Input snapshot
DnsModule::publish(array $zoneSnapshot, ConnectionContext $connection) receives the local zone ID/name, integer revision, deterministic dns:<id>:<revision> idempotency key and normalised records. Each record has name, type, value, TTL and optional priority. Read credentials only from the requested encrypted connection context.
Preserve DNS meaning
Map relative names, apex records and provider-specific value encodings correctly. Respect CNAME conflicts and MX/SRV priorities. A complete snapshot publisher must preserve required provider-managed records and detect unknown remote data before destructive replacement. It must not delete MX, TXT verification or delegation records merely because the local draft was incomplete.
The existing storefront provisioner edits its own target host records inside a complete local zone. That does not make an arbitrary partial zone safe for full publication. Provider account ownership, zone selection and record permissions must be checked explicitly.
Confirmation and errors
Return a successful OperationResult only for the exact submitted provider revision/result you can confirm. The core separately records published_revision and keeps a later concurrent local draft. Timeouts and ambiguous API responses remain uncertain; do not mark the zone published or automatically repeat a destructive replacement. Provider acceptance does not prove worldwide propagation, DNSSEC or certificate issuance.
Tests
Cover A, AAAA, CNAME, MX, TXT, CAA, NS and SRV, escaped TXT content, conflicts, provider-managed defaults, unrelated remote records, repeated idempotency keys, concurrent local edits, invalid TLS and transport uncertainty. A fixture passing does not demonstrate a real authoritative-zone migration. Test on an isolated expendable zone before enabling writes to a production DNS account.