@jaggr2/cdk-cf-dns 0.1.0

package/lib/certificate.js

@@ -0,0 +1,83 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.CloudflareValidatedCertificate = void 0;
+const acm = __importStar(require("aws-cdk-lib/aws-certificatemanager"));
+const cdk = __importStar(require("aws-cdk-lib"));
+const constructs_1 = require("constructs");
+const provider_1 = require("./provider");
+/**
+ * An ACM certificate whose DNS validation records are written into Cloudflare
+ * automatically, removing the manual copy-paste step.
+ *
+ * CloudFormation does not expose the validation `ResourceRecord` as a
+ * certificate attribute, so a custom resource calls `acm:DescribeCertificate`,
+ * polls until the records are populated (they are absent for a few seconds
+ * after creation), and writes each unique CNAME into Cloudflare.
+ *
+ * Note: if the certificate is attached to CloudFront it must live in
+ * `us-east-1`; this construct does not solve cross-region certificates.
+ */
+class CloudflareValidatedCertificate extends constructs_1.Construct {
+    /**
+     * The underlying ACM certificate.
+     */
+    certificate;
+    constructor(scope, id, props) {
+        super(scope, id);
+        // Create the certificate with DNS validation but no hosted zone: the
+        // validation records are written to Cloudflare by the custom resource.
+        this.certificate = new acm.Certificate(this, 'Certificate', {
+            domainName: props.domainName,
+            subjectAlternativeNames: props.subjectAlternativeNames,
+            validation: acm.CertificateValidation.fromDns(),
+        });
+        const provider = provider_1.CloudflareCertificateProvider.getOrCreate(this);
+        provider.grantSecretRead(props.zone.apiToken);
+        const validation = new cdk.CustomResource(this, 'DnsValidation', {
+            serviceToken: provider.serviceToken,
+            resourceType: 'Custom::CloudflareCertificateDnsValidation',
+            properties: {
+                certificateArn: this.certificate.certificateArn,
+                zoneId: props.zone.zoneId,
+                apiTokenSecretArn: props.zone.apiToken.secretArn,
+            },
+        });
+        // The validation resource can only read records once the certificate exists.
+        validation.node.addDependency(this.certificate);
+    }
+}
+exports.CloudflareValidatedCertificate = CloudflareValidatedCertificate;
+//# sourceMappingURL=certificate.js.map

package/lib/certificate.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"certificate.js","sourceRoot":"","sources":["../src/certificate.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAAA,wEAA0D;AAC1D,iDAAmC;AACnC,2CAAuC;AACvC,yCAA2D;AAyB3D;;;;;;;;;;;GAWG;AACH,MAAa,8BAA+B,SAAQ,sBAAS;IAC3D;;OAEG;IACa,WAAW,CAAkB;IAE7C,YAAmB,KAAgB,EAAE,EAAU,EAAE,KAA0C;QACzF,KAAK,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;QAEjB,qEAAqE;QACrE,uEAAuE;QACvE,IAAI,CAAC,WAAW,GAAG,IAAI,GAAG,CAAC,WAAW,CAAC,IAAI,EAAE,aAAa,EAAE;YAC1D,UAAU,EAAE,KAAK,CAAC,UAAU;YAC5B,uBAAuB,EAAE,KAAK,CAAC,uBAAuB;YACtD,UAAU,EAAE,GAAG,CAAC,qBAAqB,CAAC,OAAO,EAAE;SAChD,CAAC,CAAC;QAEH,MAAM,QAAQ,GAAG,wCAA6B,CAAC,WAAW,CAAC,IAAI,CAAC,CAAC;QACjE,QAAQ,CAAC,eAAe,CAAC,KAAK,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;QAE9C,MAAM,UAAU,GAAG,IAAI,GAAG,CAAC,cAAc,CAAC,IAAI,EAAE,eAAe,EAAE;YAC/D,YAAY,EAAE,QAAQ,CAAC,YAAY;YACnC,YAAY,EAAE,4CAA4C;YAC1D,UAAU,EAAE;gBACV,cAAc,EAAE,IAAI,CAAC,WAAW,CAAC,cAAc;gBAC/C,MAAM,EAAE,KAAK,CAAC,IAAI,CAAC,MAAM;gBACzB,iBAAiB,EAAE,KAAK,CAAC,IAAI,CAAC,QAAQ,CAAC,SAAS;aACjD;SACF,CAAC,CAAC;QAEH,6EAA6E;QAC7E,UAAU,CAAC,IAAI,CAAC,aAAa,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC;IAClD,CAAC;CACF;AAjCD,wEAiCC"}

package/lib/handler/acm.d.ts

@@ -0,0 +1,12 @@
+import type { CloudFormationCustomResourceEvent } from 'aws-lambda';
+/**
+ * The Lambda handler for the `Custom::CloudflareCertificateDnsValidation`
+ * custom resource.
+ *
+ * @param event The CloudFormation custom resource event.
+ * @returns The custom resource result with `PhysicalResourceId` and `Data`.
+ */
+export declare function handler(event: CloudFormationCustomResourceEvent): Promise<{
+    PhysicalResourceId: string;
+    Data: Record<string, unknown>;
+}>;

package/lib/handler/acm.js

@@ -0,0 +1,131 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.handler = handler;
+const client_acm_1 = require("@aws-sdk/client-acm");
+const cloudflare_1 = require("./cloudflare");
+const acmClient = new client_acm_1.ACMClient({});
+/**
+ * Sleeps for the given number of milliseconds.
+ */
+async function sleep(ms) {
+    await new Promise((resolve) => setTimeout(resolve, ms));
+}
+/**
+ * Describes the certificate and returns the deduplicated DNS validation records
+ * that ACM currently exposes. A wildcard SAN and its apex share one record, so
+ * records are deduplicated on the name/value pair.
+ */
+async function describeValidationRecords(certificateArn) {
+    const response = await acmClient.send(new client_acm_1.DescribeCertificateCommand({ CertificateArn: certificateArn }));
+    const options = response.Certificate?.DomainValidationOptions ?? [];
+    const records = [];
+    for (const option of options) {
+        const resourceRecord = option.ResourceRecord;
+        if (resourceRecord?.Name && resourceRecord.Value) {
+            const name = resourceRecord.Name.replace(/\.$/, '');
+            const value = resourceRecord.Value.replace(/\.$/, '');
+            const duplicate = records.some((r) => r.name === name && r.value === value);
+            if (!duplicate) {
+                records.push({ name, value });
+            }
+        }
+    }
+    return records;
+}
+/**
+ * Polls ACM until the validation `ResourceRecord`s are populated. They are
+ * absent for a few seconds after the certificate is created, so the handler
+ * retries until they appear or the deadline is reached.
+ */
+async function pollValidationRecords(certificateArn, delaySeconds, timeoutSeconds) {
+    const deadline = Date.now() + timeoutSeconds * 1000;
+    while (Date.now() < deadline) {
+        const records = await describeValidationRecords(certificateArn);
+        if (records.length > 0) {
+            return records;
+        }
+        await sleep(delaySeconds * 1000);
+    }
+    throw new Error(`Timed out waiting for ACM DNS validation records for ${certificateArn}`);
+}
+/**
+ * Creates (or adopts) a CNAME validation record in Cloudflare. Validation
+ * records must never be proxied and must use a plain TTL.
+ */
+async function upsertCname(zoneId, name, value, token) {
+    const payload = {
+        name,
+        type: 'CNAME',
+        content: value,
+        ttl: 60,
+        proxied: false,
+    };
+    const response = await (0, cloudflare_1.request)(`/zones/${zoneId}/dns_records`, { method: 'POST', token, body: payload });
+    if ((0, cloudflare_1.isAlreadyExists)(response)) {
+        (0, cloudflare_1.log)('validation', { message: 'validation record already exists; adopting', zoneId, name });
+        const existing = await (0, cloudflare_1.findRecord)(zoneId, name, 'CNAME', token);
+        if (!existing) {
+            throw new Error(`Cloudflare reported ${name} already exists but the lookup found no matching record`);
+        }
+        await (0, cloudflare_1.request)(`/zones/${zoneId}/dns_records/${existing.id}`, { method: 'PATCH', token, body: payload });
+        return;
+    }
+    (0, cloudflare_1.assertSuccess)(response);
+}
+/**
+ * Handles both `Create` and `Update`: reads the certificate's validation
+ * records from ACM and writes each unique CNAME into Cloudflare.
+ */
+async function onUpsert(event) {
+    const properties = event.ResourceProperties;
+    const certificateArn = String(properties.certificateArn);
+    const zoneId = String(properties.zoneId);
+    const token = await (0, cloudflare_1.getApiToken)(String(properties.apiTokenSecretArn));
+    const delaySeconds = Number(properties.pollDelaySeconds ?? 5);
+    const timeoutSeconds = Number(properties.pollTimeoutSeconds ?? 120);
+    (0, cloudflare_1.log)('validation', { certificateArn, zoneId });
+    const records = await pollValidationRecords(certificateArn, delaySeconds, timeoutSeconds);
+    for (const record of records) {
+        await upsertCname(zoneId, record.name, record.value, token);
+    }
+    (0, cloudflare_1.log)('validation', { message: `wrote ${records.length} validation record(s)`, names: records.map((r) => r.name) });
+    return {
+        PhysicalResourceId: certificateArn,
+        Data: { ValidationRecords: records.map((r) => r.name) },
+    };
+}
+/**
+ * Handles `Delete`. The validation CNAMEs are left in Cloudflare — they are
+ * harmless after issuance and cleaning them up would add fragile delete logic.
+ */
+async function onDelete(event) {
+    (0, cloudflare_1.log)('validation', { message: 'delete; leaving validation records in Cloudflare' });
+    return { PhysicalResourceId: event.PhysicalResourceId, Data: {} };
+}
+/**
+ * The Lambda handler for the `Custom::CloudflareCertificateDnsValidation`
+ * custom resource.
+ *
+ * @param event The CloudFormation custom resource event.
+ * @returns The custom resource result with `PhysicalResourceId` and `Data`.
+ */
+async function handler(event) {
+    try {
+        (0, cloudflare_1.log)('event', { requestType: event.RequestType });
+        switch (event.RequestType) {
+            case 'Create':
+                return await onUpsert(event);
+            case 'Update':
+                return await onUpsert(event);
+            case 'Delete':
+                return await onDelete(event);
+            default:
+                throw new Error(`Unsupported RequestType: ${event.RequestType}`);
+        }
+    }
+    catch (error) {
+        const message = error instanceof Error ? error.message : String(error);
+        throw new Error(`Cloudflare ACM DNS validation custom resource failed during ${event.RequestType}: ${message}`);
+    }
+}
+//# sourceMappingURL=acm.js.map

package/lib/handler/acm.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"acm.js","sourceRoot":"","sources":["../../src/handler/acm.ts"],"names":[],"mappings":";;AA6IA,0BAkBC;AA/JD,oDAA4E;AAE5E,6CAAqG;AAErG,MAAM,SAAS,GAAG,IAAI,sBAAS,CAAC,EAAE,CAAC,CAAC;AAUpC;;GAEG;AACH,KAAK,UAAU,KAAK,CAAC,EAAU;IAC7B,MAAM,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,UAAU,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC,CAAC;AAC1D,CAAC;AAED;;;;GAIG;AACH,KAAK,UAAU,yBAAyB,CAAC,cAAsB;IAC7D,MAAM,QAAQ,GAAG,MAAM,SAAS,CAAC,IAAI,CAAC,IAAI,uCAA0B,CAAC,EAAE,cAAc,EAAE,cAAc,EAAE,CAAC,CAAC,CAAC;IAC1G,MAAM,OAAO,GAAG,QAAQ,CAAC,WAAW,EAAE,uBAAuB,IAAI,EAAE,CAAC;IACpE,MAAM,OAAO,GAAuB,EAAE,CAAC;IAEvC,KAAK,MAAM,MAAM,IAAI,OAAO,EAAE,CAAC;QAC7B,MAAM,cAAc,GAAG,MAAM,CAAC,cAAc,CAAC;QAC7C,IAAI,cAAc,EAAE,IAAI,IAAI,cAAc,CAAC,KAAK,EAAE,CAAC;YACjD,MAAM,IAAI,GAAG,cAAc,CAAC,IAAI,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;YACpD,MAAM,KAAK,GAAG,cAAc,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;YACtD,MAAM,SAAS,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,IAAI,IAAI,CAAC,CAAC,KAAK,KAAK,KAAK,CAAC,CAAC;YAC5E,IAAI,CAAC,SAAS,EAAE,CAAC;gBACf,OAAO,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;YAChC,CAAC;QACH,CAAC;IACH,CAAC;IAED,OAAO,OAAO,CAAC;AACjB,CAAC;AAED;;;;GAIG;AACH,KAAK,UAAU,qBAAqB,CAClC,cAAsB,EACtB,YAAoB,EACpB,cAAsB;IAEtB,MAAM,QAAQ,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,cAAc,GAAG,IAAI,CAAC;IAEpD,OAAO,IAAI,CAAC,GAAG,EAAE,GAAG,QAAQ,EAAE,CAAC;QAC7B,MAAM,OAAO,GAAG,MAAM,yBAAyB,CAAC,cAAc,CAAC,CAAC;QAChE,IAAI,OAAO,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACvB,OAAO,OAAO,CAAC;QACjB,CAAC;QACD,MAAM,KAAK,CAAC,YAAY,GAAG,IAAI,CAAC,CAAC;IACnC,CAAC;IAED,MAAM,IAAI,KAAK,CAAC,wDAAwD,cAAc,EAAE,CAAC,CAAC;AAC5F,CAAC;AAED;;;GAGG;AACH,KAAK,UAAU,WAAW,CAAC,MAAc,EAAE,IAAY,EAAE,KAAa,EAAE,KAAa;IACnF,MAAM,OAAO,GAA4B;QACvC,IAAI;QACJ,IAAI,EAAE,OAAO;QACb,OAAO,EAAE,KAAK;QACd,GAAG,EAAE,EAAE;QACP,OAAO,EAAE,KAAK;KACf,CAAC;IAEF,MAAM,QAAQ,GAAG,MAAM,IAAA,oBAAO,EAAC,UAAU,MAAM,cAAc,EAAE,EAAE,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,OAAO,EAAE,CAAC,CAAC;IAEzG,IAAI,IAAA,4BAAe,EAAC,QAAQ,CAAC,EAAE,CAAC;QAC9B,IAAA,gBAAG,EAAC,YAAY,EAAE,EAAE,OAAO,EAAE,4CAA4C,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC;QAC3F,MAAM,QAAQ,GAAG,MAAM,IAAA,uBAAU,EAAC,MAAM,EAAE,IAAI,EAAE,OAAO,EAAE,KAAK,CAAC,CAAC;QAChE,IAAI,CAAC,QAAQ,EAAE,CAAC;YACd,MAAM,IAAI,KAAK,CAAC,uBAAuB,IAAI,yDAAyD,CAAC,CAAC;QACxG,CAAC;QACD,MAAM,IAAA,oBAAO,EAAC,UAAU,MAAM,gBAAgB,QAAQ,CAAC,EAAE,EAAE,EAAE,EAAE,MAAM,EAAE,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,OAAO,EAAE,CAAC,CAAC;QACxG,OAAO;IACT,CAAC;IAED,IAAA,0BAAa,EAAC,QAAQ,CAAC,CAAC;AAC1B,CAAC;AAED;;;GAGG;AACH,KAAK,UAAU,QAAQ,CACrB,KAAwF;IAExF,MAAM,UAAU,GAAG,KAAK,CAAC,kBAA6C,CAAC;IACvE,MAAM,cAAc,GAAG,MAAM,CAAC,UAAU,CAAC,cAAc,CAAC,CAAC;IACzD,MAAM,MAAM,GAAG,MAAM,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC;IACzC,MAAM,KAAK,GAAG,MAAM,IAAA,wBAAW,EAAC,MAAM,CAAC,UAAU,CAAC,iBAAiB,CAAC,CAAC,CAAC;IACtE,MAAM,YAAY,GAAG,MAAM,CAAC,UAAU,CAAC,gBAAgB,IAAI,CAAC,CAAC,CAAC;IAC9D,MAAM,cAAc,GAAG,MAAM,CAAC,UAAU,CAAC,kBAAkB,IAAI,GAAG,CAAC,CAAC;IAEpE,IAAA,gBAAG,EAAC,YAAY,EAAE,EAAE,cAAc,EAAE,MAAM,EAAE,CAAC,CAAC;IAE9C,MAAM,OAAO,GAAG,MAAM,qBAAqB,CAAC,cAAc,EAAE,YAAY,EAAE,cAAc,CAAC,CAAC;IAC1F,KAAK,MAAM,MAAM,IAAI,OAAO,EAAE,CAAC;QAC7B,MAAM,WAAW,CAAC,MAAM,EAAE,MAAM,CAAC,IAAI,EAAE,MAAM,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC;IAC9D,CAAC;IAED,IAAA,gBAAG,EAAC,YAAY,EAAE,EAAE,OAAO,EAAE,SAAS,OAAO,CAAC,MAAM,uBAAuB,EAAE,KAAK,EAAE,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IAClH,OAAO;QACL,kBAAkB,EAAE,cAAc;QAClC,IAAI,EAAE,EAAE,iBAAiB,EAAE,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE;KACxD,CAAC;AACJ,CAAC;AAED;;;GAGG;AACH,KAAK,UAAU,QAAQ,CAAC,KAA8C;IACpE,IAAA,gBAAG,EAAC,YAAY,EAAE,EAAE,OAAO,EAAE,kDAAkD,EAAE,CAAC,CAAC;IACnF,OAAO,EAAE,kBAAkB,EAAE,KAAK,CAAC,kBAAkB,EAAE,IAAI,EAAE,EAAE,EAAE,CAAC;AACpE,CAAC;AAED;;;;;;GAMG;AACI,KAAK,UAAU,OAAO,CAAC,KAAwC;IACpE,IAAI,CAAC;QACH,IAAA,gBAAG,EAAC,OAAO,EAAE,EAAE,WAAW,EAAE,KAAK,CAAC,WAAW,EAAE,CAAC,CAAC;QAEjD,QAAQ,KAAK,CAAC,WAAW,EAAE,CAAC;YAC1B,KAAK,QAAQ;gBACX,OAAO,MAAM,QAAQ,CAAC,KAAK,CAAC,CAAC;YAC/B,KAAK,QAAQ;gBACX,OAAO,MAAM,QAAQ,CAAC,KAAK,CAAC,CAAC;YAC/B,KAAK,QAAQ;gBACX,OAAO,MAAM,QAAQ,CAAC,KAAK,CAAC,CAAC;YAC/B;gBACE,MAAM,IAAI,KAAK,CAAC,4BAA6B,KAAkC,CAAC,WAAW,EAAE,CAAC,CAAC;QACnG,CAAC;IACH,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,MAAM,OAAO,GAAG,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;QACvE,MAAM,IAAI,KAAK,CAAC,+DAA+D,KAAK,CAAC,WAAW,KAAK,OAAO,EAAE,CAAC,CAAC;IAClH,CAAC;AACH,CAAC"}

package/lib/handler/cloudflare.d.ts

@@ -0,0 +1,133 @@
+/**
+ * Shared helpers for the Lambda handlers. This module is bundled into each
+ * handler entry point by esbuild; it is never imported by CDK library code.
+ */
+/**
+ * The base URL for the Cloudflare API v4.
+ */
+export declare const CF_BASE_URL = "https://api.cloudflare.com/client/v4";
+/**
+ * How many attempts the retrying HTTP helper makes before giving up.
+ */
+export declare const MAX_ATTEMPTS = 5;
+/**
+ * Base backoff delay in milliseconds, doubled each attempt with full jitter.
+ */
+export declare const BACKOFF_BASE_MS = 500;
+/**
+ * Upper bound for a single backoff sleep in milliseconds.
+ */
+export declare const BACKOFF_CAP_MS = 4000;
+/**
+ * Cloudflare record IDs are 32 lowercase hex characters.
+ */
+export declare const RECORD_ID_PATTERN: RegExp;
+/**
+ * The shape of a Cloudflare API response envelope.
+ */
+export interface CloudflareResponse {
+    success: boolean;
+    errors: Array<{
+        code: number;
+        message: string;
+    }>;
+    messages: Array<{
+        code: number;
+        message: string;
+    }>;
+    result: unknown;
+}
+/**
+ * A DNS record as returned by the Cloudflare API.
+ */
+export interface CloudflareDnsRecord {
+    id: string;
+    name: string;
+    type: string;
+}
+/**
+ * Redacts strings that look like Cloudflare credentials (and known token
+ * values) from arbitrary log payloads.
+ *
+ * @param value The value to redact.
+ * @returns A copy of `value` with token-shaped strings replaced.
+ */
+export declare function redact(value: unknown): unknown;
+/**
+ * Logs a message to CloudWatch with all token-shaped strings redacted.
+ */
+export declare function log(...args: unknown[]): void;
+/**
+ * Resolves the Cloudflare API token from Secrets Manager, caching it per ARN so
+ * warm invocations skip the API call. Supports the secret being either a raw
+ * string or a JSON blob with an `apiToken` key.
+ *
+ * @param secretArn The ARN of the secret holding the token.
+ */
+export declare function getApiToken(secretArn: string): Promise<string>;
+/**
+ * A Cloudflare API error, carrying the HTTP status and the error payload so the
+ * lifecycle logic can inspect specific error codes.
+ */
+export declare class CloudflareApiError extends Error {
+    readonly status: number;
+    readonly errors: Array<{
+        code: number;
+        message: string;
+    }>;
+    constructor(status: number, errors: Array<{
+        code: number;
+        message: string;
+    }>);
+}
+/**
+ * Performs an HTTP request against the Cloudflare API with retries.
+ *
+ * Retries with exponential backoff + full jitter on HTTP 429, 5xx and network
+ * errors, honouring the `Retry-After` header when present.
+ *
+ * @param path    The API path, e.g. `/zones/{id}/dns_records`.
+ * @param options Request options. A resolved token is sent as `token`.
+ */
+export declare function request(path: string, options: {
+    method: string;
+    token?: string;
+    body?: unknown;
+}): Promise<{
+    status: number;
+    body: CloudflareResponse;
+}>;
+/**
+ * Throws a descriptive error when the Cloudflare response has `success: false`.
+ */
+export declare function assertSuccess(response: {
+    status: number;
+    body: CloudflareResponse;
+}): void;
+/**
+ * Returns true when the response indicates the record already exists.
+ */
+export declare function isAlreadyExists(response: {
+    status: number;
+    body: CloudflareResponse;
+}): boolean;
+/**
+ * Returns true when the response indicates the record no longer exists.
+ */
+export declare function isRecordDoesNotExist(response: {
+    status: number;
+    body: CloudflareResponse;
+}): boolean;
+/**
+ * Builds the DNS record payload sent to the Cloudflare API from the custom
+ * resource properties.
+ */
+export declare function buildRecordPayload(properties: Record<string, unknown>): Record<string, unknown>;
+/**
+ * Creates a DNS record and returns the Cloudflare record.
+ */
+export declare function createRecord(zoneId: string, payload: Record<string, unknown>, token: string): Promise<CloudflareDnsRecord>;
+/**
+ * Looks up a record by name and type in the zone.
+ */
+export declare function findRecord(zoneId: string, name: string, type: string, token: string): Promise<CloudflareDnsRecord | undefined>;

package/lib/handler/cloudflare.js

@@ -0,0 +1,264 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.CloudflareApiError = exports.RECORD_ID_PATTERN = exports.BACKOFF_CAP_MS = exports.BACKOFF_BASE_MS = exports.MAX_ATTEMPTS = exports.CF_BASE_URL = void 0;
+exports.redact = redact;
+exports.log = log;
+exports.getApiToken = getApiToken;
+exports.request = request;
+exports.assertSuccess = assertSuccess;
+exports.isAlreadyExists = isAlreadyExists;
+exports.isRecordDoesNotExist = isRecordDoesNotExist;
+exports.buildRecordPayload = buildRecordPayload;
+exports.createRecord = createRecord;
+exports.findRecord = findRecord;
+const client_secrets_manager_1 = require("@aws-sdk/client-secrets-manager");
+/**
+ * Shared helpers for the Lambda handlers. This module is bundled into each
+ * handler entry point by esbuild; it is never imported by CDK library code.
+ */
+/**
+ * The base URL for the Cloudflare API v4.
+ */
+exports.CF_BASE_URL = 'https://api.cloudflare.com/client/v4';
+/**
+ * How many attempts the retrying HTTP helper makes before giving up.
+ */
+exports.MAX_ATTEMPTS = 5;
+/**
+ * Base backoff delay in milliseconds, doubled each attempt with full jitter.
+ */
+exports.BACKOFF_BASE_MS = 500;
+/**
+ * Upper bound for a single backoff sleep in milliseconds.
+ */
+exports.BACKOFF_CAP_MS = 4000;
+/**
+ * A regular expression matching strings that look like Cloudflare credentials
+ * (API tokens are 40 characters, global API keys 37). Anything matching is
+ * redacted from logs.
+ */
+const TOKEN_PATTERN = /[A-Za-z0-9_-]{37,}/g;
+/**
+ * Cloudflare record IDs are 32 lowercase hex characters.
+ */
+exports.RECORD_ID_PATTERN = /^[a-f0-9]{32}$/;
+const secretCache = new Map();
+let secretsClient;
+/**
+ * Redacts strings that look like Cloudflare credentials (and known token
+ * values) from arbitrary log payloads.
+ *
+ * @param value The value to redact.
+ * @returns A copy of `value` with token-shaped strings replaced.
+ */
+function redact(value) {
+    if (typeof value === 'string') {
+        return value.replace(TOKEN_PATTERN, '[REDACTED]');
+    }
+    if (Array.isArray(value)) {
+        return value.map((item) => redact(item));
+    }
+    if (value !== null && typeof value === 'object') {
+        const out = {};
+        for (const [key, item] of Object.entries(value)) {
+            out[key] = redact(item);
+        }
+        return out;
+    }
+    return value;
+}
+/**
+ * Logs a message to CloudWatch with all token-shaped strings redacted.
+ */
+function log(...args) {
+    console.log(...args.map((arg) => redact(arg)));
+}
+/**
+ * Resolves the Cloudflare API token from Secrets Manager, caching it per ARN so
+ * warm invocations skip the API call. Supports the secret being either a raw
+ * string or a JSON blob with an `apiToken` key.
+ *
+ * @param secretArn The ARN of the secret holding the token.
+ */
+async function getApiToken(secretArn) {
+    const cached = secretCache.get(secretArn);
+    if (cached !== undefined) {
+        return cached;
+    }
+    if (!secretsClient) {
+        secretsClient = new client_secrets_manager_1.SecretsManagerClient({});
+    }
+    const response = await secretsClient.send(new client_secrets_manager_1.GetSecretValueCommand({ SecretId: secretArn }));
+    const secretString = response.SecretString;
+    if (secretString === undefined) {
+        throw new Error(`Secret ${secretArn} has no SecretString; store the API token as a raw string or a JSON blob with an "apiToken" key`);
+    }
+    let token = secretString;
+    try {
+        const parsed = JSON.parse(secretString);
+        if (parsed !== null && typeof parsed === 'object' && typeof parsed.apiToken === 'string') {
+            token = parsed.apiToken;
+        }
+    }
+    catch {
+        // Not JSON: treat the raw string as the token.
+    }
+    if (token.length === 0) {
+        throw new Error(`Secret ${secretArn} resolved to an empty API token`);
+    }
+    secretCache.set(secretArn, token);
+    return token;
+}
+/**
+ * A Cloudflare API error, carrying the HTTP status and the error payload so the
+ * lifecycle logic can inspect specific error codes.
+ */
+class CloudflareApiError extends Error {
+    status;
+    errors;
+    constructor(status, errors) {
+        const details = errors.map((error) => `${error.code}: ${error.message}`).join('; ');
+        super(`Cloudflare API error (HTTP ${status}): ${String(redact(details))}`);
+        this.status = status;
+        this.errors = errors;
+    }
+}
+exports.CloudflareApiError = CloudflareApiError;
+/**
+ * Performs an HTTP request against the Cloudflare API with retries.
+ *
+ * Retries with exponential backoff + full jitter on HTTP 429, 5xx and network
+ * errors, honouring the `Retry-After` header when present.
+ *
+ * @param path    The API path, e.g. `/zones/{id}/dns_records`.
+ * @param options Request options. A resolved token is sent as `token`.
+ */
+async function request(path, options) {
+    const headers = {
+        'Content-Type': 'application/json',
+    };
+    if (options.token !== undefined) {
+        headers['Authorization'] = `Bearer ${options.token}`;
+    }
+    const url = `${exports.CF_BASE_URL}${path}`;
+    const body = options.body === undefined ? undefined : JSON.stringify(options.body);
+    let lastError;
+    for (let attempt = 0; attempt < exports.MAX_ATTEMPTS; attempt++) {
+        try {
+            const response = await fetch(url, {
+                method: options.method,
+                headers,
+                body,
+            });
+            const text = await response.text();
+            let parsed;
+            try {
+                parsed = JSON.parse(text);
+            }
+            catch {
+                parsed = {
+                    success: false,
+                    errors: [{ code: 0, message: `Non-JSON response (HTTP ${response.status}): ${truncate(text, 500)}` }],
+                    messages: [],
+                    result: null,
+                };
+            }
+            const retryable = response.status === 429 || response.status >= 500;
+            if (retryable && attempt < exports.MAX_ATTEMPTS - 1) {
+                await sleepForRetry(response, attempt);
+                continue;
+            }
+            return { status: response.status, body: parsed };
+        }
+        catch (error) {
+            lastError = error instanceof Error ? error : new Error(String(error));
+            if (attempt < exports.MAX_ATTEMPTS - 1) {
+                log('retry', { path, attempt, reason: `network error: ${lastError.message}` });
+                await sleepForRetry(undefined, attempt);
+            }
+        }
+    }
+    throw lastError ?? new Error(`Request to ${path} failed after ${exports.MAX_ATTEMPTS} attempts`);
+}
+/**
+ * Sleeps for a backoff interval, honouring `Retry-After` when the server
+ * provided one and otherwise using exponential backoff with full jitter.
+ */
+async function sleepForRetry(response, attempt) {
+    let delayMs;
+    const retryAfter = response?.headers.get('Retry-After');
+    if (retryAfter !== null && retryAfter !== undefined) {
+        const seconds = Number.parseInt(retryAfter, 10);
+        delayMs = Number.isFinite(seconds) ? Math.min(seconds * 1000, exports.BACKOFF_CAP_MS) : exports.BACKOFF_CAP_MS;
+    }
+    else {
+        const cap = Math.min(exports.BACKOFF_CAP_MS, exports.BACKOFF_BASE_MS * 2 ** attempt);
+        delayMs = Math.random() * cap;
+    }
+    await new Promise((resolve) => setTimeout(resolve, delayMs));
+}
+/**
+ * Truncates a long string for inclusion in an error message.
+ */
+function truncate(value, max) {
+    return value.length > max ? `${value.slice(0, max)}...` : value;
+}
+/**
+ * Throws a descriptive error when the Cloudflare response has `success: false`.
+ */
+function assertSuccess(response) {
+    if (!response.body.success) {
+        throw new CloudflareApiError(response.status, response.body.errors);
+    }
+}
+/**
+ * Returns true when the response indicates the record already exists.
+ */
+function isAlreadyExists(response) {
+    if (response.body.success) {
+        return false;
+    }
+    return response.body.errors.some((error) => {
+        const codeMatches = error.code === 81053 || error.code === 81057;
+        const messageMatches = /already exists/i.test(error.message);
+        return codeMatches || messageMatches;
+    });
+}
+/**
+ * Returns true when the response indicates the record no longer exists.
+ */
+function isRecordDoesNotExist(response) {
+    return response.body.errors.some((error) => error.code === 81044);
+}
+/**
+ * Builds the DNS record payload sent to the Cloudflare API from the custom
+ * resource properties.
+ */
+function buildRecordPayload(properties) {
+    const record = (properties.record ?? {});
+    const payload = {};
+    for (const key of ['name', 'type', 'content', 'data', 'ttl', 'proxied', 'priority', 'comment', 'tags']) {
+        if (record[key] !== undefined) {
+            payload[key] = record[key];
+        }
+    }
+    return payload;
+}
+/**
+ * Creates a DNS record and returns the Cloudflare record.
+ */
+async function createRecord(zoneId, payload, token) {
+    const response = await request(`/zones/${zoneId}/dns_records`, { method: 'POST', token, body: payload });
+    assertSuccess(response);
+    return response.body.result;
+}
+/**
+ * Looks up a record by name and type in the zone.
+ */
+async function findRecord(zoneId, name, type, token) {
+    const response = await request(`/zones/${zoneId}/dns_records?name=${encodeURIComponent(name)}&type=${type}`, { method: 'GET', token });
+    assertSuccess(response);
+    const results = response.body.result;
+    return results[0];
+}
+//# sourceMappingURL=cloudflare.js.map

package/lib/handler/cloudflare.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"cloudflare.js","sourceRoot":"","sources":["../../src/handler/cloudflare.ts"],"names":[],"mappings":";;;AAoEA,wBAeC;AAKD,kBAEC;AASD,kCAgCC;AA2BD,0BAsDC;AA+BD,sCAIC;AAKD,0CASC;AAKD,oDAEC;AAMD,gDAWC;AAKD,oCAIC;AAKD,gCAKC;AAhTD,4EAA8F;AAE9F;;;GAGG;AAEH;;GAEG;AACU,QAAA,WAAW,GAAG,sCAAsC,CAAC;AAElE;;GAEG;AACU,QAAA,YAAY,GAAG,CAAC,CAAC;AAE9B;;GAEG;AACU,QAAA,eAAe,GAAG,GAAG,CAAC;AAEnC;;GAEG;AACU,QAAA,cAAc,GAAG,IAAI,CAAC;AAEnC;;;;GAIG;AACH,MAAM,aAAa,GAAG,qBAAqB,CAAC;AAE5C;;GAEG;AACU,QAAA,iBAAiB,GAAG,gBAAgB,CAAC;AAqBlD,MAAM,WAAW,GAAG,IAAI,GAAG,EAAkB,CAAC;AAC9C,IAAI,aAA+C,CAAC;AAEpD;;;;;;GAMG;AACH,SAAgB,MAAM,CAAC,KAAc;IACnC,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;QAC9B,OAAO,KAAK,CAAC,OAAO,CAAC,aAAa,EAAE,YAAY,CAAC,CAAC;IACpD,CAAC;IACD,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;QACzB,OAAO,KAAK,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC;IAC3C,CAAC;IACD,IAAI,KAAK,KAAK,IAAI,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;QAChD,MAAM,GAAG,GAA4B,EAAE,CAAC;QACxC,KAAK,MAAM,CAAC,GAAG,EAAE,IAAI,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;YAChD,GAAG,CAAC,GAAG,CAAC,GAAG,MAAM,CAAC,IAAI,CAAC,CAAC;QAC1B,CAAC;QACD,OAAO,GAAG,CAAC;IACb,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED;;GAEG;AACH,SAAgB,GAAG,CAAC,GAAG,IAAe;IACpC,OAAO,CAAC,GAAG,CAAC,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;AACjD,CAAC;AAED;;;;;;GAMG;AACI,KAAK,UAAU,WAAW,CAAC,SAAiB;IACjD,MAAM,MAAM,GAAG,WAAW,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;IAC1C,IAAI,MAAM,KAAK,SAAS,EAAE,CAAC;QACzB,OAAO,MAAM,CAAC;IAChB,CAAC;IAED,IAAI,CAAC,aAAa,EAAE,CAAC;QACnB,aAAa,GAAG,IAAI,6CAAoB,CAAC,EAAE,CAAC,CAAC;IAC/C,CAAC;IAED,MAAM,QAAQ,GAAG,MAAM,aAAa,CAAC,IAAI,CAAC,IAAI,8CAAqB,CAAC,EAAE,QAAQ,EAAE,SAAS,EAAE,CAAC,CAAC,CAAC;IAC9F,MAAM,YAAY,GAAG,QAAQ,CAAC,YAAY,CAAC;IAC3C,IAAI,YAAY,KAAK,SAAS,EAAE,CAAC;QAC/B,MAAM,IAAI,KAAK,CAAC,UAAU,SAAS,iGAAiG,CAAC,CAAC;IACxI,CAAC;IAED,IAAI,KAAK,GAAG,YAAY,CAAC;IACzB,IAAI,CAAC;QACH,MAAM,MAAM,GAAY,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,CAAC;QACjD,IAAI,MAAM,KAAK,IAAI,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,OAAQ,MAAkC,CAAC,QAAQ,KAAK,QAAQ,EAAE,CAAC;YACtH,KAAK,GAAI,MAAkC,CAAC,QAAkB,CAAC;QACjE,CAAC;IACH,CAAC;IAAC,MAAM,CAAC;QACP,+CAA+C;IACjD,CAAC;IAED,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACvB,MAAM,IAAI,KAAK,CAAC,UAAU,SAAS,iCAAiC,CAAC,CAAC;IACxE,CAAC;IAED,WAAW,CAAC,GAAG,CAAC,SAAS,EAAE,KAAK,CAAC,CAAC;IAClC,OAAO,KAAK,CAAC;AACf,CAAC;AAED;;;GAGG;AACH,MAAa,kBAAmB,SAAQ,KAAK;IAC3B,MAAM,CAAS;IACf,MAAM,CAA2C;IAEjE,YAAmB,MAAc,EAAE,MAAgD;QACjF,MAAM,OAAO,GAAG,MAAM,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,GAAG,KAAK,CAAC,IAAI,KAAK,KAAK,CAAC,OAAO,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACpF,KAAK,CAAC,8BAA8B,MAAM,MAAM,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,EAAE,CAAC,CAAC;QAC3E,IAAI,CAAC,MAAM,GAAG,MAAM,CAAC;QACrB,IAAI,CAAC,MAAM,GAAG,MAAM,CAAC;IACvB,CAAC;CACF;AAVD,gDAUC;AAED;;;;;;;;GAQG;AACI,KAAK,UAAU,OAAO,CAC3B,IAAY,EACZ,OAA2D;IAE3D,MAAM,OAAO,GAA2B;QACtC,cAAc,EAAE,kBAAkB;KACnC,CAAC;IACF,IAAI,OAAO,CAAC,KAAK,KAAK,SAAS,EAAE,CAAC;QAChC,OAAO,CAAC,eAAe,CAAC,GAAG,UAAU,OAAO,CAAC,KAAK,EAAE,CAAC;IACvD,CAAC;IAED,MAAM,GAAG,GAAG,GAAG,mBAAW,GAAG,IAAI,EAAE,CAAC;IACpC,MAAM,IAAI,GAAG,OAAO,CAAC,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;IAEnF,IAAI,SAA4B,CAAC;IAEjC,KAAK,IAAI,OAAO,GAAG,CAAC,EAAE,OAAO,GAAG,oBAAY,EAAE,OAAO,EAAE,EAAE,CAAC;QACxD,IAAI,CAAC;YACH,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,GAAG,EAAE;gBAChC,MAAM,EAAE,OAAO,CAAC,MAAM;gBACtB,OAAO;gBACP,IAAI;aACL,CAAC,CAAC;YAEH,MAAM,IAAI,GAAG,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAC;YACnC,IAAI,MAA0B,CAAC;YAC/B,IAAI,CAAC;gBACH,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAuB,CAAC;YAClD,CAAC;YAAC,MAAM,CAAC;gBACP,MAAM,GAAG;oBACP,OAAO,EAAE,KAAK;oBACd,MAAM,EAAE,CAAC,EAAE,IAAI,EAAE,CAAC,EAAE,OAAO,EAAE,2BAA2B,QAAQ,CAAC,MAAM,MAAM,QAAQ,CAAC,IAAI,EAAE,GAAG,CAAC,EAAE,EAAE,CAAC;oBACrG,QAAQ,EAAE,EAAE;oBACZ,MAAM,EAAE,IAAI;iBACb,CAAC;YACJ,CAAC;YAED,MAAM,SAAS,GAAG,QAAQ,CAAC,MAAM,KAAK,GAAG,IAAI,QAAQ,CAAC,MAAM,IAAI,GAAG,CAAC;YACpE,IAAI,SAAS,IAAI,OAAO,GAAG,oBAAY,GAAG,CAAC,EAAE,CAAC;gBAC5C,MAAM,aAAa,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC;gBACvC,SAAS;YACX,CAAC;YAED,OAAO,EAAE,MAAM,EAAE,QAAQ,CAAC,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC;QACnD,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,SAAS,GAAG,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,KAAK,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC;YACtE,IAAI,OAAO,GAAG,oBAAY,GAAG,CAAC,EAAE,CAAC;gBAC/B,GAAG,CAAC,OAAO,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,MAAM,EAAE,kBAAkB,SAAS,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC;gBAC/E,MAAM,aAAa,CAAC,SAAS,EAAE,OAAO,CAAC,CAAC;YAC1C,CAAC;QACH,CAAC;IACH,CAAC;IAED,MAAM,SAAS,IAAI,IAAI,KAAK,CAAC,cAAc,IAAI,iBAAiB,oBAAY,WAAW,CAAC,CAAC;AAC3F,CAAC;AAED;;;GAGG;AACH,KAAK,UAAU,aAAa,CAAC,QAA8B,EAAE,OAAe;IAC1E,IAAI,OAAe,CAAC;IAEpB,MAAM,UAAU,GAAG,QAAQ,EAAE,OAAO,CAAC,GAAG,CAAC,aAAa,CAAC,CAAC;IACxD,IAAI,UAAU,KAAK,IAAI,IAAI,UAAU,KAAK,SAAS,EAAE,CAAC;QACpD,MAAM,OAAO,GAAG,MAAM,CAAC,QAAQ,CAAC,UAAU,EAAE,EAAE,CAAC,CAAC;QAChD,OAAO,GAAG,MAAM,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,OAAO,GAAG,IAAI,EAAE,sBAAc,CAAC,CAAC,CAAC,CAAC,sBAAc,CAAC;IACjG,CAAC;SAAM,CAAC;QACN,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,CAAC,sBAAc,EAAE,uBAAe,GAAG,CAAC,IAAI,OAAO,CAAC,CAAC;QACrE,OAAO,GAAG,IAAI,CAAC,MAAM,EAAE,GAAG,GAAG,CAAC;IAChC,CAAC;IAED,MAAM,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,UAAU,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC,CAAC;AAC/D,CAAC;AAED;;GAEG;AACH,SAAS,QAAQ,CAAC,KAAa,EAAE,GAAW;IAC1C,OAAO,KAAK,CAAC,MAAM,GAAG,GAAG,CAAC,CAAC,CAAC,GAAG,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC;AAClE,CAAC;AAED;;GAEG;AACH,SAAgB,aAAa,CAAC,QAAsD;IAClF,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,OAAO,EAAE,CAAC;QAC3B,MAAM,IAAI,kBAAkB,CAAC,QAAQ,CAAC,MAAM,EAAE,QAAQ,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;IACtE,CAAC;AACH,CAAC;AAED;;GAEG;AACH,SAAgB,eAAe,CAAC,QAAsD;IACpF,IAAI,QAAQ,CAAC,IAAI,CAAC,OAAO,EAAE,CAAC;QAC1B,OAAO,KAAK,CAAC;IACf,CAAC;IACD,OAAO,QAAQ,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,EAAE;QACzC,MAAM,WAAW,GAAG,KAAK,CAAC,IAAI,KAAK,KAAK,IAAI,KAAK,CAAC,IAAI,KAAK,KAAK,CAAC;QACjE,MAAM,cAAc,GAAG,iBAAiB,CAAC,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;QAC7D,OAAO,WAAW,IAAI,cAAc,CAAC;IACvC,CAAC,CAAC,CAAC;AACL,CAAC;AAED;;GAEG;AACH,SAAgB,oBAAoB,CAAC,QAAsD;IACzF,OAAO,QAAQ,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,IAAI,KAAK,KAAK,CAAC,CAAC;AACpE,CAAC;AAED;;;GAGG;AACH,SAAgB,kBAAkB,CAAC,UAAmC;IACpE,MAAM,MAAM,GAAG,CAAC,UAAU,CAAC,MAAM,IAAI,EAAE,CAA4B,CAAC;IACpE,MAAM,OAAO,GAA4B,EAAE,CAAC;IAE5C,KAAK,MAAM,GAAG,IAAI,CAAC,MAAM,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,KAAK,EAAE,SAAS,EAAE,UAAU,EAAE,SAAS,EAAE,MAAM,CAAC,EAAE,CAAC;QACvG,IAAI,MAAM,CAAC,GAAG,CAAC,KAAK,SAAS,EAAE,CAAC;YAC9B,OAAO,CAAC,GAAG,CAAC,GAAG,MAAM,CAAC,GAAG,CAAC,CAAC;QAC7B,CAAC;IACH,CAAC;IAED,OAAO,OAAO,CAAC;AACjB,CAAC;AAED;;GAEG;AACI,KAAK,UAAU,YAAY,CAAC,MAAc,EAAE,OAAgC,EAAE,KAAa;IAChG,MAAM,QAAQ,GAAG,MAAM,OAAO,CAAC,UAAU,MAAM,cAAc,EAAE,EAAE,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,OAAO,EAAE,CAAC,CAAC;IACzG,aAAa,CAAC,QAAQ,CAAC,CAAC;IACxB,OAAO,QAAQ,CAAC,IAAI,CAAC,MAA6B,CAAC;AACrD,CAAC;AAED;;GAEG;AACI,KAAK,UAAU,UAAU,CAAC,MAAc,EAAE,IAAY,EAAE,IAAY,EAAE,KAAa;IACxF,MAAM,QAAQ,GAAG,MAAM,OAAO,CAAC,UAAU,MAAM,qBAAqB,kBAAkB,CAAC,IAAI,CAAC,SAAS,IAAI,EAAE,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC,CAAC;IACvI,aAAa,CAAC,QAAQ,CAAC,CAAC;IACxB,MAAM,OAAO,GAAG,QAAQ,CAAC,IAAI,CAAC,MAA+B,CAAC;IAC9D,OAAO,OAAO,CAAC,CAAC,CAAC,CAAC;AACpB,CAAC"}

package/lib/handler/index.d.ts

@@ -0,0 +1,11 @@
+import type { CloudFormationCustomResourceEvent } from 'aws-lambda';
+/**
+ * The Lambda handler for the `Custom::CloudflareDnsRecord` custom resource.
+ *
+ * @param event The CloudFormation custom resource event.
+ * @returns The custom resource result with `PhysicalResourceId` and `Data`.
+ */
+export declare function handler(event: CloudFormationCustomResourceEvent): Promise<{
+    PhysicalResourceId: string;
+    Data: Record<string, unknown>;
+}>;