From 63bbc6098aabe41c48e0b439c5d948ffccddc4be Mon Sep 17 00:00:00 2001
From: huangyinghui <18666119673@163.com>
Date: Tue, 8 Sep 2026 22:45:59 +0800
Subject: [PATCH] =?UTF-8?q?fix(deploy):=20=E4=B8=80=E7=BA=A7=E5=AD=90?=
 =?UTF-8?q?=E5=9F=9F=E8=B7=B3=E8=BF=87=20Total=20TLS=E2=80=94=E2=80=94Univ?=
 =?UTF-8?q?ersal=20SSL=20=E9=80=9A=E9=85=8D=E8=A6=86=E7=9B=96=EF=BC=8C?=
 =?UTF-8?q?=E5=85=8D=E8=B4=B9=E8=AE=A1=E5=88=92=E6=97=A0=20ACM=20=E6=8A=A5?=
 =?UTF-8?q?=201450?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

needsTotalTls(domain, zoneName) 纯函数 + 三用例：一级子域/apex 不
需要、多级需要。用户拍板实例域名回 unself.handywote.top（免费证书
覆盖），部署日志不再每次报 1450。

Signed-off-by: huangyinghui <18666119673@163.com>
---
 deploy/cloudflare/src/steps.ts       | 13 ++++++++++++-
 deploy/cloudflare/test/steps.test.ts | 14 +++++++++++++-
 2 files changed, 25 insertions(+), 2 deletions(-)

diff --git a/deploy/cloudflare/src/steps.ts b/deploy/cloudflare/src/steps.ts
index d54f8e8..615861d 100644
--- a/deploy/cloudflare/src/steps.ts
+++ b/deploy/cloudflare/src/steps.ts
@@ -69,6 +69,11 @@ export async function discoverModules(rootDir: string, selectedIds: string[]): P
   return refs;
 }
 
+/** 多级子域判定：Universal SSL 只覆盖 apex + 一级通配（*.zone），更深的需要 Total TLS。 */
+export function needsTotalTls(domain: string, zoneName: string): boolean {
+  return domain.split('.').length > zoneName.split('.').length + 1;
+}
+
 /** 九步主流程。返回部署摘要（供测试断言与部署输出）。 */
 export async function runNineSteps(input: {
   rootDir: string;
@@ -181,8 +186,14 @@ export async function runNineSteps(input: {
       await removeLegacyCustomDomains({ accountId, domain: config.domain, apiToken: token, log: rep.log });
     });
     await cleanup();
-    // 多级子域不在 Universal SSL 覆盖内：提前触发 Total TLS 签发（幂等）
+    // 多级子域不在 Universal SSL 覆盖内：提前触发 Total TLS 签发（幂等）。
+    // 一级子域（*.zone）由 Universal SSL 通配证书覆盖，无需 Total TLS（且免费计划无 ACM 会报 1450）
+    const needsTls = needsTotalTls(config.domain, zone.name);
     const totalTls = input.ensureTotalTls ?? (async () => {
+      if (!needsTls) {
+        rep.log(`跳过 Total TLS：${config.domain} 为一级子域（Universal SSL 覆盖）`);
+        return;
+      }
       await ensureTotalTls({
         zoneId: zone.id,
         apiToken: process.env.CLOUDFLARE_API_TOKEN ?? '',
diff --git a/deploy/cloudflare/test/steps.test.ts b/deploy/cloudflare/test/steps.test.ts
index da833d8..b4a04ea 100644
--- a/deploy/cloudflare/test/steps.test.ts
+++ b/deploy/cloudflare/test/steps.test.ts
@@ -1,6 +1,6 @@
 // SPDX-License-Identifier: AGPL-3.0-only
 import { describe, expect, it } from 'vitest';
-import { runNineSteps } from '../src/steps';
+import { needsTotalTls, runNineSteps } from '../src/steps';
 import type { Wrangler } from '../src/wrangler';
 
 /**
@@ -100,6 +100,18 @@ const SMOKE_OK = {
     ),
 };
 
+describe('needsTotalTls（Universal SSL 覆盖边界）', () => {
+  it('一级子域：覆盖，不需要', () => {
+    expect(needsTotalTls('unself.handywote.top', 'handywote.top')).toBe(false);
+  });
+  it('多级子域：不覆盖，需要', () => {
+    expect(needsTotalTls('unself.demo.handywote.top', 'handywote.top')).toBe(true);
+  });
+  it('apex 自身：覆盖，不需要', () => {
+    expect(needsTotalTls('handywote.top', 'handywote.top')).toBe(false);
+  });
+});
+
 describe('runNineSteps（九步编排 · 幂等收敛）', () => {
   it('空账号首跑：命令序列覆盖九步；二跑零 create/put（收敛）', { timeout: 120_000 }, async () => {
     const first = makeFakeWrangler();