@omega.js/manager 0.1.0

package/dist/services/edge/ensure/workers.js

@@ -0,0 +1,219 @@
+/**
+ * Ensure Workers + routes match `edge.providers.cloudflare.workers`
+ * [{ name, route, script, env }] — script is a filename in this service's
+ * workers/ dir; route supports `{ domain }` templating.
+ *
+ * 1. Reads existing workers + zone routes + account ID.
+ * 2. For each configured worker: load script from disk, mark create/update;
+ *    for each route: ensure it exists and points at the right script.
+ *    Unconfigured workers/routes are removed.
+ * 3. PUTs worker scripts as multipart form data, POSTs/PUTs/DELETEs routes.
+ */
+const { join } = require('node:path');
+const chalk = require('chalk').default;
+const jetpack = require('fs-jetpack');
+const { templateObject } = require('../../../config.js');
+const { cacheRead } = require('../lib/read-cache.js');
+const { getZoneId, zoneGate } = require('../lib/ruleset-helper.js');
+const { dryRunPlan } = require('../../../lib/run-gates.js');
+
+async function getAccountId(api, zoneId) {
+  const zone = await api.makeRequest(`/zones/${zoneId}`);
+  return zone.result.account.id;
+}
+
+function buildScriptFormData(scriptContent, env) {
+  const formData = new FormData();
+  formData.append('metadata', JSON.stringify({
+    main_module: 'index.js',
+    bindings: Object.entries(env || {}).map(([key, value]) => ({
+      type: 'plain_text', name: key, text: value,
+    })),
+  }));
+  formData.append('index.js', new Blob([scriptContent], { type: 'application/javascript+module' }), 'index.js');
+  return formData;
+}
+
+module.exports = async function ensureWorkers(context) {
+  const { cloudflareApi: api, brandRoot, brandConfig, domain, options = {} } = context;
+  const zoneId = getZoneId(context);
+  const gated = zoneGate(context, 'workers');
+  if (gated) return gated;
+
+  // === DIFF config presence first — reads are pointless without any config ===
+  const workersConfig = brandConfig?.edge?.providers?.cloudflare?.workers;
+  if (!workersConfig || workersConfig.length === 0) {
+    console.log(`      ${chalk.dim('⊘ No workers configured')}`);
+    return;
+  }
+
+  // === READ ===
+  const accountId = await getAccountId(api, zoneId);
+  const workersResponse = await api.makeRequest(`/accounts/${accountId}/workers/scripts`);
+  const existingWorkers = workersResponse.result || [];
+  const routesResponse = await api.makeRequest(`/zones/${zoneId}/workers/routes`);
+  const existingRoutes = routesResponse.result || [];
+
+  console.log(`      ${chalk.green('✓')} Read ${chalk.dim(`(${existingWorkers.length} items)`)}`);
+  cacheRead(brandRoot, 'workers', {
+    count: existingWorkers.length,
+    workers: existingWorkers,
+    routes: existingRoutes,
+    accountId,
+  });
+
+  // === DIFF ===
+  const workersToCreate = [];
+  const workersToUpdate = [];
+  const routesToCreate = [];
+  const routesToUpdate = [];
+
+  for (const workerConfig of workersConfig) {
+    const route = templateObject(workerConfig.route, { domain });
+    const scriptPath = join(__dirname, '..', 'workers', workerConfig.script);
+    const scriptContent = jetpack.read(scriptPath);
+
+    if (!scriptContent) {
+      console.error(`      ${chalk.red('✗')} Worker script not found: ${chalk.cyan(scriptPath)}`);
+      continue;
+    }
+
+    const existingWorker = existingWorkers.find((w) => w.id === workerConfig.name);
+    if (existingWorker) {
+      workersToUpdate.push({ name: workerConfig.name, script: scriptContent, env: workerConfig.env || {} });
+    } else {
+      console.log(`      ${chalk.dim('·')} create worker ${chalk.cyan(workerConfig.name)}`);
+      workersToCreate.push({ name: workerConfig.name, script: scriptContent, env: workerConfig.env || {} });
+    }
+
+    const existingRoute = existingRoutes.find((r) => r.pattern === route);
+    if (existingRoute) {
+      if (existingRoute.script !== workerConfig.name) {
+        console.log(`      ${chalk.dim('·')} update route ${chalk.cyan(route)} -> ${chalk.cyan(workerConfig.name)}`);
+        routesToUpdate.push({ id: existingRoute.id, pattern: route, script: workerConfig.name });
+      }
+    } else {
+      console.log(`      ${chalk.dim('·')} create route ${chalk.cyan(route)} -> ${chalk.cyan(workerConfig.name)}`);
+      routesToCreate.push({ pattern: route, script: workerConfig.name });
+    }
+  }
+
+  // Detect stale routes and workers (in Cloudflare but not in config)
+  const configRoutePatterns = new Set(workersConfig.map((w) => templateObject(w.route, { domain })));
+  const configWorkerNames = new Set(workersConfig.map((w) => w.name));
+
+  const routesToDelete = existingRoutes.filter((r) => !configRoutePatterns.has(r.pattern));
+  const workersToDelete = existingWorkers.filter((w) => !configWorkerNames.has(w.id));
+
+  for (const route of routesToDelete) {
+    console.log(`      ${chalk.dim('·')} remove route ${chalk.cyan(route.pattern)}`);
+  }
+  for (const worker of workersToDelete) {
+    console.log(`      ${chalk.dim('·')} remove worker ${chalk.cyan(worker.id)}`);
+  }
+
+  if (workersToCreate.length === 0 && workersToUpdate.length === 0
+    && routesToCreate.length === 0 && routesToUpdate.length === 0
+    && routesToDelete.length === 0 && workersToDelete.length === 0) {
+    console.log(`      ${chalk.dim('⊘ No changes needed')}`);
+    return;
+  }
+
+  if (options.dryRun) {
+    dryRunPlan('write the worker + routes');
+    return {
+      status: 'success',
+      output: {
+        workers: {
+          planned: {
+            createWorkers: workersToCreate.length,
+            updateWorkers: workersToUpdate.length,
+            createRoutes: routesToCreate.length,
+            updateRoutes: routesToUpdate.length,
+            deleteRoutes: routesToDelete.length,
+            deleteWorkers: workersToDelete.length,
+          },
+        },
+      },
+    };
+  }
+
+  // === WRITE ===
+  const output = {
+    workersCreated: [], workersUpdated: [], routesCreated: [], routesUpdated: [],
+    routesDeleted: [], workersDeleted: [], errors: [],
+  };
+
+  for (const worker of [...workersToCreate, ...workersToUpdate]) {
+    const isCreate = workersToCreate.includes(worker);
+    try {
+      await api.makeRequest(`/accounts/${accountId}/workers/scripts/${worker.name}`, {
+        method: 'PUT',
+        body: buildScriptFormData(worker.script, worker.env),
+      });
+      (isCreate ? output.workersCreated : output.workersUpdated).push(worker.name);
+      console.log(`      ${chalk.green('✓')} ${isCreate ? 'Created' : 'Updated'} worker: ${chalk.cyan(worker.name)}`);
+    } catch (error) {
+      console.error(`      ${chalk.red('✗')} Failed to ${isCreate ? 'create' : 'update'} worker ${chalk.cyan(worker.name)}${chalk.dim(`: ${error.message}`)}`);
+      output.errors.push({ worker: worker.name, error: error.message });
+    }
+  }
+
+  for (const route of routesToCreate) {
+    try {
+      await api.makeRequest(`/zones/${zoneId}/workers/routes`, {
+        method: 'POST',
+        body: JSON.stringify({ pattern: route.pattern, script: route.script }),
+      });
+      output.routesCreated.push(route.pattern);
+      console.log(`      ${chalk.green('✓')} Created route: ${chalk.cyan(route.pattern)} -> ${chalk.cyan(route.script)}`);
+    } catch (error) {
+      console.error(`      ${chalk.red('✗')} Failed to create route ${chalk.cyan(route.pattern)}${chalk.dim(`: ${error.message}`)}`);
+      output.errors.push({ route: route.pattern, error: error.message });
+    }
+  }
+
+  for (const route of routesToUpdate) {
+    try {
+      await api.makeRequest(`/zones/${zoneId}/workers/routes/${route.id}`, {
+        method: 'PUT',
+        body: JSON.stringify({ pattern: route.pattern, script: route.script }),
+      });
+      output.routesUpdated.push(route.pattern);
+      console.log(`      ${chalk.green('✓')} Updated route: ${chalk.cyan(route.pattern)} -> ${chalk.cyan(route.script)}`);
+    } catch (error) {
+      console.error(`      ${chalk.red('✗')} Failed to update route ${chalk.cyan(route.pattern)}${chalk.dim(`: ${error.message}`)}`);
+      output.errors.push({ route: route.pattern, error: error.message });
+    }
+  }
+
+  // Delete stale routes (before workers — routes reference worker scripts)
+  for (const route of routesToDelete) {
+    try {
+      await api.makeRequest(`/zones/${zoneId}/workers/routes/${route.id}`, { method: 'DELETE' });
+      output.routesDeleted.push(route.pattern);
+      console.log(`      ${chalk.green('✓')} Removed route: ${chalk.cyan(route.pattern)}`);
+    } catch (error) {
+      console.error(`      ${chalk.red('✗')} Failed to remove route ${chalk.cyan(route.pattern)}${chalk.dim(`: ${error.message}`)}`);
+      output.errors.push({ route: route.pattern, error: error.message });
+    }
+  }
+
+  // Delete stale workers
+  for (const worker of workersToDelete) {
+    try {
+      await api.makeRequest(`/accounts/${accountId}/workers/scripts/${worker.id}`, { method: 'DELETE' });
+      output.workersDeleted.push(worker.id);
+      console.log(`      ${chalk.green('✓')} Removed worker: ${chalk.cyan(worker.id)}`);
+    } catch (error) {
+      console.error(`      ${chalk.red('✗')} Failed to remove worker ${chalk.cyan(worker.id)}${chalk.dim(`: ${error.message}`)}`);
+      output.errors.push({ worker: worker.id, error: error.message });
+    }
+  }
+
+  return {
+    status: output.errors.length > 0 ? 'warned' : 'success',
+    ...(output.errors.length > 0 ? { reason: `${output.errors.length} worker(s) failed: ${output.errors.map((e) => e.worker).join(', ')}` } : {}),
+    output: { workers: output },
+  };
+};

package/dist/services/edge/ensure/zone-settings.js

@@ -0,0 +1,108 @@
+/**
+ * Ensure zone settings match `edge.providers.cloudflare.settings`.
+ *
+ * 1. Reads all settings in one bulk call + any addon settings individually.
+ * 2. Diffs against desired settings — skips read-only and absent ones.
+ * 3. Patches each changed setting (one API call per setting — Cloudflare has no bulk PATCH).
+ *
+ * Failures on individual settings don't block the rest.
+ */
+const chalk = require('chalk').default;
+const { DEFAULTS } = require('../../../config.js');
+const { cacheRead } = require('../lib/read-cache.js');
+const { getZoneId, zoneGate } = require('../lib/ruleset-helper.js');
+const { dryRunPlan } = require('../../../lib/run-gates.js');
+
+// Settings not returned by /zones/{id}/settings — each needs its own GET.
+const ADDON_SETTINGS = ['speed_brain', 'fonts'];
+
+module.exports = async function ensureZoneSettings(context) {
+  const { cloudflareApi: api, brandRoot, brandConfig, options = {} } = context;
+  const zoneId = getZoneId(context);
+  const gated = zoneGate(context, 'zoneSettings');
+  if (gated) return gated;
+
+  // === READ ===
+  const bulkResponse = await api.makeRequest(`/zones/${zoneId}/settings`);
+  const settings = {};
+  for (const s of bulkResponse.result) {
+    settings[s.id] = { value: s.value, editable: s.editable !== false };
+  }
+
+  const targetAddons = ADDON_SETTINGS.filter((id) => Object.keys(DEFAULTS.edge.providers.cloudflare.settings).includes(id));
+  for (const id of targetAddons) {
+    if (settings[id]) continue;
+    try {
+      const response = await api.makeRequest(`/zones/${zoneId}/settings/${id}`);
+      settings[id] = { value: response.result.value, editable: response.result.editable !== false };
+    } catch (error) {
+      console.log(`      ${chalk.yellow('⚠')} addon setting ${chalk.bold(id)} not available${chalk.dim(`: ${error.message}`)}`);
+    }
+  }
+
+  console.log(`      ${chalk.green('✓')} Read ${chalk.dim(`(${Object.keys(settings).length} items)`)}`);
+  cacheRead(brandRoot, 'zone-settings', { count: Object.keys(settings).length, settings });
+
+  // === DIFF ===
+  const desired = brandConfig?.edge?.providers?.cloudflare?.settings;
+  if (!desired || typeof desired !== 'object') {
+    return;
+  }
+
+  const updates = {};
+  const skipped = [];
+
+  for (const [key, desiredValue] of Object.entries(desired)) {
+    const current = settings[key];
+    if (!current) continue; // not on this plan
+    if (!current.editable) {
+      skipped.push(key);
+      continue;
+    }
+
+    const isObject = typeof desiredValue === 'object' && desiredValue !== null;
+    const changed = isObject
+      ? JSON.stringify(current.value) !== JSON.stringify(desiredValue)
+      : current.value !== desiredValue;
+    if (!changed) continue;
+
+    updates[key] = desiredValue;
+    const currentDisplay = isObject ? '(object)' : String(current.value);
+    const desiredDisplay = isObject ? '(object)' : String(desiredValue);
+    console.log(`      ${chalk.dim('·')} ${key}: ${chalk.dim(currentDisplay)} => ${chalk.cyan(desiredDisplay)}`);
+  }
+
+  if (skipped.length > 0) {
+    console.log(`      ${chalk.yellow('⚠')} ${skipped.length} read-only setting(s) skipped: ${chalk.dim(skipped.join(', '))}`);
+  }
+
+  if (Object.keys(updates).length === 0) {
+    console.log(`      ${chalk.dim('⊘ No changes needed')}`);
+    return;
+  }
+
+  if (options.dryRun) {
+    return dryRunPlan(`patch ${Object.keys(updates).length} setting(s)`, { status: 'success', output: { settings: { planned: Object.keys(updates) } } });
+  }
+
+  // === WRITE ===
+  const output = { updated: true, success: [], failed: [] };
+
+  for (const [key, value] of Object.entries(updates)) {
+    try {
+      await api.makeRequest(`/zones/${zoneId}/settings/${key}`, {
+        method: 'PATCH',
+        body: JSON.stringify({ value }),
+      });
+      output.success.push(key);
+      const display = typeof value === 'object' ? '(object)' : String(value);
+      console.log(`      ${chalk.green('✓')} ${key} => ${chalk.cyan(display)}`);
+    } catch (error) {
+      output.failed.push({ key, error: error.message });
+      console.error(`      ${chalk.red('✗')} ${key}${chalk.dim(`: ${error.message}`)}`);
+    }
+  }
+
+  output.count = output.success.length;
+  return { output: { settings: output } };
+};

package/dist/services/edge/ensure/zone.js

@@ -0,0 +1,183 @@
+/**
+ * Ensure the zone exists in Cloudflare.
+ *
+ * Creates the zone when missing — for subdomain projects that means the
+ * PARENT zone (playground.omegajs.dev → creates omegajs.dev): the zone is
+ * a prerequisite resource the brand's records live in, and creating it is
+ * inert until the registrar's nameservers point at it (which the domain
+ * service automates for API registrars, right after this service). A
+ * pending zone reports its nameservers; when the registrar is a manual
+ * one, interactive runs open its nameserver page and poll until the zone
+ * activates. Non-interactive/dry runs just report — a later run picks the
+ * zone up once it activates.
+ *
+ * The resolved id goes two places: `state: { zoneId }` for the later
+ * operations in THIS run (they read it via getZoneId), and CONFIG, at
+ * `edge.providers.cloudflare.zone` (#434) — the id `omega purge` targets
+ * from a build, where no Cloudflare token is in play. The resolved value
+ * always wins: a stale hand-set id is drift and gets patched.
+ */
+const chalk = require('chalk').default;
+const { openBrowserAndPoll, pollWithSpinner } = require('../../../vendor/devkit/flows.js');
+const { cacheRead } = require('../lib/read-cache.js');
+const { API_PROVIDERS, REGISTRAR_NAMESERVER_URLS, resolveRegistrar } = require('../../domain/lib/registrars.js');
+const { writeBrandConfig } = require('../../../lib/config-write.js');
+const { canPrompt, dryRunPlan } = require('../../../lib/run-gates.js');
+
+const CONFIG_PATH = 'edge.providers.cloudflare.zone';
+
+/**
+ * Land the resolved zone id in omega.json5 (drift-gated) and hand back the
+ * within-run carry every later operation reads.
+ *
+ * @param {Object} context - Handler context
+ * @param {Object} zone - The resolved Cloudflare zone
+ * @returns {Object} The handler's `state` block
+ */
+function landZoneId(context, zone) {
+  if (context.brandConfig.edge?.providers?.cloudflare?.zone !== zone.id) {
+    writeBrandConfig(context, { [CONFIG_PATH]: zone.id });
+  }
+
+  return { zoneId: zone.id };
+}
+
+function reportPending(zone) {
+  console.log(`      ${chalk.yellow('⚠')} Zone pending — set these nameservers at your domain registrar:`);
+  for (const ns of zone.name_servers || []) {
+    console.log(`        ${chalk.cyan(ns)}`);
+  }
+}
+
+/**
+ * Interactive wait for a pending zone: opens the registrar's nameserver page
+ * (when domain.providers names one with a known dashboard) and re-reads the
+ * zone until Cloudflare reports it active.
+ *
+ * @returns {Object|null} - The active zone, or null (deferred/skipped —
+ *   the caller returns its pending shape)
+ */
+async function waitForActiveZone(context, zone) {
+  const { cloudflareApi: api, brandConfig, zoneDomain, options = {} } = context;
+  const provider = resolveRegistrar(brandConfig);
+
+  // API registrars: the domain service sets the nameservers right after this
+  // service. No provider yet: nothing to open (fresh brand). Non-interactive
+  // and dry runs never sit in a poll.
+  if (!canPrompt(options) || !provider || API_PROVIDERS.has(provider)) {
+    console.log(`      ${chalk.dim('Rerun after the nameservers propagate (the domain service automates this for API registrars).')}`);
+    return null;
+  }
+
+  const check = async () => {
+    const fresh = (await api.makeRequest(`/zones/${zone.id}`)).result;
+    return fresh.status === 'active' ? { done: true, result: fresh } : { done: false };
+  };
+
+  // provider is user config — unknown registrars poll without a browser step
+  const registrarUrl = REGISTRAR_NAMESERVER_URLS[provider]?.(zoneDomain);
+  const result = registrarUrl
+    ? await openBrowserAndPoll({
+      url: registrarUrl,
+      label: `the ${provider} nameserver settings`,
+      promptMessage: `Set the nameservers above at ${provider}.`,
+      waitMessage: 'Checking nameservers',
+      check,
+      intervalMs: 10000,
+      indent: '      ',
+    })
+    : await pollWithSpinner({
+      check,
+      intervalMs: 10000,
+      message: 'Checking nameservers',
+      indent: '      ',
+    });
+
+  if (result.success) {
+    console.log(`      ${chalk.green('✓')} Nameservers configured — zone is active`);
+    return result.result;
+  }
+
+  console.log(`      ${chalk.dim('⊘ Zone still pending — rerun to check again later')}`);
+  return null;
+}
+
+module.exports = async function ensureZone(context) {
+  const { cloudflareApi: api, brandRoot, zoneDomain, isSubdomainProject, options = {} } = context;
+
+  // === READ ===
+  const accounts = await api.makeRequest('/accounts');
+  if (!accounts.result || accounts.result.length === 0) {
+    throw new Error('No Cloudflare account found for this token');
+  }
+  const accountId = accounts.result[0].id;
+
+  const allZones = await api.getAllZones();
+  let zone = allZones.find((z) => z.name === zoneDomain);
+  cacheRead(brandRoot, 'zone', { accountId, zone: zone || null });
+
+  if (zone) {
+    console.log(`      ${chalk.green('✓')} Zone exists: ${chalk.cyan(zoneDomain)} ${chalk.dim(`(${zone.status})`)}`);
+    console.log(`      ${chalk.dim(`Dashboard: https://dash.cloudflare.com/${accountId}/${zoneDomain}`)}`);
+
+    if (zone.status === 'pending' && !isSubdomainProject) {
+      reportPending(zone);
+      const activeZone = await waitForActiveZone(context, zone);
+      if (!activeZone) {
+        return {
+          state: landZoneId(context, zone),
+          output: { zone: { status: 'pending', nameservers: zone.name_servers } },
+        };
+      }
+      zone = activeZone;
+    }
+
+    return {
+      state: landZoneId(context, zone),
+      output: { zone: { status: zone.status } },
+    };
+  }
+
+  // === WRITE: create the zone (the PARENT zone for subdomain projects —
+  // inert until the registrar points at it, so records under the subdomain
+  // can land in the same run) ===
+  if (isSubdomainProject) {
+    console.log(`      ${chalk.yellow('⚠')} Parent zone ${chalk.cyan(zoneDomain)} not in Cloudflare yet — creating it (subdomain project)`);
+  }
+
+  if (options.dryRun) {
+    return dryRunPlan(`add zone ${zoneDomain} to Cloudflare`, { status: 'success', output: { zone: { planned: 'create' } } });
+  }
+
+  console.log(`      Adding zone ${chalk.cyan(zoneDomain)} to Cloudflare...`);
+
+  const response = await api.makeRequest('/zones', {
+    method: 'POST',
+    body: JSON.stringify({
+      account: { id: accountId },
+      name: zoneDomain,
+      type: 'full',
+    }),
+  });
+
+  zone = response.result;
+
+  console.log(`      ${chalk.green('✓')} Zone added ${chalk.dim(`(${zone.id})`)}`);
+
+  if (zone.status === 'pending') {
+    reportPending(zone);
+    const activeZone = await waitForActiveZone(context, zone);
+    if (!activeZone) {
+      return {
+        state: landZoneId(context, zone),
+        output: { zone: { created: true, status: 'pending', nameservers: zone.name_servers } },
+      };
+    }
+    zone = activeZone;
+  }
+
+  return {
+    state: landZoneId(context, zone),
+    output: { zone: { created: true, status: zone.status } },
+  };
+};

package/dist/services/edge/index.js

@@ -0,0 +1,73 @@
+/**
+ * Edge service — reconciles the brand's zone to `edge.providers.cloudflare`
+ * in omega.json5: zone existence, DNS records, email routing, zone settings,
+ * rulesets (cache/redirect/configuration/response-headers/security/managed-
+ * transforms), speed tests, and workers. Ported from omega-manager; every
+ * handler follows read → diff → write because Cloudflare requires fetching
+ * current state before patching.
+ *
+ * Auth: CLOUDFLARE_TOKEN in the brand .env. No token → the service skips.
+ *
+ * Subdomain projects (brand.url is not an apex domain) use the parent zone
+ * and only run zone + dns-records — zone-level settings belong to the parent
+ * brand.
+ *
+ * Each handler caches its read step to .omega/cache/cloudflare/{op}.json.
+ */
+const chalk = require('chalk').default;
+const { serviceInputSpec } = require('../../config.js');
+const { createServiceRunner } = require('../../lib/service-runner.js');
+const { CloudflareAPI } = require('./lib/cloudflare-api.js');
+const { getApexDomain } = require('../../lib/domain-utils.js');
+const { requestServiceInput } = require('../../lib/service-input.js');
+
+// Operations allowed for subdomain projects (zone-level settings are skipped)
+const SUBDOMAIN_OPERATIONS = new Set(['zone', 'dns-records']);
+
+module.exports.run = createServiceRunner({
+  serviceDir: __dirname,
+  setup: async (context) => {
+    const cloudflare = context.brandConfig.edge?.providers?.cloudflare || {};
+
+    if (cloudflare.enabled === false) {
+      return { skip: true, reason: 'edge.providers.cloudflare.enabled = false' };
+    }
+
+    if (!context.cloudflareApi) {
+      const gate = await requestServiceInput(context, serviceInputSpec('edge'));
+      if (gate) return gate;
+    }
+
+    const domain = (context.brandConfig.brand?.url || '').replace(/^https?:\/\//, '');
+    if (!domain) {
+      return { skip: true, reason: 'no brand.url configured' };
+    }
+
+    // Tests inject a fake client via context.cloudflareApi
+    const api = context.cloudflareApi || new CloudflareAPI();
+
+    const apexDomain = getApexDomain(domain);
+    const isSubdomainProject = domain !== apexDomain;
+    const zoneDomain = apexDomain;
+    const zone = await api.getZoneByName(zoneDomain);
+
+    if (isSubdomainProject) {
+      console.log(`    Subdomain project detected: ${chalk.cyan(domain)}`);
+      console.log(`    Using parent zone: ${chalk.cyan(zoneDomain)}`);
+    }
+
+    const filteredOperations = isSubdomainProject
+      ? context.operations.filter((op) => SUBDOMAIN_OPERATIONS.has(op.name))
+      : context.operations;
+
+    return {
+      cloudflareApi: api,
+      domain,           // Full domain (e.g. app.mybrand.com)
+      zoneDomain,       // Apex/zone domain (e.g. mybrand.com)
+      isSubdomainProject,
+      zoneId: zone?.id || null,
+      zone,
+      operations: filteredOperations,
+    };
+  },
+});

package/dist/services/edge/lib/cloudflare-api.js

@@ -0,0 +1,84 @@
+/**
+ * Cloudflare API client — omega-manager's fetch wrapper, ported verbatim.
+ * Token comes from CLOUDFLARE_TOKEN in the brand .env (loaded before services
+ * run) or is passed in directly.
+ */
+
+const CLOUDFLARE_API_BASE = 'https://api.cloudflare.com/client/v4';
+
+class CloudflareAPI {
+  constructor(apiToken = null) {
+    this.apiToken = apiToken || process.env.CLOUDFLARE_TOKEN;
+
+    if (!this.apiToken) {
+      throw new Error('Cloudflare API token not configured. Set CLOUDFLARE_TOKEN in the brand .env');
+    }
+
+    this.headers = {
+      'Authorization': `Bearer ${this.apiToken}`,
+      'Content-Type': 'application/json',
+    };
+  }
+
+  async makeRequest(endpoint, options = {}) {
+    const url = `${CLOUDFLARE_API_BASE}${endpoint}`;
+
+    // FormData bodies (worker uploads) must not carry a JSON Content-Type —
+    // fetch sets the multipart boundary itself
+    const isFormData = options.body instanceof FormData;
+    const headers = isFormData
+      ? { 'Authorization': `Bearer ${this.apiToken}`, ...options.headers }
+      : { ...this.headers, ...options.headers };
+
+    const response = await fetch(url, { ...options, headers });
+    const data = await response.json();
+
+    if (!data.success) {
+      throw new Error(`Cloudflare API Error: ${JSON.stringify(data.errors)}`);
+    }
+
+    return data;
+  }
+
+  /**
+   * Find a zone by its exact name (null if not found)
+   */
+  async getZoneByName(domain) {
+    const data = await this.makeRequest(`/zones?name=${domain}`);
+
+    if (!data.result || data.result.length === 0) {
+      return null;
+    }
+
+    return data.result[0];
+  }
+
+  /**
+   * List every zone on the account (paginated)
+   */
+  async getAllZones() {
+    const zones = [];
+    let page = 1;
+    const perPage = 50;
+
+    while (true) {
+      const data = await this.makeRequest(`/zones?page=${page}&per_page=${perPage}`);
+
+      if (!data.result || data.result.length === 0) {
+        break;
+      }
+
+      zones.push(...data.result);
+
+      if (data.result.length < perPage) {
+        break;
+      }
+
+      page++;
+    }
+
+    return zones;
+  }
+}
+
+module.exports = { CloudflareAPI };