import zone export

Read a Route53 export and hand back the records, the SOA timers and the delegation, ready to store.

Parses a Route53 list-resource-record-sets export into the DNS zone store's own record shape. Accepts the AWS document ({"ResourceRecordSets": [...]}), a bare array, or either as JSON text. Owners come back RELATIVE to the origin ('@' for the apex, 'www', '*'), with Route53's octal escapes expanded, which is what lets one record set render under several apexes. The apex SOA and NS are NOT records: they come back on the soa and nameservers pins, because every rendered zone carries its own delegation and a serial stamped at render time. The SOA serial is discarded deliberately. ALIAS records are kept with their target on alias_target and no values; BIND has no ALIAS, so they are resolved at render time. Records carrying a Route53 routing policy (SetIdentifier: weighted, latency, geolocation, failover) make the block REFUSE with success=false, because a zone file would have to flatten them into one arbitrary answer; allow_routing_policies imports them flat and reports each one on the warnings pin. Record order is preserved as the export gave it, which is the order the store keeps and the renderer emits. SEEDING A GROUP: a record set may also carry lowercase policy, slot and note keys, which are passed through to the record. A real AWS export never has them (its keys are TitleCase), but a caller seeding a zone group can, which makes seeding one call instead of an import followed by a PATCH per record. policy is verbatim, rewrite, per-apex or note; anything else is REFUSED rather than ignored, because ignoring it would leave the record rendering verbatim : copied to every apex, the opposite of what was asked. per-apex without a slot is refused too: a slot nobody can fill is a gap, not a decision.