sc-cf

# /sc-cf — Cloudflare > **Status:** **DNS is implemented** (`lib/cloudflare.js` + `scripts/dns.js`). Workers, Pages, R2 and Zero Trust tunnel are **not implemented** — see [Not implemented yet](#not-implemented-yet). ```mermaid flowchart TD A["/sc-cf set --domain be.example.com"] --> B["resolve zone<br/>longest suffix wins<br/>(or CLOUDFLARE_ZONE_ID pin)"] B --> C["GET /zones/:id/dns_records<br/>?type=A&name.exact=be.example.com"] C --> D{"exact name+type<br/>matches?"} D -->|"0"| E["POST /dns_records<br/>proxied:false"] D -->|"1, content+proxied ok"| F["no-op ✅<br/>{ alreadyExists: true }"] D -->|"1, wrong"| G["PATCH /dns_records/:recordId<br/>that ONE id"] D -->|">1"| H["refuse ⚠️<br/>{ skipped:true, reason:'ambiguous' }"] E --> I["settle 5s, then ✅<br/>{ skipped:false, created:true }"] G --> I ``` ## When to use - **The domain's nameservers point at Cloudflare.** That is the whole deciding factor — see [Hostinger vs Cloudflare](#hostinger-vs-cloudflare-which-provider-owns-the-zone). - You need a subdomain A record so Traefik/Dokploy can obtain a Let's Encrypt certificate (the driving case). - `/sc-all` needs a DNS provider and `CLOUDFLARE_API_TOKEN` is set — `configureDns` here is signature-compatible with `lib/hostinger.js`. ## Scope (implemented) `lib/cloudflare.js` is the client; `skills/sc-cf/scripts/dns.js` is the CLI over it. - **Zone resolution** — longest-matching-suffix probe (`GET /zones?name=<candidate>`, longest-first)...