vpcdns

type Binding struct {
	// FQDN is the name this binding answers for (no trailing dot).
	FQDN string
	// Addrs are the addresses the name resolves to (answered as A or AAAA by
	// address family).
	Addrs []netip.Addr
	// Delegate forwards sub-names (x.<FQDN>) to a resolver at this binding's
	// addrs instead of answering locally (recursive tunnel resolution).
	Delegate bool
	// TTL for answers in seconds; 0 means defaultTTL.
	TTL uint32
	// Reachable are the prefixes carved out of the egress SSRF backstop for
	// this binding.
	Reachable []netip.Prefix
}

type Handler struct {
	// Source returns the current name-plane snapshot; required.
	Source func() Snapshot
	// QueryUpstream resolves a DNS request against a single delegate upstream
	// address. Nil means the default UDP-with-TCP-fallback exchange against
	// the overlay-embedded resolver (upstreamHostFromAddr); tests override it.
	QueryUpstream func(ctx context.Context, upstream netip.Addr, req *dns.Msg) (*dns.Msg, error)
	// Metrics are the optional observation hooks.
	Metrics Metrics
	// Name labels this handler in plugin errors; defaults to "vpcdns".
	Name string
}

type Metrics struct {
	// Query is invoked once per handled query with the outcome:
	// "hit", "recursive", "nxdomain", or "passthrough".
	Query func(outcome string)
	// RecursiveDuration observes one recursive resolution's duration.
	RecursiveDuration func(seconds float64)
	// UpstreamAbandoned counts delegate upstreams abandoned after the grace
	// period.
	UpstreamAbandoned func(n int)
}

type Snapshot struct {
	Zones    []string
	Bindings []Binding
}