@naviyra/cloud-panel 0.0.3-beta → 0.0.3-beta2

package/apps/agent/src/cloudflare.mjs

@@ -1,733 +1,857 @@
-import { spawn } from "node:child_process";
-import { existsSync } from "node:fs";
-import { readFile, writeFile, rename, mkdir } from "node:fs/promises";
-import path from "node:path";
-import os from "node:os";
-import { fileURLToPath } from "node:url";
-import { safeEnvironment } from "./native.mjs";
-
-const cfId = /^[a-f0-9]{32}$/i;
-const emailPattern = /^[a-z0-9._%+-]+@[a-z0-9.-]+\.[a-z]{2,}$/i;
-let login = {
-  state: "idle",
-  log: "",
-  error: "",
-  skipped: false,
-};
-let child = null;
-let apiLogin = { state: "idle", log: "", error: "", skipped: false };
-let apiChild = null;
-
-export function certPath() {
-  return (
-    process.env.CLOUDFLARE_CERT ||
-    path.join(os.homedir(), ".cloudflared", "cert.pem")
-  );
-}
-export function parseOriginCert(pem) {
-  const match = String(pem).match(
-    /-----BEGIN ARGO TUNNEL TOKEN-----([A-Za-z0-9+/=\s]+)-----END ARGO TUNNEL TOKEN-----/,
-  );
-  if (!match) throw Error("Cloudflare certificate has no tunnel token");
-  const decoded = Buffer.from(match[1].replace(/\s/g, ""), "base64").toString(
-    "utf8",
-  );
-  let zoneId = "",
-    accountId = "",
-    apiToken = "";
-  try {
-    const json = JSON.parse(decoded);
-    zoneId = json.zoneID || json.zoneId || "";
-    accountId = json.accountID || json.accountId || "";
-    apiToken = json.apiToken || json.serviceKey || "";
-  } catch {
-    const lines = decoded
-      .split(/\r?\n/)
-      .map((line) => line.trim())
-      .filter(Boolean);
-    if (lines.length >= 2) {
-      zoneId = lines[0];
-      apiToken = lines[1];
-    }
-  }
-  if (!cfId.test(zoneId) || apiToken.length < 8)
-    throw Error("Cloudflare certificate is missing a zone or token");
-  if (accountId && !cfId.test(accountId)) accountId = "";
-  return { zoneId, accountId, apiToken };
-}
-async function readOriginCert() {
-  return parseOriginCert(await readFile(certPath()));
-}
-function pushLog(chunk) {
-  const text = String(chunk)
-    .replace(/Bearer\s+\S+/gi, "Bearer [redacted]")
-    .replace(/apiToken\\?":\\?"[^"\\]+/gi, 'apiToken":"[redacted]');
-  login.log = (login.log + text).slice(-8000);
-}
-function loginUrl() {
-  return login.log.match(/https:\/\/\S+/)?.[0]?.replace(/[),.\]]+$/, "") || "";
-}
-function publicLogin() {
-  return {
-    state: login.state,
-    log: login.log,
-    error: login.error,
-    skipped: login.skipped,
-    url: loginUrl(),
-    registered: login.state === "done",
-  };
-}
-export async function cloudflareStatus() {
-  let registered = false,
-    zoneId = null,
-    accountId = null;
-  try {
-    const cert = await readOriginCert();
-    registered = true;
-    zoneId = cert.zoneId;
-    accountId = cert.accountId || null;
-  } catch {
-    registered = false;
-  }
-  return {
-    registered,
-    zone_id: zoneId,
-    account_id: accountId,
-    cert_path: certPath(),
-    tunnels_enabled: process.env.NATIVE_TUNNELS !== "false",
-    api_authorized: Boolean(await readWranglerAuth()),
-    login: registered
-      ? {
-          state: "done",
-          log: "",
-          error: "",
-          skipped: true,
-          url: "",
-          registered: true,
-        }
-      : publicLogin(),
-  };
-}
-async function enableNativeTunnels() {
-  process.env.NATIVE_TUNNELS = "true";
-  const envFile = fileURLToPath(new URL("../../../.env", import.meta.url));
-  try {
-    let text = await readFile(envFile, "utf8");
-    if (/^NATIVE_TUNNELS=/m.test(text))
-      text = text.replace(/^NATIVE_TUNNELS=.*$/m, "NATIVE_TUNNELS=true");
-    else text = `${text.trimEnd()}\nNATIVE_TUNNELS=true\n`;
-    await writeFile(envFile, text);
-  } catch {
-    // This process still publishes tunnels until it restarts.
-  }
-}
-export async function startCloudflareLogin() {
-  try {
-    await readOriginCert();
-    login = {
-      state: "done",
-      log: "Cloudflare is already registered.",
-      error: "",
-      skipped: true,
-    };
-    return { ...publicLogin(), registered: true, skipped: true };
-  } catch {
-    // A missing or unreadable certificate starts the browser login.
-  }
-  if (login.state === "running") return publicLogin();
-  login = {
-    state: "running",
-    log: "Starting cloudflared tunnel login…\n",
-    error: "",
-    skipped: false,
-  };
-  const file = certPath();
-  try {
-    await rename(file, `${file}.invalid`);
-    pushLog("Moved an unreadable certificate aside.\n");
-  } catch {
-    // No previous certificate.
-  }
-  await mkdir(path.dirname(file), { recursive: true });
-  const bin = process.env.CLOUDFLARED_BIN || "cloudflared";
-  child = spawn(bin, ["tunnel", "login"], {
-    env: { ...safeEnvironment(), TUNNEL_ORIGIN_CERT: file },
-    windowsHide: true,
-    shell: false,
-    stdio: ["ignore", "pipe", "pipe"],
-  });
-  child.stdout?.on("data", pushLog);
-  child.stderr?.on("data", pushLog);
-  const timer = setTimeout(() => {
-    child?.kill();
-    if (login.state === "running") {
-      login.state = "error";
-      login.error =
-        "Cloudflare login timed out. Approve the browser prompt and try again.";
-    }
-  }, 5 * 60 * 1000);
-  child.on("error", (error) => {
-    clearTimeout(timer);
-    login.state = "error";
-    login.error =
-      error.code === "ENOENT"
-        ? "cloudflared is not installed. Install it, set CLOUDFLARED_BIN if needed, and restart the agent."
-        : error.message;
-    child = null;
-  });
-  child.on("exit", async () => {
-    clearTimeout(timer);
-    child = null;
-    try {
-      await readOriginCert();
-      await enableNativeTunnels();
-      login.state = "done";
-      login.error = "";
-      pushLog("\nCloudflare account registered.\n");
-    } catch {
-      if (login.state === "running") {
-        login.state = "error";
-        login.error =
-          "Login finished without a certificate. Approve a zone in the browser and try again.";
-      }
-    }
-  });
-  return publicLogin();
-}
-export function cloudflareLoginStatus() {
-  return publicLogin();
-}
-function wranglerAuthPaths() {
-  if (process.env.WRANGLER_AUTH_FILE) return [process.env.WRANGLER_AUTH_FILE];
-  const home = os.homedir();
-  const appData =
-    process.env.APPDATA || path.join(home, "AppData", "Roaming");
-  const xdg = process.env.XDG_CONFIG_HOME || path.join(home, ".config");
-  return [
-    path.join(home, ".wrangler", "config", "default.toml"),
-    path.join(appData, "xdg.config", ".wrangler", "config", "default.toml"),
-    path.join(xdg, ".wrangler", "config", "default.toml"),
-    path.join(xdg, "wrangler", "config", "default.toml"),
-  ];
-}
-function tomlValue(text, key) {
-  const match = text.match(
-    new RegExp(`^${key}\\s*=\\s*"((?:\\\\.|[^"\\\\])*)"`, "m"),
-  );
-  return match ? match[1].replace(/\\"/g, '"') : "";
-}
-export async function readWranglerAuth() {
-  for (const file of wranglerAuthPaths()) {
-    let text;
-    try {
-      text = await readFile(file, "utf8");
-    } catch {
-      continue;
-    }
-    const token = tomlValue(text, "oauth_token");
-    if (token.length < 20) continue;
-    return { token };
-  }
-  return null;
-}
-function apiLoginView() {
-  const url =
-    apiLogin.log.match(/https:\/\/\S+/)?.[0]?.replace(/[),.\]]+$/, "") || "";
-  return {
-    state: apiLogin.state,
-    log: apiLogin.log,
-    error: apiLogin.error,
-    skipped: apiLogin.skipped,
-    url,
-    registered: apiLogin.state === "done",
-  };
-}
-function pushApiLog(chunk) {
-  const text = String(chunk)
-    .replace(/Bearer\s+\S+/gi, "Bearer [redacted]")
-    .replace(/oauth_token\\?":\\?"[^"\\]+/gi, 'oauth_token":"[redacted]');
-  apiLogin.log = (apiLogin.log + text).slice(-8000);
-}
-function wranglerLaunch() {
-  if (process.env.WRANGLER_BIN)
-    return { file: process.env.WRANGLER_BIN, args: ["login"] };
-  const cli = path.join(
-    path.dirname(process.execPath),
-    "node_modules",
-    "npm",
-    "bin",
-    "npx-cli.js",
-  );
-  if (existsSync(cli))
-    return {
-      file: process.execPath,
-      args: [cli, "--yes", "wrangler", "login"],
-    };
-  return {
-    file: process.env.ComSpec || "cmd.exe",
-    args: ["/d", "/s", "/c", "npx", "--yes", "wrangler", "login"],
-  };
-}
-export async function startCloudflareApiLogin() {
-  if (await readWranglerAuth()) {
-    apiLogin = {
-      state: "done",
-      log: "Wrangler is already authorized.",
-      error: "",
-      skipped: true,
-    };
-    return { ...apiLoginView(), registered: true, skipped: true };
-  }
-  if (apiLogin.state === "running") return apiLoginView();
-  apiLogin = {
-    state: "running",
-    log: "Starting wrangler login…\n",
-    error: "",
-    skipped: false,
-  };
-  const launch = wranglerLaunch();
-  apiChild = spawn(launch.file, launch.args, {
-    env: safeEnvironment(),
-    windowsHide: true,
-    shell: false,
-    stdio: ["ignore", "pipe", "pipe"],
-  });
-  apiChild.stdout?.on("data", pushApiLog);
-  apiChild.stderr?.on("data", pushApiLog);
-  const timer = setTimeout(() => {
-    apiChild?.kill();
-    if (apiLogin.state === "running") {
-      apiLogin.state = "error";
-      apiLogin.error =
-        "Wrangler login timed out. Approve the browser prompt and try again.";
-    }
-  }, 8 * 60 * 1000);
-  apiChild.on("error", (error) => {
-    clearTimeout(timer);
-    apiLogin.state = "error";
-    apiLogin.error = error.message;
-    apiChild = null;
-  });
-  apiChild.on("exit", async () => {
-    clearTimeout(timer);
-    apiChild = null;
-    if (await readWranglerAuth()) {
-      apiLogin.state = "done";
-      apiLogin.error = "";
-      pushApiLog("\nCloudflare API authorized.\n");
-    } else if (apiLogin.state === "running") {
-      apiLogin.state = "error";
-      apiLogin.error =
-        "Wrangler login finished without API access. Approve the browser prompt and try again.";
-    }
-  });
-  return apiLoginView();
-}
-export function cloudflareApiLoginStatus() {
-  return apiLoginView();
-}
-async function credentials(purpose = "dns") {
-  let cert;
-  try {
-    cert = await readOriginCert();
-  } catch {
-    throw Object.assign(
-      Error("Connect Cloudflare with cloudflared tunnel login first"),
-      { status: 400 },
-    );
-  }
-  const zoneFromEnv = process.env.CLOUDFLARE_ZONE_ID || "";
-  const zoneId = cfId.test(zoneFromEnv) ? zoneFromEnv : cert.zoneId;
-  if (purpose === "email") {
-    const wrangler = await readWranglerAuth();
-    const envToken = process.env.CLOUDFLARE_API_TOKEN || "";
-    const token = wrangler?.token || (envToken.length >= 20 ? envToken : "");
-    if (!token)
-      throw Object.assign(
-        Error(
-          "Authorize the Cloudflare API with Wrangler. The CLI login opens a browser and does not need CLOUDFLARE_API_TOKEN.",
-        ),
-        { status: 403, needsApiLogin: true },
-      );
-    return { token, zoneId, accountId: cert.accountId };
-  }
-  return { token: cert.apiToken, zoneId, accountId: cert.accountId };
-}
-export async function deleteTunnelCname(subdomain, tunnelId) {
-  const { token, zoneId } = await credentials("dns");
-  const base = `https://api.cloudflare.com/client/v4/zones/${zoneId}/dns_records`;
-  const call = async (url, method = "GET") => {
-    const response = await fetch(url, {
-      method,
-      headers: { Authorization: `Bearer ${token}` },
-      signal: AbortSignal.timeout(15000),
-    });
-    const data = await response.json().catch(() => ({}));
-    if (!response.ok || data.success === false)
-      throw Error("Cloudflare DNS cleanup failed");
-    return data.result;
-  };
-  for (const record of await call(
-    `${base}?name=${encodeURIComponent(subdomain)}&type=CNAME`,
-  ))
-    if (record.content === `${tunnelId}.cfargotunnel.com`)
-      await call(`${base}/${record.id}`, "DELETE");
-}
-async function cf(pathname, { method = "GET", body, query, purpose = "dns" } = {}) {
-  const { token } = await credentials(purpose);
-  const url = new URL(`https://api.cloudflare.com/client/v4${pathname}`);
-  for (const [key, value] of Object.entries(query || {}))
-    if (value != null && value !== "") url.searchParams.set(key, String(value));
-  let response;
-  try {
-    response = await fetch(url, {
-      method,
-      headers: {
-        Authorization: `Bearer ${token}`,
-        "Content-Type": "application/json",
-      },
-      body: body == null ? undefined : JSON.stringify(body),
-      signal: AbortSignal.timeout(20000),
-    });
-  } catch {
-    throw Object.assign(Error("Cloudflare API is unreachable"), { status: 502 });
-  }
-  const data = await response.json().catch(() => ({}));
-  if (!response.ok || data.success === false) {
-    let message =
-      data.errors?.[0]?.message || `Cloudflare API returned ${response.status}`;
-    if (response.status === 401 || response.status === 403)
-      message +=
-        ". Authorize with Wrangler from the Email screen. That CLI login does not use an API token in .env.";
-    throw Object.assign(Error(message), {
-      status: response.status === 401 || response.status === 403 ? 403 : 502,
-    });
-  }
-  return data;
-}
-function recordView(record) {
-  return {
-    id: record.id,
-    type: record.type,
-    name: record.name,
-    content: record.content,
-    ttl: record.ttl,
-    proxied: Boolean(record.proxied),
-    proxiable: Boolean(record.proxiable),
-    priority: record.priority ?? null,
-    comment: record.comment || "",
-    tags: record.tags || [],
-    locked: Boolean(record.locked),
-    created_on: record.created_on || null,
-    modified_on: record.modified_on || null,
-  };
-}
-export function assertCfId(id) {
-  if (!cfId.test(id || ""))
-    throw Object.assign(Error("Invalid Cloudflare identifier"), { status: 400 });
-  return id;
-}
-export async function listDns() {
-  const { zoneId } = await credentials();
-  const zone = await cf(`/zones/${zoneId}`);
-  const records = [];
-  for (let page = 1; page <= 20; page++) {
-    const data = await cf(`/zones/${zoneId}/dns_records`, {
-      query: { page, per_page: 100 },
-    });
-    records.push(...(data.result || []).map(recordView));
-    if (!data.result_info || page >= data.result_info.total_pages) break;
-  }
-  return {
-    zone: {
-      id: zone.result.id,
-      name: zone.result.name,
-      status: zone.result.status,
-    },
-    records,
-  };
-}
-export async function getDnsRecord(id) {
-  assertCfId(id);
-  const { zoneId } = await credentials();
-  return recordView((await cf(`/zones/${zoneId}/dns_records/${id}`)).result);
-}
-export async function updateDnsRecord(id, input) {
-  assertCfId(id);
-  const name = String(input?.name || "").trim();
-  const content = String(input?.content ?? "").trim();
-  const ttl = Number(input?.ttl);
-  if (!name || name.length > 253 || /[^a-z0-9._@*-]/i.test(name))
-    throw Object.assign(Error("Enter a valid record name"), { status: 400 });
-  if (!content || content.length > 4096)
-    throw Object.assign(Error("Enter record content"), { status: 400 });
-  if (!(ttl === 1 || (Number.isInteger(ttl) && ttl >= 60 && ttl <= 86400)))
-    throw Object.assign(
-      Error("TTL must be Auto or between 60 and 86400 seconds"),
-      { status: 400 },
-    );
-  const current = await getDnsRecord(id);
-  if (current.locked)
-    throw Object.assign(Error("This DNS record is locked"), { status: 400 });
-  const body = {
-    type: current.type,
-    name,
-    content,
-    ttl,
-    comment: String(input?.comment || "").slice(0, 500),
-  };
-  if (current.proxiable) body.proxied = Boolean(input?.proxied);
-  if (["MX", "SRV", "URI"].includes(current.type)) {
-    const priority = Number(input?.priority);
-    if (!Number.isInteger(priority) || priority < 0 || priority > 65535)
-      throw Object.assign(Error("Enter a priority from 0 to 65535"), {
-        status: 400,
-      });
-    body.priority = priority;
-  }
-  const { zoneId } = await credentials();
-  return recordView(
-    (
-      await cf(`/zones/${zoneId}/dns_records/${id}`, {
-        method: "PUT",
-        body,
-      })
-    ).result,
-  );
-}
-function withMailbox(input) {
-  if (!input || input.matcher === "all") return input;
-  if (input.local == null && input.domain == null) return input;
-  const local = String(input.local || "")
-    .trim()
-    .toLowerCase();
-  const domain = String(input.domain || "")
-    .trim()
-    .toLowerCase();
-  if (!/^[a-z0-9](?:[a-z0-9._+-]*[a-z0-9])?$/i.test(local))
-    throw Object.assign(Error("Enter the mailbox name"), { status: 400 });
-  if (!/^[a-z0-9.-]+\.[a-z]{2,}$/i.test(domain))
-    throw Object.assign(Error("Choose a domain"), { status: 400 });
-  return { ...input, custom_address: `${local}@${domain}`, domain };
-}
-function addressDomain(value) {
-  const address = String(value || "").toLowerCase();
-  const at = address.lastIndexOf("@");
-  return at === -1 ? "" : address.slice(at + 1);
-}
-async function zoneForDomain(domain) {
-  const { zoneId } = await credentials("email");
-  if (!domain) return zoneId;
-  const current = await cf(`/zones/${zoneId}`, { purpose: "email" });
-  if (current.result?.name?.toLowerCase() === domain) return zoneId;
-  const listed = await cf("/zones", {
-    query: { name: domain, per_page: 20 },
-    purpose: "email",
-  });
-  const match = (listed.result || []).find(
-    (zone) => zone.name?.toLowerCase() === domain,
-  );
-  if (!match)
-    throw Object.assign(Error("Choose a domain on this Cloudflare account"), {
-      status: 400,
-    });
-  return match.id;
-}
-async function emailDomains(zoneId, currentName) {
-  const domains = [];
-  try {
-    const listed = await cf("/zones", {
-      query: { per_page: 50, status: "active" },
-      purpose: "email",
-    });
-    for (const zone of listed.result || [])
-      if (zone?.name && cfId.test(zone.id)) domains.push(zone.name);
-  } catch {
-    /* The connected zone is still shown when the account list is unavailable. */
-  }
-  if (currentName && !domains.some((name) => name.toLowerCase() === currentName.toLowerCase()))
-    domains.unshift(currentName);
-  const names = [...new Set(domains.map((name) => name.toLowerCase()))];
-  names.sort((a, b) => a.localeCompare(b));
-  const current = currentName.toLowerCase();
-  if (names.includes(current)) {
-    names.splice(names.indexOf(current), 1);
-    names.unshift(current);
-  }
-  return names;
-}
-function ruleView(rule) {
-  const matcher = rule.matchers?.[0] || {};
-  const action = rule.actions?.[0] || {};
-  return {
-    id: rule.id,
-    name: rule.name || "",
-    enabled: Boolean(rule.enabled),
-    matcher: matcher.type || "",
-    custom_address: matcher.value || "",
-    action: action.type || "",
-    destination: Array.isArray(action.value) ? action.value[0] || "" : "",
-    priority: rule.priority ?? 0,
-  };
-}
-function ruleBody(input) {
-  const name = String(input?.name || "").trim();
-  const matcher = input?.matcher === "all" ? "all" : "literal";
-  const action = input?.action === "drop" ? "drop" : "forward";
-  const custom = String(input?.custom_address || "")
-    .trim()
-    .toLowerCase();
-  const destination = String(input?.destination || "")
-    .trim()
-    .toLowerCase();
-  if (name.length < 1 || name.length > 80)
-    throw Object.assign(Error("Enter a rule name"), { status: 400 });
-  if (matcher === "literal" && !emailPattern.test(custom))
-    throw Object.assign(Error("Enter the custom address to match"), {
-      status: 400,
-    });
-  if (action === "forward" && !emailPattern.test(destination))
-    throw Object.assign(Error("Enter a destination address"), { status: 400 });
-  return {
-    name,
-    enabled: input?.enabled !== false,
-    matchers:
-      matcher === "all"
-        ? [{ type: "all" }]
-        : [{ type: "literal", field: "to", value: custom }],
-    actions:
-      action === "drop"
-        ? [{ type: "drop" }]
-        : [{ type: "forward", value: [destination] }],
-  };
-}
-export async function emailOverview() {
-  const { zoneId, accountId } = await credentials("email");
-  const settings = await cf(`/zones/${zoneId}/email/routing`, {
-    purpose: "email",
-  });
-  const rules = await cf(`/zones/${zoneId}/email/routing/rules`, {
-    query: { per_page: 50 },
-    purpose: "email",
-  });
-  let addresses = [],
-    address_error = "";
-  if (accountId) {
-    try {
-      addresses =
-        (await cf(`/accounts/${accountId}/email/routing/addresses`, {
-          purpose: "email",
-        })).result ||
-        [];
-    } catch (error) {
-      address_error = error.message;
-    }
-  } else
-    address_error =
-      "This certificate has no account id, so destination addresses cannot be listed.";
-  return {
-    zone: settings.result?.name || "",
-    domains: await emailDomains(zoneId, settings.result?.name || ""),
-    settings: {
-      enabled: Boolean(settings.result?.enabled),
-      status: settings.result?.status || "unknown",
-      name: settings.result?.name || "",
-      support_subaddress: Boolean(settings.result?.support_subaddress),
-    },
-    rules: (rules.result || []).map(ruleView),
-    addresses: addresses.map((item) => ({
-      id: item.id,
-      email: item.email,
-      verified: item.verified || null,
-    })),
-    address_error,
-  };
-}
-export async function setEmailRouting(enabled) {
-  const { zoneId } = await credentials("email");
-  const data = await cf(
-    `/zones/${zoneId}/email/routing/${enabled ? "enable" : "disable"}`,
-    { method: "POST", purpose: "email" },
-  );
-  return {
-    enabled: Boolean(data.result?.enabled),
-    status: data.result?.status || "",
-  };
-}
-export async function createEmailRule(input) {
-  const next = withMailbox(input);
-  const body = ruleBody(next);
-  const zoneId = await zoneForDomain(
-    next.domain || addressDomain(body.matchers?.[0]?.value),
-  );
-  return ruleView(
-    (
-      await cf(`/zones/${zoneId}/email/routing/rules`, {
-        method: "POST",
-        body,
-        purpose: "email",
-      })
-    )
-      .result,
-  );
-}
-export async function updateEmailRule(id, input) {
-  assertCfId(id);
-  const body = ruleBody(input);
-  const zoneId = await zoneForDomain(addressDomain(body.matchers?.[0]?.value));
-  return ruleView(
-    (
-      await cf(`/zones/${zoneId}/email/routing/rules/${id}`, {
-        method: "PUT",
-        body,
-        purpose: "email",
-      })
-    ).result,
-  );
-}
-export async function deleteEmailRule(id, domain = "") {
-  assertCfId(id);
-  const zoneId = await zoneForDomain(String(domain || "").toLowerCase());
-  await cf(`/zones/${zoneId}/email/routing/rules/${id}`, {
-    method: "DELETE",
-    purpose: "email",
-  });
-  return { ok: true };
-}
-export async function addDestination(email) {
-  const address = String(email || "")
-    .trim()
-    .toLowerCase();
-  if (!emailPattern.test(address))
-    throw Object.assign(Error("Enter a valid email"), { status: 400 });
-  const { accountId } = await credentials("email");
-  if (!accountId)
-    throw Object.assign(
-      Error("Account id is missing from the Cloudflare certificate"),
-      { status: 400 },
-    );
-  const data = await cf(`/accounts/${accountId}/email/routing/addresses`, {
-    method: "POST",
-    body: { email: address },
-    purpose: "email",
-  });
-  return {
-    id: data.result?.id,
-    email: data.result?.email,
-    verified: data.result?.verified || null,
-  };
-}
-export async function deleteDestination(id) {
-  assertCfId(id);
-  const { accountId } = await credentials("email");
-  if (!accountId)
-    throw Object.assign(
-      Error("Account id is missing from the Cloudflare certificate"),
-      { status: 400 },
-    );
-  await cf(`/accounts/${accountId}/email/routing/addresses/${id}`, {
-    method: "DELETE",
-    purpose: "email",
-  });
-  return { ok: true };
-}
+import { spawn } from "node:child_process";
+import { existsSync } from "node:fs";
+import { readFile, writeFile, rename, mkdir, copyFile, rm } from "node:fs/promises";
+import path from "node:path";
+import os from "node:os";
+import { fileURLToPath } from "node:url";
+import { safeEnvironment } from "./native.mjs";
+
+const cfId = /^[a-f0-9]{32}$/i;
+const emailPattern = /^[a-z0-9._%+-]+@[a-z0-9.-]+\.[a-z]{2,}$/i;
+const WRANGLER_CLIENT_ID = "54d11594-84e4-41aa-b438-e81b8fa78ee7";
+const WRANGLER_TOKEN_URL = "https://dash.cloudflare.com/oauth2/token";
+const REFRESH_SKEW_MS = 60_000;
+let login = {
+  state: "idle",
+  log: "",
+  error: "",
+  skipped: false,
+};
+let child = null;
+let apiLogin = { state: "idle", log: "", error: "", skipped: false };
+let apiChild = null;
+let refreshing = null;
+let refreshFailureUntil = 0;
+
+export function certPath() {
+  return (
+    process.env.CLOUDFLARE_CERT ||
+    path.join(os.homedir(), ".cloudflared", "cert.pem")
+  );
+}
+export function parseOriginCert(pem) {
+  const match = String(pem).match(
+    /-----BEGIN ARGO TUNNEL TOKEN-----([A-Za-z0-9+/=\s]+)-----END ARGO TUNNEL TOKEN-----/,
+  );
+  if (!match) throw Error("Cloudflare certificate has no tunnel token");
+  const decoded = Buffer.from(match[1].replace(/\s/g, ""), "base64").toString(
+    "utf8",
+  );
+  let zoneId = "",
+    accountId = "",
+    apiToken = "";
+  try {
+    const json = JSON.parse(decoded);
+    zoneId = json.zoneID || json.zoneId || "";
+    accountId = json.accountID || json.accountId || "";
+    apiToken = json.apiToken || json.serviceKey || "";
+  } catch {
+    const lines = decoded
+      .split(/\r?\n/)
+      .map((line) => line.trim())
+      .filter(Boolean);
+    if (lines.length >= 2) {
+      zoneId = lines[0];
+      apiToken = lines[1];
+    }
+  }
+  if (!cfId.test(zoneId) || apiToken.length < 8)
+    throw Error("Cloudflare certificate is missing a zone or token");
+  if (accountId && !cfId.test(accountId)) accountId = "";
+  return { zoneId, accountId, apiToken };
+}
+async function readOriginCert() {
+  return parseOriginCert(await readFile(certPath()));
+}
+function pushLog(chunk) {
+  const text = String(chunk)
+    .replace(/Bearer\s+\S+/gi, "Bearer [redacted]")
+    .replace(/apiToken\\?":\\?"[^"\\]+/gi, 'apiToken":"[redacted]');
+  login.log = (login.log + text).slice(-8000);
+}
+function loginUrl() {
+  return login.log.match(/https:\/\/\S+/)?.[0]?.replace(/[),.\]]+$/, "") || "";
+}
+function publicLogin() {
+  return {
+    state: login.state,
+    log: login.log,
+    error: login.error,
+    skipped: login.skipped,
+    url: loginUrl(),
+    registered: login.state === "done",
+  };
+}
+export async function cloudflareStatus() {
+  let registered = false,
+    zoneId = null,
+    accountId = null;
+  try {
+    const cert = await readOriginCert();
+    registered = true;
+    zoneId = cert.zoneId;
+    accountId = cert.accountId || null;
+  } catch {
+    registered = false;
+  }
+  return {
+    registered,
+    zone_id: zoneId,
+    account_id: accountId,
+    cert_path: certPath(),
+    tunnels_enabled: process.env.NATIVE_TUNNELS !== "false",
+    api_authorized: accessTokenCurrent(await ensureWranglerToken()),
+    login: registered
+      ? {
+          state: "done",
+          log: "",
+          error: "",
+          skipped: true,
+          url: "",
+          registered: true,
+        }
+      : publicLogin(),
+  };
+}
+async function enableNativeTunnels() {
+  process.env.NATIVE_TUNNELS = "true";
+  const envFile = fileURLToPath(new URL("../../../.env", import.meta.url));
+  try {
+    let text = await readFile(envFile, "utf8");
+    if (/^NATIVE_TUNNELS=/m.test(text))
+      text = text.replace(/^NATIVE_TUNNELS=.*$/m, "NATIVE_TUNNELS=true");
+    else text = `${text.trimEnd()}\nNATIVE_TUNNELS=true\n`;
+    await writeFile(envFile, text);
+  } catch {
+    // This process still publishes tunnels until it restarts.
+  }
+}
+export async function startCloudflareLogin() {
+  try {
+    await readOriginCert();
+    login = {
+      state: "done",
+      log: "Cloudflare is already registered.",
+      error: "",
+      skipped: true,
+    };
+    return { ...publicLogin(), registered: true, skipped: true };
+  } catch {
+    // A missing or unreadable certificate starts the browser login.
+  }
+  if (login.state === "running") return publicLogin();
+  login = {
+    state: "running",
+    log: "Starting cloudflared tunnel login…\n",
+    error: "",
+    skipped: false,
+  };
+  const file = certPath();
+  try {
+    await rename(file, `${file}.invalid`);
+    pushLog("Moved an unreadable certificate aside.\n");
+  } catch {
+    // No previous certificate.
+  }
+  await mkdir(path.dirname(file), { recursive: true });
+  const bin = process.env.CLOUDFLARED_BIN || "cloudflared";
+  child = spawn(bin, ["tunnel", "login"], {
+    env: { ...safeEnvironment(), TUNNEL_ORIGIN_CERT: file },
+    windowsHide: true,
+    shell: false,
+    stdio: ["ignore", "pipe", "pipe"],
+  });
+  child.stdout?.on("data", pushLog);
+  child.stderr?.on("data", pushLog);
+  const timer = setTimeout(() => {
+    child?.kill();
+    if (login.state === "running") {
+      login.state = "error";
+      login.error =
+        "Cloudflare login timed out. Approve the browser prompt and try again.";
+    }
+  }, 5 * 60 * 1000);
+  child.on("error", (error) => {
+    clearTimeout(timer);
+    login.state = "error";
+    login.error =
+      error.code === "ENOENT"
+        ? "cloudflared is not installed. Install it, set CLOUDFLARED_BIN if needed, and restart the agent."
+        : error.message;
+    child = null;
+  });
+  child.on("exit", async () => {
+    clearTimeout(timer);
+    child = null;
+    try {
+      await readOriginCert();
+      await enableNativeTunnels();
+      login.state = "done";
+      login.error = "";
+      pushLog("\nCloudflare account registered.\n");
+    } catch {
+      if (login.state === "running") {
+        login.state = "error";
+        login.error =
+          "Login finished without a certificate. Approve a zone in the browser and try again.";
+      }
+    }
+  });
+  return publicLogin();
+}
+export function cloudflareLoginStatus() {
+  return publicLogin();
+}
+function wranglerAuthPaths() {
+  if (process.env.WRANGLER_AUTH_FILE) return [process.env.WRANGLER_AUTH_FILE];
+  const home = os.homedir();
+  const appData =
+    process.env.APPDATA || path.join(home, "AppData", "Roaming");
+  const xdg = process.env.XDG_CONFIG_HOME || path.join(home, ".config");
+  return [
+    path.join(home, ".wrangler", "config", "default.toml"),
+    path.join(appData, "xdg.config", ".wrangler", "config", "default.toml"),
+    path.join(xdg, ".wrangler", "config", "default.toml"),
+    path.join(xdg, "wrangler", "config", "default.toml"),
+  ];
+}
+function tomlValue(text, key) {
+  const match = text.match(
+    new RegExp(`^${key}\\s*=\\s*"((?:\\\\.|[^"\\\\])*)"`, "m"),
+  );
+  return match ? match[1].replace(/\\"/g, '"') : "";
+}
+function parseScopes(text) {
+  const match = text.match(/^scopes\s*=\s*\[([^\]]*)\]/m);
+  if (!match) return [];
+  return [...match[1].matchAll(/"((?:\\.|[^"\\])*)"/g)].map((item) =>
+    item[1].replace(/\\"/g, '"'),
+  );
+}
+function tomlString(value) {
+  return `"${String(value).replace(/\\/g, "\\\\").replace(/"/g, '\\"')}"`;
+}
+function accessTokenCurrent(auth) {
+  if (!auth?.token) return false;
+  if (!auth.expiration) return true;
+  const when = Date.parse(auth.expiration);
+  if (Number.isNaN(when)) return true;
+  return when - Date.now() > REFRESH_SKEW_MS;
+}
+export async function readWranglerAuth() {
+  for (const file of wranglerAuthPaths()) {
+    let text;
+    try {
+      text = await readFile(file, "utf8");
+    } catch {
+      continue;
+    }
+    const token = tomlValue(text, "oauth_token");
+    if (token.length < 20) continue;
+    return {
+      token,
+      refreshToken: tomlValue(text, "refresh_token"),
+      expiration: tomlValue(text, "expiration_time"),
+      scopes: parseScopes(text),
+      file,
+    };
+  }
+  return null;
+}
+async function writeWranglerAuth(auth) {
+  const scopes = (auth.scopes.length ? auth.scopes : ["offline_access"])
+    .map((scope) => tomlString(scope))
+    .join(", ");
+  const text = [
+    `oauth_token = ${tomlString(auth.token)}`,
+    `expiration_time = ${tomlString(auth.expiration)}`,
+    `refresh_token = ${tomlString(auth.refreshToken)}`,
+    `scopes = [ ${scopes} ]`,
+    "",
+  ].join("\n");
+  const temporary = `${auth.file}.${process.pid}.tmp`;
+  await writeFile(temporary, text, "utf8");
+  try {
+    await copyFile(temporary, auth.file);
+  } finally {
+    await rm(temporary, { force: true });
+  }
+}
+async function refreshAndStore(auth, fetchImpl) {
+  if (Date.now() < refreshFailureUntil) return auth;
+  let response;
+  try {
+    response = await fetchImpl(WRANGLER_TOKEN_URL, {
+      method: "POST",
+      headers: { "Content-Type": "application/x-www-form-urlencoded" },
+      body: new URLSearchParams({
+        grant_type: "refresh_token",
+        refresh_token: auth.refreshToken,
+        client_id: WRANGLER_CLIENT_ID,
+      }),
+      signal: AbortSignal.timeout(20000),
+    });
+  } catch {
+    refreshFailureUntil = Date.now() + 60_000;
+    return auth;
+  }
+  const data = await response.json().catch(() => ({}));
+  if (
+    !response.ok ||
+    data.error ||
+    typeof data.access_token !== "string" ||
+    data.access_token.length < 20
+  ) {
+    refreshFailureUntil = Date.now() + 60_000;
+    return auth;
+  }
+  const next = {
+    token: data.access_token,
+    refreshToken:
+      typeof data.refresh_token === "string" && data.refresh_token.length >= 20
+        ? data.refresh_token
+        : auth.refreshToken,
+    expiration: new Date(
+      Date.now() + Number(data.expires_in || 3600) * 1000,
+    ).toISOString(),
+    scopes:
+      typeof data.scope === "string" && data.scope.trim()
+        ? data.scope.split(" ").filter(Boolean)
+        : auth.scopes,
+    file: auth.file,
+  };
+  try {
+    await writeWranglerAuth(next);
+  } catch {
+    refreshFailureUntil = Date.now() + 60_000;
+    return auth;
+  }
+  refreshFailureUntil = 0;
+  return next;
+}
+export async function ensureWranglerToken(fetchImpl = fetch, { force = false } = {}) {
+  const auth = await readWranglerAuth();
+  if (!auth) return null;
+  if (!force && accessTokenCurrent(auth)) return auth;
+  if (!auth.refreshToken || auth.refreshToken.length < 20) return auth;
+  if (!refreshing)
+    refreshing = refreshAndStore(auth, fetchImpl).finally(() => {
+      refreshing = null;
+    });
+  return refreshing;
+}
+function apiLoginView() {
+  const url =
+    apiLogin.log.match(/https:\/\/\S+/)?.[0]?.replace(/[),.\]]+$/, "") || "";
+  return {
+    state: apiLogin.state,
+    log: apiLogin.log,
+    error: apiLogin.error,
+    skipped: apiLogin.skipped,
+    url,
+    registered: apiLogin.state === "done",
+  };
+}
+function pushApiLog(chunk) {
+  const text = String(chunk)
+    .replace(/Bearer\s+\S+/gi, "Bearer [redacted]")
+    .replace(/oauth_token\\?":\\?"[^"\\]+/gi, 'oauth_token":"[redacted]');
+  apiLogin.log = (apiLogin.log + text).slice(-8000);
+}
+function wranglerLaunch() {
+  if (process.env.WRANGLER_BIN)
+    return { file: process.env.WRANGLER_BIN, args: ["login"] };
+  const cli = path.join(
+    path.dirname(process.execPath),
+    "node_modules",
+    "npm",
+    "bin",
+    "npx-cli.js",
+  );
+  if (existsSync(cli))
+    return {
+      file: process.execPath,
+      args: [cli, "--yes", "wrangler", "login"],
+    };
+  return {
+    file: process.env.ComSpec || "cmd.exe",
+    args: ["/d", "/s", "/c", "npx", "--yes", "wrangler", "login"],
+  };
+}
+export async function startCloudflareApiLogin() {
+  if (accessTokenCurrent(await ensureWranglerToken())) {
+    apiLogin = {
+      state: "done",
+      log: "Wrangler is already authorized.",
+      error: "",
+      skipped: true,
+    };
+    return { ...apiLoginView(), registered: true, skipped: true };
+  }
+  if (apiLogin.state === "running") return apiLoginView();
+  apiLogin = {
+    state: "running",
+    log: "Starting wrangler login…\n",
+    error: "",
+    skipped: false,
+  };
+  const launch = wranglerLaunch();
+  apiChild = spawn(launch.file, launch.args, {
+    env: safeEnvironment(),
+    windowsHide: true,
+    shell: false,
+    stdio: ["ignore", "pipe", "pipe"],
+  });
+  apiChild.stdout?.on("data", pushApiLog);
+  apiChild.stderr?.on("data", pushApiLog);
+  const timer = setTimeout(() => {
+    apiChild?.kill();
+    if (apiLogin.state === "running") {
+      apiLogin.state = "error";
+      apiLogin.error =
+        "Wrangler login timed out. Approve the browser prompt and try again.";
+    }
+  }, 8 * 60 * 1000);
+  apiChild.on("error", (error) => {
+    clearTimeout(timer);
+    apiLogin.state = "error";
+    apiLogin.error = error.message;
+    apiChild = null;
+  });
+  apiChild.on("exit", async () => {
+    clearTimeout(timer);
+    apiChild = null;
+    if (await readWranglerAuth()) {
+      apiLogin.state = "done";
+      apiLogin.error = "";
+      pushApiLog("\nCloudflare API authorized.\n");
+    } else if (apiLogin.state === "running") {
+      apiLogin.state = "error";
+      apiLogin.error =
+        "Wrangler login finished without API access. Approve the browser prompt and try again.";
+    }
+  });
+  return apiLoginView();
+}
+export function cloudflareApiLoginStatus() {
+  return apiLoginView();
+}
+async function credentials(purpose = "dns") {
+  let cert;
+  try {
+    cert = await readOriginCert();
+  } catch {
+    throw Object.assign(
+      Error("Connect Cloudflare with cloudflared tunnel login first"),
+      { status: 400 },
+    );
+  }
+  const zoneFromEnv = process.env.CLOUDFLARE_ZONE_ID || "";
+  const zoneId = cfId.test(zoneFromEnv) ? zoneFromEnv : cert.zoneId;
+  if (purpose === "email") {
+    const wrangler = await ensureWranglerToken();
+    const envToken = process.env.CLOUDFLARE_API_TOKEN || "";
+    const token =
+      (accessTokenCurrent(wrangler) ? wrangler.token : "") ||
+      (envToken.length >= 20 ? envToken : "") ||
+      wrangler?.token ||
+      "";
+    if (!token)
+      throw Object.assign(
+        Error(
+          "Authorize the Cloudflare API with Wrangler. The CLI login opens a browser and does not need CLOUDFLARE_API_TOKEN.",
+        ),
+        { status: 403, needsApiLogin: true },
+      );
+    return { token, zoneId, accountId: cert.accountId };
+  }
+  return { token: cert.apiToken, zoneId, accountId: cert.accountId };
+}
+export async function deleteTunnelCname(subdomain, tunnelId) {
+  const { token, zoneId } = await credentials("dns");
+  const base = `https://api.cloudflare.com/client/v4/zones/${zoneId}/dns_records`;
+  const call = async (url, method = "GET") => {
+    const response = await fetch(url, {
+      method,
+      headers: { Authorization: `Bearer ${token}` },
+      signal: AbortSignal.timeout(15000),
+    });
+    const data = await response.json().catch(() => ({}));
+    if (!response.ok || data.success === false)
+      throw Error("Cloudflare DNS cleanup failed");
+    return data.result;
+  };
+  for (const record of await call(
+    `${base}?name=${encodeURIComponent(subdomain)}&type=CNAME`,
+  ))
+    if (record.content === `${tunnelId}.cfargotunnel.com`)
+      await call(`${base}/${record.id}`, "DELETE");
+}
+async function cf(pathname, options = {}) {
+  const { method = "GET", body, query, purpose = "dns" } = options;
+  const { token } = await credentials(purpose);
+  const url = new URL(`https://api.cloudflare.com/client/v4${pathname}`);
+  for (const [key, value] of Object.entries(query || {}))
+    if (value != null && value !== "") url.searchParams.set(key, String(value));
+  let response;
+  try {
+    response = await fetch(url, {
+      method,
+      headers: {
+        Authorization: `Bearer ${token}`,
+        "Content-Type": "application/json",
+      },
+      body: body == null ? undefined : JSON.stringify(body),
+      signal: AbortSignal.timeout(20000),
+    });
+  } catch {
+    throw Object.assign(Error("Cloudflare API is unreachable"), { status: 502 });
+  }
+  const data = await response.json().catch(() => ({}));
+  if (
+    response.status === 401 &&
+    purpose === "email" &&
+    !options.retried
+  ) {
+    const renewed = await ensureWranglerToken(fetch, { force: true });
+    if (renewed?.token && renewed.token !== token)
+      return cf(pathname, { ...options, retried: true });
+  }
+  if (!response.ok || data.success === false) {
+    let message =
+      data.errors?.[0]?.message || `Cloudflare API returned ${response.status}`;
+    if (response.status === 401 || response.status === 403)
+      message +=
+        ". Authorize with Wrangler from the Email screen. That CLI login does not use an API token in .env.";
+    throw Object.assign(Error(message), {
+      status: response.status === 401 || response.status === 403 ? 403 : 502,
+    });
+  }
+  return data;
+}
+function recordView(record) {
+  return {
+    id: record.id,
+    type: record.type,
+    name: record.name,
+    content: record.content,
+    ttl: record.ttl,
+    proxied: Boolean(record.proxied),
+    proxiable: Boolean(record.proxiable),
+    priority: record.priority ?? null,
+    comment: record.comment || "",
+    tags: record.tags || [],
+    locked: Boolean(record.locked),
+    created_on: record.created_on || null,
+    modified_on: record.modified_on || null,
+  };
+}
+export function assertCfId(id) {
+  if (!cfId.test(id || ""))
+    throw Object.assign(Error("Invalid Cloudflare identifier"), { status: 400 });
+  return id;
+}
+export async function listDns() {
+  const { zoneId } = await credentials();
+  const zone = await cf(`/zones/${zoneId}`);
+  const records = [];
+  for (let page = 1; page <= 20; page++) {
+    const data = await cf(`/zones/${zoneId}/dns_records`, {
+      query: { page, per_page: 100 },
+    });
+    records.push(...(data.result || []).map(recordView));
+    if (!data.result_info || page >= data.result_info.total_pages) break;
+  }
+  return {
+    zone: {
+      id: zone.result.id,
+      name: zone.result.name,
+      status: zone.result.status,
+    },
+    records,
+  };
+}
+export async function getDnsRecord(id) {
+  assertCfId(id);
+  const { zoneId } = await credentials();
+  return recordView((await cf(`/zones/${zoneId}/dns_records/${id}`)).result);
+}
+export async function updateDnsRecord(id, input) {
+  assertCfId(id);
+  const name = String(input?.name || "").trim();
+  const content = String(input?.content ?? "").trim();
+  const ttl = Number(input?.ttl);
+  if (!name || name.length > 253 || /[^a-z0-9._@*-]/i.test(name))
+    throw Object.assign(Error("Enter a valid record name"), { status: 400 });
+  if (!content || content.length > 4096)
+    throw Object.assign(Error("Enter record content"), { status: 400 });
+  if (!(ttl === 1 || (Number.isInteger(ttl) && ttl >= 60 && ttl <= 86400)))
+    throw Object.assign(
+      Error("TTL must be Auto or between 60 and 86400 seconds"),
+      { status: 400 },
+    );
+  const current = await getDnsRecord(id);
+  if (current.locked)
+    throw Object.assign(Error("This DNS record is locked"), { status: 400 });
+  const body = {
+    type: current.type,
+    name,
+    content,
+    ttl,
+    comment: String(input?.comment || "").slice(0, 500),
+  };
+  if (current.proxiable) body.proxied = Boolean(input?.proxied);
+  if (["MX", "SRV", "URI"].includes(current.type)) {
+    const priority = Number(input?.priority);
+    if (!Number.isInteger(priority) || priority < 0 || priority > 65535)
+      throw Object.assign(Error("Enter a priority from 0 to 65535"), {
+        status: 400,
+      });
+    body.priority = priority;
+  }
+  const { zoneId } = await credentials();
+  return recordView(
+    (
+      await cf(`/zones/${zoneId}/dns_records/${id}`, {
+        method: "PUT",
+        body,
+      })
+    ).result,
+  );
+}
+function withMailbox(input) {
+  if (!input || input.matcher === "all") return input;
+  if (input.local == null && input.domain == null) return input;
+  const local = String(input.local || "")
+    .trim()
+    .toLowerCase();
+  const domain = String(input.domain || "")
+    .trim()
+    .toLowerCase();
+  if (!/^[a-z0-9](?:[a-z0-9._+-]*[a-z0-9])?$/i.test(local))
+    throw Object.assign(Error("Enter the mailbox name"), { status: 400 });
+  if (!/^[a-z0-9.-]+\.[a-z]{2,}$/i.test(domain))
+    throw Object.assign(Error("Choose a domain"), { status: 400 });
+  return { ...input, custom_address: `${local}@${domain}`, domain };
+}
+function addressDomain(value) {
+  const address = String(value || "").toLowerCase();
+  const at = address.lastIndexOf("@");
+  return at === -1 ? "" : address.slice(at + 1);
+}
+async function zoneForDomain(domain) {
+  const { zoneId } = await credentials("email");
+  if (!domain) return zoneId;
+  const current = await cf(`/zones/${zoneId}`, { purpose: "email" });
+  if (current.result?.name?.toLowerCase() === domain) return zoneId;
+  const listed = await cf("/zones", {
+    query: { name: domain, per_page: 20 },
+    purpose: "email",
+  });
+  const match = (listed.result || []).find(
+    (zone) => zone.name?.toLowerCase() === domain,
+  );
+  if (!match)
+    throw Object.assign(Error("Choose a domain on this Cloudflare account"), {
+      status: 400,
+    });
+  return match.id;
+}
+async function emailDomains(zoneId, currentName) {
+  const domains = [];
+  try {
+    const listed = await cf("/zones", {
+      query: { per_page: 50, status: "active" },
+      purpose: "email",
+    });
+    for (const zone of listed.result || [])
+      if (zone?.name && cfId.test(zone.id)) domains.push(zone.name);
+  } catch {
+    /* The connected zone is still shown when the account list is unavailable. */
+  }
+  if (currentName && !domains.some((name) => name.toLowerCase() === currentName.toLowerCase()))
+    domains.unshift(currentName);
+  const names = [...new Set(domains.map((name) => name.toLowerCase()))];
+  names.sort((a, b) => a.localeCompare(b));
+  const current = currentName.toLowerCase();
+  if (names.includes(current)) {
+    names.splice(names.indexOf(current), 1);
+    names.unshift(current);
+  }
+  return names;
+}
+function ruleView(rule) {
+  const matcher = rule.matchers?.[0] || {};
+  const action = rule.actions?.[0] || {};
+  return {
+    id: rule.id,
+    name: rule.name || "",
+    enabled: Boolean(rule.enabled),
+    matcher: matcher.type || "",
+    custom_address: matcher.value || "",
+    action: action.type || "",
+    destination: Array.isArray(action.value) ? action.value[0] || "" : "",
+    priority: rule.priority ?? 0,
+  };
+}
+function ruleBody(input) {
+  const name = String(input?.name || "").trim();
+  const matcher = input?.matcher === "all" ? "all" : "literal";
+  const action = input?.action === "drop" ? "drop" : "forward";
+  const custom = String(input?.custom_address || "")
+    .trim()
+    .toLowerCase();
+  const destination = String(input?.destination || "")
+    .trim()
+    .toLowerCase();
+  if (name.length < 1 || name.length > 80)
+    throw Object.assign(Error("Enter a rule name"), { status: 400 });
+  if (matcher === "literal" && !emailPattern.test(custom))
+    throw Object.assign(Error("Enter the custom address to match"), {
+      status: 400,
+    });
+  if (action === "forward" && !emailPattern.test(destination))
+    throw Object.assign(Error("Enter a destination address"), { status: 400 });
+  return {
+    name,
+    enabled: input?.enabled !== false,
+    matchers:
+      matcher === "all"
+        ? [{ type: "all" }]
+        : [{ type: "literal", field: "to", value: custom }],
+    actions:
+      action === "drop"
+        ? [{ type: "drop" }]
+        : [{ type: "forward", value: [destination] }],
+  };
+}
+export async function emailOverview() {
+  const { zoneId, accountId } = await credentials("email");
+  const settings = await cf(`/zones/${zoneId}/email/routing`, {
+    purpose: "email",
+  });
+  const rules = await cf(`/zones/${zoneId}/email/routing/rules`, {
+    query: { per_page: 50 },
+    purpose: "email",
+  });
+  let addresses = [],
+    address_error = "";
+  if (accountId) {
+    try {
+      addresses =
+        (await cf(`/accounts/${accountId}/email/routing/addresses`, {
+          purpose: "email",
+        })).result ||
+        [];
+    } catch (error) {
+      address_error = error.message;
+    }
+  } else
+    address_error =
+      "This certificate has no account id, so destination addresses cannot be listed.";
+  return {
+    zone: settings.result?.name || "",
+    domains: await emailDomains(zoneId, settings.result?.name || ""),
+    settings: {
+      enabled: Boolean(settings.result?.enabled),
+      status: settings.result?.status || "unknown",
+      name: settings.result?.name || "",
+      support_subaddress: Boolean(settings.result?.support_subaddress),
+    },
+    rules: (rules.result || []).map(ruleView),
+    addresses: addresses.map((item) => ({
+      id: item.id,
+      email: item.email,
+      verified: item.verified || null,
+    })),
+    address_error,
+  };
+}
+export async function setEmailRouting(enabled) {
+  const { zoneId } = await credentials("email");
+  const data = await cf(
+    `/zones/${zoneId}/email/routing/${enabled ? "enable" : "disable"}`,
+    { method: "POST", purpose: "email" },
+  );
+  return {
+    enabled: Boolean(data.result?.enabled),
+    status: data.result?.status || "",
+  };
+}
+export async function createEmailRule(input) {
+  const next = withMailbox(input);
+  const body = ruleBody(next);
+  const zoneId = await zoneForDomain(
+    next.domain || addressDomain(body.matchers?.[0]?.value),
+  );
+  return ruleView(
+    (
+      await cf(`/zones/${zoneId}/email/routing/rules`, {
+        method: "POST",
+        body,
+        purpose: "email",
+      })
+    )
+      .result,
+  );
+}
+export async function updateEmailRule(id, input) {
+  assertCfId(id);
+  const body = ruleBody(input);
+  const zoneId = await zoneForDomain(addressDomain(body.matchers?.[0]?.value));
+  return ruleView(
+    (
+      await cf(`/zones/${zoneId}/email/routing/rules/${id}`, {
+        method: "PUT",
+        body,
+        purpose: "email",
+      })
+    ).result,
+  );
+}
+export async function deleteEmailRule(id, domain = "") {
+  assertCfId(id);
+  const zoneId = await zoneForDomain(String(domain || "").toLowerCase());
+  await cf(`/zones/${zoneId}/email/routing/rules/${id}`, {
+    method: "DELETE",
+    purpose: "email",
+  });
+  return { ok: true };
+}
+export async function addDestination(email) {
+  const address = String(email || "")
+    .trim()
+    .toLowerCase();
+  if (!emailPattern.test(address))
+    throw Object.assign(Error("Enter a valid email"), { status: 400 });
+  const { accountId } = await credentials("email");
+  if (!accountId)
+    throw Object.assign(
+      Error("Account id is missing from the Cloudflare certificate"),
+      { status: 400 },
+    );
+  const data = await cf(`/accounts/${accountId}/email/routing/addresses`, {
+    method: "POST",
+    body: { email: address },
+    purpose: "email",
+  });
+  return {
+    id: data.result?.id,
+    email: data.result?.email,
+    verified: data.result?.verified || null,
+  };
+}
+export async function deleteDestination(id) {
+  assertCfId(id);
+  const { accountId } = await credentials("email");
+  if (!accountId)
+    throw Object.assign(
+      Error("Account id is missing from the Cloudflare certificate"),
+      { status: 400 },
+    );
+  await cf(`/accounts/${accountId}/email/routing/addresses/${id}`, {
+    method: "DELETE",
+    purpose: "email",
+  });
+  return { ok: true };
+}