refactor: Stage 6: Adopt SupportedTypes across providers

REFACTORING_PROJECTS.md

@@ -3,22 +3,28 @@
 Useful refactoring projects. Please feel free to pick up any of these.
 
 
-## Code that can probably be deleted
-
-* Retire RegisterCustomRecordType()/GetCustomRecordType() during the Stage 5–6
-  SupportedTypes rollout, after replacing their record recognition and
-  provider-support checks. Legacy validation still depends on them.
-
-* Remove the "orig_custom_type" metadata with that rollout. It is still read
-  by target validation and must remain until that dependency is replaced.
-
-
 ## Documentation updates
 
 * Improved "how to write a provider" docs. The process for creating a DNS or Registrar provider could be improved. We should provide templates to copy instead of asking people to find a similar provider.  The doc should start by creating a generic provider, then add features and options over time.  The first thing should test credentials and nothing else.  Then add a registrar (if needed) and then the "preview" functionality, then "push".
 
 ## Rewrites needed
 
+* Rework how metadata is passed to providers and how provider state is owned.
+  Consider an explicit split between state specific to a `credEntry` (such as
+  account-wide caches and rate limiters) and state specific to a
+  `(domain, credEntry)` (such as domain-specific configuration). Revisit client
+  initialization and reuse as part of that design. Also consider a tiered
+  metadata system with explicit inheritance and precedence rules, or providers
+  implemented as external binaries that maintain their own state. Keep this as
+  a separate future project with appropriate provider testing, rather than
+  expanding the current configuration-syntax rollout.
+
+* Future provider concurrency change: default to allowing concurrency and replace
+  authored `CanConcur` declarations with `ConcurBroken: true` only for providers
+  that cannot run concurrently. Derive the compatibility `CanConcur` capability
+  as `!ConcurBroken`, and audit existing `Cannot`/`Unimplemented` notes to
+  distinguish known limitations from untested providers. Implement in a separate PR.
+
 * PTR() "magic" should be reworked as a builder called PTR(). It will be much more
 cleaner and more testable. Plus it will consolidate the code into one place instead
 of being some in LabelFromDnsconfigjs() and other places.

documentation/advanced-features/writing-providers.md

@@ -309,36 +309,56 @@ If a provider doesn't advertise a particular capability, the integration test sy
 
 Don't feel obligated to implement everything at once. In fact, we'd prefer a few small PRs than one big one. Focus on getting the basic provider working well before adding these extras.
 
-Operational features have names like `providers.CanUseSRV` and `providers.CanUseAlias`.  The list of optional "capabilities" are in the file `dnscontrol/pkg/providers/providers.go` (look for `CanUseAlias`).
+Operational features such as `CanConcur` and `CanAutoDNSSEC` are named fields in
+`providers.Definition`. Record support is declared in `SupportedTypes` and also
+exposed through the compatibility capabilities in `pkg/providers/capabilities.go`.
 
 Capabilities are processed early by DNSControl.  For example if a provider doesn't support SRV records, DNSControl will error out when parsing `dnscontrol.js` rather than waiting until the API fails at the very end.
 
 Enable optional capabilities in the `nameProvider.go` file and run the integration tests to see what works and what doesn't.  Fix any bugs and repeat, repeat, repeat until you have all the capabilities you want to implement.
 
-Declare supported record types in `providers.Definition.SupportedTypes`, for
-example `[]string{"Default", "PTR"}`. This list is exhaustive:
-`Default` contains `A`, `AAAA`, `CAA`, `CNAME`, `MX`, `NS`, `SRV`, and `TXT`.
-It is a fixed baseline for typical authoritative DNS providers; verify each
+Declare supported record types in `providers.Definition.SupportedTypes`, with
+each string item on its own line to keep future diffs small:
+
+```go
+SupportedTypes: []string{
+    "Basic8",
+    "PTR",
+},
+```
+
+This list is exhaustive:
+`Basic8` contains `A`, `AAAA`, `CAA`, `CNAME`, `MX`, `NS`, `SRV`, and `TXT`.
+Its membership is fixed at these eight types; verify each
 provider's implementation and declare exceptions such as `NS:Cannot` explicitly.
 Specialized providers can supply their own complete list. `RFC` includes all ordinary
 types in DNSControl's record catalog; `*` also includes pseudo-types. Patterns
 such as `BUNNY_*` match whole type names, with `*` matching zero or more characters.
 Unknown concrete type names are errors.
 
+`IMPORT_TRANSFORM` is a deferred configuration command, not a record type or
+pseudo-type. It works with every provider and must not appear in `SupportedTypes`.
+Normalization executes it before providers see records, then checks the copied
+records against each provider's declaration. Custom pseudo-types need a parser
+registered with `privatetypes.Register` and an entry
+in `SupportedTypes`. Multiple providers can support the same pseudo-type.
+
 An entry without a suffix means supported. Use `:Can`, `:Cannot`, or
 `:Unimplemented` on concrete names or patterns, for example
 `[]string{"RFC", "CAA:Cannot"}`. Both negative statuses reject records;
-`Unimplemented` retains a distinct documentation status. `Default` and `RFC`
+`Unimplemented` retains a distinct documentation status. `Basic8` and `RFC`
 do not take suffixes. Type names are case-insensitive; status suffixes use the
 spellings shown here.
 
 Precedence is: exact entries, patterns with status suffixes, legacy `Features`,
 then unsuffixed patterns/categories. Conflicting statuses at the winning
 priority are errors, regardless of order. An exact entry can resolve conflicting
-patterns. Nil `SupportedTypes` means `Default`; a non-nil empty slice declares
-no support. During migration, legacy `Features` can still supply individual
-type statuses, and a non-nil `Features` with nil `SupportedTypes` retains legacy
-validation. General `DS` support includes child DS records; `CanUseDSForChildren`
+patterns. Nil `SupportedTypes` means `Basic8`; a non-nil empty slice declares
+no support beyond `Features`. Built-in providers all declare `SupportedTypes`
+explicitly; registrar-only providers use `[]string{}`. `Features` remains a
+compatibility input and can retain comments and links for individual types or
+interface-derived capabilities. A non-nil `Features` with nil `SupportedTypes`
+retains legacy capability validation. General `DS` support includes child DS records; `CanUseDSForChildren`
 can independently allow child DS records even with `DS:Cannot`.
 
 Registration retains selectors until the complete catalog is available.

documentation/provider/adguardhome.md

@@ -69,23 +69,23 @@ D("example.com", REG_NONE, DnsProvider(DSP_ADGUARDHOME),
   - [get-zones](../commands/get-zones.md): ❌
 - DNS extensions
   - [`ALIAS`](../language-reference/domain-modifiers/ALIAS.md): ✅
-  - [`DNAME`](../language-reference/domain-modifiers/DNAME.md): ❔
-  - [`LOC`](../language-reference/domain-modifiers/LOC.md): ❔
-  - [`PTR`](../language-reference/domain-modifiers/PTR.md): ❔
-  - [`SOA`](../language-reference/domain-modifiers/SOA.md): ❔
+  - [`DNAME`](../language-reference/domain-modifiers/DNAME.md): ❌
+  - [`LOC`](../language-reference/domain-modifiers/LOC.md): ❌
+  - [`PTR`](../language-reference/domain-modifiers/PTR.md): ❌
+  - [`SOA`](../language-reference/domain-modifiers/SOA.md): ❌
 - Service discovery
-  - [`DHCID`](../language-reference/domain-modifiers/DHCID.md): ❔
-  - [`NAPTR`](../language-reference/domain-modifiers/NAPTR.md): ❔
-  - [`SRV`](../language-reference/domain-modifiers/SRV.md): ❔
-  - [`SVCB`](../language-reference/domain-modifiers/SVCB.md): ❔
+  - [`DHCID`](../language-reference/domain-modifiers/DHCID.md): ❌
+  - [`NAPTR`](../language-reference/domain-modifiers/NAPTR.md): ❌
+  - [`SRV`](../language-reference/domain-modifiers/SRV.md): ❌
+  - [`SVCB`](../language-reference/domain-modifiers/SVCB.md): ❌
 - Security
-  - [`CAA`](../language-reference/domain-modifiers/CAA.md): ❔
-  - [`HTTPS`](../language-reference/domain-modifiers/HTTPS.md): ❔
-  - [`SMIMEA`](../language-reference/domain-modifiers/SMIMEA.md): ❔
-  - [`SSHFP`](../language-reference/domain-modifiers/SSHFP.md): ❔
-  - [`TLSA`](../language-reference/domain-modifiers/TLSA.md): ❔
+  - [`CAA`](../language-reference/domain-modifiers/CAA.md): ❌
+  - [`HTTPS`](../language-reference/domain-modifiers/HTTPS.md): ❌
+  - [`SMIMEA`](../language-reference/domain-modifiers/SMIMEA.md): ❌
+  - [`SSHFP`](../language-reference/domain-modifiers/SSHFP.md): ❌
+  - [`TLSA`](../language-reference/domain-modifiers/TLSA.md): ❌
 - DNSSEC
   - [`AUTODNSSEC`](../language-reference/domain-modifiers/AUTODNSSEC_ON.md): ❔
-  - [`DNSKEY`](../language-reference/domain-modifiers/DNSKEY.md): ❔
-  - [`DS`](../language-reference/domain-modifiers/DS.md): ❔
+  - [`DNSKEY`](../language-reference/domain-modifiers/DNSKEY.md): ❌
+  - [`DS`](../language-reference/domain-modifiers/DS.md): ❌
 <!-- provider-features-end -->

documentation/provider/akamaiedgedns.md

@@ -377,23 +377,23 @@ Created zone: example_3.com
   - [get-zones](../commands/get-zones.md): ✅
 - DNS extensions
   - [`ALIAS`](../language-reference/domain-modifiers/ALIAS.md): ✅
-  - [`DNAME`](../language-reference/domain-modifiers/DNAME.md): ❔
+  - [`DNAME`](../language-reference/domain-modifiers/DNAME.md): ❌
   - [`LOC`](../language-reference/domain-modifiers/LOC.md): ✅
   - [`PTR`](../language-reference/domain-modifiers/PTR.md): ✅
   - [`SOA`](../language-reference/domain-modifiers/SOA.md): ❌
 - Service discovery
-  - [`DHCID`](../language-reference/domain-modifiers/DHCID.md): ❔
+  - [`DHCID`](../language-reference/domain-modifiers/DHCID.md): ❌
   - [`NAPTR`](../language-reference/domain-modifiers/NAPTR.md): ✅
   - [`SRV`](../language-reference/domain-modifiers/SRV.md): ✅
-  - [`SVCB`](../language-reference/domain-modifiers/SVCB.md): ❔
+  - [`SVCB`](../language-reference/domain-modifiers/SVCB.md): ❌
 - Security
   - [`CAA`](../language-reference/domain-modifiers/CAA.md): ✅
-  - [`HTTPS`](../language-reference/domain-modifiers/HTTPS.md): ❔
-  - [`SMIMEA`](../language-reference/domain-modifiers/SMIMEA.md): ❔
+  - [`HTTPS`](../language-reference/domain-modifiers/HTTPS.md): ❌
+  - [`SMIMEA`](../language-reference/domain-modifiers/SMIMEA.md): ❌
   - [`SSHFP`](../language-reference/domain-modifiers/SSHFP.md): ✅
   - [`TLSA`](../language-reference/domain-modifiers/TLSA.md): ✅
 - DNSSEC
   - [`AUTODNSSEC`](../language-reference/domain-modifiers/AUTODNSSEC_ON.md): ✅
-  - [`DNSKEY`](../language-reference/domain-modifiers/DNSKEY.md): ❔
+  - [`DNSKEY`](../language-reference/domain-modifiers/DNSKEY.md): ❌
   - [`DS`](../language-reference/domain-modifiers/DS.md): ❌
 <!-- provider-features-end -->

documentation/provider/alidns.md

@@ -139,23 +139,23 @@ If a domain does not exist in your Alibaba Cloud account, you must create it man
   - [get-zones](../commands/get-zones.md): ✅
 - DNS extensions
   - [`ALIAS`](../language-reference/domain-modifiers/ALIAS.md): ❌
-  - [`DNAME`](../language-reference/domain-modifiers/DNAME.md): ❔
-  - [`LOC`](../language-reference/domain-modifiers/LOC.md): ❔
+  - [`DNAME`](../language-reference/domain-modifiers/DNAME.md): ❌
+  - [`LOC`](../language-reference/domain-modifiers/LOC.md): ❌
   - [`PTR`](../language-reference/domain-modifiers/PTR.md): ❌
-  - [`SOA`](../language-reference/domain-modifiers/SOA.md): ❔
+  - [`SOA`](../language-reference/domain-modifiers/SOA.md): ❌
 - Service discovery
-  - [`DHCID`](../language-reference/domain-modifiers/DHCID.md): ❔
+  - [`DHCID`](../language-reference/domain-modifiers/DHCID.md): ❌
   - [`NAPTR`](../language-reference/domain-modifiers/NAPTR.md): ❌
   - [`SRV`](../language-reference/domain-modifiers/SRV.md): ✅
-  - [`SVCB`](../language-reference/domain-modifiers/SVCB.md): ❔
+  - [`SVCB`](../language-reference/domain-modifiers/SVCB.md): ❌
 - Security
   - [`CAA`](../language-reference/domain-modifiers/CAA.md): ✅
-  - [`HTTPS`](../language-reference/domain-modifiers/HTTPS.md): ❔
-  - [`SMIMEA`](../language-reference/domain-modifiers/SMIMEA.md): ❔
+  - [`HTTPS`](../language-reference/domain-modifiers/HTTPS.md): ❌
+  - [`SMIMEA`](../language-reference/domain-modifiers/SMIMEA.md): ❌
   - [`SSHFP`](../language-reference/domain-modifiers/SSHFP.md): ❌
   - [`TLSA`](../language-reference/domain-modifiers/TLSA.md): ❌
 - DNSSEC
   - [`AUTODNSSEC`](../language-reference/domain-modifiers/AUTODNSSEC_ON.md): ❌
-  - [`DNSKEY`](../language-reference/domain-modifiers/DNSKEY.md): ❔
-  - [`DS`](../language-reference/domain-modifiers/DS.md): ❔
+  - [`DNSKEY`](../language-reference/domain-modifiers/DNSKEY.md): ❌
+  - [`DS`](../language-reference/domain-modifiers/DS.md): ❌
 <!-- provider-features-end -->

documentation/provider/autodns.md

@@ -119,23 +119,23 @@ D("example.com", REG_NONE, DnsProvider(DSP_AUTODNS),
   - [get-zones](../commands/get-zones.md): ✅
 - DNS extensions
   - [`ALIAS`](../language-reference/domain-modifiers/ALIAS.md): ✅
-  - [`DNAME`](../language-reference/domain-modifiers/DNAME.md): ❔
-  - [`LOC`](../language-reference/domain-modifiers/LOC.md): ❔
+  - [`DNAME`](../language-reference/domain-modifiers/DNAME.md): ❌
+  - [`LOC`](../language-reference/domain-modifiers/LOC.md): ❌
   - [`PTR`](../language-reference/domain-modifiers/PTR.md): ✅
-  - [`SOA`](../language-reference/domain-modifiers/SOA.md): ❔
+  - [`SOA`](../language-reference/domain-modifiers/SOA.md): ❌
 - Service discovery
-  - [`DHCID`](../language-reference/domain-modifiers/DHCID.md): ❔
-  - [`NAPTR`](../language-reference/domain-modifiers/NAPTR.md): ❔
+  - [`DHCID`](../language-reference/domain-modifiers/DHCID.md): ❌
+  - [`NAPTR`](../language-reference/domain-modifiers/NAPTR.md): ❌
   - [`SRV`](../language-reference/domain-modifiers/SRV.md): ✅
-  - [`SVCB`](../language-reference/domain-modifiers/SVCB.md): ❔
+  - [`SVCB`](../language-reference/domain-modifiers/SVCB.md): ❌
 - Security
   - [`CAA`](../language-reference/domain-modifiers/CAA.md): ✅
-  - [`HTTPS`](../language-reference/domain-modifiers/HTTPS.md): ❔
-  - [`SMIMEA`](../language-reference/domain-modifiers/SMIMEA.md): ❔
+  - [`HTTPS`](../language-reference/domain-modifiers/HTTPS.md): ❌
+  - [`SMIMEA`](../language-reference/domain-modifiers/SMIMEA.md): ❌
   - [`SSHFP`](../language-reference/domain-modifiers/SSHFP.md): ❌
   - [`TLSA`](../language-reference/domain-modifiers/TLSA.md): ❌
 - DNSSEC
   - [`AUTODNSSEC`](../language-reference/domain-modifiers/AUTODNSSEC_ON.md): ❔
-  - [`DNSKEY`](../language-reference/domain-modifiers/DNSKEY.md): ❔
+  - [`DNSKEY`](../language-reference/domain-modifiers/DNSKEY.md): ❌
   - [`DS`](../language-reference/domain-modifiers/DS.md): ❌
 <!-- provider-features-end -->

documentation/provider/azuredns.md

@@ -228,23 +228,23 @@ The ResourceGroup is case sensitive.
   - [get-zones](../commands/get-zones.md): ✅
 - DNS extensions
   - [`ALIAS`](../language-reference/domain-modifiers/ALIAS.md): ❌
-  - [`DNAME`](../language-reference/domain-modifiers/DNAME.md): ❔
+  - [`DNAME`](../language-reference/domain-modifiers/DNAME.md): ❌
   - [`LOC`](../language-reference/domain-modifiers/LOC.md): ❌
   - [`PTR`](../language-reference/domain-modifiers/PTR.md): ✅
-  - [`SOA`](../language-reference/domain-modifiers/SOA.md): ❔
+  - [`SOA`](../language-reference/domain-modifiers/SOA.md): ❌
 - Service discovery
-  - [`DHCID`](../language-reference/domain-modifiers/DHCID.md): ❔
+  - [`DHCID`](../language-reference/domain-modifiers/DHCID.md): ❌
   - [`NAPTR`](../language-reference/domain-modifiers/NAPTR.md): ❌
   - [`SRV`](../language-reference/domain-modifiers/SRV.md): ✅
-  - [`SVCB`](../language-reference/domain-modifiers/SVCB.md): ❔
+  - [`SVCB`](../language-reference/domain-modifiers/SVCB.md): ❌
 - Security
   - [`CAA`](../language-reference/domain-modifiers/CAA.md): ✅
-  - [`HTTPS`](../language-reference/domain-modifiers/HTTPS.md): ❔
-  - [`SMIMEA`](../language-reference/domain-modifiers/SMIMEA.md): ❔
+  - [`HTTPS`](../language-reference/domain-modifiers/HTTPS.md): ❌
+  - [`SMIMEA`](../language-reference/domain-modifiers/SMIMEA.md): ❌
   - [`SSHFP`](../language-reference/domain-modifiers/SSHFP.md): ❌
   - [`TLSA`](../language-reference/domain-modifiers/TLSA.md): ❌
 - DNSSEC
   - [`AUTODNSSEC`](../language-reference/domain-modifiers/AUTODNSSEC_ON.md): ❔
-  - [`DNSKEY`](../language-reference/domain-modifiers/DNSKEY.md): ❔
-  - [`DS`](../language-reference/domain-modifiers/DS.md): ❔
+  - [`DNSKEY`](../language-reference/domain-modifiers/DNSKEY.md): ❌
+  - [`DS`](../language-reference/domain-modifiers/DS.md): ❌
 <!-- provider-features-end -->

documentation/provider/azureprivatedns.md

@@ -233,20 +233,20 @@ The ResourceGroup is case-insensitive (it is lowercased internally).
   - [`DNAME`](../language-reference/domain-modifiers/DNAME.md): ❌
   - [`LOC`](../language-reference/domain-modifiers/LOC.md): ❌
   - [`PTR`](../language-reference/domain-modifiers/PTR.md): ✅
-  - [`SOA`](../language-reference/domain-modifiers/SOA.md): ❔
+  - [`SOA`](../language-reference/domain-modifiers/SOA.md): ❌
 - Service discovery
   - [`DHCID`](../language-reference/domain-modifiers/DHCID.md): ❌
   - [`NAPTR`](../language-reference/domain-modifiers/NAPTR.md): ❌
   - [`SRV`](../language-reference/domain-modifiers/SRV.md): ✅
-  - [`SVCB`](../language-reference/domain-modifiers/SVCB.md): ❔
+  - [`SVCB`](../language-reference/domain-modifiers/SVCB.md): ❌
 - Security
   - [`CAA`](../language-reference/domain-modifiers/CAA.md): ❌
-  - [`HTTPS`](../language-reference/domain-modifiers/HTTPS.md): ❔
-  - [`SMIMEA`](../language-reference/domain-modifiers/SMIMEA.md): ❔
+  - [`HTTPS`](../language-reference/domain-modifiers/HTTPS.md): ❌
+  - [`SMIMEA`](../language-reference/domain-modifiers/SMIMEA.md): ❌
   - [`SSHFP`](../language-reference/domain-modifiers/SSHFP.md): ❌
   - [`TLSA`](../language-reference/domain-modifiers/TLSA.md): ❌
 - DNSSEC
   - [`AUTODNSSEC`](../language-reference/domain-modifiers/AUTODNSSEC_ON.md): ❌
-  - [`DNSKEY`](../language-reference/domain-modifiers/DNSKEY.md): ❔
-  - [`DS`](../language-reference/domain-modifiers/DS.md): ❔
+  - [`DNSKEY`](../language-reference/domain-modifiers/DNSKEY.md): ❌
+  - [`DS`](../language-reference/domain-modifiers/DS.md): ❌
 <!-- provider-features-end -->

documentation/provider/bunnydns.md

@@ -205,7 +205,7 @@ You can configure Bunny's Pull Zone type with `BUNNY_DNS_PZ`. The target is the
   - [get-zones](../commands/get-zones.md): ✅
 - DNS extensions
   - [`ALIAS`](../language-reference/domain-modifiers/ALIAS.md): ✅
-  - [`DNAME`](../language-reference/domain-modifiers/DNAME.md): ❔
+  - [`DNAME`](../language-reference/domain-modifiers/DNAME.md): ❌
   - [`LOC`](../language-reference/domain-modifiers/LOC.md): ❌
   - [`PTR`](../language-reference/domain-modifiers/PTR.md): ✅
   - [`SOA`](../language-reference/domain-modifiers/SOA.md): ❌
@@ -217,11 +217,11 @@ You can configure Bunny's Pull Zone type with `BUNNY_DNS_PZ`. The target is the
 - Security
   - [`CAA`](../language-reference/domain-modifiers/CAA.md): ✅
   - [`HTTPS`](../language-reference/domain-modifiers/HTTPS.md): ✅
-  - [`SMIMEA`](../language-reference/domain-modifiers/SMIMEA.md): ❔
+  - [`SMIMEA`](../language-reference/domain-modifiers/SMIMEA.md): ❌
   - [`SSHFP`](../language-reference/domain-modifiers/SSHFP.md): ❌
   - [`TLSA`](../language-reference/domain-modifiers/TLSA.md): ✅
 - DNSSEC
   - [`AUTODNSSEC`](../language-reference/domain-modifiers/AUTODNSSEC_ON.md): ✅
-  - [`DNSKEY`](../language-reference/domain-modifiers/DNSKEY.md): ❔
+  - [`DNSKEY`](../language-reference/domain-modifiers/DNSKEY.md): ❌
   - [`DS`](../language-reference/domain-modifiers/DS.md): ❌
 <!-- provider-features-end -->