@spec api_clients(keyword()) :: %{optional(String.t()) => map()}

Returns API client credentials currently loaded in memory.

By default tokens are redacted. Use api_clients(redact: false) only for trusted, local debugging contexts.

@spec checkup() :: list()

Runs a checkup through the monitor process if it is running. Falls back to a one-shot checkup when monitor is disabled.

@spec checkup_once() :: list()

Runs a one-shot checkup without requiring the monitor process.

@spec clear_api_clients() :: :ok | {:error, term()}

Clears API client credentials from in-memory auth store.

See Defdo.Cloudflare.DDNS.get_all_cloudflare_config_domains/0.

See Defdo.Cloudflare.DDNS.get_current_ipv4/0.

See Defdo.Cloudflare.DDNS.get_current_ipv6/0.

@spec monitor_enabled?() :: boolean()

Returns whether monitor startup is enabled in app config.

@spec monitor_running?() :: boolean()

Returns whether the monitor process is currently running.

See Defdo.Cloudflare.DDNS.records_to_monitor/1.

@spec set_api_clients(list()) :: :ok | {:error, term()}

Replaces API client credentials in memory for multi-tenant-light auth mode.

Expected format: [ %{

"id" => "client-id",
"token" => "secret-token",
"allowed_base_domains" => ["example.com"]

} ]

@spec start_monitor(keyword()) :: GenServer.on_start()

Starts the monitor process manually.

@spec stop_monitor(timeout()) :: :ok

Stops the monitor process if it is currently running.

@spec upsert_free_domain(map()) :: {:ok, map()} | {:error, term()}

Upserts a managed CNAME record using the internal DNS API logic.