@caelo-cms/provisioning 0.10.47 → 0.10.48

package/src/deployed-release.ts

@@ -0,0 +1,220 @@
+// SPDX-License-Identifier: MPL-2.0
+
+/**
+ * The release a deployed GCP install runs, read from its Cloud Run services.
+ *
+ * Installs created before `install.json` recorded `imageDigests` have no
+ * other trustworthy record: `upgrade` rolled them through gcloud without
+ * touching the Pulumi stack config, so the config may name an older release.
+ * The wizard reads the live services instead, so re-running it on such an
+ * install keeps what runs rather than rolling to `:latest` without the
+ * migrations `upgrade` would run first.
+ */
+
+import { gcloud as defaultGcloud } from "./gcloud.js";
+import type { GcloudRunner } from "./gcloud-retry.js";
+import { GCP_STACK_ENV, gcpNamePrefix } from "./gcp-names.js";
+import type { ImageDigests } from "./install-state.js";
+import { type CloudRunSlug, SERVICE_SECRET_ENV } from "./stack-contract.js";
+import { liveContainerEnv } from "./stack-converge.js";
+
+/** The `sha256:…` digest an image reference pins, or null for a tag reference. */
+export function digestFromImageRef(ref: string): string | null {
+  return ref.trim().match(/@(sha256:[0-9a-f]{64})$/)?.[1] ?? null;
+}
+
+/** The single deployed (Pulumi-suffixed) Cloud Run service for `slug`. */
+async function findDeployedService(
+  run: GcloudRunner,
+  opts: { projectId: string; region: string },
+  slug: CloudRunSlug,
+): Promise<{ ok: true; name: string } | { ok: false; error: string }> {
+  const prefix = `${gcpNamePrefix(GCP_STACK_ENV)}-${slug}`;
+  const list = await run([
+    "run",
+    "services",
+    "list",
+    `--region=${opts.region}`,
+    `--project=${opts.projectId}`,
+    `--filter=metadata.name~^${prefix}`,
+    "--format=value(metadata.name)",
+  ]);
+  if (!list.ok) return { ok: false, error: `list Cloud Run services: ${list.stderr.trim()}` };
+  const names = list.stdout
+    .split("\n")
+    .map((s) => s.trim())
+    .filter(Boolean);
+  if (names.length !== 1) {
+    return {
+      ok: false,
+      error: `expected one ${prefix}* Cloud Run service, found ${names.length === 0 ? "none" : names.join(", ")}`,
+    };
+  }
+  return { ok: true, name: names[0] as string };
+}
+
+/**
+ * Whether the deployed services already run on the Secret Manager runtime
+ * env (password-less database URLs + `*_PASSWORD` secret references).
+ *
+ * The stacks deploy that env; a release from before it can't use it (it
+ * reads the password from the URL). The wizard keeps the release an install
+ * runs, so re-running it on an install `upgrade` hasn't moved over yet would
+ * pair the old release with env it can't connect with. The same holds for a
+ * gateway from before #613: its release needs the admin_role pool the
+ * current contract no longer gives it (no GATEWAY_DATABASE_PASSWORD yet).
+ * Such an install has to go through `upgrade` first, which moves the image
+ * and the env in one revision.
+ */
+export async function checkDeployedRuntimeEnv(opts: {
+  projectId: string;
+  region: string;
+  run?: GcloudRunner;
+}): Promise<{ ok: true } | { ok: false; error: string }> {
+  const run = opts.run ?? defaultGcloud;
+  for (const slug of ["admin", "gateway"] as const) {
+    const found = await findDeployedService(run, opts, slug);
+    if (!found.ok) return found;
+    const describe = await run([
+      "run",
+      "services",
+      "describe",
+      found.name,
+      `--region=${opts.region}`,
+      `--project=${opts.projectId}`,
+      "--format=json",
+    ]);
+    if (!describe.ok) {
+      return { ok: false, error: `describe ${found.name}: ${describe.stderr.trim()}` };
+    }
+    const env = liveContainerEnv(describe.stdout);
+    const missing = Object.keys(SERVICE_SECRET_ENV[slug]).filter(
+      (name) => name.endsWith("_PASSWORD") && env.get(name)?.kind !== "secret",
+    );
+    if (missing.length > 0) {
+      return {
+        ok: false,
+        error: `${found.name} does not read ${missing.join(", ")} from Secret Manager — its release predates the current database env (Secret Manager runtime secrets; for the gateway, its own database logins, #613). Run \`upgrade\` first: it moves the release and its env over together. Re-running the installer now would give the running release a database env it can't connect with.`,
+      };
+    }
+  }
+  return { ok: true };
+}
+
+/**
+ * Read the image digests the admin and gateway services run. Fails, naming
+ * what is missing, when a service can't be found unambiguously or doesn't
+ * run a digest-pinned image.
+ */
+export async function readDeployedImageDigests(opts: {
+  projectId: string;
+  region: string;
+  run?: GcloudRunner;
+}): Promise<{ ok: true; digests: ImageDigests } | { ok: false; error: string }> {
+  const run = opts.run ?? defaultGcloud;
+  const digests = { admin: "", gateway: "" };
+  for (const slug of ["admin", "gateway"] as const) {
+    const found = await findDeployedService(run, opts, slug);
+    if (!found.ok) return found;
+    const image = await run([
+      "run",
+      "services",
+      "describe",
+      found.name,
+      `--region=${opts.region}`,
+      `--project=${opts.projectId}`,
+      "--format=value(spec.template.spec.containers[0].image)",
+    ]);
+    if (!image.ok) return { ok: false, error: `describe ${found.name}: ${image.stderr.trim()}` };
+    const digest = digestFromImageRef(image.stdout);
+    if (!digest) {
+      return {
+        ok: false,
+        error: `${found.name} runs '${image.stdout.trim()}', which is not pinned to a digest`,
+      };
+    }
+    digests[slug] = digest;
+  }
+  return { ok: true, digests };
+}
+
+/** Where the digests a wizard run deploys come from. */
+export type DigestChoice =
+  | {
+      readonly ok: true;
+      readonly source: "recorded" | "live" | "latest";
+      readonly digests: ImageDigests;
+    }
+  | { readonly ok: false; readonly error: string };
+
+/**
+ * Pick the release a wizard run deploys. A re-run never changes versions —
+ * that is `upgrade`'s job, which migrates the database before shifting
+ * traffic:
+ *
+ *   - digests recorded in install.json win;
+ *   - an install that was provisioned (`deployed`) but predates the record
+ *     keeps what its services run;
+ *   - only a new install resolves the floating release tag.
+ */
+export async function chooseImageDigests(opts: {
+  readonly recorded: ImageDigests | null;
+  readonly deployed: boolean;
+  readonly readLive: () => ReturnType<typeof readDeployedImageDigests>;
+  readonly resolveLatest: () => Promise<ImageDigests>;
+}): Promise<DigestChoice> {
+  if (opts.recorded) return { ok: true, source: "recorded", digests: opts.recorded };
+  if (!opts.deployed) return { ok: true, source: "latest", digests: await opts.resolveLatest() };
+  const live = await opts.readLive();
+  if (!live.ok) {
+    return {
+      ok: false,
+      error: `This install was provisioned before the release it runs was recorded, and the running release can't be read (${live.error}). Run \`upgrade\` once — it records the release it rolls to — then re-run the installer.`,
+    };
+  }
+  return { ok: true, source: "live", digests: live.digests };
+}
+
+/**
+ * The region a deployed install's admin service runs in, read across all
+ * regions, or null when no admin service exists (nothing deployed yet).
+ * Used when install.json has no region recorded, so a re-run keeps the
+ * install where it is instead of asking (#607). Fails when the services
+ * can't be listed or the admin service exists in more than one region.
+ */
+export async function readDeployedRegion(opts: {
+  projectId: string;
+  run?: GcloudRunner;
+}): Promise<{ ok: true; region: string | null } | { ok: false; error: string }> {
+  const run = opts.run ?? defaultGcloud;
+  const prefix = `${gcpNamePrefix(GCP_STACK_ENV)}-admin`;
+  const list = await run([
+    "run",
+    "services",
+    "list",
+    `--project=${opts.projectId}`,
+    `--filter=metadata.name~^${prefix}`,
+    '--format=value(metadata.labels."cloud.googleapis.com/location")',
+  ]);
+  if (!list.ok) {
+    return {
+      ok: false,
+      error: `list Cloud Run services to find the install's region: ${list.stderr.trim() || "no output"}`,
+    };
+  }
+  const regions = [
+    ...new Set(
+      list.stdout
+        .split("\n")
+        .map((s) => s.trim())
+        .filter(Boolean),
+    ),
+  ];
+  if (regions.length > 1) {
+    return {
+      ok: false,
+      error: `${prefix}* Cloud Run services exist in several regions (${regions.join(", ")}); record the install's region in install.json ("region"), then re-run.`,
+    };
+  }
+  return { ok: true, region: regions[0] ?? null };
+}

package/src/dns/cloudflare.ts

@@ -0,0 +1,182 @@
+// SPDX-License-Identifier: MPL-2.0
+
+/**
+ * Cloudflare DNS adapter — zero-touch via the Cloudflare API.
+ * Uses the public REST API directly (no SDK) so the Caelo install
+ * doesn't carry the cloudflare-sdk's transitive dependency tree.
+ *
+ * Auth: CLOUDFLARE_API_TOKEN env var. Token scope needed:
+ *   Zone:DNS:Edit on the target zone
+ * (Read-only Zone:Zone:Read is enough for `detectCloudflareAuth`.)
+ *
+ * Records are upserted — repeated runs are idempotent. Each CREATE
+ * is followed by a public-DNS poll to verify the change is visible
+ * (Cloudflare propagates within ~60s typically).
+ */
+
+import { promises as dns } from "node:dns";
+import { setTimeout as sleep } from "node:timers/promises";
+import { log, spinner } from "@clack/prompts";
+import { dim, green, red } from "kleur/colors";
+import type { DnsAdapter, DnsRecord } from "./types.js";
+
+const CF_API = "https://api.cloudflare.com/client/v4";
+
+export async function detectCloudflareAuth(): Promise<{ token: string | null }> {
+  const token = process.env.CLOUDFLARE_API_TOKEN ?? null;
+  if (!token) return { token: null };
+  // Verify the token resolves (cheap HEAD-style call).
+  try {
+    const r = await fetch(`${CF_API}/user/tokens/verify`, {
+      headers: { Authorization: `Bearer ${token}` },
+    });
+    if (!r.ok) return { token: null };
+    return { token };
+  } catch {
+    return { token: null };
+  }
+}
+
+interface CfZone {
+  id: string;
+  name: string;
+}
+
+async function findZoneId(token: string, domain: string): Promise<string | null> {
+  // Try the apex first, then walk up subdomains until we hit a zone.
+  // (e.g. caelo-cms.com → caelo-cms.com)
+  const parts = domain.split(".");
+  for (let i = 0; i < parts.length - 1; i++) {
+    const candidate = parts.slice(i).join(".");
+    const r = await fetch(`${CF_API}/zones?name=${encodeURIComponent(candidate)}`, {
+      headers: { Authorization: `Bearer ${token}` },
+    });
+    if (!r.ok) continue;
+    const body = (await r.json()) as { result?: CfZone[] };
+    if (body.result && body.result.length > 0) return body.result[0]?.id ?? null;
+  }
+  return null;
+}
+
+interface CfRecord {
+  id: string;
+  type: string;
+  name: string;
+  content: string;
+}
+
+async function existingRecord(
+  token: string,
+  zoneId: string,
+  hostname: string,
+  type: string,
+): Promise<CfRecord | null> {
+  const r = await fetch(
+    `${CF_API}/zones/${zoneId}/dns_records?type=${type}&name=${encodeURIComponent(hostname)}`,
+    { headers: { Authorization: `Bearer ${token}` } },
+  );
+  if (!r.ok) return null;
+  const body = (await r.json()) as { result?: CfRecord[] };
+  return body.result?.[0] ?? null;
+}
+
+async function upsertRecord(token: string, zoneId: string, record: DnsRecord): Promise<void> {
+  const existing = await existingRecord(token, zoneId, record.hostname, record.type);
+  const body = {
+    type: record.type,
+    name: record.hostname,
+    content: record.value,
+    ttl: record.ttl ?? 1, // 1 = auto in Cloudflare
+    proxied: false, // Caelo expects raw A records hitting GCP LB IP, not Cloudflare's proxy
+  };
+  if (existing) {
+    if (existing.content === record.value) return; // already correct
+    const r = await fetch(`${CF_API}/zones/${zoneId}/dns_records/${existing.id}`, {
+      method: "PUT",
+      headers: { Authorization: `Bearer ${token}`, "Content-Type": "application/json" },
+      body: JSON.stringify(body),
+    });
+    if (!r.ok) throw new Error(`Cloudflare PUT ${record.hostname}: ${r.status} ${await r.text()}`);
+    return;
+  }
+  const r = await fetch(`${CF_API}/zones/${zoneId}/dns_records`, {
+    method: "POST",
+    headers: { Authorization: `Bearer ${token}`, "Content-Type": "application/json" },
+    body: JSON.stringify(body),
+  });
+  if (!r.ok) throw new Error(`Cloudflare POST ${record.hostname}: ${r.status} ${await r.text()}`);
+}
+
+export function makeCloudflareAdapter(opts: { domain: string; apiToken: string }): DnsAdapter {
+  return {
+    name: `Cloudflare (zero-touch via API)`,
+    async applyRecords(records: DnsRecord[]): Promise<void> {
+      const s = spinner();
+      s.start(`Locating Cloudflare zone for ${opts.domain}...`);
+      const zoneId = await findZoneId(opts.apiToken, opts.domain);
+      if (!zoneId) {
+        s.stop(red(`No Cloudflare zone found containing ${opts.domain}.`));
+        throw new Error(
+          `Domain ${opts.domain} isn't in your Cloudflare account. Add it as a zone first, or unset CLOUDFLARE_API_TOKEN to use the manual paste flow.`,
+        );
+      }
+      s.stop(green(`Cloudflare zone ${dim(zoneId)} found`));
+
+      for (const record of records) {
+        const s2 = spinner();
+        s2.start(`Upserting ${record.type} ${record.hostname} → ${record.value}...`);
+        try {
+          await upsertRecord(opts.apiToken, zoneId, record);
+        } catch (e) {
+          s2.stop(red(`Failed: ${e instanceof Error ? e.message : String(e)}`));
+          throw e;
+        }
+        s2.stop(green(`${record.type} ${record.hostname} set`));
+      }
+
+      // Quick public-DNS poll — Cloudflare usually propagates within
+      // ~60s. We give 5 min before giving up + telling the operator
+      // to verify manually.
+      const s3 = spinner();
+      s3.start("Verifying public DNS resolution...");
+      const start = Date.now();
+      const remaining = new Set(records.map((r) => `${r.type}:${r.hostname}`));
+      while (remaining.size > 0 && Date.now() - start < 5 * 60 * 1000) {
+        for (const key of [...remaining]) {
+          const record = records.find((r) => `${r.type}:${r.hostname}` === key);
+          if (!record) {
+            remaining.delete(key);
+            continue;
+          }
+          if (await checkRecord(record)) remaining.delete(key);
+        }
+        if (remaining.size > 0) await sleep(5000);
+      }
+      if (remaining.size > 0) {
+        s3.stop(red(`Some records still unresolved: ${[...remaining].join(", ")}`));
+        log.error(
+          `Cloudflare API succeeded but public DNS doesn't reflect the change yet. Wait + verify with \`dig\` then re-run.`,
+        );
+        throw new Error("DNS verify timeout.");
+      }
+      s3.stop(green("All records resolve publicly."));
+    },
+  };
+}
+
+async function checkRecord(record: DnsRecord): Promise<boolean> {
+  try {
+    if (record.type === "A") {
+      const result = await dns.resolve4(record.hostname);
+      return result.includes(record.value);
+    }
+    if (record.type === "CNAME") {
+      const result = await dns.resolveCname(record.hostname);
+      const expected = record.value.replace(/\.$/, "");
+      return result.some((v) => v.replace(/\.$/, "") === expected);
+    }
+    return true; // AAAA + TXT — assume Cloudflare API success means it's there
+  } catch {
+    return false;
+  }
+}

package/src/dns/groups.test.ts

@@ -0,0 +1,76 @@
+// SPDX-License-Identifier: MPL-2.0
+
+import { describe, expect, it } from "bun:test";
+import { formatDnsRecordGroups, groupDnsRecords, switchesPublicSite } from "./groups.js";
+
+const domain = "example.com";
+
+describe("groupDnsRecords", () => {
+  it("keeps the main domain's traffic records for go-live (gcp load balancer)", () => {
+    const records = [
+      { hostname: "example.com", type: "A", value: "203.0.113.7" },
+      { hostname: "admin.example.com", type: "A", value: "203.0.113.7" },
+    ];
+    const g = groupDnsRecords(records, domain);
+    expect(g.setNow.map((r) => r.hostname)).toEqual(["admin.example.com"]);
+    expect(g.atGoLive.map((r) => r.hostname)).toEqual(["example.com"]);
+  });
+
+  it("sets verification TXT records now and apex A records at go-live (gcp-firebase)", () => {
+    const records = [
+      { hostname: "admin.example.com", type: "CNAME", value: "ghs.googlehosted.com." },
+      { hostname: "example.com", type: "TXT", value: "hosting-site=caelo" },
+      { hostname: "_acme-challenge.example.com", type: "TXT", value: "abc" },
+      { hostname: "example.com", type: "A", value: "199.36.158.100" },
+      { hostname: "www.example.com", type: "CNAME", value: "example.web.app." },
+    ];
+    const g = groupDnsRecords(records, domain);
+    expect(g.setNow.map((r) => `${r.type} ${r.hostname}`)).toEqual([
+      "CNAME admin.example.com",
+      "TXT example.com",
+      "TXT _acme-challenge.example.com",
+    ]);
+    expect(g.atGoLive.map((r) => `${r.type} ${r.hostname}`)).toEqual([
+      "A example.com",
+      "CNAME www.example.com",
+    ]);
+  });
+
+  it("compares host names case- and trailing-dot-insensitively", () => {
+    expect(
+      switchesPublicSite({ hostname: "Example.com.", type: "aaaa", value: "::1" }, domain),
+    ).toBe(true);
+    expect(
+      switchesPublicSite({ hostname: "staging.example.com", type: "CNAME", value: "x" }, domain),
+    ).toBe(false);
+  });
+});
+
+describe("formatDnsRecordGroups", () => {
+  it("labels both groups and warns about the go-live records", () => {
+    const lines = formatDnsRecordGroups(
+      groupDnsRecords(
+        [
+          { hostname: "example.com", type: "A", value: "1.2.3.4" },
+          { hostname: "admin.example.com", type: "A", value: "1.2.3.4" },
+        ],
+        domain,
+      ),
+      domain,
+    );
+    expect(lines[0]).toBe("Set now (new hosts, nothing live uses them):");
+    expect(lines).toContain("Only at go-live (these move example.com to Caelo):");
+    expect(lines.join("\n")).toContain("takes a website that is live on example.com offline");
+    expect(lines.indexOf("Only at go-live (these move example.com to Caelo):")).toBeGreaterThan(
+      lines.findIndex((l) => /^\s+A\s+admin\.example\.com\s/.test(l)),
+    );
+  });
+
+  it("omits an empty group", () => {
+    const lines = formatDnsRecordGroups(
+      groupDnsRecords([{ hostname: "admin.example.com", type: "A", value: "1.2.3.4" }], domain),
+      domain,
+    );
+    expect(lines.some((l) => l.includes("go-live"))).toBe(false);
+  });
+});

package/src/dns/groups.ts

@@ -0,0 +1,86 @@
+// SPDX-License-Identifier: MPL-2.0
+
+/**
+ * Which install DNS records are safe to set right away, and which switch the
+ * public website and so wait for go-live.
+ *
+ * An operator installing Caelo usually still runs a live site on the main
+ * domain. The admin host, the staging host and verification TXT records are
+ * new names nobody serves yet — set them now. An A / AAAA / CNAME record on
+ * the main domain or `www.` repoints every visitor to Caelo, which serves an
+ * empty site until the first publish: setting it during the install takes
+ * the old site down. Those wait for go-live.
+ */
+
+/** A record as the stacks report it (`dnsRecordsRequiredOut`). */
+export interface InstallDnsRecord {
+  readonly hostname: string;
+  readonly type: string;
+  readonly value: string;
+  readonly purpose?: string;
+}
+
+export interface DnsRecordGroups<R extends InstallDnsRecord> {
+  /** Records for hosts no live site uses — set during the install. */
+  readonly setNow: R[];
+  /** Records that move the public site to Caelo — set at go-live only. */
+  readonly atGoLive: R[];
+}
+
+const TRAFFIC_TYPES = new Set(["A", "AAAA", "CNAME"]);
+
+function bare(hostname: string): string {
+  return hostname.trim().toLowerCase().replace(/\.$/, "");
+}
+
+/** Whether `record` repoints the public site on `domain` (apex or www). */
+export function switchesPublicSite(record: InstallDnsRecord, domain: string): boolean {
+  const host = bare(record.hostname);
+  const apex = bare(domain);
+  return TRAFFIC_TYPES.has(record.type.toUpperCase()) && (host === apex || host === `www.${apex}`);
+}
+
+/** Split `records` into {@link DnsRecordGroups} for the install's `domain`. */
+export function groupDnsRecords<R extends InstallDnsRecord>(
+  records: readonly R[],
+  domain: string,
+): DnsRecordGroups<R> {
+  const setNow: R[] = [];
+  const atGoLive: R[] = [];
+  for (const r of records) (switchesPublicSite(r, domain) ? atGoLive : setNow).push(r);
+  return { setNow, atGoLive };
+}
+
+/** One printable line per record: `TYPE   host → value`. */
+export function dnsRecordLine(r: InstallDnsRecord, hostWidth: number): string {
+  return `  ${r.type.padEnd(6)} ${r.hostname.padEnd(hostWidth)} → ${r.value}`;
+}
+
+/**
+ * The two labelled groups as text lines, for the installer's final summary.
+ * An empty group is left out; the go-live group always carries its warning.
+ */
+export function formatDnsRecordGroups(
+  groups: DnsRecordGroups<InstallDnsRecord>,
+  domain: string,
+): string[] {
+  const width = Math.max(
+    domain.length,
+    ...[...groups.setNow, ...groups.atGoLive].map((r) => r.hostname.length),
+  );
+  const lines: string[] = [];
+  if (groups.setNow.length > 0) {
+    lines.push("Set now (new hosts, nothing live uses them):");
+    for (const r of groups.setNow) lines.push(dnsRecordLine(r, width));
+  }
+  if (groups.atGoLive.length > 0) {
+    if (lines.length > 0) lines.push("");
+    lines.push(`Only at go-live (these move ${domain} to Caelo):`);
+    for (const r of groups.atGoLive) lines.push(dnsRecordLine(r, width));
+    lines.push(
+      `  Warning: setting these now takes a website that is live on ${domain} offline.`,
+      "  Replace the existing records once you have published the new site.",
+    );
+  }
+  return lines;
+}

package/src/dns/index.ts

@@ -0,0 +1,56 @@
+// SPDX-License-Identifier: MPL-2.0
+
+/**
+ * DNS adapters — each provider implements the same `DnsAdapter`
+ * interface so the wizard can pick by registrar. Per CLAUDE.md §11.C:
+ * "DNS records land automatically when the registrar API is supported.
+ * Otherwise the CLI prints the records, polls DNS, and continues only
+ * when resolution succeeds."
+ *
+ * v1 adapters:
+ *   - Cloudflare — zero-touch via the Cloudflare API
+ *   - Route53     — zero-touch via the AWS SDK
+ *   - manual      — print records + verify-poll via dig
+ *
+ * Detection order: Cloudflare → Route53 → manual fallback. Detection
+ * is best-effort; the wizard always prompts to confirm.
+ */
+
+import { detectCloudflareAuth, makeCloudflareAdapter } from "./cloudflare.js";
+import { makeManualAdapter } from "./manual.js";
+import type { DnsAdapter } from "./types.js";
+
+export type { DnsAdapter } from "./types.js";
+
+/**
+ * Pick the right DNS adapter based on environment + interactive
+ * detection. The CLI's wizard calls this; if a registrar's API is
+ * reachable, returns its adapter. Otherwise falls back to manual.
+ */
+export async function pickDnsAdapter(opts: {
+  domain: string;
+  forceManual?: boolean;
+  /** No prompts: the manual adapter prints the records and polls (the install job). */
+  nonInteractive?: boolean;
+}): Promise<DnsAdapter> {
+  const manual = { domain: opts.domain, nonInteractive: opts.nonInteractive ?? false };
+  if (opts.forceManual) {
+    return makeManualAdapter(manual);
+  }
+
+  // Cloudflare — needs CLOUDFLARE_API_TOKEN (read-only zone scope is
+  // enough for detection; create needs Zone:DNS:Edit).
+  const cf = await detectCloudflareAuth();
+  if (cf.token) {
+    return makeCloudflareAdapter({
+      domain: opts.domain,
+      apiToken: cf.token,
+    });
+  }
+
+  // Route53 — would need AWS_PROFILE / AWS_ACCESS_KEY_ID. Not yet
+  // implemented; falls through to manual. The interface + adapter
+  // skeleton land here so the future PR is one file.
+
+  return makeManualAdapter(manual);
+}