@omega.js/manager 0.1.0

package/dist/services/edge/ensure/dns-records.js

@@ -0,0 +1,304 @@
+/**
+ * Ensure DNS records match `edge.providers.cloudflare.dns` plus the platform record set
+ * (GitHub Pages, www, email-provider MX/SPF, DMARC; BIMI only when
+ * configured — see lib/dns-records-helpers.js).
+ *
+ * Subdomain projects only touch records belonging to the subdomain (apex
+ * records are owned by the parent brand).
+ *
+ * The whole SendGrid set is not config at all — this handler asks SendGrid
+ * before it diffs: `GET /v3/whitelabel/domains` for the `u<id>.<whitelabel>`
+ * host the domain-auth records are built from ([#692]), and
+ * `GET /v3/whitelabel/links` for whether `emailurl.<domain>` may be proxied
+ * yet ([#646]).
+ */
+const chalk = require('chalk').default;
+const { pollWithSpinner } = require('../../../vendor/devkit/flows.js');
+const { cacheRead } = require('../lib/read-cache.js');
+const { getZoneId, zoneGate } = require('../lib/ruleset-helper.js');
+const { diffRecords } = require('../lib/dns-records-helpers.js');
+const { SendGridAPI } = require('../../campaigns/lib/sendgrid-api.js');
+const { canPrompt, dryRunPlan } = require('../../../lib/run-gates.js');
+
+const LINK_BRANDING_PENDING_REASON = 'SendGrid has not validated the branded link — the emailurl CNAME stays unproxied';
+
+module.exports = async function ensureDnsRecords(context) {
+  const { cloudflareApi: api, brandRoot, brandConfig, domain, isSubdomainProject, options = {} } = context;
+  const zoneId = getZoneId(context);
+  const gated = zoneGate(context, 'dnsRecords');
+  if (gated) return gated;
+
+  // === READ ===
+  const data = await api.makeRequest(`/zones/${zoneId}/dns_records`);
+  const records = data.result;
+  console.log(`      ${chalk.green('✓')} Read ${chalk.dim(`(${records.length} items)`)}`);
+  cacheRead(brandRoot, 'dns-records', { count: records.length, records });
+
+  // === DIFF ===
+  // Tests inject a fake client via context.sendgridApi
+  const sendgridApi = context.sendgridApi || (process.env.SENDGRID_API_KEY ? new SendGridAPI() : null);
+  const sendgrid = await resolveDomainAuth(context, sendgridApi);
+  const { valid: linkBrandingValid, pending: linkBrandingPending } = await resolveLinkBranding(context, sendgridApi, sendgrid);
+  const diff = diffRecords({ records, brandConfig, domain, isSubdomainProject, sendgrid, linkBrandingValid });
+  if (!diff) {
+    console.log(`      ${chalk.dim('⊘ No changes needed')}`);
+    if (linkBrandingPending) {
+      return { status: 'warned', reason: LINK_BRANDING_PENDING_REASON };
+    }
+    return;
+  }
+
+  if (options.dryRun) {
+    // The SendGrid host is READ, never written, so a dry run reads it too and
+    // names what it found — the plan covers the same records a real run does
+    // ([#692](https://github.com/Omega-JS-Stack/omega/issues/692)).
+    const sendgridPlan = sendgrid ? ` (SendGrid domain auth read live: u${sendgrid.id}.${sendgrid.whitelabel}.sendgrid.net)` : '';
+    dryRunPlan(`create ${diff.toCreate.length}, update ${diff.toUpdate.length}, delete ${diff.toDelete.length}${sendgridPlan}`);
+    return {
+      status: 'success',
+      output: { dns: { planned: { create: diff.toCreate.length, update: diff.toUpdate.length, delete: diff.toDelete.length } } },
+    };
+  }
+
+  // === WRITE ===
+  const output = { created: [], updated: [], deleted: [], errors: [] };
+
+  for (const record of diff.toCreate) {
+    try {
+      await api.makeRequest(`/zones/${zoneId}/dns_records`, {
+        method: 'POST',
+        body: JSON.stringify({
+          type: record.type,
+          name: record.name,
+          content: record.content,
+          ttl: record.ttl || 1,
+          proxied: record.proxied ?? false,
+          priority: record.priority,
+          comment: record.comment,
+        }),
+      });
+      output.created.push({ name: record.name, type: record.type });
+      console.log(`      ${chalk.green('✓')} Created ${chalk.cyan(`${record.type} ${record.name}`)}`);
+    } catch (error) {
+      output.errors.push({ name: record.name, type: record.type, error: error.message });
+      console.error(`      ${chalk.red('✗')} Failed to create ${chalk.cyan(`${record.type} ${record.name}`)}${chalk.dim(`: ${error.message}`)}`);
+    }
+  }
+
+  for (const record of diff.toUpdate) {
+    try {
+      await api.makeRequest(`/zones/${zoneId}/dns_records/${record.id}`, {
+        method: 'PATCH',
+        body: JSON.stringify({
+          type: record.type,
+          name: record.name,
+          content: record.content,
+          ttl: record.ttl,
+          proxied: record.proxied,
+          comment: record.comment,
+          priority: record.priority,
+        }),
+      });
+      output.updated.push({ name: record.name, type: record.type });
+      console.log(`      ${chalk.green('✓')} Updated ${chalk.cyan(`${record.type} ${record.name}`)}`);
+    } catch (error) {
+      output.errors.push({ name: record.name, type: record.type, error: error.message });
+      console.error(`      ${chalk.red('✗')} Failed to update ${chalk.cyan(`${record.type} ${record.name}`)}${chalk.dim(`: ${error.message}`)}`);
+    }
+  }
+
+  for (const record of diff.toDelete) {
+    try {
+      await api.makeRequest(`/zones/${zoneId}/dns_records/${record.id}`, { method: 'DELETE' });
+      output.deleted.push({ name: record.name, type: record.type, content: record.content });
+      console.log(`      ${chalk.green('✓')} Deleted ${chalk.cyan(`${record.type} ${record.name}`)} (${chalk.dim(record.content)})`);
+    } catch (error) {
+      output.errors.push({ name: record.name, type: record.type, error: error.message });
+      console.error(`      ${chalk.red('✗')} Failed to delete ${chalk.cyan(`${record.type} ${record.name}`)}${chalk.dim(`: ${error.message}`)}`);
+    }
+  }
+
+  const parts = [];
+  if (output.created.length > 0) parts.push(`${chalk.bold(output.created.length)} created`);
+  if (output.updated.length > 0) parts.push(`${chalk.bold(output.updated.length)} updated`);
+  if (output.deleted.length > 0) parts.push(`${chalk.bold(output.deleted.length)} deleted`);
+  if (output.errors.length > 0) parts.push(`${chalk.bold(output.errors.length)} errors`);
+  if (parts.length > 0) {
+    console.log(`      Summary: ${parts.join(', ')}`);
+  }
+
+  const reasons = [];
+  if (output.errors.length > 0) {
+    reasons.push(`${output.errors.length} record(s) failed: ${output.errors.map((e) => e.name).join(', ')}`);
+  }
+  if (linkBrandingPending) {
+    reasons.push(LINK_BRANDING_PENDING_REASON);
+  }
+
+  return {
+    status: reasons.length > 0 ? 'warned' : 'success',
+    ...(reasons.length > 0 ? { reason: reasons.join('; ') } : {}),
+    output: { dns: output },
+  };
+};
+
+/**
+ * The `u<id>.<whitelabel>` host every SendGrid domain-auth record is built
+ * from, read LIVE off the account.
+ *
+ * These are SendGrid's OWN observed facts about the domain, not choices a
+ * brand makes, so they are referenced at the source instead of copied into
+ * config — a `dns.sendgrid` block drifts the moment the account
+ * re-authenticates the domain, and nothing ever wrote it back
+ * ([#692](https://github.com/Omega-JS-Stack/omega/issues/692)).
+ * `GET /v3/whitelabel/domains` answers with the authentication's own record
+ * set, whose `mail_cname` points at exactly the host the record builder
+ * rebuilds (`u<id>.<whitelabel>.sendgrid.net`).
+ *
+ * Every no-answer SKIPS the SendGrid records and says why: no key, no
+ * authentication for this domain (the campaigns service creates it), an
+ * unreachable API, or a host shape this parser does not know. A subdomain
+ * project has no SendGrid records to build at all — the apex record set
+ * belongs to the parent brand — so it never asks.
+ *
+ * @param {object} context - The service context
+ * @param {object|null} api - The SendGrid client (null without an API key)
+ * @returns {Promise<{ id: string, whitelabel: string }|null>}
+ */
+async function resolveDomainAuth({ domain, isSubdomainProject }, api) {
+  if (isSubdomainProject) return null;
+
+  if (!api) {
+    console.log(`      ${chalk.yellow('⚠')} SendGrid records skipped — no ${chalk.cyan('SENDGRID_API_KEY')} to read the domain authentication with`);
+    return null;
+  }
+
+  let domains;
+  try {
+    domains = await api.getAuthenticatedDomains();
+  } catch (error) {
+    console.log(`      ${chalk.yellow('⚠')} SendGrid records skipped — could not read the domain authentication${chalk.dim(`: ${error.message}`)}`);
+    return null;
+  }
+
+  const auth = (domains || []).find((entry) => (entry.domain || '').toLowerCase() === domain.toLowerCase());
+  if (!auth) {
+    console.log(`      ${chalk.yellow('⚠')} SendGrid records skipped — no authenticated domain for ${chalk.cyan(domain)} in SendGrid (the campaigns service creates it)`);
+    return null;
+  }
+
+  const host = auth.dns?.mail_cname?.data;
+  const parsed = /^u([^.]+)\.([^.]+)\.sendgrid\.net$/i.exec(host || '');
+  if (!parsed) {
+    console.log(`      ${chalk.yellow('⚠')} SendGrid records skipped — domain-auth host ${chalk.cyan(host || '(none)')} is not ${chalk.dim('u<id>.<whitelabel>.sendgrid.net')}`);
+    return null;
+  }
+
+  return { id: parsed[1], whitelabel: parsed[2] };
+}
+
+/**
+ * Has SendGrid VALIDATED the branded link host for this brand's domain?
+ *
+ * SendGrid validates `emailurl.<domain>` by resolving it as a CNAME to
+ * sendgrid.net, and a Cloudflare-proxied record answers with the edge's own
+ * addresses instead — so proxying it BEFORE validation locks the branding out
+ * of ever validating, and every emailed link stays broken. This is the read
+ * that keeps the flip in order: grey-cloud until `GET /v3/whitelabel/links`
+ * reports `valid: true` for the host
+ * ([#646](https://github.com/Omega-JS-Stack/omega/issues/646)).
+ *
+ * An interactive run WAITS for that answer rather than leaving the flip to a
+ * later walk ([#662](https://github.com/Omega-JS-Stack/omega/issues/662)):
+ * `pollWithSpinner` re-asks SendGrid until the branding validates and the
+ * diff below proxies the CNAME in this same walk. Skipping the wait (or a
+ * non-interactive run) keeps the record grey and the rerun message.
+ *
+ * An unreachable SendGrid answers NO: the unproxied record is the safe half of
+ * the pair (a plain-HTTP hop, which is where every brand already is), while a
+ * wrong YES is unrecoverable without a hand edit. No API key never reaches
+ * here — the domain-auth read skipped the whole set first.
+ *
+ * NO ENTRY is the one NO that is not pending: the campaigns service creates
+ * the branding later in this same walk
+ * ([#693](https://github.com/Omega-JS-Stack/omega/issues/693)), so waiting on
+ * it here would never end. That case says so and moves on.
+ *
+ * @param {object} context - The service context
+ * @param {object|null} api - The SendGrid client (null without an API key)
+ * @param {object|null} sendgrid - The live domain-auth values, when there are
+ *   SendGrid records to gate at all
+ * @returns {Promise<{ valid: boolean, pending: boolean }>} - `pending` is a
+ *   live branding that did not validate: the warned reason's condition.
+ */
+async function resolveLinkBranding(context, api, sendgrid) {
+  const { domain, options = {} } = context;
+
+  // No SendGrid records to gate: the domain-auth read found none (and already
+  // said why), or a subdomain project, whose record set stops at the GitHub
+  // Pages pair (the apex belongs to the parent).
+  if (!sendgrid) {
+    return { valid: false, pending: false };
+  }
+
+  const host = `emailurl.${domain}`;
+
+  const branding = await readBrandedLink(api, host, true);
+
+  // Nothing to WAIT for HERE: the account has no link branding for this host
+  // yet, and the campaigns service creates it LATER IN THIS SAME WALK
+  // ([#693](https://github.com/Omega-JS-Stack/omega/issues/693)) — waiting on
+  // it before that would never end. The record still lands (grey), which is
+  // exactly the state SendGrid validates against.
+  if (branding === null) {
+    console.log(`      ${chalk.yellow('⚠')} ${chalk.cyan(`CNAME ${host}`)} stays unproxied — SendGrid has no link branding for that host yet. The campaigns service creates and validates it later in this run (when campaigns is enabled for this brand), then flips ${chalk.cyan(`CNAME ${host}`)} to proxied.`);
+    return { valid: false, pending: false };
+  }
+
+  let valid = branding?.valid === true;
+
+  // Wait it out: SendGrid validates minutes after the CNAME lands, and the
+  // proxy flip belongs to THIS walk (#662). Ticks stay quiet — the first read
+  // already reported an unreachable API.
+  if (!valid && canPrompt(options)) {
+    const result = await pollWithSpinner({
+      check: async () => ((await readBrandedLink(api, host))?.valid === true ? { done: true } : { done: false }),
+      intervalMs: 10000,
+      message: `Waiting for SendGrid to validate ${host}`,
+      indent: '      ',
+    });
+    valid = result.success;
+  }
+
+  if (!valid) {
+    console.log(`      ${chalk.yellow('⚠')} ${chalk.cyan(`CNAME ${host}`)} stays unproxied — SendGrid has not validated the branded link. Rerun ${chalk.cyan('omega manage')} once it has, and the record flips to proxied so emailed links land on HTTPS.`);
+  }
+
+  return { valid, pending: !valid };
+}
+
+/**
+ * One read of SendGrid's branded-link list: this host's entry.
+ *
+ * The caller needs all three answers apart, because only ONE of them is worth
+ * waiting on: an entry that exists and is not valid yet is minutes away, while
+ * a missing entry arrives from the campaigns service later in the walk, not
+ * from any wait here.
+ *
+ * @param {object} api - The SendGrid client
+ * @param {string} host - The branded link host (`emailurl.<domain>`)
+ * @param {boolean} [logError] - Report an unreachable API (the first read only)
+ * @returns {Promise<object|null|undefined>} The branding entry; `null` when the
+ *   account has none for this host; `undefined` when the read itself failed.
+ */
+async function readBrandedLink(api, host, logError = false) {
+  try {
+    const links = await api.getBrandedLinks();
+    return (links || []).find((link) => `${link.subdomain}.${link.domain}`.toLowerCase() === host.toLowerCase()) || null;
+  } catch (error) {
+    if (logError) {
+      console.log(`      ${chalk.yellow('⚠')} Could not read SendGrid link branding${chalk.dim(`: ${error.message}`)}`);
+    }
+    return undefined;
+  }
+}

package/dist/services/edge/ensure/email-routing.js

@@ -0,0 +1,292 @@
+/**
+ * Ensure Cloudflare Email Routing is enabled and forwarding rules are synced.
+ *
+ * Only runs when domain.email.providers names cloudflare; rules come from
+ * domain.email.forwarding [{ from: 'support' | '*', to: 'inbox@…' }].
+ *
+ * Unverified destination addresses: a verification email is sent; interactive
+ * runs open the dashboard and retry the rule write until the address verifies,
+ * non-interactive/dry runs return warned with the dashboard URL — rerun after
+ * verifying.
+ */
+const chalk = require('chalk').default;
+const { openBrowserAndPoll } = require('../../../vendor/devkit/flows.js');
+const { cacheRead } = require('../lib/read-cache.js');
+const { getZoneId, zoneGate } = require('../lib/ruleset-helper.js');
+const { resolveEmailProvider } = require('../../domain/lib/registrars.js');
+const { canPrompt, dryRunPlan } = require('../../../lib/run-gates.js');
+
+function isUnverifiedError(error) {
+  return error.message.includes('2054') || error.message.toLowerCase().includes('not verified');
+}
+
+async function getAccountId(api, zoneId) {
+  const zone = await api.makeRequest(`/zones/${zoneId}`);
+  return zone.result.account.id;
+}
+
+/**
+ * Send a verification email for the destination; interactive runs then open
+ * the dashboard and retry the rule write until the address verifies.
+ *
+ * @returns {boolean} - true when the rule landed after verification
+ */
+async function handleUnverified(api, zoneId, destination, retryWrite, options = {}) {
+  console.log(`      ${chalk.yellow('⚠')} Destination ${chalk.cyan(destination)} is not verified in Cloudflare`);
+
+  const accountId = await getAccountId(api, zoneId);
+  try {
+    await api.makeRequest(`/accounts/${accountId}/email/routing/addresses`, {
+      method: 'POST',
+      body: JSON.stringify({ email: destination }),
+    });
+    console.log(`      ${chalk.dim('→')} Verification email sent to ${chalk.cyan(destination)}`);
+  } catch (verifyError) {
+    if (verifyError.message.includes('already exists')) {
+      console.log(`      ${chalk.dim('→')} Verification already pending for ${chalk.cyan(destination)}`);
+    } else {
+      console.log(`      ${chalk.yellow('⚠')} Could not send verification email${chalk.dim(`: ${verifyError.message}`)}`);
+    }
+  }
+
+  const dashboardUrl = `https://dash.cloudflare.com/${accountId}/email-routing/destination-addresses`;
+
+  if (canPrompt(options)) {
+    const result = await openBrowserAndPoll({
+      url: dashboardUrl,
+      label: 'the Cloudflare destination-addresses page',
+      promptMessage: `Verify ${chalk.cyan(destination)} in Cloudflare Email Routing (check the inbox).`,
+      waitMessage: 'Checking verification',
+      indent: '      ',
+      check: async () => {
+        try {
+          await retryWrite();
+          return { done: true };
+        } catch (error) {
+          if (isUnverifiedError(error)) {
+            return { done: false };
+          }
+          return { done: true, error: error.message };
+        }
+      },
+    });
+
+    if (result.success) {
+      console.log(`      ${chalk.green('✓')} Verified — rule created`);
+      return true;
+    }
+    if (result.error) {
+      console.log(`      ${chalk.yellow('⚠')} Rule write failed${chalk.dim(`: ${result.error}`)}`);
+    }
+  }
+
+  console.log(`      ${chalk.dim(`Verify at: ${dashboardUrl} — then rerun`)}`);
+  return false;
+}
+
+module.exports = async function ensureEmailRouting(context) {
+  const { cloudflareApi: api, brandRoot, domain, brandConfig, options = {} } = context;
+  const zoneId = getZoneId(context);
+  const gated = zoneGate(context, 'emailRouting');
+  if (gated) return gated;
+  const emailConfig = brandConfig.domain?.email;
+
+  if (resolveEmailProvider(brandConfig) !== 'cloudflare') {
+    console.log(`      ${chalk.dim('⊘ Email provider is not cloudflare — nothing to route')}`);
+    return;
+  }
+
+  // === READ: routing status ===
+  let routing = null;
+  try {
+    const resp = await api.makeRequest(`/zones/${zoneId}/email/routing`);
+    routing = resp.result;
+  } catch {
+    if (options.dryRun) {
+      return dryRunPlan('enable email routing', { status: 'success', output: { emailRouting: { planned: 'enable' } } });
+    }
+    console.log(`      ${chalk.dim('→')} Enabling email routing...`);
+    await api.makeRequest(`/zones/${zoneId}/email/routing/enable`, { method: 'POST' });
+    const resp = await api.makeRequest(`/zones/${zoneId}/email/routing`);
+    routing = resp.result;
+  }
+
+  if (routing?.enabled) {
+    console.log(`      ${chalk.green('✓')} Email routing enabled`);
+  } else {
+    console.log(`      ${chalk.yellow('⚠')} Email routing not yet active (may need DNS propagation)`);
+  }
+
+  const desiredRules = emailConfig.forwarding || [];
+  if (desiredRules.length === 0) {
+    console.log(`      ${chalk.dim('→')} No forwarding rules configured`);
+    return { output: { emailRouting: { enabled: true, rules: 0 } } };
+  }
+
+  // Split catch-all from regular rules — Cloudflare uses a separate endpoint for catch-all
+  const desiredCatchAll = desiredRules.find((r) => r.from === '*');
+  const desiredRegular = desiredRules.filter((r) => r.from !== '*');
+
+  const existingResp = await api.makeRequest(`/zones/${zoneId}/email/routing/rules`);
+  const existingRules = existingResp.result || [];
+  cacheRead(brandRoot, 'email-routing', { routing, rules: existingRules });
+
+  let created = 0;
+  let updated = 0;
+  let skipped = 0;
+  let deleted = 0;
+  let unverified = 0;
+  let planned = 0;
+
+  // --- Catch-all rule (separate API endpoint) ---
+  if (desiredCatchAll) {
+    const catchAllResp = await api.makeRequest(`/zones/${zoneId}/email/routing/rules/catch_all`);
+    const currentCatchAll = catchAllResp.result;
+    const currentAction = currentCatchAll?.actions?.[0];
+    const alreadyCorrect = currentCatchAll?.enabled
+      && currentAction?.type === 'forward'
+      && currentAction?.value?.[0] === desiredCatchAll.to;
+
+    if (alreadyCorrect) {
+      console.log(`      ${chalk.green('✓')} ${chalk.cyan('*')} → ${chalk.dim(desiredCatchAll.to)}`);
+      skipped++;
+    } else if (options.dryRun) {
+      dryRunPlan(`set catch-all → ${desiredCatchAll.to}`);
+      planned++;
+    } else {
+      console.log(`      ${chalk.dim('→')} Updating catch-all: ${chalk.cyan('*')} → ${chalk.dim(desiredCatchAll.to)}`);
+      const putCatchAll = () => api.makeRequest(`/zones/${zoneId}/email/routing/rules/catch_all`, {
+        method: 'PUT',
+        body: JSON.stringify({
+          matchers: [{ type: 'all' }],
+          actions: [{ type: 'forward', value: [desiredCatchAll.to] }],
+          enabled: true,
+          name: 'Catch-all',
+        }),
+      });
+      try {
+        await putCatchAll();
+        console.log(`      ${chalk.green('✓')} Updated`);
+        updated++;
+      } catch (error) {
+        if (!isUnverifiedError(error)) throw error;
+        const resolved = await handleUnverified(api, zoneId, desiredCatchAll.to, putCatchAll, options);
+        if (resolved) {
+          updated++;
+        } else {
+          unverified++;
+        }
+      }
+    }
+  }
+
+  // --- Regular rules ---
+  for (const desired of desiredRegular) {
+    const matcherValue = `${desired.from}@${domain}`;
+
+    const exists = existingRules.find((rule) => {
+      if (!rule.matchers || !rule.actions) return false;
+      const matcher = rule.matchers[0];
+      const action = rule.actions[0];
+      return matcher.type === 'literal'
+        && matcher.value === matcherValue
+        && action.value?.[0] === desired.to;
+    });
+
+    if (exists) {
+      console.log(`      ${chalk.green('✓')} ${chalk.cyan(matcherValue)} → ${chalk.dim(desired.to)}`);
+      skipped++;
+      continue;
+    }
+
+    if (options.dryRun) {
+      dryRunPlan(`create ${matcherValue} → ${desired.to}`);
+      planned++;
+      continue;
+    }
+
+    console.log(`      ${chalk.dim('→')} Creating rule: ${chalk.cyan(matcherValue)} → ${chalk.dim(desired.to)}`);
+
+    const postRule = () => api.makeRequest(`/zones/${zoneId}/email/routing/rules`, {
+      method: 'POST',
+      body: JSON.stringify({
+        matchers: [{ type: 'literal', field: 'to', value: matcherValue }],
+        actions: [{ type: 'forward', value: [desired.to] }],
+        enabled: true,
+        name: `Forward ${matcherValue}`,
+      }),
+    });
+
+    try {
+      await postRule();
+      console.log(`      ${chalk.green('✓')} Created`);
+      created++;
+    } catch (error) {
+      if (!isUnverifiedError(error)) throw error;
+      const resolved = await handleUnverified(api, zoneId, desired.to, postRule, options);
+      if (resolved) {
+        created++;
+      } else {
+        unverified++;
+      }
+    }
+  }
+
+  // Delete regular rules in Cloudflare that aren't in config (skip catch-all — managed separately)
+  for (const existing of existingRules) {
+    if (!existing.matchers || !existing.actions || !existing.enabled) continue;
+
+    const matcher = existing.matchers[0];
+    const action = existing.actions[0];
+    if (action?.type !== 'forward') continue;
+    if (matcher.type === 'all') continue;
+
+    const isDesired = desiredRegular.some((desired) =>
+      matcher.type === 'literal'
+      && matcher.value === `${desired.from}@${domain}`
+      && action.value?.[0] === desired.to,
+    );
+
+    if (!isDesired) {
+      if (options.dryRun) {
+        dryRunPlan(`remove ${matcher.value} → ${action.value?.[0]}`);
+        planned++;
+        continue;
+      }
+      console.log(`      ${chalk.dim('→')} Removing rule: ${chalk.cyan(matcher.value)} → ${chalk.dim(action.value?.[0])}`);
+      await api.makeRequest(`/zones/${zoneId}/email/routing/rules/${existing.tag}`, { method: 'DELETE' });
+      console.log(`      ${chalk.green('✓')} Removed`);
+      deleted++;
+    }
+  }
+
+  // Disable catch-all if not in config but currently active
+  if (!desiredCatchAll) {
+    const catchAllResp = await api.makeRequest(`/zones/${zoneId}/email/routing/rules/catch_all`);
+    const currentCatchAll = catchAllResp.result;
+    if (currentCatchAll?.enabled && currentCatchAll?.actions?.[0]?.type === 'forward') {
+      if (options.dryRun) {
+        dryRunPlan('disable catch-all (not in config)');
+        planned++;
+      } else {
+        console.log(`      ${chalk.dim('→')} Disabling catch-all (not in config)`);
+        await api.makeRequest(`/zones/${zoneId}/email/routing/rules/catch_all`, {
+          method: 'PUT',
+          body: JSON.stringify({
+            matchers: [{ type: 'all' }],
+            actions: [{ type: 'drop' }],
+            enabled: false,
+          }),
+        });
+        console.log(`      ${chalk.green('✓')} Disabled`);
+        deleted++;
+      }
+    }
+  }
+
+  return {
+    status: unverified > 0 ? 'warned' : 'success',
+    ...(unverified > 0 ? { reason: `${unverified} destination address(es) unverified` } : {}),
+    output: { emailRouting: { enabled: true, created, updated, skipped, deleted, unverified, ...(planned > 0 && { planned }) } },
+  };
+};