fix: expose delegation adoption ref

internal/drivers/delegation.go

@@ -58,6 +58,21 @@ func (d *DelegationDriver) ProviderIDFormat() interfaces.ProviderIDFormat {
 	return interfaces.IDFormatDomainName
 }
 
+// AdoptionRef lets wfctl adopt an already-delegated domain before creating
+// registrar state. Read uses public NS first, so an already-correct delegation
+// can plan as no-op without requiring Hover authentication.
+func (d *DelegationDriver) AdoptionRef(spec interfaces.ResourceSpec) (interfaces.ResourceRef, bool, error) {
+	s, err := parseDelegationSpec(spec)
+	if err != nil {
+		return interfaces.ResourceRef{}, false, err
+	}
+	return interfaces.ResourceRef{
+		Name:       spec.Name,
+		Type:       "infra.dns_delegation",
+		ProviderID: s.domain,
+	}, true, nil
+}
+
 // dnsDelegationSpec is the parsed config view.
 type dnsDelegationSpec struct {
 	domain      string

internal/drivers/delegation_test.go

@@ -164,6 +164,27 @@ func TestDelegationDriver_Read_UsesPublicNSBeforeHoverLogin(t *testing.T) {
 	}
 }
 
+func TestDelegationDriver_AdoptionRef_UsesSpecDomain(t *testing.T) {
+	d := NewDelegationDriverWithClient(&fakeDelegationClient{})
+	ref, ok, err := d.AdoptionRef(interfaces.ResourceSpec{
+		Name: "delegation",
+		Type: "infra.dns_delegation",
+		Config: map[string]any{
+			"domain":      "example.com",
+			"nameservers": []any{"ns1.example.com"},
+		},
+	})
+	if err != nil {
+		t.Fatalf("AdoptionRef: %v", err)
+	}
+	if !ok {
+		t.Fatal("expected adoption ref")
+	}
+	if ref.Name != "delegation" || ref.Type != "infra.dns_delegation" || ref.ProviderID != "example.com" {
+		t.Fatalf("unexpected ref: %+v", ref)
+	}
+}
+
 func TestDelegationDriver_Read_PropagatesError(t *testing.T) {
 	fc := &fakeDelegationClient{getErr: errors.New("API down")}
 	d := NewDelegationDriverWithClient(fc)