@pithy-sh/cloudflare 0.1.1 → 0.1.3

package/dist/zones/zonesManager.d.ts

@@ -0,0 +1,50 @@
+import { z } from "zod";
+import { CloudflareManager } from "../client/manager";
+/**
+ * The account's zones — the registrable domains a custom domain can attach to.
+ *
+ * **Nothing here listed zones before.** Every zone-scoped operation in this package takes a `zoneId` the
+ * caller already knows: `CloudflareCustomHostnamesManager` takes it as constructor config,
+ * `CloudflareEmailRoutingManager` takes it per method, `CloudflareWorkersManager.addRoute` takes it
+ * positionally — and `pithy email provision` makes a human paste one, telling them to "find it on the
+ * zone's Overview page". So the CLI never *discovered* a zone; it demanded one.
+ *
+ * That is what this exists to change. When `pithy init` and `pithy worker add` ask where a Worker will
+ * answer, offering the account's real zones means a typo fails at `init` with a list of what exists,
+ * rather than at `deploy` with a Cloudflare error to decode.
+ *
+ * Read-only, deliberately. Pithy attaches routes to zones and never creates, transfers, or deletes one —
+ * a zone is the adopter's relationship with their registrar, not a resource this toolset provisions. The
+ * scoped token needs only `Zone:Read`.
+ */
+/** One zone on the account. */
+export declare const ZoneInfo: z.ZodObject<{
+    id: z.ZodString;
+    name: z.ZodString;
+    status: z.ZodString;
+}, z.core.$strip>;
+export type ZoneInfo = z.output<typeof ZoneInfo>;
+/** Read the account's zones. Never creates or deletes — a zone is the adopter's, not ours to provision. */
+export declare class CloudflareZonesManager extends CloudflareManager {
+    getServiceType(): string;
+    /** Prove access by listing. A read, and never throws — the caller decides what an inaccessible account means. */
+    validateServiceAccess(): Promise<boolean>;
+    /**
+     * Every zone on this account, name-sorted so a picker is stable between runs.
+     *
+     * Filtered to the account, because a user-bound token can see zones on accounts this project has
+     * nothing to do with — offering those would invite someone to attach a Worker to a zone that another
+     * account owns, which fails at deploy with an error that names neither problem.
+     */
+    listZones(): Promise<ZoneInfo[]>;
+    /**
+     * The zone a hostname belongs to, or `null`.
+     *
+     * Matches the **longest** zone name that the hostname sits under, which is the only correct rule when
+     * an account holds both `example.com` and `eu.example.com`: `api.eu.example.com` belongs to the latter,
+     * and picking the first match would attach it to the wrong zone. A public-suffix guess is not used at
+     * all — a zone can itself be a subdomain, and the account's own list is the authority.
+     */
+    findZoneForHostname(hostname: string): Promise<ZoneInfo | null>;
+}
+//# sourceMappingURL=zonesManager.d.ts.map

package/dist/zones/zonesManager.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"zonesManager.d.ts","sourceRoot":"","sources":["../../src/zones/zonesManager.ts"],"names":[],"mappings":"AAGA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,OAAO,EAAE,iBAAiB,EAAE,MAAM,mBAAmB,CAAC;AAEtD;;;;;;;;;;;;;;;;GAgBG;AAEH,+BAA+B;AAC/B,eAAO,MAAM,QAAQ;;;;iBAc4F,CAAC;AAClH,MAAM,MAAM,QAAQ,GAAG,CAAC,CAAC,MAAM,CAAC,OAAO,QAAQ,CAAC,CAAC;AAEjD,2GAA2G;AAC3G,qBAAa,sBAAuB,SAAQ,iBAAiB;IAC3D,cAAc,IAAI,MAAM,CAEvB;IAED,iHAAiH;IAC3G,qBAAqB,IAAI,OAAO,CAAC,OAAO,CAAC,CAO9C;IAED;;;;;;OAMG;IACG,SAAS,IAAI,OAAO,CAAC,QAAQ,EAAE,CAAC,CASrC;IAED;;;;;;;OAOG;IACG,mBAAmB,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,QAAQ,GAAG,IAAI,CAAC,CAKpE;CACF"}

package/dist/zones/zonesManager.js

@@ -0,0 +1,74 @@
+import { cloudflareRequest } from "../client/errors.js";
+import { CloudflareManager } from "../client/manager.js";
+import { z } from "zod";
+//#region src/zones/zonesManager.ts
+/**
+* The account's zones — the registrable domains a custom domain can attach to.
+*
+* **Nothing here listed zones before.** Every zone-scoped operation in this package takes a `zoneId` the
+* caller already knows: `CloudflareCustomHostnamesManager` takes it as constructor config,
+* `CloudflareEmailRoutingManager` takes it per method, `CloudflareWorkersManager.addRoute` takes it
+* positionally — and `pithy email provision` makes a human paste one, telling them to "find it on the
+* zone's Overview page". So the CLI never *discovered* a zone; it demanded one.
+*
+* That is what this exists to change. When `pithy init` and `pithy worker add` ask where a Worker will
+* answer, offering the account's real zones means a typo fails at `init` with a list of what exists,
+* rather than at `deploy` with a Cloudflare error to decode.
+*
+* Read-only, deliberately. Pithy attaches routes to zones and never creates, transfers, or deletes one —
+* a zone is the adopter's relationship with their registrar, not a resource this toolset provisions. The
+* scoped token needs only `Zone:Read`.
+*/
+/** One zone on the account. */
+const ZoneInfo = z.object({
+	id: z.string().describe("The CF-assigned zone id, which every zone-scoped API call is addressed by."),
+	name: z.string().describe("The registrable domain, e.g. `example.com`. This is the value a Worker's `domains` declaration names as its `zone`, and what wrangler writes as `zone_name`."),
+	status: z.string().describe("The zone's lifecycle status — `active` once Cloudflare is serving it, otherwise `pending`, `initializing`, or `moved`. A non-active zone cannot carry a custom domain yet, so a picker shows it and says so rather than hiding it.")
+}).describe("One Cloudflare zone: the registrable domain a custom domain can attach to, and whether it is live.");
+/** Read the account's zones. Never creates or deletes — a zone is the adopter's, not ours to provision. */
+var CloudflareZonesManager = class extends CloudflareManager {
+	getServiceType() {
+		return "Cloudflare Zones";
+	}
+	/** Prove access by listing. A read, and never throws — the caller decides what an inaccessible account means. */
+	async validateServiceAccess() {
+		try {
+			await this.listZones();
+			return true;
+		} catch {
+			return false;
+		}
+	}
+	/**
+	* Every zone on this account, name-sorted so a picker is stable between runs.
+	*
+	* Filtered to the account, because a user-bound token can see zones on accounts this project has
+	* nothing to do with — offering those would invite someone to attach a Worker to a zone that another
+	* account owns, which fails at deploy with an error that names neither problem.
+	*/
+	async listZones() {
+		return cloudflareRequest("list zones", async () => {
+			const zones = [];
+			for await (const zone of this.getClient().zones.list({ account: { id: this.accountId } })) {
+				const parsed = ZoneInfo.safeParse(zone);
+				if (parsed.success) zones.push(parsed.data);
+			}
+			return zones.sort((a, b) => a.name.localeCompare(b.name));
+		});
+	}
+	/**
+	* The zone a hostname belongs to, or `null`.
+	*
+	* Matches the **longest** zone name that the hostname sits under, which is the only correct rule when
+	* an account holds both `example.com` and `eu.example.com`: `api.eu.example.com` belongs to the latter,
+	* and picking the first match would attach it to the wrong zone. A public-suffix guess is not used at
+	* all — a zone can itself be a subdomain, and the account's own list is the authority.
+	*/
+	async findZoneForHostname(hostname) {
+		const candidates = (await this.listZones()).filter((zone) => hostname === zone.name || hostname.endsWith(`.${zone.name}`));
+		if (candidates.length === 0) return null;
+		return candidates.reduce((longest, zone) => zone.name.length > longest.name.length ? zone : longest);
+	}
+};
+//#endregion
+export { CloudflareZonesManager, ZoneInfo };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@pithy-sh/cloudflare",
-  "version": "0.1.1",
+  "version": "0.1.3",
   "license": "MIT",
   "repository": {
     "type": "git",
@@ -8,18 +8,23 @@
     "directory": "packages/cloudflare"
   },
   "files": [
+    "dist",
     "src",
-    "!src/**/*.test.*"
+    "!src/**/*.test.*",
+    "!dist/**/*.test.*"
   ],
   "type": "module",
   "engines": {
     "node": ">=22"
   },
   "exports": {
-    "./src/*": "./src/*.ts"
+    "./src/*": {
+      "types": "./dist/*.d.ts",
+      "default": "./dist/*.js"
+    }
   },
   "scripts": {
-    "build": "tsc -p tsconfig.json --noEmit false --outDir dist",
+    "build": "tsdown && tsc -p tsconfig.build.json",
     "typecheck": "tsc -p tsconfig.json",
     "test": "vitest run",
     "test:node": "vitest run --project=node",
@@ -31,18 +36,22 @@
     "@aws-sdk/client-s3": "^3.1111.0",
     "@aws-sdk/s3-request-presigner": "^3.1111.0",
     "@cloudflare/workers-types": "^5.20260729.1",
-    "@pithy-sh/core": "workspace:*",
+    "@pithy-sh/core": "^0.1.3",
     "cloudflare": "^7.0.0",
-    "js-base64": "^3.9.2",
-    "kysely": "^0.29.0",
-    "zod": "^4.0.0"
+    "js-base64": "^3.9.2"
   },
   "devDependencies": {
     "@pithy-sh/tsconfig": "workspace:*",
     "@types/node": "^22.15.0",
     "@vitest/coverage-v8": "^4.1.0",
+    "kysely": "^0.29.0",
     "kysely-d1": "^0.4.0",
+    "tsdown": "^0.23.0",
     "typescript": "^7.0.2",
-    "vitest": "^4.1.0"
+    "vitest": "^4.1.0",
+    "zod": "^4.4.0"
+  },
+  "peerDependencies": {
+    "zod": "^4.4.0"
   }
 }