@wraps.dev/cli 3.11.0 → 3.11.1

package/dist/cli.js

@@ -24974,668 +24974,147 @@ var init_presets = __esm({
   }
 });
 
-// src/utils/route53.ts
-var route53_exports = {};
-__export(route53_exports, {
-  createDNSRecords: () => createDNSRecords,
-  createSelectedDNSRecords: () => createSelectedDNSRecords,
-  deleteDNSRecords: () => deleteDNSRecords,
-  findHostedZone: () => findHostedZone,
-  mergeSPFRecord: () => mergeSPFRecord,
-  previewDNSChanges: () => previewDNSChanges
+// src/utils/dns/cloudflare.ts
+var cloudflare_exports = {};
+__export(cloudflare_exports, {
+  CloudflareDNSClient: () => CloudflareDNSClient
 });
-import {
-  ChangeResourceRecordSetsCommand,
-  ListHostedZonesByNameCommand,
-  ListResourceRecordSetsCommand,
-  Route53Client
-} from "@aws-sdk/client-route-53";
-async function getExistingTXTRecords(client2, hostedZoneId, domain) {
-  try {
-    const response = await client2.send(
-      new ListResourceRecordSetsCommand({
-        HostedZoneId: hostedZoneId,
-        StartRecordName: domain,
-        StartRecordType: "TXT",
-        MaxItems: 100
-      })
-    );
-    const txtRecordSet = response.ResourceRecordSets?.find(
-      (rs) => rs.Type === "TXT" && (rs.Name === domain || rs.Name === `${domain}.`)
-    );
-    if (!txtRecordSet?.ResourceRecords) {
-      return { allValues: [], spfValue: null, ttl: 1800 };
-    }
-    const allValues = [];
-    let spfValue = null;
-    for (const record of txtRecordSet.ResourceRecords) {
-      const value = record.Value || "";
-      allValues.push(value);
-      const unquoted = value.replace(/^"|"$/g, "");
-      if (unquoted.startsWith("v=spf1")) {
-        spfValue = unquoted;
-      }
-    }
-    return {
-      allValues,
-      spfValue,
-      ttl: txtRecordSet.TTL || 1800
-    };
-  } catch (_error) {
-    return { allValues: [], spfValue: null, ttl: 1800 };
-  }
-}
-function mergeSPFRecord(existingSPF) {
-  const sesInclude = "include:amazonses.com";
-  if (existingSPF.includes(sesInclude)) {
-    return existingSPF;
-  }
-  const allMatch = existingSPF.match(/\s([~+?-]?all)$/);
-  if (allMatch) {
-    const beforeAll = existingSPF.slice(0, allMatch.index);
-    const allPart = allMatch[1];
-    return `${beforeAll} ${sesInclude} ${allPart}`;
-  }
-  return `${existingSPF} ${sesInclude}`;
-}
-async function getExistingRecords(client2, hostedZoneId) {
-  try {
-    const response = await client2.send(
-      new ListResourceRecordSetsCommand({
-        HostedZoneId: hostedZoneId,
-        MaxItems: 500
-      })
-    );
-    return response.ResourceRecordSets || [];
-  } catch (_error) {
-    return [];
-  }
-}
-function findExistingRecord(records, name, type) {
-  const normalizedName = name.endsWith(".") ? name : `${name}.`;
-  return records.find((r6) => r6.Name === normalizedName && r6.Type === type) || null;
-}
-function getRecordValue(record) {
-  if (!record?.ResourceRecords?.length) {
-    return null;
-  }
-  return record.ResourceRecords.map((r6) => r6.Value || "").join(", ");
+function normalizeRecordValue(value) {
+  return value.replace(/^"/, "").replace(/"$/, "").trim();
 }
-async function previewDNSChanges(hostedZoneId, domain, dkimTokens, region, customTrackingDomain, mailFromDomain) {
-  const client2 = new Route53Client({ region });
-  const existingRecords = await getExistingRecords(client2, hostedZoneId);
-  const existingTXT = await getExistingTXTRecords(client2, hostedZoneId, domain);
-  const records = [];
-  for (const token of dkimTokens) {
-    const name = `${token}._domainkey.${domain}`;
-    const proposedValue = `${token}.dkim.amazonses.com`;
-    const existing = findExistingRecord(existingRecords, name, "CNAME");
-    const existingValue = getRecordValue(existing);
-    let status2 = "new";
-    if (existingValue === proposedValue) {
-      status2 = "no_change";
-    } else if (existingValue) {
-      status2 = "update";
-    }
-    records.push({
-      name,
-      type: "CNAME",
-      proposedValue,
-      existingValue,
-      status: status2,
-      category: "dkim"
-    });
-  }
-  const proposedSPF = existingTXT.spfValue ? mergeSPFRecord(existingTXT.spfValue) : "v=spf1 include:amazonses.com ~all";
-  let spfStatus = "new";
-  if (existingTXT.spfValue) {
-    if (existingTXT.spfValue === proposedSPF) {
-      spfStatus = "no_change";
-    } else if (existingTXT.spfValue.includes("include:amazonses.com")) {
-      spfStatus = "no_change";
-    } else {
-      spfStatus = "update";
-    }
-  }
-  records.push({
-    name: domain,
-    type: "TXT",
-    proposedValue: `"${proposedSPF}"`,
-    existingValue: existingTXT.spfValue ? `"${existingTXT.spfValue}"` : null,
-    status: spfStatus,
-    category: "spf",
-    conflictReason: void 0
-  });
-  const dmarcName = `_dmarc.${domain}`;
-  const dmarcRuaDomain = mailFromDomain || domain;
-  const proposedDMARC = `"v=DMARC1; p=quarantine; sp=quarantine; np=reject; rua=mailto:postmaster@${dmarcRuaDomain}"`;
-  const existingDMARC = findExistingRecord(existingRecords, dmarcName, "TXT");
-  const existingDMARCValue = getRecordValue(existingDMARC);
-  let dmarcStatus = "new";
-  let dmarcConflictReason;
-  if (existingDMARCValue) {
-    if (existingDMARCValue === proposedDMARC) {
-      dmarcStatus = "no_change";
-    } else {
-      dmarcStatus = "conflict";
-      dmarcConflictReason = "Existing DMARC policy will be replaced";
-    }
-  }
-  records.push({
-    name: dmarcName,
-    type: "TXT",
-    proposedValue: proposedDMARC,
-    existingValue: existingDMARCValue,
-    status: dmarcStatus,
-    category: "dmarc",
-    conflictReason: dmarcConflictReason
-  });
-  if (customTrackingDomain) {
-    const proposedTracking = `r.${region}.awstrack.me`;
-    const existingTracking = findExistingRecord(
-      existingRecords,
-      customTrackingDomain,
-      "CNAME"
-    );
-    const existingTrackingValue = getRecordValue(existingTracking);
-    let trackingStatus = "new";
-    let trackingConflictReason;
-    if (existingTrackingValue === proposedTracking) {
-      trackingStatus = "no_change";
-    } else if (existingTrackingValue) {
-      trackingStatus = "conflict";
-      trackingConflictReason = `Points to ${existingTrackingValue}, will be replaced`;
-    }
-    records.push({
-      name: customTrackingDomain,
-      type: "CNAME",
-      proposedValue: proposedTracking,
-      existingValue: existingTrackingValue,
-      status: trackingStatus,
-      category: "tracking",
-      conflictReason: trackingConflictReason
-    });
-  }
-  if (mailFromDomain) {
-    const proposedMX = `10 feedback-smtp.${region}.amazonses.com`;
-    const existingMX = findExistingRecord(
-      existingRecords,
-      mailFromDomain,
-      "MX"
-    );
-    const existingMXValue = getRecordValue(existingMX);
-    let mxStatus = "new";
-    if (existingMXValue === proposedMX) {
-      mxStatus = "no_change";
-    } else if (existingMXValue) {
-      mxStatus = "update";
-    }
-    records.push({
-      name: mailFromDomain,
-      type: "MX",
-      proposedValue: proposedMX,
-      existingValue: existingMXValue,
-      status: mxStatus,
-      category: "mailfrom_mx"
-    });
-    const mailFromSPF = '"v=spf1 include:amazonses.com ~all"';
-    const existingMailFromTXT = await getExistingTXTRecords(
-      client2,
-      hostedZoneId,
-      mailFromDomain
-    );
-    let mailFromSpfStatus = "new";
-    if (existingMailFromTXT.spfValue?.includes("include:amazonses.com")) {
-      mailFromSpfStatus = "no_change";
-    } else if (existingMailFromTXT.spfValue) {
-      mailFromSpfStatus = "update";
-    }
-    records.push({
-      name: mailFromDomain,
-      type: "TXT",
-      proposedValue: mailFromSPF,
-      existingValue: existingMailFromTXT.spfValue ? `"${existingMailFromTXT.spfValue}"` : null,
-      status: mailFromSpfStatus,
-      category: "mailfrom_spf"
-    });
+function valuesMatch(type, actual, expected) {
+  const normalizedActual = normalizeRecordValue(actual);
+  const normalizedExpected = normalizeRecordValue(expected);
+  if (type === "MX") {
+    return normalizedActual.toLowerCase() === normalizedExpected.toLowerCase();
   }
-  const conflictCount = records.filter((r6) => r6.status === "conflict").length;
-  const newCount = records.filter((r6) => r6.status === "new").length;
-  const updateCount = records.filter((r6) => r6.status === "update").length;
-  const noChangeCount = records.filter((r6) => r6.status === "no_change").length;
-  return {
-    records,
-    hasConflicts: conflictCount > 0,
-    conflictCount,
-    newCount,
-    updateCount,
-    noChangeCount
-  };
+  return normalizedActual === normalizedExpected;
 }
-async function createSelectedDNSRecords(hostedZoneId, domain, dkimTokens, region, selectedCategories, customTrackingDomain, mailFromDomain, trackingCnameTarget) {
-  const client2 = new Route53Client({ region });
-  const changes = [];
-  if (selectedCategories.has("dkim")) {
-    for (const token of dkimTokens) {
-      changes.push({
-        Action: "UPSERT",
-        ResourceRecordSet: {
-          Name: `${token}._domainkey.${domain}`,
-          Type: "CNAME",
-          TTL: 1800,
-          ResourceRecords: [{ Value: `${token}.dkim.amazonses.com` }]
-        }
-      });
-    }
-  }
-  if (selectedCategories.has("spf")) {
-    const existingTXT = await getExistingTXTRecords(
-      client2,
-      hostedZoneId,
-      domain
-    );
-    const newTXTValues = [];
-    if (existingTXT.spfValue) {
-      const mergedSPF = mergeSPFRecord(existingTXT.spfValue);
-      newTXTValues.push(`"${mergedSPF}"`);
-      for (const value of existingTXT.allValues) {
-        const unquoted = value.replace(/^"|"$/g, "");
-        if (!unquoted.startsWith("v=spf1")) {
-          newTXTValues.push(value);
-        }
-      }
-    } else if (existingTXT.allValues.length > 0) {
-      newTXTValues.push('"v=spf1 include:amazonses.com ~all"');
-      newTXTValues.push(...existingTXT.allValues);
-    } else {
-      newTXTValues.push('"v=spf1 include:amazonses.com ~all"');
-    }
-    changes.push({
-      Action: "UPSERT",
-      ResourceRecordSet: {
-        Name: domain,
-        Type: "TXT",
-        TTL: existingTXT.ttl,
-        ResourceRecords: newTXTValues.map((v) => ({ Value: v }))
+var CLOUDFLARE_API_BASE, CloudflareDNSClient;
+var init_cloudflare = __esm({
+  "src/utils/dns/cloudflare.ts"() {
+    "use strict";
+    init_esm_shims();
+    CLOUDFLARE_API_BASE = "https://api.cloudflare.com/client/v4";
+    CloudflareDNSClient = class {
+      zoneId;
+      apiToken;
+      constructor(zoneId, apiToken) {
+        this.zoneId = zoneId;
+        this.apiToken = apiToken;
       }
-    });
-  }
-  if (selectedCategories.has("dmarc")) {
-    const dmarcRuaDomain = mailFromDomain || domain;
-    changes.push({
-      Action: "UPSERT",
-      ResourceRecordSet: {
-        Name: `_dmarc.${domain}`,
-        Type: "TXT",
-        TTL: 1800,
-        ResourceRecords: [
+      async request(endpoint, method = "GET", body) {
+        const response = await fetch(
+          `${CLOUDFLARE_API_BASE}/zones/${this.zoneId}${endpoint}`,
           {
-            Value: `"v=DMARC1; p=quarantine; sp=quarantine; np=reject; rua=mailto:postmaster@${dmarcRuaDomain}"`
+            method,
+            headers: {
+              Authorization: `Bearer ${this.apiToken}`,
+              "Content-Type": "application/json"
+            },
+            body: body ? JSON.stringify(body) : void 0
           }
-        ]
+        );
+        return response.json();
       }
-    });
-  }
-  if (selectedCategories.has("tracking") && customTrackingDomain) {
-    changes.push({
-      Action: "UPSERT",
-      ResourceRecordSet: {
-        Name: customTrackingDomain,
-        Type: "CNAME",
-        TTL: 1800,
-        ResourceRecords: [
-          { Value: trackingCnameTarget ?? `r.${region}.awstrack.me` }
-        ]
+      async createRecord(name, type, content, priority) {
+        const recordContent = type === "TXT" ? `"${content}"` : content;
+        const body = {
+          name,
+          type,
+          content: recordContent,
+          ttl: 1800,
+          proxied: false
+          // Must not be proxied for email records
+        };
+        if (priority !== void 0) {
+          body.priority = priority;
+        }
+        const result = await this.request(
+          "/dns_records",
+          "POST",
+          body
+        );
+        return result.success;
       }
-    });
-  }
-  if (selectedCategories.has("mailfrom_mx") && mailFromDomain) {
-    changes.push({
-      Action: "UPSERT",
-      ResourceRecordSet: {
-        Name: mailFromDomain,
-        Type: "MX",
-        TTL: 1800,
-        ResourceRecords: [
-          { Value: `10 feedback-smtp.${region}.amazonses.com` }
-        ]
+      async findRecord(name, type) {
+        const result = await this.request(
+          `/dns_records?name=${encodeURIComponent(name)}&type=${type}`
+        );
+        if (result.success && result.result.length > 0) {
+          return result.result[0];
+        }
+        return null;
       }
-    });
-  }
-  if (selectedCategories.has("mailfrom_spf") && mailFromDomain) {
-    changes.push({
-      Action: "UPSERT",
-      ResourceRecordSet: {
-        Name: mailFromDomain,
-        Type: "TXT",
-        TTL: 1800,
-        ResourceRecords: [{ Value: '"v=spf1 include:amazonses.com ~all"' }]
+      /**
+       * All records matching name+type. Unlike `findRecord`, this returns every
+       * match — callers that need to know whether a name ALREADY has mail records
+       * cannot use a single-result lookup.
+       */
+      async listRecords(name, type) {
+        const result = await this.request(
+          `/dns_records?name=${encodeURIComponent(name)}&type=${type}`
+        );
+        if (!(result.success && result.result)) {
+          return [];
+        }
+        return result.result.map((r6) => ({
+          content: r6.content,
+          priority: r6.priority
+        }));
       }
-    });
-  }
-  if (changes.length === 0) {
-    return;
-  }
-  await client2.send(
-    new ChangeResourceRecordSetsCommand({
-      HostedZoneId: hostedZoneId,
-      ChangeBatch: {
-        Changes: changes
+      async deleteRecord(recordId) {
+        const result = await this.request(
+          `/dns_records/${recordId}`,
+          "DELETE"
+        );
+        return result.success;
       }
-    })
-  );
-}
-async function findHostedZone(domain, region) {
-  const client2 = new Route53Client({ region });
-  try {
-    const response = await client2.send(
-      new ListHostedZonesByNameCommand({
-        DNSName: domain,
-        MaxItems: 1
-      })
-    );
-    const zone = response.HostedZones?.[0];
-    if (zone && zone.Name === `${domain}.` && zone.Id) {
-      return {
-        id: zone.Id.replace("/hostedzone/", ""),
-        name: zone.Name
-      };
-    }
-    return null;
-  } catch (_error) {
-    return null;
-  }
-}
-async function createDNSRecords(hostedZoneId, domain, dkimTokens, region, customTrackingDomain, mailFromDomain, cloudFrontDomain) {
-  const client2 = new Route53Client({ region });
-  const changes = [];
-  for (const token of dkimTokens) {
-    changes.push({
-      Action: "UPSERT",
-      ResourceRecordSet: {
-        Name: `${token}._domainkey.${domain}`,
-        Type: "CNAME",
-        TTL: 1800,
-        ResourceRecords: [{ Value: `${token}.dkim.amazonses.com` }]
+      /**
+       * Delete an existing record by name+type, if one exists. `createRecord`
+       * always POSTs a new record rather than upserting, so callers that need
+       * to change an existing record's value (e.g. swapping the tracking CNAME
+       * target) must delete the old one first to avoid ending up with two.
+       */
+      async deleteRecordIfExists(name, type) {
+        const existing = await this.findRecord(name, type);
+        if (existing) {
+          await this.deleteRecord(existing.id);
+        }
       }
-    });
-  }
-  const existingTXT = await getExistingTXTRecords(client2, hostedZoneId, domain);
-  const newTXTValues = [];
-  if (existingTXT.spfValue) {
-    const mergedSPF = mergeSPFRecord(existingTXT.spfValue);
-    newTXTValues.push(`"${mergedSPF}"`);
-    for (const value of existingTXT.allValues) {
-      const unquoted = value.replace(/^"|"$/g, "");
-      if (!unquoted.startsWith("v=spf1")) {
-        newTXTValues.push(value);
-      }
-    }
-  } else if (existingTXT.allValues.length > 0) {
-    newTXTValues.push('"v=spf1 include:amazonses.com ~all"');
-    newTXTValues.push(...existingTXT.allValues);
-  } else {
-    newTXTValues.push('"v=spf1 include:amazonses.com ~all"');
-  }
-  changes.push({
-    Action: "UPSERT",
-    ResourceRecordSet: {
-      Name: domain,
-      Type: "TXT",
-      TTL: existingTXT.ttl,
-      ResourceRecords: newTXTValues.map((v) => ({ Value: v }))
-    }
-  });
-  const dmarcRuaDomain = mailFromDomain || domain;
-  changes.push({
-    Action: "UPSERT",
-    ResourceRecordSet: {
-      Name: `_dmarc.${domain}`,
-      Type: "TXT",
-      TTL: 1800,
-      ResourceRecords: [
-        {
-          Value: `"v=DMARC1; p=quarantine; sp=quarantine; np=reject; rua=mailto:postmaster@${dmarcRuaDomain}"`
-        }
-      ]
-    }
-  });
-  if (customTrackingDomain) {
-    const targetDomain = cloudFrontDomain || `r.${region}.awstrack.me`;
-    changes.push({
-      Action: "UPSERT",
-      ResourceRecordSet: {
-        Name: customTrackingDomain,
-        Type: "CNAME",
-        TTL: 1800,
-        ResourceRecords: [{ Value: targetDomain }]
-      }
-    });
-  }
-  if (mailFromDomain) {
-    changes.push({
-      Action: "UPSERT",
-      ResourceRecordSet: {
-        Name: mailFromDomain,
-        Type: "MX",
-        TTL: 1800,
-        ResourceRecords: [
-          { Value: `10 feedback-smtp.${region}.amazonses.com` }
-        ]
-      }
-    });
-    changes.push({
-      Action: "UPSERT",
-      ResourceRecordSet: {
-        Name: mailFromDomain,
-        Type: "TXT",
-        TTL: 1800,
-        ResourceRecords: [{ Value: '"v=spf1 include:amazonses.com ~all"' }]
-      }
-    });
-  }
-  await client2.send(
-    new ChangeResourceRecordSetsCommand({
-      HostedZoneId: hostedZoneId,
-      ChangeBatch: {
-        Changes: changes
-      }
-    })
-  );
-}
-async function deleteDNSRecords(hostedZoneId, domain, dkimTokens, region, customTrackingDomain, mailFromDomain) {
-  const client2 = new Route53Client({ region });
-  const response = await client2.send(
-    new ListResourceRecordSetsCommand({
-      HostedZoneId: hostedZoneId,
-      MaxItems: 500
-    })
-  );
-  const recordSets = response.ResourceRecordSets || [];
-  const changes = [];
-  const addDeletionIfExists = (name, type) => {
-    const normalizedName = name.endsWith(".") ? name : `${name}.`;
-    const record = recordSets.find(
-      (rs) => rs.Name === normalizedName && rs.Type === type
-    );
-    if (record?.ResourceRecords) {
-      changes.push({
-        Action: "DELETE",
-        ResourceRecordSet: record
-      });
-    }
-  };
-  for (const token of dkimTokens) {
-    addDeletionIfExists(`${token}._domainkey.${domain}`, "CNAME");
-  }
-  addDeletionIfExists(`_dmarc.${domain}`, "TXT");
-  if (customTrackingDomain) {
-    addDeletionIfExists(customTrackingDomain, "CNAME");
-  }
-  if (mailFromDomain) {
-    addDeletionIfExists(mailFromDomain, "MX");
-    addDeletionIfExists(mailFromDomain, "TXT");
-  }
-  if (changes.length === 0) {
-    return;
-  }
-  await client2.send(
-    new ChangeResourceRecordSetsCommand({
-      HostedZoneId: hostedZoneId,
-      ChangeBatch: {
-        Changes: changes
-      }
-    })
-  );
-}
-var init_route53 = __esm({
-  "src/utils/route53.ts"() {
-    "use strict";
-    init_esm_shims();
-  }
-});
-
-// src/utils/dns/cloudflare.ts
-var cloudflare_exports = {};
-__export(cloudflare_exports, {
-  CloudflareDNSClient: () => CloudflareDNSClient
-});
-function normalizeRecordValue(value) {
-  return value.replace(/^"/, "").replace(/"$/, "").trim();
-}
-function valuesMatch(type, actual, expected) {
-  const normalizedActual = normalizeRecordValue(actual);
-  const normalizedExpected = normalizeRecordValue(expected);
-  if (type === "MX") {
-    return normalizedActual.toLowerCase() === normalizedExpected.toLowerCase();
-  }
-  return normalizedActual === normalizedExpected;
-}
-var CLOUDFLARE_API_BASE, CloudflareDNSClient;
-var init_cloudflare = __esm({
-  "src/utils/dns/cloudflare.ts"() {
-    "use strict";
-    init_esm_shims();
-    CLOUDFLARE_API_BASE = "https://api.cloudflare.com/client/v4";
-    CloudflareDNSClient = class {
-      zoneId;
-      apiToken;
-      constructor(zoneId, apiToken) {
-        this.zoneId = zoneId;
-        this.apiToken = apiToken;
-      }
-      async request(endpoint, method = "GET", body) {
-        const response = await fetch(
-          `${CLOUDFLARE_API_BASE}/zones/${this.zoneId}${endpoint}`,
-          {
-            method,
-            headers: {
-              Authorization: `Bearer ${this.apiToken}`,
-              "Content-Type": "application/json"
-            },
-            body: body ? JSON.stringify(body) : void 0
-          }
-        );
-        return response.json();
-      }
-      async createRecord(name, type, content, priority) {
-        const recordContent = type === "TXT" ? `"${content}"` : content;
-        const body = {
-          name,
-          type,
-          content: recordContent,
-          ttl: 1800,
-          proxied: false
-          // Must not be proxied for email records
-        };
-        if (priority !== void 0) {
-          body.priority = priority;
-        }
-        const result = await this.request(
-          "/dns_records",
-          "POST",
-          body
-        );
-        return result.success;
-      }
-      async findRecord(name, type) {
-        const result = await this.request(
-          `/dns_records?name=${encodeURIComponent(name)}&type=${type}`
-        );
-        if (result.success && result.result.length > 0) {
-          return result.result[0];
-        }
-        return null;
-      }
-      /**
-       * All records matching name+type. Unlike `findRecord`, this returns every
-       * match — callers that need to know whether a name ALREADY has mail records
-       * cannot use a single-result lookup.
-       */
-      async listRecords(name, type) {
-        const result = await this.request(
-          `/dns_records?name=${encodeURIComponent(name)}&type=${type}`
-        );
-        if (!(result.success && result.result)) {
-          return [];
-        }
-        return result.result.map((r6) => ({
-          content: r6.content,
-          priority: r6.priority
-        }));
-      }
-      async deleteRecord(recordId) {
-        const result = await this.request(
-          `/dns_records/${recordId}`,
-          "DELETE"
-        );
-        return result.success;
-      }
-      /**
-       * Delete an existing record by name+type, if one exists. `createRecord`
-       * always POSTs a new record rather than upserting, so callers that need
-       * to change an existing record's value (e.g. swapping the tracking CNAME
-       * target) must delete the old one first to avoid ending up with two.
-       */
-      async deleteRecordIfExists(name, type) {
-        const existing = await this.findRecord(name, type);
-        if (existing) {
-          await this.deleteRecord(existing.id);
-        }
-      }
-      /**
-       * Delete records matching name + type + exact value. Value matching is the
-       * point: a name can carry several TXT or MX records, and deleting "the first
-       * one" can remove a record Wraps did not create.
-       */
-      async deleteRecordsByValue(name, type, value) {
-        let result;
-        try {
-          result = await this.request(
-            `/dns_records?name=${encodeURIComponent(name)}&type=${type}`
-          );
-        } catch (error) {
-          return {
-            deleted: 0,
-            error: error instanceof Error ? error.message : "Unknown error"
-          };
-        }
-        if (!result.success) {
-          return {
-            deleted: 0,
-            error: result.errors?.map((e6) => e6.message).join("; ") || "Failed to list DNS records"
-          };
-        }
-        const matches = result.result.filter(
-          (record) => valuesMatch(type, record.content, value)
-        );
-        let deleted = 0;
-        for (const record of matches) {
-          if (await this.deleteRecord(record.id)) {
-            deleted++;
-          }
-        }
-        return { deleted };
+      /**
+       * Delete records matching name + type + exact value. Value matching is the
+       * point: a name can carry several TXT or MX records, and deleting "the first
+       * one" can remove a record Wraps did not create.
+       */
+      async deleteRecordsByValue(name, type, value) {
+        let result;
+        try {
+          result = await this.request(
+            `/dns_records?name=${encodeURIComponent(name)}&type=${type}`
+          );
+        } catch (error) {
+          return {
+            deleted: 0,
+            error: error instanceof Error ? error.message : "Unknown error"
+          };
+        }
+        if (!result.success) {
+          return {
+            deleted: 0,
+            error: result.errors?.map((e6) => e6.message).join("; ") || "Failed to list DNS records"
+          };
+        }
+        const matches = result.result.filter(
+          (record) => valuesMatch(type, record.content, value)
+        );
+        let deleted = 0;
+        for (const record of matches) {
+          if (await this.deleteRecord(record.id)) {
+            deleted++;
+          }
+        }
+        return { deleted };
       }
       /**
        * Create arbitrary DNS records from a list
@@ -26227,174 +25706,896 @@ var init_vercel = __esm({
             ]
           };
         }
-      }
-      async deleteEmailRecords(data) {
-        const { domain, dkimTokens, mailFromDomain } = data;
-        const errors2 = [];
-        let recordsCreated = 0;
-        try {
-          for (const token of dkimTokens) {
-            const name = `${token}._domainkey.${domain}`;
-            const record = await this.findRecord(name, "CNAME");
-            if (record) {
-              const success = await this.deleteRecord(record.id);
-              if (success) {
-                recordsCreated++;
-              } else {
-                errors2.push(`Failed to delete DKIM record: ${name}`);
-              }
-            }
-          }
-          const dmarcRecord = await this.findRecord(`_dmarc.${domain}`, "TXT");
-          if (dmarcRecord) {
-            const success = await this.deleteRecord(dmarcRecord.id);
-            if (success) {
-              recordsCreated++;
-            } else {
-              errors2.push("Failed to delete DMARC record");
-            }
-          }
-          if (mailFromDomain) {
-            const mxRecord = await this.findRecord(mailFromDomain, "MX");
-            if (mxRecord) {
-              const success = await this.deleteRecord(mxRecord.id);
-              if (success) {
-                recordsCreated++;
-              } else {
-                errors2.push(`Failed to delete MX record for ${mailFromDomain}`);
-              }
-            }
-            const spfRecord = await this.findRecord(mailFromDomain, "TXT");
-            if (spfRecord) {
-              const success = await this.deleteRecord(spfRecord.id);
-              if (success) {
-                recordsCreated++;
-              } else {
-                errors2.push(`Failed to delete SPF record for ${mailFromDomain}`);
-              }
-            }
-          }
-          return {
-            success: errors2.length === 0,
-            recordsCreated,
-            errors: errors2.length > 0 ? errors2 : void 0
-          };
-        } catch (error) {
-          return {
-            success: false,
-            recordsCreated,
-            errors: [
-              ...errors2,
-              error instanceof Error ? error.message : "Unknown error"
-            ]
-          };
+      }
+      async deleteEmailRecords(data) {
+        const { domain, dkimTokens, mailFromDomain } = data;
+        const errors2 = [];
+        let recordsCreated = 0;
+        try {
+          for (const token of dkimTokens) {
+            const name = `${token}._domainkey.${domain}`;
+            const record = await this.findRecord(name, "CNAME");
+            if (record) {
+              const success = await this.deleteRecord(record.id);
+              if (success) {
+                recordsCreated++;
+              } else {
+                errors2.push(`Failed to delete DKIM record: ${name}`);
+              }
+            }
+          }
+          const dmarcRecord = await this.findRecord(`_dmarc.${domain}`, "TXT");
+          if (dmarcRecord) {
+            const success = await this.deleteRecord(dmarcRecord.id);
+            if (success) {
+              recordsCreated++;
+            } else {
+              errors2.push("Failed to delete DMARC record");
+            }
+          }
+          if (mailFromDomain) {
+            const mxRecord = await this.findRecord(mailFromDomain, "MX");
+            if (mxRecord) {
+              const success = await this.deleteRecord(mxRecord.id);
+              if (success) {
+                recordsCreated++;
+              } else {
+                errors2.push(`Failed to delete MX record for ${mailFromDomain}`);
+              }
+            }
+            const spfRecord = await this.findRecord(mailFromDomain, "TXT");
+            if (spfRecord) {
+              const success = await this.deleteRecord(spfRecord.id);
+              if (success) {
+                recordsCreated++;
+              } else {
+                errors2.push(`Failed to delete SPF record for ${mailFromDomain}`);
+              }
+            }
+          }
+          return {
+            success: errors2.length === 0,
+            recordsCreated,
+            errors: errors2.length > 0 ? errors2 : void 0
+          };
+        } catch (error) {
+          return {
+            success: false,
+            recordsCreated,
+            errors: [
+              ...errors2,
+              error instanceof Error ? error.message : "Unknown error"
+            ]
+          };
+        }
+      }
+      /**
+       * Get all CAA records for the domain
+       */
+      async getCAARecords() {
+        const result = await this.request(
+          `/v4/domains/${this.domain}/records`
+        );
+        if (result.error || !result.records) {
+          return [];
+        }
+        return result.records.filter((r6) => r6.type === "CAA").map((r6) => {
+          const match = r6.value.match(/^(\d+)\s+(\w+)\s+"?([^"]+)"?$/);
+          if (match) {
+            return {
+              flags: Number.parseInt(match[1], 10),
+              tag: match[2],
+              value: match[3]
+            };
+          }
+          return null;
+        }).filter(
+          (r6) => r6 !== null
+        );
+      }
+      /**
+       * Check if Amazon is allowed to issue certificates based on CAA records
+       * Returns true if:
+       * - No CAA records exist (any CA can issue)
+       * - CAA records exist and include amazon.com or amazontrust.com
+       */
+      async isAmazonCAAAllowed() {
+        const caaRecords = await this.getCAARecords();
+        const issueRecords = caaRecords.filter(
+          (r6) => r6.tag === "issue" || r6.tag === "issuewild"
+        );
+        if (issueRecords.length === 0) {
+          return { allowed: true, hasCAA: false, existingCAs: [] };
+        }
+        const existingCAs = issueRecords.map((r6) => r6.value);
+        const amazonAllowed = existingCAs.some(
+          (ca) => ca.includes("amazon.com") || ca.includes("amazontrust.com")
+        );
+        return { allowed: amazonAllowed, hasCAA: true, existingCAs };
+      }
+      /**
+       * Add a CAA record to allow Amazon to issue certificates
+       */
+      async addAmazonCAARecord() {
+        const body = {
+          name: "@",
+          // Root domain
+          type: "CAA",
+          value: '0 issue "amazon.com"',
+          ttl: 1800
+        };
+        const result = await this.request(
+          `/v2/domains/${this.domain}/records`,
+          "POST",
+          body
+        );
+        return !result.error;
+      }
+      async verifyRecords(data) {
+        const { domain, dkimTokens, mailFromDomain, region } = data;
+        const missing = [];
+        const incorrect = [];
+        for (const token of dkimTokens) {
+          const name = `${token}._domainkey.${domain}`;
+          const expectedValue = `${token}.dkim.amazonses.com`;
+          const record = await this.findRecord(name, "CNAME");
+          if (!record) {
+            missing.push(`DKIM: ${name}`);
+          } else if (record.value !== expectedValue) {
+            incorrect.push(`DKIM: ${name} (expected ${expectedValue})`);
+          }
+        }
+        const spfRecord = await this.findRecord(domain, "TXT");
+        if (!spfRecord) {
+          missing.push(`SPF: ${domain}`);
+        } else if (!spfRecord.value.includes("include:amazonses.com")) {
+          incorrect.push(`SPF: ${domain} (missing amazonses.com include)`);
+        }
+        const dmarcRecord = await this.findRecord(`_dmarc.${domain}`, "TXT");
+        if (!dmarcRecord) {
+          missing.push(`DMARC: _dmarc.${domain}`);
+        }
+        if (mailFromDomain) {
+          const mxRecord = await this.findRecord(mailFromDomain, "MX");
+          if (!mxRecord) {
+            missing.push(`MX: ${mailFromDomain}`);
+          } else if (!mxRecord.value.includes(`feedback-smtp.${region}.amazonses.com`)) {
+            incorrect.push(`MX: ${mailFromDomain}`);
+          }
+          const mailFromSpf = await this.findRecord(mailFromDomain, "TXT");
+          if (!mailFromSpf) {
+            missing.push(`SPF: ${mailFromDomain}`);
+          }
+        }
+        return {
+          verified: missing.length === 0 && incorrect.length === 0,
+          missing,
+          incorrect
+        };
+      }
+    };
+  }
+});
+
+// src/utils/dns/email-dns-cleanup.ts
+var email_dns_cleanup_exports = {};
+__export(email_dns_cleanup_exports, {
+  deleteEmailDNSRecordsForProvider: () => deleteEmailDNSRecordsForProvider
+});
+import {
+  ChangeResourceRecordSetsCommand,
+  ListResourceRecordSetsCommand,
+  Route53Client
+} from "@aws-sdk/client-route-53";
+async function deleteViaValueMatchedClient(client2, records) {
+  const deleted = [];
+  const skipped = [];
+  const errors2 = [];
+  for (const record of records) {
+    const label = `${record.type} ${record.name}`;
+    const result = await client2.deleteRecordsByValue(
+      record.name,
+      record.type,
+      record.value
+    );
+    if (result.error) {
+      errors2.push(`${label}: ${result.error}`);
+    } else if (result.deleted > 0) {
+      for (let i6 = 0; i6 < result.deleted; i6++) {
+        deleted.push(label);
+      }
+    } else {
+      skipped.push({
+        record: label,
+        reason: "no record with the value Wraps created"
+      });
+    }
+  }
+  return { deleted, skipped, supported: true, errors: errors2 };
+}
+async function listRoute53RecordSet(client2, hostedZoneId, name, type) {
+  const targetName = normalizeRoute53Name(name);
+  let startRecordName = name;
+  let startRecordType;
+  const MAX_PAGES = 50;
+  for (let page = 0; page < MAX_PAGES; page++) {
+    const response = await client2.send(
+      new ListResourceRecordSetsCommand({
+        HostedZoneId: hostedZoneId,
+        StartRecordName: startRecordName,
+        StartRecordType: startRecordType
+      })
+    );
+    const rrsets = response.ResourceRecordSets ?? [];
+    let movedPastTarget = false;
+    for (const rrset of rrsets) {
+      if (!(rrset.Name && rrset.Type)) {
+        continue;
+      }
+      if (normalizeRoute53Name(rrset.Name) !== targetName) {
+        movedPastTarget = true;
+        break;
+      }
+      if (rrset.Type === type) {
+        return {
+          ttl: rrset.TTL,
+          values: (rrset.ResourceRecords ?? []).map((r6) => r6.Value).filter((v) => Boolean(v))
+        };
+      }
+    }
+    if (movedPastTarget || !response.IsTruncated) {
+      break;
+    }
+    startRecordName = response.NextRecordName;
+    startRecordType = response.NextRecordType;
+    if (!startRecordName) {
+      break;
+    }
+  }
+}
+function buildRoute53RemovalChange(params) {
+  const { name, type, sesValue, existing } = params;
+  const values = existing?.values ?? [];
+  if (!values.includes(sesValue)) {
+    return {
+      change: null,
+      skippedReason: `The ${type} record set at ${name} does not contain the value Wraps created \u2014 leaving it in place.`
+    };
+  }
+  const remaining = values.filter((value) => value !== sesValue);
+  if (remaining.length === 0) {
+    return {
+      change: {
+        Action: "DELETE",
+        ResourceRecordSet: {
+          Name: name,
+          Type: type,
+          TTL: existing?.ttl ?? 1800,
+          ResourceRecords: values.map((value) => ({ Value: value }))
+        }
+      }
+    };
+  }
+  return {
+    change: {
+      Action: "UPSERT",
+      ResourceRecordSet: {
+        Name: name,
+        Type: type,
+        TTL: existing?.ttl ?? 1800,
+        ResourceRecords: remaining.map((value) => ({ Value: value }))
+      }
+    }
+  };
+}
+function route53Value(record) {
+  if (record.type === "MX") {
+    return `${record.priority} ${record.value}`;
+  }
+  if (record.type === "TXT") {
+    return `"${record.value}"`;
+  }
+  return record.value;
+}
+async function deleteRoute53EmailRecords(hostedZoneId, region, records) {
+  const client2 = new Route53Client({ region });
+  const mxTxtNames = /* @__PURE__ */ new Set();
+  const cnameNames = /* @__PURE__ */ new Set();
+  for (const record of records) {
+    if (record.type === "CNAME") {
+      cnameNames.add(record.name);
+    } else {
+      mxTxtNames.add(record.name);
+    }
+  }
+  const mxTxtByName = /* @__PURE__ */ new Map();
+  const cnameByName = /* @__PURE__ */ new Map();
+  try {
+    for (const name of mxTxtNames) {
+      mxTxtByName.set(
+        name,
+        await listExistingRoute53InboundRecords(client2, hostedZoneId, name)
+      );
+    }
+    for (const name of cnameNames) {
+      cnameByName.set(
+        name,
+        await listRoute53RecordSet(client2, hostedZoneId, name, "CNAME")
+      );
+    }
+  } catch (error) {
+    return {
+      deleted: [],
+      skipped: [],
+      supported: true,
+      errors: [error instanceof Error ? error.message : "Unknown error"]
+    };
+  }
+  const changes = [];
+  const deleted = [];
+  const skipped = [];
+  for (const record of records) {
+    const label = `${record.type} ${record.name}`;
+    const existing = record.type === "CNAME" ? cnameByName.get(record.name) : mxTxtByName.get(record.name)?.get(record.type);
+    const result = buildRoute53RemovalChange({
+      name: record.name,
+      type: record.type,
+      sesValue: route53Value(record),
+      existing
+    });
+    if (result.change) {
+      changes.push(result.change);
+      deleted.push(label);
+    } else if (result.skippedReason) {
+      skipped.push({ record: label, reason: result.skippedReason });
+    }
+  }
+  if (changes.length === 0) {
+    return { deleted, skipped, supported: true, errors: [] };
+  }
+  try {
+    await client2.send(
+      new ChangeResourceRecordSetsCommand({
+        HostedZoneId: hostedZoneId,
+        ChangeBatch: { Changes: changes }
+      })
+    );
+    return { deleted, skipped, supported: true, errors: [] };
+  } catch (error) {
+    return {
+      deleted: [],
+      skipped,
+      supported: true,
+      errors: [error instanceof Error ? error.message : "Unknown error"]
+    };
+  }
+}
+async function deleteEmailDNSRecordsForProvider(credentials, data) {
+  const records = buildEmailDNSRecords(data).filter(
+    (record) => record.category !== "spf"
+  );
+  switch (credentials.provider) {
+    case "cloudflare": {
+      const client2 = new CloudflareDNSClient(
+        credentials.zoneId,
+        credentials.token
+      );
+      return deleteViaValueMatchedClient(client2, records);
+    }
+    case "vercel": {
+      const client2 = new VercelDNSClient(
+        data.domain,
+        credentials.token,
+        credentials.teamId
+      );
+      return deleteViaValueMatchedClient(client2, records);
+    }
+    case "route53":
+      return deleteRoute53EmailRecords(
+        credentials.hostedZoneId,
+        data.region,
+        records
+      );
+    case "manual":
+      return { deleted: [], skipped: [], supported: false, errors: [] };
+  }
+}
+var init_email_dns_cleanup = __esm({
+  "src/utils/dns/email-dns-cleanup.ts"() {
+    "use strict";
+    init_esm_shims();
+    init_cloudflare();
+    init_create_records();
+    init_vercel();
+  }
+});
+
+// src/utils/route53.ts
+var route53_exports = {};
+__export(route53_exports, {
+  createDNSRecords: () => createDNSRecords,
+  createSelectedDNSRecords: () => createSelectedDNSRecords,
+  deleteDNSRecords: () => deleteDNSRecords,
+  findHostedZone: () => findHostedZone,
+  mergeSPFRecord: () => mergeSPFRecord,
+  previewDNSChanges: () => previewDNSChanges
+});
+import {
+  ChangeResourceRecordSetsCommand as ChangeResourceRecordSetsCommand2,
+  ListHostedZonesByNameCommand,
+  ListResourceRecordSetsCommand as ListResourceRecordSetsCommand2,
+  Route53Client as Route53Client2
+} from "@aws-sdk/client-route-53";
+async function getExistingTXTRecords(client2, hostedZoneId, domain) {
+  try {
+    const response = await client2.send(
+      new ListResourceRecordSetsCommand2({
+        HostedZoneId: hostedZoneId,
+        StartRecordName: domain,
+        StartRecordType: "TXT",
+        MaxItems: 100
+      })
+    );
+    const txtRecordSet = response.ResourceRecordSets?.find(
+      (rs) => rs.Type === "TXT" && (rs.Name === domain || rs.Name === `${domain}.`)
+    );
+    if (!txtRecordSet?.ResourceRecords) {
+      return { allValues: [], spfValue: null, ttl: 1800 };
+    }
+    const allValues = [];
+    let spfValue = null;
+    for (const record of txtRecordSet.ResourceRecords) {
+      const value = record.Value || "";
+      allValues.push(value);
+      const unquoted = value.replace(/^"|"$/g, "");
+      if (unquoted.startsWith("v=spf1")) {
+        spfValue = unquoted;
+      }
+    }
+    return {
+      allValues,
+      spfValue,
+      ttl: txtRecordSet.TTL || 1800
+    };
+  } catch (_error) {
+    return { allValues: [], spfValue: null, ttl: 1800 };
+  }
+}
+function mergeSPFRecord(existingSPF) {
+  const sesInclude = "include:amazonses.com";
+  if (existingSPF.includes(sesInclude)) {
+    return existingSPF;
+  }
+  const allMatch = existingSPF.match(/\s([~+?-]?all)$/);
+  if (allMatch) {
+    const beforeAll = existingSPF.slice(0, allMatch.index);
+    const allPart = allMatch[1];
+    return `${beforeAll} ${sesInclude} ${allPart}`;
+  }
+  return `${existingSPF} ${sesInclude}`;
+}
+async function getExistingRecords(client2, hostedZoneId) {
+  try {
+    const response = await client2.send(
+      new ListResourceRecordSetsCommand2({
+        HostedZoneId: hostedZoneId,
+        MaxItems: 500
+      })
+    );
+    return response.ResourceRecordSets || [];
+  } catch (_error) {
+    return [];
+  }
+}
+function findExistingRecord(records, name, type) {
+  const normalizedName = name.endsWith(".") ? name : `${name}.`;
+  return records.find((r6) => r6.Name === normalizedName && r6.Type === type) || null;
+}
+function getRecordValue(record) {
+  if (!record?.ResourceRecords?.length) {
+    return null;
+  }
+  return record.ResourceRecords.map((r6) => r6.Value || "").join(", ");
+}
+async function previewDNSChanges(hostedZoneId, domain, dkimTokens, region, customTrackingDomain, mailFromDomain) {
+  const client2 = new Route53Client2({ region });
+  const existingRecords = await getExistingRecords(client2, hostedZoneId);
+  const existingTXT = await getExistingTXTRecords(client2, hostedZoneId, domain);
+  const records = [];
+  for (const token of dkimTokens) {
+    const name = `${token}._domainkey.${domain}`;
+    const proposedValue = `${token}.dkim.amazonses.com`;
+    const existing = findExistingRecord(existingRecords, name, "CNAME");
+    const existingValue = getRecordValue(existing);
+    let status2 = "new";
+    if (existingValue === proposedValue) {
+      status2 = "no_change";
+    } else if (existingValue) {
+      status2 = "update";
+    }
+    records.push({
+      name,
+      type: "CNAME",
+      proposedValue,
+      existingValue,
+      status: status2,
+      category: "dkim"
+    });
+  }
+  const proposedSPF = existingTXT.spfValue ? mergeSPFRecord(existingTXT.spfValue) : "v=spf1 include:amazonses.com ~all";
+  let spfStatus = "new";
+  if (existingTXT.spfValue) {
+    if (existingTXT.spfValue === proposedSPF) {
+      spfStatus = "no_change";
+    } else if (existingTXT.spfValue.includes("include:amazonses.com")) {
+      spfStatus = "no_change";
+    } else {
+      spfStatus = "update";
+    }
+  }
+  records.push({
+    name: domain,
+    type: "TXT",
+    proposedValue: `"${proposedSPF}"`,
+    existingValue: existingTXT.spfValue ? `"${existingTXT.spfValue}"` : null,
+    status: spfStatus,
+    category: "spf",
+    conflictReason: void 0
+  });
+  const dmarcName = `_dmarc.${domain}`;
+  const dmarcRuaDomain = mailFromDomain || domain;
+  const proposedDMARC = `"v=DMARC1; p=quarantine; sp=quarantine; np=reject; rua=mailto:postmaster@${dmarcRuaDomain}"`;
+  const existingDMARC = findExistingRecord(existingRecords, dmarcName, "TXT");
+  const existingDMARCValue = getRecordValue(existingDMARC);
+  let dmarcStatus = "new";
+  let dmarcConflictReason;
+  if (existingDMARCValue) {
+    if (existingDMARCValue === proposedDMARC) {
+      dmarcStatus = "no_change";
+    } else {
+      dmarcStatus = "conflict";
+      dmarcConflictReason = "Existing DMARC policy will be replaced";
+    }
+  }
+  records.push({
+    name: dmarcName,
+    type: "TXT",
+    proposedValue: proposedDMARC,
+    existingValue: existingDMARCValue,
+    status: dmarcStatus,
+    category: "dmarc",
+    conflictReason: dmarcConflictReason
+  });
+  if (customTrackingDomain) {
+    const proposedTracking = `r.${region}.awstrack.me`;
+    const existingTracking = findExistingRecord(
+      existingRecords,
+      customTrackingDomain,
+      "CNAME"
+    );
+    const existingTrackingValue = getRecordValue(existingTracking);
+    let trackingStatus = "new";
+    let trackingConflictReason;
+    if (existingTrackingValue === proposedTracking) {
+      trackingStatus = "no_change";
+    } else if (existingTrackingValue) {
+      trackingStatus = "conflict";
+      trackingConflictReason = `Points to ${existingTrackingValue}, will be replaced`;
+    }
+    records.push({
+      name: customTrackingDomain,
+      type: "CNAME",
+      proposedValue: proposedTracking,
+      existingValue: existingTrackingValue,
+      status: trackingStatus,
+      category: "tracking",
+      conflictReason: trackingConflictReason
+    });
+  }
+  if (mailFromDomain) {
+    const proposedMX = `10 feedback-smtp.${region}.amazonses.com`;
+    const existingMX = findExistingRecord(
+      existingRecords,
+      mailFromDomain,
+      "MX"
+    );
+    const existingMXValue = getRecordValue(existingMX);
+    let mxStatus = "new";
+    if (existingMXValue === proposedMX) {
+      mxStatus = "no_change";
+    } else if (existingMXValue) {
+      mxStatus = "update";
+    }
+    records.push({
+      name: mailFromDomain,
+      type: "MX",
+      proposedValue: proposedMX,
+      existingValue: existingMXValue,
+      status: mxStatus,
+      category: "mailfrom_mx"
+    });
+    const mailFromSPF = '"v=spf1 include:amazonses.com ~all"';
+    const existingMailFromTXT = await getExistingTXTRecords(
+      client2,
+      hostedZoneId,
+      mailFromDomain
+    );
+    let mailFromSpfStatus = "new";
+    if (existingMailFromTXT.spfValue?.includes("include:amazonses.com")) {
+      mailFromSpfStatus = "no_change";
+    } else if (existingMailFromTXT.spfValue) {
+      mailFromSpfStatus = "update";
+    }
+    records.push({
+      name: mailFromDomain,
+      type: "TXT",
+      proposedValue: mailFromSPF,
+      existingValue: existingMailFromTXT.spfValue ? `"${existingMailFromTXT.spfValue}"` : null,
+      status: mailFromSpfStatus,
+      category: "mailfrom_spf"
+    });
+  }
+  const conflictCount = records.filter((r6) => r6.status === "conflict").length;
+  const newCount = records.filter((r6) => r6.status === "new").length;
+  const updateCount = records.filter((r6) => r6.status === "update").length;
+  const noChangeCount = records.filter((r6) => r6.status === "no_change").length;
+  return {
+    records,
+    hasConflicts: conflictCount > 0,
+    conflictCount,
+    newCount,
+    updateCount,
+    noChangeCount
+  };
+}
+async function createSelectedDNSRecords(hostedZoneId, domain, dkimTokens, region, selectedCategories, customTrackingDomain, mailFromDomain, trackingCnameTarget) {
+  const client2 = new Route53Client2({ region });
+  const changes = [];
+  if (selectedCategories.has("dkim")) {
+    for (const token of dkimTokens) {
+      changes.push({
+        Action: "UPSERT",
+        ResourceRecordSet: {
+          Name: `${token}._domainkey.${domain}`,
+          Type: "CNAME",
+          TTL: 1800,
+          ResourceRecords: [{ Value: `${token}.dkim.amazonses.com` }]
+        }
+      });
+    }
+  }
+  if (selectedCategories.has("spf")) {
+    const existingTXT = await getExistingTXTRecords(
+      client2,
+      hostedZoneId,
+      domain
+    );
+    const newTXTValues = [];
+    if (existingTXT.spfValue) {
+      const mergedSPF = mergeSPFRecord(existingTXT.spfValue);
+      newTXTValues.push(`"${mergedSPF}"`);
+      for (const value of existingTXT.allValues) {
+        const unquoted = value.replace(/^"|"$/g, "");
+        if (!unquoted.startsWith("v=spf1")) {
+          newTXTValues.push(value);
         }
       }
-      /**
-       * Get all CAA records for the domain
-       */
-      async getCAARecords() {
-        const result = await this.request(
-          `/v4/domains/${this.domain}/records`
-        );
-        if (result.error || !result.records) {
-          return [];
-        }
-        return result.records.filter((r6) => r6.type === "CAA").map((r6) => {
-          const match = r6.value.match(/^(\d+)\s+(\w+)\s+"?([^"]+)"?$/);
-          if (match) {
-            return {
-              flags: Number.parseInt(match[1], 10),
-              tag: match[2],
-              value: match[3]
-            };
+    } else if (existingTXT.allValues.length > 0) {
+      newTXTValues.push('"v=spf1 include:amazonses.com ~all"');
+      newTXTValues.push(...existingTXT.allValues);
+    } else {
+      newTXTValues.push('"v=spf1 include:amazonses.com ~all"');
+    }
+    changes.push({
+      Action: "UPSERT",
+      ResourceRecordSet: {
+        Name: domain,
+        Type: "TXT",
+        TTL: existingTXT.ttl,
+        ResourceRecords: newTXTValues.map((v) => ({ Value: v }))
+      }
+    });
+  }
+  if (selectedCategories.has("dmarc")) {
+    const dmarcRuaDomain = mailFromDomain || domain;
+    changes.push({
+      Action: "UPSERT",
+      ResourceRecordSet: {
+        Name: `_dmarc.${domain}`,
+        Type: "TXT",
+        TTL: 1800,
+        ResourceRecords: [
+          {
+            Value: `"v=DMARC1; p=quarantine; sp=quarantine; np=reject; rua=mailto:postmaster@${dmarcRuaDomain}"`
           }
-          return null;
-        }).filter(
-          (r6) => r6 !== null
-        );
+        ]
+      }
+    });
+  }
+  if (selectedCategories.has("tracking") && customTrackingDomain) {
+    changes.push({
+      Action: "UPSERT",
+      ResourceRecordSet: {
+        Name: customTrackingDomain,
+        Type: "CNAME",
+        TTL: 1800,
+        ResourceRecords: [
+          { Value: trackingCnameTarget ?? `r.${region}.awstrack.me` }
+        ]
+      }
+    });
+  }
+  if (selectedCategories.has("mailfrom_mx") && mailFromDomain) {
+    changes.push({
+      Action: "UPSERT",
+      ResourceRecordSet: {
+        Name: mailFromDomain,
+        Type: "MX",
+        TTL: 1800,
+        ResourceRecords: [
+          { Value: `10 feedback-smtp.${region}.amazonses.com` }
+        ]
+      }
+    });
+  }
+  if (selectedCategories.has("mailfrom_spf") && mailFromDomain) {
+    changes.push({
+      Action: "UPSERT",
+      ResourceRecordSet: {
+        Name: mailFromDomain,
+        Type: "TXT",
+        TTL: 1800,
+        ResourceRecords: [{ Value: '"v=spf1 include:amazonses.com ~all"' }]
+      }
+    });
+  }
+  if (changes.length === 0) {
+    return;
+  }
+  await client2.send(
+    new ChangeResourceRecordSetsCommand2({
+      HostedZoneId: hostedZoneId,
+      ChangeBatch: {
+        Changes: changes
+      }
+    })
+  );
+}
+async function findHostedZone(domain, region) {
+  const client2 = new Route53Client2({ region });
+  try {
+    const response = await client2.send(
+      new ListHostedZonesByNameCommand({
+        DNSName: domain,
+        MaxItems: 1
+      })
+    );
+    const zone = response.HostedZones?.[0];
+    if (zone && zone.Name === `${domain}.` && zone.Id) {
+      return {
+        id: zone.Id.replace("/hostedzone/", ""),
+        name: zone.Name
+      };
+    }
+    return null;
+  } catch (_error) {
+    return null;
+  }
+}
+async function createDNSRecords(hostedZoneId, domain, dkimTokens, region, customTrackingDomain, mailFromDomain, cloudFrontDomain) {
+  const client2 = new Route53Client2({ region });
+  const changes = [];
+  for (const token of dkimTokens) {
+    changes.push({
+      Action: "UPSERT",
+      ResourceRecordSet: {
+        Name: `${token}._domainkey.${domain}`,
+        Type: "CNAME",
+        TTL: 1800,
+        ResourceRecords: [{ Value: `${token}.dkim.amazonses.com` }]
       }
-      /**
-       * Check if Amazon is allowed to issue certificates based on CAA records
-       * Returns true if:
-       * - No CAA records exist (any CA can issue)
-       * - CAA records exist and include amazon.com or amazontrust.com
-       */
-      async isAmazonCAAAllowed() {
-        const caaRecords = await this.getCAARecords();
-        const issueRecords = caaRecords.filter(
-          (r6) => r6.tag === "issue" || r6.tag === "issuewild"
-        );
-        if (issueRecords.length === 0) {
-          return { allowed: true, hasCAA: false, existingCAs: [] };
+    });
+  }
+  const existingTXT = await getExistingTXTRecords(client2, hostedZoneId, domain);
+  const newTXTValues = [];
+  if (existingTXT.spfValue) {
+    const mergedSPF = mergeSPFRecord(existingTXT.spfValue);
+    newTXTValues.push(`"${mergedSPF}"`);
+    for (const value of existingTXT.allValues) {
+      const unquoted = value.replace(/^"|"$/g, "");
+      if (!unquoted.startsWith("v=spf1")) {
+        newTXTValues.push(value);
+      }
+    }
+  } else if (existingTXT.allValues.length > 0) {
+    newTXTValues.push('"v=spf1 include:amazonses.com ~all"');
+    newTXTValues.push(...existingTXT.allValues);
+  } else {
+    newTXTValues.push('"v=spf1 include:amazonses.com ~all"');
+  }
+  changes.push({
+    Action: "UPSERT",
+    ResourceRecordSet: {
+      Name: domain,
+      Type: "TXT",
+      TTL: existingTXT.ttl,
+      ResourceRecords: newTXTValues.map((v) => ({ Value: v }))
+    }
+  });
+  const dmarcRuaDomain = mailFromDomain || domain;
+  changes.push({
+    Action: "UPSERT",
+    ResourceRecordSet: {
+      Name: `_dmarc.${domain}`,
+      Type: "TXT",
+      TTL: 1800,
+      ResourceRecords: [
+        {
+          Value: `"v=DMARC1; p=quarantine; sp=quarantine; np=reject; rua=mailto:postmaster@${dmarcRuaDomain}"`
         }
-        const existingCAs = issueRecords.map((r6) => r6.value);
-        const amazonAllowed = existingCAs.some(
-          (ca) => ca.includes("amazon.com") || ca.includes("amazontrust.com")
-        );
-        return { allowed: amazonAllowed, hasCAA: true, existingCAs };
+      ]
+    }
+  });
+  if (customTrackingDomain) {
+    const targetDomain = cloudFrontDomain || `r.${region}.awstrack.me`;
+    changes.push({
+      Action: "UPSERT",
+      ResourceRecordSet: {
+        Name: customTrackingDomain,
+        Type: "CNAME",
+        TTL: 1800,
+        ResourceRecords: [{ Value: targetDomain }]
       }
-      /**
-       * Add a CAA record to allow Amazon to issue certificates
-       */
-      async addAmazonCAARecord() {
-        const body = {
-          name: "@",
-          // Root domain
-          type: "CAA",
-          value: '0 issue "amazon.com"',
-          ttl: 1800
-        };
-        const result = await this.request(
-          `/v2/domains/${this.domain}/records`,
-          "POST",
-          body
-        );
-        return !result.error;
+    });
+  }
+  if (mailFromDomain) {
+    changes.push({
+      Action: "UPSERT",
+      ResourceRecordSet: {
+        Name: mailFromDomain,
+        Type: "MX",
+        TTL: 1800,
+        ResourceRecords: [
+          { Value: `10 feedback-smtp.${region}.amazonses.com` }
+        ]
       }
-      async verifyRecords(data) {
-        const { domain, dkimTokens, mailFromDomain, region } = data;
-        const missing = [];
-        const incorrect = [];
-        for (const token of dkimTokens) {
-          const name = `${token}._domainkey.${domain}`;
-          const expectedValue = `${token}.dkim.amazonses.com`;
-          const record = await this.findRecord(name, "CNAME");
-          if (!record) {
-            missing.push(`DKIM: ${name}`);
-          } else if (record.value !== expectedValue) {
-            incorrect.push(`DKIM: ${name} (expected ${expectedValue})`);
-          }
-        }
-        const spfRecord = await this.findRecord(domain, "TXT");
-        if (!spfRecord) {
-          missing.push(`SPF: ${domain}`);
-        } else if (!spfRecord.value.includes("include:amazonses.com")) {
-          incorrect.push(`SPF: ${domain} (missing amazonses.com include)`);
-        }
-        const dmarcRecord = await this.findRecord(`_dmarc.${domain}`, "TXT");
-        if (!dmarcRecord) {
-          missing.push(`DMARC: _dmarc.${domain}`);
-        }
-        if (mailFromDomain) {
-          const mxRecord = await this.findRecord(mailFromDomain, "MX");
-          if (!mxRecord) {
-            missing.push(`MX: ${mailFromDomain}`);
-          } else if (!mxRecord.value.includes(`feedback-smtp.${region}.amazonses.com`)) {
-            incorrect.push(`MX: ${mailFromDomain}`);
-          }
-          const mailFromSpf = await this.findRecord(mailFromDomain, "TXT");
-          if (!mailFromSpf) {
-            missing.push(`SPF: ${mailFromDomain}`);
-          }
-        }
-        return {
-          verified: missing.length === 0 && incorrect.length === 0,
-          missing,
-          incorrect
-        };
+    });
+    changes.push({
+      Action: "UPSERT",
+      ResourceRecordSet: {
+        Name: mailFromDomain,
+        Type: "TXT",
+        TTL: 1800,
+        ResourceRecords: [{ Value: '"v=spf1 include:amazonses.com ~all"' }]
       }
-    };
+    });
+  }
+  await client2.send(
+    new ChangeResourceRecordSetsCommand2({
+      HostedZoneId: hostedZoneId,
+      ChangeBatch: {
+        Changes: changes
+      }
+    })
+  );
+}
+async function deleteDNSRecords(hostedZoneId, domain, dkimTokens, region, customTrackingDomain, mailFromDomain) {
+  const { deleteEmailDNSRecordsForProvider: deleteEmailDNSRecordsForProvider2 } = await Promise.resolve().then(() => (init_email_dns_cleanup(), email_dns_cleanup_exports));
+  return deleteEmailDNSRecordsForProvider2(
+    { provider: "route53", hostedZoneId },
+    {
+      domain,
+      dkimTokens,
+      region,
+      customTrackingDomain,
+      mailFromDomain
+    }
+  );
+}
+var init_route53 = __esm({
+  "src/utils/route53.ts"() {
+    "use strict";
+    init_esm_shims();
   }
 });
 
@@ -26415,9 +26616,9 @@ __export(create_records_exports, {
   normalizeRoute53Name: () => normalizeRoute53Name
 });
 import {
-  ChangeResourceRecordSetsCommand as ChangeResourceRecordSetsCommand2,
-  ListResourceRecordSetsCommand as ListResourceRecordSetsCommand2,
-  Route53Client as Route53Client2
+  ChangeResourceRecordSetsCommand as ChangeResourceRecordSetsCommand3,
+  ListResourceRecordSetsCommand as ListResourceRecordSetsCommand3,
+  Route53Client as Route53Client3
 } from "@aws-sdk/client-route-53";
 import pc7 from "picocolors";
 function buildEmailDNSRecords(data) {
@@ -26634,7 +26835,7 @@ async function listExistingRoute53InboundRecords(client2, hostedZoneId, name) {
   const MAX_PAGES = 50;
   for (let page = 0; page < MAX_PAGES; page++) {
     const response = await client2.send(
-      new ListResourceRecordSetsCommand2({
+      new ListResourceRecordSetsCommand3({
         HostedZoneId: hostedZoneId,
         StartRecordName: startRecordName,
         StartRecordType: startRecordType
@@ -26814,7 +27015,7 @@ async function createInboundDNSRecordsForProvider(credentials, receivingDomain,
   const records = buildInboundDNSRecords(receivingDomain, region);
   switch (credentials.provider) {
     case "route53": {
-      const client2 = new Route53Client2({ region });
+      const client2 = new Route53Client3({ region });
       let existing;
       try {
         existing = await listExistingRoute53InboundRecords(
@@ -26862,7 +27063,7 @@ async function createInboundDNSRecordsForProvider(credentials, receivingDomain,
       }
       try {
         await client2.send(
-          new ChangeResourceRecordSetsCommand2({
+          new ChangeResourceRecordSetsCommand3({
             HostedZoneId: credentials.hostedZoneId,
             ChangeBatch: { Changes: changes }
           })
@@ -31180,10 +31381,10 @@ var init_credentials = __esm({
 
 // src/utils/dns/inbound-dns-cleanup.ts
 import {
-  ChangeResourceRecordSetsCommand as ChangeResourceRecordSetsCommand3,
-  Route53Client as Route53Client3
+  ChangeResourceRecordSetsCommand as ChangeResourceRecordSetsCommand4,
+  Route53Client as Route53Client4
 } from "@aws-sdk/client-route-53";
-async function deleteViaValueMatchedClient(client2, records) {
+async function deleteViaValueMatchedClient2(client2, records) {
   const deleted = [];
   const skipped = [];
   const errors2 = [];
@@ -31292,7 +31493,7 @@ function buildRoute53InboundTXTRemoval(record, existing) {
   return { change: null };
 }
 async function deleteRoute53InboundRecords(hostedZoneId, receivingDomain, region, records) {
-  const client2 = new Route53Client3({ region });
+  const client2 = new Route53Client4({ region });
   let existing;
   try {
     existing = await listExistingRoute53InboundRecords(
@@ -31345,7 +31546,7 @@ async function deleteRoute53InboundRecords(hostedZoneId, receivingDomain, region
   }
   try {
     await client2.send(
-      new ChangeResourceRecordSetsCommand3({
+      new ChangeResourceRecordSetsCommand4({
         HostedZoneId: hostedZoneId,
         ChangeBatch: { Changes: changes }
       })
@@ -31368,7 +31569,7 @@ async function deleteInboundDNSRecordsForProvider(credentials, receivingDomain,
         credentials.zoneId,
         credentials.token
       );
-      return deleteViaValueMatchedClient(client2, records);
+      return deleteViaValueMatchedClient2(client2, records);
     }
     case "vercel": {
       const client2 = new VercelDNSClient(
@@ -31376,7 +31577,7 @@ async function deleteInboundDNSRecordsForProvider(credentials, receivingDomain,
         credentials.token,
         credentials.teamId
       );
-      return deleteViaValueMatchedClient(client2, records);
+      return deleteViaValueMatchedClient2(client2, records);
     }
     case "route53":
       return deleteRoute53InboundRecords(
@@ -31400,7 +31601,7 @@ var init_inbound_dns_cleanup = __esm({
 });
 
 // src/utils/dns/inbound-preflight.ts
-import { Route53Client as Route53Client4 } from "@aws-sdk/client-route-53";
+import { Route53Client as Route53Client5 } from "@aws-sdk/client-route-53";
 import * as clack24 from "@clack/prompts";
 function stripQuotes(value) {
   return value.replace(/^"|"$/g, "");
@@ -31478,7 +31679,7 @@ async function checkInboundDNSPreflight(credentials, receivingDomain, region, pa
     }
   }
   try {
-    const client2 = new Route53Client4({ region });
+    const client2 = new Route53Client5({ region });
     const existing = await listExistingRoute53InboundRecords(
       client2,
       credentials.hostedZoneId,
@@ -31577,6 +31778,7 @@ __export(dns_exports, {
   checkInboundDNSPreflight: () => checkInboundDNSPreflight,
   createDNSRecordsForProvider: () => createDNSRecordsForProvider,
   createInboundDNSRecordsForProvider: () => createInboundDNSRecordsForProvider,
+  deleteEmailDNSRecordsForProvider: () => deleteEmailDNSRecordsForProvider,
   deleteInboundDNSRecordsForProvider: () => deleteInboundDNSRecordsForProvider,
   describeInboundDNSConflict: () => describeInboundDNSConflict,
   detectAvailableDNSProviders: () => detectAvailableDNSProviders,
@@ -31599,6 +31801,7 @@ var init_dns = __esm({
     init_cloudflare();
     init_create_records();
     init_credentials();
+    init_email_dns_cleanup();
     init_inbound_dns_cleanup();
     init_inbound_preflight();
     init_vercel();
@@ -34712,13 +34915,13 @@ async function emptyS3Bucket(bucketName, region) {
 }
 async function deleteCdnDNSRecords(hostedZoneId, customDomain) {
   const {
-    Route53Client: Route53Client6,
-    ListResourceRecordSetsCommand: ListResourceRecordSetsCommand3,
-    ChangeResourceRecordSetsCommand: ChangeResourceRecordSetsCommand5
+    Route53Client: Route53Client7,
+    ListResourceRecordSetsCommand: ListResourceRecordSetsCommand4,
+    ChangeResourceRecordSetsCommand: ChangeResourceRecordSetsCommand6
   } = await import("@aws-sdk/client-route-53");
-  const route533 = new Route53Client6({ region: "us-east-1" });
+  const route533 = new Route53Client7({ region: "us-east-1" });
   const listResponse = await route533.send(
-    new ListResourceRecordSetsCommand3({
+    new ListResourceRecordSetsCommand4({
       HostedZoneId: hostedZoneId
     })
   );
@@ -34736,7 +34939,7 @@ async function deleteCdnDNSRecords(hostedZoneId, customDomain) {
     ResourceRecordSet: record
   }));
   await route533.send(
-    new ChangeResourceRecordSetsCommand5({
+    new ChangeResourceRecordSetsCommand6({
       HostedZoneId: hostedZoneId,
       ChangeBatch: { Changes: changes }
     })
@@ -36109,13 +36312,13 @@ ${pc12.yellow(pc12.bold("Configuration Notes:"))}`);
         try {
           progress.start("Checking existing DNS records");
           const {
-            Route53Client: Route53Client6,
-            ListResourceRecordSetsCommand: ListResourceRecordSetsCommand3,
-            ChangeResourceRecordSetsCommand: ChangeResourceRecordSetsCommand5
+            Route53Client: Route53Client7,
+            ListResourceRecordSetsCommand: ListResourceRecordSetsCommand4,
+            ChangeResourceRecordSetsCommand: ChangeResourceRecordSetsCommand6
           } = await import("@aws-sdk/client-route-53");
-          const route533 = new Route53Client6({ region: "us-east-1" });
+          const route533 = new Route53Client7({ region: "us-east-1" });
           const existingRecords = await route533.send(
-            new ListResourceRecordSetsCommand3({
+            new ListResourceRecordSetsCommand4({
               HostedZoneId: hostedZone.id,
               StartRecordName: outputs.customDomain,
               StartRecordType: "CNAME",
@@ -36203,7 +36406,7 @@ ${pc12.yellow(pc12.bold("Configuration Notes:"))}`);
             }));
             if (changes.length > 0) {
               await route533.send(
-                new ChangeResourceRecordSetsCommand5({
+                new ChangeResourceRecordSetsCommand6({
                   HostedZoneId: hostedZone.id,
                   ChangeBatch: { Changes: changes }
                 })
@@ -41493,9 +41696,9 @@ var IP_BLACKLISTS = [
   { name: "ScientificSpam", zone: "bl.scientificspam.net", priority: "medium" },
   { name: "Swinog IP", zone: "dnsrbl.swinog.ch", priority: "medium" },
   { name: "Kempt.net", zone: "dnsbl.kempt.net", priority: "low" },
-  { name: "Anonmails", zone: "spam.dnsbl.anonmails.de", priority: "low" },
+  { name: "Anonmails", zone: "spam.dnsbl.anonmails.de", priority: "low" }
   // Reputation lists
-  { name: "Composite BL", zone: "cbl.anti-spam.org.cn", priority: "low" }
+  // cbl.anti-spam.org.cn removed: dead zone, wildcards every query to 208.98.x.x
 ];
 var DEFAULT_TIMEOUT3 = 5e3;
 var SPF_LOOKUP_LIMIT = 10;
@@ -41958,8 +42161,11 @@ var TEST_RETURN_CODES = /* @__PURE__ */ new Set([
   "127.255.255.255"
   // Reserved/test
 ]);
+function isValidListingResponse(returnCode) {
+  return returnCode.startsWith("127.");
+}
 function isTestResponse(returnCode) {
-  return TEST_RETURN_CODES.has(returnCode);
+  return !isValidListingResponse(returnCode) || TEST_RETURN_CODES.has(returnCode);
 }
 async function checkBlacklist(options) {
   const { quick = false, skip = false, domain, ips = [] } = options;
@@ -43260,7 +43466,7 @@ async function parseAndValidateSpf(domain, record, result) {
     result.valid = false;
   } else if (allMechanism === "?all") {
     result.warnings.push(
-      "SPF uses ?all (neutral) - consider using -all or ~all"
+      "SPF uses ?all (neutral) - consider using ~all or -all"
     );
   } else if (!allMechanism) {
     result.warnings.push(
@@ -43396,7 +43602,7 @@ var GRADE_BANDS = {
 function calculateScore(checks) {
   const deductions = [];
   const bonuses = [];
-  collectSpfIssues(checks.spf, deductions);
+  collectSpfIssues(checks.spf, checks.dmarc, deductions);
   collectDkimIssues(checks, deductions, bonuses);
   collectDmarcIssues(checks.dmarc, deductions, bonuses);
   collectInfraIssues(checks, deductions, bonuses);
@@ -43497,7 +43703,22 @@ function determineGrade(checks) {
   }
   return "F";
 }
-function collectSpfIssues(spf, deductions) {
+function dmarcEnforces(dmarc) {
+  return dmarc.exists && dmarc.valid && !dmarc.testing && (dmarc.policy === "quarantine" || dmarc.policy === "reject");
+}
+var AUTHORIZING_MECHANISM = /^(?:a|mx|ptr)(?:[:/]|$)|^(?:ip4|ip6|include|exists):/i;
+function authorizesSenders(spf) {
+  return (spf.record ?? "").trim().split(/\s+/).slice(1).some((term) => {
+    if (/^redirect=/i.test(term)) {
+      return true;
+    }
+    return AUTHORIZING_MECHANISM.test(term.replace(/^[+\-~?]/, ""));
+  });
+}
+function hardfailWithoutEnforcingDmarc(spf, dmarc) {
+  return spf.allMechanism === "-all" && authorizesSenders(spf) && !dmarcEnforces(dmarc);
+}
+function collectSpfIssues(spf, dmarc, deductions) {
   if (!spf.exists) {
     deductions.push({ check: "spf", points: 5, reason: "No SPF record" });
     return;
@@ -43536,11 +43757,11 @@ function collectSpfIssues(spf, deductions) {
       points: 3,
       reason: "SPF ?all is too permissive"
     });
-  } else if (spf.allMechanism === "~all") {
+  } else if (hardfailWithoutEnforcingDmarc(spf, dmarc)) {
     deductions.push({
       check: "spf",
       points: 2,
-      reason: "SPF ~all (softfail) instead of -all (hardfail)"
+      reason: "SPF -all (hardfail) without an enforcing DMARC policy \u2014 forwarded mail is rejected before DKIM is checked"
     });
   }
   if (spf.lookupCount > 10) {
@@ -44081,7 +44302,7 @@ function displayResults2(result, options) {
   console.log();
   console.log(pc21.bold("AUTHENTICATION"));
   console.log();
-  displaySpfResult(spf, options.verbose);
+  displaySpfResult(spf, dmarc, options.verbose);
   displayDkimResult(dkim, options.verbose);
   displayDmarcResult(dmarc);
   displayBimiResult(bimi, result.domain);
@@ -44221,7 +44442,7 @@ function displayScoreBox(domain, score, grade, quick) {
   console.log(pc21.dim("\u2502") + " ".repeat(width - 2) + pc21.dim("\u2502"));
   console.log(pc21.dim(`\u2570${"\u2500".repeat(width - 2)}\u256F`));
 }
-function displaySpfResult(spf, verbose) {
+function displaySpfResult(spf, dmarc, verbose) {
   const status2 = spf.exists && spf.valid ? pc21.green("\u2713") : spf.exists ? pc21.yellow("\u26A0") : pc21.red("\u2717");
   console.log(
     `  ${status2} ${pc21.dim("SPF")}              ${spf.record || "Not found"}`
@@ -44237,9 +44458,9 @@ function displaySpfResult(spf, verbose) {
         "                     " + formatSpfLookupTree(spf.lookupTree).split("\n").join("\n                     ")
       );
     }
-    if (spf.allMechanism === "~all") {
+    if (hardfailWithoutEnforcingDmarc(spf, dmarc)) {
       console.log(
-        `                     ${pc21.dim("Softfail (~all) \u2014 consider using -all for strict enforcement")}`
+        `                     ${pc21.yellow("Hardfail (-all) with no enforcing DMARC \u2014 forwarded mail is rejected before DKIM is checked")}`
       );
     }
   }
@@ -45272,6 +45493,17 @@ async function getEmailIdentityInfo(domain, region) {
     throw error;
   }
 }
+function reportEmailDNSCleanup(result) {
+  for (const label of result.deleted) {
+    clack22.log.success(`Deleted DNS record: ${label}`);
+  }
+  for (const skip of result.skipped) {
+    clack22.log.warn(`Left DNS record in place: ${skip.record} (${skip.reason})`);
+  }
+  for (const err of result.errors) {
+    clack22.log.warn(`DNS cleanup error: ${err}`);
+  }
+}
 function selectAgentsToDestroy(emailConfig) {
   const agentsConfig = emailConfig?.agents;
   if (!agentsConfig?.enabled) {
@@ -45419,7 +45651,7 @@ async function emailDestroy(options) {
         shouldCleanDNS = true;
       } else {
         const cleanDNS = await clack22.confirm({
-          message: `Found Route53 hosted zone for ${pc24.cyan(domain)}. Delete DNS records (DKIM, DMARC, MAIL FROM)?`,
+          message: `Found Route53 hosted zone for ${pc24.cyan(domain)}. Delete the DNS records Wraps created (DKIM, DMARC, tracking CNAME, MAIL FROM)? Records Wraps did not create are left in place.`,
           initialValue: true
         });
         if (clack22.isCancel(cleanDNS)) {
@@ -45495,16 +45727,18 @@ async function emailDestroy(options) {
   }
   if (shouldCleanDNS && hostedZone && domain && dkimTokens.length > 0) {
     try {
-      await progress.execute(`Deleting DNS records for ${domain}`, async () => {
-        await deleteDNSRecords(
+      const result = await progress.execute(
+        `Deleting DNS records for ${domain}`,
+        () => deleteDNSRecords(
           hostedZone.id,
           domain,
           dkimTokens,
           region,
           emailConfig?.tracking?.customRedirectDomain,
           mailFromDomain
-        );
-      });
+        )
+      );
+      reportEmailDNSCleanup(result);
     } catch (error) {
       const msg = error instanceof Error ? error.message : String(error);
       clack22.log.warn(`Could not delete DNS records: ${msg}`);
@@ -45769,8 +46003,8 @@ import {
   UpdateDistributionCommand
 } from "@aws-sdk/client-cloudfront";
 import {
-  ChangeResourceRecordSetsCommand as ChangeResourceRecordSetsCommand4,
-  Route53Client as Route53Client5
+  ChangeResourceRecordSetsCommand as ChangeResourceRecordSetsCommand5,
+  Route53Client as Route53Client6
 } from "@aws-sdk/client-route-53";
 var US_EAST_1 = "us-east-1";
 var CERT_POLL_ATTEMPTS = 10;
@@ -45971,9 +46205,9 @@ async function pushValidationRecord(provider, sendingDomain, sesRegion, record)
       return result.success;
     }
     if (credResult.credentials.provider === "route53") {
-      const route533 = new Route53Client5({ region: sesRegion });
+      const route533 = new Route53Client6({ region: sesRegion });
       await route533.send(
-        new ChangeResourceRecordSetsCommand4({
+        new ChangeResourceRecordSetsCommand5({
           HostedZoneId: credResult.credentials.hostedZoneId,
           ChangeBatch: {
             Changes: [
@@ -49225,9 +49459,9 @@ async function inboundInit(options) {
         region,
         domain
       );
-      if (result.success && result.recordsCreated > 0) {
+      if (result.success) {
         progress.succeed(
-          `Created ${result.recordsCreated} DNS records in ${getDNSProviderDisplayName2(dnsProvider)}`
+          result.recordsCreated > 0 ? `Created ${result.recordsCreated} DNS records in ${getDNSProviderDisplayName2(dnsProvider)}` : `DNS already configured for ${receivingDomain}`
         );
         dnsAutoCreated = true;
       } else {
@@ -49356,6 +49590,12 @@ Deploy first: ${pc28.cyan("wraps email inbound init")}
     clack27.log.warn(
       `This will remove inbound email for ${pc28.cyan(inboundConfig.receivingDomain || "")}`
     );
+    const replyThreading = emailService.config.replyThreading;
+    if (replyThreading?.enabled && replyThreading.domains.length > 0) {
+      clack27.log.warn(
+        `Reply threading will stop working for ${replyThreading.domains.map((d6) => pc28.cyan(d6.domain)).join(", ")} once inbound infrastructure is removed. Run ${pc28.cyan("wraps email reply destroy")} to clean those up.`
+      );
+    }
     if (allInboundDomains.length > 0) {
       const { buildInboundDNSRecords: buildRecordsForDisplay } = await Promise.resolve().then(() => (init_dns(), dns_exports));
       clack27.log.info(pc28.bold("DNS records that will be deleted:"));
@@ -50036,9 +50276,9 @@ Deploy first: ${pc28.cyan("wraps email inbound init")}
         region,
         parentDomain
       );
-      if (result.success && result.recordsCreated > 0) {
+      if (result.success) {
         progress.succeed(
-          `Created ${result.recordsCreated} DNS records in ${getDNSProviderDisplayName2(dnsProvider)}`
+          result.recordsCreated > 0 ? `Created ${result.recordsCreated} DNS records in ${getDNSProviderDisplayName2(dnsProvider)}` : `DNS already configured for ${receivingDomain}`
         );
         dnsAutoCreated = true;
         if (replyThreadingEnabled) {
@@ -51854,9 +52094,9 @@ to diagnose, or retry the init.`,
           region,
           domain
         );
-        if (result.success && result.recordsCreated > 0) {
+        if (result.success) {
           progress.succeed(
-            `Created ${result.recordsCreated} DNS records for r.mail.${domain} via ${getDNSProviderDisplayName2(dnsProvider)}`
+            result.recordsCreated > 0 ? `Created ${result.recordsCreated} DNS records for r.mail.${domain} via ${getDNSProviderDisplayName2(dnsProvider)}` : `DNS already configured for r.mail.${domain}`
           );
           dnsAutoCreated = true;
         }
@@ -52327,17 +52567,65 @@ function stripDomainFromReplyThreadingMetadata(params) {
     domains: remaining
   };
 }
+var UNSUPPORTED_REPLY_DNS_CLEANUP = {
+  deleted: [],
+  skipped: [],
+  supported: false,
+  errors: []
+};
 async function cleanupDomainInfra(params) {
-  const { domain, region, progress } = params;
+  const { domain, region, progress, metadata } = params;
   await progress.execute(
     `Removing r.mail.${domain} from receipt rule`,
     async () => {
       await removeDomainFromReceiptRule(region, `r.mail.${domain}`);
     }
   );
-  clack34.log.info(
-    `Remove MX/SPF DNS records for ${pc35.cyan(`r.mail.${domain}`)} from your DNS provider.`
-  );
+  const dnsProvider = metadata.services.email?.dnsProvider;
+  if (!dnsProvider || dnsProvider === "manual") {
+    return UNSUPPORTED_REPLY_DNS_CLEANUP;
+  }
+  try {
+    const { getDNSCredentials: getDNSCredentials2, deleteInboundDNSRecordsForProvider: deleteInboundDNSRecordsForProvider2 } = await Promise.resolve().then(() => (init_dns(), dns_exports));
+    const credentialResult = await getDNSCredentials2(
+      dnsProvider,
+      domain,
+      region
+    );
+    if (!(credentialResult.valid && credentialResult.credentials)) {
+      clack34.log.warn(
+        `Could not validate ${dnsProvider} credentials to delete DNS records for r.mail.${domain}: ${credentialResult.error || "unknown error"}`
+      );
+      return UNSUPPORTED_REPLY_DNS_CLEANUP;
+    }
+    return await deleteInboundDNSRecordsForProvider2(
+      credentialResult.credentials,
+      `r.mail.${domain}`,
+      region,
+      domain
+    );
+  } catch (error) {
+    clack34.log.warn(
+      `Failed to delete DNS records for r.mail.${domain}: ${error instanceof Error ? error.message : String(error)}`
+    );
+    return UNSUPPORTED_REPLY_DNS_CLEANUP;
+  }
+}
+function reportReplyDNSCleanup(result, domain) {
+  for (const label of result.deleted) {
+    clack34.log.success(`Deleted DNS record: ${label}`);
+  }
+  for (const skip of result.skipped) {
+    clack34.log.warn(`Left DNS record in place: ${skip.record} (${skip.reason})`);
+  }
+  for (const err of result.errors) {
+    clack34.log.warn(`DNS cleanup error: ${err}`);
+  }
+  if (!result.supported) {
+    clack34.log.info(
+      `Remove MX/SPF DNS records for ${pc35.cyan(`r.mail.${domain}`)} from your DNS provider.`
+    );
+  }
 }
 async function replyDestroy(options) {
   if (!isJsonMode()) {
@@ -52447,20 +52735,33 @@ async function replyDestroy(options) {
       }
     );
   }
+  const dnsCleanupByDomain = [];
   for (const domain of targets) {
-    await cleanupDomainInfra({ domain, region, progress });
+    const result = await cleanupDomainInfra({
+      domain,
+      region,
+      progress,
+      metadata
+    });
+    dnsCleanupByDomain.push({ domain, result });
   }
   await saveConnectionMetadata(metadata);
   if (isJsonMode()) {
     jsonSuccess("email.reply.destroy", {
       removed: targets,
-      region
+      region,
+      dnsDeleted: dnsCleanupByDomain.flatMap((d6) => d6.result.deleted),
+      dnsSkipped: dnsCleanupByDomain.flatMap((d6) => d6.result.skipped),
+      dnsSupported: dnsCleanupByDomain.some((d6) => d6.result.supported)
     });
     return;
   }
   console.log();
   clack34.log.success(`Removed reply threading for ${targets.join(", ")}.`);
   console.log();
+  for (const { domain, result } of dnsCleanupByDomain) {
+    reportReplyDNSCleanup(result, domain);
+  }
 }
 async function replyDecode(addressInput, options) {
   const progress = new DeploymentProgress();