feat(dns): add db-backed DNS provider, domain, and record management with ops UI support

ts_interfaces/data/dns-provider.ts

@@ -0,0 +1,73 @@
+/**
+ * Supported DNS provider types. Initially Cloudflare; the abstraction is
+ * designed so additional providers (Route53, Gandi, DigitalOcean…) can be
+ * added by implementing the IDnsProvider class interface in ts/dns/providers/.
+ */
+export type TDnsProviderType = 'cloudflare';
+
+/**
+ * Status of the last connection test against a provider.
+ */
+export type TDnsProviderStatus = 'untested' | 'ok' | 'error';
+
+/**
+ * Cloudflare-specific credential shape.
+ */
+export interface ICloudflareCredentials {
+  apiToken: string;
+}
+
+/**
+ * Discriminated union of all supported provider credential shapes.
+ * Persisted opaquely on `IDnsProvider.credentials`.
+ */
+export type TDnsProviderCredentials =
+  | ({ type: 'cloudflare' } & ICloudflareCredentials);
+
+/**
+ * A registered DNS provider account. Holds the credentials needed to
+ * call the provider's API and a snapshot of its last health check.
+ */
+export interface IDnsProvider {
+  id: string;
+  name: string;
+  type: TDnsProviderType;
+  /** Opaque credentials object — shape depends on `type`. */
+  credentials: TDnsProviderCredentials;
+  status: TDnsProviderStatus;
+  lastTestedAt?: number;
+  lastError?: string;
+  createdAt: number;
+  updatedAt: number;
+  createdBy: string;
+}
+
+/**
+ * A redacted view of IDnsProvider safe to send to the UI / over the wire.
+ * Strips secret fields from `credentials` while preserving the rest.
+ */
+export interface IDnsProviderPublic {
+  id: string;
+  name: string;
+  type: TDnsProviderType;
+  status: TDnsProviderStatus;
+  lastTestedAt?: number;
+  lastError?: string;
+  createdAt: number;
+  updatedAt: number;
+  createdBy: string;
+  /** Whether credentials are configured (true after creation). Never the secret itself. */
+  hasCredentials: boolean;
+}
+
+/**
+ * A domain reported by a provider's API (not yet imported into dcrouter).
+ */
+export interface IProviderDomainListing {
+  /** FQDN of the zone (e.g. 'example.com'). */
+  name: string;
+  /** Provider's internal zone identifier (zone_id for Cloudflare). */
+  externalId: string;
+  /** Authoritative nameservers reported by the provider. */
+  nameservers: string[];
+}

ts_interfaces/data/dns-record.ts

@@ -0,0 +1,42 @@
+/**
+ * Supported DNS record types.
+ */
+export type TDnsRecordType = 'A' | 'AAAA' | 'CNAME' | 'MX' | 'TXT' | 'NS' | 'SOA' | 'CAA';
+
+/**
+ * Where a DNS record came from.
+ *
+ * - 'manual' → created in the dcrouter UI / API
+ * - 'synced' → pulled from a provider during a sync operation
+ */
+export type TDnsRecordSource = 'manual' | 'synced';
+
+/**
+ * A DNS record. For manual (authoritative) domains, the record is registered
+ * with the embedded smartdns.DnsServer. For provider-managed domains, the
+ * record is mirrored from / pushed to the provider API and `providerRecordId`
+ * holds the provider's internal record id (for updates and deletes).
+ */
+export interface IDnsRecord {
+  id: string;
+  /** ID of the parent IDomain. */
+  domainId: string;
+  /** Fully qualified record name (e.g. 'www.example.com'). */
+  name: string;
+  type: TDnsRecordType;
+  /**
+   * Record value as a string. For MX records, formatted as
+   * `<priority> <exchange>` (e.g. `10 mail.example.com`).
+   */
+  value: string;
+  /** TTL in seconds. */
+  ttl: number;
+  /** Cloudflare-specific: whether the record is proxied through Cloudflare. */
+  proxied?: boolean;
+  source: TDnsRecordSource;
+  /** Provider's internal record id (for updates/deletes). Only set for provider records. */
+  providerRecordId?: string;
+  createdAt: number;
+  updatedAt: number;
+  createdBy: string;
+}

ts_interfaces/data/domain.ts

@@ -0,0 +1,35 @@
+/**
+ * Where a domain came from / how it is managed.
+ *
+ * - 'manual'   → operator added the domain manually. dcrouter is the
+ *               authoritative DNS server for it; records are served by
+ *               the embedded smartdns.DnsServer.
+ * - 'provider' → domain was imported from an external DNS provider
+ *               (e.g. Cloudflare). The provider stays authoritative;
+ *               dcrouter only reads/writes records via the provider API.
+ */
+export type TDomainSource = 'manual' | 'provider';
+
+/**
+ * A domain under management by dcrouter.
+ */
+export interface IDomain {
+  id: string;
+  /** Fully qualified domain name (e.g. 'example.com'). */
+  name: string;
+  source: TDomainSource;
+  /** ID of the DnsProvider that owns this domain — only set when source === 'provider'. */
+  providerId?: string;
+  /** True when dcrouter is the authoritative DNS server for this domain (source === 'manual'). */
+  authoritative: boolean;
+  /** Authoritative nameservers (display only — populated from provider for imported domains). */
+  nameservers?: string[];
+  /** Provider's internal zone identifier — only set when source === 'provider'. */
+  externalZoneId?: string;
+  /** Last time records were synced from the provider — only set when source === 'provider'. */
+  lastSyncedAt?: number;
+  description?: string;
+  createdAt: number;
+  updatedAt: number;
+  createdBy: string;
+}

ts_interfaces/data/index.ts

@@ -3,4 +3,7 @@ export * from './stats.js';
 export * from './remoteingress.js';
 export * from './route-management.js';
 export * from './target-profile.js';
-export * from './vpn.js';
+export * from './vpn.js';
+export * from './dns-provider.js';
+export * from './domain.js';
+export * from './dns-record.js';

ts_interfaces/data/route-management.ts

@@ -14,7 +14,10 @@ export type TApiTokenScope =
   | 'tokens:read' | 'tokens:manage'
   | 'source-profiles:read' | 'source-profiles:write'
   | 'target-profiles:read' | 'target-profiles:write'
-  | 'targets:read' | 'targets:write';
+  | 'targets:read' | 'targets:write'
+  | 'dns-providers:read' | 'dns-providers:write'
+  | 'domains:read' | 'domains:write'
+  | 'dns-records:read' | 'dns-records:write';
 
 // ============================================================================
 // Source Profile Types (source-side: who can access)