tento-cloudflare

tento-cloudflare is the Cloudflare DNS client and routing config layer used by fleet and DNS management scripts.

Public surface

• CloudflareApi wraps Cloudflare zone, record, and token verification calls.
• models::* contains typed Cloudflare API response and request shapes.
• routing::{TargetsConfig, RoutingConfig, ResolvedTarget} models local DNS target and route config.
• auditor::{DnsRecordAuditor, DnsRecordAnalysis} classifies live DNS records for cleanup or verification.
• scripts::ScriptsConfig wires the client, auditor, and inventory files into tento-sh commands.

Boundaries

Cloudflare credentials are read through tento-env; callers should not pass tokens directly to shell commands. The crate owns Cloudflare-specific API details and TOML routing formats. Higher-level fleet code should ask this crate for diffs or sync operations instead of constructing DNS records itself.

Routing config lives in inventory files. The API client should stay a transport wrapper; decisions about desired targets and subdomain routing belong in routing and script command code.