@agenticmail/enterprise 0.5.327 → 0.5.329

package/src/setup/deployment.ts

@@ -1,561 +0,0 @@
-/**
- * Setup Wizard — Step 3: Deployment Target
- *
- * Choose where the enterprise server will run.
- * Includes Cloudflare Tunnel as recommended self-hosted option —
- * handles install, login, tunnel creation, DNS, and PM2 in one flow.
- */
-
-import { execSync, exec as execCb } from 'child_process';
-import { promisify } from 'util';
-import { existsSync, writeFileSync, readFileSync } from 'fs';
-import { join } from 'path';
-import { homedir, platform, arch } from 'os';
-
-const execP = promisify(execCb);
-
-export type DeployTarget = 'cloud' | 'cloudflare-tunnel' | 'fly' | 'railway' | 'docker' | 'local';
-
-const SUBDOMAIN_REGISTRY_URL = process.env.AGENTICMAIL_SUBDOMAIN_REGISTRY_URL
-  || 'https://registry.agenticmail.io';
-
-export interface DeploymentSelection {
-  target: DeployTarget;
-  /** Populated when target is 'cloudflare-tunnel' */
-  tunnel?: {
-    tunnelId: string;
-    domain: string;
-    port: number;
-    tunnelName: string;
-  };
-  /** Populated when target is 'cloud' (agenticmail.io subdomain) */
-  cloud?: {
-    subdomain: string;
-    fqdn: string;
-    tunnelId: string;
-    tunnelToken: string;
-    port: number;
-  };
-}
-
-export async function promptDeployment(
-  inquirer: any,
-  chalk: any,
-): Promise<DeploymentSelection> {
-  console.log('');
-  console.log(chalk.bold.cyan('  Step 3 of 4: Deployment'));
-  console.log(chalk.dim('  Where should your dashboard run?\n'));
-
-  const { deployTarget } = await inquirer.prompt([{
-    type: 'list',
-    name: 'deployTarget',
-    message: 'Deploy to:',
-    choices: [
-      {
-        name: `AgenticMail Cloud  ${chalk.green('← recommended')}  ${chalk.dim('(instant URL, zero config)')}`,
-        value: 'cloud',
-      },
-      {
-        name: `Cloudflare Tunnel  ${chalk.dim('(self-hosted, free, no ports)')}`,
-        value: 'cloudflare-tunnel',
-      },
-      {
-        name: `Fly.io  ${chalk.dim('(your account)')}`,
-        value: 'fly',
-      },
-      {
-        name: `Railway  ${chalk.dim('(your account)')}`,
-        value: 'railway',
-      },
-      {
-        name: `Docker  ${chalk.dim('(self-hosted)')}`,
-        value: 'docker',
-      },
-      {
-        name: `Local  ${chalk.dim('(dev/testing, runs here)')}`,
-        value: 'local',
-      },
-    ],
-  }]);
-
-  if (deployTarget === 'cloud') {
-    const cloud = await runCloudSetup(inquirer, chalk);
-    return { target: deployTarget, cloud };
-  }
-
-  if (deployTarget === 'cloudflare-tunnel') {
-    const tunnel = await runTunnelSetup(inquirer, chalk);
-    return { target: deployTarget, tunnel };
-  }
-
-  return { target: deployTarget };
-}
-
-// ─── AgenticMail Cloud (Subdomain) Setup ────────────
-
-async function runCloudSetup(
-  inquirer: any,
-  chalk: any,
-): Promise<DeploymentSelection['cloud']> {
-  console.log('');
-  console.log(chalk.bold('  AgenticMail Cloud Setup'));
-  console.log(chalk.dim('  Get a free subdomain on agenticmail.io — no Cloudflare account needed.'));
-  console.log(chalk.dim('  Your instance will be live at https://yourname.agenticmail.io\n'));
-
-  // ── Step 1: Choose subdomain ─────────
-
-  let subdomain = '';
-  let claimResult: any = null;
-
-  while (!subdomain) {
-    const { name } = await inquirer.prompt([{
-      type: 'input',
-      name: 'name',
-      message: 'Choose your subdomain:',
-      suffix: chalk.dim('.agenticmail.io'),
-      validate: (input: string) => {
-        const cleaned = input.toLowerCase().trim();
-        if (cleaned.length < 3) return 'Must be at least 3 characters';
-        if (cleaned.length > 32) return 'Must be 32 characters or fewer';
-        if (!/^[a-z0-9]([a-z0-9-]*[a-z0-9])?$/.test(cleaned)) return 'Only lowercase letters, numbers, and hyphens allowed';
-        return true;
-      },
-    }]);
-
-    const cleaned = name.toLowerCase().trim();
-
-    // Check availability
-    process.stdout.write(chalk.dim(`  Checking ${cleaned}.agenticmail.io... `));
-    try {
-      const checkResp = await fetch(`${SUBDOMAIN_REGISTRY_URL}/check?name=${encodeURIComponent(cleaned)}`);
-      const checkData = await checkResp.json() as any;
-
-      if (!checkData.available) {
-        console.log(chalk.red('✗ ' + (checkData.reason || 'Not available')));
-        continue;
-      }
-      console.log(chalk.green('✓ Available!'));
-    } catch (err: any) {
-      console.log(chalk.yellow('⚠ Could not check availability: ' + err.message));
-      console.log(chalk.dim('  Proceeding anyway — the claim step will verify.\n'));
-    }
-
-    // Confirm
-    const { confirmed } = await inquirer.prompt([{
-      type: 'confirm',
-      name: 'confirmed',
-      message: `Claim ${chalk.bold(cleaned + '.agenticmail.io')}?`,
-      default: true,
-    }]);
-
-    if (!confirmed) continue;
-
-    // ── Step 2: Claim subdomain ─────────
-
-    // Get or generate vault key hash for recovery
-    const { createHash, randomUUID } = await import('crypto');
-    let vaultKey = process.env.AGENTICMAIL_VAULT_KEY;
-    if (!vaultKey) {
-      vaultKey = randomUUID() + randomUUID();
-      process.env.AGENTICMAIL_VAULT_KEY = vaultKey;
-    }
-    const vaultKeyHash = createHash('sha256').update(vaultKey).digest('hex');
-
-    process.stdout.write(chalk.dim('  Provisioning subdomain... '));
-    try {
-      const claimResp = await fetch(`${SUBDOMAIN_REGISTRY_URL}/claim`, {
-        method: 'POST',
-        headers: { 'Content-Type': 'application/json' },
-        body: JSON.stringify({ name: cleaned, vaultKeyHash }),
-      });
-      claimResult = await claimResp.json() as any;
-
-      if (claimResult.error) {
-        console.log(chalk.red('✗ ' + claimResult.error));
-
-        // If they already have a subdomain, offer recovery
-        if (claimResult.error.includes('already has subdomain')) {
-          const { wantsRecover } = await inquirer.prompt([{
-            type: 'confirm',
-            name: 'wantsRecover',
-            message: 'Recover your existing subdomain instead?',
-            default: true,
-          }]);
-          if (wantsRecover) {
-            const recoverResp = await fetch(`${SUBDOMAIN_REGISTRY_URL}/recover`, {
-              method: 'POST',
-              headers: { 'Content-Type': 'application/json' },
-              body: JSON.stringify({ vaultKeyHash }),
-            });
-            claimResult = await recoverResp.json() as any;
-            if (claimResult.success) {
-              subdomain = claimResult.subdomain;
-              console.log(chalk.green(`✓ Recovered: ${claimResult.fqdn}`));
-            } else {
-              console.log(chalk.red('✗ Recovery failed: ' + (claimResult.error || 'Unknown error')));
-            }
-          }
-        }
-        continue;
-      }
-
-      if (claimResult.success) {
-        subdomain = claimResult.subdomain || cleaned;
-        if (claimResult.recovered) {
-          console.log(chalk.green('✓ Recovered existing subdomain'));
-        } else {
-          console.log(chalk.green('✓ Subdomain claimed!'));
-        }
-      }
-    } catch (err: any) {
-      console.log(chalk.red('✗ Failed: ' + err.message));
-      console.log(chalk.dim('  Check your internet connection and try again.\n'));
-    }
-  }
-
-  // ── Step 3: Install cloudflared ─────────
-
-  console.log('');
-  console.log(chalk.bold('  Installing cloudflared connector...'));
-
-  let cloudflaredPath = '';
-  try {
-    cloudflaredPath = execSync('which cloudflared', { encoding: 'utf8' }).trim();
-    console.log(chalk.green(`  ✓ cloudflared found at ${cloudflaredPath}`));
-  } catch {
-    console.log(chalk.dim('  cloudflared not found — installing...'));
-    try {
-      const os = platform();
-      if (os === 'darwin') {
-        execSync('brew install cloudflared', { stdio: 'pipe' });
-      } else if (os === 'linux') {
-        const archStr = arch() === 'arm64' ? 'arm64' : 'amd64';
-        execSync(`curl -L https://github.com/cloudflare/cloudflared/releases/latest/download/cloudflared-linux-${archStr} -o /usr/local/bin/cloudflared && chmod +x /usr/local/bin/cloudflared`, { stdio: 'pipe' });
-      } else {
-        console.log(chalk.yellow('  Please install cloudflared manually: https://developers.cloudflare.com/cloudflare-one/connections/connect-apps/install-and-setup/installation/'));
-      }
-      cloudflaredPath = execSync('which cloudflared', { encoding: 'utf8' }).trim();
-      console.log(chalk.green(`  ✓ cloudflared installed at ${cloudflaredPath}`));
-    } catch (e: any) {
-      console.log(chalk.yellow('  ⚠ Could not auto-install cloudflared.'));
-      console.log(chalk.dim('    Install manually: https://developers.cloudflare.com/cloudflare-one/connections/connect-apps/install-and-setup/installation/'));
-    }
-  }
-
-  // ── Step 4: Configure PM2 ─────────
-
-  const port = 3100;
-  const fqdn = claimResult?.fqdn || `${subdomain}.agenticmail.io`;
-  const tunnelToken = claimResult?.tunnelToken;
-  const tunnelId = claimResult?.tunnelId;
-
-  console.log('');
-  console.log(chalk.bold.green('  ✓ Setup Complete!'));
-  console.log('');
-  console.log(`  Your dashboard: ${chalk.bold.cyan('https://' + fqdn)}`);
-
-  // ── CRITICAL: Vault key backup warning ─────────
-  console.log('');
-  console.log(chalk.bgYellow.black.bold('  ⚠  BACK UP ~/.agenticmail/.env  ⚠  '));
-  console.log('');
-  console.log(chalk.yellow('  This file contains EVERYTHING needed to recover if your machine crashes:'));
-  console.log('');
-  console.log(chalk.yellow('    DATABASE_URL          — your database connection'));
-  console.log(chalk.yellow('    JWT_SECRET            — login session signing key'));
-  console.log(chalk.yellow('    AGENTICMAIL_VAULT_KEY — encrypted credentials + subdomain recovery'));
-  console.log(chalk.yellow('    CLOUDFLARED_TOKEN     — tunnel connection token'));
-  console.log(chalk.yellow('    PORT                  — server port'));
-  console.log('');
-  console.log(chalk.bold.yellow('  Copy this file to a safe place (password manager, cloud drive, etc.)'));
-  console.log(chalk.bold.yellow('  Without it, you CANNOT recover your subdomain or encrypted data.'));
-  console.log('');
-  console.log(chalk.dim('  To recover on a new machine:'));
-  console.log(chalk.cyan('    npx @agenticmail/enterprise recover --cloud'));
-  console.log('');
-  console.log('');
-  console.log(chalk.dim('  To start your instance, run these two processes:'));
-  console.log('');
-  console.log(`    ${chalk.cyan('cloudflared tunnel --no-autoupdate run --token ' + (tunnelToken || '<your-tunnel-token>'))}`);
-  console.log(`    ${chalk.cyan('npx @agenticmail/enterprise start')}`);
-  console.log('');
-  console.log(chalk.dim('  Or let the setup wizard start them with PM2 (next step).\n'));
-
-  // Save tunnel token to .env
-  const envPath = join(homedir(), '.agenticmail', '.env');
-  try {
-    let envContent = '';
-    if (existsSync(envPath)) {
-      envContent = readFileSync(envPath, 'utf8');
-    }
-    if (tunnelToken && !envContent.includes('CLOUDFLARED_TOKEN=')) {
-      envContent += `\nCLOUDFLARED_TOKEN=${tunnelToken}\n`;
-    }
-    if (!envContent.includes('AGENTICMAIL_SUBDOMAIN=')) {
-      envContent += `AGENTICMAIL_SUBDOMAIN=${subdomain}\n`;
-    }
-    if (!envContent.includes('AGENTICMAIL_DOMAIN=')) {
-      envContent += `AGENTICMAIL_DOMAIN=${fqdn}\n`;
-    }
-    const { mkdirSync } = await import('fs');
-    mkdirSync(join(homedir(), '.agenticmail'), { recursive: true });
-    writeFileSync(envPath, envContent, { mode: 0o600 });
-  } catch {}
-
-  return {
-    subdomain,
-    fqdn,
-    tunnelId: tunnelId || '',
-    tunnelToken: tunnelToken || '',
-    port,
-  };
-}
-
-// ─── Cloudflare Tunnel Interactive Setup ────────────
-
-async function runTunnelSetup(
-  inquirer: any,
-  chalk: any,
-): Promise<DeploymentSelection['tunnel']> {
-  console.log('');
-  console.log(chalk.bold('  Cloudflare Tunnel Setup'));
-  console.log(chalk.dim('  Exposes your local server to the internet via Cloudflare.'));
-  console.log(chalk.dim('  No open ports, free TLS, auto-DNS.\n'));
-
-  // ── Step 1: Check / Install cloudflared ─────────
-  console.log(chalk.bold('  1. Cloudflared CLI'));
-
-  let installed = false;
-  let version = '';
-  try {
-    version = execSync('cloudflared --version 2>&1', { encoding: 'utf8', timeout: 5000 }).trim();
-    installed = true;
-  } catch { /* not installed */ }
-
-  if (installed) {
-    console.log(chalk.green(`     ✓ Installed (${version})\n`));
-  } else {
-    console.log(chalk.yellow('     Not installed.'));
-    const { doInstall } = await inquirer.prompt([{
-      type: 'confirm',
-      name: 'doInstall',
-      message: 'Install cloudflared now?',
-      default: true,
-    }]);
-
-    if (!doInstall) {
-      console.log(chalk.red('\n  cloudflared is required for tunnel deployment.'));
-      console.log(chalk.dim('  Install it manually: https://developers.cloudflare.com/cloudflare-one/connections/connect-networks/downloads/\n'));
-      process.exit(1);
-    }
-
-    console.log(chalk.dim('     Installing...'));
-    try {
-      await installCloudflared();
-      version = execSync('cloudflared --version 2>&1', { encoding: 'utf8', timeout: 5000 }).trim();
-      console.log(chalk.green(`     ✓ Installed (${version})\n`));
-    } catch (err: any) {
-      console.log(chalk.red(`     ✗ Installation failed: ${err.message}`));
-      console.log(chalk.dim('     Install manually and re-run setup.\n'));
-      process.exit(1);
-    }
-  }
-
-  // ── Step 2: Login to Cloudflare ─────────────────
-  console.log(chalk.bold('  2. Cloudflare Authentication'));
-
-  const cfDir = join(homedir(), '.cloudflared');
-  const certPath = join(cfDir, 'cert.pem');
-  const loggedIn = existsSync(certPath);
-
-  if (loggedIn) {
-    console.log(chalk.green('     ✓ Already authenticated\n'));
-  } else {
-    console.log(chalk.dim('     This will open your browser to authorize Cloudflare.\n'));
-    const { doLogin } = await inquirer.prompt([{
-      type: 'confirm',
-      name: 'doLogin',
-      message: 'Open browser to login to Cloudflare?',
-      default: true,
-    }]);
-
-    if (!doLogin) {
-      console.log(chalk.red('\n  Cloudflare auth is required. Run `cloudflared tunnel login` manually.\n'));
-      process.exit(1);
-    }
-
-    console.log(chalk.dim('     Waiting for browser authorization...'));
-    try {
-      await execP('cloudflared tunnel login', { timeout: 120000 });
-      console.log(chalk.green('     ✓ Authenticated\n'));
-    } catch (err: any) {
-      console.log(chalk.red(`     ✗ Login failed or timed out: ${err.message}`));
-      console.log(chalk.dim('     Complete the browser authorization and try again.\n'));
-      process.exit(1);
-    }
-  }
-
-  // ── Step 3: Domain + Port ───────────────────────
-  console.log(chalk.bold('  3. Tunnel Configuration'));
-
-  const { domain, port, tunnelName } = await inquirer.prompt([
-    {
-      type: 'input',
-      name: 'domain',
-      message: 'Domain (e.g. dashboard.yourcompany.com):',
-      validate: (v: string) => v.includes('.') ? true : 'Enter a valid domain',
-    },
-    {
-      type: 'number',
-      name: 'port',
-      message: 'Local port:',
-      default: 3200,
-    },
-    {
-      type: 'input',
-      name: 'tunnelName',
-      message: 'Tunnel name:',
-      default: 'agenticmail-enterprise',
-    },
-  ]);
-
-  // ── Step 4: Create tunnel + DNS + Start ─────────
-  console.log('');
-  console.log(chalk.bold('  4. Deploying'));
-
-  // Create tunnel
-  let tunnelId = '';
-  try {
-    console.log(chalk.dim('     Creating tunnel...'));
-    const out = execSync(`cloudflared tunnel create ${tunnelName} 2>&1`, { encoding: 'utf8', timeout: 30000 });
-    const match = out.match(/Created tunnel .+ with id ([a-f0-9-]+)/);
-    tunnelId = match?.[1] || '';
-    console.log(chalk.green(`     ✓ Tunnel created: ${tunnelName} (${tunnelId})`));
-  } catch (e: any) {
-    if (e.message?.includes('already exists') || e.stderr?.includes('already exists')) {
-      try {
-        const listOut = execSync('cloudflared tunnel list --output json 2>&1', { encoding: 'utf8', timeout: 15000 });
-        const tunnels = JSON.parse(listOut);
-        const existing = tunnels.find((t: any) => t.name === tunnelName);
-        if (existing) {
-          tunnelId = existing.id;
-          console.log(chalk.green(`     ✓ Using existing tunnel: ${tunnelName} (${tunnelId})`));
-        }
-      } catch {
-        console.log(chalk.red(`     ✗ Tunnel "${tunnelName}" exists but couldn't read its ID`));
-        process.exit(1);
-      }
-    } else {
-      console.log(chalk.red(`     ✗ Failed to create tunnel: ${e.message}`));
-      process.exit(1);
-    }
-  }
-
-  if (!tunnelId) {
-    console.log(chalk.red('     ✗ Could not determine tunnel ID'));
-    process.exit(1);
-  }
-
-  // Write config
-  const config = [
-    `tunnel: ${tunnelId}`,
-    `credentials-file: ${join(cfDir, tunnelId + '.json')}`,
-    '',
-    'ingress:',
-    `  - hostname: ${domain}`,
-    `    service: http://localhost:${port}`,
-    '  - service: http_status:404',
-  ].join('\n');
-
-  writeFileSync(join(cfDir, 'config.yml'), config);
-  console.log(chalk.green(`     ✓ Config written: ${domain} → localhost:${port}`));
-
-  // Route DNS
-  try {
-    execSync(`cloudflared tunnel route dns ${tunnelId} ${domain} 2>&1`, { encoding: 'utf8', timeout: 30000 });
-    console.log(chalk.green(`     ✓ DNS CNAME created: ${domain}`));
-  } catch (e: any) {
-    if (e.message?.includes('already exists') || e.stderr?.includes('already exists')) {
-      console.log(chalk.green(`     ✓ DNS CNAME already exists for ${domain}`));
-    } else {
-      console.log(chalk.yellow(`     ⚠ DNS routing failed — add CNAME manually: ${domain} → ${tunnelId}.cfargotunnel.com`));
-    }
-  }
-
-  // Start with PM2
-  let started = false;
-  try {
-    execSync('which pm2', { timeout: 3000 });
-    try { execSync('pm2 delete cloudflared 2>/dev/null', { timeout: 5000 }); } catch { /* ok */ }
-    execSync(`pm2 start cloudflared --name cloudflared -- tunnel run`, { encoding: 'utf8', timeout: 15000 });
-    try { execSync('pm2 save 2>/dev/null', { timeout: 5000 }); } catch { /* ok */ }
-    // Setup PM2 to survive reboots
-    try {
-      const startupOut = execSync('pm2 startup 2>&1', { encoding: 'utf8', timeout: 15000 });
-      const sudoMatch = startupOut.match(/sudo .+$/m);
-      if (sudoMatch) try { execSync(sudoMatch[0], { timeout: 15000, stdio: 'pipe' }); } catch {}
-    } catch { /* non-fatal */ }
-    console.log(chalk.green('     ✓ Tunnel running via PM2 (auto-restarts on crash + reboot)'));
-    started = true;
-  } catch { /* PM2 not available */ }
-
-  if (!started) {
-    // Try npm install pm2 globally, then retry
-    try {
-      console.log(chalk.dim('     Installing PM2 for process management...'));
-      execSync('npm install -g pm2', { timeout: 60000, stdio: 'pipe' });
-      try { execSync('pm2 delete cloudflared 2>/dev/null', { timeout: 5000 }); } catch { /* ok */ }
-      execSync(`pm2 start cloudflared --name cloudflared -- tunnel run`, { encoding: 'utf8', timeout: 15000 });
-      try { execSync('pm2 save 2>/dev/null', { timeout: 5000 }); } catch { /* ok */ }
-      try {
-        const startupOut = execSync('pm2 startup 2>&1', { encoding: 'utf8', timeout: 15000 });
-        const sudoMatch = startupOut.match(/sudo .+$/m);
-        if (sudoMatch) try { execSync(sudoMatch[0], { timeout: 15000, stdio: 'pipe' }); } catch {}
-      } catch { /* non-fatal */ }
-      console.log(chalk.green('     ✓ PM2 installed + tunnel running (auto-restarts on crash + reboot)'));
-      started = true;
-    } catch {
-      console.log(chalk.yellow('     ⚠ PM2 not available — tunnel started in background'));
-      console.log(chalk.dim('       Install PM2 for auto-restart: npm install -g pm2'));
-      try {
-        const { spawn } = await import('child_process');
-        const child = spawn('cloudflared', ['tunnel', 'run'], { detached: true, stdio: 'ignore' });
-        child.unref();
-        started = true;
-      } catch { /* best effort */ }
-    }
-  }
-
-  console.log('');
-  console.log(chalk.green.bold(`  ✓ Tunnel deployed! Your dashboard will be at https://${domain}`));
-  console.log('');
-
-  return { tunnelId, domain, port, tunnelName };
-}
-
-// ─── Install cloudflared binary ─────────────────────
-
-async function installCloudflared(): Promise<void> {
-  const plat = platform();
-  const a = arch();
-
-  if (plat === 'darwin') {
-    try {
-      execSync('which brew', { timeout: 3000 });
-      execSync('brew install cloudflared 2>&1', { encoding: 'utf8', timeout: 120000 });
-      return;
-    } catch { /* no brew, direct download */ }
-    const cfArch = a === 'arm64' ? 'arm64' : 'amd64';
-    execSync(
-      `curl -L -o /usr/local/bin/cloudflared https://github.com/cloudflare/cloudflared/releases/latest/download/cloudflared-darwin-${cfArch} && chmod +x /usr/local/bin/cloudflared`,
-      { timeout: 60000 },
-    );
-  } else if (plat === 'linux') {
-    const cfArch = a === 'arm64' ? 'arm64' : 'amd64';
-    execSync(
-      `curl -L -o /usr/local/bin/cloudflared https://github.com/cloudflare/cloudflared/releases/latest/download/cloudflared-linux-${cfArch} && chmod +x /usr/local/bin/cloudflared`,
-      { timeout: 60000 },
-    );
-  } else {
-    throw new Error('Unsupported platform: ' + plat);
-  }
-}

package/src/setup/domain.ts

@@ -1,112 +0,0 @@
-/**
- * Setup Wizard — Step 4: Custom Domain (Optional)
- *
- * Optionally configure a custom domain for the dashboard.
- * Supports three modes:
- *   1. Subdomain only — <subdomain>.agenticmail.io (default)
- *   2. Root domain — deploy on your main domain (e.g. agenticmail.io)
- *   3. Subdomain of your domain — e.g. agents.yourcompany.com
- */
-
-export interface DomainSelection {
-  customDomain?: string;
-  /** If true, deploy on root domain without subdomain prefix */
-  useRootDomain?: boolean;
-}
-
-export async function promptDomain(
-  inquirer: any,
-  chalk: any,
-  deployTarget: string,
-): Promise<DomainSelection> {
-  // Skip for local deployments
-  if (deployTarget === 'local') {
-    return {};
-  }
-
-  console.log('');
-  console.log(chalk.bold.cyan('  Step 4 of 5: Custom Domain'));
-  console.log(chalk.dim('  Configure how your team will access the dashboard.\n'));
-
-  // Explain what a custom domain does based on deploy target
-  const targetHints: Record<string, string> = {
-    cloud: 'By default, your dashboard is at <subdomain>.agenticmail.io. Add a custom domain for a branded URL.',
-    docker: 'Configure your reverse proxy (nginx, Caddy, etc.) to route your domain to the Docker container.',
-    fly: 'After deploying, run `fly certs add <domain>` to provision TLS for your domain.',
-    railway: 'Add your domain in Railway project settings after deploying.',
-  };
-
-  if (targetHints[deployTarget]) {
-    console.log(chalk.dim(`  ${targetHints[deployTarget]}`));
-    console.log('');
-  }
-
-  const { domainMode } = await inquirer.prompt([{
-    type: 'list',
-    name: 'domainMode',
-    message: 'Domain setup:',
-    choices: [
-      {
-        name: `Use default subdomain only  ${chalk.dim('(<subdomain>.agenticmail.io)')}`,
-        value: 'subdomain_only',
-      },
-      {
-        name: `Add a custom subdomain  ${chalk.dim('(e.g. agents.yourcompany.com)')}`,
-        value: 'custom_subdomain',
-      },
-      {
-        name: `Deploy on my root domain  ${chalk.dim('(e.g. yourcompany.com — no subdomain)')}`,
-        value: 'root_domain',
-      },
-    ],
-  }]);
-
-  if (domainMode === 'subdomain_only') {
-    return {};
-  }
-
-  const isRoot = domainMode === 'root_domain';
-
-  const { domain } = await inquirer.prompt([{
-    type: 'input',
-    name: 'domain',
-    message: isRoot ? 'Your domain:' : 'Custom domain:',
-    suffix: isRoot
-      ? chalk.dim('  (e.g. yourcompany.com)')
-      : chalk.dim('  (e.g. agents.yourcompany.com)'),
-    validate: (v: string) => {
-      const d = v.trim().toLowerCase();
-      if (!d.includes('.')) return 'Enter a valid domain (e.g. yourcompany.com)';
-      if (d.startsWith('http')) return 'Enter just the domain, not a URL';
-      if (d.endsWith('.')) return 'Do not include a trailing dot';
-      return true;
-    },
-    filter: (v: string) => v.trim().toLowerCase(),
-  }]);
-
-  if (isRoot) {
-    console.log('');
-    console.log(chalk.bold('  Root Domain Deployment'));
-    console.log(chalk.dim(`  Your dashboard will be accessible at: ${chalk.white('https://' + domain)}`));
-    console.log(chalk.dim('  This means the entire domain is dedicated to your AgenticMail deployment.'));
-    console.log('');
-  }
-
-  // Preview what DNS they'll need
-  console.log('');
-  console.log(chalk.dim('  After setup, you will need DNS records for this domain:'));
-  console.log('');
-  if (isRoot) {
-    console.log(chalk.dim(`  1. ${chalk.white('A record')}         — point ${domain} to your server IP`));
-    console.log(chalk.dim(`     (or CNAME if your provider allows it at the apex)`));
-  } else {
-    console.log(chalk.dim(`  1. ${chalk.white('CNAME or A record')}  — routes traffic to your server`));
-  }
-  console.log(chalk.dim(`  2. ${chalk.white('TXT record')}          — proves domain ownership (next step)`));
-  console.log('');
-
-  return {
-    customDomain: domain,
-    useRootDomain: isRoot || undefined,
-  };
-}