void 0.26.1 → 0.28.0

package/dist/email-cloudflare-CH053RxK.mjs

@@ -0,0 +1,1096 @@
+import { n as __toESM } from "./rolldown-runtime-DXIUcv95.mjs";
+import { a as join, n as dirname, s as relative } from "./dist-ipQi0Q8y.mjs";
+import { t as require_picocolors } from "./picocolors-BTps1_gs.mjs";
+import { d as readConfig } from "./config-Bx_1SpnO.mjs";
+import { i as collectFiles } from "./isr-config-DPjXM8J2.mjs";
+import { i as voidWarn, r as voidLog } from "./log-vqY3pqwI.mjs";
+import { i as readProjectIdField } from "./project-rqDnVsJN.mjs";
+import { p as findBindingNameOwner, u as ensureWranglerCompat } from "./wrangler-BYs07Rxy.mjs";
+import { n as scopedAccessCredentials } from "./cf-access-BM9G0lhO.mjs";
+import { n as ensurePlatformProxyAccess } from "./cf-access-CWP4avfP.mjs";
+import { a as getApiUrl, c as getToken, o as getProxyUrl } from "./auth-B6iOCjKI.mjs";
+import { l as stripInternalEnvKeys } from "./env-BJjULvL0.mjs";
+import { n as readPrerenderPathsResponse, r as renderPrerenderPaths, t as outputFileForPath } from "./prerender-render-Bfsumdkv.mjs";
+import { a as buildEnv } from "./version-metadata-DIrqEHQo.mjs";
+import { existsSync, mkdirSync, readFileSync, unlinkSync, writeFileSync } from "node:fs";
+import { isRecord } from "@void/deploy-core";
+import { execFile } from "node:child_process";
+//#region src/prerender.ts
+var import_picocolors = /* @__PURE__ */ __toESM(require_picocolors(), 1);
+const PRERENDER_PATHS_ENDPOINT = "/__void/prerender-paths";
+const nodeRendererUrl = new URL(import.meta.url.endsWith(".ts") ? "./prerender-render.ts" : "./prerender-render.mjs", import.meta.url).href;
+function normalizeWorkerModulePath(path) {
+	return path.replace(/\\/g, "/").replace(/^\.\//, "");
+}
+function resolveWorkerModuleType(relativePath) {
+	const normalized = normalizeWorkerModulePath(relativePath);
+	if (normalized.includes("/.vite/") || normalized.startsWith(".vite/")) return null;
+	if (normalized === "wrangler.json" || normalized === "wrangler.jsonc") return null;
+	if (normalized.endsWith(".mjs") || normalized.endsWith(".js")) return "ESModule";
+	if (normalized.endsWith(".cjs")) return "CommonJS";
+	if (normalized.endsWith(".wasm")) return "CompiledWasm";
+	if (normalized.endsWith(".txt")) return "Text";
+	if (normalized.endsWith(".bin")) return "Data";
+	return null;
+}
+function collectPrerenderWorkerModules(workerDir, workerMain) {
+	const normalizedEntry = normalizeWorkerModulePath(workerMain);
+	const modules = collectFiles(workerDir).flatMap((filePath) => {
+		const relativePath = normalizeWorkerModulePath(relative(workerDir, filePath));
+		const type = resolveWorkerModuleType(relativePath);
+		if (!type) return [];
+		const file = readFileSync(filePath);
+		return [{
+			path: filePath,
+			relativePath,
+			type,
+			contents: type === "CompiledWasm" || type === "Data" ? new Uint8Array(file) : file.toString("utf-8")
+		}];
+	});
+	modules.sort((a, b) => {
+		if (a.relativePath === normalizedEntry) return -1;
+		if (b.relativePath === normalizedEntry) return 1;
+		return a.relativePath.localeCompare(b.relativePath);
+	});
+	if (!modules.some((module) => module.relativePath === normalizedEntry)) throw new Error(`prerender: Worker entry '${normalizedEntry}' not found in '${workerDir}'.`);
+	return modules.map(({ relativePath: _relativePath, ...module }) => module);
+}
+function buildPrerenderBindings(input) {
+	const { sanitized: wranglerVars, stripped } = stripInternalEnvKeys(input.wranglerVars);
+	if (stripped.length > 0) voidWarn(`Ignoring internal env keys in prerender inputs: ${stripped.join(", ")}. These are reserved for Void runtime use.`);
+	const voidBindings = {};
+	if (input.voidToken && input.voidProjectId) {
+		voidBindings.__VOID_TOKEN = input.voidToken;
+		voidBindings.__VOID_PROJECT_ID = input.voidProjectId;
+		if (!input.voidProxyUrl) throw new Error("prerender: No connected platform proxy is available. Run `void connect <url>` first.");
+		voidBindings.__VOID_PROXY_URL = input.voidProxyUrl;
+		const access = scopedAccessCredentials(input.accessEnv ?? {}, voidBindings.__VOID_PROXY_URL);
+		if (access) voidBindings.__VOID_ACCESS_CREDENTIALS = access;
+		if (input.remoteMode) voidBindings.__VOID_REMOTE = "1";
+	}
+	return {
+		...wranglerVars,
+		...voidBindings
+	};
+}
+async function createCloudflarePrerenderRunner(options) {
+	const { root, workerDir, persistDir, clientDir, remoteMode } = options;
+	const wranglerPath = join(workerDir, "wrangler.json");
+	if (!existsSync(wranglerPath)) throw new Error(`prerender: wrangler.json not found in '${workerDir}'.`);
+	const wranglerConfig = JSON.parse(readFileSync(wranglerPath, "utf-8"));
+	const wranglerCompat = ensureWranglerCompat(root, readConfig(root), workerDir);
+	const workerMain = wranglerConfig.main ?? "index.js";
+	let voidProjectId = options.projectId;
+	if (!voidProjectId) voidProjectId = process.env.VOID_DEPLOY_PROJECT_ID || void 0;
+	if (!voidProjectId) voidProjectId = readProjectIdField(root);
+	const voidToken = voidProjectId ? options.voidToken ?? getToken(root) : null;
+	const voidProxyUrl = voidToken && voidProjectId ? getProxyUrl(root) : void 0;
+	if (voidProxyUrl) ensurePlatformProxyAccess(getApiUrl(root), voidProxyUrl);
+	const bindings = buildPrerenderBindings({
+		accessEnv: process.env,
+		wranglerVars: wranglerConfig.vars,
+		voidToken,
+		voidProjectId,
+		voidProxyUrl,
+		remoteMode
+	});
+	const { Miniflare, convertV4MiniflareOptions } = await import("miniflare");
+	const mfOptions = {
+		modules: collectPrerenderWorkerModules(workerDir, workerMain),
+		modulesRoot: workerDir,
+		compatibilityDate: wranglerCompat.compatibilityDate,
+		compatibilityFlags: wranglerCompat.compatibilityFlags ?? [],
+		bindings: {
+			...bindings,
+			__VOID_PRERENDER: "1"
+		}
+	};
+	if (clientDir) mfOptions.serviceBindings = { [wranglerConfig.assets?.binding ?? "ASSETS"](request) {
+		const url = new URL(request.url);
+		const filePath = join(clientDir, url.pathname);
+		try {
+			const content = readFileSync(filePath);
+			return new Response(content);
+		} catch {
+			return new Response("Not Found", { status: 404 });
+		}
+	} };
+	const d1 = wranglerConfig.d1_databases;
+	if (Array.isArray(d1) && d1.length > 0) {
+		const databases = {};
+		for (const db of d1) databases[db.binding] = db.database_id;
+		mfOptions.d1Databases = databases;
+	}
+	const kv = wranglerConfig.kv_namespaces;
+	if (Array.isArray(kv) && kv.length > 0) {
+		const namespaces = {};
+		for (const ns of kv) namespaces[ns.binding] = ns.id;
+		mfOptions.kvNamespaces = namespaces;
+	}
+	const r2 = wranglerConfig.r2_buckets;
+	if (Array.isArray(r2) && r2.length > 0) {
+		const buckets = {};
+		for (const bucket of r2) buckets[bucket.binding] = bucket.bucket_name;
+		mfOptions.r2Buckets = buckets;
+	}
+	if (mfOptions.d1Databases || mfOptions.kvNamespaces || mfOptions.r2Buckets) mfOptions.resourcePersistencePath = join(persistDir, "v3");
+	const mf = new Miniflare(convertV4MiniflareOptions(mfOptions));
+	return {
+		async collectPaths() {
+			return readPrerenderPathsResponse(await mf.dispatchFetch(`http://localhost${PRERENDER_PATHS_ENDPOINT}`, { method: "POST" }));
+		},
+		async fetchPath(path) {
+			return mf.dispatchFetch(`http://localhost${path}`);
+		},
+		async fetchPageData(path) {
+			return mf.dispatchFetch(`http://localhost${path}`, { headers: {
+				Accept: "application/json",
+				Purpose: "prefetch",
+				"X-VoidPages": "true"
+			} });
+		},
+		async close() {
+			await mf.dispose();
+		}
+	};
+}
+async function collectPrerenderPaths(options) {
+	const runner = await createCloudflarePrerenderRunner(options);
+	try {
+		return await runner.collectPaths();
+	} finally {
+		await runner.close();
+	}
+}
+/**
+* Prerender pages by spinning up Miniflare with the built worker.
+* Collects paths through the built worker's internal endpoint and then
+* fetches each page, writing HTML responses to `clientDir`.
+*/
+async function prerenderPages(options) {
+	const runner = await createCloudflarePrerenderRunner(options);
+	try {
+		const paths = await runner.collectPaths();
+		if (paths.length === 0) return {
+			paths,
+			rendered: [],
+			failed: []
+		};
+		return {
+			paths,
+			...await renderPrerenderPaths(paths, options.clientDir, (path) => runner.fetchPath(path), (path) => runner.fetchPageData(path), (path, outputFile, error) => {
+				if (error !== void 0) voidWarn(`prerender ${path} failed: ${error}`);
+				else voidLog(`prerender ${import_picocolors.default.blue(outputFile)}`);
+			})
+		};
+	} finally {
+		await runner.close();
+	}
+}
+async function runNodePrerenderRunner(root, config) {
+	const runnerPath = join(root, ".void", "prerender-runner.mjs");
+	mkdirSync(dirname(runnerPath), { recursive: true });
+	writeFileSync(runnerPath, `
+import { pathToFileURL } from "node:url";
+import { dirname, join } from "node:path";
+import { readPrerenderPathsResponse, renderPrerenderPaths } from ${JSON.stringify(nodeRendererUrl)};
+
+const config = JSON.parse(process.argv[2]);
+const { mode, ssrDir, clientDir } = config;
+
+const appUrl = pathToFileURL(join(ssrDir, "app.js")).href;
+const app = await import(appUrl);
+const fetch = app.default?.fetch;
+if (!fetch) {
+  console.error("[void] No default export with fetch() found in app.js");
+  process.exit(1);
+}
+
+// The second argument is the Hono env. Its marker is what lets the built app
+// answer path discovery; HTTP servers never pass it.
+async function collectPaths() {
+  return readPrerenderPathsResponse(
+    await fetch(
+      new Request("http://localhost${PRERENDER_PATHS_ENDPOINT}", { method: "POST" }),
+      { __VOID_PRERENDER: "1" },
+    ),
+  );
+}
+
+async function renderPaths(paths) {
+  if (!clientDir) return { rendered: [], failed: [] };
+  return renderPrerenderPaths(
+    paths, clientDir,
+    (path) => fetch(new Request("http://localhost" + path)),
+    (path) => fetch(new Request("http://localhost" + path, {
+      headers: { "Accept": "application/json", "Purpose": "prefetch", "X-VoidPages": "true" },
+    })),
+  );
+}
+
+if (mode === "collect") {
+  process.stdout.write(JSON.stringify({ paths: await collectPaths() }));
+} else {
+  const paths = await collectPaths();
+  const result = await renderPaths(paths);
+  process.stdout.write(JSON.stringify({ paths, ...result }));
+}
+`);
+	try {
+		return await new Promise((resolve, reject) => {
+			execFile(process.execPath, [runnerPath, JSON.stringify(config)], {
+				env: buildEnv(),
+				cwd: root,
+				maxBuffer: 10485760
+			}, (error, stdout, stderr) => {
+				if (stderr) process.stderr.write(stderr);
+				if (error) {
+					reject(/* @__PURE__ */ new Error(`Prerender child process failed: ${error.message}`));
+					return;
+				}
+				try {
+					resolve(JSON.parse(stdout));
+				} catch {
+					reject(/* @__PURE__ */ new Error(`Failed to parse prerender output: ${stdout}`));
+				}
+			});
+		});
+	} finally {
+		try {
+			unlinkSync(runnerPath);
+		} catch {}
+	}
+}
+async function collectPrerenderPathsNode(options) {
+	return (await runNodePrerenderRunner(options.root, {
+		mode: "collect",
+		ssrDir: options.ssrDir,
+		clientDir: options.clientDir
+	})).paths;
+}
+/**
+* Prerender pages for Node.js targets by spawning a child process.
+*
+* Uses a child process to avoid mutating `process.env` in the parent Vite
+* build process. The child imports the built app, collects prerender paths
+* from the internal endpoint, renders each page, and returns the result.
+*/
+async function prerenderPagesNode(options) {
+	const result = await runNodePrerenderRunner(options.root, {
+		mode: "collect-and-render",
+		ssrDir: options.ssrDir,
+		clientDir: options.clientDir
+	});
+	for (const path of result.rendered) voidLog(`prerender ${import_picocolors.default.blue(outputFileForPath(path))}`);
+	for (const { path, error } of result.failed) voidWarn(`prerender ${path} failed: ${error}`);
+	return result;
+}
+//#endregion
+//#region src/cli/email-cloudflare.ts
+/** The `send_email` binding name Void provisions and the runtime reads. */
+const SEND_EMAIL_BINDING = "SEND_EMAIL";
+/** The root-config `vars` key carrying `void.config.ts` `email.from` into the worker. */
+const EMAIL_FROM_VAR = "__VOID_EMAIL_FROM";
+const CLOUDFLARE_API_BASE_URL = "https://api.cloudflare.com/client/v4";
+/** OAuth scopes the session needs (`whoami` `tokenPermissions`). */
+const REQUIRED_EMAIL_SCOPES = ["email_routing:write", "email_sending:write"];
+/** Cloudflare Email API error codes with a known meaning; others are reported verbatim. */
+const CF_EMAIL_ERROR_CODES = {
+	2062: "Email Routing is not enabled on this zone",
+	2040: "already onboarded for Email Sending",
+	2036: "account is not entitled to Email Sending",
+	10105: "account is not entitled to Email Sending"
+};
+/** The one-time dashboard step printed when the subdomain routing call cannot be made. */
+function subdomainDashboardFallback(apex, domain) {
+	return `Cloudflare dashboard → ${apex} → Email → Settings → Subdomains → add ${domain}, then redeploy`;
+}
+/** The Workers Free hint printed when Email Sending onboarding fails. */
+const SENDING_FREE_PLAN_HINT = "Workers Paid needed for arbitrary recipients. Inbound works; sendEmail() to verified destinations only.";
+/**
+* Config shapes the writer would refuse for `SEND_EMAIL` and `__VOID_EMAIL_FROM`, checked
+* before anything is asked. The writer keeps the same guard, since the file can change first.
+*/
+function findEmailConfigConflicts(config) {
+	const conflicts = /* @__PURE__ */ new Set();
+	const check = (field, name) => {
+		let owner;
+		try {
+			owner = findBindingNameOwner(config, field, name);
+		} catch (err) {
+			conflicts.add(`Cloudflare config: ${err instanceof Error ? err.message : String(err)}`);
+			return;
+		}
+		if (owner !== void 0) conflicts.add(`Cloudflare config already uses ${name} as a ${owner} binding; rename it in void.config.ts (Void writes ${name} into ${field})`);
+	};
+	check("send_email", SEND_EMAIL_BINDING);
+	check("vars", EMAIL_FROM_VAR);
+	return [...conflicts];
+}
+/** The `EmailCloudflareInputs` fields read from the parsed root config. */
+function emailConfigInputs(rootConfig) {
+	return {
+		existingSendEmail: Array.isArray(rootConfig.send_email) ? rootConfig.send_email : void 0,
+		existingAddresses: rootConfig.addresses,
+		existingVars: isRecord(rootConfig.vars) ? rootConfig.vars : void 0,
+		configConflicts: findEmailConfigConflicts(rootConfig)
+	};
+}
+/**
+* Host part of `email.from`, lowercased; `null` when it is not `local@host`. `void.config.ts`
+* also accepts the display-name form (`Acme <noreply@mail.acme.com>`, see `config.ts`),
+* so the address inside `<…>` is read when present.
+*
+* Validated per label, so an empty label or one that starts with `-` never reaches a
+* Cloudflare command argument.
+*/
+function emailFromDomain(from) {
+	const bracketed = /<([^<>]*)>\s*$/.exec(from.trim());
+	const address = bracketed ? bracketed[1] : from;
+	const at = address.lastIndexOf("@");
+	if (at <= 0 || at === address.length - 1) return null;
+	const host = address.slice(at + 1).trim().toLowerCase();
+	const labels = host.split(".");
+	if (labels.length < 2 || !labels.every((l) => /^[a-z0-9]([a-z0-9-]{0,61}[a-z0-9])?$/.test(l))) return null;
+	return host;
+}
+/**
+* `email/<literal>.ts` and `email/<literal>+[tag].ts` → `<literal>@<domain>`.
+* `email/_default.ts` and any dynamic local part (`[name].ts`, `[name]+[tag].ts`)
+* need a catch-all, which Cloudflare offers only on a zone apex: `*@<apex>` on the apex
+* path, refused with a message on a subdomain.
+*
+* Reuses the scanner's compiled pattern kinds rather than re-parsing filenames — the
+* grammar lives in `router/email.ts` and this must never disagree with the dispatcher.
+*/
+function deriveAddresses(handlers, domain, mode) {
+	const literals = [];
+	const routes = [];
+	const refused = [];
+	let needsCatchAll = false;
+	const catchAllHandlers = [];
+	for (const def of handlers.addresses) {
+		const handler = `email/${def.filePath}`;
+		if (def.pattern.kind === "static" || def.pattern.kind === "static-tag") {
+			const address = `${def.address.split("+")[0] ?? def.address}@${domain}`;
+			if (!literals.includes(address)) literals.push(address);
+			routes.push({
+				address,
+				handler
+			});
+			continue;
+		}
+		if (mode === "subdomain") {
+			refused.push({
+				handler,
+				reason: `a dynamic local part needs a catch-all, and a catch-all exists only on a zone apex; nothing at @${domain} reaches it`
+			});
+			continue;
+		}
+		needsCatchAll = true;
+		catchAllHandlers.push(handler);
+	}
+	if (handlers.defaultHandler) {
+		const handler = `email/${handlers.defaultHandler}`;
+		if (mode === "subdomain") refused.push({
+			handler,
+			reason: `a catch-all exists only on an apex; other @${domain} mail bounces`
+		});
+		else {
+			needsCatchAll = true;
+			catchAllHandlers.push(handler);
+		}
+	}
+	const addresses = [...literals];
+	if (needsCatchAll) {
+		const catchAll = `*@${domain}`;
+		addresses.push(catchAll);
+		for (const handler of catchAllHandlers) routes.push({
+			address: catchAll,
+			handler
+		});
+	}
+	return {
+		addresses,
+		refused,
+		routes
+	};
+}
+function parseWhoamiJson(data) {
+	if (!isRecord(data) || typeof data.loggedIn !== "boolean") return null;
+	if (data.tokenPermissions !== void 0 && (!Array.isArray(data.tokenPermissions) || data.tokenPermissions.some((scope) => typeof scope !== "string"))) return null;
+	if (data.accounts !== void 0 && (!Array.isArray(data.accounts) || data.accounts.some((account) => !isRecord(account) || typeof account.id !== "string" || typeof account.name !== "string"))) return null;
+	return data;
+}
+function readRoutingSettings(data) {
+	return isRecord(data) && typeof data.name === "string" && data.name.length > 0 && typeof data.enabled === "boolean" && typeof data.status === "string" && data.status.length > 0 && typeof data.tag === "string" && /^[0-9a-f]{32}$/.test(data.tag) ? {
+		name: data.name,
+		enabled: data.enabled,
+		status: data.status,
+		tag: data.tag
+	} : null;
+}
+function readRoutingRules(data) {
+	if (!Array.isArray(data)) return null;
+	const rules = [];
+	let catchAll = null;
+	for (const entry of data) {
+		if (!isRecord(entry) || typeof entry.enabled !== "boolean" || !Array.isArray(entry.actions) || entry.actions.length === 0 || !Array.isArray(entry.matchers) || entry.matchers.length === 0) return null;
+		const actions = [];
+		for (const action of entry.actions) {
+			if (!isRecord(action) || typeof action.type !== "string") return null;
+			if (action.type === "drop") actions.push("drop");
+			else if (action.type === "worker" || action.type === "forward") {
+				const values = typeof action.value === "string" ? [action.value] : action.value;
+				if (!Array.isArray(values) || values.length === 0 || !values.every((value) => typeof value === "string" && value.length > 0)) return null;
+				if (action.type === "worker") actions.push("worker:" + values.join(","));
+				else actions.push("forward:" + values.join(","));
+			} else return null;
+		}
+		const to = [];
+		let all = false;
+		for (const matcher of entry.matchers) {
+			if (!isRecord(matcher)) return null;
+			if (matcher.type === "all") all = true;
+			else if (matcher.type === "literal" && matcher.field === "to" || matcher.type === "to") {
+				if (typeof matcher.value !== "string" || matcher.value.length === 0) return null;
+				to.push(matcher.value.toLowerCase());
+			} else return null;
+		}
+		if (all) {
+			if (catchAll || entry.matchers.length !== 1) return null;
+			catchAll = {
+				enabled: entry.enabled,
+				actions
+			};
+		} else {
+			if (typeof entry.id !== "string" || entry.id.length === 0 || entry.name !== void 0 && typeof entry.name !== "string") return null;
+			rules.push({
+				id: entry.id,
+				name: entry.name ?? "",
+				enabled: entry.enabled,
+				to,
+				actions
+			});
+		}
+	}
+	return {
+		rules,
+		catchAll
+	};
+}
+function readSendingSettings(data) {
+	if (!isRecord(data)) return null;
+	const tag = data.tag ?? data.id;
+	return typeof data.name === "string" && data.name.length > 0 && typeof data.enabled === "boolean" && typeof tag === "string" && /^[0-9a-f]{32}$/.test(tag) ? {
+		name: data.name,
+		enabled: data.enabled,
+		tag
+	} : null;
+}
+function providerErrorCode(result) {
+	return result.errorCode ?? result.errors?.find((error) => error.code !== void 0)?.code ?? null;
+}
+function isHardFailure(result) {
+	return Boolean(result.signal) || Boolean(result.error);
+}
+function mxState(exchanges) {
+	if (exchanges.length === 0) return "empty";
+	return exchanges.every((x) => /\.mx\.cloudflare\.net\.?$/i.test(x)) ? "cloudflare" : "foreign";
+}
+async function probeMx(dns, name) {
+	try {
+		const exchanges = (await dns.resolveMx(name)).slice().sort((a, b) => a.priority - b.priority).map((r) => r.exchange.toLowerCase());
+		return {
+			state: mxState(exchanges),
+			exchanges
+		};
+	} catch (err) {
+		if (isNoRecord(err)) return {
+			state: "empty",
+			exchanges: []
+		};
+		return {
+			state: "unknown",
+			exchanges: []
+		};
+	}
+}
+async function probeTxt(dns, name) {
+	try {
+		return (await dns.resolveTxt(name)).length > 0 ? "present" : "absent";
+	} catch (err) {
+		return isNoRecord(err) ? "absent" : "unknown";
+	}
+}
+function isNoRecord(err) {
+	const code = err?.code;
+	return code === "ENODATA" || code === "ENOTFOUND";
+}
+/** Candidate zone names for `mail.acme.com`: `mail.acme.com`, `acme.com`. */
+function zoneCandidates(domain) {
+	const labels = domain.split(".");
+	const out = [];
+	for (let i = 0; i <= labels.length - 2; i += 1) out.push(labels.slice(i).join("."));
+	return out;
+}
+function shortId(id) {
+	return `${id.slice(0, 8)}…`;
+}
+/**
+* Read-only preflight: session, zone, public DNS, the provider reads and, when the bearer
+* can be borrowed, the two REST reads that have no command. Nothing here writes.
+*/
+async function preflightEmail(inputs) {
+	const domain = emailFromDomain(inputs.from);
+	if (!domain) throw new Error(`email.from must be an address like you@mail.example.com (got ${JSON.stringify(inputs.from)})`);
+	const apiBaseUrl = inputs.apiBaseUrl ?? CLOUDFLARE_API_BASE_URL;
+	const run = async (operation) => inputs.runWrangler({
+		...operation,
+		...inputs.configPath ? { configPath: inputs.configPath } : {}
+	}, { capture: true });
+	const usageHandlers = [...inputs.handlers.addresses.map((d) => `email/${d.filePath}`), ...inputs.handlers.defaultHandler ? [`email/${inputs.handlers.defaultHandler}`] : []];
+	const pre = {
+		from: inputs.from,
+		domain,
+		apex: null,
+		mode: null,
+		workerName: inputs.workerName,
+		accountId: inputs.accountId,
+		usage: {
+			handlers: usageHandlers,
+			sendEmailFiles: inputs.sendEmailFiles
+		},
+		session: {
+			state: "unknown",
+			missingScopes: []
+		},
+		zone: { state: "unknown" },
+		apexMx: {
+			state: "unknown",
+			exchanges: []
+		},
+		domainMx: {
+			state: "unknown",
+			exchanges: []
+		},
+		routing: { state: "unknown" },
+		subaddressing: { state: "unknown" },
+		sending: {
+			state: "unknown",
+			dnsConflicts: []
+		},
+		rules: {
+			state: "unknown",
+			mine: [],
+			foreign: [],
+			absent: []
+		},
+		binding: { state: "absent" },
+		sender: { state: "absent" },
+		addressesOwnership: {
+			state: "absent",
+			foreign: []
+		},
+		addressesStale: false,
+		derived: {
+			addresses: [],
+			refused: [],
+			routes: []
+		},
+		addresses: [],
+		rulesPending: [],
+		blockers: [],
+		sendingRetryable: false,
+		ready: false
+	};
+	const block = (scope, message) => {
+		pre.blockers.push({
+			scope,
+			message
+		});
+	};
+	for (const conflict of inputs.configConflicts ?? []) block("all", conflict);
+	const whoami = await run({ type: "auth.whoami" });
+	const who = isHardFailure(whoami) || whoami.status !== 0 ? null : parseWhoamiJson(whoami.data);
+	if (!who) {
+		pre.session.state = "unknown";
+		block("all", "could not read the Cloudflare session — run `void cloudflare login`");
+	} else if (!who.loggedIn) {
+		pre.session.state = "not-logged-in";
+		block("all", "not logged in to Cloudflare — run `void cloudflare login`");
+	} else {
+		pre.session.authType = who.authType;
+		pre.session.email = who.email;
+		pre.session.accountName = who.accounts?.find((a) => a.id === inputs.accountId)?.name;
+		if (who.authType === "Global API Key") {
+			pre.session.state = "api-key";
+			block("all", "the Cloudflare session is a Global API Key (CLOUDFLARE_API_KEY), which has no bearer to borrow for the subaddressing calls — unset CLOUDFLARE_API_KEY, then run `void cloudflare login` or set CLOUDFLARE_API_TOKEN to a token with Email Routing Edit + Email Sending Edit");
+		} else if (who.authType === void 0 || who.authType === "OAuth Token") {
+			const scopes = new Set(who.tokenPermissions ?? []);
+			pre.session.missingScopes = REQUIRED_EMAIL_SCOPES.filter((s) => !scopes.has(s));
+			if (pre.session.missingScopes.length > 0) {
+				pre.session.state = "missing-scopes";
+				block("all", `the Cloudflare session lacks ${pre.session.missingScopes.join(" + ")} — run \`void cloudflare logout\`, then \`void cloudflare login\` (one browser Allow)`);
+			} else pre.session.state = "ok";
+		} else pre.session.state = "ok";
+	}
+	const tokenHint = pre.session.state === "ok" && pre.session.authType !== "OAuth Token" ? " (an API token needs Email Routing Edit + Email Sending Edit on the zone and account)" : "";
+	let settings = null;
+	let settingsMiss = false;
+	if (pre.session.state === "ok") for (const candidate of zoneCandidates(domain)) {
+		const result = await run({
+			type: "email.routing.settings",
+			domain: candidate
+		});
+		if (isHardFailure(result)) {
+			settingsMiss = true;
+			break;
+		}
+		if (result.status === 0 && result.data === null) continue;
+		if (result.status !== 0) {
+			settingsMiss = true;
+			break;
+		}
+		settings = readRoutingSettings(result.data);
+		if (!settings) settingsMiss = true;
+		break;
+	}
+	if (settings) {
+		pre.apex = settings.name.toLowerCase();
+		pre.mode = pre.apex === domain ? "apex" : "subdomain";
+		pre.zone = {
+			state: "found",
+			zoneId: settings.tag
+		};
+	} else if (settingsMiss) block("all", `could not read Email Routing settings — unknown — run \`void email setup --platform cloudflare\`${tokenHint}`);
+	else if (pre.session.state === "ok") pre.zone.state = "not-found";
+	pre.domainMx = await probeMx(inputs.dns, domain);
+	pre.apexMx = pre.apex && pre.apex !== domain ? await probeMx(inputs.dns, pre.apex) : pre.domainMx;
+	const dmarc = await probeTxt(inputs.dns, `_dmarc.${domain}`);
+	const bounce = await probeTxt(inputs.dns, `cf-bounce.${domain}`);
+	if (dmarc === "present") pre.sending.dnsConflicts.push(`_dmarc.${domain}`);
+	if (bounce === "present") pre.sending.dnsConflicts.push(`cf-bounce.${domain}`);
+	if (dmarc === "unknown" || bounce === "unknown") pre.sending.dnsConflicts.push(`(DNS lookup failed for _dmarc.${domain} / cf-bounce.${domain})`);
+	let bearer = null;
+	if (pre.session.state === "ok") bearer = await inputs.getSessionBearer().catch(() => null);
+	if (bearer) {
+		const candidates = pre.apex ? [pre.apex] : zoneCandidates(domain);
+		for (const candidate of candidates) {
+			const zones = await fetchWithSessionBearer(inputs.fetchImpl, bearer, "GET", `/zones?name=${encodeURIComponent(candidate)}`, void 0, apiBaseUrl);
+			if (!zones.ok) break;
+			const zone = (Array.isArray(zones.result) ? zones.result : [])[0];
+			if (!zone) continue;
+			pre.zone.type = zone.type;
+			if (zone.account?.id && zone.account.id !== inputs.accountId) pre.zone = {
+				state: "other-account",
+				zoneId: zone.id,
+				type: zone.type
+			};
+			else if (zone.type && zone.type !== "full") pre.zone = {
+				state: "partial",
+				zoneId: zone.id,
+				type: zone.type
+			};
+			else {
+				pre.zone = {
+					state: "found",
+					zoneId: zone.id,
+					type: zone.type
+				};
+				if (!pre.apex) {
+					pre.apex = zone.name.toLowerCase();
+					pre.mode = pre.apex === domain ? "apex" : "subdomain";
+				}
+			}
+			break;
+		}
+		if (pre.zone.state === "found" && pre.zone.zoneId) {
+			const routing = await fetchWithSessionBearer(inputs.fetchImpl, bearer, "GET", `/zones/${pre.zone.zoneId}/email/routing`, void 0, apiBaseUrl);
+			const flag = routing.result?.support_subaddress;
+			if (routing.ok && typeof flag === "boolean") pre.subaddressing.state = flag ? "on" : "off";
+		}
+	}
+	bearer = null;
+	switch (pre.zone.state) {
+		case "not-found":
+			block("all", `no zone for ${domain} in Cloudflare account ${inputs.accountId} — add the domain to this account first`);
+			break;
+		case "other-account":
+			block("all", `${pre.apex ?? domain} is a zone in a different Cloudflare account than ${inputs.accountId}`);
+			break;
+		case "partial": block("all", `${pre.apex ?? domain} is a ${pre.zone.type} zone; Email Routing needs a full zone on Cloudflare DNS`);
+	}
+	if (!pre.apex || !pre.mode) {
+		pre.ready = false;
+		return pre;
+	}
+	const apex = pre.apex;
+	const mode = pre.mode;
+	if (settings) {
+		if (mode === "apex") {
+			pre.routing = {
+				state: settings.enabled && settings.status === "ready" ? "ready" : "pending",
+				status: settings.status,
+				enabled: settings.enabled
+			};
+			if (/^(unlocked|misconfigured)/.test(settings.status)) block("all", `Email Routing on ${apex} is ${settings.status} — fix it in the Cloudflare dashboard; Void never re-locks records you unlocked`);
+		} else {
+			pre.routing = {
+				state: pre.domainMx.state === "cloudflare" ? "ready" : pre.domainMx.state === "unknown" ? "unknown" : "pending",
+				status: settings.status,
+				enabled: settings.enabled
+			};
+			if (settings.status === "unlocked") block("all", `Email Routing on ${apex} is ${settings.status} — fix it in the Cloudflare dashboard; Void never re-locks records you unlocked`);
+		}
+	}
+	if (pre.routing.state !== "ready") {
+		if (pre.domainMx.state === "foreign") block("all", `${domain} already receives mail (${pre.domainMx.exchanges.join(", ")}). Void never enables routing over live mail.${mode === "apex" ? ` Use something@mail.${apex}.` : ""}`);
+		else if (pre.domainMx.state === "unknown") block("all", `could not read the MX records of ${domain} — unknown — run \`void email setup --platform cloudflare\``);
+	}
+	pre.derived = deriveAddresses(inputs.handlers, domain, mode);
+	const rulesResult = await run({
+		type: "email.routing.rules.list",
+		domain: apex
+	});
+	const rules = isHardFailure(rulesResult) || rulesResult.status !== 0 ? null : readRoutingRules(rulesResult.data);
+	if (!rules) {
+		pre.rules.state = "unknown";
+		block("all", `could not read Email Routing rules — unknown — run \`void email setup --platform cloudflare\`${tokenHint}`);
+	} else {
+		const workerToken = `worker:${inputs.workerName}`;
+		for (const address of pre.derived.addresses) {
+			if (address.startsWith("*@")) {
+				if (!rules.catchAll || !rules.catchAll.enabled || rules.catchAll.actions.includes("drop")) pre.rules.absent.push(address);
+				else if (rules.catchAll.actions.includes(workerToken)) pre.rules.mine.push(address);
+				else pre.rules.foreign.push({
+					address,
+					owner: rules.catchAll.actions.join(", ")
+				});
+				continue;
+			}
+			const rule = rules.rules.find((r) => r.enabled && r.to.includes(address)) ?? rules.rules.find((r) => r.to.includes(address));
+			if (!rule) pre.rules.absent.push(address);
+			else if (rule.actions.includes(workerToken)) {
+				if (rule.enabled) pre.rules.mine.push(address);
+				else pre.rules.absent.push(address);
+			} else pre.rules.foreign.push({
+				address,
+				owner: rule.actions.join(", ")
+			});
+		}
+		pre.rules.state = pre.rules.absent.length === 0 ? "ready" : "pending";
+	}
+	const foreign = new Set(pre.rules.foreign.map((f) => f.address));
+	pre.addresses = pre.derived.addresses.filter((a) => !foreign.has(a));
+	const sendingResult = await run({
+		type: "email.sending.settings",
+		domain
+	});
+	if (isHardFailure(sendingResult)) pre.sending.state = "unknown";
+	else if (sendingResult.status === 0 && sendingResult.data === null) pre.sending.state = "pending";
+	else if (sendingResult.status === 0) {
+		const parsed = readSendingSettings(sendingResult.data);
+		pre.sending.state = parsed ? parsed.enabled ? "ready" : "pending" : "unknown";
+	} else pre.sending.state = "unknown";
+	if (pre.sending.state === "unknown") block("sending", `could not read Email Sending settings — unknown — run \`void email setup --platform cloudflare\`${tokenHint}`);
+	else if (pre.sending.state === "pending" && pre.sending.dnsConflicts.length > 0) block("sending", `${pre.sending.dnsConflicts.join(", ")} already exists; onboarding writes its own _dmarc (p=reject) and DKIM records and would conflict — remove them or keep sending off`);
+	const names = (inputs.existingSendEmail ?? []).map((e) => typeof e?.name === "string" ? e.name : "");
+	if (names.includes("SEND_EMAIL")) pre.binding = { state: "present" };
+	else if (names.length > 0) {
+		pre.binding = {
+			state: "foreign",
+			foreignName: names[0]
+		};
+		block("all", `Cloudflare config already has a send_email binding named ${JSON.stringify(names[0])}; rename it to ${SEND_EMAIL_BINDING} in void.config.ts (a second binding would be silent)`);
+	}
+	if (inputs.existingAddresses !== void 0 && inputs.existingAddresses !== null) {
+		const existing = Array.isArray(inputs.existingAddresses) ? inputs.existingAddresses.map((a) => typeof a === "string" ? a.toLowerCase() : String(a)) : ["(not an array)"];
+		const candidates = new Set(pre.derived.addresses);
+		const unknown = existing.filter((a) => !candidates.has(a));
+		if (unknown.length > 0) {
+			pre.addressesOwnership = {
+				state: "foreign",
+				foreign: unknown
+			};
+			block("all", `Cloudflare addresses holds entries Void did not derive (${unknown.join(", ")}); remove ${unknown.map((a) => JSON.stringify(a)).join(", ")} from cloudflare.addresses in void.config.ts, or manage addresses by hand and unset email.from — skipping email setup this deploy`);
+		} else {
+			pre.addressesOwnership = {
+				state: "mine",
+				foreign: []
+			};
+			const pruned = new Set(pre.addresses);
+			pre.addressesStale = existing.length !== pre.addresses.length || existing.some((a) => !pruned.has(a));
+		}
+	} else pre.addressesStale = pre.addresses.length > 0;
+	const senderVar = inputs.existingVars?.[EMAIL_FROM_VAR];
+	pre.sender.state = senderVar === inputs.from ? "ready" : senderVar === void 0 ? "absent" : "stale";
+	pre.rulesPending = pre.rules.absent.filter((a) => pre.addresses.includes(a));
+	const sendingBlocked = pre.blockers.some((b) => b.scope === "sending");
+	pre.sendingRetryable = pre.sending.state === "pending" && !sendingBlocked;
+	const sendingSettled = pre.sending.state === "ready" || sendingBlocked || pre.sending.state === "pending" && pre.binding.state === "present";
+	pre.ready = !pre.blockers.some((b) => b.scope === "all") && pre.routing.state === "ready" && pre.subaddressing.state === "on" && sendingSettled && pre.binding.state === "present";
+	return pre;
+}
+/** Column padding for the checklist; an overflowing cell gets three spaces. */
+function pad(text, width) {
+	return text.length >= width ? `${text}   ` : text.padEnd(width);
+}
+/**
+* The block shown before the confirmation: status rows, then the `+`/`!` change list.
+* Blockers render as `✘` rows at the end so the developer sees why nothing will be asked.
+*/
+function renderEmailChecklist(pre) {
+	const apex = pre.apex ?? "?";
+	const lines = [];
+	const inUse = [...pre.usage.handlers, ...pre.usage.sendEmailFiles ? [`sendEmail() in ${pre.usage.sendEmailFiles} file${pre.usage.sendEmailFiles === 1 ? "" : "s"}`] : []];
+	lines.push(`  Email in use   ${inUse.join(" · ")}`);
+	const row = (label, value, note = "") => {
+		lines.push(`    ${pad(label, 10)}${note ? `${pad(value, 23)}${note}` : value}`);
+	};
+	row("domain", pre.domain, "(void.config.ts email.from)");
+	const session = [pre.session.accountName ? `account ${pre.session.accountName} (${shortId(pre.accountId)})` : `account ${shortId(pre.accountId)}`, pre.session.authType && pre.session.authType !== "OAuth Token" ? `session ${pre.session.email ? `${pre.session.email} ` : ""}(${pre.session.authType})` : pre.session.email ? `session ${pre.session.email}` : null].filter(Boolean).join(" · ");
+	row("zone", pre.zone.state === "found" ? apex : `${apex} ${pre.zone.state}`, session);
+	if (pre.mode === "subdomain") row("apex MX", pre.apexMx.exchanges[0] ?? (pre.apexMx.state === "unknown" ? "unknown" : "none"), "left alone — mail lives on the subdomain");
+	else row("apex MX", pre.apexMx.exchanges[0] ?? (pre.apexMx.state === "unknown" ? "unknown" : "none"), pre.apexMx.state === "cloudflare" ? "Cloudflare Email Routing" : pre.apexMx.state === "empty" ? "empty — the apex can take routing" : "");
+	const routingWord = pre.routing.state === "ready" ? "enabled" : pre.routing.state === "unknown" ? "unknown — run void email setup --platform cloudflare" : `not enabled${pre.mode === "apex" && pre.routing.status && pre.routing.status !== "unconfigured" ? ` (${pre.routing.status})` : ""}`;
+	const subWord = pre.subaddressing.state === "on" ? "subaddressing on" : pre.subaddressing.state === "off" ? "subaddressing off" : "subaddressing unknown";
+	row("routing", `${pre.domain}  ${routingWord} · ${subWord}`);
+	const sendingWord = pre.sending.state === "ready" ? "onboarded" : pre.sending.state === "unknown" ? "unknown — run void email setup --platform cloudflare" : pre.sendingRetryable && pre.binding.state === "present" ? "not onboarded — verified destinations only; after upgrading to Workers Paid run void email setup --platform cloudflare" : "not onboarded";
+	row("sending", `${pre.domain}  ${sendingWord}`);
+	if (pre.derived.addresses.length === 0) row("rules", "(none — no email/ handlers)");
+	for (const address of pre.derived.addresses) {
+		const foreignRule = pre.rules.foreign.find((f) => f.address === address);
+		const status = pre.rules.mine.includes(address) ? "ready" : foreignRule ? `owned elsewhere: ${foreignRule.owner} — pruned` : pre.rules.state === "unknown" ? "unknown" : "absent";
+		row("rules", `${address} → ${pre.workerName}`, `(${status})`);
+	}
+	row("binding", SEND_EMAIL_BINDING, `(${pre.binding.state === "present" ? "present" : pre.binding.state === "foreign" ? `found ${pre.binding.foreignName} instead` : "absent"})`);
+	row("sender", pre.from, `(vars.${EMAIL_FROM_VAR} ${pre.sender.state})`);
+	lines.push("");
+	const changes = [];
+	const change = (what, why) => {
+		changes.push(`    + ${pad(what, 44)}${why}`);
+	};
+	const warn = (what, why) => {
+		changes.push(`    ! ${pad(what, 44)}${why}`);
+	};
+	const subdomainNeedsApex = pre.mode === "subdomain" && pre.routing.enabled !== true;
+	if (pre.routing.state !== "ready" && subdomainNeedsApex) warn(`enable Email Routing on ${pre.domain}`, `Email Routing is not enabled on ${apex}; Void never enables it on the apex from the subdomain path — ${subdomainDashboardFallback(apex, pre.domain)}`);
+	else if (pre.routing.state !== "ready") change(`enable Email Routing on ${pre.domain}`, `Cloudflare writes and locks 3 MX + 1 SPF record ${pre.mode === "subdomain" ? "there" : "on the apex"}`);
+	if (pre.subaddressing.state !== "on") change(`turn on subaddressing for ${apex}`, "support+anything@ reaches support@");
+	if (pre.sending.state !== "ready" && !pre.blockers.some((b) => b.scope === "sending")) change(`onboard ${pre.domain} for Email Sending`, `MX/SPF/DKIM on cf-bounce.${pre.domain}, _dmarc.${pre.domain} (p=reject)`);
+	const parts = [];
+	if (pre.binding.state !== "present") parts.push(`send_email: [{ name: "${SEND_EMAIL_BINDING}" }]`);
+	if (pre.addressesStale) parts.push(pre.addresses.length > 0 ? `addresses: ${JSON.stringify(pre.addresses)}` : "addresses: (removed)");
+	if (pre.sender.state !== "ready") parts.push(`vars.${EMAIL_FROM_VAR}: ${JSON.stringify(pre.from)}`);
+	if (parts.length > 0) change("Cloudflare config", parts.join(", "));
+	for (const address of pre.rules.absent) change("routing rule (created on deploy)", `${address} → ${pre.workerName}`);
+	for (const foreign of pre.rules.foreign) warn(foreign.address, `already routed to ${foreign.owner}; left alone, not in addresses`);
+	for (const refused of pre.derived.refused) warn(refused.handler, refused.reason);
+	for (const blocker of pre.blockers) changes.push(`    ✘ ${blocker.message}`);
+	if (changes.length === 0) lines.push("  Nothing to change — email is set up.");
+	else lines.push(`  This changes YOUR Cloudflare account.${pre.mode === "subdomain" && !subdomainNeedsApex ? ` ${apex} itself is not touched.` : ""}`, ...changes);
+	return lines.join("\n");
+}
+/**
+* The ONLY function that receives the session bearer. It puts the token in the
+* `Authorization` header and nowhere else: not in the URL, not in a log line, not in
+* the returned object, not in an error. A transport failure is returned as
+* `{ ok: false, status: 0 }` with the underlying message (which names the URL at
+* most) — never thrown, so a caller can never leak the token through a stack trace.
+*/
+async function fetchWithSessionBearer(fetchImpl, bearer, method, path, body, apiBaseUrl = CLOUDFLARE_API_BASE_URL) {
+	const headers = { Authorization: `Bearer ${bearer}` };
+	if (body !== void 0) headers["Content-Type"] = "application/json";
+	const scrub = (text) => text.split(bearer).join("[redacted]");
+	let response;
+	try {
+		response = await fetchImpl(`${apiBaseUrl}${path}`, {
+			method,
+			headers,
+			body: body === void 0 ? void 0 : JSON.stringify(body)
+		});
+	} catch (err) {
+		return {
+			ok: false,
+			status: 0,
+			result: null,
+			errors: [{
+				code: 0,
+				message: scrub(err instanceof Error ? err.message : String(err))
+			}]
+		};
+	}
+	let payload = {};
+	try {
+		payload = await response.json();
+	} catch {
+		payload = {};
+	}
+	const errors = (payload.errors ?? []).map((e) => ({
+		code: typeof e?.code === "number" ? e.code : 0,
+		message: typeof e?.message === "string" ? scrub(e.message) : ""
+	}));
+	return {
+		ok: response.ok && payload.success !== false,
+		status: response.status,
+		result: payload.result ?? null,
+		errors
+	};
+}
+/**
+* Run only the rows preflight found not ready:
+*
+*   routing   apex → `email routing enable <apex>`
+*             subdomain → bearer POST /zones/{z}/email/routing/dns { name }
+*   subaddr   bearer PATCH /zones/{z}/email/routing { support_subaddress: true }
+*   sending   `email sending enable <domain>`; code 2040 (already onboarded) is ok;
+*             any other failure prints a hint and continues without sending
+*
+* A failed bearer call prints the dashboard fallback and withholds `addresses` this run;
+* it never fails the deploy. An `all` blocker applies nothing and returns an empty patch.
+*/
+async function applyEmailSetup(pre, inputs) {
+	const lines = [];
+	const result = {
+		patch: {},
+		lines,
+		routingReady: pre.routing.state === "ready",
+		subaddressingReady: pre.subaddressing.state === "on",
+		sendingReady: pre.sending.state === "ready",
+		inboundReady: false
+	};
+	const blocked = pre.blockers.filter((b) => b.scope === "all");
+	if (blocked.length > 0 || !pre.apex || !pre.mode) {
+		for (const b of blocked) lines.push(`  ✘ ${b.message}`);
+		if (blocked.length === 0) lines.push("  ✘ email: the zone could not be resolved — unknown — run `void email setup --platform cloudflare`");
+		return result;
+	}
+	const apex = pre.apex;
+	const apiBaseUrl = inputs.apiBaseUrl ?? CLOUDFLARE_API_BASE_URL;
+	const run = async (operation) => inputs.runWrangler({
+		...operation,
+		...inputs.configPath ? { configPath: inputs.configPath } : {}
+	}, { capture: true });
+	let bearer;
+	let bearerFailed = false;
+	let bearerObtained = false;
+	const borrow = async () => {
+		if (bearer === void 0) {
+			bearer = await inputs.getSessionBearer().catch(() => null);
+			if (bearer) bearerObtained = true;
+			else bearerFailed = true;
+		}
+		return bearer;
+	};
+	const withBearer = async (method, path, body) => {
+		const token = await borrow();
+		if (!token) return null;
+		const response = await fetchWithSessionBearer(inputs.fetchImpl, token, method, path, body, apiBaseUrl);
+		if (!response.ok) bearerFailed = true;
+		return response;
+	};
+	const describeFailure = (response) => {
+		if (!response) return "could not borrow the Cloudflare session (session-bearer step failed)";
+		const first = response.errors[0];
+		const code = first?.code ? ` [code: ${first.code}]` : "";
+		const known = first?.code ? CF_EMAIL_ERROR_CODES[first.code] : void 0;
+		return `Cloudflare answered ${response.status}${code}${known ? ` — ${known}` : first?.message ? ` — ${first.message}` : ""}`;
+	};
+	const apexRoutingOff = pre.mode === "subdomain" && pre.routing.enabled !== true;
+	if (!result.routingReady) {
+		if (pre.mode === "apex") {
+			const enable = await run({
+				type: "email.routing.enable",
+				domain: apex
+			});
+			if (!isHardFailure(enable) && enable.status === 0) {
+				result.routingReady = true;
+				lines.push(`  ✔ routing   ${apex} enabled`);
+			} else {
+				const code = providerErrorCode(enable);
+				lines.push(`  ✘ routing   could not enable Email Routing on ${apex}${code ? ` [code: ${code}]${CF_EMAIL_ERROR_CODES[code] ? ` — ${CF_EMAIL_ERROR_CODES[code]}` : ""}` : ""}`);
+			}
+		} else if (apexRoutingOff) {
+			lines.push(`  ✘ routing   ${pre.domain}: Email Routing is not enabled on ${apex} — a subdomain can only be added to a zone that already routes; Void never enables routing on the apex from the subdomain path`);
+			lines.push(`    ${subdomainDashboardFallback(apex, pre.domain)}`);
+		} else {
+			const response = await withBearer("POST", `/zones/${pre.zone.zoneId}/email/routing/dns`, { name: pre.domain });
+			if (response?.ok) {
+				result.routingReady = true;
+				lines.push(`  ✔ routing   ${pre.domain} enabled`);
+			} else {
+				lines.push(`  ✘ routing   ${pre.domain}: ${describeFailure(response)}`);
+				lines.push(`    ${subdomainDashboardFallback(apex, pre.domain)}`);
+			}
+		}
+	}
+	if (!result.subaddressingReady && !bearerFailed && !apexRoutingOff) {
+		const response = await withBearer("PATCH", `/zones/${pre.zone.zoneId}/email/routing`, { support_subaddress: true });
+		if (response?.ok) {
+			result.subaddressingReady = true;
+			lines.push(`  ✔ routing   subaddressing on for ${apex}`);
+		} else {
+			lines.push(`  ✘ routing   subaddressing on ${apex}: ${describeFailure(response)}`);
+			lines.push(`    turn it on in the Cloudflare dashboard → ${apex} → Email → Settings → Subaddressing`);
+		}
+	} else if (!result.subaddressingReady) lines.push(`  ✘ routing   subaddressing on ${apex}: skipped (${apexRoutingOff ? `Email Routing is not enabled on ${apex}` : bearerObtained ? "the subdomain routing call failed" : "session bearer unavailable"})`);
+	bearer = null;
+	const sendingBlocked = pre.blockers.filter((b) => b.scope === "sending");
+	if (!result.sendingReady && sendingBlocked.length > 0) for (const b of sendingBlocked) lines.push(`  ! sending   ${b.message}`);
+	else if (!result.sendingReady) {
+		const enable = await run({
+			type: "email.sending.enable",
+			domain: pre.domain
+		});
+		const code = isHardFailure(enable) ? null : providerErrorCode(enable);
+		if (!isHardFailure(enable) && (enable.status === 0 || code === 2040)) {
+			result.sendingReady = true;
+			lines.push(`  ✔ sending   ${pre.domain} onboarded`);
+		} else {
+			const known = code ? CF_EMAIL_ERROR_CODES[code] : void 0;
+			lines.push(`  ! sending   ${pre.domain} not onboarded${code ? ` [code: ${code}]` : ""}${known ? ` — ${known}` : ""}`);
+			lines.push(`    ${SENDING_FREE_PLAN_HINT}`);
+		}
+	}
+	if (result.routingReady || result.sendingReady) {
+		result.patch.sendEmail = { name: SEND_EMAIL_BINDING };
+		result.patch.vars = { [EMAIL_FROM_VAR]: pre.from };
+	}
+	const addressesWithheld = bearerFailed || !result.routingReady;
+	if (!addressesWithheld && pre.addresses.length > 0) result.patch.addresses = pre.addresses;
+	else {
+		result.patch.addresses = null;
+		if (addressesWithheld && pre.addresses.length > 0) lines.push(`  ! config    addresses withheld this run (${bearerFailed ? "session-bearer step failed" : "routing not ready"}); no routing rule is created for ${pre.addresses.join(", ")}`);
+	}
+	lines.push("  ✔ config    void.lock.json updated");
+	result.inboundReady = result.routingReady && result.subaddressingReady && !addressesWithheld;
+	return result;
+}
+/**
+* The post-deploy block:
+*
+*     inbound   support@mail.acme.com  →  email/support+[ticket].ts
+*     outbound  sendEmail() from support@mail.acme.com
+*/
+function renderAddressMap(map) {
+	const lines = [];
+	const width = Math.max(0, ...map.routes.map((r) => r.address.length));
+	const pending = map.pendingLabel ?? "(no rule this deploy)";
+	for (const route of map.routes) {
+		const marker = !map.addresses.includes(route.address) ? `   ${pending}` : map.creating?.includes(route.address) ? "   (rule created by this deploy)" : "";
+		lines.push(`    inbound   ${pad(route.address, width + 2)}→  ${route.handler}${marker}`);
+	}
+	lines.push(`    outbound  sendEmail() from ${map.from}${map.sendingReady ? "" : "   (verified destinations only)"}`);
+	return lines.join("\n");
+}
+/** The production `EmailDns`: `node:dns/promises` against the system resolver. */
+async function createNodeEmailDns() {
+	const dns = await import("node:dns/promises");
+	return {
+		resolveMx: (name) => dns.resolveMx(name),
+		resolveTxt: (name) => dns.resolveTxt(name)
+	};
+}
+//#endregion
+export { emailConfigInputs as a, renderAddressMap as c, collectPrerenderPathsNode as d, prerenderPages as f, createNodeEmailDns as i, renderEmailChecklist as l, SEND_EMAIL_BINDING as n, preflightEmail as o, prerenderPagesNode as p, applyEmailSetup as r, probeMx as s, EMAIL_FROM_VAR as t, collectPrerenderPaths as u };