void 0.20.1 → 0.20.2

package/dist/email-uKyQYUVY.mjs

@@ -1,1016 +0,0 @@
-import { A as password, D as log, F as isCancel, O as note, c as import_picocolors, i as createSpinner, w as confirm } from "./output-tFQLLj26.mjs";
-import { C as renderAddressMap, S as preflightEmail, a as isWranglerNonInteractiveOrCI, b as createNodeEmailDns, i as discoverRootWranglerConfig, o as loadProvisionModule, r as deriveWorkerName, s as resolveDeployTransport, t as createDeployWranglerRunner, u as runWranglerAuthToken, w as renderEmailChecklist, x as findEmailConfigConflicts, y as applyEmailSetup } from "./deploy-iXZ3F0N6.mjs";
-import { n as readProjectPaths } from "./project-paths-SK8nMHPp.mjs";
-import { c as getToken, d as openBrowser, i as createCodeVerifier, r as createCodeChallenge, x as readProjectConfig } from "./auth-W9WII-mN.mjs";
-import { k as writeProvisionedWranglerConfig } from "./wrangler--imS8n0d.mjs";
-import { f as readConfig } from "./config-BQFq7QvD.mjs";
-import { a as scanEmailHandlersSync } from "./email-Ce6SQq-i.mjs";
-import { n as PlatformClient, t as PlatformApiError } from "./client-Clirrol3.mjs";
-import { randomBytes } from "node:crypto";
-import { execSync } from "node:child_process";
-import { parseRootWranglerConfig, readWranglerTopLevelString } from "@void/deploy-cloudflare";
-//#region src/cli/cf-oauth.ts
-/**
-* The Cloudflare OAuth grant on wrangler's public PKCE client (design doc
-* 0078, "The OAuth grant on wrangler's client"; task contract 8) — the
-* primary credential grant for `void email domain add`. The customer clicks
-* Allow on Cloudflare's hosted consent page, the loopback server below
-* receives the code, exchanges it at the token endpoint, and returns the
-* grant's refresh token.
-*
-* The refresh token is held in memory only: the command POSTs it to the
-* platform as its first use and drops it. It is never written to disk, the
-* keychain, a log line, or an error message.
-*
-* The client id is wrangler's own public client (no secret), which
-* Cloudflare can rotate or revoke any day — so the template-link + paste
-* path in `email.ts` is the permanent fallback, not a legacy branch. The
-* consent page is Cloudflare's and names Wrangler; it cannot say Void, so
-* the warning line is printed here before the browser opens.
-*/
-/** wrangler's public PKCE OAuth client id (no secret). Not ours — see the header. */
-const CF_OAUTH_CLIENT_ID = "54d11594-84e4-41aa-b438-e81b8fa78ee7";
-const CF_OAUTH_AUTHORIZE_URL = "https://dash.cloudflare.com/oauth2/auth";
-const CF_OAUTH_TOKEN_URL = "https://dash.cloudflare.com/oauth2/token";
-const CF_OAUTH_REVOKE_URL = "https://dash.cloudflare.com/oauth2/revoke";
-/**
-* The redirect registered on wrangler's client. Fixed port and path: the
-* consent flow redirects here and only here, so the loopback server binds
-* exactly :8976 and answers exactly /oauth/callback — unlike the platform
-* login's random-port /callback in auth.ts, which cannot serve this flow.
-*/
-const CF_OAUTH_CALLBACK_PORT = 8976;
-const CF_OAUTH_REDIRECT_URI = `http://localhost:${CF_OAUTH_CALLBACK_PORT}/oauth/callback`;
-/** The scopes the email-domain setup needs; `offline_access` is what yields the refresh token. */
-const CF_OAUTH_SCOPE = "zone:read email_routing:write email_sending:write workers_scripts:write offline_access";
-/**
-* Revoke a grant at Cloudflare — RFC 7009 on wrangler's public client, the
-* same form wrangler's `logout` posts (a public client authenticates with
-* the token itself; no Authorization header). Never throws, never logs the
-* token; the boolean is whether Cloudflare CONFIRMED the revocation (200 —
-* CF answers 200 even for a bogus token), so `false` means the grant's
-* state is unknown and it may still be live: callers that print an outcome
-* must not claim a revocation they cannot prove. For when the CLI holds a
-* grant it will not hand to the platform: a consent exchange that
-* completed after the flow settled (fire-and-forget there — the flow is
-* settled), or an add request that provably never persisted one.
-*/
-async function revokeCfOauthGrant(refreshToken) {
-	try {
-		return (await fetch(CF_OAUTH_REVOKE_URL, {
-			method: "POST",
-			headers: { "Content-Type": "application/x-www-form-urlencoded" },
-			body: new URLSearchParams({
-				token: refreshToken,
-				token_type_hint: "refresh_token",
-				client_id: CF_OAUTH_CLIENT_ID
-			}).toString()
-		})).ok;
-	} catch {
-		return false;
-	}
-}
-/** The consent URL the browser opens — PKCE S256, state-bound to the loopback server. */
-function buildCfOauthAuthorizeUrl(params) {
-	const url = new URL(CF_OAUTH_AUTHORIZE_URL);
-	url.searchParams.set("response_type", "code");
-	url.searchParams.set("client_id", CF_OAUTH_CLIENT_ID);
-	url.searchParams.set("redirect_uri", CF_OAUTH_REDIRECT_URI);
-	url.searchParams.set("scope", CF_OAUTH_SCOPE);
-	url.searchParams.set("state", params.state);
-	url.searchParams.set("code_challenge", params.codeChallenge);
-	url.searchParams.set("code_challenge_method", "S256");
-	return url.href;
-}
-/**
-* Exchange the authorization code at Cloudflare's token endpoint. The
-* response body is never logged and never copied into an error — it carries
-* token material on success, so failure messages name only the HTTP status.
-*/
-async function exchangeCfOauthCode(code, codeVerifier) {
-	const res = await fetch(CF_OAUTH_TOKEN_URL, {
-		method: "POST",
-		headers: { "Content-Type": "application/x-www-form-urlencoded" },
-		body: new URLSearchParams({
-			grant_type: "authorization_code",
-			code,
-			redirect_uri: CF_OAUTH_REDIRECT_URI,
-			client_id: CF_OAUTH_CLIENT_ID,
-			code_verifier: codeVerifier
-		}).toString()
-	});
-	if (!res.ok) throw new Error(`cf-oauth: Cloudflare's token exchange failed (HTTP ${res.status}).`);
-	let body;
-	try {
-		body = await res.json();
-	} catch {
-		throw new Error("cf-oauth: Cloudflare's token exchange returned an invalid response.");
-	}
-	const refreshToken = body && typeof body === "object" && "refresh_token" in body ? body.refresh_token : void 0;
-	if (typeof refreshToken !== "string" || refreshToken.length === 0) throw new Error("cf-oauth: Cloudflare's answer carried no refresh token.");
-	return { refreshToken };
-}
-/** Same minimal callback page the platform login renders (auth.ts keeps its own copy). */
-function page(title, message) {
-	return `<!DOCTYPE html>
-<html><head><meta charset="utf-8"><meta name="viewport" content="width=device-width,initial-scale=1">
-<title>${title} - Void</title>
-<style>:root{color-scheme:light dark}*{margin:0;padding:0;box-sizing:border-box}body{font-family:system-ui,-apple-system,sans-serif;min-height:100vh;display:flex;align-items:center;justify-content:center;background:#fafafa;color:#111}.card{text-align:center;padding:3rem}h1{font-size:1.5rem;font-weight:600;margin-bottom:.75rem}p{color:#666;font-size:1rem}@media (prefers-color-scheme:dark){body{background:#0a0a0a;color:#fafafa}p{color:#a3a3a3}}</style>
-</head><body><div class="card"><h1>${title}</h1><p>${message}</p></div></body></html>`;
-}
-/**
-* Run the grant: bind the loopback server on :8976, warn about the
-* Wrangler-named consent page, open the browser, and resolve with the
-* refresh token once the code has been exchanged INSIDE the request handler
-* (so the browser only sees the success page after the exchange succeeded).
-*
-* Rejects on a busy port, a denied consent, a failed exchange, an abort
-* (`signal` — the command aborts when Enter switches to the token path), or
-* the timeout; the caller falls back to the template-link path on any of
-* them. `onUrl` fires with the authorize URL once the server is listening,
-* so the command can show it as the manual fallback when the browser fails
-* to open. The server is always closed before settling.
-*/
-async function runCfOauthGrant(options) {
-	const http = await import("node:http");
-	const { onUrl, signal } = options;
-	const timeoutMs = options.timeoutMs ?? 3e5;
-	const execFile = options.execFile ?? (await import("node:child_process")).execFile;
-	if (signal?.aborted) throw new Error("cf-oauth: cancelled.");
-	return new Promise((resolve, reject) => {
-		let settled = false;
-		const state = randomBytes(32).toString("hex");
-		const codeVerifier = createCodeVerifier();
-		const codeChallenge = createCodeChallenge(codeVerifier);
-		const onAbort = () => fail(/* @__PURE__ */ new Error("cf-oauth: cancelled."));
-		const fail = (error) => {
-			if (settled) return;
-			settled = true;
-			server.close();
-			signal?.removeEventListener("abort", onAbort);
-			reject(error);
-		};
-		const succeed = (grant) => {
-			if (settled) return;
-			settled = true;
-			server.close();
-			signal?.removeEventListener("abort", onAbort);
-			resolve(grant);
-		};
-		const cancelled = (res) => {
-			res.writeHead(200, { "Content-Type": "text/html" });
-			res.end(page("Authorization cancelled", "This sign-in was cancelled in the terminal. You can close this tab."));
-		};
-		const server = http.createServer(async (req, res) => {
-			const url = new URL(req.url, "http://localhost");
-			if (url.pathname !== "/oauth/callback") {
-				res.writeHead(404);
-				res.end("Not found");
-				return;
-			}
-			if (url.searchParams.get("state") !== state) {
-				res.writeHead(400, { "Content-Type": "text/html" });
-				res.end(page("Authorization failed", "Invalid callback. Please try again."));
-				return;
-			}
-			const cfError = url.searchParams.get("error");
-			if (cfError) {
-				const message = cfError === "access_denied" ? "The Cloudflare consent was denied." : `Cloudflare returned an error (${cfError}).`;
-				res.writeHead(403, { "Content-Type": "text/html" });
-				res.end(page("Authorization failed", message));
-				fail(/* @__PURE__ */ new Error(`cf-oauth: ${message}`));
-				return;
-			}
-			const code = url.searchParams.get("code");
-			if (!code) {
-				res.writeHead(400, { "Content-Type": "text/html" });
-				res.end(page("Authorization failed", "No authorization code received. Please try again."));
-				return;
-			}
-			let grant;
-			try {
-				grant = await exchangeCfOauthCode(code, codeVerifier);
-			} catch (err) {
-				if (settled) {
-					cancelled(res);
-					return;
-				}
-				res.writeHead(400, { "Content-Type": "text/html" });
-				res.end(page("Authorization failed", "Could not complete the Cloudflare grant. Please try again."));
-				fail(err instanceof Error ? err : /* @__PURE__ */ new Error("cf-oauth: Cloudflare's token exchange failed."));
-				return;
-			}
-			if (settled) {
-				revokeCfOauthGrant(grant.refreshToken);
-				cancelled(res);
-				return;
-			}
-			res.writeHead(200, { "Content-Type": "text/html" });
-			res.end(page("Cloudflare connected", "You can close this tab and return to the terminal."));
-			succeed(grant);
-		});
-		server.on("connection", (socket) => socket.unref());
-		server.on("error", (err) => {
-			const code = err.code;
-			fail(/* @__PURE__ */ new Error(`cf-oauth: could not start the local callback server on port ${CF_OAUTH_CALLBACK_PORT}${code ? ` (${code})` : ""}.`));
-		});
-		signal?.addEventListener("abort", onAbort, { once: true });
-		server.listen(CF_OAUTH_CALLBACK_PORT, "127.0.0.1", () => {
-			log.warn("Opening Cloudflare's consent page — it names Wrangler; that is expected (Void borrows wrangler's OAuth client for this one-click grant).");
-			const authorizeUrl = buildCfOauthAuthorizeUrl({
-				state,
-				codeChallenge
-			});
-			onUrl?.(authorizeUrl);
-			openBrowser(authorizeUrl, execFile);
-		});
-		setTimeout(() => {
-			fail(/* @__PURE__ */ new Error("cf-oauth: the consent timed out."));
-		}, timeoutMs).unref();
-	});
-}
-//#endregion
-//#region src/cli/email.ts
-async function runEmailCommand(root, args) {
-	if (args.platform === "cloudflare") return runEmailCloudflareCommand(root, args);
-	if (args.subcommand === "setup") {
-		log.error("email: `void email setup` sets email up on your OWN Cloudflare account — run it with `--platform cloudflare`. The Void platform needs no setup: deploy, and `void email usage` shows your address.");
-		process.exit(1);
-	}
-	if (args.subcommand === "status") {
-		log.error("email: `void email status` is available with `--platform cloudflare` today. On the Void platform use `void email usage` and `void email destinations`.");
-		process.exit(1);
-	}
-	const token = getToken(root);
-	if (!token) {
-		log.error("Not logged in. Run `void auth login` first.");
-		process.exit(1);
-	}
-	const client = new PlatformClient(token, { root });
-	const requestedSlug = args.projectSlug ?? process.env.VOID_PROJECT?.trim();
-	let projectId;
-	if (requestedSlug) {
-		const project = (await client.listProjects()).find((p) => p.slug === requestedSlug);
-		if (!project) {
-			log.error(`project: No project found with slug '${requestedSlug}'.`);
-			process.exit(1);
-		}
-		projectId = project.id;
-	} else {
-		const config = readProjectConfig(root);
-		if (!config) {
-			log.error("No linked project. Run `void project link` or pass --project <name>.");
-			process.exit(1);
-		}
-		projectId = config.projectId;
-	}
-	switch (args.subcommand) {
-		case "usage": return emailUsage(client, projectId);
-		case "logs": return emailLogs(client, projectId, args.limit);
-		case "destinations": return emailDestinations(client, projectId);
-		case "allow": return emailAllow(client, projectId, args.address);
-		case "disallow": return emailDisallow(client, projectId, args.address);
-		case "domain": return runEmailDomainCommand(client, projectId, args);
-	}
-}
-async function emailUsage(client, projectId) {
-	const usage = await client.getEmailUsage(projectId);
-	const status = usage.suspended ? import_picocolors.default.red("SUSPENDED") : import_picocolors.default.green("active");
-	const lines = [
-		`Month:       ${usage.month}`,
-		`Status:      ${status}`,
-		`Outbound:    ${usage.sent} / ${usage.limit} (${usage.remaining} remaining)`,
-		`Inbound:     ${usage.received}`
-	];
-	note(lines.join("\n"), "Email Usage");
-}
-async function emailDestinations(client, projectId) {
-	const rows = await client.listEmailDestinations(projectId);
-	if (rows.length === 0) {
-		log.info("No verified destinations. Run `void email allow <address>` to add one — Cloudflare will email the recipient with a verification link.");
-		return;
-	}
-	const lines = rows.map((d) => {
-		const status = d.status === "verified" ? import_picocolors.default.green("verified") : d.status === "pending" ? import_picocolors.default.yellow("pending") : import_picocolors.default.red("failed");
-		return `  ${d.address.padEnd(40)} ${status}`;
-	});
-	note(lines.join("\n"), "Email Destinations");
-}
-/**
-* `void email allow <address>` — exported for the unit test; the command
-* entry (`runEmailCommand`) resolves the client and project first.
-*/
-async function emailAllow(client, projectId, address) {
-	const dest = await client.addEmailDestination(projectId, address);
-	const sent = dest.verificationSent !== false && (dest.created || dest.platformVerificationPending);
-	if (dest.status === "verified") log.success(`${dest.address} is already verified.`);
-	else if (sent) {
-		log.success(`Verification email sent to ${dest.address}.`);
-		log.info("They click the link in their inbox — no Void or Cloudflare account needed. `void email destinations` to poll status.");
-	} else if (dest.created) log.warn(`${dest.address} is on this project's list now, but Cloudflare already had the address pending (added by another project, or by hand), so no new verification email was sent — the link it mailed when the address was first added is the one to click. ${freshLinkHint(dest.address)}`);
-	else log.info(`${dest.address} is still pending — Cloudflare emailed them a verification link when the address was first added, and a repeat add sends nothing new. ${freshLinkHint(dest.address)}`);
-}
-/**
-* Cloudflare has no API to resend its verification mail; the only fresh link
-* is a fresh registration, and the platform deletes the Cloudflare-side
-* address only once no project still lists it.
-*/
-function freshLinkHint(address) {
-	return `For a fresh link, remove the address from every project that lists it (\`void email disallow ${address}\`), then \`void email allow ${address}\` — Cloudflare mails a new link only when it registers the address anew.`;
-}
-/**
-* `void email disallow <address>` — exported for the unit test; the command
-* entry (`runEmailCommand`) resolves the client and project first.
-*
-* No deploy is involved: the api tightens the proxy's `email-allowlist`
-* KV mirror inside the DELETE (and answers 503 if that write fails), and
-* the proxy re-reads the mirror with a 60s `cacheTtl` on both the send
-* path and inbound forward/reply — so the address is refused once that
-* per-colo cache turns over.
-*/
-async function emailDisallow(client, projectId, address) {
-	const dest = (await client.listEmailDestinations(projectId)).find((d) => d.address.toLowerCase() === address.toLowerCase());
-	if (!dest) {
-		log.error(`destination: '${address}' is not in the project's allowlist.`);
-		process.exit(1);
-	}
-	await client.removeEmailDestination(projectId, dest.id);
-	log.success(`Removed ${dest.address}. Sends to it are refused within about a minute.`);
-}
-/**
-* `void email logs` — exported for the unit test; the command entry
-* (`runEmailCommand`) resolves the client and project first.
-*/
-async function emailLogs(client, projectId, limit) {
-	const result = await client.getEmailLogs(projectId, limit);
-	if (result.pending) {
-		log.info(result.note ?? "Persistent log storage is not yet wired up.");
-		log.info("Email activity logs are not available yet. Console output from your email handler appears in `void project logs`.");
-		return;
-	}
-	if (result.logs.length === 0) {
-		log.info("No email activity recorded.");
-		return;
-	}
-	const lines = result.logs.map((entry) => {
-		const ts = new Date(entry.timestamp).toISOString();
-		const dir = entry.direction === "sent" ? "→" : "←";
-		const subject = entry.subject ? ` "${entry.subject}"` : "";
-		return `${ts}  ${dir}  ${entry.from} → ${entry.to}  ${entry.status}${subject}`;
-	});
-	note(lines.join("\n"), "Email Logs");
-}
-/**
-* The dashboard template link's permission groups (contract 8). Every key
-* rides every link — there is no apex-only key, because `Zone Settings Edit`
-* gates the routing POST on both paths; `zone: read` is what the zone lookup
-* needs. URL-encoded by `URL.searchParams`.
-*/
-const CF_TOKEN_TEMPLATE_PERMISSION_GROUPS = [
-	{
-		key: "zone",
-		type: "read"
-	},
-	{
-		key: "email_routing_rule",
-		type: "edit"
-	},
-	{
-		key: "email_sending",
-		type: "edit"
-	},
-	{
-		key: "workers_scripts",
-		type: "edit"
-	},
-	{
-		key: "zone_settings",
-		type: "edit"
-	}
-];
-/** The three-click template link — the fallback grant path (0078, "Creating the token in three clicks"). */
-function buildCfApiTokenTemplateUrl(domain) {
-	const url = new URL("https://dash.cloudflare.com/profile/api-tokens");
-	url.searchParams.set("permissionGroupKeys", JSON.stringify(CF_TOKEN_TEMPLATE_PERMISSION_GROUPS));
-	url.searchParams.set("accountId", "*");
-	url.searchParams.set("zoneId", "all");
-	url.searchParams.set("name", `Void email — ${domain}`);
-	return url.href;
-}
-const CFUT_TOKEN_PATTERN = /^cfut_[A-Za-z0-9_-]{44,64}$/;
-const LEGACY_CF_TOKEN_PATTERN = /^[A-Za-z0-9_-]{40}$/;
-const REFUSED_TOKEN_PREFIXES = [
-	"ghp_",
-	"github_pat_",
-	"sk-",
-	"xox",
-	"cfk_"
-];
-/** Shape-only classification of a clipboard or pasted value. Never logs the value. */
-function classifyCfApiTokenShape(value) {
-	const token = value.trim();
-	if (REFUSED_TOKEN_PREFIXES.some((prefix) => token.startsWith(prefix))) return "refused";
-	if (CFUT_TOKEN_PATTERN.test(token)) return "cfut";
-	if (LEGACY_CF_TOKEN_PATTERN.test(token)) return "legacy";
-	return "unknown";
-}
-function readClipboard() {
-	const platform = process.platform;
-	const command = platform === "darwin" ? "pbpaste" : platform === "win32" ? "powershell -NoProfile -Command Get-Clipboard" : "xclip -o -selection clipboard";
-	try {
-		return execSync(command, {
-			encoding: "utf8",
-			stdio: [
-				"ignore",
-				"pipe",
-				"ignore"
-			]
-		});
-	} catch {
-		if (platform !== "darwin" && platform !== "win32") try {
-			return execSync("wl-paste", {
-				encoding: "utf8",
-				stdio: [
-					"ignore",
-					"pipe",
-					"ignore"
-				]
-			});
-		} catch {}
-		return null;
-	}
-}
-/** `pbcopy </dev/null` and the platform equivalents — best-effort, never throws. */
-function clearClipboard() {
-	const platform = process.platform;
-	try {
-		if (platform === "darwin") execSync("pbcopy", { input: "" });
-		else if (platform === "win32") execSync("clip", { input: "" });
-		else try {
-			execSync("xclip -selection clipboard", { input: "" });
-		} catch {
-			execSync("wl-copy", { input: "" });
-		}
-	} catch {}
-}
-/**
-* The CLI-side active check from 0078's clipboard sequence. 'unknown' means
-* the check could not run (no network, a CF error) — the caller proceeds and
-* lets the platform verify authoritatively, never treating a network blip as
-* a bad token. The token itself is never logged.
-*/
-async function verifyCfApiToken(token) {
-	let res;
-	try {
-		res = await fetch("https://api.cloudflare.com/client/v4/user/tokens/verify", { headers: { authorization: `Bearer ${token}` } });
-	} catch {
-		return "unknown";
-	}
-	if (res.status === 401 || res.status === 403) return "inactive";
-	if (!res.ok) return "unknown";
-	try {
-		return (await res.json()).result?.status === "active" ? "active" : "inactive";
-	} catch {
-		return "unknown";
-	}
-}
-/** Mirror of the api's normalization (`normalizeEmailDomain`). */
-function normalizeEmailDomainInput(raw) {
-	return raw.trim().toLowerCase().replace(/\.$/, "");
-}
-/**
-* Same DNS-hostname shape the api enforces — checked here so junk fails
-* before a grant is ever requested, not after. Real validation stays the
-* platform's zone lookup.
-*/
-function isValidEmailDomainInput(domain) {
-	return /^(?!-)[a-z0-9-]{1,63}(?<!-)(\.(?!-)[a-z0-9-]{1,63}(?<!-))+$/.test(domain);
-}
-/**
-* Where `--subdomain` lands: a bare label nests under the positional domain
-* (`mx` → `mx.acme.com`), a full host is taken as-is but must stay under it.
-* Throws on anything else — the user named a domain this add cannot register.
-*/
-function resolveEmailDomainTarget(domain, subdomain) {
-	if (subdomain === void 0) return {
-		emailDomain: domain,
-		forced: false
-	};
-	const candidate = subdomain.trim().toLowerCase().replace(/\.$/, "");
-	const resolved = candidate.includes(".") ? candidate : `${candidate}.${domain}`;
-	if (!isValidEmailDomainInput(resolved)) throw new Error(`email: invalid --subdomain value '${subdomain}'.`);
-	if (resolved === domain || !resolved.endsWith(`.${domain}`)) throw new Error(`email: --subdomain must name a subdomain of ${domain} (got '${subdomain}').`);
-	return {
-		emailDomain: resolved,
-		forced: true
-	};
-}
-/**
-* Local public-DNS MX read. [] = no records, null = could not read. The
-* local answer only steers the default and the render — the platform
-* re-checks over public DNS and its answer is authoritative, so a
-* split-horizon resolver never blocks a valid setup here.
-*/
-async function lookupMxForRender(dns, name) {
-	try {
-		return (await dns.resolveMx(name)).slice().sort((a, b) => a.priority - b.priority).map((r) => r.exchange.replace(/\.$/, "").toLowerCase());
-	} catch (err) {
-		const code = err?.code;
-		return code === "ENODATA" || code === "ENOTFOUND" ? [] : null;
-	}
-}
-/**
-* The "Enter switches paths" race from 0078's flow. The default reads one
-* cooked-mode line from stdin; `stop` removes the listener so a losing race
-* cannot eat the first keystroke of a later prompt.
-*/
-function createEnterRace(waitForEnter) {
-	if (waitForEnter) return {
-		promise: waitForEnter().then(() => "enter"),
-		stop: () => {}
-	};
-	const stdin = process.stdin;
-	let onData;
-	return {
-		promise: new Promise((resolve) => {
-			if (!stdin.isTTY) return;
-			onData = () => resolve("enter");
-			stdin.on("data", onData);
-		}),
-		stop: () => {
-			if (onData) stdin.removeListener("data", onData);
-		}
-	};
-}
-async function defaultPasteToken() {
-	const result = await password({
-		message: "Paste the Cloudflare API token:",
-		mask: "*"
-	});
-	if (isCancel(result) || typeof result === "symbol") return null;
-	return result;
-}
-/**
-* Lost-answer reconcile bounds for `domain add`: attempt-count bounded (not
-* wall clock) so the worst case is finite and tests are deterministic. The
-* API's pre-insert phase is DB-only but takes tens of ms to seconds of
-* Hyperdrive RTTs, and a lost answer does not stop the API worker — a single
-* immediate status read can 404 while the POST is still committing.
-*/
-const ADD_RECONCILE_ATTEMPTS = 15;
-const ADD_RECONCILE_INTERVAL_MS = 1e3;
-/**
-* `void email domain add <domain>` — exported for the unit test; the command
-* entry resolves the client and project first.
-*
-* The flow (0078, "The flow"): render the MX decision → the OAuth grant →
-* the template-link + clipboard fallback (Enter switches to the masked paste
-* at any point) → POST the credential once → render the resulting row. A
-* failed add leaves the platform row 'failed' and re-running add replaces
-* the credential — the api's replace path, not anything here.
-*/
-async function emailDomainAdd(client, projectId, rawDomain, subdomain, deps = {}) {
-	const exit = deps.exit ?? ((code) => process.exit(code));
-	const fail = (message) => {
-		log.error(message);
-		return exit(1);
-	};
-	const domain = normalizeEmailDomainInput(rawDomain);
-	if (!isValidEmailDomainInput(domain)) return fail(`email: invalid domain '${rawDomain}'.`);
-	let target;
-	try {
-		target = resolveEmailDomainTarget(domain, subdomain);
-	} catch (err) {
-		return fail(err instanceof Error ? err.message : String(err));
-	}
-	const dns = deps.dns ?? await createNodeEmailDns();
-	if (target.forced) {
-		const mx = await lookupMxForRender(dns, target.emailDomain);
-		if (mx !== null && mx.length > 0) log.warn(`MX        ${target.emailDomain} already carries MX (${mx.join(", ")}) — the platform re-checks over public DNS and may refuse it.`);
-	} else {
-		const mx = await lookupMxForRender(dns, domain);
-		if (mx === null) log.info(`MX        could not read ${domain}'s MX from here — the platform decides over public DNS.`);
-		else if (mx.length > 0) {
-			target = {
-				emailDomain: `mail.${domain}`,
-				forced: false
-			};
-			log.info(`MX        ${domain} carries MX for ${mx[0]} → apex is off limits\n          using ${target.emailDomain}  [change with --subdomain]`);
-			const subMx = await lookupMxForRender(dns, target.emailDomain);
-			if (subMx !== null && subMx.length > 0) log.warn(`MX        ${target.emailDomain} also carries MX (${subMx.join(", ")}) — the platform may refuse it; pick another with --subdomain.`);
-		} else log.info(`MX        ${domain} has no MX records → using the apex`);
-	}
-	if (!(deps.isInteractive ?? !isWranglerNonInteractiveOrCI())) return fail("email: `void email domain add` needs an interactive terminal (the grant opens a browser; the fallback reads the clipboard or a paste). Run it locally.");
-	let credential;
-	const runGrant = deps.runGrant ?? ((options) => runCfOauthGrant(options));
-	const grantSpinner = createSpinner();
-	grantSpinner.start("Opening Cloudflare's consent page…");
-	const controller = new AbortController();
-	const enterDuringGrant = createEnterRace(deps.waitForEnter);
-	const grantOutcome = await Promise.race([runGrant({
-		signal: controller.signal,
-		onUrl: (url) => grantSpinner.message(`Waiting for the Cloudflare grant — click Allow. If the browser didn't open, visit:\n${import_picocolors.default.cyan(url)}\n(Enter switches to the API-token path.)`)
-	}).then((grant) => ({
-		type: "grant",
-		grant
-	}), (error) => ({
-		type: "error",
-		error: error instanceof Error ? error : new Error(String(error))
-	})), enterDuringGrant.promise.then(() => ({ type: "enter" }))]);
-	enterDuringGrant.stop();
-	if (grantOutcome.type === "grant") {
-		grantSpinner.stop("Grant received.");
-		credential = {
-			kind: "oauth_grant",
-			refreshToken: grantOutcome.grant.refreshToken
-		};
-	} else {
-		controller.abort();
-		grantSpinner.stop(grantOutcome.type === "enter" ? "Switched to the API-token path." : "The consent flow did not complete — using the API-token path.");
-		if (grantOutcome.type === "error") log.warn(grantOutcome.error.message);
-	}
-	if (credential === void 0) {
-		const url = buildCfApiTokenTemplateUrl(target.emailDomain);
-		const readClip = deps.readClipboard ?? readClipboard;
-		const clearClip = deps.clearClipboard ?? clearClipboard;
-		const verify = deps.verifyToken ?? verifyCfApiToken;
-		const openUrl = deps.openUrl ?? ((u) => {
-			import("node:child_process").then(({ execFile }) => openBrowser(u, execFile));
-		});
-		const snapshot = readClip();
-		if (snapshot === null) log.info("No clipboard tool found here — paste the token instead.");
-		openUrl(url);
-		let outcome;
-		let watchSpinner;
-		if (snapshot === null) outcome = { type: "timeout" };
-		else {
-			watchSpinner = createSpinner();
-			watchSpinner.start([
-				"Create the token in three clicks: Continue to summary → Create Token → Copy.",
-				"Watching the clipboard for it — nothing is read until you copy, and it is cleared afterwards.",
-				"(Enter pastes it yourself instead.)",
-				`If the browser didn't open, visit:\n${import_picocolors.default.cyan(url)}`
-			].join("\n"));
-			const spinner = watchSpinner;
-			const deadline = Date.now() + (deps.watchTimeoutMs ?? 6e5);
-			const interval = deps.watchIntervalMs ?? 1e3;
-			const snapshotTrimmed = snapshot.trim();
-			const enterDuringWatch = createEnterRace(deps.waitForEnter);
-			let watchSettled = false;
-			let watchTimer;
-			outcome = await Promise.race([(async () => {
-				while (!watchSettled && Date.now() < deadline) {
-					await new Promise((resolve) => {
-						watchTimer = setTimeout(resolve, interval);
-					});
-					if (watchSettled) break;
-					const value = readClip()?.trim();
-					if (!value || value === snapshotTrimmed) continue;
-					const shape = classifyCfApiTokenShape(value);
-					if (shape === "refused" || shape === "unknown") continue;
-					const verdict = await verify(value);
-					if (verdict === "inactive") {
-						spinner.message("That is not an active Cloudflare token — still waiting.");
-						continue;
-					}
-					if (verdict === "unknown") log.info("Could not reach Cloudflare to check the token — the platform will verify it.");
-					return {
-						type: "token",
-						token: value
-					};
-				}
-				return { type: "timeout" };
-			})(), enterDuringWatch.promise.then(() => ({ type: "enter" }))]);
-			watchSettled = true;
-			enterDuringWatch.stop();
-			watchTimer?.unref();
-		}
-		if (outcome.type === "token") {
-			clearClip();
-			watchSpinner?.stop("Token received — the clipboard copy was cleared.");
-			log.info("A clipboard manager may keep its own history — clear it there if you run one.");
-			credential = {
-				kind: "api_token",
-				apiToken: outcome.token
-			};
-		} else {
-			watchSpinner?.stop(outcome.type === "enter" ? "Pasting instead." : "No token arrived — paste it instead.");
-			const pasted = await (deps.pasteToken ?? defaultPasteToken)();
-			if (pasted === null) {
-				log.info("Cancelled — nothing was stored anywhere.");
-				return;
-			}
-			const token = pasted.trim();
-			const shape = classifyCfApiTokenShape(token);
-			if (shape === "refused") return fail("email: that looks like a different kind of token (a GitHub, OpenAI, Slack, or Cloudflare global key) — the link above creates a scoped Cloudflare API token.");
-			if (shape === "unknown") return fail("email: that is not shaped like a Cloudflare API token (`cfut_…` or the legacy 40-character form). Create one from the link above.");
-			const verdict = await verify(token);
-			if (verdict === "inactive") return fail("email: that is not an active Cloudflare token.");
-			if (verdict === "unknown") log.info("Could not reach Cloudflare to check the token — the platform will verify it.");
-			credential = {
-				kind: "api_token",
-				apiToken: token
-			};
-		}
-	}
-	const attemptId = crypto.randomUUID();
-	let row;
-	try {
-		row = await client.addEmailDomain(projectId, {
-			domain: target.emailDomain,
-			...credential.kind === "oauth_grant" ? { refreshToken: credential.refreshToken } : { apiToken: credential.apiToken },
-			attemptId
-		});
-	} catch (err) {
-		if (err instanceof PlatformApiError && (err.status === 400 || err.status === 404 || err.status === 409)) throw err;
-		const sleep = deps.sleep ?? ((ms) => new Promise((resolve) => setTimeout(resolve, ms)));
-		let lastRead;
-		for (let attempt = 0; attempt < ADD_RECONCILE_ATTEMPTS; attempt++) {
-			if (attempt > 0) await sleep(ADD_RECONCILE_INTERVAL_MS);
-			let existing;
-			try {
-				existing = await client.getEmailDomain(projectId, target.emailDomain);
-			} catch (statusErr) {
-				if (statusErr instanceof PlatformApiError && statusErr.status === 404) lastRead = "missing";
-				continue;
-			}
-			if ("attemptId" in existing) {
-				if (existing.attemptId === attemptId) {
-					log.warn("The add's answer was lost (network or platform error), but the platform has the row.");
-					printEmailDomainOutcome(existing);
-					return;
-				}
-				lastRead = "foreign";
-				continue;
-			}
-			log.warn("The add's answer was lost (network or platform error), but the platform has the row.");
-			printEmailDomainOutcome(existing);
-			return;
-		}
-		if (lastRead === "foreign") {
-			if (credential.kind === "oauth_grant") return fail(await revokeCfOauthGrant(credential.refreshToken) ? `email: the add did not complete, and ${target.emailDomain} kept the row's existing credential; the OAuth grant minted for this attempt was revoked — re-run to retry the replace.` : `email: the add did not complete, and ${target.emailDomain} kept the row's existing credential; the OAuth grant minted for this attempt could not be revoked — revoke it in the Cloudflare dashboard, then re-run to retry the replace.`);
-			return fail(`email: the add did not complete, and ${target.emailDomain} kept the row's existing credential. The token was not stored anywhere; delete it in the Cloudflare dashboard if you are not retrying.`);
-		}
-		if (lastRead === "missing") {
-			if (credential.kind === "oauth_grant") return fail(await revokeCfOauthGrant(credential.refreshToken) ? `email: the add did not complete — ${target.emailDomain} was not registered, and the OAuth grant minted for this attempt was revoked.` : `email: the add did not complete — ${target.emailDomain} was not registered; the OAuth grant minted for this attempt could not be revoked — revoke it in the Cloudflare dashboard before retrying.`);
-			return fail(`email: the add did not complete — ${target.emailDomain} was not registered. The token was not stored anywhere; delete it in the Cloudflare dashboard if you are not retrying.`);
-		}
-		return fail(`email: the add did not complete, and the follow-up check failed too — the add's state is unknown, so nothing was revoked. A grant minted for this attempt may still be live: once connectivity is back, run \`void email domain status ${target.emailDomain}\`; if it shows no row, revoke the grant in the Cloudflare dashboard before retrying.`);
-	}
-	log.success(credential.kind === "oauth_grant" ? "Grant stored on the platform, encrypted for this project — nothing is kept on this machine." : "Token stored on the platform, encrypted for this project — nothing is kept on this machine.");
-	printEmailDomainOutcome(row);
-}
-function emailDomainStatusText(status) {
-	if (status === "active") return import_picocolors.default.green("active");
-	if (status === "pending") return import_picocolors.default.yellow("pending");
-	return import_picocolors.default.red(status === "failed" ? "failed" : status.replace("_", " "));
-}
-/**
-* The dashboard path for the one remaining human step. The row does not
-* carry the zone name, so a subdomain row strips its first label — the zone
-* the walk almost always lands on (`mail.acme.com` → `acme.com`).
-*/
-function routingSubdomainInstruction(domain, mode) {
-	return `add ${domain} in the Cloudflare dashboard — Email Routing → ${mode === "subdomain" ? domain.split(".").slice(1).join(".") : domain} → Settings → Subdomains (no API exists for it)`;
-}
-/**
-* The shared result render for add and sync: the row as a block, then the
-* one guidance line the status calls for. `error` is printed verbatim — the
-* api guarantees it names a step or a CF error, never credential material.
-*/
-function printEmailDomainOutcome(row) {
-	if (row.status === "failed") {
-		const step = row.setup_state?.failed_step;
-		log.error(`email: ${row.domain} failed${step ? ` at ${step.replaceAll("_", " ")}` : ""}${row.error ? ` — ${row.error}` : ""}`);
-		log.info(`Fix the step above, then re-run \`void email domain add ${row.domain}\` — adding again replaces the credential and retries.`);
-		return;
-	}
-	const lines = [
-		`Domain:      ${row.domain}`,
-		`Status:      ${emailDomainStatusText(row.status)}`,
-		`Mode:        ${row.mode ?? "—"}`,
-		`Credential:  ${row.credential_kind === "oauth_grant" ? "OAuth grant" : "API token"}`
-	];
-	if (row.relay_worker_name) lines.push(`Relay:       ${row.relay_worker_name}${row.relay_version !== null ? ` v${row.relay_version}` : ""}`);
-	if (row.token_expires_on) lines.push(`Token TTL:   expires ${row.token_expires_on}`);
-	note(lines.join("\n"), "Email Domain");
-	const remaining = row.setup_state?.remaining_steps ?? [];
-	if (row.status === "pending" && remaining.includes("routing_subdomain")) {
-		log.warn(`One step only you can do: ${routingSubdomainInstruction(row.domain, row.mode)}.`);
-		log.info(`Then run \`void email domain status ${row.domain}\` to poll.`);
-		return;
-	}
-	if (row.status === "pending") {
-		log.info(`Run \`void email domain status ${row.domain}\` to poll.`);
-		return;
-	}
-	if (row.status === "token_revoked" || row.status === "token_expired") {
-		log.warn(`The stored credential was ${row.status === "token_revoked" ? "revoked at Cloudflare" : "left to expire"} — re-run \`void email domain add ${row.domain}\` with a fresh grant or token. Rules and the relay stay.`);
-		return;
-	}
-	if (remaining.includes("sending_onboarding")) log.info(`Inbound is live. Sending to arbitrary recipients needs Workers Paid — until then sendEmail() works to verified destinations only. After upgrading, run \`void email domain sync ${row.domain}\` to finish onboarding.`);
-	log.success(`${row.domain} is live — send with \`sendEmail({ from: 'you@${row.domain}', … })\`; inbound mail to any address on ${row.domain} reaches your email/ handlers.`);
-}
-/**
-* `void email domain status <domain>` — exported for the unit test. Re-probes
-* the credential and the relay on every call (the api does it), so this is
-* also the drift report: it never fights the customer's edits, it names them.
-*/
-async function emailDomainStatus(client, projectId, rawDomain) {
-	const domain = normalizeEmailDomainInput(rawDomain);
-	const row = await client.getEmailDomain(projectId, domain);
-	const lines = [
-		`Domain:      ${row.domain}`,
-		`Status:      ${emailDomainStatusText(row.status)}`,
-		`Mode:        ${row.mode ?? "—"}`
-	];
-	const credential = row.credential_status === "probe_failed" ? `${row.credential_kind === "oauth_grant" ? "OAuth grant" : "API token"} · probe failed (stored view shown)` : `${row.credential_kind === "oauth_grant" ? "OAuth grant" : "API token"} · ${row.credential_status}`;
-	lines.push(`Credential:  ${credential}`);
-	if (row.token_id) lines.push(`Token:       id ${row.token_id}${row.token_expires_on ? ` · expires ${row.token_expires_on}` : ""}`);
-	if (row.relay_worker_name) {
-		let relay = `Relay:       ${row.relay_worker_name}${row.relay_version !== null ? ` v${row.relay_version}` : ""}`;
-		if (row.relay_missing === true) relay += " · missing from the account";
-		else if (row.relay_drift) relay += ` · drifted (current is v${row.current_relay_version})`;
-		lines.push(relay);
-	}
-	if (row.setup_state?.failed_step) lines.push(`Failed step: ${row.setup_state.failed_step.replaceAll("_", " ")}`);
-	lines.push(`Catch-all:   ${row.catch_all}`);
-	note(lines.join("\n"), "Email Domain");
-	if (row.error) log.error(`email: ${row.error}`);
-	const remaining = row.setup_state?.remaining_steps ?? [];
-	if (remaining.includes("routing_subdomain")) log.warn(`One step only you can do: ${routingSubdomainInstruction(row.domain, row.mode)}.`);
-	if (remaining.includes("sending_onboarding")) log.info(`Sending to arbitrary recipients needs Workers Paid — inbound works; sendEmail() to verified destinations only. After upgrading, run \`void email domain sync ${row.domain}\`.`);
-	if (row.relay_missing === true || row.relay_drift) log.info(`Run \`void email domain sync ${row.domain}\` to redeploy the relay in place.`);
-	if (row.catch_all_drift) log.info(`Catch-all drifted — run \`void email domain sync ${row.domain}\` to re-point it.`);
-	if (row.status === "token_revoked" || row.status === "token_expired") log.warn(`Re-run \`void email domain add ${row.domain}\` with a fresh grant or token — adding again replaces the credential, rules stay.`);
-}
-/** `void email domain list` — exported for the unit test. */
-async function emailDomainList(client, projectId) {
-	const rows = await client.listEmailDomains(projectId);
-	if (rows.length === 0) {
-		log.info("No email domains. Run `void email domain add <domain>` to send and receive at your own domain on a Cloudflare zone.");
-		return;
-	}
-	const width = Math.max(...rows.map((row) => row.domain.length));
-	const lines = rows.map((row) => `  ${row.domain.padEnd(width)}  ${emailDomainStatusText(row.status)}  ${row.mode ?? "—"}`);
-	note(lines.join("\n"), "Email Domains");
-}
-/** `void email domain sync <domain>` — exported for the unit test. */
-async function emailDomainSync(client, projectId, rawDomain) {
-	const domain = normalizeEmailDomainInput(rawDomain);
-	const row = await client.syncEmailDomain(projectId, domain);
-	if (row.status !== "failed") {
-		log.success(`Relay redeployed${row.relay_version !== null ? ` at v${row.relay_version}` : ""} with a rotated secret.`);
-		if (row.catch_all === "foreign_conflict") log.warn("Catch-all: the zone's catch-all points at a different worker and was NOT overwritten — change it in the zone's Email Routing settings if inbound mail should reach this relay.");
-		else if (row.catch_all !== void 0) log.info(`Catch-all: ${row.catch_all.replaceAll("_", " ")}`);
-	}
-	printEmailDomainOutcome(row);
-}
-/** `void email domain remove <domain>` — exported for the unit test. */
-async function emailDomainRemove(client, projectId, rawDomain, options = {}) {
-	const domain = normalizeEmailDomainInput(rawDomain);
-	const result = await client.removeEmailDomain(projectId, domain, options.force);
-	if (!result.removed) {
-		const steps = result.failed_steps?.length ? result.failed_steps.join(", ") : "unknown";
-		log.error(`email: could not remove ${domain} — failed Cloudflare-side steps: ${steps}.`);
-		log.info(`The registration was kept — retry \`void email domain remove ${domain}\` once the Cloudflare-side problem is fixed, or re-run with --force to drop the row anyway.`);
-		(options.exit ?? ((code) => process.exit(code)))(1);
-	}
-	log.success(`Removed ${domain} — the platform row, the stored credential and the relay secret are gone.`);
-	const failed = result.failed_steps ?? [];
-	if (failed.length > 0 && (result.forced === true || failed.some((step) => step !== "revoke_grant"))) log.warn(`Cloudflare-side cleanup failed for: ${failed.join(", ")} — delete the relay worker and reset the catch-all in the zone's Email Routing settings yourself.`);
-	else if (failed.length > 0) log.info("Note: the Cloudflare grant could not be revoked (already invalid or Cloudflare unreachable) — no mail impact.");
-}
-async function runEmailDomainCommand(client, projectId, args) {
-	switch (args.domainVerb) {
-		case "add": return emailDomainAdd(client, projectId, args.domain, args.subdomain);
-		case "status": return emailDomainStatus(client, projectId, args.domain);
-		case "list": return emailDomainList(client, projectId);
-		case "sync": return emailDomainSync(client, projectId, args.domain);
-		case "remove": return emailDomainRemove(client, projectId, args.domain, { force: args.force });
-	}
-}
-/**
-* `void email setup --platform cloudflare` and `void email status --platform cloudflare`.
-*
-* `setup` is the deploy's step 3b-ii on its own: preflight → checklist → the one Enter →
-* apply → write the root wrangler.jsonc. It exists for CI: a non-interactive deploy that
-* finds email not ready prints the checklist and says to run this once, commit
-* wrangler.jsonc, and redeploy. Rules and the catch-all stay wrangler's job — the next
-* `void deploy --platform cloudflare` applies the plan from the written `addresses`. It
-* is also the ONLY place a sending onboarding the committed binding remembers as refused
-* (Workers Free) is retried — on its own prompt, after a Workers Paid upgrade; the deploy
-* reads that row as settled and never retries it.
-*
-* `status` is the preflight alone, printed, exit 1 when not ready.
-*/
-async function runEmailCloudflareCommand(root, args, deps = {}) {
-	const exit = deps.exit ?? ((code) => process.exit(code));
-	const print = deps.print ?? ((block) => log.message(block));
-	const fail = (message) => {
-		log.error(message);
-		return exit(1);
-	};
-	const from = readConfig(root).email?.from;
-	if (!from) return fail("email: no sender configured. Add \"email\": { \"from\": \"you@mail.acme.com\" } to void.json — its host is the domain email is set up on.");
-	const paths = readProjectPaths(root);
-	const handlers = scanEmailHandlersSync(paths.sourceRoot);
-	const configPath = discoverRootWranglerConfig(root);
-	const rootConfig = parseRootWranglerConfig(configPath);
-	await loadProvisionModule();
-	let apiBaseUrl;
-	try {
-		apiBaseUrl = resolveDeployTransport(root, rootConfig);
-	} catch (err) {
-		return fail(`email: ${err instanceof Error ? err.message : String(err)}`);
-	}
-	const accountId = readWranglerTopLevelString(rootConfig, "account_id") ?? (process.env.CLOUDFLARE_ACCOUNT_ID?.trim() || void 0);
-	if (!accountId) return fail([
-		"email: no Cloudflare account is pinned.",
-		"Set `account_id` in your root wrangler.jsonc, or export CLOUDFLARE_ACCOUNT_ID —",
-		"the same pin `void deploy --platform cloudflare` needs."
-	].join("\n"));
-	const workerName = readWranglerTopLevelString(rootConfig, "name") ?? deriveWorkerName(root);
-	const runWrangler = deps.runWrangler ?? createDeployWranglerRunner(root, accountId, apiBaseUrl);
-	const getSessionBearer = deps.getSessionBearer ?? (() => runWranglerAuthToken(runWrangler, configPath));
-	const sendEmail = rootConfig.send_email;
-	const inputs = {
-		handlers,
-		from,
-		workerName,
-		accountId,
-		existingSendEmail: Array.isArray(sendEmail) ? sendEmail : null,
-		existingAddresses: rootConfig.addresses,
-		existingVars: rootConfig.vars && typeof rootConfig.vars === "object" && !Array.isArray(rootConfig.vars) ? rootConfig.vars : null,
-		configConflicts: findEmailConfigConflicts(rootConfig),
-		wranglerArgs: [
-			"-c",
-			configPath,
-			"--env="
-		],
-		apiBaseUrl,
-		runWrangler,
-		getSessionBearer,
-		fetchImpl: deps.fetchImpl ?? fetch,
-		dns: deps.dns ?? await createNodeEmailDns()
-	};
-	let pre;
-	try {
-		pre = await preflightEmail(inputs);
-	} catch (err) {
-		return fail(`email: ${err instanceof Error ? err.message : String(err)}`);
-	}
-	print(renderEmailChecklist(pre));
-	if (args.subcommand === "status") {
-		print(renderAddressMap({
-			from,
-			routes: pre.derived.routes,
-			addresses: pre.rules.mine,
-			sendingReady: pre.sending.state === "ready",
-			pendingLabel: "(no rule yet)"
-		}));
-		if (pre.ready) {
-			log.success(`Email is set up on ${pre.domain}.`);
-			return;
-		}
-		log.warn(`Email is not set up on ${pre.domain} yet — run \`void email setup --platform cloudflare\`.`);
-		return exit(1);
-	}
-	if (pre.blockers.some((b) => b.scope === "all")) return fail("email: nothing was changed — fix the ✘ rows above and rerun.");
-	if (!pre.ready || pre.sendingRetryable) {
-		if (!(deps.isInteractive ?? !isWranglerNonInteractiveOrCI())) return fail("email: `void email setup` changes your Cloudflare account, so it needs an interactive terminal. Run it locally once, commit wrangler.jsonc, then redeploy.");
-		if (!await (deps.confirm ?? (async (message) => {
-			const answer = await confirm({
-				message,
-				initialValue: true
-			});
-			return !isCancel(answer) && answer === true;
-		}))(pre.ready ? `Onboard ${pre.domain} for Email Sending? Inbound already works; onboarding needs Workers Paid.` : `Set up email on ${pre.domain}?`)) {
-			log.info("Nothing changed.");
-			return;
-		}
-	}
-	const out = await applyEmailSetup(pre, inputs);
-	if (out.lines.length > 0) print(out.lines.join("\n"));
-	try {
-		writeProvisionedWranglerConfig(root, out.patch, { configPath });
-	} catch (err) {
-		return fail(`email: could not update ${configPath} — ${err instanceof Error ? err.message : String(err)}`);
-	}
-	print(renderAddressMap({
-		from,
-		routes: pre.derived.routes,
-		addresses: out.patch.addresses ?? [],
-		sendingReady: out.sendingReady,
-		pendingLabel: "(no rule yet)"
-	}));
-	if (!out.inboundReady) {
-		const missing = !out.routingReady ? `Email Routing on ${pre.domain} is not ready` : !out.subaddressingReady ? `subaddressing on ${pre.apex} is still off (support+anything@ would not reach support@)` : "`addresses` was withheld";
-		log.warn(`Email is not set up on ${pre.domain} yet — ${missing}; no routing rule is created until it is. Finish the step above, then rerun \`void email setup --platform cloudflare\`.`);
-		return exit(1);
-	}
-	if ((out.patch.addresses ?? []).length > 0) log.info("Routing rules are created by the next `void deploy --platform cloudflare`, which applies the Email Routing plan from `addresses`.");
-	log.success(`Email set up on ${pre.domain}.`);
-}
-//#endregion
-export { runEmailCommand };