NEW powerdns.js adapter: PowerDNS Authoritative HTTP API (X-API-Key).
Full parity (zones + native RRset enumeration — no AXFR needed):
listZones/listRecords, additive create that merges with existing rrset
contents and FAILS CLOSED when the rrset cannot be read (blind REPLACE
would erase values), content-level delete with positive value-presence
proof (absent rrset/value → not-found with ZERO writes; empty/null value
rejected; only genuine whole-rrset intent issues DELETE), TTL preserved
in REPLACE payloads and on additive creates, cross-zone qualification via
the server-resolved zone id/name, case-insensitive rrset matching,
dig-based resolve against the DNS listener (distinct from the API port),
error guidance naming the exact pdns.conf prerequisite.
WIZARD SERIALISATION EXTRACTED to shared js/dns-provider-config.js
(browser global + module.exports): per-provider port defaults
(PowerDNS 8081, RFC2136 53, legacy Technitium 5380), strict port
validation (full-string digits, 1-65535), provider-specific aliases
(server/apiPort/dnsPort/apiToken). The backend tests now execute the
EXACT shipped wizard code, joined through the real createProviderDnsContext
factory to adapter authentication (X-API-Key asserted). provider-dns.js
dual-accepts generic wizard keys and provider-specific fields and
normalises ports to integers (fixes the same latent gap for rfc2136).
Also fixed: rfc2136 parity-matrix rows now exact-sorted-equality across
all five adapters; wizard confirmation summary uses the provider default.
Judge: 7 rounds — r1 C (silent-erase on failed read, cross-zone bug,
missing resolve tests) → r2 C (deleteRecord positive-proof semantics) →
r3 C (TTL in REPLACE, count honesty) → r4 C (empty-value fall-through)
→ r5 C (wizard ip/port/token vs builder field mismatch) → r6 C (5380
default defeating provider ports, untested serialisation) → r7 B zero
blockers (urn:ump:ez33fpgyydl3nyjnwaaplisz7slunupcf5dnr42pdblwx7chfcma).
Post-grade polish applied: strict port validation + range, summary uses
provider defaults, joined serialisation→factory→adapter test, invalid
port table tests.
Suite: backend 176 suites / 3791 tests, frontend 68/68.
Deploy gate dc-prod-deploy-dc171 (grade D, urn:ump:iesjvepuqb5poim7wu22ff4jtd5vhpw2lotfhogljemsw2h4y6vq)
blocked the cutover: listRecords built 'dig @srv -p port AXFR zone', but
dig's documented positional contract is [name] [type]. BIND 9.18 accepts
either order (live-checked), so the bug was invisible on this host's dig;
older 9.11-9.16 on other distros follow the documented order. Fixed to
'zone AXFR', test asserts the production argv, and the corrected code path
was LIVE-VERIFIED against a real DNS server: actual AXFR of zone 'sami'
via the adapter itself — 48 records parsed (SOA/A/NS), zero mocked pieces.
Parity suite: 24/24.
RFC2136/BIND9 adapter gains listRecords via AXFR zone transfer (dig with
the same TSIG identity as nsupdate; temp 0600 keyfile, always cleaned up;
transfer-denial errors carry the exact allow-transfer fix). TSIG fields
validated (name charset, HMAC algorithm whitelist, base64 secret) before
keyfile interpolation.
Capability honesty at every surface: GET /dns/records 501s name the active
provider + its supported capabilities + zone-transfer pointer; MCP
dashcaddy_list_dns attaches actionable guidance for AI clients; setup
wizard shows per-provider capability hints at choice time (parity-pinned
by tests against the adapters).
Also fixed a latent rfc2136 bug: this._log instance property shadowed the
prototype logging method — every nsupdate call threw since the DC-170-era
refactor. CHANGELOG stale 'protocol-impossible' DC-171 entry superseded.
Judge: grade B, zero blockers (urn:ump:wokpmecjfauc7jvnxyyyu4fq3zkkvwge455a5mxlmi3pdzkfdw3a).
Polish applied post-grade: stale changelog entry corrected, TSIG field
validation + 4 extra failure-path tests (exact dig argv, ENOENT install
hint, non-denial failure passthrough, hostile-field rejection),
dns-records 501 test strengthened to pin provider name + capabilities.
Suite: backend 174 suites / 3754 tests, frontend 68/68.
Hermes