@agentcomms/resend 0.8.0 → 0.10.0

package/dist/cli.mjs

@@ -1,9 +1,9 @@
 #!/usr/bin/env node
-import { B as canPrompt, C as policyReport, D as showAccount, E as sendPolicyOf, F as CommsError, G as gatedChangeAtTerminal, H as colorEnabled, I as EXIT_CODES, J as renderInstall, K as installExitStatus, L as agentMarker, M as checkNewName, O as ResendContext, P as CHANNEL_SERVERS, Q as serverPruneChange, R as approvalKind, S as policyChange, T as removeAccountChange, U as escapeForDisplay, X as runCommand, Y as renderPrune, Z as serverInstallChange, _ as runDoctor, a as revokeSendApproval, b as listAccounts, c as downloadReceived, d as listReceived, et as truncateDisplay, f as listScheduled, g as showSentEmail, h as showReceived, i as prepareSend, l as getMetrics, m as listSuppressions, n as executeSend, o as sendStatus, ot as VERSION, p as listSentEmails, q as paint, r as finishSendApproval, s as cancelScheduledChange, t as beginSendApproval, tt as writeResult, u as listDomains, v as addAccountChange, w as policyWanted, x as modeOf, y as inspectKey, z as approveChangeAtTerminal } from "./send-BpwXJL8C.mjs";
+import { $ as openCore, B as approvalKind, C as policyChange, D as sendPolicyOf, E as removeAccountChange, F as CHANNEL_SERVERS, H as approveChangeAtTerminal, I as CommsError, J as escapeForDisplay, K as colorEnabled, L as EXIT_CODES, N as checkNewName, O as showAccount, Q as installExitStatus, R as SEND_LOOKUP, S as policyApprovalRefusal, T as policyWanted, U as canPrompt, V as approvalsOf, Y as exemptFromUpdateGate, Z as gatedChangeAtTerminal, _ as runDoctor, _t as VERSION, a as revokeSendApproval, at as serverInstallChange, b as listAccounts, c as downloadReceived, d as listReceived, et as paint, f as listScheduled, ft as writeResult, g as showSentEmail, h as showReceived, i as prepareSend, it as runCommand, k as ResendContext, l as getMetrics, lt as truncateDisplay, m as listSuppressions, n as executeSend, nt as renderInstall, o as sendStatus, ot as serverPruneChange, p as listSentEmails, q as commandPathOf, r as finishSendApproval, rt as renderPrune, s as cancelScheduledChange, st as terminalUpdateHooks, t as beginSendApproval, tt as refuseUnclaimedApproval, u as listDomains, ut as updateGateAtTerminal, v as addAccountChange, w as policyReport, x as modeOf, y as inspectKey, z as agentMarker } from "./send-Ba1caJ6x.mjs";
 import path from "node:path";
+import childProcess from "node:child_process";
 import { createInterface } from "node:readline/promises";
 import { stripVTControlCharacters } from "node:util";
-import childProcess from "node:child_process";
 import fs from "node:fs";
 import process$1 from "node:process";
 import { EventEmitter } from "node:events";
@@ -3160,7 +3160,8 @@ Getting started:
   agent-resend received list --account acme/resend
   agent-resend mcp install --client claude-code   register the server with an agent, once a person approves it
 
-Exit codes: 0 ok · 1 unexpected · 10 a send or a change was refused or needs approval · 64 usage ·
+Exit codes: 0 ok · 1 unexpected · 10 a send or a change was refused or needs approval · 11 an update
+is out: update first, or put it off (agentcomms update, agentcomms update --later) · 64 usage ·
 65 bad data · 66 not found · 69 provider or secret store unavailable · 75 temporary (retry later) ·
 77 key or permission needed · 78 configuration problem.`).exitOverride();
 	const globals = () => {
@@ -3174,9 +3175,41 @@ Exit codes: 0 ok · 1 unexpected · 10 a send or a change was refused or needs a
 		json: globals().json,
 		color: globals().color
 	});
+	let gated = null;
+	program.hook("preAction", async (_program, command) => {
+		const path = commandPathOf(command);
+		if (exemptFromUpdateGate(path)) return;
+		const core = openCore({ env });
+		let ended = null;
+		const code = await runCommand(output(), async () => {
+			ended = await updateGateAtTerminal({
+				core,
+				env,
+				binary: "agent-resend",
+				channel: "resend",
+				running: VERSION,
+				output: output(),
+				noInput: false,
+				streams,
+				approveCommand: "agent-resend approve",
+				approvals: approvalsOf(command),
+				approvalClaim: path.join(" ") === "send status" ? SEND_LOOKUP : void 0,
+				...terminalUpdateHooks(core, env, {
+					output: output(),
+					streams,
+					approveCommand: "agent-resend approve"
+				})
+			});
+		}, streams);
+		gated = code !== 0 ? code : ended;
+	});
 	const act = (body) => async (...args) => {
 		ran = true;
 		softExit = null;
+		if (gated !== null) {
+			exitCode = gated;
+			return;
+		}
 		const context = new ResendContext({
 			...deps,
 			env,
@@ -3237,7 +3270,9 @@ Exit codes: 0 ok · 1 unexpected · 10 a send or a change was refused or needs a
 			mode: flags.mode,
 			change: flags.change
 		});
-		const result = wanted.send === void 0 && wanted.mode === void 0 && wanted.change === void 0 ? await policyReport(context, name) : await changeAt(context, policyChange(context, name, wanted), flags, `agent-resend account policy ${name}${wanted.send ? ` --send ${wanted.send}` : ""}${wanted.mode ? ` --mode ${wanted.mode}` : ""}${wanted.change ? ` --change ${wanted.change}` : ""}`);
+		const reporting = wanted.send === void 0 && wanted.mode === void 0 && wanted.change === void 0;
+		if (reporting) refuseUnclaimedApproval(flags.approval, policyApprovalRefusal("cli"));
+		const result = reporting ? await policyReport(context, name) : await changeAt(context, policyChange(context, name, wanted), flags, `agent-resend account policy ${name}${wanted.send ? ` --send ${wanted.send}` : ""}${wanted.mode ? ` --mode ${wanted.mode}` : ""}${wanted.change ? ` --change ${wanted.change}` : ""}`);
 		writeResult(result, output(), renderPolicy, streams);
 	}));
 	program.command("doctor").description("check what has to work, and say who enforces what — read-only is this package’s promise, not the key’s").option("--account <name>", "check only this account").option("--offline", "do not ask Resend anything", false).action(act(async (context, options, flags) => {
@@ -3370,7 +3405,7 @@ Exit codes: 0 ok · 1 unexpected · 10 a send or a change was refused or needs a
 	}));
 	const mcp = program.command("mcp").description("run the MCP server on stdio, for a coding agent to connect to").option("--account <name>", "pin the server to one account; every tool then acts on it and no other").action(async (flags) => {
 		ran = true;
-		const { startResendStdioServer } = await import("./stdio-entry-CVMfmkCS.mjs");
+		const { startResendStdioServer } = await import("./stdio-entry-CKC1hDbG.mjs");
 		await startResendStdioServer({
 			...deps,
 			env,

package/dist/index.d.mts

@@ -11519,6 +11519,8 @@ type SendPolicy = "chat" | "confirm" | "never";
  * way to change it, and that passes no gate at all.
  */
 type ChangePolicy = "chat" | "confirm";
+/** Whether this machine checks for a newer release once a day, and stops until it is updated or put off. */
+type UpdateCheckSetting = "on" | "off";
 type StoreKind = "keychain" | "file";
 interface ClientConfig {
   provider: string;
@@ -11573,6 +11575,15 @@ interface Defaults {
      */
     elicitationClients: string[];
   };
+  /**
+   * The daily update check (design 2026-09-28): once a day this machine asks npm whether a newer release is out, and
+   * every server and command stops until it is updated or put off until tomorrow. Absent reads as `on`.
+   *
+   * Absent rather than filled in, as `changePolicy` is: a default the schema supplied would be written into the file
+   * by the next unrelated change, where it would look like a choice somebody made. Turning it off is a loosening —
+   * it is what keeps a machine from quietly falling behind a release — so it is approved like one; on applies at once.
+   */
+  updateCheck?: UpdateCheckSetting | undefined;
 }
 /**
  * A connected account on a platform that is not mail: a Slack workspace, and every channel after it (design
@@ -11786,6 +11797,11 @@ interface LooseningConsent {
    */
   changes?: readonly Loosening[] | undefined;
 }
+/**
+ * Why a saved name has {@link DOWNLOAD_SUFFIX} after it: a name tools read or run on their own (`auto-read`), an
+ * extension that is not one of the inert ones (`type`), or no extension at all (`no-extension`).
+ */
+type RenameReason = "auto-read" | "type" | "no-extension";
 //#endregion
 //#region src/approvals.d.ts
 /**
@@ -11801,17 +11817,26 @@ interface LooseningConsent {
  *
  * A change approval (`kind: 'change'`) lives in the same store and goes through the same states, except that its
  * claim goes straight to `used`: what it permits is a write to the configuration, which the claimant makes itself.
+ *
+ * So does a download's question (`kind: 'download'`): where to save the files a Gmail or Slack download names. It is
+ * held to the change policy of the mailbox or workspace it is about, as every other change there is. Under `chat` the
+ * person's answer, relayed from the chat, claims it straight from `pending`. Under `confirm` it has to be answered
+ * where an agent cannot answer for them — at their own terminal, or in a form a trusted client shows them — which
+ * records the answer and moves it to `approved`; only then is it claimed, straight to `used`, and the recorded answer
+ * is the one that saves. It gets the store's expiry, its single use and its binding for the reason a change does: an
+ * answer given for three invoices must not save the next conversation's files, nor be spent twice.
  */
 type ApprovalState = "pending" | "approved" | "sending" | "used" | "failed" | "unknown" | "expired" | "revoked";
 type ApprovalChannel = "elicitation" | "terminal";
 /**
- * What an approval permits: a send (a mail, a post, a reaction) or a change to the configuration.
+ * What an approval permits: a send (a mail, a post, a reaction), a change to the configuration, or a download saved
+ * where the person said.
  *
- * One store for both, so a change gets the machinery a send already has — expiry, single use, the typed code — and
- * a kind on every record, so that neither can be spent as the other. Without it, a person who approved a post at a
+ * One store for all three, so a change gets the machinery a send already has — expiry, single use, the typed code —
+ * and a kind on every record, so that none can be spent as another. Without it, a person who approved a post at a
  * terminal would also have approved whatever change an agent claimed under the same id.
  */
-type ApprovalKind = "send" | "change";
+type ApprovalKind = "send" | "change" | "download";
 /** The inbox or account a change is about. `id` is absent when the change connects it, and it does not exist yet. */
 interface ChangeTarget {
   kind: "inbox" | "account";
@@ -11839,6 +11864,70 @@ interface ChangeBinding {
   /** What it does outside the configuration, in words: a sign-in, a registration, files removed. */
   effects: string[];
 }
+/**
+ * Exactly which download a question was asked for, stored on the record so the answer can be held to it.
+ *
+ * The files are the ones the question listed, by the platform's own ids — `<message id>/<part id>` for Gmail, the file
+ * id for Slack — in the order they were listed: a claim for any other set is a claim for a download the person was
+ * not asked about. So are the names they would be saved under, in the same order: a Slack file renamed between the
+ * question and the answer would otherwise be saved under a name the person was never shown. The folders are the two
+ * the question showed, as absolute paths. They are not part of the digest, because they are what the answer *means*
+ * rather than what it is for: `downloads` in the answer is the path the person read, even when an agent runs the
+ * download again from another folder.
+ */
+interface DownloadBinding {
+  /** One line about the download, for a listing: "where to save 2 files from acme/gmail". Not part of the digest. */
+  summary: string;
+  /** The mailbox or workspace the files come from, by the id it has now. */
+  target: {
+    kind: "inbox" | "account";
+    name: string;
+    id: string;
+  };
+  /** Which download asked: `attachments.download`, `files.download`. */
+  operation: string;
+  /** The request as the caller made it, in the words of its own arguments: the selection, and how many at most. */
+  request: Record<string, unknown>;
+  /** The files the question listed, by the platform's ids, in order. */
+  files: string[];
+  /** The names those files would be saved under, as the question listed them, in the same order. */
+  names: string[];
+  /** The two folders the question offered, as absolute paths. */
+  folders: {
+    downloads: string;
+    current: string;
+  };
+  /**
+   * The files as the question listed them to the person — the names they would be saved under, their sizes, why a
+   * name has `.download` after it, and their risk flags — so a terminal or a form can show the question, and its
+   * warnings, again. Not part of the digest: the ids and names above are.
+   */
+  listing?: ListedFile[] | undefined;
+  /** The person's answer, when they gave it where an agent cannot: at a terminal, or in a trusted client's form. */
+  answer?: RecordedSaveAnswer | undefined;
+}
+/** One file as a question lists it. */
+interface ListedFile {
+  /** The name it would be saved under: the sender's made safe, with `.download` after it unless it is inert. */
+  name: string;
+  size: number | null;
+  /** Why `.download` is after its name; absent when the name is the sender's, made safe. */
+  renamed?: RenameReason | undefined;
+  /** Its risk flags, as the file's own listing gives them. */
+  flags?: string[] | undefined;
+}
+/**
+ * An answer recorded on a question: one of the two folders it offered, or the folder the person named, as an absolute
+ * path — resolved where they typed it, so it means the folder they read.
+ */
+type RecordedSaveAnswer = {
+  readonly choice: "downloads" | "current";
+} | {
+  readonly choice: "other";
+  readonly folder: string;
+};
+/** What a claim of a download's question is held to: all of the binding but its summary and the folders it offered. */
+type DownloadRequest = Pick<DownloadBinding, "target" | "operation" | "request" | "files" | "names">;
 interface Expectation {
   to: string[];
   cc: string[];
@@ -11877,6 +11966,8 @@ interface ApprovalRecord {
   reason?: string | undefined;
   /** For a change: exactly what it permits. `digest` is `changeDigest` of this. */
   change?: ChangeBinding | undefined;
+  /** For a download's question: what it asked about, and the folders it offered. `digest` is `downloadDigest`. */
+  download?: DownloadBinding | undefined;
 }
 interface CreateApprovalInput {
   inboxId: string;
@@ -11922,6 +12013,7 @@ declare class ApprovalStore {
   constructor(stateDir: string, options?: {
     now?: () => Date;
     ttlMs?: number;
+    downloadTtlMs?: number;
   });
   create(input: CreateApprovalInput): Promise<ApprovalRecord>;
   get(approvalId: string): Promise<ApprovalRecord | null>;
@@ -11968,6 +12060,52 @@ declare class ApprovalStore {
    * person to have typed the code at a terminal first; until then the refusal leaves the record as it is.
    */
   claimForChange(approvalId: string, live: LiveChange, options?: ClaimOptions): Promise<ApprovalRecord>;
+  /**
+   * A download's question, pending, bound to `downloadDigest(input.download)` — computed here, never taken from the
+   * caller, as a change's digest is. It stands in for the draft revision too.
+   *
+   * `policy` is the change policy of the mailbox or workspace the files come from, as it stands when the question is
+   * asked: where a stranger's files land on this machine is a change to it, and is answered the way that account's
+   * other changes are approved. A claim holds the question to the stricter of this and the policy then.
+   */
+  createDownload(input: {
+    download: DownloadBinding;
+    policy: ChangePolicy;
+  }): Promise<ApprovalRecord & {
+    download: DownloadBinding;
+  }>;
+  /**
+   * Records the person's answer to a download's question, given where an agent cannot give it: at their own terminal,
+   * or in a form a trusted client showed them. The question moves to `approved`, carrying the answer, and waits for
+   * the download to claim it — which it may then do under `confirm`, and which saves where this answer says.
+   *
+   * Only a pending question can be answered, and only once: a second answer is refused, not taken over the first.
+   */
+  answerDownload(approvalId: string, via: ApprovalChannel, answer: RecordedSaveAnswer): Promise<ApprovalRecord & {
+    download: DownloadBinding;
+  }>;
+  /**
+   * Claims a download's question, once, for the download the caller is about to make — and returns it, with the
+   * folders it offered, so that `downloads` and `current` in the answer mean the paths the person read, and with the
+   * answer the person recorded, when they recorded one.
+   *
+   * `live` is the download as the caller computes it now: the same account, the same request, the same files under
+   * the same names — the person answered for those files and no others. Any other is refused, and the question left
+   * open, as it was: a second call that got an argument wrong is the agent's slip, not the person's, and voiding the
+   * question for it would make the person answer again for nothing. It still expires, and is claimed once.
+   *
+   * `options.policy` is the change policy of that account now, and the stricter of it and the one the question was
+   * asked under decides. Under `chat`, a pending question is claimed with the answer the caller carries: the person
+   * gave it in the conversation. Under `confirm`, only a question the person answered at a terminal or in a trusted
+   * form can be claimed; a pending one is refused, and left as it is, so they can still answer it. One used, voided or
+   * expired is refused as an approval in that state is.
+   */
+  claimForDownload(approvalId: string, live: DownloadRequest, options?: {
+    policy?: ChangePolicy | undefined;
+    pendingHint?: string | undefined;
+  }): Promise<ApprovalRecord & {
+    download: DownloadBinding;
+  }>;
   /** Records the outcome of the one send attempt. */
   complete(approvalId: string, outcome: {
     sentMessageId: string;
@@ -12067,7 +12205,10 @@ interface ResolvedPaths {
   secretsDir: string;
   /** Managed runtime installs for MCP clients. */
   dataDir: string;
-  /** Default root for attachment downloads and exports. */
+  /**
+   * Default root for exports and for the files Resend's received mail carries. A Gmail attachment or a Slack file is
+   * not saved here: those downloads ask the person where to save (`save-destination.ts`).
+   */
   downloadsDir: string;
 }
 //#endregion

package/dist/index.mjs

@@ -1,5 +1,5 @@
-import { at as ROUTES, it as RESEND_DOWNLOAD_ORIGIN, nt as REFUSED, ot as VERSION, rt as RESEND_API_ORIGIN } from "./send-BpwXJL8C.mjs";
-import { t as createResendMcpServer } from "./server-C3PKeQSN.mjs";
+import { _t as VERSION, gt as ROUTES, ht as RESEND_DOWNLOAD_ORIGIN, mt as RESEND_API_ORIGIN, pt as REFUSED } from "./send-Ba1caJ6x.mjs";
+import { t as createResendMcpServer } from "./server-BHHLf1lV.mjs";
 //#region src/index.ts
 /**
 * The library entry of `@agentcomms/resend`.