refactor(ENG-13681): move the unused domain-selection API to its caller

This branch shipped an API surface nothing in it calls. Every consumer is in
the Maven helper (#339), which is stacked on top of this branch, so the code
and its tests move there, where the first caller lives and where a reviewer
can see what they are for.

Moved: select_custom_domain and CustomDomain.serves_repository; the
single-host resolvers default_host, default_host_for_type, builtin_host and
builtin_host_for_type with their two private helpers; and domain_scope.
With them go the twelve select_custom_domain tests, the six host-resolver
tests and the persisted-scope test.

Staying: _precedence_key and the CustomDomain.scope / is_bound_to pair it
reads, because get_format_domains sorts by it and the Docker installer and
runtime helper both call that. The DomainScope enum stays with them; only
its string parser moves.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

Author: cloudsmith-iduffy

cloudsmith_cli/cli/tests/commands/test_credential_helper.py

@@ -26,7 +26,7 @@
     read_cache,
     write_cache,
 )
-from ....credential_helpers.default_domains import DomainScope, domain_scope
+from ....credential_helpers.default_domains import DomainScope
 from ....credential_helpers.docker.runtime import (
     _REFUSAL_MESSAGE,
     execute,
@@ -839,21 +839,6 @@ def test_custom_domain_scope(repository, expected):
     assert domain.scope is expected
 
 
-@pytest.mark.parametrize(
-    "value,expected",
-    [
-        ("repository", DomainScope.REPOSITORY),
-        ("organization", DomainScope.ORGANIZATION),
-        ("nonsense", DomainScope.ORGANIZATION),
-        (None, DomainScope.ORGANIZATION),
-        ("", DomainScope.ORGANIZATION),
-    ],
-)
-def test_domain_scope_resolves_persisted_values(value, expected):
-    """A persisted scope string resolves, degrading to organisation."""
-    assert domain_scope(value) is expected
-
-
 @httpretty.activate(allow_net_connect=False)
 def test_get_custom_domains_parses_repository_scope(tmp_path, monkeypatch):
     """The nested repository payload binds the record to its repository."""

cloudsmith_cli/cli/tests/commands/test_custom_domain_precedence.py

@@ -1,24 +1,18 @@
 # Copyright 2026 Cloudsmith Ltd
-"""Tests for choosing between overlapping custom domains.
+"""Tests for the record fields custom-domain precedence ranks on.
 
-Repository-scoped beats organisation-wide, primary beats non-primary, and an
-older domain beats a newer one.
-
-Also covers the record fields the chain reads, which have to survive the
-on-disk cache: a run served from the cache must rank domains identically to
-the run that populated it.
+They have to survive the on-disk cache: a run served from the cache must rank
+domains identically to the run that populated it.
 """
 
 from datetime import datetime, timezone
 
 import pytest
 
-from ....credential_helpers.backends import BackendKind
 from ....credential_helpers.custom_domains import (
     CustomDomain,
     _record_from_payload,
     read_cache,
-    select_custom_domain,
     write_cache,
 )
 from ....credential_helpers.default_domains import DomainType
@@ -50,156 +44,6 @@ def _domain(
     )
 
 
-def _repo_domain(host, repository="prod", **kwargs):
-    """Build a record bound to a single repository."""
-    return _domain(host, repository=repository, **kwargs)
-
-
-def test_repository_scoped_beats_organisation_wide():
-    """A domain bound to the repository in hand is the most specific match."""
-    org_wide = _domain("dl.acme.com")
-    repo_bound = _repo_domain("dl-prod.acme.com")
-
-    chosen = select_custom_domain(
-        [org_wide, repo_bound], domain_type=DomainType.DOWNLOAD, repository="prod"
-    )
-
-    assert chosen is repo_bound
-
-
-def test_repository_scoping_outranks_primary():
-    """Scope is a stronger signal than the primary flag."""
-    org_wide_primary = _domain("dl.acme.com", primary=True)
-    repo_bound_secondary = _repo_domain("dl-prod.acme.com", primary=False)
-
-    chosen = select_custom_domain(
-        [org_wide_primary, repo_bound_secondary],
-        domain_type=DomainType.DOWNLOAD,
-        repository="prod",
-    )
-
-    assert chosen is repo_bound_secondary
-
-
-def test_primary_beats_secondary_at_the_same_scope():
-    """Within one scope the primary domain wins, whatever its age."""
-    secondary = _domain(
-        "old.acme.com", primary=False, created_at="2024-01-01T00:00:00Z"
-    )
-    primary = _domain("new.acme.com", primary=True, created_at="2026-01-01T00:00:00Z")
-
-    chosen = select_custom_domain([secondary, primary], domain_type=DomainType.DOWNLOAD)
-
-    assert chosen is primary
-
-
-def test_oldest_wins_when_scope_and_primary_tie():
-    """Age is the final tie-break, oldest first."""
-    newer = _domain("new.acme.com", created_at="2026-06-01T00:00:00Z")
-    older = _domain("old.acme.com", created_at="2024-02-01T00:00:00Z")
-
-    chosen = select_custom_domain([newer, older], domain_type=DomainType.DOWNLOAD)
-
-    assert chosen is older
-
-
-def test_undated_domain_sorts_after_a_dated_one():
-    """A record with no timestamp must not out-rank a known-older one."""
-    undated = _domain("undated.acme.com", created_at=None)
-    dated = _domain("dated.acme.com", created_at="2025-05-01T00:00:00Z")
-
-    chosen = select_custom_domain([undated, dated], domain_type=DomainType.DOWNLOAD)
-
-    assert chosen is dated
-
-
-@pytest.mark.parametrize("enabled,validated", [(False, True), (True, False)])
-def test_inactive_domains_are_never_chosen(enabled, validated):
-    """A disabled or unvalidated domain cannot serve traffic."""
-    inactive = _domain("broken.acme.com", enabled=enabled, validated=validated)
-
-    assert select_custom_domain([inactive], domain_type=DomainType.DOWNLOAD) is None
-
-
-def test_a_domain_bound_to_another_repository_is_never_used():
-    """A repository-scoped host serves only the repository it belongs to."""
-    other = _repo_domain("dl-staging.acme.com", repository="staging")
-
-    assert (
-        select_custom_domain(
-            [other], domain_type=DomainType.DOWNLOAD, repository="prod"
-        )
-        is None
-    )
-
-
-def test_a_repository_scoped_domain_is_skipped_without_a_repository():
-    """With no repository in hand, only organisation-wide domains apply."""
-    repo_bound = _repo_domain("dl-prod.acme.com")
-
-    assert select_custom_domain([repo_bound], domain_type=DomainType.DOWNLOAD) is None
-
-
-def test_domain_types_do_not_cross_over():
-    """An upload host must never be offered as the download host."""
-    upload = _domain("up.acme.com", domain_type=DomainType.UPLOAD)
-    download = _domain("dl.acme.com", domain_type=DomainType.DOWNLOAD)
-
-    assert (
-        select_custom_domain([upload, download], domain_type=DomainType.UPLOAD)
-        is upload
-    )
-    assert (
-        select_custom_domain([upload, download], domain_type=DomainType.DOWNLOAD)
-        is download
-    )
-
-
-def test_native_api_domains_are_matched_on_backend_kind():
-    """Native API hosts speak one format each, so the kind has to match."""
-    maven = _domain(
-        "mvn.acme.com",
-        domain_type=DomainType.NATIVE_API,
-        backend_kind=BackendKind.MAVEN,
-    )
-    python = _domain(
-        "pypi.acme.com",
-        domain_type=DomainType.NATIVE_API,
-        backend_kind=BackendKind.PYTHON,
-    )
-
-    chosen = select_custom_domain(
-        [maven, python],
-        domain_type=DomainType.NATIVE_API,
-        backend_kind=BackendKind.MAVEN,
-    )
-
-    assert chosen is maven
-
-
-def test_selection_is_independent_of_input_order():
-    """Two otherwise-equal domains must resolve the same way every run.
-
-    The listing API guarantees no ordering, and `read_all_cached_domains`
-    merges several organisations' cache files, so arrival order is not stable
-    even between two runs on one machine. Without a final tie-break, two
-    installs of the same repository could bind different hosts.
-    """
-    first = _domain("zzz.acme.com", created_at=None)
-    second = _domain("aaa.acme.com", created_at=None)
-
-    forwards = select_custom_domain([first, second], domain_type=DomainType.DOWNLOAD)
-    backwards = select_custom_domain([second, first], domain_type=DomainType.DOWNLOAD)
-
-    assert forwards is backwards
-    assert forwards.host == "aaa.acme.com"
-
-
-def test_no_candidates_returns_none():
-    """An empty listing resolves to nothing, not an error."""
-    assert select_custom_domain([], domain_type=DomainType.DOWNLOAD) is None
-
-
 def test_precedence_fields_round_trip_the_cache(tmp_path):
     """A cached run must rank domains the same way the fetching run did.
 

cloudsmith_cli/cli/tests/commands/test_default_domains.py

@@ -11,10 +11,6 @@
     BUILTIN_DOMAINS,
     DefaultDomain,
     DomainType,
-    builtin_host,
-    builtin_host_for_type,
-    default_host,
-    default_host_for_type,
     domain_type_for_backend_kind,
     format_for_backend_kind,
     load_default_domains,
@@ -215,60 +211,6 @@ def test_trusted_lookup_skips_a_config_without_a_domains_section(tmp_path, monke
     ]
 
 
-def test_default_hosts_honour_a_config_override(tmp_path, monkeypatch):
-    """default_host/_for_type resolve against the override, not the builtins."""
-    (tmp_path / "config.ini").write_text(
-        "[domains]\ncdn.internal.example.com =\nmvn.internal.example.com = maven\n",
-        encoding="utf-8",
-    )
-    monkeypatch.setattr(cli_config.ConfigReader, "config_files", ["config.ini"])
-    monkeypatch.setattr(cli_config.ConfigReader, "config_searchpath", [str(tmp_path)])
-
-    assert default_host_for_type(DomainType.DOWNLOAD) == "cdn.internal.example.com"
-    assert default_host(BackendKind.MAVEN) == "mvn.internal.example.com"
-
-
-def test_default_host_rejects_a_kind_the_declared_table_omits(tmp_path, monkeypatch):
-    """A declared table is authoritative - it never falls back to a built-in.
-
-    The section decides which hosts may receive a Cloudsmith credential, so
-    resolving to a public *.cloudsmith.io host the operator never listed would
-    contradict the very statement the table makes. An on-premise deployment
-    would also be handed a host it cannot reach.
-    """
-    (tmp_path / "config.ini").write_text(
-        "[domains]\ncdn.internal.example.com =\n", encoding="utf-8"
-    )
-    monkeypatch.setattr(cli_config.ConfigReader, "config_files", ["config.ini"])
-    monkeypatch.setattr(cli_config.ConfigReader, "config_searchpath", [str(tmp_path)])
-
-    with pytest.raises(ValueError, match="maven"):
-        default_host(BackendKind.MAVEN)
-
-
-def test_default_host_for_type_rejects_a_type_the_declared_table_omits(
-    tmp_path, monkeypatch
-):
-    """The format-less endpoints get the same treatment as a package format."""
-    (tmp_path / "config.ini").write_text(
-        "[domains]\ncdn.internal.example.com =\n", encoding="utf-8"
-    )
-    monkeypatch.setattr(cli_config.ConfigReader, "config_files", ["config.ini"])
-    monkeypatch.setattr(cli_config.ConfigReader, "config_searchpath", [str(tmp_path)])
-
-    with pytest.raises(ValueError, match="upload"):
-        default_host_for_type(DomainType.UPLOAD)
-
-
-def test_default_hosts_use_builtins_when_no_table_is_declared(tmp_path, monkeypatch):
-    """Declaring no table at all still resolves to the built-in hosts."""
-    monkeypatch.setattr(cli_config.ConfigReader, "config_files", ["config.ini"])
-    monkeypatch.setattr(cli_config.ConfigReader, "config_searchpath", [str(tmp_path)])
-
-    assert default_host(BackendKind.MAVEN) == "maven.cloudsmith.io"
-    assert default_host_for_type(DomainType.UPLOAD) == "upload.cloudsmith.io"
-
-
 @pytest.mark.parametrize(
     "label,domain_type",
     [
@@ -299,14 +241,15 @@ def test_config_reserved_labels_declare_formatless_hosts(tmp_path, label, domain
 
 
 def test_declared_upload_host_resolves(tmp_path, monkeypatch):
-    """A declared upload endpoint is what default_host_for_type returns."""
+    """A declared upload endpoint lands in the table as the upload host."""
     (tmp_path / "config.ini").write_text(
         "[domains]\nuploads.internal.example.com = upload\n", encoding="utf-8"
     )
     monkeypatch.setattr(cli_config.ConfigReader, "config_files", ["config.ini"])
     monkeypatch.setattr(cli_config.ConfigReader, "config_searchpath", [str(tmp_path)])
 
-    assert default_host_for_type(DomainType.UPLOAD) == "uploads.internal.example.com"
+    domain = _by_host(load_default_domains())["uploads.internal.example.com"]
+    assert domain.domain_type is DomainType.UPLOAD
 
 
 def test_unrecognised_config_label_is_warned_about(tmp_path, caplog):
@@ -396,8 +339,9 @@ def test_explicit_config_file_is_honoured_as_trusted(tmp_path, monkeypatch):
     )
     monkeypatch.setattr(cli_config.ConfigReader, "config_searchpath", ["."])
 
-    assert default_host_for_type(DomainType.DOWNLOAD) == "cdn.internal.example.com"
-    assert default_host(BackendKind.MAVEN) == "mvn.internal.example.com"
+    indexed = _by_host(load_default_domains())
+    assert indexed["cdn.internal.example.com"].domain_type is DomainType.DOWNLOAD
+    assert indexed["mvn.internal.example.com"].backend_kind == BackendKind.MAVEN
     assert untrusted_config_declares_domains() is False
 
 
@@ -459,17 +403,6 @@ def test_builtin_domains_with_a_backend_kind_are_native_api():
             assert domain.domain_type is DomainType.NATIVE_API, domain.host
 
 
-def test_builtin_host_for_type_resolves_the_format_less_hosts():
-    """The download and upload hosts are looked up by type, not by constant.
-
-    NATIVE_API covers many hosts, so there is no single one to return.
-    """
-    assert builtin_host_for_type(DomainType.DOWNLOAD) == "dl.cloudsmith.io"
-    assert builtin_host_for_type(DomainType.UPLOAD) == "upload.cloudsmith.io"
-    with pytest.raises(ValueError):
-        builtin_host_for_type(DomainType.NATIVE_API)
-
-
 @pytest.mark.parametrize(
     "backend_kind,expected",
     [
@@ -484,14 +417,6 @@ def test_domain_type_for_backend_kind(backend_kind, expected):
     assert domain_type_for_backend_kind(backend_kind) is expected
 
 
-def test_builtin_host_resolves_a_backend_kind_to_its_own_host():
-    """Formats served only via the CDN have no dedicated built-in host."""
-    assert builtin_host(BackendKind.MAVEN) == "maven.cloudsmith.io"
-    assert builtin_host(BackendKind.PYTHON) == "python.cloudsmith.io"
-    with pytest.raises(ValueError):
-        builtin_host(BackendKind.DEB)
-
-
 def test_default_domain_is_frozen():
     """Records are immutable so callers cannot mutate the shared table."""
     domain = DefaultDomain(host="a.cloudsmith.io", backend_kind=BackendKind.PYTHON)