@dench.com/cli 2.1.3 → 2.1.5

package/dench.ts

@@ -2351,6 +2351,7 @@ async function getRuntime() {
       return {
         mode: "session" as const,
         host: resolveApiHost(host),
+        convexUrl: stored.session.convexUrl,
         client: createCliConvexClient(stored.session.convexUrl),
         sessionToken: stored.session.sessionToken,
         organization: stored.session.organization,
@@ -2397,6 +2398,7 @@ async function getRuntime() {
       return {
         mode: "apiKey" as const,
         host: apiHost,
+        convexUrl: sandboxConvexUrl,
         client: createCliConvexClient(sandboxConvexUrl),
         sessionToken: apiKey,
         organization: sandboxOrganization,
@@ -2412,6 +2414,7 @@ async function getRuntime() {
       return {
         mode: "session" as const,
         host: apiHost,
+        convexUrl: sandboxConvexUrl,
         client: createCliConvexClient(sandboxConvexUrl),
         sessionToken: sandboxAgentToken,
         organization: sandboxOrganization,
@@ -2981,13 +2984,44 @@ function suggestedWorkFromArtifacts(artifacts: JsonRecord[]) {
   );
 }
 
+/**
+ * The fs daemon authenticates purely from `CONVEX_URL` + `DENCH_API_KEY`
+ * env vars (sandboxes bake them in). Local shells running off an OAuth
+ * agent session have neither — resolve the active session and inject
+ * its convexUrl + `dch_agent_*` token. The server-side files functions
+ * accept the agent-session token in the same `apiKey` slot (prefix
+ * dispatch, like `requireCrmAccess`), so the daemon works unchanged.
+ */
+async function resolveFsDaemonEnv(): Promise<NodeJS.ProcessEnv> {
+  if (process.env.CONVEX_URL?.trim() && process.env.DENCH_API_KEY?.trim()) {
+    return process.env;
+  }
+  try {
+    const runtime = await getRuntime();
+    if (runtime.mode === "session" || runtime.mode === "apiKey") {
+      return {
+        ...process.env,
+        CONVEX_URL: process.env.CONVEX_URL?.trim() || runtime.convexUrl,
+        DENCH_API_KEY:
+          process.env.DENCH_API_KEY?.trim() || runtime.sessionToken,
+      };
+    }
+  } catch {
+    // No saved session / dev env — fall through with the unmodified env;
+    // the daemon prints its own missing-credential error for subcommands
+    // that need Convex access.
+  }
+  return process.env;
+}
+
 async function runFsCommand() {
   const subArgs = args.slice(args.indexOf("fs") + 1);
   const configuredBinary = process.env.DENCH_FS_DAEMON_BIN?.trim();
   const binary = configuredBinary || "dench-fs-daemon";
+  const daemonEnv = await resolveFsDaemonEnv();
   let exitCode: number;
   try {
-    exitCode = await spawnInherited(binary, subArgs);
+    exitCode = await spawnInherited(binary, subArgs, daemonEnv);
   } catch (error) {
     if (configuredBinary || !isCommandNotFound(error)) {
       throw error;
@@ -2995,7 +3029,11 @@ async function runFsCommand() {
     const localDaemon = fileURLToPath(
       new URL("./fs-daemon.ts", import.meta.url),
     );
-    exitCode = await spawnInherited("bun", [localDaemon, ...subArgs]);
+    exitCode = await spawnInherited(
+      "bun",
+      [localDaemon, ...subArgs],
+      daemonEnv,
+    );
   }
   if (exitCode !== 0) {
     process.exitCode = exitCode;
@@ -3025,8 +3063,18 @@ async function requireFilesApiKey(
   runtime: Runtime,
   command: string,
 ): Promise<string> {
-  const auth = await resolveGatewayCommandAuth(runtime, command);
-  return auth.bearerToken;
+  // The Convex files functions accept either a unified Dench API key OR a
+  // `dch_agent_*` OAuth agent-session token in their `apiKey` arg (the
+  // server dispatches on prefix, same as `requireCrmAccess`). So the
+  // runtime's own bearer works directly — no gateway-key exchange, which
+  // used to gate OAuth sessions behind a paid workspace and an extra
+  // host round-trip.
+  if (runtime.mode === "session" || runtime.mode === "apiKey") {
+    return runtime.sessionToken;
+  }
+  const envApiKey = process.env.DENCH_API_KEY?.trim();
+  if (envApiKey) return envApiKey;
+  throw loginRequiredError(command);
 }
 
 type FileTreeRow = {
@@ -3603,11 +3651,15 @@ function sha256HexSync(bytes: Uint8Array): string {
   return createHash("sha256").update(bytes).digest("hex");
 }
 
-async function spawnInherited(binary: string, commandArgs: string[]) {
+async function spawnInherited(
+  binary: string,
+  commandArgs: string[],
+  env: NodeJS.ProcessEnv = process.env,
+) {
   return await new Promise<number>((resolve, reject) => {
     const child = spawn(binary, commandArgs, {
       stdio: "inherit",
-      env: process.env,
+      env,
     });
     child.on("error", reject);
     child.on("close", (code) => resolve(code ?? 1));

package/email.ts

@@ -0,0 +1,424 @@
+import { readFile } from "node:fs/promises";
+import type { ConvexHttpClient } from "convex/browser";
+import { makeFunctionReference } from "convex/server";
+import { getFlag, parseJson } from "./lib/cli-args";
+
+type EmailCliContext = {
+  convex: ConvexHttpClient;
+  args: string[];
+  jsonOutput: boolean;
+  sessionToken?: string;
+  bearerToken?: string;
+  gatewayBaseUrl?: string;
+  gatewayHeaders?: Record<string, string>;
+};
+
+class EmailCliError extends Error {}
+
+type JsonRecord = Record<string, unknown>;
+
+function normalizeGatewayBaseUrl(value: string): string {
+  return value.replace(/\/+$/, "").replace(/\/v1$/, "");
+}
+
+function resolveGatewayBaseUrl(ctx: EmailCliContext): string {
+  const explicit =
+    process.env.DENCH_GATEWAY_URL?.trim() || process.env.GATEWAY_URL?.trim();
+  if (explicit) return normalizeGatewayBaseUrl(explicit);
+  if (ctx.gatewayBaseUrl?.trim()) {
+    return normalizeGatewayBaseUrl(ctx.gatewayBaseUrl.trim());
+  }
+  const host = process.env.DENCH_HOST?.trim();
+  if (host && /localhost|127\.0\.0\.1/.test(host)) {
+    return "http://localhost:8787";
+  }
+  return "https://gateway.merseoriginals.com";
+}
+
+function requireBearerToken(ctx: EmailCliContext): string {
+  const token = ctx.bearerToken?.trim() || process.env.DENCH_API_KEY?.trim();
+  if (!token) {
+    throw new EmailCliError(
+      "No Dench credential found. Set DENCH_API_KEY or run `dench signin`.",
+    );
+  }
+  return token;
+}
+
+async function callGateway(
+  ctx: EmailCliContext,
+  method: "GET" | "POST",
+  path: string,
+  body?: JsonRecord,
+) {
+  const baseUrl = resolveGatewayBaseUrl(ctx);
+  const response = await fetch(`${baseUrl}${path}`, {
+    method,
+    headers: {
+      accept: "application/json",
+      authorization: `Bearer ${requireBearerToken(ctx)}`,
+      ...(ctx.gatewayHeaders ?? {}),
+      ...(method === "POST" ? { "content-type": "application/json" } : {}),
+    },
+    ...(method === "POST" ? { body: JSON.stringify(body ?? {}) } : {}),
+  });
+  const text = await response.text();
+  if (!response.ok) {
+    throw new EmailCliError(
+      `Email service returned ${response.status}: ${text.slice(0, 500)}`,
+    );
+  }
+  const payload = text ? JSON.parse(text) : {};
+  return payload;
+}
+
+async function callMutation(
+  ctx: EmailCliContext,
+  name: string,
+  args: JsonRecord,
+) {
+  const ref = makeFunctionReference<"mutation">(name);
+  return await ctx.convex.mutation(ref, {
+    ...args,
+    sessionToken: ctx.sessionToken,
+  } as never);
+}
+
+async function callQuery(ctx: EmailCliContext, name: string, args: JsonRecord) {
+  const ref = makeFunctionReference<"query">(name);
+  return await ctx.convex.query(ref, {
+    ...args,
+    sessionToken: ctx.sessionToken,
+  } as never);
+}
+
+async function callAction(
+  ctx: EmailCliContext,
+  name: string,
+  args: JsonRecord,
+) {
+  const ref = makeFunctionReference<"action">(name);
+  return await ctx.convex.action(ref, {
+    ...args,
+    sessionToken: ctx.sessionToken,
+  } as never);
+}
+
+function out(ctx: EmailCliContext, payload: unknown, text: string) {
+  if (ctx.jsonOutput) {
+    console.log(JSON.stringify(payload, null, 2));
+    return;
+  }
+  console.log(text);
+}
+
+function requiredFlag(args: string[], name: string): string {
+  const value = getFlag(args, name)?.trim();
+  if (!value) throw new EmailCliError(`Missing required ${name}`);
+  return value;
+}
+
+function optionalJsonFlag(args: string[], name: string): unknown | undefined {
+  const raw = getFlag(args, name);
+  return raw === undefined ? undefined : parseJson(raw);
+}
+
+async function readTextFlag(
+  args: string[],
+  inlineFlag: string,
+  fileFlag: string,
+) {
+  const inline = getFlag(args, inlineFlag);
+  if (inline !== undefined) return inline;
+  const path = getFlag(args, fileFlag);
+  if (!path) return undefined;
+  return await readFile(path, "utf8");
+}
+
+async function readRecipients(path: string): Promise<JsonRecord[]> {
+  const content = await readFile(path, "utf8");
+  const trimmed = content.trim();
+  if (!trimmed) return [];
+  if (trimmed.startsWith("[")) {
+    const parsed = JSON.parse(trimmed);
+    if (!Array.isArray(parsed))
+      throw new EmailCliError("Recipients file must be an array or JSONL");
+    return parsed.map((row) =>
+      row && typeof row === "object"
+        ? (row as JsonRecord)
+        : { email: String(row) },
+    );
+  }
+  return trimmed
+    .split(/\r?\n/)
+    .filter(Boolean)
+    .map((line) => {
+      const parsed = JSON.parse(line);
+      return parsed && typeof parsed === "object"
+        ? (parsed as JsonRecord)
+        : { email: String(parsed) };
+    });
+}
+
+function toRecipients(rows: JsonRecord[]) {
+  return rows.map((row) => {
+    const email =
+      row.email ?? row.Email ?? row["Email Address"] ?? row.emailAddress;
+    if (typeof email !== "string") {
+      throw new EmailCliError("Each recipient row must include an email field");
+    }
+    return {
+      email,
+      displayName:
+        typeof row.name === "string"
+          ? row.name
+          : typeof row.displayName === "string"
+            ? row.displayName
+            : undefined,
+      personalization: row.personalization ?? row,
+      personEntryId:
+        typeof row.personEntryId === "string" ? row.personEntryId : undefined,
+      companyEntryId:
+        typeof row.companyEntryId === "string" ? row.companyEntryId : undefined,
+    };
+  });
+}
+
+export function emailHelp() {
+  console.log(`dench email — Dench Emailing Service campaign commands
+
+Usage:
+  dench email identity verify --from founder@example.com [--json]
+  dench email identity verify --domain example.com --from founder@example.com [--json]
+  dench email identity status --identity founder@example.com [--json]
+  dench email identity status --identity-id <identityId> [--json]
+  dench email template create --name "Intro" --subject "Hi {{firstName}}" --html-file body.html [--text-file body.txt] [--json]
+  dench email template preview --template <id> --data '{"firstName":"Ada"}' [--json]
+  dench email campaign create --name "Q2 outreach" --identity <id> --template <id> [--json]
+  dench email campaign recipients add --campaign <id> --file recipients.jsonl [--json]
+  dench email campaign preview --campaign <id> [--sample 5] [--json]
+  dench email campaign submit --campaign <id> [--json]
+  dench email campaign status --campaign <id> [--json]
+  dench email campaign pause|resume|cancel --campaign <id> [--json]`);
+}
+
+export async function runEmailCommand(ctx: EmailCliContext): Promise<void> {
+  const group = ctx.args.shift();
+  if (!group || group === "help" || group === "--help" || group === "-h") {
+    emailHelp();
+    return;
+  }
+  if (group === "identity") {
+    await runIdentity(ctx);
+    return;
+  }
+  if (group === "template") {
+    await runTemplate(ctx);
+    return;
+  }
+  if (group === "campaign") {
+    await runCampaign(ctx);
+    return;
+  }
+  throw new EmailCliError(`Unknown dench email subcommand: ${group}`);
+}
+
+async function runIdentity(ctx: EmailCliContext) {
+  const sub = ctx.args.shift();
+  if (sub === "verify") {
+    const domain = getFlag(ctx.args, "--domain");
+    const from = requiredFlag(ctx.args, "--from");
+    const type = domain ? "domain" : "email";
+    const identity = domain ?? from;
+    const configurationSetName = getFlag(ctx.args, "--configuration-set");
+    const created = await callMutation(
+      ctx,
+      "functions/emailCampaigns:createIdentity",
+      {
+        type,
+        domain,
+        fromEmail: from,
+        fromName: getFlag(ctx.args, "--from-name"),
+        replyToEmail: getFlag(ctx.args, "--reply-to"),
+        configurationSetName,
+      },
+    );
+    const verification = await callAction(
+      ctx,
+      "functions/emailCampaignsNode:beginSenderVerification",
+      { identityId: (created as JsonRecord).identityId },
+    );
+    out(
+      ctx,
+      { ok: true, created, verification },
+      `Verification started for ${identity}`,
+    );
+    return;
+  }
+  if (sub === "status") {
+    const identityId = getFlag(ctx.args, "--identity-id");
+    if (identityId) {
+      const payload = await callAction(
+        ctx,
+        "functions/emailCampaignsNode:refreshIdentityStatus",
+        { identityId },
+      );
+      out(ctx, payload, JSON.stringify(payload, null, 2));
+      return;
+    }
+    const identity = requiredFlag(ctx.args, "--identity");
+    const payload = await callGateway(
+      ctx,
+      "GET",
+      `/v1/email/identities/${encodeURIComponent(identity)}/status`,
+    );
+    const status = payload as JsonRecord;
+    const shaped = {
+      ok: status.ok === true,
+      identity: status.identity,
+      deliveryVerified: status.verifiedForSendingStatus === true,
+      deliveryVerificationStatus: status.verificationStatus,
+    };
+    out(ctx, shaped, JSON.stringify(shaped, null, 2));
+    return;
+  }
+  throw new EmailCliError("Usage: dench email identity verify|status");
+}
+
+async function runTemplate(ctx: EmailCliContext) {
+  const sub = ctx.args.shift();
+  if (sub === "create") {
+    const htmlBody = await readTextFlag(ctx.args, "--html", "--html-file");
+    if (!htmlBody) throw new EmailCliError("Missing --html or --html-file");
+    const textBody = await readTextFlag(ctx.args, "--text", "--text-file");
+    const payload = await callMutation(
+      ctx,
+      "functions/emailCampaigns:createTemplate",
+      {
+        name: requiredFlag(ctx.args, "--name"),
+        subject: requiredFlag(ctx.args, "--subject"),
+        htmlBody,
+        textBody,
+      },
+    );
+    out(
+      ctx,
+      payload,
+      `Template created: ${(payload as JsonRecord).templateId}`,
+    );
+    return;
+  }
+  if (sub === "preview") {
+    const templateId = requiredFlag(ctx.args, "--template");
+    const data = optionalJsonFlag(ctx.args, "--data");
+    const payload = await callQuery(
+      ctx,
+      "functions/emailCampaigns:previewTemplate",
+      { templateId, data },
+    );
+    out(ctx, payload, JSON.stringify(payload, null, 2));
+    return;
+  }
+  throw new EmailCliError("Usage: dench email template create|preview");
+}
+
+async function runCampaign(ctx: EmailCliContext) {
+  const sub = ctx.args.shift();
+  if (sub === "create") {
+    const payload = await callMutation(
+      ctx,
+      "functions/emailCampaigns:createCampaign",
+      {
+        name: requiredFlag(ctx.args, "--name"),
+        identityId: requiredFlag(ctx.args, "--identity"),
+        templateId: requiredFlag(ctx.args, "--template"),
+        scheduledAt: getFlag(ctx.args, "--scheduled-at")
+          ? Date.parse(requiredFlag(ctx.args, "--scheduled-at"))
+          : undefined,
+        maxRecipients: getFlag(ctx.args, "--max-recipients")
+          ? Number(requiredFlag(ctx.args, "--max-recipients"))
+          : undefined,
+      },
+    );
+    out(
+      ctx,
+      payload,
+      `Campaign created: ${(payload as JsonRecord).campaignId}`,
+    );
+    return;
+  }
+  if (sub === "recipients") {
+    const nested = ctx.args.shift();
+    if (nested !== "add") {
+      throw new EmailCliError(
+        "Usage: dench email campaign recipients add --campaign <id> --file recipients.jsonl",
+      );
+    }
+    const campaignId = requiredFlag(ctx.args, "--campaign");
+    const file = getFlag(ctx.args, "--file");
+    const rows = file
+      ? await readRecipients(file)
+      : ((optionalJsonFlag(ctx.args, "--data") as JsonRecord[] | undefined) ??
+        []);
+    if (rows.length === 0) throw new EmailCliError("No recipients provided");
+    const payload = await callMutation(
+      ctx,
+      "functions/emailCampaigns:addRecipients",
+      { campaignId, recipients: toRecipients(rows) },
+    );
+    out(ctx, payload, JSON.stringify(payload, null, 2));
+    return;
+  }
+  if (sub === "preview") {
+    const sampleRaw = getFlag(ctx.args, "--sample");
+    const payload = await callQuery(
+      ctx,
+      "functions/emailCampaigns:previewCampaign",
+      {
+        campaignId: requiredFlag(ctx.args, "--campaign"),
+        sample: sampleRaw ? Number(sampleRaw) : undefined,
+      },
+    );
+    out(ctx, payload, JSON.stringify(payload, null, 2));
+    return;
+  }
+  if (sub === "submit") {
+    const payload = await callMutation(
+      ctx,
+      "functions/emailCampaigns:submitCampaign",
+      {
+        campaignId: requiredFlag(ctx.args, "--campaign"),
+        approvalId: getFlag(ctx.args, "--approval"),
+      },
+    );
+    out(ctx, payload, JSON.stringify(payload, null, 2));
+    return;
+  }
+  if (sub === "status") {
+    const payload = await callQuery(
+      ctx,
+      "functions/emailCampaigns:getCampaign",
+      {
+        campaignId: requiredFlag(ctx.args, "--campaign"),
+      },
+    );
+    out(ctx, payload, JSON.stringify(payload, null, 2));
+    return;
+  }
+  if (sub === "pause" || sub === "resume" || sub === "cancel") {
+    const fn =
+      sub === "pause"
+        ? "pauseCampaign"
+        : sub === "resume"
+          ? "resumeCampaign"
+          : "cancelCampaign";
+    const payload = await callMutation(ctx, `functions/emailCampaigns:${fn}`, {
+      campaignId: requiredFlag(ctx.args, "--campaign"),
+    });
+    out(ctx, payload, JSON.stringify(payload, null, 2));
+    return;
+  }
+  throw new EmailCliError(
+    "Usage: dench email campaign create|recipients|preview|submit|status|pause|resume|cancel",
+  );
+}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@dench.com/cli",
-  "version": "2.1.3",
+  "version": "2.1.5",
   "description": "Dench agent workspace CLI. v2 unifies auth behind `dench signin`; the legacy `dench login` / `dench onboard` / `dench setup` / `dench what-can-i-do` / `dench register` commands now error with a redirect.",
   "type": "module",
   "bin": {
@@ -24,6 +24,7 @@
     "chat.ts",
     "chat-spawn.ts",
     "crm.ts",
+    "email.ts",
     "members.ts",
     "cron.ts",
     "browser.ts",