@jaggr2/cdk-cf-dns 0.1.0

package/lib/handler/index.js

@@ -0,0 +1,114 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.handler = handler;
+const cloudflare_1 = require("./cloudflare");
+/**
+ * Handles the `Create` request type.
+ */
+async function onCreate(event) {
+    const properties = event.ResourceProperties;
+    const zoneId = String(properties.zoneId);
+    const payload = (0, cloudflare_1.buildRecordPayload)(properties);
+    const token = await (0, cloudflare_1.getApiToken)(String(properties.apiTokenSecretArn));
+    (0, cloudflare_1.log)('create', { zoneId, name: payload.name, type: payload.type });
+    const response = await (0, cloudflare_1.request)(`/zones/${zoneId}/dns_records`, { method: 'POST', token, body: payload });
+    if ((0, cloudflare_1.isAlreadyExists)(response)) {
+        if (!properties.adoptExisting) {
+            throw new Error(`DNS record ${String(payload.name)} (${String(payload.type)}) already exists in zone ${zoneId}. ` +
+                'Either delete it in the Cloudflare dashboard, or set adoptExisting: true to adopt and manage it.');
+        }
+        (0, cloudflare_1.log)('adopt', { zoneId, name: payload.name, type: payload.type });
+        const existing = await (0, cloudflare_1.findRecord)(zoneId, String(payload.name), String(payload.type), token);
+        if (!existing) {
+            throw new Error(`Cloudflare reported ${String(payload.name)} already exists but the lookup found no matching record`);
+        }
+        await (0, cloudflare_1.request)(`/zones/${zoneId}/dns_records/${existing.id}`, { method: 'PATCH', token, body: payload });
+        return { PhysicalResourceId: existing.id, Data: { RecordId: existing.id, DomainName: existing.name } };
+    }
+    (0, cloudflare_1.assertSuccess)(response);
+    const result = response.body.result;
+    return { PhysicalResourceId: result.id, Data: { RecordId: result.id, DomainName: result.name } };
+}
+/**
+ * Handles the `Update` request type.
+ */
+async function onUpdate(event) {
+    const properties = event.ResourceProperties;
+    const oldProperties = event.OldResourceProperties;
+    const zoneId = String(properties.zoneId);
+    const payload = (0, cloudflare_1.buildRecordPayload)(properties);
+    const token = await (0, cloudflare_1.getApiToken)(String(properties.apiTokenSecretArn));
+    (0, cloudflare_1.log)('update', { zoneId, name: payload.name, type: payload.type });
+    // If the zone changed, the record must be created in the new zone. Returning a
+    // new physical id tells CloudFormation to send a Delete for the old one.
+    if (String(oldProperties.zoneId) !== zoneId) {
+        (0, cloudflare_1.log)('update', { message: 'zone changed; creating in new zone', zoneId });
+        const created = await (0, cloudflare_1.createRecord)(zoneId, payload, token);
+        return { PhysicalResourceId: created.id, Data: { RecordId: created.id, DomainName: created.name } };
+    }
+    const physicalId = event.PhysicalResourceId;
+    const response = await (0, cloudflare_1.request)(`/zones/${zoneId}/dns_records/${physicalId}`, { method: 'PATCH', token, body: payload });
+    // The record was deleted out-of-band (e.g. in the dashboard); recreate it.
+    if (response.status === 404 || (response.body.success === false && (0, cloudflare_1.isRecordDoesNotExist)(response))) {
+        (0, cloudflare_1.log)('update', { message: 'record not found; recreating', zoneId, name: payload.name });
+        const created = await (0, cloudflare_1.createRecord)(zoneId, payload, token);
+        return { PhysicalResourceId: created.id, Data: { RecordId: created.id, DomainName: created.name } };
+    }
+    (0, cloudflare_1.assertSuccess)(response);
+    const result = response.body.result;
+    return { PhysicalResourceId: physicalId, Data: { RecordId: result.id, DomainName: result.name } };
+}
+/**
+ * Handles the `Delete` request type. Deleting is idempotent: a missing record
+ * is treated as success so stacks never become undeletable.
+ */
+async function onDelete(event) {
+    const properties = event.ResourceProperties;
+    const zoneId = String(properties.zoneId);
+    const physicalId = event.PhysicalResourceId;
+    if (properties.retainOnDelete) {
+        (0, cloudflare_1.log)('delete', { message: 'retainOnDelete set; leaving record in Cloudflare', zoneId });
+        return { PhysicalResourceId: physicalId, Data: {} };
+    }
+    // A failed Create can leave CloudFormation's arn:... placeholder as the
+    // physical id; never throw in that case.
+    if (!cloudflare_1.RECORD_ID_PATTERN.test(physicalId)) {
+        (0, cloudflare_1.log)('delete', { message: 'physical id is not a Cloudflare record id; skipping delete', physicalId });
+        return { PhysicalResourceId: physicalId, Data: {} };
+    }
+    const token = await (0, cloudflare_1.getApiToken)(String(properties.apiTokenSecretArn));
+    (0, cloudflare_1.log)('delete', { zoneId, physicalId });
+    const response = await (0, cloudflare_1.request)(`/zones/${zoneId}/dns_records/${physicalId}`, { method: 'DELETE', token });
+    if (response.status === 404 || (response.body.success === false && (0, cloudflare_1.isRecordDoesNotExist)(response))) {
+        (0, cloudflare_1.log)('delete', { message: 'record already gone; treating delete as success', physicalId });
+        return { PhysicalResourceId: physicalId, Data: {} };
+    }
+    (0, cloudflare_1.assertSuccess)(response);
+    return { PhysicalResourceId: physicalId, Data: {} };
+}
+/**
+ * The Lambda handler for the `Custom::CloudflareDnsRecord` custom resource.
+ *
+ * @param event The CloudFormation custom resource event.
+ * @returns The custom resource result with `PhysicalResourceId` and `Data`.
+ */
+async function handler(event) {
+    try {
+        (0, cloudflare_1.log)('event', { requestType: event.RequestType });
+        switch (event.RequestType) {
+            case 'Create':
+                return await onCreate(event);
+            case 'Update':
+                return await onUpdate(event);
+            case 'Delete':
+                return await onDelete(event);
+            default:
+                throw new Error(`Unsupported RequestType: ${event.RequestType}`);
+        }
+    }
+    catch (error) {
+        const message = error instanceof Error ? error.message : String(error);
+        throw new Error(`Cloudflare DNS custom resource failed during ${event.RequestType}: ${message}`);
+    }
+}
+//# sourceMappingURL=index.js.map

package/lib/handler/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/handler/index.ts"],"names":[],"mappings":";;AA8HA,0BAkBC;AA/ID,6CAWsB;AAEtB;;GAEG;AACH,KAAK,UAAU,QAAQ,CAAC,KAA8C;IACpE,MAAM,UAAU,GAAG,KAAK,CAAC,kBAA6C,CAAC;IACvE,MAAM,MAAM,GAAG,MAAM,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC;IACzC,MAAM,OAAO,GAAG,IAAA,+BAAkB,EAAC,UAAU,CAAC,CAAC;IAC/C,MAAM,KAAK,GAAG,MAAM,IAAA,wBAAW,EAAC,MAAM,CAAC,UAAU,CAAC,iBAAiB,CAAC,CAAC,CAAC;IAEtE,IAAA,gBAAG,EAAC,QAAQ,EAAE,EAAE,MAAM,EAAE,IAAI,EAAE,OAAO,CAAC,IAAI,EAAE,IAAI,EAAE,OAAO,CAAC,IAAI,EAAE,CAAC,CAAC;IAElE,MAAM,QAAQ,GAAG,MAAM,IAAA,oBAAO,EAAC,UAAU,MAAM,cAAc,EAAE,EAAE,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,OAAO,EAAE,CAAC,CAAC;IAEzG,IAAI,IAAA,4BAAe,EAAC,QAAQ,CAAC,EAAE,CAAC;QAC9B,IAAI,CAAC,UAAU,CAAC,aAAa,EAAE,CAAC;YAC9B,MAAM,IAAI,KAAK,CACb,cAAc,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,KAAK,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,4BAA4B,MAAM,IAAI;gBAC/F,kGAAkG,CACrG,CAAC;QACJ,CAAC;QAED,IAAA,gBAAG,EAAC,OAAO,EAAE,EAAE,MAAM,EAAE,IAAI,EAAE,OAAO,CAAC,IAAI,EAAE,IAAI,EAAE,OAAO,CAAC,IAAI,EAAE,CAAC,CAAC;QACjE,MAAM,QAAQ,GAAG,MAAM,IAAA,uBAAU,EAAC,MAAM,EAAE,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,KAAK,CAAC,CAAC;QAC7F,IAAI,CAAC,QAAQ,EAAE,CAAC;YACd,MAAM,IAAI,KAAK,CAAC,uBAAuB,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,yDAAyD,CAAC,CAAC;QACxH,CAAC;QAED,MAAM,IAAA,oBAAO,EAAC,UAAU,MAAM,gBAAgB,QAAQ,CAAC,EAAE,EAAE,EAAE,EAAE,MAAM,EAAE,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,OAAO,EAAE,CAAC,CAAC;QACxG,OAAO,EAAE,kBAAkB,EAAE,QAAQ,CAAC,EAAE,EAAE,IAAI,EAAE,EAAE,QAAQ,EAAE,QAAQ,CAAC,EAAE,EAAE,UAAU,EAAE,QAAQ,CAAC,IAAI,EAAE,EAAE,CAAC;IACzG,CAAC;IAED,IAAA,0BAAa,EAAC,QAAQ,CAAC,CAAC;IACxB,MAAM,MAAM,GAAG,QAAQ,CAAC,IAAI,CAAC,MAAsC,CAAC;IACpE,OAAO,EAAE,kBAAkB,EAAE,MAAM,CAAC,EAAE,EAAE,IAAI,EAAE,EAAE,QAAQ,EAAE,MAAM,CAAC,EAAE,EAAE,UAAU,EAAE,MAAM,CAAC,IAAI,EAAE,EAAE,CAAC;AACnG,CAAC;AAED;;GAEG;AACH,KAAK,UAAU,QAAQ,CAAC,KAA8C;IACpE,MAAM,UAAU,GAAG,KAAK,CAAC,kBAA6C,CAAC;IACvE,MAAM,aAAa,GAAG,KAAK,CAAC,qBAAgD,CAAC;IAC7E,MAAM,MAAM,GAAG,MAAM,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC;IACzC,MAAM,OAAO,GAAG,IAAA,+BAAkB,EAAC,UAAU,CAAC,CAAC;IAC/C,MAAM,KAAK,GAAG,MAAM,IAAA,wBAAW,EAAC,MAAM,CAAC,UAAU,CAAC,iBAAiB,CAAC,CAAC,CAAC;IAEtE,IAAA,gBAAG,EAAC,QAAQ,EAAE,EAAE,MAAM,EAAE,IAAI,EAAE,OAAO,CAAC,IAAI,EAAE,IAAI,EAAE,OAAO,CAAC,IAAI,EAAE,CAAC,CAAC;IAElE,+EAA+E;IAC/E,yEAAyE;IACzE,IAAI,MAAM,CAAC,aAAa,CAAC,MAAM,CAAC,KAAK,MAAM,EAAE,CAAC;QAC5C,IAAA,gBAAG,EAAC,QAAQ,EAAE,EAAE,OAAO,EAAE,oCAAoC,EAAE,MAAM,EAAE,CAAC,CAAC;QACzE,MAAM,OAAO,GAAG,MAAM,IAAA,yBAAY,EAAC,MAAM,EAAE,OAAO,EAAE,KAAK,CAAC,CAAC;QAC3D,OAAO,EAAE,kBAAkB,EAAE,OAAO,CAAC,EAAE,EAAE,IAAI,EAAE,EAAE,QAAQ,EAAE,OAAO,CAAC,EAAE,EAAE,UAAU,EAAE,OAAO,CAAC,IAAI,EAAE,EAAE,CAAC;IACtG,CAAC;IAED,MAAM,UAAU,GAAG,KAAK,CAAC,kBAAkB,CAAC;IAC5C,MAAM,QAAQ,GAAG,MAAM,IAAA,oBAAO,EAAC,UAAU,MAAM,gBAAgB,UAAU,EAAE,EAAE,EAAE,MAAM,EAAE,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,OAAO,EAAE,CAAC,CAAC;IAExH,2EAA2E;IAC3E,IAAI,QAAQ,CAAC,MAAM,KAAK,GAAG,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,OAAO,KAAK,KAAK,IAAI,IAAA,iCAAoB,EAAC,QAAQ,CAAC,CAAC,EAAE,CAAC;QACnG,IAAA,gBAAG,EAAC,QAAQ,EAAE,EAAE,OAAO,EAAE,8BAA8B,EAAE,MAAM,EAAE,IAAI,EAAE,OAAO,CAAC,IAAI,EAAE,CAAC,CAAC;QACvF,MAAM,OAAO,GAAG,MAAM,IAAA,yBAAY,EAAC,MAAM,EAAE,OAAO,EAAE,KAAK,CAAC,CAAC;QAC3D,OAAO,EAAE,kBAAkB,EAAE,OAAO,CAAC,EAAE,EAAE,IAAI,EAAE,EAAE,QAAQ,EAAE,OAAO,CAAC,EAAE,EAAE,UAAU,EAAE,OAAO,CAAC,IAAI,EAAE,EAAE,CAAC;IACtG,CAAC;IAED,IAAA,0BAAa,EAAC,QAAQ,CAAC,CAAC;IACxB,MAAM,MAAM,GAAG,QAAQ,CAAC,IAAI,CAAC,MAAsC,CAAC;IACpE,OAAO,EAAE,kBAAkB,EAAE,UAAU,EAAE,IAAI,EAAE,EAAE,QAAQ,EAAE,MAAM,CAAC,EAAE,EAAE,UAAU,EAAE,MAAM,CAAC,IAAI,EAAE,EAAE,CAAC;AACpG,CAAC;AAED;;;GAGG;AACH,KAAK,UAAU,QAAQ,CAAC,KAA8C;IACpE,MAAM,UAAU,GAAG,KAAK,CAAC,kBAA6C,CAAC;IACvE,MAAM,MAAM,GAAG,MAAM,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC;IACzC,MAAM,UAAU,GAAG,KAAK,CAAC,kBAAkB,CAAC;IAE5C,IAAI,UAAU,CAAC,cAAc,EAAE,CAAC;QAC9B,IAAA,gBAAG,EAAC,QAAQ,EAAE,EAAE,OAAO,EAAE,kDAAkD,EAAE,MAAM,EAAE,CAAC,CAAC;QACvF,OAAO,EAAE,kBAAkB,EAAE,UAAU,EAAE,IAAI,EAAE,EAAE,EAAE,CAAC;IACtD,CAAC;IAED,wEAAwE;IACxE,yCAAyC;IACzC,IAAI,CAAC,8BAAiB,CAAC,IAAI,CAAC,UAAU,CAAC,EAAE,CAAC;QACxC,IAAA,gBAAG,EAAC,QAAQ,EAAE,EAAE,OAAO,EAAE,4DAA4D,EAAE,UAAU,EAAE,CAAC,CAAC;QACrG,OAAO,EAAE,kBAAkB,EAAE,UAAU,EAAE,IAAI,EAAE,EAAE,EAAE,CAAC;IACtD,CAAC;IAED,MAAM,KAAK,GAAG,MAAM,IAAA,wBAAW,EAAC,MAAM,CAAC,UAAU,CAAC,iBAAiB,CAAC,CAAC,CAAC;IACtE,IAAA,gBAAG,EAAC,QAAQ,EAAE,EAAE,MAAM,EAAE,UAAU,EAAE,CAAC,CAAC;IAEtC,MAAM,QAAQ,GAAG,MAAM,IAAA,oBAAO,EAAC,UAAU,MAAM,gBAAgB,UAAU,EAAE,EAAE,EAAE,MAAM,EAAE,QAAQ,EAAE,KAAK,EAAE,CAAC,CAAC;IAE1G,IAAI,QAAQ,CAAC,MAAM,KAAK,GAAG,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,OAAO,KAAK,KAAK,IAAI,IAAA,iCAAoB,EAAC,QAAQ,CAAC,CAAC,EAAE,CAAC;QACnG,IAAA,gBAAG,EAAC,QAAQ,EAAE,EAAE,OAAO,EAAE,iDAAiD,EAAE,UAAU,EAAE,CAAC,CAAC;QAC1F,OAAO,EAAE,kBAAkB,EAAE,UAAU,EAAE,IAAI,EAAE,EAAE,EAAE,CAAC;IACtD,CAAC;IAED,IAAA,0BAAa,EAAC,QAAQ,CAAC,CAAC;IACxB,OAAO,EAAE,kBAAkB,EAAE,UAAU,EAAE,IAAI,EAAE,EAAE,EAAE,CAAC;AACtD,CAAC;AAED;;;;;GAKG;AACI,KAAK,UAAU,OAAO,CAAC,KAAwC;IACpE,IAAI,CAAC;QACH,IAAA,gBAAG,EAAC,OAAO,EAAE,EAAE,WAAW,EAAE,KAAK,CAAC,WAAW,EAAE,CAAC,CAAC;QAEjD,QAAQ,KAAK,CAAC,WAAW,EAAE,CAAC;YAC1B,KAAK,QAAQ;gBACX,OAAO,MAAM,QAAQ,CAAC,KAAK,CAAC,CAAC;YAC/B,KAAK,QAAQ;gBACX,OAAO,MAAM,QAAQ,CAAC,KAAK,CAAC,CAAC;YAC/B,KAAK,QAAQ;gBACX,OAAO,MAAM,QAAQ,CAAC,KAAK,CAAC,CAAC;YAC/B;gBACE,MAAM,IAAI,KAAK,CAAC,4BAA6B,KAAkC,CAAC,WAAW,EAAE,CAAC,CAAC;QACnG,CAAC;IACH,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,MAAM,OAAO,GAAG,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;QACvE,MAAM,IAAI,KAAK,CAAC,gDAAgD,KAAK,CAAC,WAAW,KAAK,OAAO,EAAE,CAAC,CAAC;IACnG,CAAC;AACH,CAAC"}

package/lib/index.d.ts

@@ -0,0 +1,4 @@
+export * from './zone';
+export * from './record';
+export * from './provider';
+export * from './certificate';

package/lib/index.js

@@ -0,0 +1,21 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __exportStar = (this && this.__exportStar) || function(m, exports) {
+    for (var p in m) if (p !== "default" && !Object.prototype.hasOwnProperty.call(exports, p)) __createBinding(exports, m, p);
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+__exportStar(require("./zone"), exports);
+__exportStar(require("./record"), exports);
+__exportStar(require("./provider"), exports);
+__exportStar(require("./certificate"), exports);
+//# sourceMappingURL=index.js.map

package/lib/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;AAAA,yCAAuB;AACvB,2CAAyB;AACzB,6CAA2B;AAC3B,gDAA8B"}

package/lib/provider.d.ts

@@ -0,0 +1,75 @@
+import * as secretsmanager from 'aws-cdk-lib/aws-secretsmanager';
+import { Construct } from 'constructs';
+/**
+ * The shared custom-resource provider that performs the Cloudflare DNS API
+ * calls.
+ *
+ * One instance exists per stack (a singleton keyed by `Stack`), so a stack with
+ * many records still has exactly one Lambda handler. All records route their
+ * custom-resource events through this handler.
+ */
+export declare class CloudflareDnsProvider extends Construct {
+    /**
+     * Gets (or lazily creates) the provider for the stack of `scope`.
+     *
+     * @param scope Any construct within the stack that should own the provider.
+     */
+    static getOrCreate(scope: Construct): CloudflareDnsProvider;
+    /**
+     * The custom-resource service token that records use as their `serviceToken`.
+     */
+    readonly serviceToken: string;
+    /**
+     * The IAM role used by the handler. Record constructs grant `GetSecretValue`
+     * on their zone's secret here.
+     */
+    private readonly handlerRole;
+    /**
+     * Secrets that have already been granted, deduplicated by ARN.
+     */
+    private readonly grantedSecrets;
+    private constructor();
+    /**
+     * Grants the provider's handler `secretsmanager:GetSecretValue` on the given
+     * secret. Repeated grants of the same secret are deduplicated.
+     *
+     * @param secret The secret holding a Cloudflare API token.
+     */
+    grantSecretRead(secret: secretsmanager.ISecret): void;
+}
+/**
+ * The shared custom-resource provider that writes ACM DNS validation records
+ * into Cloudflare.
+ *
+ * Like `CloudflareDnsProvider`, one instance exists per stack. It additionally
+ * grants its handler `acm:DescribeCertificate` on all certificates.
+ */
+export declare class CloudflareCertificateProvider extends Construct {
+    /**
+     * Gets (or lazily creates) the provider for the stack of `scope`.
+     *
+     * @param scope Any construct within the stack that should own the provider.
+     */
+    static getOrCreate(scope: Construct): CloudflareCertificateProvider;
+    /**
+     * The custom-resource service token that the certificate construct uses as
+     * its `serviceToken`.
+     */
+    readonly serviceToken: string;
+    /**
+     * The IAM role used by the handler.
+     */
+    private readonly handlerRole;
+    /**
+     * Secrets that have already been granted, deduplicated by ARN.
+     */
+    private readonly grantedSecrets;
+    private constructor();
+    /**
+     * Grants the provider's handler `secretsmanager:GetSecretValue` on the given
+     * secret. Repeated grants of the same secret are deduplicated.
+     *
+     * @param secret The secret holding a Cloudflare API token.
+     */
+    grantSecretRead(secret: secretsmanager.ISecret): void;
+}

package/lib/provider.js

@@ -0,0 +1,234 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.CloudflareCertificateProvider = exports.CloudflareDnsProvider = void 0;
+const fs = __importStar(require("fs"));
+const path = __importStar(require("path"));
+const cdk = __importStar(require("aws-cdk-lib"));
+const iam = __importStar(require("aws-cdk-lib/aws-iam"));
+const lambda = __importStar(require("aws-cdk-lib/aws-lambda"));
+const aws_lambda_nodejs_1 = require("aws-cdk-lib/aws-lambda-nodejs");
+const logs = __importStar(require("aws-cdk-lib/aws-logs"));
+const custom_resources = __importStar(require("aws-cdk-lib/custom-resources"));
+const constructs_1 = require("constructs");
+/**
+ * The stable construct ID used for the shared DNS provider on each Stack.
+ */
+const PROVIDER_ID = 'AcmeCloudflareDnsProvider';
+/**
+ * The stable construct ID used for the shared ACM provider on each Stack.
+ */
+const CERTIFICATE_PROVIDER_ID = 'AcmeCloudflareCertificateProvider';
+/**
+ * Resolves a handler entry point. When the library is consumed from the
+ * compiled `lib/` output the source lives at `<package>/src/handler/<file>`;
+ * when tests run against `src/` directly it is at `src/handler/<file>`.
+ */
+function handlerEntry(file) {
+    const fromLib = path.join(__dirname, '..', 'src', 'handler', file);
+    if (fs.existsSync(fromLib)) {
+        return fromLib;
+    }
+    return path.join(__dirname, 'handler', file);
+}
+/**
+ * Creates the shared handler function with the provider's standard
+ * configuration: Node 22 on ARM, 256 MB, a one-month log group that is deleted
+ * with the stack, and an esbuild bundle with the AWS SDK kept external.
+ */
+function createHandler(scope, id, file, timeout) {
+    // `NodejsFunction` requires its entry (and lock file) to live under
+    // `projectRoot`. The library is consumed from a different project, so both
+    // are pointed at the package's own root. The handler has no runtime npm
+    // dependencies, so the shipped `deps.lock.json` marker is never actually
+    // read — it only satisfies the path validation.
+    const projectRoot = path.join(__dirname, '..');
+    const handler = new aws_lambda_nodejs_1.NodejsFunction(scope, id, {
+        entry: handlerEntry(file),
+        projectRoot,
+        depsLockFilePath: path.join(projectRoot, 'src', 'handler', 'deps.lock.json'),
+        runtime: lambda.Runtime.NODEJS_22_X,
+        architecture: lambda.Architecture.ARM_64,
+        timeout,
+        memorySize: 256,
+        bundling: {
+            minify: true,
+            sourceMap: true,
+            externalModules: ['@aws-sdk/*'],
+        },
+    });
+    const logGroup = new logs.LogGroup(scope, `${id}LogGroup`, {
+        logGroupName: `/aws/lambda/${handler.functionName}`,
+        retention: logs.RetentionDays.ONE_MONTH,
+        removalPolicy: cdk.RemovalPolicy.DESTROY,
+    });
+    logGroup.node.addDependency(handler);
+    if (!handler.role) {
+        throw new Error(`Cloudflare provider handler ${id} requires an IAM role`);
+    }
+    return { handler, role: handler.role };
+}
+/**
+ * The shared custom-resource provider that performs the Cloudflare DNS API
+ * calls.
+ *
+ * One instance exists per stack (a singleton keyed by `Stack`), so a stack with
+ * many records still has exactly one Lambda handler. All records route their
+ * custom-resource events through this handler.
+ */
+class CloudflareDnsProvider extends constructs_1.Construct {
+    /**
+     * Gets (or lazily creates) the provider for the stack of `scope`.
+     *
+     * @param scope Any construct within the stack that should own the provider.
+     */
+    static getOrCreate(scope) {
+        const stack = cdk.Stack.of(scope);
+        const existing = stack.node.tryFindChild(PROVIDER_ID);
+        if (existing) {
+            return existing;
+        }
+        return new CloudflareDnsProvider(stack, PROVIDER_ID);
+    }
+    /**
+     * The custom-resource service token that records use as their `serviceToken`.
+     */
+    serviceToken;
+    /**
+     * The IAM role used by the handler. Record constructs grant `GetSecretValue`
+     * on their zone's secret here.
+     */
+    handlerRole;
+    /**
+     * Secrets that have already been granted, deduplicated by ARN.
+     */
+    grantedSecrets = new Set();
+    constructor(scope, id) {
+        super(scope, id);
+        const { handler, role } = createHandler(this, 'Handler', 'index.ts', cdk.Duration.minutes(2));
+        const provider = new custom_resources.Provider(this, 'Provider', {
+            onEventHandler: handler,
+        });
+        this.serviceToken = provider.serviceToken;
+        this.handlerRole = role;
+    }
+    /**
+     * Grants the provider's handler `secretsmanager:GetSecretValue` on the given
+     * secret. Repeated grants of the same secret are deduplicated.
+     *
+     * @param secret The secret holding a Cloudflare API token.
+     */
+    grantSecretRead(secret) {
+        const arn = secret.secretArn;
+        if (this.grantedSecrets.has(arn)) {
+            return;
+        }
+        this.grantedSecrets.add(arn);
+        this.handlerRole.addToPrincipalPolicy(new iam.PolicyStatement({
+            actions: ['secretsmanager:GetSecretValue'],
+            resources: [arn],
+        }));
+    }
+}
+exports.CloudflareDnsProvider = CloudflareDnsProvider;
+/**
+ * The shared custom-resource provider that writes ACM DNS validation records
+ * into Cloudflare.
+ *
+ * Like `CloudflareDnsProvider`, one instance exists per stack. It additionally
+ * grants its handler `acm:DescribeCertificate` on all certificates.
+ */
+class CloudflareCertificateProvider extends constructs_1.Construct {
+    /**
+     * Gets (or lazily creates) the provider for the stack of `scope`.
+     *
+     * @param scope Any construct within the stack that should own the provider.
+     */
+    static getOrCreate(scope) {
+        const stack = cdk.Stack.of(scope);
+        const existing = stack.node.tryFindChild(CERTIFICATE_PROVIDER_ID);
+        if (existing) {
+            return existing;
+        }
+        return new CloudflareCertificateProvider(stack, CERTIFICATE_PROVIDER_ID);
+    }
+    /**
+     * The custom-resource service token that the certificate construct uses as
+     * its `serviceToken`.
+     */
+    serviceToken;
+    /**
+     * The IAM role used by the handler.
+     */
+    handlerRole;
+    /**
+     * Secrets that have already been granted, deduplicated by ARN.
+     */
+    grantedSecrets = new Set();
+    constructor(scope, id) {
+        super(scope, id);
+        // ACM validation records can take a while to appear after certificate
+        // creation, so the handler gets a generous timeout to poll for them.
+        const { handler, role } = createHandler(this, 'Handler', 'acm.ts', cdk.Duration.minutes(5));
+        role.addToPrincipalPolicy(new iam.PolicyStatement({
+            actions: ['acm:DescribeCertificate'],
+            resources: ['*'],
+        }));
+        const provider = new custom_resources.Provider(this, 'Provider', {
+            onEventHandler: handler,
+        });
+        this.serviceToken = provider.serviceToken;
+        this.handlerRole = role;
+    }
+    /**
+     * Grants the provider's handler `secretsmanager:GetSecretValue` on the given
+     * secret. Repeated grants of the same secret are deduplicated.
+     *
+     * @param secret The secret holding a Cloudflare API token.
+     */
+    grantSecretRead(secret) {
+        const arn = secret.secretArn;
+        if (this.grantedSecrets.has(arn)) {
+            return;
+        }
+        this.grantedSecrets.add(arn);
+        this.handlerRole.addToPrincipalPolicy(new iam.PolicyStatement({
+            actions: ['secretsmanager:GetSecretValue'],
+            resources: [arn],
+        }));
+    }
+}
+exports.CloudflareCertificateProvider = CloudflareCertificateProvider;
+//# sourceMappingURL=provider.js.map

package/lib/provider.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"provider.js","sourceRoot":"","sources":["../src/provider.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAAA,uCAAyB;AACzB,2CAA6B;AAC7B,iDAAmC;AACnC,yDAA2C;AAC3C,+DAAiD;AACjD,qEAA+D;AAC/D,2DAA6C;AAE7C,+EAAiE;AACjE,2CAAuC;AAEvC;;GAEG;AACH,MAAM,WAAW,GAAG,2BAA2B,CAAC;AAEhD;;GAEG;AACH,MAAM,uBAAuB,GAAG,mCAAmC,CAAC;AAEpE;;;;GAIG;AACH,SAAS,YAAY,CAAC,IAAY;IAChC,MAAM,OAAO,GAAG,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,SAAS,EAAE,IAAI,CAAC,CAAC;IACnE,IAAI,EAAE,CAAC,UAAU,CAAC,OAAO,CAAC,EAAE,CAAC;QAC3B,OAAO,OAAO,CAAC;IACjB,CAAC;IACD,OAAO,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,SAAS,EAAE,IAAI,CAAC,CAAC;AAC/C,CAAC;AAED;;;;GAIG;AACH,SAAS,aAAa,CAAC,KAAgB,EAAE,EAAU,EAAE,IAAY,EAAE,OAAqB;IACtF,oEAAoE;IACpE,2EAA2E;IAC3E,wEAAwE;IACxE,yEAAyE;IACzE,gDAAgD;IAChD,MAAM,WAAW,GAAG,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,IAAI,CAAC,CAAC;IAE/C,MAAM,OAAO,GAAG,IAAI,kCAAc,CAAC,KAAK,EAAE,EAAE,EAAE;QAC5C,KAAK,EAAE,YAAY,CAAC,IAAI,CAAC;QACzB,WAAW;QACX,gBAAgB,EAAE,IAAI,CAAC,IAAI,CAAC,WAAW,EAAE,KAAK,EAAE,SAAS,EAAE,gBAAgB,CAAC;QAC5E,OAAO,EAAE,MAAM,CAAC,OAAO,CAAC,WAAW;QACnC,YAAY,EAAE,MAAM,CAAC,YAAY,CAAC,MAAM;QACxC,OAAO;QACP,UAAU,EAAE,GAAG;QACf,QAAQ,EAAE;YACR,MAAM,EAAE,IAAI;YACZ,SAAS,EAAE,IAAI;YACf,eAAe,EAAE,CAAC,YAAY,CAAC;SAChC;KACF,CAAC,CAAC;IAEH,MAAM,QAAQ,GAAG,IAAI,IAAI,CAAC,QAAQ,CAAC,KAAK,EAAE,GAAG,EAAE,UAAU,EAAE;QACzD,YAAY,EAAE,eAAe,OAAO,CAAC,YAAY,EAAE;QACnD,SAAS,EAAE,IAAI,CAAC,aAAa,CAAC,SAAS;QACvC,aAAa,EAAE,GAAG,CAAC,aAAa,CAAC,OAAO;KACzC,CAAC,CAAC;IACH,QAAQ,CAAC,IAAI,CAAC,aAAa,CAAC,OAAO,CAAC,CAAC;IAErC,IAAI,CAAC,OAAO,CAAC,IAAI,EAAE,CAAC;QAClB,MAAM,IAAI,KAAK,CAAC,+BAA+B,EAAE,uBAAuB,CAAC,CAAC;IAC5E,CAAC;IAED,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,OAAO,CAAC,IAAI,EAAE,CAAC;AACzC,CAAC;AAED;;;;;;;GAOG;AACH,MAAa,qBAAsB,SAAQ,sBAAS;IAClD;;;;OAIG;IACI,MAAM,CAAC,WAAW,CAAC,KAAgB;QACxC,MAAM,KAAK,GAAG,GAAG,CAAC,KAAK,CAAC,EAAE,CAAC,KAAK,CAAC,CAAC;QAClC,MAAM,QAAQ,GAAG,KAAK,CAAC,IAAI,CAAC,YAAY,CAAC,WAAW,CAAsC,CAAC;QAC3F,IAAI,QAAQ,EAAE,CAAC;YACb,OAAO,QAAQ,CAAC;QAClB,CAAC;QACD,OAAO,IAAI,qBAAqB,CAAC,KAAK,EAAE,WAAW,CAAC,CAAC;IACvD,CAAC;IAED;;OAEG;IACa,YAAY,CAAS;IAErC;;;OAGG;IACc,WAAW,CAAY;IAExC;;OAEG;IACc,cAAc,GAAgB,IAAI,GAAG,EAAE,CAAC;IAEzD,YAAoB,KAAgB,EAAE,EAAU;QAC9C,KAAK,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;QAEjB,MAAM,EAAE,OAAO,EAAE,IAAI,EAAE,GAAG,aAAa,CAAC,IAAI,EAAE,SAAS,EAAE,UAAU,EAAE,GAAG,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC;QAE9F,MAAM,QAAQ,GAAG,IAAI,gBAAgB,CAAC,QAAQ,CAAC,IAAI,EAAE,UAAU,EAAE;YAC/D,cAAc,EAAE,OAAO;SACxB,CAAC,CAAC;QAEH,IAAI,CAAC,YAAY,GAAG,QAAQ,CAAC,YAAY,CAAC;QAC1C,IAAI,CAAC,WAAW,GAAG,IAAI,CAAC;IAC1B,CAAC;IAED;;;;;OAKG;IACI,eAAe,CAAC,MAA8B;QACnD,MAAM,GAAG,GAAG,MAAM,CAAC,SAAS,CAAC;QAC7B,IAAI,IAAI,CAAC,cAAc,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC;YACjC,OAAO;QACT,CAAC;QACD,IAAI,CAAC,cAAc,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;QAC7B,IAAI,CAAC,WAAW,CAAC,oBAAoB,CAAC,IAAI,GAAG,CAAC,eAAe,CAAC;YAC5D,OAAO,EAAE,CAAC,+BAA+B,CAAC;YAC1C,SAAS,EAAE,CAAC,GAAG,CAAC;SACjB,CAAC,CAAC,CAAC;IACN,CAAC;CACF;AA7DD,sDA6DC;AAED;;;;;;GAMG;AACH,MAAa,6BAA8B,SAAQ,sBAAS;IAC1D;;;;OAIG;IACI,MAAM,CAAC,WAAW,CAAC,KAAgB;QACxC,MAAM,KAAK,GAAG,GAAG,CAAC,KAAK,CAAC,EAAE,CAAC,KAAK,CAAC,CAAC;QAClC,MAAM,QAAQ,GAAG,KAAK,CAAC,IAAI,CAAC,YAAY,CAAC,uBAAuB,CAA8C,CAAC;QAC/G,IAAI,QAAQ,EAAE,CAAC;YACb,OAAO,QAAQ,CAAC;QAClB,CAAC;QACD,OAAO,IAAI,6BAA6B,CAAC,KAAK,EAAE,uBAAuB,CAAC,CAAC;IAC3E,CAAC;IAED;;;OAGG;IACa,YAAY,CAAS;IAErC;;OAEG;IACc,WAAW,CAAY;IAExC;;OAEG;IACc,cAAc,GAAgB,IAAI,GAAG,EAAE,CAAC;IAEzD,YAAoB,KAAgB,EAAE,EAAU;QAC9C,KAAK,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;QAEjB,sEAAsE;QACtE,qEAAqE;QACrE,MAAM,EAAE,OAAO,EAAE,IAAI,EAAE,GAAG,aAAa,CAAC,IAAI,EAAE,SAAS,EAAE,QAAQ,EAAE,GAAG,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC;QAE5F,IAAI,CAAC,oBAAoB,CAAC,IAAI,GAAG,CAAC,eAAe,CAAC;YAChD,OAAO,EAAE,CAAC,yBAAyB,CAAC;YACpC,SAAS,EAAE,CAAC,GAAG,CAAC;SACjB,CAAC,CAAC,CAAC;QAEJ,MAAM,QAAQ,GAAG,IAAI,gBAAgB,CAAC,QAAQ,CAAC,IAAI,EAAE,UAAU,EAAE;YAC/D,cAAc,EAAE,OAAO;SACxB,CAAC,CAAC;QAEH,IAAI,CAAC,YAAY,GAAG,QAAQ,CAAC,YAAY,CAAC;QAC1C,IAAI,CAAC,WAAW,GAAG,IAAI,CAAC;IAC1B,CAAC;IAED;;;;;OAKG;IACI,eAAe,CAAC,MAA8B;QACnD,MAAM,GAAG,GAAG,MAAM,CAAC,SAAS,CAAC;QAC7B,IAAI,IAAI,CAAC,cAAc,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC;YACjC,OAAO;QACT,CAAC;QACD,IAAI,CAAC,cAAc,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;QAC7B,IAAI,CAAC,WAAW,CAAC,oBAAoB,CAAC,IAAI,GAAG,CAAC,eAAe,CAAC;YAC5D,OAAO,EAAE,CAAC,+BAA+B,CAAC;YAC1C,SAAS,EAAE,CAAC,GAAG,CAAC;SACjB,CAAC,CAAC,CAAC;IACN,CAAC;CACF;AApED,sEAoEC"}