@stacksjs/ts-cloud 0.8.2 → 0.9.0

package/dist/{chunk-gttvakpv.js → chunk-atbgd8wz.js}

@@ -4,6 +4,9 @@ import {
 import {
   AWSClient
 } from "./chunk-zqtpg06c.js";
+
+// src/dns/types.ts
+var PROXIABLE_RECORD_TYPES = new Set(["A", "AAAA", "CNAME"]);
 // src/dns/porkbun.ts
 var PORKBUN_API_URL = "https://api.porkbun.com/api/json/v3";
 var PORKBUN_MAX_ATTEMPTS = 8;
@@ -544,13 +547,19 @@ class GoDaddyProvider {
 }
 // src/dns/cloudflare.ts
 var CLOUDFLARE_API_URL = "https://api.cloudflare.com/client/v4";
+var CLOUDFLARE_MANAGED_RULE_PREFIX = "[ts-cloud]";
 
 class CloudflareProvider {
   name = "cloudflare";
   apiToken;
   zoneCache = new Map;
-  constructor(apiToken) {
+  configuredZoneId;
+  accountId;
+  configuredZoneName;
+  constructor(apiToken, options = {}) {
     this.apiToken = apiToken;
+    this.configuredZoneId = options.zoneId;
+    this.accountId = options.accountId;
   }
   async request(method, endpoint, body) {
     const url = `${CLOUDFLARE_API_URL}${endpoint}`;
@@ -580,38 +589,70 @@ class CloudflareProvider {
     }
     return domain;
   }
-  async getZoneId(domain) {
-    const rootDomain = this.getRootDomain(domain);
+  async resolveZone(domain) {
+    const hostname = domain.replace(/\.$/, "").toLowerCase();
+    if (this.configuredZoneId) {
+      const name = await this.resolveConfiguredZoneName();
+      if (name && (hostname === name || hostname.endsWith(`.${name}`))) {
+        return { id: this.configuredZoneId, name };
+      }
+    }
+    const rootDomain = this.getRootDomain(hostname);
     const cached = this.zoneCache.get(rootDomain);
     if (cached) {
-      return cached;
+      return { id: cached, name: rootDomain };
     }
     const response = await this.request("GET", `/zones?name=${encodeURIComponent(rootDomain)}`);
     if (!response.result || response.result.length === 0) {
-      throw new Error(`Zone not found for domain: ${rootDomain}`);
+      throw new Error(`Zone not found for domain: ${rootDomain}. ` + `If the API token is scoped to a single zone, set its zone id (CLOUDFLARE_ZONE_ID) — ` + `zone lookup by name needs account-wide Zone:Read.`);
     }
     const zoneId = response.result[0].id;
     this.zoneCache.set(rootDomain, zoneId);
-    return zoneId;
+    return { id: zoneId, name: response.result[0].name || rootDomain };
   }
-  getFullRecordName(name, domain) {
-    const rootDomain = this.getRootDomain(domain);
+  async resolveConfiguredZoneName() {
+    if (!this.configuredZoneId)
+      return;
+    if (this.configuredZoneName)
+      return this.configuredZoneName;
+    try {
+      const response = await this.request("GET", `/zones/${this.configuredZoneId}`);
+      const name = response.result?.name?.toLowerCase();
+      if (!name)
+        return;
+      this.configuredZoneName = name;
+      this.zoneCache.set(name, this.configuredZoneId);
+      return name;
+    } catch {
+      return;
+    }
+  }
+  async getZoneId(domain) {
+    return (await this.resolveZone(domain)).id;
+  }
+  getFullRecordName(name, zoneName) {
     const cleanName = name.replace(/\.$/, "");
-    if (!cleanName || cleanName === rootDomain || cleanName === "@") {
-      return rootDomain;
+    if (!cleanName || cleanName === zoneName || cleanName === "@") {
+      return zoneName;
     }
-    if (cleanName.endsWith(`.${rootDomain}`)) {
+    if (cleanName.endsWith(`.${zoneName}`)) {
       return cleanName;
     }
-    return `${cleanName}.${rootDomain}`;
+    return `${cleanName}.${zoneName}`;
   }
-  toCloudflareRecord(record, domain) {
+  toCloudflareRecord(record, zoneName, proxied) {
     const cfRecord = {
       type: record.type,
-      name: this.getFullRecordName(record.name, domain),
+      name: this.getFullRecordName(record.name, zoneName),
       content: record.content || record.value || "",
       ttl: record.ttl || 1
     };
+    const desiredProxy = proxied ?? record.proxied;
+    if (desiredProxy !== undefined && PROXIABLE_RECORD_TYPES.has(record.type)) {
+      cfRecord.proxied = desiredProxy;
+      if (desiredProxy)
+        cfRecord.ttl = 1;
+    }
     if (record.type === "MX" && record.priority !== undefined) {
       cfRecord.priority = record.priority;
     }
@@ -629,14 +670,15 @@ class CloudflareProvider {
       type: record.type,
       content: record.content,
       ttl: record.ttl,
-      priority: record.priority
+      priority: record.priority,
+      proxied: record.proxied
     };
   }
   async createRecord(domain, record) {
     try {
-      const zoneId = await this.getZoneId(domain);
-      const cfRecord = this.toCloudflareRecord(record, domain);
-      const response = await this.request("POST", `/zones/${zoneId}/dns_records`, cfRecord);
+      const zone = await this.resolveZone(domain);
+      const cfRecord = this.toCloudflareRecord(record, zone.name);
+      const response = await this.request("POST", `/zones/${zone.id}/dns_records`, cfRecord);
       return {
         success: true,
         id: response.result.id,
@@ -651,20 +693,21 @@ class CloudflareProvider {
   }
   async upsertRecord(domain, record) {
     try {
-      const zoneId = await this.getZoneId(domain);
-      const fullName = this.getFullRecordName(record.name, domain);
-      const existingResponse = await this.request("GET", `/zones/${zoneId}/dns_records?type=${record.type}&name=${encodeURIComponent(fullName)}`);
-      const cfRecord = this.toCloudflareRecord(record, domain);
-      if (existingResponse.result && existingResponse.result.length > 0) {
-        const existingId = existingResponse.result[0].id;
-        const response2 = await this.request("PUT", `/zones/${zoneId}/dns_records/${existingId}`, cfRecord);
+      const zone = await this.resolveZone(domain);
+      const fullName = this.getFullRecordName(record.name, zone.name);
+      const existingResponse = await this.request("GET", `/zones/${zone.id}/dns_records?type=${record.type}&name=${encodeURIComponent(fullName)}`);
+      const existing = existingResponse.result?.[0];
+      const proxied = record.proxied ?? existing?.proxied;
+      const cfRecord = this.toCloudflareRecord(record, zone.name, proxied);
+      if (existing) {
+        const response2 = await this.request("PUT", `/zones/${zone.id}/dns_records/${existing.id}`, cfRecord);
         return {
           success: true,
           id: response2.result.id,
           message: "Record updated successfully"
         };
       }
-      const response = await this.request("POST", `/zones/${zoneId}/dns_records`, cfRecord);
+      const response = await this.request("POST", `/zones/${zone.id}/dns_records`, cfRecord);
       return {
         success: true,
         id: response.result.id,
@@ -676,8 +719,9 @@ class CloudflareProvider {
   }
   async deleteRecord(domain, record) {
     try {
-      const zoneId = await this.getZoneId(domain);
-      const fullName = this.getFullRecordName(record.name, domain);
+      const zone = await this.resolveZone(domain);
+      const zoneId = zone.id;
+      const fullName = this.getFullRecordName(record.name, zone.name);
       const existingResponse = await this.request("GET", `/zones/${zoneId}/dns_records?type=${record.type}&name=${encodeURIComponent(fullName)}`);
       if (!existingResponse.result || existingResponse.result.length === 0) {
         return {
@@ -804,8 +848,9 @@ class CloudflareProvider {
   }
   async getRecordProxyStatus(domain, record) {
     try {
-      const zoneId = await this.getZoneId(domain);
-      const fullName = this.getFullRecordName(record.name, domain);
+      const zone = await this.resolveZone(domain);
+      const zoneId = zone.id;
+      const fullName = this.getFullRecordName(record.name, zone.name);
       const response = await this.request("GET", `/zones/${zoneId}/dns_records?type=${record.type}&name=${encodeURIComponent(fullName)}`);
       if (response.result && response.result.length > 0) {
         const matchingRecord = response.result.find((r) => r.content === record.content);
@@ -818,8 +863,9 @@ class CloudflareProvider {
   }
   async setRecordProxyStatus(domain, record, proxied) {
     try {
-      const zoneId = await this.getZoneId(domain);
-      const fullName = this.getFullRecordName(record.name, domain);
+      const zone = await this.resolveZone(domain);
+      const zoneId = zone.id;
+      const fullName = this.getFullRecordName(record.name, zone.name);
       const response = await this.request("GET", `/zones/${zoneId}/dns_records?type=${record.type}&name=${encodeURIComponent(fullName)}`);
       if (!response.result || response.result.length === 0) {
         return false;
@@ -834,6 +880,81 @@ class CloudflareProvider {
       return false;
     }
   }
+  async zoneIdFor(domain) {
+    return this.getZoneId(domain);
+  }
+  get account() {
+    return this.accountId;
+  }
+  async getZoneSettings(domain) {
+    const zoneId = await this.getZoneId(domain);
+    const response = await this.request("GET", `/zones/${zoneId}/settings`);
+    const settings = {};
+    for (const setting of response.result || [])
+      settings[setting.id] = setting.value;
+    return settings;
+  }
+  async applyZoneSettings(domain, desired) {
+    const zoneId = await this.getZoneId(domain);
+    const current = await this.getZoneSettings(domain).catch(() => ({}));
+    const changed = [];
+    const failed = [];
+    for (const [id, value] of Object.entries(desired)) {
+      if (value === undefined)
+        continue;
+      const existing = current[id];
+      if (existing !== undefined && deepEqual(existing, value))
+        continue;
+      try {
+        await this.request("PATCH", `/zones/${zoneId}/settings/${id}`, { value });
+        changed.push({ id, from: existing, to: value });
+      } catch (error) {
+        failed.push({ id, error: error instanceof Error ? error.message : String(error) });
+      }
+    }
+    return { changed, failed };
+  }
+  async getPhaseRules(domain, phase) {
+    const zoneId = await this.getZoneId(domain);
+    try {
+      const response = await this.request("GET", `/zones/${zoneId}/rulesets/phases/${phase}/entrypoint`);
+      return response.result?.rules || [];
+    } catch {
+      return [];
+    }
+  }
+  async putManagedPhaseRules(domain, phase, rules) {
+    try {
+      const zoneId = await this.getZoneId(domain);
+      const existing = await this.getPhaseRules(domain, phase);
+      const foreign = existing.filter((rule) => !(rule.description || "").startsWith(CLOUDFLARE_MANAGED_RULE_PREFIX));
+      const managed = rules.map((rule) => ({
+        ...rule,
+        description: rule.description?.startsWith(CLOUDFLARE_MANAGED_RULE_PREFIX) ? rule.description : `${CLOUDFLARE_MANAGED_RULE_PREFIX} ${rule.description || phase}`
+      }));
+      const payload = [...foreign, ...managed].map(({ id: _id, ...rule }) => rule);
+      await this.request("PUT", `/zones/${zoneId}/rulesets/phases/${phase}/entrypoint`, { rules: payload });
+      return { success: true };
+    } catch (error) {
+      return { success: false, message: error instanceof Error ? error.message : String(error) };
+    }
+  }
+}
+function deepEqual(a, b) {
+  if (a === b)
+    return true;
+  if (typeof a !== typeof b || a === null || b === null)
+    return false;
+  if (typeof a !== "object")
+    return false;
+  if (Array.isArray(a) || Array.isArray(b)) {
+    if (!Array.isArray(a) || !Array.isArray(b) || a.length !== b.length)
+      return false;
+    return a.every((item, index) => deepEqual(item, b[index]));
+  }
+  const aRecord = a;
+  const bRecord = b;
+  return Object.keys(bRecord).every((key) => deepEqual(aRecord[key], bRecord[key]));
 }
 // src/dns/route53-adapter.ts
 class Route53Provider {
@@ -1779,7 +1900,7 @@ function createDnsProvider(config) {
     case "godaddy":
       return new GoDaddyProvider(config.apiKey, config.apiSecret, config.environment);
     case "cloudflare":
-      return new CloudflareProvider(config.apiToken);
+      return new CloudflareProvider(config.apiToken, { zoneId: config.zoneId, accountId: config.accountId });
     default:
       throw new Error(`Unknown DNS provider: ${config.provider}`);
   }
@@ -1826,10 +1947,12 @@ class DnsProviderFactory {
     });
     return this;
   }
-  addCloudflare(apiToken) {
+  addCloudflare(apiToken, options = {}) {
     this.configs.push({
       provider: "cloudflare",
-      apiToken
+      apiToken,
+      zoneId: options.zoneId,
+      accountId: options.accountId
     });
     return this;
   }
@@ -1850,7 +1973,10 @@ class DnsProviderFactory {
     }
     const cloudflareApiToken = process.env.CLOUDFLARE_API_TOKEN;
     if (cloudflareApiToken) {
-      this.addCloudflare(cloudflareApiToken);
+      this.addCloudflare(cloudflareApiToken, {
+        zoneId: process.env.CLOUDFLARE_ZONE_ID,
+        accountId: process.env.CLOUDFLARE_ACCOUNT_ID
+      });
     }
     return this;
   }
@@ -1882,4 +2008,4 @@ class DnsProviderFactory {
 }
 var dnsProviders = new DnsProviderFactory;
 
-export { PorkbunProvider, GoDaddyProvider, CloudflareProvider, Route53Provider, UnifiedDnsValidator, createPorkbunValidator, createGoDaddyValidator, createRoute53Validator, createDnsProvider, detectDnsProvider, DnsProviderFactory, dnsProviders, ACMClient, ACMDnsValidator };
+export { PROXIABLE_RECORD_TYPES, PorkbunProvider, GoDaddyProvider, CLOUDFLARE_MANAGED_RULE_PREFIX, CloudflareProvider, Route53Provider, UnifiedDnsValidator, createPorkbunValidator, createGoDaddyValidator, createRoute53Validator, createDnsProvider, detectDnsProvider, DnsProviderFactory, dnsProviders, ACMClient, ACMDnsValidator };

package/dist/{chunk-x6137d59.js → chunk-hg7rhrgd.js}

@@ -1519,6 +1519,7 @@ function gatewayHostnames(sites, options = {}) {
   }
   return [...hosts];
 }
+var PUBLIC_DNS_RESOLVERS = ["1.1.1.1", "8.8.8.8"];
 var DEFAULT_ACME_WEBROOT = "/var/www/acme-challenge";
 function normalizeSiteRedirect(input) {
   if (typeof input === "string")
@@ -1665,11 +1666,12 @@ function buildRpxConfigInternal(sites, options, appBoxes) {
     config.acmeChallengeWebroot = options.proxy.acmeWebroot ?? DEFAULT_ACME_WEBROOT;
   }
   const cdn = options.proxy.cdn;
-  if (cdn?.secret && cdn.frontedHosts.length > 0) {
+  const guardedHosts = cdn?.frontedHosts?.length ? cdn.frontedHosts : [...domains];
+  if (cdn?.secret && guardedHosts.length > 0) {
     config.originGuard = {
       header: cdn.secretHeader ?? "X-Origin-Verify",
       value: cdn.secret,
-      hosts: cdn.frontedHosts
+      hosts: guardedHosts
     };
   }
   return config;
@@ -1751,8 +1753,18 @@ for (const f of files) {
   if (frag.productionCerts?.certsDir) certsDir = frag.productionCerts.certsDir
   acmeChallengeWebroot ??= frag.acmeChallengeWebroot
   if (frag.originGuard) {
+    // One gateway means one origin-guard secret (rpx takes a single
+    // header/value). A tenant whose secret disagrees with the adopted one must
+    // NOT have its hosts guarded: its CDN would send a different value, the
+    // gateway would reject every request, and a working host would go dark.
+    // Unguarded is weaker but serving, and the mismatch is logged.
     guard ??= { header: frag.originGuard.header, value: frag.originGuard.value }
-    for (const h of frag.originGuard.hosts ?? []) guardHosts.add(h)
+    if (frag.originGuard.header === guard.header && frag.originGuard.value === guard.value) {
+      for (const h of frag.originGuard.hosts ?? []) guardHosts.add(h)
+    }
+    else {
+      console.warn('[rpx-assembler] origin-guard secret in ' + f + ' differs from the one already in force; its hosts stay unguarded rather than rejecting all traffic')
+    }
   }
 }
 const config = {
@@ -1861,13 +1873,24 @@ function buildCertManagementCommands(options) {
     `WEBROOT='${webroot}'`,
     `EMAIL='${email}'`,
     `TLSX="${tlsxCli}"`,
+    `BUN='${bunBin}'`,
     `DOMAINS='${csv}'`,
     "DNS_ATTEMPTS='24'",
     "DNS_DELAY_SECONDS='5'",
+    `DNS_RESOLVERS='${PUBLIC_DNS_RESOLVERS.join(" ")}'`,
+    "dns_resolves() {",
+    '  d="$1"',
+    "  for ns in $DNS_RESOLVERS; do",
+    `    if $BUN --eval "const{Resolver}=require('node:dns');const r=new Resolver();r.setServers([process.argv[1]]);r.resolve4(process.argv[2],e=>process.exit(e?1:0))" "$ns" "$d" >/dev/null 2>&1; then`,
+    "      return 0",
+    "    fi",
+    "  done",
+    '  getent ahosts "$d" >/dev/null 2>&1',
+    "}",
     "wait_for_dns() {",
     '  d="$1"',
     "  attempt=1",
-    '  while ! getent ahosts "$d" >/dev/null 2>&1; do',
+    '  while ! dns_resolves "$d"; do',
     '    if [ "$attempt" -ge "$DNS_ATTEMPTS" ]; then',
     '      echo "DNS for $d did not become resolvable after $DNS_ATTEMPTS attempts" >&2',
     "      return 1",

package/dist/{chunk-wxhrr03r.js → chunk-hygwq9y2.js}

@@ -1,6 +1,6 @@
 import {
   deployStaticSiteWithExternalDnsFull
-} from "./chunk-v0vpamnf.js";
+} from "./chunk-5nr95wpj.js";
 import {
   box,
   error,
@@ -50,7 +50,7 @@ import {
   resolveSiteKind,
   resolveUiSource,
   siteInstallBase
-} from "./chunk-x6137d59.js";
+} from "./chunk-hg7rhrgd.js";
 import {
   SSMClient
 } from "./chunk-7m60qnc8.js";

package/dist/{chunk-kpeb5rcs.js → chunk-ws47smxr.js}

@@ -5,9 +5,9 @@ import {
   generateStaticSiteTemplate,
   invalidateCache,
   uploadStaticFiles
-} from "./chunk-v0vpamnf.js";
+} from "./chunk-5nr95wpj.js";
 import"./chunk-01d86gt1.js";
-import"./chunk-gttvakpv.js";
+import"./chunk-atbgd8wz.js";
 import"./chunk-32e7ya18.js";
 import"./chunk-4cjrg98a.js";
 import"./chunk-rds0sy87.js";

package/dist/deploy/index.js

@@ -36,7 +36,7 @@ import {
   synchronizeDashboardUsers,
   trackDashboardOperation,
   verifyStaticApiOrigin
-} from "../chunk-wxhrr03r.js";
+} from "../chunk-hygwq9y2.js";
 import {
   deleteStaticSite,
   deployStaticSite,
@@ -47,7 +47,7 @@ import {
   generateStaticSiteTemplate,
   invalidateCache,
   uploadStaticFiles
-} from "../chunk-v0vpamnf.js";
+} from "../chunk-5nr95wpj.js";
 import {
   buildAndPushServerlessImage
 } from "../chunk-fgk8cqew.js";
@@ -56,7 +56,7 @@ import"../chunk-nsgqsmrh.js";
 import"../chunk-01d86gt1.js";
 import"../chunk-50jpda9q.js";
 import"../chunk-he9a874b.js";
-import"../chunk-gttvakpv.js";
+import"../chunk-atbgd8wz.js";
 import"../chunk-32e7ya18.js";
 import {
   IPV6_EXCLUDED_HOST_LABELS,
@@ -83,7 +83,7 @@ import {
   siteInstallBase,
   validateDeploymentConfig,
   verifyAddressRecord
-} from "../chunk-x6137d59.js";
+} from "../chunk-hg7rhrgd.js";
 import"../chunk-7m60qnc8.js";
 import"../chunk-4cjrg98a.js";
 import"../chunk-rds0sy87.js";

package/dist/dns/cloudflare.d.ts

@@ -3,11 +3,53 @@
  * API documentation: https://developers.cloudflare.com/api/resources/dns/subresources/records/
  */
 import type { CreateRecordResult, DeleteRecordResult, DnsProvider, DnsRecord, DnsRecordType, ListRecordsResult } from './types';
+/** One entry of `GET /zones/{id}/settings` (and the body of a per-setting PATCH). */
+export interface CloudflareZoneSetting {
+    id: string;
+    value: unknown;
+    editable?: boolean;
+    modified_on?: string | null;
+}
+/**
+ * A rule inside a phase entrypoint ruleset (cache rules, transform rules, …).
+ * Only the fields ts-cloud writes or has to preserve are modelled.
+ */
+export interface CloudflareRule {
+    id?: string;
+    action: string;
+    expression: string;
+    description?: string;
+    enabled?: boolean;
+    action_parameters?: Record<string, unknown>;
+}
+/**
+ * Marker that identifies a rule as ts-cloud's, carried in the rule description.
+ *
+ * Cloudflare's phase entrypoints are replace-only — `PUT .../entrypoint` sets
+ * the WHOLE rule list — so writing our rules naively would delete every rule a
+ * human added in the dashboard. Tagging ours lets a reconcile rewrite only what
+ * it owns and carry everything else through untouched.
+ */
+export declare const CLOUDFLARE_MANAGED_RULE_PREFIX = "[ts-cloud]";
+/** Ruleset phases ts-cloud manages rules in. */
+export type CloudflareRulesetPhase = 'http_request_cache_settings' | 'http_request_late_transform';
+export interface CloudflareProviderOptions {
+    /** Zone id, so the API token can be scoped to a single zone. */
+    zoneId?: string;
+    /** Account id, for account-scoped resources. */
+    accountId?: string;
+}
 export declare class CloudflareProvider implements DnsProvider {
     readonly name = "cloudflare";
     private apiToken;
+    /** Zone name → zone id. */
     private zoneCache;
-    constructor(apiToken: string);
+    /** Zone id configured up front (single-zone token); resolved to a name on first use. */
+    private readonly configuredZoneId?;
+    private readonly accountId?;
+    /** Name of {@link configuredZoneId}, learned once from the API. */
+    private configuredZoneName?;
+    constructor(apiToken: string, options?: CloudflareProviderOptions);
     /**
      * Make an authenticated API request to Cloudflare
      */
@@ -17,6 +59,22 @@ export declare class CloudflareProvider implements DnsProvider {
      * e.g., "api.example.com" -> "example.com"
      */
     private getRootDomain;
+    /**
+     * Resolve the zone a hostname belongs to, as both id and name.
+     *
+     * A configured {@link CloudflareProviderOptions.zoneId} is tried first and is
+     * the only path that works with a single-zone API token: the by-name fallback
+     * calls `GET /zones?name=…`, an ACCOUNT-level listing that a zone-scoped token
+     * cannot read — it returns an empty list, which is indistinguishable from "the
+     * domain isn't here" unless you already know the token is narrow.
+     *
+     * Resolving the configured zone also yields its real name, which is what makes
+     * record naming correct for multi-label suffixes (`example.co.uk`). The
+     * fallback can only guess the apex from the last two labels.
+     */
+    private resolveZone;
+    /** Name of the configured zone, fetched once. Undefined if it can't be read. */
+    private resolveConfiguredZoneName;
     /**
      * Get Zone ID for a domain (with caching)
      */
@@ -24,6 +82,9 @@ export declare class CloudflareProvider implements DnsProvider {
     /**
      * Get the full record name
      * Cloudflare stores records with full domain names
+     *
+     * `zoneName` is the zone's actual name as Cloudflare reports it, not a guess
+     * from the requested domain — see {@link resolveZone}.
      */
     private getFullRecordName;
     /**
@@ -71,4 +132,61 @@ export declare class CloudflareProvider implements DnsProvider {
      * Update proxy status for a record (Cloudflare-specific)
      */
     setRecordProxyStatus(domain: string, record: DnsRecord, proxied: boolean): Promise<boolean>;
+    /**
+     * Public zone id for a hostname — the entry point for the Cloudflare-specific
+     * work (settings, rulesets, purge) that sits outside the DnsProvider contract.
+     */
+    zoneIdFor(domain: string): Promise<string>;
+    /** Account id this provider was configured with, if any. */
+    get account(): string | undefined;
+    /**
+     * Read every zone setting, keyed by setting id.
+     *
+     * Used to make {@link applyZoneSettings} a real reconcile: settings that
+     * already hold the desired value are left alone, so a deploy reports what it
+     * actually changed instead of rewriting the whole zone every time.
+     */
+    getZoneSettings(domain: string): Promise<Record<string, unknown>>;
+    /**
+     * Apply zone settings, skipping any that already match.
+     *
+     * Returns one entry per setting that was actually written, plus the failures.
+     * Failures are collected rather than thrown: zone settings are largely
+     * independent, several are plan-gated (a Free zone rejects `min_tls_version`
+     * above 1.0 on some plans, `http3` needs the feature enabled), and one
+     * unavailable toggle must not abort a deploy that has already shipped code.
+     */
+    applyZoneSettings(domain: string, desired: Record<string, unknown>): Promise<{
+        changed: Array<{
+            id: string;
+            from: unknown;
+            to: unknown;
+        }>;
+        failed: Array<{
+            id: string;
+            error: string;
+        }>;
+    }>;
+    /**
+     * Read the rules currently in a phase entrypoint ruleset.
+     *
+     * A zone that has never had a rule in this phase has no entrypoint at all and
+     * the API answers 404, which is a normal empty state rather than a failure.
+     */
+    getPhaseRules(domain: string, phase: CloudflareRulesetPhase): Promise<CloudflareRule[]>;
+    /**
+     * Replace ts-cloud's rules in a phase while preserving everyone else's.
+     *
+     * Cloudflare only exposes a whole-list PUT for a phase entrypoint, so a naive
+     * write deletes every rule someone added in the dashboard. Rules ts-cloud owns
+     * are tagged in their description with {@link CLOUDFLARE_MANAGED_RULE_PREFIX};
+     * this drops exactly those, appends the new ones, and carries the rest through
+     * in their original order.
+     *
+     * Passing an empty `rules` removes ts-cloud's rules from the phase.
+     */
+    putManagedPhaseRules(domain: string, phase: CloudflareRulesetPhase, rules: CloudflareRule[]): Promise<{
+        success: boolean;
+        message?: string;
+    }>;
 }

package/dist/dns/index.d.ts

@@ -43,7 +43,10 @@ export declare class DnsProviderFactory {
     /**
      * Add Cloudflare provider
      */
-    addCloudflare(apiToken: string): this;
+    addCloudflare(apiToken: string, options?: {
+        zoneId?: string;
+        accountId?: string;
+    }): this;
     /**
      * Load providers from environment variables
      */

package/dist/dns/index.js

@@ -2,6 +2,7 @@ import {
   CloudflareProvider,
   DnsProviderFactory,
   GoDaddyProvider,
+  PROXIABLE_RECORD_TYPES,
   PorkbunProvider,
   Route53Provider,
   UnifiedDnsValidator,
@@ -11,7 +12,7 @@ import {
   createRoute53Validator,
   detectDnsProvider,
   dnsProviders
-} from "../chunk-gttvakpv.js";
+} from "../chunk-atbgd8wz.js";
 import"../chunk-32e7ya18.js";
 import"../chunk-zqtpg06c.js";
 import"../chunk-v0bahtg2.js";
@@ -25,6 +26,7 @@ export {
   UnifiedDnsValidator,
   Route53Provider,
   PorkbunProvider,
+  PROXIABLE_RECORD_TYPES,
   GoDaddyProvider,
   DnsProviderFactory,
   CloudflareProvider