zonePath,
+            metaPath: existsSync(metaPath) ? metaPath : undefined,
+            serial,
+            serverIp,
+            updatedAt,
+            template,
+        };
+    });
+}
+//# sourceMappingURL=dns-zone.js.map