/*
<MODULE_CONTRACT>
<purpose>
RFC-0753: Kernel module for DNS record management commands —
dns.record.upsert, dns.record.validate, dns.record.list, dns.record.delete,
dns.records.schema.validate.
</purpose>
<non-goals>
  <item>Do not register subdomain or leitstand commands here — those live in their own modules.</item>
</non-goals>
</MODULE_CONTRACT>
<CHANGE_SUMMARY>
  <item>RFC-0753: initial DNS module with upsert, validate, list, delete, schema.validate commands.</item>
  <item>RFC-1173: declare mutatesState on all kernel commands — collectDeclarationDiagnostics emits error-severity MUTATES-STATE-DECLARED, command.manifest.validate is the blocking consumer in packages.check, sweep declares the flag on every command definition (factories hardcode false for read-only check specs)</item>
  <item>RFC-1231: step 1 — rename supportsAllSites to acceptsAllFlag

Mechanical sweep: the field only ever gated --all argv acceptance; fan-out
follows the parsed selector. Guard renamed assertAllSitesAllowed ->
assertAllFlagAccepted, message updated. 417 declaration sites + type
surfaces (KernelCommandMetadata, ForgeCommandMetadata) in one atomic pass.</item>
  <item>RFC-1248: VITE-CLIENT-DEP-02 lazy-import gate + SCAN-02 validator reads-root existence check (RFC-1248)</item>
</CHANGE_SUMMARY>
*/

import type { ModuleExport } from "@warpgogol/werkstatt-shared/kernel";

export async function createDnsModule(): Promise<ModuleExport> {
  const { runDnsRecordUpsert } = await import("./dns-record-upsert.ts");
  const { runDnsRecordValidate } = await import("./dns-record-validate.ts");
  const { runDnsRecordList } = await import("./dns-record-list.ts");
  const { runDnsRecordDelete } = await import("./dns-record-delete.ts");
  const { runDnsRecordsSchemaValidate } = await import("./dns-records-schema-validate.ts");
  return {
    name: "dns",
    version: "0.1.0",
    declarations: [],
    commands: [
      {
        name: "dns.record.upsert",
        modulePath: "packages/werkstatt-engine/src/dns/dns.module.ts",
        description:
          "Synchronize DNS records from declaration file to Cloudflare (RFC-0753). Idempotent. Flags: --system, --dry-run.",
        scope: "workspace",
        acceptsAllFlag: false,
        mutatesState: false,
        flags: {
          system: {
            kind: "string",
            required: true,
            description:
              "System ID from system-config.yaml. Auto-injected by pipeline/CLI when --site is provided.",
          },
          "dry-run": {
            kind: "boolean",
            description: "Preview changes without making API calls.",
          },
        },
        reads: [
          "../systems-cache/{system}/system-config.yaml",
          "../systems-cache/{system}/dns-records.yaml",
        ],
        cacheable: false,
        execute: runDnsRecordUpsert,
      },
      {
        name: "dns.record.validate",
        coverage: "operator" as const,
        coverageNote: "requires --system",
        mutatesState: false,
        contract: "dns",
        rules: [],
        modulePath: "packages/werkstatt-engine/src/dns/dns.module.ts",
        description:
          "Validate live Cloudflare DNS records against declaration file (RFC-0753). Flags: --system.",
        scope: "workspace",
        acceptsAllFlag: false,
        flags: {
          system: {
            kind: "string",
            required: true,
            description: "System ID from system-config.yaml.",
          },
        },
        reads: [
          "../systems-cache/{system}/system-config.yaml",
          "../systems-cache/{system}/dns-records.yaml",
        ],
        cacheable: false,
        execute: runDnsRecordValidate,
      },
      {
        name: "dns.record.list",
        coverage: "operator" as const,
        mutatesState: false,
        modulePath: "packages/werkstatt-engine/src/dns/dns.module.ts",
        description:
          "List all live DNS records in a zone from Cloudflare (RFC-0753). Flags: --system, --name.",
        scope: "workspace",
        acceptsAllFlag: false,
        flags: {
          system: {
            kind: "string",
            required: true,
            description: "System ID from system-config.yaml.",
          },
          name: {
            kind: "string",
            description: "Filter by record name (e.g. warpgogol.com).",
          },
        },
        reads: ["../systems-cache/{system}/system-config.yaml"],
        cacheable: false,
        execute: runDnsRecordList,
      },
      {
        name: "dns.record.delete",
        coverage: "operator" as const,
        modulePath: "packages/werkstatt-engine/src/dns/dns.module.ts",
        description:
          "Delete a DNS record from Cloudflare by ID or name+type (RFC-0753). Flags: --system, --record-id, --name, --type, --dry-run.",
        scope: "workspace",
        acceptsAllFlag: false,
        mutatesState: false,
        flags: {
          system: {
            kind: "string",
            required: true,
            description: "System ID from system-config.yaml.",
          },
          "record-id": {
            kind: "string",
            description: "Cloudflare record ID to delete.",
          },
          name: {
            kind: "string",
            description: "Record name (requires --type).",
          },
          type: {
            kind: "string",
            description: "Record type (requires --name).",
          },
          "dry-run": {
            kind: "boolean",
            description: "Preview deletion without making API calls.",
          },
        },
        reads: ["../systems-cache/{system}/system-config.yaml"],
        cacheable: false,
        execute: runDnsRecordDelete,
      },
      {
        name: "dns.records.schema.validate",
        mutatesState: false,
        contract: "dns",
        rules: [],
        modulePath: "packages/werkstatt-engine/src/dns/dns.module.ts",
        description:
          "Schema-only validation of DNS record declaration files (RFC-0753). No API calls. Flags: --system.",
        scope: "workspace",
        acceptsAllFlag: false,
        flags: {
          system: {
            kind: "string",
            description: "System ID. If omitted, validates all systems with dns-records.yaml.",
          },
        },
        reads: ["../systems-cache/{system}/dns-records.yaml"],
        cacheable: true,
        execute: runDnsRecordsSchemaValidate,
      },
    ],
    pipelines: [],
  };
}