void 0.20.0 → 0.20.1

package/dist/{auth-cmd-CYVhSNFy.mjs → auth-cmd-CAH62yDU.mjs}

@@ -1,7 +1,7 @@
 import { D as log } from "./output-tFQLLj26.mjs";
 import { c as getToken, p as removeToken } from "./auth-W9WII-mN.mjs";
-import { n as PlatformClient } from "./client-CyCHWSO_.mjs";
-import { n as runLoginCommand } from "./login-C8-UuLnp.mjs";
+import { n as PlatformClient } from "./client-Clirrol3.mjs";
+import { n as runLoginCommand } from "./login-pV69H-ZO.mjs";
 import { execSync } from "node:child_process";
 //#region src/cli/auth-cmd.ts
 async function runAuthCommand(root, args) {

package/dist/{build-cmd-CkVD1uOh.mjs → build-cmd-CJvZvPQO.mjs}

@@ -1,6 +1,6 @@
 import { D as log, E as intro, a as dim, c as import_picocolors, k as outro, r as cliTitle } from "./output-tFQLLj26.mjs";
 import { c as getToken, x as readProjectConfig } from "./auth-W9WII-mN.mjs";
-import { n as PlatformClient, t as PlatformApiError } from "./client-CyCHWSO_.mjs";
+import { n as PlatformClient, t as PlatformApiError } from "./client-Clirrol3.mjs";
 import { r as resolveProjectBySlug, t as getRequestedProjectSlug } from "./resolve-project--Vxawf7z.mjs";
 import { appendFileSync, writeFileSync } from "node:fs";
 //#region src/cli/build-cmd.ts

package/dist/{cache-QcUfR-ff.mjs → cache-BlNeQjuP.mjs}

@@ -1,6 +1,6 @@
 import { D as log, E as intro, a as dim, i as createSpinner, k as outro, r as cliTitle } from "./output-tFQLLj26.mjs";
 import { c as getToken, x as readProjectConfig } from "./auth-W9WII-mN.mjs";
-import { n as PlatformClient } from "./client-CyCHWSO_.mjs";
+import { n as PlatformClient } from "./client-Clirrol3.mjs";
 import { r as resolveProjectBySlug, t as getRequestedProjectSlug } from "./resolve-project--Vxawf7z.mjs";
 //#region src/cli/cache.ts
 async function runPurgeCacheCommand(root, projectSlug) {

package/dist/{cancel-deploy-DsvWKFTe.mjs → cancel-deploy-CmlAZ9P6.mjs}

@@ -1,6 +1,6 @@
 import { D as log, E as intro, F as isCancel, k as outro, r as cliTitle, w as confirm } from "./output-tFQLLj26.mjs";
 import { c as getToken, x as readProjectConfig } from "./auth-W9WII-mN.mjs";
-import { n as PlatformClient } from "./client-CyCHWSO_.mjs";
+import { n as PlatformClient } from "./client-Clirrol3.mjs";
 //#region src/cli/cancel-deploy.ts
 const ACTIVE_STATUSES = /* @__PURE__ */ new Set([
 	"pending",

package/dist/cli/cli.mjs

@@ -490,6 +490,11 @@ const emailSubcommands = [
 		arg: "<address>",
 		description: "Remove a verified recipient"
 	},
+	{
+		name: "domain",
+		arg: "<add|status|list|sync|remove>",
+		description: "Send and receive at your own domain on a Cloudflare zone"
+	},
 	{
 		name: "status",
 		description: "Show the email setup state and address map",
@@ -507,9 +512,17 @@ const EMAIL_SUBCOMMANDS = [
 	"destinations",
 	"allow",
 	"disallow",
+	"domain",
 	"status",
 	"setup"
 ];
+const EMAIL_DOMAIN_VERBS = [
+	"add",
+	"status",
+	"list",
+	"sync",
+	"remove"
+];
 /**
 * Read a value-taking flag in its `--flag value` or `--flag=value` form. Returns the
 * raw value, or `undefined` when the flag is the last token or is followed by another
@@ -534,11 +547,13 @@ function readFlagValue(rest, i, flag) {
 }
 function parseEmailArgs(args) {
 	const subcommand = args[0];
-	if (!subcommand || !EMAIL_SUBCOMMANDS.includes(subcommand)) throw new Error("email: Usage: void email <usage|logs|destinations|allow|disallow|status|setup> [args] [--project <name>] [--limit <n>] [--platform cloudflare].");
+	if (!subcommand || !EMAIL_SUBCOMMANDS.includes(subcommand)) throw new Error("email: Usage: void email <usage|logs|destinations|allow|disallow|domain|status|setup> [args] [--project <name>] [--limit <n>] [--platform cloudflare].");
 	let limit;
 	const projectValues = [];
 	const platformValues = [];
 	const backendValues = [];
+	const subdomainValues = [];
+	let forceCount = 0;
 	const positional = [];
 	const rest = args.slice(1);
 	for (let i = 0; i < rest.length; i++) if (rest[i] === "--project" || rest[i]?.startsWith("--project=")) {
@@ -563,7 +578,17 @@ function parseEmailArgs(args) {
 		if (value === void 0) throw new Error("email: --backend requires a value ('cloudflare').");
 		backendValues.push(value);
 		i = next;
+	} else if (rest[i] === "--subdomain" || rest[i]?.startsWith("--subdomain=")) {
+		const { value, next } = readFlagValue(rest, i, "--subdomain");
+		if (value === void 0 || value.trim() === "") throw new Error("email: --subdomain requires a value (a subdomain label or host).");
+		subdomainValues.push(value);
+		i = next;
+	} else if (rest[i] === "--force" || rest[i]?.startsWith("--force=")) {
+		if (rest[i] !== "--force") throw new Error("email: --force takes no value.");
+		forceCount++;
 	} else positional.push(rest[i]);
+	if (forceCount > 1) throw new Error("email: --force can only be specified once.");
+	const force = forceCount > 0 ? true : void 0;
 	if (projectValues.length > 1) throw new Error("email: --project can only be specified once.");
 	const projectSlug = projectValues[0];
 	if (backendValues.length > 1) throw new Error("email: --backend can only be specified once.");
@@ -580,6 +605,20 @@ function parseEmailArgs(args) {
 		if (backendValue !== "cloudflare") throw new Error("email: --backend must be 'cloudflare'.");
 		platform = "cloudflare";
 	}
+	if (subdomainValues.length > 1) throw new Error("email: --subdomain can only be specified once.");
+	const subdomain = subdomainValues[0];
+	if (subcommand === "domain") {
+		if (platform === "cloudflare") throw new Error("email: --platform cloudflare applies to `void email status` and `void email setup` only (`domain` is a Void platform command).");
+		return parseEmailDomainArgs(positional, {
+			projectSlug,
+			limit,
+			platform,
+			subdomain,
+			force
+		});
+	}
+	if (subdomain !== void 0) throw new Error("email: --subdomain applies to `void email domain add` only.");
+	if (force !== void 0) throw new Error("email: --force applies to `void email domain remove` only.");
 	if (positional.length > 1) throw new Error(`email: \`void email ${subcommand}\` takes exactly one positional argument (got ${positional.length}: ${positional.map((p) => JSON.stringify(p)).join(", ")}).`);
 	const address = positional[0];
 	if ((subcommand === "allow" || subcommand === "disallow") && !address) throw new Error(`email: Usage: void email ${subcommand} <address> [--project <name>].`);
@@ -596,6 +635,34 @@ function parseEmailArgs(args) {
 		platform
 	};
 }
+/**
+* The nested `void email domain <verb> [<domain>]` group. positional[0] is the
+* verb, positional[1] the domain — `list` takes no domain, every other verb
+* requires exactly one. Shape validation of the domain itself is the command's
+* job (and ultimately the api's — its regex is authoritative); the parser only
+* counts positionals, exactly as it does for `allow <address>`.
+*/
+function parseEmailDomainArgs(positional, flags) {
+	const verb = positional[0];
+	if (!verb || !EMAIL_DOMAIN_VERBS.includes(verb)) throw new Error("email: Usage: void email domain <add|status|list|sync|remove> [<domain>] [--project <name>].");
+	if (flags.subdomain !== void 0 && verb !== "add") throw new Error("email: --subdomain applies to `void email domain add` only.");
+	if (flags.force !== void 0 && verb !== "remove") throw new Error("email: --force applies to `void email domain remove` only.");
+	const domain = positional[1];
+	if (verb === "list") {
+		if (domain !== void 0) throw new Error("email: `void email domain list` takes no domain argument.");
+	} else if (domain === void 0) throw new Error(`email: Usage: void email domain ${verb} <domain> [--project <name>].`);
+	if (positional.length > 2) throw new Error(`email: \`void email domain ${verb}\` takes exactly one domain argument (got ${positional.length - 1}: ${positional.slice(1).map((p) => JSON.stringify(p)).join(", ")}).`);
+	return {
+		subcommand: "domain",
+		domainVerb: verb,
+		domain,
+		subdomain: flags.subdomain,
+		force: flags.force,
+		projectSlug: flags.projectSlug,
+		limit: flags.limit,
+		platform: flags.platform
+	};
+}
 //#endregion
 //#region src/cli/env-args.ts
 const envSubcommands = [{
@@ -2175,7 +2242,7 @@ const HELP_TREE = {
 		}
 	},
 	email: {
-		summary: "Inspect email activity and manage verified recipients.",
+		summary: "Inspect email activity, manage verified recipients, and send and receive at your own domain.",
 		usage: ["void email <command>"],
 		commands: [
 			{
@@ -2198,6 +2265,10 @@ const HELP_TREE = {
 				command: "disallow <address>",
 				description: "Remove a recipient from the allowlist"
 			},
+			{
+				command: "domain <add|status|list|sync|remove>",
+				description: "Send and receive at your own domain on a Cloudflare zone"
+			},
 			{
 				command: "status --platform cloudflare",
 				description: "Show the email setup state and address map on your own account"
@@ -2223,6 +2294,66 @@ const HELP_TREE = {
 			destinations: withProjectOption("List verified recipient addresses.", "void email destinations [options]"),
 			allow: withProjectOption("Add a recipient and trigger a Cloudflare verification email.", "void email allow <address> [options]"),
 			disallow: withProjectOption("Remove a recipient from the verified allowlist.", "void email disallow <address> [options]"),
+			domain: {
+				summary: "Send and receive at your own domain on a Cloudflare zone.",
+				usage: ["void email domain <verb> [<domain>] [options]"],
+				commands: [
+					{
+						command: "add <domain>",
+						description: "Register the domain (OAuth grant, or a scoped API token)"
+					},
+					{
+						command: "status <domain>",
+						description: "Show state; re-probes the credential and relay, polls a pending row"
+					},
+					{
+						command: "list",
+						description: "List registered email domains"
+					},
+					{
+						command: "sync <domain>",
+						description: "Redeploy the relay at the current version and rotate its secret"
+					},
+					{
+						command: "remove <domain>",
+						description: "Delete the registration, stored credential, and relay secret"
+					}
+				],
+				options: [{
+					command: "--subdomain <label|host>",
+					description: "On add: register this subdomain instead of the proposed mail.<domain>"
+				}, {
+					command: "--project <name>",
+					description: "Project name override"
+				}],
+				children: {
+					add: {
+						summary: "Register a domain on a Cloudflare zone you own for sending and receiving. Proposes mail.<domain> when the apex already carries MX.",
+						usage: ["void email domain add <domain> [options]"],
+						options: [{
+							command: "--subdomain <label|host>",
+							description: "Register this subdomain instead of the proposed mail.<domain>"
+						}, {
+							command: "--project <name>",
+							description: "Project name override"
+						}]
+					},
+					status: withProjectOption("Show a registered domain, re-probing its credential and relay.", "void email domain status <domain> [options]"),
+					list: withProjectOption("List registered email domains.", "void email domain list [options]"),
+					sync: withProjectOption("Redeploy the relay at the current version and rotate its secret.", "void email domain sync <domain> [options]"),
+					remove: {
+						summary: "Delete the registration, stored credential, and relay secret.",
+						usage: ["void email domain remove <domain> [options]"],
+						options: [{
+							command: "--force",
+							description: "Drop the row even when Cloudflare-side cleanup fails"
+						}, {
+							command: "--project <name>",
+							description: "Project name override"
+						}]
+					}
+				}
+			},
 			status: {
 				summary: "Show the email setup state and address map. Exit 1 when not ready.",
 				usage: ["void email status --platform cloudflare"],
@@ -3488,7 +3619,7 @@ if (helpPath) {
 		log.error(formatCloudflareUserMessage(err instanceof Error ? err.message : String(err)));
 		process.exit(1);
 	}
-	import("../deploy-CcDoeBIf.mjs").then((n) => n.n).then(({ runDeploy }) => {
+	import("../deploy-iXZ3F0N6.mjs").then((n) => n.n).then(({ runDeploy }) => {
 		runDeploy(root, {
 			projectSlug: deployArgs.projectSlug,
 			dir: deployArgs.dir,
@@ -3506,24 +3637,24 @@ if (helpPath) {
 	});
 } else if (command === "connect") (async () => {
 	const parsed = parseConnectArgs(args.slice(1));
-	const { runConnectCommand } = await import("../connect-D9Yr-T5f.mjs");
+	const { runConnectCommand } = await import("../connect-C04Wdy_h.mjs");
 	await runConnectCommand(process.cwd(), parsed);
 })().catch((err) => {
 	log.error(formatCloudflareUserMessage(err instanceof Error ? err.message : String(err)));
 	process.exit(1);
 });
-else if (command === "auth") runSubcommandGroup("auth", authSubcommands, parseAuthArgs, (root, parsed) => import("../auth-cmd-CYVhSNFy.mjs").then(({ runAuthCommand }) => runAuthCommand(root, parsed)));
-else if (command === "platform") runSubcommandGroup("platform", platformSubcommands, parsePlatformArgs, (root, parsed) => import("../platform-cmd-BEOVv1PN.mjs").then(({ runPlatformCommand }) => runPlatformCommand(root, parsed)));
-else if (command === "cloudflare") runSubcommandGroup("cloudflare", cloudflareSubcommands, parseCloudflareArgs, (root, parsed) => import("../cloudflare-cmd-D3ME2GAe.mjs").then(({ runCloudflareCommand }) => runCloudflareCommand(root, parsed)));
-else if (command === "project") runSubcommandGroup("project", projectSubcommands, parseProjectArgs, (root, parsed) => import("../project-cmd-DCpk1cDt.mjs").then(({ runProjectCommand }) => runProjectCommand(root, parsed)));
-else if (command === "secret") runSubcommandGroup("secret", secretSubcommands, parseSecretArgs, (root, parsed) => import("../secret-BqTxGqki.mjs").then(({ runSecretCommand }) => runSecretCommand(root, parsed)));
-else if (command === "domain") runSubcommandGroup("domain", domainSubcommands, parseDomainArgs, (root, parsed) => import("../domain-gu_iaHmn.mjs").then(({ runDomainCommand }) => runDomainCommand(root, parsed)));
-else if (command === "email") runSubcommandGroup("email", emailSubcommands, parseEmailArgs, (root, parsed) => import("../email-r6DHJyAB.mjs").then(({ runEmailCommand }) => runEmailCommand(root, parsed)));
-else if (command === "db") runSubcommandGroup("db", dbSubcommands, parseDbArgs, (root, parsed) => import("../db-BxoUWL0F.mjs").then(({ runDbCommand }) => runDbCommand(root, parsed)));
-else if (command === "env") runSubcommandGroup("env", envSubcommands, parseEnvArgs, (root, parsed) => import("../env-DmU2To0C.mjs").then(({ runEnvCommand }) => runEnvCommand(root, parsed)));
-else if (command === "gen") runSubcommandGroup("gen", genSubcommands, parseGenArgs, (root, parsed) => import("../gen-BKw6qHIg.mjs").then(({ runGenCommand }) => runGenCommand(root, parsed)));
-else if (command === "github") runSubcommandGroup("github", githubSubcommands, parseGithubArgs, (root, parsed) => import("../github-cmd-DJS5Ab-H.mjs").then(({ runGithubCommand }) => runGithubCommand(root, parsed)));
-else if (command === "build") runSubcommandGroup("build", buildSubcommands, parseBuildArgs, (root, parsed) => import("../build-cmd-CkVD1uOh.mjs").then(({ runBuildCommand }) => runBuildCommand(root, parsed)));
+else if (command === "auth") runSubcommandGroup("auth", authSubcommands, parseAuthArgs, (root, parsed) => import("../auth-cmd-CAH62yDU.mjs").then(({ runAuthCommand }) => runAuthCommand(root, parsed)));
+else if (command === "platform") runSubcommandGroup("platform", platformSubcommands, parsePlatformArgs, (root, parsed) => import("../platform-cmd-DxJ2FRwR.mjs").then(({ runPlatformCommand }) => runPlatformCommand(root, parsed)));
+else if (command === "cloudflare") runSubcommandGroup("cloudflare", cloudflareSubcommands, parseCloudflareArgs, (root, parsed) => import("../cloudflare-cmd-B6_OZx2V.mjs").then(({ runCloudflareCommand }) => runCloudflareCommand(root, parsed)));
+else if (command === "project") runSubcommandGroup("project", projectSubcommands, parseProjectArgs, (root, parsed) => import("../project-cmd-Mo0V9yKS.mjs").then(({ runProjectCommand }) => runProjectCommand(root, parsed)));
+else if (command === "secret") runSubcommandGroup("secret", secretSubcommands, parseSecretArgs, (root, parsed) => import("../secret-ByhJ9AMl.mjs").then(({ runSecretCommand }) => runSecretCommand(root, parsed)));
+else if (command === "domain") runSubcommandGroup("domain", domainSubcommands, parseDomainArgs, (root, parsed) => import("../domain-B1VmoSr0.mjs").then(({ runDomainCommand }) => runDomainCommand(root, parsed)));
+else if (command === "email") runSubcommandGroup("email", emailSubcommands, parseEmailArgs, (root, parsed) => import("../email-uKyQYUVY.mjs").then(({ runEmailCommand }) => runEmailCommand(root, parsed)));
+else if (command === "db") runSubcommandGroup("db", dbSubcommands, parseDbArgs, (root, parsed) => import("../db-D2d_mUsB.mjs").then(({ runDbCommand }) => runDbCommand(root, parsed)));
+else if (command === "env") runSubcommandGroup("env", envSubcommands, parseEnvArgs, (root, parsed) => import("../env-BcQzYgoG.mjs").then(({ runEnvCommand }) => runEnvCommand(root, parsed)));
+else if (command === "gen") runSubcommandGroup("gen", genSubcommands, parseGenArgs, (root, parsed) => import("../gen-DI2YwdBM.mjs").then(({ runGenCommand }) => runGenCommand(root, parsed)));
+else if (command === "github") runSubcommandGroup("github", githubSubcommands, parseGithubArgs, (root, parsed) => import("../github-cmd-xItS5Zwf.mjs").then(({ runGithubCommand }) => runGithubCommand(root, parsed)));
+else if (command === "build") runSubcommandGroup("build", buildSubcommands, parseBuildArgs, (root, parsed) => import("../build-cmd-CJvZvPQO.mjs").then(({ runBuildCommand }) => runBuildCommand(root, parsed)));
 else if (command === "prepare") {
 	const root = process.cwd();
 	let prepareArgs;
@@ -3541,7 +3672,7 @@ else if (command === "prepare") {
 	});
 } else if (command === "init") {
 	const root = process.cwd();
-	import("../init-Dx5cgKqK.mjs").then(({ runInitCommand, parseInitArgs }) => {
+	import("../init-BD-9THgn.mjs").then(({ runInitCommand, parseInitArgs }) => {
 		let initArgs;
 		try {
 			initArgs = parseInitArgs(args.slice(1));
@@ -3607,7 +3738,7 @@ else if (command === "prepare") {
 		},
 		{
 			name: "email",
-			hint: "usage | logs | destinations | allow | disallow | status | setup",
+			hint: "usage | logs | destinations | allow | disallow | domain | status | setup",
 			description: "Inspect email activity and manage verified recipients"
 		},
 		{
@@ -3653,32 +3784,32 @@ else if (command === "prepare") {
 		const root = process.cwd();
 		switch (cmd) {
 			case "connect": {
-				const { runConnectCommand } = await import("../connect-D9Yr-T5f.mjs");
+				const { runConnectCommand } = await import("../connect-C04Wdy_h.mjs");
 				await runConnectCommand(root, parseConnectArgs([]));
 				return;
 			}
 			case "init": {
-				const { runInitCommand, parseInitArgs } = await import("../init-Dx5cgKqK.mjs");
+				const { runInitCommand, parseInitArgs } = await import("../init-BD-9THgn.mjs");
 				await runInitCommand(root, parseInitArgs([]));
 				return;
 			}
 			case "deploy": {
-				const { runDeploy } = await import("../deploy-CcDoeBIf.mjs").then((n) => n.n);
+				const { runDeploy } = await import("../deploy-iXZ3F0N6.mjs").then((n) => n.n);
 				await runDeploy(root);
 				return;
 			}
-			case "auth": return runSubcommandGroup("auth", authSubcommands, parseAuthArgs, (r, p) => import("../auth-cmd-CYVhSNFy.mjs").then(({ runAuthCommand }) => runAuthCommand(r, p)));
-			case "platform": return runSubcommandGroup("platform", platformSubcommands, parsePlatformArgs, (r, p) => import("../platform-cmd-BEOVv1PN.mjs").then(({ runPlatformCommand }) => runPlatformCommand(r, p)));
-			case "cloudflare": return runSubcommandGroup("cloudflare", cloudflareSubcommands, parseCloudflareArgs, (r, p) => import("../cloudflare-cmd-D3ME2GAe.mjs").then(({ runCloudflareCommand }) => runCloudflareCommand(r, p)));
-			case "project": return runSubcommandGroup("project", projectSubcommands, parseProjectArgs, (r, p) => import("../project-cmd-DCpk1cDt.mjs").then(({ runProjectCommand }) => runProjectCommand(r, p)));
-			case "secret": return runSubcommandGroup("secret", secretSubcommands, parseSecretArgs, (r, p) => import("../secret-BqTxGqki.mjs").then(({ runSecretCommand }) => runSecretCommand(r, p)));
-			case "domain": return runSubcommandGroup("domain", domainSubcommands, parseDomainArgs, (r, p) => import("../domain-gu_iaHmn.mjs").then(({ runDomainCommand }) => runDomainCommand(r, p)));
-			case "github": return runSubcommandGroup("github", githubSubcommands, parseGithubArgs, (r, p) => import("../github-cmd-DJS5Ab-H.mjs").then(({ runGithubCommand }) => runGithubCommand(r, p)));
-			case "build": return runSubcommandGroup("build", buildSubcommands, parseBuildArgs, (r, p) => import("../build-cmd-CkVD1uOh.mjs").then(({ runBuildCommand }) => runBuildCommand(r, p)));
-			case "email": return runSubcommandGroup("email", emailSubcommands, parseEmailArgs, (r, p) => import("../email-r6DHJyAB.mjs").then(({ runEmailCommand }) => runEmailCommand(r, p)));
-			case "db": return runSubcommandGroup("db", dbSubcommands, parseDbArgs, (r, p) => import("../db-BxoUWL0F.mjs").then(({ runDbCommand }) => runDbCommand(r, p)));
-			case "env": return runSubcommandGroup("env", envSubcommands, parseEnvArgs, (r, p) => import("../env-DmU2To0C.mjs").then(({ runEnvCommand }) => runEnvCommand(r, p)));
-			case "gen": return runSubcommandGroup("gen", genSubcommands, parseGenArgs, (r, p) => import("../gen-BKw6qHIg.mjs").then(({ runGenCommand }) => runGenCommand(r, p)));
+			case "auth": return runSubcommandGroup("auth", authSubcommands, parseAuthArgs, (r, p) => import("../auth-cmd-CAH62yDU.mjs").then(({ runAuthCommand }) => runAuthCommand(r, p)));
+			case "platform": return runSubcommandGroup("platform", platformSubcommands, parsePlatformArgs, (r, p) => import("../platform-cmd-DxJ2FRwR.mjs").then(({ runPlatformCommand }) => runPlatformCommand(r, p)));
+			case "cloudflare": return runSubcommandGroup("cloudflare", cloudflareSubcommands, parseCloudflareArgs, (r, p) => import("../cloudflare-cmd-B6_OZx2V.mjs").then(({ runCloudflareCommand }) => runCloudflareCommand(r, p)));
+			case "project": return runSubcommandGroup("project", projectSubcommands, parseProjectArgs, (r, p) => import("../project-cmd-Mo0V9yKS.mjs").then(({ runProjectCommand }) => runProjectCommand(r, p)));
+			case "secret": return runSubcommandGroup("secret", secretSubcommands, parseSecretArgs, (r, p) => import("../secret-ByhJ9AMl.mjs").then(({ runSecretCommand }) => runSecretCommand(r, p)));
+			case "domain": return runSubcommandGroup("domain", domainSubcommands, parseDomainArgs, (r, p) => import("../domain-B1VmoSr0.mjs").then(({ runDomainCommand }) => runDomainCommand(r, p)));
+			case "github": return runSubcommandGroup("github", githubSubcommands, parseGithubArgs, (r, p) => import("../github-cmd-xItS5Zwf.mjs").then(({ runGithubCommand }) => runGithubCommand(r, p)));
+			case "build": return runSubcommandGroup("build", buildSubcommands, parseBuildArgs, (r, p) => import("../build-cmd-CJvZvPQO.mjs").then(({ runBuildCommand }) => runBuildCommand(r, p)));
+			case "email": return runSubcommandGroup("email", emailSubcommands, parseEmailArgs, (r, p) => import("../email-uKyQYUVY.mjs").then(({ runEmailCommand }) => runEmailCommand(r, p)));
+			case "db": return runSubcommandGroup("db", dbSubcommands, parseDbArgs, (r, p) => import("../db-D2d_mUsB.mjs").then(({ runDbCommand }) => runDbCommand(r, p)));
+			case "env": return runSubcommandGroup("env", envSubcommands, parseEnvArgs, (r, p) => import("../env-BcQzYgoG.mjs").then(({ runEnvCommand }) => runEnvCommand(r, p)));
+			case "gen": return runSubcommandGroup("gen", genSubcommands, parseGenArgs, (r, p) => import("../gen-DI2YwdBM.mjs").then(({ runGenCommand }) => runGenCommand(r, p)));
 			case "prepare": {
 				const { runPrepareCommand } = await import("../prepare-BfJvFUtJ.mjs");
 				await runPrepareCommand(root, parsePrepareArgs([]));

package/dist/{client-CyCHWSO_.mjs → client-Clirrol3.mjs}

@@ -641,6 +641,65 @@ var PlatformClient = class {
 		if (!res.ok) await throwPlatformApiError("Failed to remove email destination", res);
 		return res.json();
 	}
+	async listEmailDomains(projectId) {
+		const res = await fetch(`${this.baseUrl}/projects/${projectId}/email/domains`, { headers: { ...this.authHeaders } });
+		if (!res.ok) await throwPlatformApiError("Failed to list email domains", res);
+		return res.json();
+	}
+	/**
+	* `domain add` sends the credential exactly once — the OAuth grant's
+	* refresh token xor a pasted API token (the api enforces exactly one). It
+	* is the only call that ever carries it: the platform stores it encrypted
+	* per project, and every later step (`status`, `sync`, `remove`) addresses
+	* the row by domain. The caller must not log the input.
+	*/
+	async addEmailDomain(projectId, input) {
+		const res = await fetch(`${this.baseUrl}/projects/${projectId}/email/domains`, {
+			method: "POST",
+			headers: {
+				"Content-Type": "application/json",
+				...this.authHeaders
+			},
+			body: JSON.stringify({
+				domain: input.domain,
+				...input.refreshToken !== void 0 ? { refreshToken: input.refreshToken } : {},
+				...input.apiToken !== void 0 ? { apiToken: input.apiToken } : {},
+				...input.attemptId !== void 0 ? { attemptId: input.attemptId } : {}
+			})
+		});
+		if (!res.ok) await throwPlatformApiError("Failed to add email domain", res);
+		return res.json();
+	}
+	async getEmailDomain(projectId, domain) {
+		const res = await fetch(`${this.baseUrl}/projects/${projectId}/email/domains/${encodeURIComponent(domain)}`, { headers: { ...this.authHeaders } });
+		if (!res.ok) await throwPlatformApiError("Failed to fetch email domain status", res);
+		return res.json();
+	}
+	/** Redeploys the relay at the current version and rotates its secret (0078, `sync`). */
+	async syncEmailDomain(projectId, domain) {
+		const res = await fetch(`${this.baseUrl}/projects/${projectId}/email/domains/${encodeURIComponent(domain)}/sync`, {
+			method: "POST",
+			headers: { ...this.authHeaders }
+		});
+		if (!res.ok) await throwPlatformApiError("Failed to sync email domain", res);
+		return res.json();
+	}
+	/**
+	* `force` appends `?force=1`: the api drops the row even when a
+	* Cloudflare-side cleanup step fails (and answers `forced: true` +
+	* `failed_steps`). Without it a CF-side failure keeps the row for retry
+	* (`removed: false`).
+	*/
+	async removeEmailDomain(projectId, domain, force) {
+		const url = new URL(`${this.baseUrl}/projects/${projectId}/email/domains/${encodeURIComponent(domain)}`);
+		if (force) url.searchParams.set("force", "1");
+		const res = await fetch(url, {
+			method: "DELETE",
+			headers: { ...this.authHeaders }
+		});
+		if (!res.ok) await throwPlatformApiError("Failed to remove email domain", res);
+		return res.json();
+	}
 };
 //#endregion
 export { isExpiredTokenError as a, isCliOutdatedError as i, PlatformClient as n, parsePlatformErrorBody as o, client_exports as r, PlatformApiError as t };

package/dist/{cloudflare-auth-DRkGe7-s.mjs → cloudflare-auth-B1QtTO1b.mjs}

@@ -1,6 +1,6 @@
 import { D as log } from "./output-tFQLLj26.mjs";
 import { o as resolveWranglerArgv } from "./preset-lAy0B0BQ.mjs";
-import { execFile, spawnSync } from "node:child_process";
+import { execFile, spawn, spawnSync } from "node:child_process";
 //#region src/cli/cloudflare-auth.ts
 var CloudflareAuthenticationError = class extends Error {
 	name = "CloudflareAuthenticationError";
@@ -102,7 +102,11 @@ function createBundledCloudflareAuthRunner(root) {
 			env,
 			maxBuffer: 10485760,
 			shell: false,
-			stdio: capture ? [
+			stdio: cloudflareKeyringNeedsTerminal(args) ? [
+				"inherit",
+				"inherit",
+				"ignore"
+			] : capture ? [
 				"ignore",
 				"pipe",
 				"pipe"
@@ -122,6 +126,37 @@ function createBundledCloudflareAuthRunner(root) {
 /** Run a captured auth command without blocking terminal input or exposing credentials. */
 function runCloudflareAuthCommand(root, args, signal) {
 	const [command, ...prefix] = resolveWranglerArgv(root);
+	if (cloudflareKeyringNeedsTerminal(args)) return new Promise((resolve) => {
+		const child = spawn(command, [...prefix, ...args], {
+			cwd: root,
+			env: cloudflareAuthCommandEnvironment(args),
+			shell: false,
+			signal,
+			stdio: [
+				"inherit",
+				"inherit",
+				"ignore"
+			],
+			timeout: 6e5,
+			windowsHide: true
+		});
+		child.once("error", (error) => {
+			resolve({
+				status: null,
+				stdout: "",
+				stderr: "",
+				error: error.message
+			});
+		});
+		child.once("close", (status, signal) => {
+			resolve({
+				status,
+				signal,
+				stdout: "",
+				stderr: ""
+			});
+		});
+	});
 	return new Promise((resolve) => {
 		execFile(command, [...prefix, ...args], {
 			cwd: root,
@@ -145,9 +180,21 @@ function runCloudflareAuthCommand(root, args, signal) {
 }
 function cloudflareAuthCommandEnvironment(args, source = process.env) {
 	const env = cloudflareAuthEnvironment(source);
-	if (args[0] === "login" || args[0] === "logout") env.WRANGLER_LOG = "none";
+	if (args[0] === "login" || args[0] === "logout" || isCloudflareKeyringEnable(args)) env.WRANGLER_LOG = "none";
 	return env;
 }
+function isCloudflareKeyringEnable(args) {
+	return args.length === 3 && args[0] === "auth" && args[1] === "keyring" && args[2] === "enable";
+}
+/**
+* Wrangler installs its Windows keyring backend only when stdin AND stdout are
+* terminals. Capturing `auth keyring enable` makes first-time setup fail even
+* inside PowerShell. This command only configures storage; it never reads or
+* prints a credential. Keep every other auth command captured.
+*/
+function cloudflareKeyringNeedsTerminal(args) {
+	return process.platform === "win32" && process.stdin.isTTY === true && process.stdout.isTTY === true && isCloudflareKeyringEnable(args);
+}
 function cloudflareAuthEnvironment(source = process.env) {
 	const env = { ...source };
 	const scrubbedWranglerKeys = /* @__PURE__ */ new Set([
@@ -167,4 +214,4 @@ function announceCloudflareLogin() {
 	log.info("Opening Cloudflare login in your browser. Press Ctrl+C to cancel.");
 }
 //#endregion
-export { enableCloudflareKeyring as a, runCloudflareAuthCommand as c, createBundledCloudflareAuthRunner as i, announceCloudflareLogin as n, ensureCloudflareAuthentication as o, cloudflareCredentialOverrides as r, parseCloudflareAuthSession as s, CloudflareAuthenticationError as t };
+export { createBundledCloudflareAuthRunner as a, parseCloudflareAuthSession as c, cloudflareKeyringNeedsTerminal as i, runCloudflareAuthCommand as l, announceCloudflareLogin as n, enableCloudflareKeyring as o, cloudflareCredentialOverrides as r, ensureCloudflareAuthentication as s, CloudflareAuthenticationError as t };

package/dist/{cloudflare-cmd-D3ME2GAe.mjs → cloudflare-cmd-B6_OZx2V.mjs}

@@ -1,7 +1,7 @@
 import { t as basename } from "./dist-BrsS7cai.mjs";
 import { D as log } from "./output-tFQLLj26.mjs";
 import { v as readRootWranglerConfig } from "./wrangler--imS8n0d.mjs";
-import { a as enableCloudflareKeyring, i as createBundledCloudflareAuthRunner, o as ensureCloudflareAuthentication, r as cloudflareCredentialOverrides, s as parseCloudflareAuthSession } from "./cloudflare-auth-DRkGe7-s.mjs";
+import { a as createBundledCloudflareAuthRunner, c as parseCloudflareAuthSession, o as enableCloudflareKeyring, r as cloudflareCredentialOverrides, s as ensureCloudflareAuthentication } from "./cloudflare-auth-B1QtTO1b.mjs";
 //#region src/cli/cloudflare-cmd.ts
 async function runCloudflareCommand(root, args) {
 	const runWrangler = createBundledCloudflareAuthRunner(root);

package/dist/{cloudflare-connect-BivMefMA.mjs → cloudflare-connect-j5D4hhrG.mjs}

@@ -1,7 +1,7 @@
 import { o as join, t as basename } from "./dist-BrsS7cai.mjs";
 import { D as log, F as isCancel, j as select } from "./output-tFQLLj26.mjs";
 import { i as LATEST_KNOWN_COMPAT_DATE, k as writeProvisionedWranglerConfig, v as readRootWranglerConfig } from "./wrangler--imS8n0d.mjs";
-import { i as createBundledCloudflareAuthRunner, o as ensureCloudflareAuthentication } from "./cloudflare-auth-DRkGe7-s.mjs";
+import { a as createBundledCloudflareAuthRunner, s as ensureCloudflareAuthentication } from "./cloudflare-auth-B1QtTO1b.mjs";
 import { existsSync } from "node:fs";
 //#region src/cli/cloudflare-connect.ts
 async function connectCloudflare(root, interactive = Boolean(process.stdin.isTTY)) {

package/dist/{connect-D9Yr-T5f.mjs → connect-C04Wdy_h.mjs}

@@ -1,9 +1,9 @@
 import { D as log, F as isCancel, G as normalizePlatformApiUrl, W as listPlatformConnections, j as select } from "./output-tFQLLj26.mjs";
 import { C as writeDeploymentPlatform, b as readDeploymentPlatform, f as readPlatformToken, w as writePlatformSelection } from "./auth-W9WII-mN.mjs";
-import { a as isExpiredTokenError, n as PlatformClient } from "./client-CyCHWSO_.mjs";
-import { t as promptForLoginToken } from "./login-C8-UuLnp.mjs";
-import { t as connectCloudflare } from "./cloudflare-connect-BivMefMA.mjs";
-import { discoverPlatform, promptPlatformUrl, saveDiscoveredPlatform } from "./platform-cmd-BEOVv1PN.mjs";
+import { a as isExpiredTokenError, n as PlatformClient } from "./client-Clirrol3.mjs";
+import { t as promptForLoginToken } from "./login-pV69H-ZO.mjs";
+import { t as connectCloudflare } from "./cloudflare-connect-j5D4hhrG.mjs";
+import { discoverPlatform, promptPlatformUrl, saveDiscoveredPlatform } from "./platform-cmd-DxJ2FRwR.mjs";
 //#region src/cli/connect.ts
 async function selectVoidPlatform(interactive) {
 	if (!interactive) throw new Error("connect: Supply a Void platform URL in non-interactive mode.");

package/dist/{create-project-DMV-csEm.mjs → create-project-ChGZ1DFd.mjs}

@@ -1,7 +1,7 @@
 import { n as __exportAll } from "./rolldown-runtime-rQ84J-ij.mjs";
 import { C as cancel, D as log, F as isCancel, N as text, c as import_picocolors, j as select, w as confirm } from "./output-tFQLLj26.mjs";
 import { T as writeProjectConfig, s as getSiteDomain, v as attachSelectedPlatform } from "./auth-W9WII-mN.mjs";
-import { t as PlatformApiError } from "./client-CyCHWSO_.mjs";
+import { t as PlatformApiError } from "./client-Clirrol3.mjs";
 import { n as inferDefaultSlug } from "./resolve-project--Vxawf7z.mjs";
 //#region src/cli/project-slug.ts
 var project_slug_exports = /* @__PURE__ */ __exportAll({