depesha 0.1.0__tar.gz

depesha-0.1.0/PKG-INFO

@@ -0,0 +1,35 @@
+Metadata-Version: 2.4
+Name: depesha
+Version: 0.1.0
+Summary: Depesha CLI: transactional email from the shell, with the Claude skill built in
+Author: Depesha
+License: MIT
+Project-URL: Homepage, https://depesha.com
+Keywords: depesha,email,transactional,graphql,cli,agents
+Requires-Python: >=3.12
+Description-Content-Type: text/markdown
+Provides-Extra: admin
+Requires-Dist: httpx>=0.28; extra == "admin"
+Provides-Extra: dev
+Requires-Dist: pytest>=8.0; extra == "dev"
+Requires-Dist: respx>=0.22; extra == "dev"
+Requires-Dist: httpx>=0.28; extra == "dev"
+Requires-Dist: ruff>=0.8; extra == "dev"
+
+# depesha
+
+The command-line client for [Depesha](https://depesha.com), transactional email for every project you run, with the `/depesha` Claude skill built in.
+
+```bash
+uv tool install depesha            # or: pipx install depesha
+depesha skill install              # the skill, into ~/.claude/skills/depesha
+depesha login --token-file key.txt # a dp_live_, dp_test_ or dp_op_ key
+depesha templates push templates/
+depesha send sign-in-code --to you@example.com --var code=428913 --var-json expires_minutes=10
+```
+
+`depesha <noun> <verb>` maps to GraphQL against `https://api.depesha.com/graphql`; `depesha gql` and `depesha schema --sdl` reach the whole API. Output is JSON; exit codes are 0 ok, 1 API error (with `extensions.code`), 2 transport, 3 usage or configuration. Credentials live in `~/.depesha/credentials.json` (mode 600); `DEPESHA_TOKEN`, `DEPESHA_URL`, `DEPESHA_PROFILE` and `DEPESHA_PROJECT` override them.
+
+The core uses only the standard library. `depesha admin` (operator only, on the owner's machine) needs `depesha[admin]`.
+
+Full reference: `depesha skill show references/cli.md`.

depesha-0.1.0/README.md

@@ -0,0 +1,17 @@
+# depesha
+
+The command-line client for [Depesha](https://depesha.com), transactional email for every project you run, with the `/depesha` Claude skill built in.
+
+```bash
+uv tool install depesha            # or: pipx install depesha
+depesha skill install              # the skill, into ~/.claude/skills/depesha
+depesha login --token-file key.txt # a dp_live_, dp_test_ or dp_op_ key
+depesha templates push templates/
+depesha send sign-in-code --to you@example.com --var code=428913 --var-json expires_minutes=10
+```
+
+`depesha <noun> <verb>` maps to GraphQL against `https://api.depesha.com/graphql`; `depesha gql` and `depesha schema --sdl` reach the whole API. Output is JSON; exit codes are 0 ok, 1 API error (with `extensions.code`), 2 transport, 3 usage or configuration. Credentials live in `~/.depesha/credentials.json` (mode 600); `DEPESHA_TOKEN`, `DEPESHA_URL`, `DEPESHA_PROFILE` and `DEPESHA_PROJECT` override them.
+
+The core uses only the standard library. `depesha admin` (operator only, on the owner's machine) needs `depesha[admin]`.
+
+Full reference: `depesha skill show references/cli.md`.

depesha-0.1.0/depesha.egg-info/PKG-INFO

@@ -0,0 +1,35 @@
+Metadata-Version: 2.4
+Name: depesha
+Version: 0.1.0
+Summary: Depesha CLI: transactional email from the shell, with the Claude skill built in
+Author: Depesha
+License: MIT
+Project-URL: Homepage, https://depesha.com
+Keywords: depesha,email,transactional,graphql,cli,agents
+Requires-Python: >=3.12
+Description-Content-Type: text/markdown
+Provides-Extra: admin
+Requires-Dist: httpx>=0.28; extra == "admin"
+Provides-Extra: dev
+Requires-Dist: pytest>=8.0; extra == "dev"
+Requires-Dist: respx>=0.22; extra == "dev"
+Requires-Dist: httpx>=0.28; extra == "dev"
+Requires-Dist: ruff>=0.8; extra == "dev"
+
+# depesha
+
+The command-line client for [Depesha](https://depesha.com), transactional email for every project you run, with the `/depesha` Claude skill built in.
+
+```bash
+uv tool install depesha            # or: pipx install depesha
+depesha skill install              # the skill, into ~/.claude/skills/depesha
+depesha login --token-file key.txt # a dp_live_, dp_test_ or dp_op_ key
+depesha templates push templates/
+depesha send sign-in-code --to you@example.com --var code=428913 --var-json expires_minutes=10
+```
+
+`depesha <noun> <verb>` maps to GraphQL against `https://api.depesha.com/graphql`; `depesha gql` and `depesha schema --sdl` reach the whole API. Output is JSON; exit codes are 0 ok, 1 API error (with `extensions.code`), 2 transport, 3 usage or configuration. Credentials live in `~/.depesha/credentials.json` (mode 600); `DEPESHA_TOKEN`, `DEPESHA_URL`, `DEPESHA_PROFILE` and `DEPESHA_PROJECT` override them.
+
+The core uses only the standard library. `depesha admin` (operator only, on the owner's machine) needs `depesha[admin]`.
+
+Full reference: `depesha skill show references/cli.md`.

depesha-0.1.0/depesha.egg-info/SOURCES.txt

@@ -0,0 +1,44 @@
+README.md
+pyproject.toml
+depesha.egg-info/PKG-INFO
+depesha.egg-info/SOURCES.txt
+depesha.egg-info/dependency_links.txt
+depesha.egg-info/entry_points.txt
+depesha.egg-info/requires.txt
+depesha.egg-info/top_level.txt
+depesha_cli/__init__.py
+depesha_cli/__main__.py
+depesha_cli/auth.py
+depesha_cli/cloudflare.py
+depesha_cli/credentials.py
+depesha_cli/errors.py
+depesha_cli/introspection.py
+depesha_cli/io.py
+depesha_cli/template_files.py
+depesha_cli/transport.py
+depesha_cli/commands/__init__.py
+depesha_cli/commands/_run.py
+depesha_cli/commands/admin.py
+depesha_cli/commands/auth.py
+depesha_cli/commands/domain.py
+depesha_cli/commands/gql.py
+depesha_cli/commands/key.py
+depesha_cli/commands/messages.py
+depesha_cli/commands/project.py
+depesha_cli/commands/recipient.py
+depesha_cli/commands/schema.py
+depesha_cli/commands/send.py
+depesha_cli/commands/skill.py
+depesha_cli/commands/suppressions.py
+depesha_cli/commands/templates.py
+depesha_cli/skills/depesha/SKILL.md
+depesha_cli/skills/depesha/references/cli.md
+depesha_cli/skills/depesha/references/domains.md
+depesha_cli/skills/depesha/references/sending.md
+depesha_cli/skills/depesha/references/templates.md
+tests/test_admin.py
+tests/test_cli.py
+tests/test_commands.py
+tests/test_credentials.py
+tests/test_skill.py
+tests/test_transport.py

depesha-0.1.0/depesha.egg-info/dependency_links.txt

@@ -0,0 +1 @@
+

depesha-0.1.0/depesha.egg-info/entry_points.txt

@@ -0,0 +1,2 @@
+[console_scripts]
+depesha = depesha_cli.__main__:main

depesha-0.1.0/depesha.egg-info/requires.txt

@@ -0,0 +1,9 @@
+
+[admin]
+httpx>=0.28
+
+[dev]
+pytest>=8.0
+respx>=0.22
+httpx>=0.28
+ruff>=0.8

depesha-0.1.0/depesha.egg-info/top_level.txt

@@ -0,0 +1 @@
+depesha_cli

depesha-0.1.0/depesha_cli/__init__.py

@@ -0,0 +1 @@
+__version__ = "0.1.0"

depesha-0.1.0/depesha_cli/__main__.py

@@ -0,0 +1,58 @@
+import argparse
+import sys
+
+from . import __version__, auth, commands
+from .commands.skill import ADVERT
+from .errors import DepeshaCliError
+
+DOCS_HINT = (
+    "Run 'depesha --help' for the command list and 'depesha <noun> --help' for a group's verbs. "
+    "Docs: https://pypi.org/project/depesha/ · Depesha wiki page 'depesha/api/cli-reference'."
+)
+
+
+class DepeshaArgumentParser(argparse.ArgumentParser):
+    def error(self, message):
+        self.print_usage(sys.stderr)
+        self.exit(3, f"{self.prog}: error: {message}\n{DOCS_HINT}\n")
+
+
+def build_parser() -> DepeshaArgumentParser:
+    parser = DepeshaArgumentParser(
+        prog="depesha",
+        description="Depesha CLI: transactional email from the shell (argv -> GraphQL).",
+        epilog=(
+            "Exit codes: 0 ok, 1 GraphQL error (extensions.code), 2 transport, 3 usage or config. "
+            f"{DOCS_HINT} {ADVERT}."
+        ),
+    )
+    parser.add_argument("--version", action="version", version=f"depesha {__version__}")
+    parser.add_argument(
+        "--profile",
+        metavar="NAME",
+        default=None,
+        help="credential profile from ~/.depesha/credentials.json (default: DEPESHA_PROFILE, else the current one)",
+    )
+    subparsers = parser.add_subparsers(
+        dest="command", metavar="<command>", required=True, parser_class=DepeshaArgumentParser
+    )
+    commands.register(subparsers)
+    help_parser = subparsers.add_parser("help", help="show this help message and exit")
+    help_parser.set_defaults(func=lambda _args: (parser.print_help(), 0)[1])
+    return parser
+
+
+def main(argv=None) -> int:
+    parser = build_parser()
+    args = parser.parse_args(argv)
+    auth.set_profile_override(args.profile)
+    try:
+        result = args.func(args)
+    except DepeshaCliError as exc:
+        print(exc.render(), file=sys.stderr)
+        return exc.exit_code
+    return int(result or 0)
+
+
+if __name__ == "__main__":
+    sys.exit(main())

depesha-0.1.0/depesha_cli/auth.py

@@ -0,0 +1,94 @@
+import os
+from dataclasses import dataclass
+from urllib.parse import urlsplit, urlunsplit
+
+from .credentials import DEFAULT_PROFILE, CredentialStore
+from .errors import ConfigError
+
+DEFAULT_URL = "https://api.depesha.com/graphql"
+GRAPHQL_PATH = "/graphql"
+LOGIN_HINT = "No Depesha credentials found. Run: depesha login (or set DEPESHA_TOKEN)"
+KEY_PREFIXES = {"dp_live_": "live", "dp_test_": "test", "dp_op_": "operator"}
+
+_profile_override: str | None = None
+
+
+def set_profile_override(name: str | None) -> None:
+    global _profile_override
+    _profile_override = name or None
+
+
+def profile_name(payload: dict | None = None) -> str:
+    explicit = _profile_override or os.environ.get("DEPESHA_PROFILE")
+    if explicit:
+        return explicit
+    if payload is not None and payload.get("current_profile"):
+        return payload["current_profile"]
+    return DEFAULT_PROFILE
+
+
+def key_kind(token: str) -> str | None:
+    for prefix, kind in KEY_PREFIXES.items():
+        if token.startswith(prefix):
+            return kind
+    return None
+
+
+def key_prefix(token: str) -> str:
+    for prefix in KEY_PREFIXES:
+        if token.startswith(prefix):
+            return token[: len(prefix) + 8]
+    return ""
+
+
+def graphql_url(url: str) -> str:
+    parts = urlsplit(url.strip())
+    if parts.scheme not in ("http", "https") or not parts.netloc:
+        raise ConfigError(f"Not an http(s) URL: {url!r}")
+    path = parts.path.rstrip("/")
+    if not path.endswith(GRAPHQL_PATH):
+        path = path + GRAPHQL_PATH
+    return urlunsplit((parts.scheme, parts.netloc, path, "", ""))
+
+
+@dataclass
+class Credential:
+    url: str
+    token: str
+    source: str
+    profile_name: str | None = None
+
+    @property
+    def kind(self) -> str | None:
+        return key_kind(self.token)
+
+
+def select(store: CredentialStore | None = None) -> Credential:
+    store = store or CredentialStore()
+    env_url = os.environ.get("DEPESHA_URL")
+    env_token = os.environ.get("DEPESHA_TOKEN")
+    if env_token:
+        payload = store.read(strict=False)
+        profile = payload["profiles"].get(profile_name(payload)) or {}
+        url = env_url or profile.get("url") or DEFAULT_URL
+        return Credential(graphql_url(url), env_token, "DEPESHA_TOKEN env")
+    payload = store.read()
+    name = profile_name(payload)
+    profile = payload["profiles"].get(name)
+    if not profile or not profile.get("token"):
+        if payload["profiles"]:
+            raise ConfigError(f"No Depesha credentials for profile {name!r}. Run: depesha login --profile {name}")
+        raise ConfigError(LOGIN_HINT)
+    url = env_url or profile.get("url") or DEFAULT_URL
+    return Credential(graphql_url(url), profile["token"], f"profile {name!r} ({store.path})", name)
+
+
+def default_project() -> str | None:
+    env_project = os.environ.get("DEPESHA_PROJECT")
+    if env_project:
+        return env_project
+    if os.environ.get("DEPESHA_TOKEN"):
+        return None
+    store = CredentialStore()
+    payload = store.read(strict=False)
+    return (payload["profiles"].get(profile_name(payload)) or {}).get("project")

depesha-0.1.0/depesha_cli/cloudflare.py

@@ -0,0 +1,124 @@
+import httpx
+
+from .errors import ConfigError, TransportError
+
+API = "https://api.cloudflare.com/client/v4"
+TIMEOUT = 30.0
+CREATED = "created"
+UPDATED = "updated"
+UNCHANGED = "unchanged"
+CONFLICT = "conflict"
+PLANNED_CREATE = "would create"
+PLANNED_UPDATE = "would update"
+
+
+class Cloudflare:
+    def __init__(self, token: str, client: httpx.Client | None = None):
+        self.client = client or httpx.Client(
+            base_url=API, timeout=TIMEOUT, headers={"Authorization": f"Bearer {token}"}
+        )
+
+    def request(self, method: str, path: str, **kwargs) -> dict | list:
+        try:
+            response = self.client.request(method, path, **kwargs)
+        except httpx.HTTPError as exc:
+            raise TransportError(f"Could not reach Cloudflare: {exc}") from exc
+        if response.status_code >= 400:
+            raise TransportError(
+                f"Cloudflare answered HTTP {response.status_code} to {method} {path}",
+                status=response.status_code,
+                body=cloudflare_errors(response),
+            )
+        return response.json()["result"]
+
+    def find_zone(self, domain: str) -> dict:
+        labels = domain.split(".")
+        for start in range(len(labels) - 1):
+            candidate = ".".join(labels[start:])
+            zones = self.request("GET", "/zones", params={"name": candidate})
+            if zones:
+                return zones[0]
+        raise ConfigError(f"No Cloudflare zone for {domain} is visible to this token")
+
+    def records(self, zone_id: str, name: str) -> list[dict]:
+        return self.request("GET", f"/zones/{zone_id}/dns_records", params={"name": name, "per_page": 100})
+
+    def create(self, zone_id: str, record: dict) -> dict:
+        return self.request("POST", f"/zones/{zone_id}/dns_records", json=record)
+
+    def update(self, zone_id: str, record_id: str, changes: dict) -> dict:
+        return self.request("PATCH", f"/zones/{zone_id}/dns_records/{record_id}", json=changes)
+
+
+def cloudflare_errors(response: httpx.Response) -> str:
+    try:
+        errors = response.json().get("errors") or []
+    except ValueError:
+        return response.text[:500]
+    return "; ".join(f"{e.get('code')}: {e.get('message')}" for e in errors) or response.text[:500]
+
+
+def normalize(record_type: str, content: str) -> str:
+    value = content.strip()
+    if record_type == "CNAME":
+        return value.rstrip(".").lower()
+    return value.strip('"')
+
+
+def plan_record(action: dict, existing: list[dict], tag: str) -> tuple[str, dict | None, str | None]:
+    wanted_type = action["type"]
+    wanted = normalize(wanted_type, action["content"])
+    same_type = [r for r in existing if r["type"] == wanted_type]
+    others = [r for r in existing if r["type"] != wanted_type]
+    if wanted_type == "CNAME" and others:
+        kinds = ", ".join(sorted({r["type"] for r in others}))
+        return CONFLICT, None, f"{action['name']} already has {kinds} records; a CNAME can't sit next to them"
+    if wanted_type == "TXT" and any(normalize("TXT", r["content"]).startswith("v=DMARC1") for r in same_type):
+        return CONFLICT, None, f"{action['name']} already has a DMARC record; Depesha never changes it"
+    for record in same_type:
+        if normalize(wanted_type, record["content"]) != wanted:
+            continue
+        if not record.get("proxied"):
+            return UNCHANGED, record, None
+        if record.get("comment") == tag:
+            return UPDATED, record, "switch to DNS only"
+        return CONFLICT, record, f"{action['name']} is proxied (orange cloud); switch it to DNS only by hand"
+    ours = [r for r in same_type if r.get("comment") == tag]
+    if ours:
+        return UPDATED, ours[0], None
+    if same_type and wanted_type == "CNAME":
+        found = ", ".join(r["content"] for r in same_type)
+        return CONFLICT, None, f"{action['name']} points to {found}, which Depesha didn't create; left untouched"
+    return CREATED, None, None
+
+
+def apply_actions(cf: Cloudflare, zone: dict, domain: dict, actions: list[dict], *, dry_run: bool) -> list[dict]:
+    tag = f"depesha:{domain['id']}"
+    results = []
+    for action in actions:
+        outcome, record, detail = plan_record(action, cf.records(zone["id"], action["name"]), tag)
+        row = {"type": action["type"], "name": action["name"], "content": action["content"], "result": outcome}
+        if detail:
+            row["detail"] = detail
+        if outcome == CREATED:
+            if dry_run:
+                row["result"] = PLANNED_CREATE
+            else:
+                cf.create(
+                    zone["id"],
+                    {
+                        "type": action["type"],
+                        "name": action["name"],
+                        "content": action["content"],
+                        "ttl": 1,
+                        "proxied": False,
+                        "comment": tag,
+                    },
+                )
+        elif outcome == UPDATED:
+            if dry_run:
+                row["result"] = PLANNED_UPDATE
+            else:
+                cf.update(zone["id"], record["id"], {"content": action["content"], "proxied": False, "comment": tag})
+        results.append(row)
+    return results

depesha-0.1.0/depesha_cli/commands/__init__.py

@@ -0,0 +1,20 @@
+from . import admin, auth, domain, gql, key, messages, project, recipient, schema, send, skill, suppressions, templates
+
+
+def register(subparsers) -> None:
+    for module in (
+        auth,
+        project,
+        key,
+        recipient,
+        domain,
+        templates,
+        send,
+        messages,
+        suppressions,
+        gql,
+        schema,
+        skill,
+        admin,
+    ):
+        module.register(subparsers)

depesha-0.1.0/depesha_cli/commands/_run.py

@@ -0,0 +1,106 @@
+import os
+import sys
+from pathlib import Path
+
+from ..auth import default_project, select
+from ..errors import ConfigError
+from ..io import format_output
+from ..transport import execute
+
+
+def fetch(document: str, variables: dict) -> dict:
+    credential = select()
+    return execute(document, variables, url=credential.url, token=credential.token)
+
+
+def fetch_data(document: str, variables: dict) -> dict:
+    return fetch(document, variables).get("data") or {}
+
+
+def emit(args, envelope: dict) -> None:
+    print(format_output(envelope, raw=getattr(args, "raw", False), compact=getattr(args, "compact", False)))
+    sys.stdout.flush()
+
+
+def hint(message: str | None) -> None:
+    if message:
+        print(message, file=sys.stderr)
+        sys.stderr.flush()
+
+
+def run_op(args, document: str, variables: dict, *, after=None) -> int:
+    envelope = fetch(document, variables)
+    emit(args, envelope)
+    if after is not None:
+        hint(after(envelope.get("data") or {}))
+    return 0
+
+
+def project_arg(args, *, required: bool) -> str | None:
+    project = getattr(args, "project", None) or default_project()
+    if required and not project:
+        raise ConfigError("--project is required (or set DEPESHA_PROJECT, or log in with a project key)")
+    return project
+
+
+def add_project_arg(parser, *, required: bool) -> None:
+    suffix = "" if required else "; a project key may omit it"
+    parser.add_argument(
+        "--project",
+        metavar="SLUG",
+        help=f"project slug (default: DEPESHA_PROJECT, else the profile's project{suffix})",
+    )
+
+
+def add_secret_file_arg(parser) -> None:
+    parser.add_argument(
+        "--secret-file",
+        metavar="PATH",
+        help="write the new secret to PATH (mode 600, must not exist) instead of printing it",
+    )
+
+
+def open_secret_file(path: str):
+    target = Path(path).expanduser()
+    try:
+        descriptor = os.open(target, os.O_CREAT | os.O_EXCL | os.O_WRONLY | os.O_NOFOLLOW, 0o600)
+    except FileExistsError as exc:
+        raise ConfigError(f"Refusing to overwrite {target}: it already exists (nothing was created)") from exc
+    except OSError as exc:
+        raise ConfigError(f"Cannot create {target}: {exc} (nothing was created)") from exc
+    return target, os.fdopen(descriptor, "w")
+
+
+def run_secret_op(args, document: str, variables: dict, path: list[str]) -> int:
+    secret_file = getattr(args, "secret_file", None)
+    if not secret_file:
+        emit(args, fetch(document, variables))
+        return 0
+    target, handle = open_secret_file(secret_file)
+    try:
+        envelope = fetch(document, variables)
+    except BaseException:
+        handle.close()
+        target.unlink()
+        raise
+    node = envelope.get("data") or {}
+    for key in path[:-1]:
+        node = node.get(key) or {}
+    secret = node.get(path[-1])
+    if not secret:
+        handle.close()
+        target.unlink()
+        emit(args, envelope)
+        hint("depesha: the API returned no secret, so nothing was written")
+        return 1
+    try:
+        with handle:
+            handle.write(secret + "\n")
+    except OSError as exc:
+        emit(args, envelope)
+        hint(f"depesha: could not write {target}: {exc}; the secret is printed above instead, copy it now")
+        return 1
+    del node[path[-1]]
+    node["secretFile"] = str(target)
+    emit(args, envelope)
+    return 0

depesha-0.1.0/depesha_cli/commands/admin.py

@@ -0,0 +1,95 @@
+import importlib
+import importlib.util
+import json
+import sys
+from pathlib import Path
+
+from ..errors import ConfigError
+from ..io import read_path
+from ._run import fetch_data
+from .domain import resolve_domain_id
+
+DEFAULT_TOKEN_FILE = "~/.cloudflared/cf-dns-token"
+ADMIN_EXTRA_HINT = (
+    "depesha admin needs the [admin] extra: uv tool install 'depesha[admin]' (or pip install 'depesha[admin]')"
+)
+DOMAIN_QUERY = "query Domain($id: ID!) { domain(id: $id) { id name state actions { action type name content } } }"
+
+
+def register(subparsers) -> None:
+    group = subparsers.add_parser(
+        "admin",
+        help="operator only, on the owner's machine: local credentials, never through the API",
+        description=(
+            "operator-only work with local credentials. Nothing here is exposed by the API; it runs where the "
+            "credentials are (the owner's machine)."
+        ),
+    )
+    verbs = group.add_subparsers(dest="admin_verb", metavar="<verb>", required=True)
+    dns = verbs.add_parser(
+        "dns",
+        help="create a domain's CNAMEs in the owner's Cloudflare zone",
+        description=(
+            "read the domain's action list from the API (operator credential) and create each ADD record in the "
+            "owner's Cloudflare zone with the all-zones DNS token: DNS only, tagged depesha:<domain-id>. Records "
+            "Depesha didn't create are never changed; they are reported as conflicts (exit 1). The DMARC TXT is "
+            "only created with --dmarc, after the owner agreed."
+        ),
+    )
+    dns.add_argument("domain", metavar="DOMAIN", help="the domain id, or its name with --project")
+    dns.add_argument("--project", metavar="SLUG", help="project slug, to look the domain up by name")
+    dns.add_argument(
+        "--token-file",
+        default=DEFAULT_TOKEN_FILE,
+        metavar="PATH",
+        help=f"Cloudflare DNS token (default: {DEFAULT_TOKEN_FILE})",
+    )
+    dns.add_argument("--dmarc", action="store_true", help="also create the offered _dmarc TXT (owner consent)")
+    dns.add_argument("--dry-run", action="store_true", help="show what would change; write nothing")
+    dns.set_defaults(func=run_dns)
+
+
+def load_cloudflare():
+    if importlib.util.find_spec("httpx") is None:
+        raise ConfigError(ADMIN_EXTRA_HINT)
+    return importlib.import_module("depesha_cli.cloudflare")
+
+
+def read_token(path: str) -> str:
+    resolved = str(Path(path).expanduser())
+    if not Path(resolved).is_file():
+        raise ConfigError(f"No Cloudflare token at {resolved}; depesha admin runs on the owner's machine")
+    token = read_path(resolved).strip()
+    if not token:
+        raise ConfigError(f"{resolved} is empty")
+    return token
+
+
+def run_dns(args) -> int:
+    cloudflare = load_cloudflare()
+    token = read_token(args.token_file)
+    domain = fetch_data(DOMAIN_QUERY, {"id": resolve_domain_id(args, args.domain)})["domain"]
+    actions = [
+        action
+        for action in domain["actions"]
+        if action["action"] == "ADD" and (action["type"] == "CNAME" or (args.dmarc and action["type"] == "TXT"))
+    ]
+    client = cloudflare.Cloudflare(token)
+    zone = client.find_zone(domain["name"])
+    records = cloudflare.apply_actions(client, zone, domain, actions, dry_run=args.dry_run)
+    report = {
+        "domain": domain["name"],
+        "domainId": domain["id"],
+        "zone": zone["name"],
+        "dryRun": args.dry_run,
+        "records": records,
+    }
+    print(json.dumps(report, indent=2))
+    sys.stdout.flush()
+    conflicts = [r for r in records if r["result"] == cloudflare.CONFLICT]
+    if conflicts:
+        print(f"depesha: {len(conflicts)} record(s) left untouched; fix them by hand", file=sys.stderr)
+        return 1
+    if not args.dry_run:
+        print(f"Next: depesha domain verify {domain['id']}", file=sys.stderr)
+    return 0