@jaggr2/cdk-cf-dns 0.1.0

package/lib/record.d.ts

@@ -0,0 +1,225 @@
+import { Duration, RemovalPolicy } from 'aws-cdk-lib';
+import { Construct } from 'constructs';
+import { ICloudflareZone } from './zone';
+/**
+ * The DNS record types supported by this library.
+ */
+export declare enum CloudflareRecordType {
+    /** An IPv4 address record. */
+    A = "A",
+    /** An IPv6 address record. */
+    AAAA = "AAAA",
+    /** A canonical name record. */
+    CNAME = "CNAME",
+    /** A text record. */
+    TXT = "TXT",
+    /** A mail exchanger record. */
+    MX = "MX",
+    /** A name server record. */
+    NS = "NS",
+    /** A service locator record. */
+    SRV = "SRV",
+    /** A certification authority authorization record. */
+    CAA = "CAA",
+    /** A pointer record. */
+    PTR = "PTR",
+    /** A uniform resource identifier record. */
+    URI = "URI"
+}
+/**
+ * TTL helpers for Cloudflare records.
+ */
+export declare class CloudflareTtl {
+    /**
+     * Cloudflare's automatic TTL (a value of `1` on the wire).
+     */
+    static readonly AUTO: Duration;
+}
+/**
+ * Properties for a Cloudflare DNS record.
+ */
+export interface CloudflareRecordProps {
+    /**
+     * The Cloudflare zone the record belongs to.
+     */
+    readonly zone: ICloudflareZone;
+    /**
+     * Record name. If it does not end in the zone name and `zone.zoneName` is set,
+     * it is treated as relative and the zone name is appended.
+     * Use `'@'` or omit for the zone apex.
+     *
+     * @default - the zone apex
+     */
+    readonly recordName?: string;
+    /**
+     * The record type.
+     */
+    readonly type: CloudflareRecordType;
+    /**
+     * Record value. Mutually exclusive with `data`.
+     */
+    readonly content?: string;
+    /**
+     * Structured value for SRV/CAA/URI records. Mutually exclusive with `content`.
+     */
+    readonly data?: Record<string, unknown>;
+    /**
+     * The time-to-live for the record.
+     *
+     * @default Duration.minutes(5) — pass `CloudflareTtl.AUTO` for Cloudflare's automatic TTL (1)
+     */
+    readonly ttl?: Duration;
+    /**
+     * Whether to proxy the record through Cloudflare. Only valid for A, AAAA and CNAME.
+     *
+     * @default false
+     */
+    readonly proxied?: boolean;
+    /**
+     * Record priority. Required for MX, SRV and URI.
+     */
+    readonly priority?: number;
+    /**
+     * A free-form comment attached to the record.
+     *
+     * @default - no comment
+     */
+    readonly comment?: string;
+    /**
+     * Tags attached to the record.
+     *
+     * @default - no tags
+     */
+    readonly tags?: string[];
+    /**
+     * If a record with the same name+type already exists in Cloudflare, adopt and
+     * manage it instead of failing the deployment.
+     *
+     * @default false
+     */
+    readonly adoptExisting?: boolean;
+    /**
+     * If RETAIN, the record is left in Cloudflare when the stack resource is deleted.
+     *
+     * @default RemovalPolicy.DESTROY
+     */
+    readonly removalPolicy?: RemovalPolicy;
+}
+/**
+ * A Cloudflare DNS record managed as a CloudFormation resource.
+ *
+ * The construct synthesises a `Custom::CloudflareDnsRecord` custom resource whose
+ * Lambda handler calls the Cloudflare API. The API token is resolved at runtime
+ * from Secrets Manager; only the secret ARN ever appears in the template.
+ */
+export declare class CloudflareRecord extends Construct {
+    /**
+     * Cloudflare's record ID, from `GetAtt`. This is the value you can use to
+     * locate the record in the Cloudflare dashboard.
+     */
+    readonly recordId: string;
+    /**
+     * The fully-qualified name actually written to Cloudflare (e.g. `app.example.com`).
+     */
+    readonly domainName: string;
+    /**
+     * The underlying custom resource.
+     */
+    private readonly resource;
+    constructor(scope: Construct, id: string, props: CloudflareRecordProps);
+}
+/**
+ * Resolves a relative record name against the zone name, matching the
+ * `aws-cdk-lib/aws-route53` ergonomics.
+ *
+ * - `undefined` or `'@'` resolves to the zone apex.
+ * - A name that already ends in the zone name is used verbatim.
+ * - Anything else is treated as relative and the zone name is appended.
+ */
+export declare function resolveRecordName(recordName: string | undefined, zoneName: string | undefined): string;
+/**
+ * Properties for an A record.
+ */
+export interface CloudflareARecordProps extends Omit<CloudflareRecordProps, 'type' | 'data' | 'priority'> {
+    /** The IPv4 address. */
+    readonly content: string;
+    /** Whether to proxy the record through Cloudflare. @default false */
+    readonly proxied?: boolean;
+}
+/**
+ * An A record.
+ */
+export declare class CloudflareARecord extends CloudflareRecord {
+    constructor(scope: Construct, id: string, props: CloudflareARecordProps);
+}
+/**
+ * Properties for an AAAA record.
+ */
+export interface CloudflareAaaaRecordProps extends Omit<CloudflareRecordProps, 'type' | 'data' | 'priority'> {
+    /** The IPv6 address. */
+    readonly content: string;
+    /** Whether to proxy the record through Cloudflare. @default false */
+    readonly proxied?: boolean;
+}
+/**
+ * An AAAA record.
+ */
+export declare class CloudflareAaaaRecord extends CloudflareRecord {
+    constructor(scope: Construct, id: string, props: CloudflareAaaaRecordProps);
+}
+/**
+ * Properties for a CNAME record.
+ */
+export interface CloudflareCnameRecordProps extends Omit<CloudflareRecordProps, 'type' | 'data' | 'priority'> {
+    /** The canonical name. */
+    readonly content: string;
+    /** Whether to proxy the record through Cloudflare. @default false */
+    readonly proxied?: boolean;
+}
+/**
+ * A CNAME record.
+ */
+export declare class CloudflareCnameRecord extends CloudflareRecord {
+    constructor(scope: Construct, id: string, props: CloudflareCnameRecordProps);
+}
+/**
+ * Properties for a TXT record.
+ */
+export interface CloudflareTxtRecordProps extends Omit<CloudflareRecordProps, 'type' | 'data' | 'proxied' | 'priority'> {
+    /** The text value. Values longer than 255 characters are automatically chunked. */
+    readonly content: string;
+}
+/**
+ * A TXT record.
+ */
+export declare class CloudflareTxtRecord extends CloudflareRecord {
+    constructor(scope: Construct, id: string, props: CloudflareTxtRecordProps);
+}
+/**
+ * Properties for an MX record.
+ */
+export interface CloudflareMxRecordProps extends Omit<CloudflareRecordProps, 'type' | 'data' | 'proxied'> {
+    /** The mail exchanger host. */
+    readonly content: string;
+    /** The MX priority. */
+    readonly priority: number;
+}
+/**
+ * An MX record.
+ */
+export declare class CloudflareMxRecord extends CloudflareRecord {
+    constructor(scope: Construct, id: string, props: CloudflareMxRecordProps);
+}
+/**
+ * Properties for a CAA record.
+ */
+export interface CloudflareCaaRecordProps extends Omit<CloudflareRecordProps, 'type' | 'data' | 'proxied' | 'priority'> {
+    /** The CAA value. */
+    readonly content: string;
+}
+/**
+ * A CAA record.
+ */
+export declare class CloudflareCaaRecord extends CloudflareRecord {
+    constructor(scope: Construct, id: string, props: CloudflareCaaRecordProps);
+}

package/lib/record.js

@@ -0,0 +1,297 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.CloudflareCaaRecord = exports.CloudflareMxRecord = exports.CloudflareTxtRecord = exports.CloudflareCnameRecord = exports.CloudflareAaaaRecord = exports.CloudflareARecord = exports.CloudflareRecord = exports.CloudflareTtl = exports.CloudflareRecordType = void 0;
+exports.resolveRecordName = resolveRecordName;
+const cdk = __importStar(require("aws-cdk-lib"));
+const aws_cdk_lib_1 = require("aws-cdk-lib");
+const constructs_1 = require("constructs");
+const provider_1 = require("./provider");
+/**
+ * The DNS record types supported by this library.
+ */
+var CloudflareRecordType;
+(function (CloudflareRecordType) {
+    /** An IPv4 address record. */
+    CloudflareRecordType["A"] = "A";
+    /** An IPv6 address record. */
+    CloudflareRecordType["AAAA"] = "AAAA";
+    /** A canonical name record. */
+    CloudflareRecordType["CNAME"] = "CNAME";
+    /** A text record. */
+    CloudflareRecordType["TXT"] = "TXT";
+    /** A mail exchanger record. */
+    CloudflareRecordType["MX"] = "MX";
+    /** A name server record. */
+    CloudflareRecordType["NS"] = "NS";
+    /** A service locator record. */
+    CloudflareRecordType["SRV"] = "SRV";
+    /** A certification authority authorization record. */
+    CloudflareRecordType["CAA"] = "CAA";
+    /** A pointer record. */
+    CloudflareRecordType["PTR"] = "PTR";
+    /** A uniform resource identifier record. */
+    CloudflareRecordType["URI"] = "URI";
+})(CloudflareRecordType || (exports.CloudflareRecordType = CloudflareRecordType = {}));
+/**
+ * TTL helpers for Cloudflare records.
+ */
+class CloudflareTtl {
+    /**
+     * Cloudflare's automatic TTL (a value of `1` on the wire).
+     */
+    static AUTO = aws_cdk_lib_1.Duration.seconds(1);
+}
+exports.CloudflareTtl = CloudflareTtl;
+/**
+ * The set of record types that may be proxied through Cloudflare.
+ */
+const PROXIED_TYPES = new Set([CloudflareRecordType.A, CloudflareRecordType.AAAA, CloudflareRecordType.CNAME]);
+/**
+ * The set of record types that require a priority.
+ */
+const PRIORITY_TYPES = new Set([CloudflareRecordType.MX, CloudflareRecordType.SRV, CloudflareRecordType.URI]);
+/**
+ * The minimum TTL accepted by Cloudflare.
+ */
+const MIN_TTL_SECONDS = 60;
+/**
+ * The maximum TTL accepted by Cloudflare.
+ */
+const MAX_TTL_SECONDS = 86400;
+/**
+ * A Cloudflare DNS record managed as a CloudFormation resource.
+ *
+ * The construct synthesises a `Custom::CloudflareDnsRecord` custom resource whose
+ * Lambda handler calls the Cloudflare API. The API token is resolved at runtime
+ * from Secrets Manager; only the secret ARN ever appears in the template.
+ */
+class CloudflareRecord extends constructs_1.Construct {
+    /**
+     * Cloudflare's record ID, from `GetAtt`. This is the value you can use to
+     * locate the record in the Cloudflare dashboard.
+     */
+    recordId;
+    /**
+     * The fully-qualified name actually written to Cloudflare (e.g. `app.example.com`).
+     */
+    domainName;
+    /**
+     * The underlying custom resource.
+     */
+    resource;
+    constructor(scope, id, props) {
+        super(scope, id);
+        validateRecordProps(props);
+        const provider = provider_1.CloudflareDnsProvider.getOrCreate(this);
+        provider.grantSecretRead(props.zone.apiToken);
+        const fqdn = resolveRecordName(props.recordName, props.zone.zoneName);
+        const ttl = resolveTtl(this, props);
+        const content = props.content === undefined
+            ? undefined
+            : chunkTxt(props.type, props.content);
+        const record = {
+            name: fqdn,
+            type: props.type,
+            ttl: ttl.toSeconds(),
+        };
+        if (props.proxied) {
+            record.proxied = true;
+        }
+        if (content !== undefined) {
+            record.content = content;
+        }
+        if (props.data !== undefined) {
+            record.data = props.data;
+        }
+        if (props.priority !== undefined) {
+            record.priority = props.priority;
+        }
+        if (props.comment !== undefined) {
+            record.comment = props.comment;
+        }
+        if (props.tags !== undefined) {
+            record.tags = props.tags;
+        }
+        const removalPolicy = props.removalPolicy ?? aws_cdk_lib_1.RemovalPolicy.DESTROY;
+        this.resource = new cdk.CustomResource(this, 'Resource', {
+            serviceToken: provider.serviceToken,
+            resourceType: 'Custom::CloudflareDnsRecord',
+            removalPolicy,
+            properties: {
+                zoneId: props.zone.zoneId,
+                apiTokenSecretArn: props.zone.apiToken.secretArn,
+                adoptExisting: props.adoptExisting ?? false,
+                retainOnDelete: removalPolicy === aws_cdk_lib_1.RemovalPolicy.RETAIN,
+                record,
+            },
+        });
+        this.recordId = this.resource.getAttString('RecordId');
+        this.domainName = this.resource.getAttString('DomainName');
+    }
+}
+exports.CloudflareRecord = CloudflareRecord;
+/**
+ * Validates the record props at synth time, throwing a helpful error rather than
+ * deferring the failure to deployment.
+ */
+function validateRecordProps(props) {
+    const hasContent = props.content !== undefined;
+    const hasData = props.data !== undefined;
+    if (hasContent === hasData) {
+        throw new Error(`CloudflareRecord must specify exactly one of "content" or "data"; got content=${props.content === undefined ? 'undefined' : JSON.stringify(props.content)}, data=${props.data === undefined ? 'undefined' : 'object'}`);
+    }
+    if (props.proxied && !PROXIED_TYPES.has(props.type)) {
+        throw new Error(`CloudflareRecord "proxied" is only valid for A, AAAA and CNAME records, got ${props.type}`);
+    }
+    if (props.priority !== undefined && !PRIORITY_TYPES.has(props.type)) {
+        throw new Error(`CloudflareRecord "priority" is only valid for MX, SRV and URI records, got ${props.type}`);
+    }
+    if (props.priority === undefined && PRIORITY_TYPES.has(props.type)) {
+        throw new Error(`CloudflareRecord "priority" is required for ${props.type} records`);
+    }
+    if (props.ttl !== undefined) {
+        const seconds = props.ttl.toSeconds();
+        const isAuto = seconds === CloudflareTtl.AUTO.toSeconds();
+        if (!isAuto && (seconds < MIN_TTL_SECONDS || seconds > MAX_TTL_SECONDS)) {
+            throw new Error(`CloudflareRecord ttl must be between ${MIN_TTL_SECONDS} and ${MAX_TTL_SECONDS} seconds, or CloudflareTtl.AUTO (1); got ${seconds}`);
+        }
+    }
+    if (props.type === CloudflareRecordType.TXT && hasContent && props.content !== undefined && props.content.length === 0) {
+        throw new Error('CloudflareRecord TXT records require non-empty content');
+    }
+}
+/**
+ * Resolves the effective TTL for the record. Cloudflare rejects any TTL other
+ * than `1` when `proxied` is true, so the TTL is silently forced to automatic
+ * and an informational annotation is emitted.
+ */
+function resolveTtl(scope, props) {
+    const ttl = props.ttl ?? aws_cdk_lib_1.Duration.minutes(5);
+    if (props.proxied && ttl.toSeconds() !== CloudflareTtl.AUTO.toSeconds()) {
+        aws_cdk_lib_1.Annotations.of(scope).addInfo(`Cloudflare requires an automatic TTL (1) for proxied records; forcing ttl to CloudflareTtl.AUTO for ${props.type} record`);
+        return CloudflareTtl.AUTO;
+    }
+    return ttl;
+}
+/**
+ * Resolves a relative record name against the zone name, matching the
+ * `aws-cdk-lib/aws-route53` ergonomics.
+ *
+ * - `undefined` or `'@'` resolves to the zone apex.
+ * - A name that already ends in the zone name is used verbatim.
+ * - Anything else is treated as relative and the zone name is appended.
+ */
+function resolveRecordName(recordName, zoneName) {
+    if (recordName === undefined || recordName === '@') {
+        return zoneName ?? '@';
+    }
+    if (zoneName !== undefined && (recordName === zoneName || recordName.endsWith(`.${zoneName}`))) {
+        return recordName;
+    }
+    if (zoneName !== undefined) {
+        return `${recordName}.${zoneName}`;
+    }
+    return recordName;
+}
+/**
+ * Chunks a TXT record value longer than 255 characters into a series of quoted
+ * segments, which is how multiple strings are encoded in a single TXT record.
+ */
+function chunkTxt(type, content) {
+    if (type !== CloudflareRecordType.TXT || content.length <= 255) {
+        return content;
+    }
+    const chunks = [];
+    for (let i = 0; i < content.length; i += 255) {
+        chunks.push(content.slice(i, i + 255));
+    }
+    return chunks.map((chunk) => `"${chunk}"`).join(' ');
+}
+/**
+ * An A record.
+ */
+class CloudflareARecord extends CloudflareRecord {
+    constructor(scope, id, props) {
+        super(scope, id, { ...props, type: CloudflareRecordType.A });
+    }
+}
+exports.CloudflareARecord = CloudflareARecord;
+/**
+ * An AAAA record.
+ */
+class CloudflareAaaaRecord extends CloudflareRecord {
+    constructor(scope, id, props) {
+        super(scope, id, { ...props, type: CloudflareRecordType.AAAA });
+    }
+}
+exports.CloudflareAaaaRecord = CloudflareAaaaRecord;
+/**
+ * A CNAME record.
+ */
+class CloudflareCnameRecord extends CloudflareRecord {
+    constructor(scope, id, props) {
+        super(scope, id, { ...props, type: CloudflareRecordType.CNAME });
+    }
+}
+exports.CloudflareCnameRecord = CloudflareCnameRecord;
+/**
+ * A TXT record.
+ */
+class CloudflareTxtRecord extends CloudflareRecord {
+    constructor(scope, id, props) {
+        super(scope, id, { ...props, type: CloudflareRecordType.TXT });
+    }
+}
+exports.CloudflareTxtRecord = CloudflareTxtRecord;
+/**
+ * An MX record.
+ */
+class CloudflareMxRecord extends CloudflareRecord {
+    constructor(scope, id, props) {
+        super(scope, id, { ...props, type: CloudflareRecordType.MX });
+    }
+}
+exports.CloudflareMxRecord = CloudflareMxRecord;
+/**
+ * A CAA record.
+ */
+class CloudflareCaaRecord extends CloudflareRecord {
+    constructor(scope, id, props) {
+        super(scope, id, { ...props, type: CloudflareRecordType.CAA });
+    }
+}
+exports.CloudflareCaaRecord = CloudflareCaaRecord;
+//# sourceMappingURL=record.js.map

package/lib/record.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"record.js","sourceRoot":"","sources":["../src/record.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAqSA,8CAcC;AAnTD,iDAAmC;AACnC,6CAAmE;AACnE,2CAAuC;AAEvC,yCAAmD;AAEnD;;GAEG;AACH,IAAY,oBAqBX;AArBD,WAAY,oBAAoB;IAC9B,8BAA8B;IAC9B,+BAAO,CAAA;IACP,8BAA8B;IAC9B,qCAAa,CAAA;IACb,+BAA+B;IAC/B,uCAAe,CAAA;IACf,qBAAqB;IACrB,mCAAW,CAAA;IACX,+BAA+B;IAC/B,iCAAS,CAAA;IACT,4BAA4B;IAC5B,iCAAS,CAAA;IACT,gCAAgC;IAChC,mCAAW,CAAA;IACX,sDAAsD;IACtD,mCAAW,CAAA;IACX,wBAAwB;IACxB,mCAAW,CAAA;IACX,4CAA4C;IAC5C,mCAAW,CAAA;AACb,CAAC,EArBW,oBAAoB,oCAApB,oBAAoB,QAqB/B;AAED;;GAEG;AACH,MAAa,aAAa;IACxB;;OAEG;IACI,MAAM,CAAU,IAAI,GAAa,sBAAQ,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC;;AAJ9D,sCAKC;AAED;;GAEG;AACH,MAAM,aAAa,GAAG,IAAI,GAAG,CAAC,CAAC,oBAAoB,CAAC,CAAC,EAAE,oBAAoB,CAAC,IAAI,EAAE,oBAAoB,CAAC,KAAK,CAAC,CAAC,CAAC;AAE/G;;GAEG;AACH,MAAM,cAAc,GAAG,IAAI,GAAG,CAAC,CAAC,oBAAoB,CAAC,EAAE,EAAE,oBAAoB,CAAC,GAAG,EAAE,oBAAoB,CAAC,GAAG,CAAC,CAAC,CAAC;AAE9G;;GAEG;AACH,MAAM,eAAe,GAAG,EAAE,CAAC;AAE3B;;GAEG;AACH,MAAM,eAAe,GAAG,KAAK,CAAC;AAoF9B;;;;;;GAMG;AACH,MAAa,gBAAiB,SAAQ,sBAAS;IAC7C;;;OAGG;IACa,QAAQ,CAAS;IAEjC;;OAEG;IACa,UAAU,CAAS;IAEnC;;OAEG;IACc,QAAQ,CAAqB;IAE9C,YAAmB,KAAgB,EAAE,EAAU,EAAE,KAA4B;QAC3E,KAAK,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;QAEjB,mBAAmB,CAAC,KAAK,CAAC,CAAC;QAE3B,MAAM,QAAQ,GAAG,gCAAqB,CAAC,WAAW,CAAC,IAAI,CAAC,CAAC;QACzD,QAAQ,CAAC,eAAe,CAAC,KAAK,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;QAE9C,MAAM,IAAI,GAAG,iBAAiB,CAAC,KAAK,CAAC,UAAU,EAAE,KAAK,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;QACtE,MAAM,GAAG,GAAG,UAAU,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;QACpC,MAAM,OAAO,GAAG,KAAK,CAAC,OAAO,KAAK,SAAS;YACzC,CAAC,CAAC,SAAS;YACX,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,IAAI,EAAE,KAAK,CAAC,OAAO,CAAC,CAAC;QAExC,MAAM,MAAM,GAA4B;YACtC,IAAI,EAAE,IAAI;YACV,IAAI,EAAE,KAAK,CAAC,IAAI;YAChB,GAAG,EAAE,GAAG,CAAC,SAAS,EAAE;SACrB,CAAC;QAEF,IAAI,KAAK,CAAC,OAAO,EAAE,CAAC;YAClB,MAAM,CAAC,OAAO,GAAG,IAAI,CAAC;QACxB,CAAC;QACD,IAAI,OAAO,KAAK,SAAS,EAAE,CAAC;YAC1B,MAAM,CAAC,OAAO,GAAG,OAAO,CAAC;QAC3B,CAAC;QACD,IAAI,KAAK,CAAC,IAAI,KAAK,SAAS,EAAE,CAAC;YAC7B,MAAM,CAAC,IAAI,GAAG,KAAK,CAAC,IAAI,CAAC;QAC3B,CAAC;QACD,IAAI,KAAK,CAAC,QAAQ,KAAK,SAAS,EAAE,CAAC;YACjC,MAAM,CAAC,QAAQ,GAAG,KAAK,CAAC,QAAQ,CAAC;QACnC,CAAC;QACD,IAAI,KAAK,CAAC,OAAO,KAAK,SAAS,EAAE,CAAC;YAChC,MAAM,CAAC,OAAO,GAAG,KAAK,CAAC,OAAO,CAAC;QACjC,CAAC;QACD,IAAI,KAAK,CAAC,IAAI,KAAK,SAAS,EAAE,CAAC;YAC7B,MAAM,CAAC,IAAI,GAAG,KAAK,CAAC,IAAI,CAAC;QAC3B,CAAC;QAED,MAAM,aAAa,GAAG,KAAK,CAAC,aAAa,IAAI,2BAAa,CAAC,OAAO,CAAC;QAEnE,IAAI,CAAC,QAAQ,GAAG,IAAI,GAAG,CAAC,cAAc,CAAC,IAAI,EAAE,UAAU,EAAE;YACvD,YAAY,EAAE,QAAQ,CAAC,YAAY;YACnC,YAAY,EAAE,6BAA6B;YAC3C,aAAa;YACb,UAAU,EAAE;gBACV,MAAM,EAAE,KAAK,CAAC,IAAI,CAAC,MAAM;gBACzB,iBAAiB,EAAE,KAAK,CAAC,IAAI,CAAC,QAAQ,CAAC,SAAS;gBAChD,aAAa,EAAE,KAAK,CAAC,aAAa,IAAI,KAAK;gBAC3C,cAAc,EAAE,aAAa,KAAK,2BAAa,CAAC,MAAM;gBACtD,MAAM;aACP;SACF,CAAC,CAAC;QAEH,IAAI,CAAC,QAAQ,GAAG,IAAI,CAAC,QAAQ,CAAC,YAAY,CAAC,UAAU,CAAC,CAAC;QACvD,IAAI,CAAC,UAAU,GAAG,IAAI,CAAC,QAAQ,CAAC,YAAY,CAAC,YAAY,CAAC,CAAC;IAC7D,CAAC;CACF;AA1ED,4CA0EC;AAED;;;GAGG;AACH,SAAS,mBAAmB,CAAC,KAA4B;IACvD,MAAM,UAAU,GAAG,KAAK,CAAC,OAAO,KAAK,SAAS,CAAC;IAC/C,MAAM,OAAO,GAAG,KAAK,CAAC,IAAI,KAAK,SAAS,CAAC;IAEzC,IAAI,UAAU,KAAK,OAAO,EAAE,CAAC;QAC3B,MAAM,IAAI,KAAK,CACb,iFAAiF,KAAK,CAAC,OAAO,KAAK,SAAS,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,OAAO,CAAC,UAAU,KAAK,CAAC,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,QAAQ,EAAE,CACxN,CAAC;IACJ,CAAC;IAED,IAAI,KAAK,CAAC,OAAO,IAAI,CAAC,aAAa,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC;QACpD,MAAM,IAAI,KAAK,CAAC,+EAA+E,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC;IAC/G,CAAC;IAED,IAAI,KAAK,CAAC,QAAQ,KAAK,SAAS,IAAI,CAAC,cAAc,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC;QACpE,MAAM,IAAI,KAAK,CAAC,8EAA8E,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC;IAC9G,CAAC;IACD,IAAI,KAAK,CAAC,QAAQ,KAAK,SAAS,IAAI,cAAc,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC;QACnE,MAAM,IAAI,KAAK,CAAC,+CAA+C,KAAK,CAAC,IAAI,UAAU,CAAC,CAAC;IACvF,CAAC;IAED,IAAI,KAAK,CAAC,GAAG,KAAK,SAAS,EAAE,CAAC;QAC5B,MAAM,OAAO,GAAG,KAAK,CAAC,GAAG,CAAC,SAAS,EAAE,CAAC;QACtC,MAAM,MAAM,GAAG,OAAO,KAAK,aAAa,CAAC,IAAI,CAAC,SAAS,EAAE,CAAC;QAC1D,IAAI,CAAC,MAAM,IAAI,CAAC,OAAO,GAAG,eAAe,IAAI,OAAO,GAAG,eAAe,CAAC,EAAE,CAAC;YACxE,MAAM,IAAI,KAAK,CACb,wCAAwC,eAAe,QAAQ,eAAe,4CAA4C,OAAO,EAAE,CACpI,CAAC;QACJ,CAAC;IACH,CAAC;IAED,IAAI,KAAK,CAAC,IAAI,KAAK,oBAAoB,CAAC,GAAG,IAAI,UAAU,IAAI,KAAK,CAAC,OAAO,KAAK,SAAS,IAAI,KAAK,CAAC,OAAO,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACvH,MAAM,IAAI,KAAK,CAAC,wDAAwD,CAAC,CAAC;IAC5E,CAAC;AACH,CAAC;AAED;;;;GAIG;AACH,SAAS,UAAU,CAAC,KAAgB,EAAE,KAA4B;IAChE,MAAM,GAAG,GAAG,KAAK,CAAC,GAAG,IAAI,sBAAQ,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC;IAE7C,IAAI,KAAK,CAAC,OAAO,IAAI,GAAG,CAAC,SAAS,EAAE,KAAK,aAAa,CAAC,IAAI,CAAC,SAAS,EAAE,EAAE,CAAC;QACxE,yBAAW,CAAC,EAAE,CAAC,KAAK,CAAC,CAAC,OAAO,CAC3B,uGAAuG,KAAK,CAAC,IAAI,SAAS,CAC3H,CAAC;QACF,OAAO,aAAa,CAAC,IAAI,CAAC;IAC5B,CAAC;IAED,OAAO,GAAG,CAAC;AACb,CAAC;AAED;;;;;;;GAOG;AACH,SAAgB,iBAAiB,CAAC,UAA8B,EAAE,QAA4B;IAC5F,IAAI,UAAU,KAAK,SAAS,IAAI,UAAU,KAAK,GAAG,EAAE,CAAC;QACnD,OAAO,QAAQ,IAAI,GAAG,CAAC;IACzB,CAAC;IAED,IAAI,QAAQ,KAAK,SAAS,IAAI,CAAC,UAAU,KAAK,QAAQ,IAAI,UAAU,CAAC,QAAQ,CAAC,IAAI,QAAQ,EAAE,CAAC,CAAC,EAAE,CAAC;QAC/F,OAAO,UAAU,CAAC;IACpB,CAAC;IAED,IAAI,QAAQ,KAAK,SAAS,EAAE,CAAC;QAC3B,OAAO,GAAG,UAAU,IAAI,QAAQ,EAAE,CAAC;IACrC,CAAC;IAED,OAAO,UAAU,CAAC;AACpB,CAAC;AAED;;;GAGG;AACH,SAAS,QAAQ,CAAC,IAA0B,EAAE,OAAe;IAC3D,IAAI,IAAI,KAAK,oBAAoB,CAAC,GAAG,IAAI,OAAO,CAAC,MAAM,IAAI,GAAG,EAAE,CAAC;QAC/D,OAAO,OAAO,CAAC;IACjB,CAAC;IACD,MAAM,MAAM,GAAa,EAAE,CAAC;IAC5B,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC,IAAI,GAAG,EAAE,CAAC;QAC7C,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,GAAG,GAAG,CAAC,CAAC,CAAC;IACzC,CAAC;IACD,OAAO,MAAM,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,IAAI,KAAK,GAAG,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;AACvD,CAAC;AAYD;;GAEG;AACH,MAAa,iBAAkB,SAAQ,gBAAgB;IACrD,YAAmB,KAAgB,EAAE,EAAU,EAAE,KAA6B;QAC5E,KAAK,CAAC,KAAK,EAAE,EAAE,EAAE,EAAE,GAAG,KAAK,EAAE,IAAI,EAAE,oBAAoB,CAAC,CAAC,EAAE,CAAC,CAAC;IAC/D,CAAC;CACF;AAJD,8CAIC;AAYD;;GAEG;AACH,MAAa,oBAAqB,SAAQ,gBAAgB;IACxD,YAAmB,KAAgB,EAAE,EAAU,EAAE,KAAgC;QAC/E,KAAK,CAAC,KAAK,EAAE,EAAE,EAAE,EAAE,GAAG,KAAK,EAAE,IAAI,EAAE,oBAAoB,CAAC,IAAI,EAAE,CAAC,CAAC;IAClE,CAAC;CACF;AAJD,oDAIC;AAYD;;GAEG;AACH,MAAa,qBAAsB,SAAQ,gBAAgB;IACzD,YAAmB,KAAgB,EAAE,EAAU,EAAE,KAAiC;QAChF,KAAK,CAAC,KAAK,EAAE,EAAE,EAAE,EAAE,GAAG,KAAK,EAAE,IAAI,EAAE,oBAAoB,CAAC,KAAK,EAAE,CAAC,CAAC;IACnE,CAAC;CACF;AAJD,sDAIC;AAUD;;GAEG;AACH,MAAa,mBAAoB,SAAQ,gBAAgB;IACvD,YAAmB,KAAgB,EAAE,EAAU,EAAE,KAA+B;QAC9E,KAAK,CAAC,KAAK,EAAE,EAAE,EAAE,EAAE,GAAG,KAAK,EAAE,IAAI,EAAE,oBAAoB,CAAC,GAAG,EAAE,CAAC,CAAC;IACjE,CAAC;CACF;AAJD,kDAIC;AAYD;;GAEG;AACH,MAAa,kBAAmB,SAAQ,gBAAgB;IACtD,YAAmB,KAAgB,EAAE,EAAU,EAAE,KAA8B;QAC7E,KAAK,CAAC,KAAK,EAAE,EAAE,EAAE,EAAE,GAAG,KAAK,EAAE,IAAI,EAAE,oBAAoB,CAAC,EAAE,EAAE,CAAC,CAAC;IAChE,CAAC;CACF;AAJD,gDAIC;AAUD;;GAEG;AACH,MAAa,mBAAoB,SAAQ,gBAAgB;IACvD,YAAmB,KAAgB,EAAE,EAAU,EAAE,KAA+B;QAC9E,KAAK,CAAC,KAAK,EAAE,EAAE,EAAE,EAAE,GAAG,KAAK,EAAE,IAAI,EAAE,oBAAoB,CAAC,GAAG,EAAE,CAAC,CAAC;IACjE,CAAC;CACF;AAJD,kDAIC"}

package/lib/zone.d.ts

@@ -0,0 +1,72 @@
+import * as secretsmanager from 'aws-cdk-lib/aws-secretsmanager';
+import { Construct } from 'constructs';
+/**
+ * A reference to a Cloudflare zone that already exists in the Cloudflare account.
+ *
+ * `CloudflareZone.fromZoneId()` is the only supported way to obtain one; this
+ * library deliberately does not create zones. Zones are assumed to be managed in
+ * the Cloudflare dashboard (or elsewhere) and referenced here by their Zone ID.
+ */
+export interface ICloudflareZone {
+    /**
+     * The Cloudflare Zone ID, e.g. `"abc123..."`. This may be a plain string or a
+     * CDK token (for example resolved from SSM at deploy time).
+     */
+    readonly zoneId: string;
+    /**
+     * The apex domain, e.g. `"example.com"`. When set, `recordName` values that do
+     * not already end in the zone name are treated as relative and this suffix is
+     * appended, matching `aws-cdk-lib/aws-route53` ergonomics.
+     *
+     * @default - record names are used verbatim
+     */
+    readonly zoneName?: string;
+    /**
+     * The Secrets Manager secret holding the Cloudflare API token. The secret may
+     * contain the token as a raw string or as a JSON blob with an `apiToken` key.
+     * Only the secret ARN ever appears in the CloudFormation template.
+     */
+    readonly apiToken: secretsmanager.ISecret;
+}
+/**
+ * Properties for referencing an existing Cloudflare zone.
+ */
+export interface CloudflareZoneAttributes {
+    /**
+     * The Cloudflare Zone ID, e.g. `"abc123..."`. This may be a plain string or a
+     * CDK token (for example resolved from SSM at deploy time).
+     */
+    readonly zoneId: string;
+    /**
+     * The Secrets Manager secret holding the Cloudflare API token. The secret may
+     * contain the token as a raw string or as a JSON blob with an `apiToken` key.
+     * Only the secret ARN ever appears in the CloudFormation template.
+     */
+    readonly apiToken: secretsmanager.ISecret;
+    /**
+     * The apex domain, e.g. `"example.com"`. Enables relative record names.
+     *
+     * @default - record names are used verbatim
+     */
+    readonly zoneName?: string;
+}
+/**
+ * A reference to an existing Cloudflare zone.
+ *
+ * Zones are not created by this library; they must already exist in the
+ * Cloudflare account. Use `CloudflareZone.fromZoneId()` to reference one.
+ */
+export declare class CloudflareZone extends Construct implements ICloudflareZone {
+    /**
+     * Reference an existing Cloudflare zone by its Zone ID.
+     *
+     * @param scope The scope in which to define this construct.
+     * @param id    The scoped construct ID.
+     * @param attrs The zone attributes.
+     */
+    static fromZoneId(scope: Construct, id: string, attrs: CloudflareZoneAttributes): ICloudflareZone;
+    readonly zoneId: string;
+    readonly zoneName?: string;
+    readonly apiToken: secretsmanager.ISecret;
+    private constructor();
+}