@drawbridge/drawbridge-utils 0.0.155 → 0.0.156

package/dist/connections/index.d.cts

@@ -1520,10 +1520,15 @@ const contacts = {
 			remove : async ( { email, id, token }, { fetcher } = {} ) => {
 
 				// NO TOKEN IS A NO-OP HERE, unlike sendgrid and twilio, and the
-				// difference is what the credential is declared to be: hubspotToken
-				// is the one provider field that is not `required`, because this is
-				// internal CRM tooling no merchant sees. A deployment with no portal
-				// is a supported state, not a missing credential.
+				// difference is what the credential is FOR: this is internal CRM
+				// tooling no merchant sees, so a deployment with no portal is a
+				// supported state rather than a missing credential.
+				//
+				// The manifest does mark hubspotToken `required`, and that is not a
+				// contradiction — the flag feeds `isLive` and nothing else, so it
+				// decides whether the admin card reads live. Not live is the honest
+				// badge when nothing will sync. It gates no behaviour, and
+				// saveProviderSettings never consults it, so the row still writes.
 				if( ! token ) return;
 
 				const contact = id || await lookup({ email, fetcher, token });

package/dist/connections/index.d.ts

@@ -1520,10 +1520,15 @@ const contacts = {
 			remove : async ( { email, id, token }, { fetcher } = {} ) => {
 
 				// NO TOKEN IS A NO-OP HERE, unlike sendgrid and twilio, and the
-				// difference is what the credential is declared to be: hubspotToken
-				// is the one provider field that is not `required`, because this is
-				// internal CRM tooling no merchant sees. A deployment with no portal
-				// is a supported state, not a missing credential.
+				// difference is what the credential is FOR: this is internal CRM
+				// tooling no merchant sees, so a deployment with no portal is a
+				// supported state rather than a missing credential.
+				//
+				// The manifest does mark hubspotToken `required`, and that is not a
+				// contradiction — the flag feeds `isLive` and nothing else, so it
+				// decides whether the admin card reads live. Not live is the honest
+				// badge when nothing will sync. It gates no behaviour, and
+				// saveProviderSettings never consults it, so the row still writes.
 				if( ! token ) return;
 
 				const contact = id || await lookup({ email, fetcher, token });

package/dist/email.cjs

@@ -19,6 +19,7 @@ var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: tru
 // lib/email.js
 var email_exports = {};
 __export(email_exports, {
+  subAddress: () => subAddress,
   toCanonicalEmail: () => toCanonicalEmail
 });
 module.exports = __toCommonJS(email_exports);
@@ -36,7 +37,20 @@ var toCanonicalEmail = (value) => {
   if (!local) return null;
   return local + "@" + domain;
 };
+var LOCAL_PART_LIMIT = 64;
+var subAddress = (email, tag) => {
+  if (!email || typeof email !== "string") return email;
+  if (!tag || typeof tag !== "string") return email;
+  if (!/^[A-Za-z0-9]+$/.test(tag)) return email;
+  const at = email.lastIndexOf("@");
+  if (at < 1 || at === email.length - 1) return email;
+  const local = email.slice(0, at);
+  if (local.includes("+")) return email;
+  if (local.length + 1 + tag.length > LOCAL_PART_LIMIT) return email;
+  return local + "+" + tag + "@" + email.slice(at + 1);
+};
 // Annotate the CommonJS export names for ESM import in node:
 0 && (module.exports = {
+  subAddress,
   toCanonicalEmail
 });

package/dist/email.d.cts

@@ -33,4 +33,56 @@ const toCanonicalEmail = ( value ) => {
 
 };
 
-export { toCanonicalEmail };
+// RFC 5322 caps the local part at 64 octets. Everything here is ASCII, so
+// length is octets.
+const LOCAL_PART_LIMIT = 64;
+
+// The inverse of toCanonicalEmail: put a tag INTO the local part rather than
+// strip one out. `subAddress( 'org@send.drwbrdg.com', '507f…' )` gives
+// `org+507f…@send.drwbrdg.com` — RFC 5233 sub-addressing, which Google delivers
+// to the untagged mailbox natively.
+//
+// This is how the platform's lead-facing sender carries the ORGANIZATION.
+// Shopify does the same thing with `store+<shopId>@shopifyemail.com`: one
+// mailbox, one MX record, one authenticated domain, and the tenant rides in the
+// address instead of in infrastructure. There is no per-organization address to
+// store, so there is nothing to migrate or backfill.
+//
+// It is derived at send time, never persisted. Worth settling BEFORE the first
+// send rather than after: the From line is frozen into every message already
+// delivered, so a shared address cannot be split apart retroactively.
+//
+// Returns the address UNCHANGED whenever it cannot be tagged safely — a flat
+// from-address is a working email, a malformed one is a send the provider
+// rejects outright. Callers rely on that: the sender resolvers fall through to
+// their own defaults on a falsy return, and never on a broken string.
+const subAddress = ( email, tag ) => {
+
+	if( ! email || typeof email !== 'string' ) return email;
+	if( ! tag || typeof tag !== 'string' ) return email;
+
+	// Organization ids are 24-char ObjectId hex, and the short-id generator is
+	// base36 — both alphanumeric, both safely atext. Checked rather than assumed
+	// because the api schema types `id` as a bare string with no pattern, and
+	// `formats.documents.insert` spreads caller data OVER the generated id, so a
+	// hand-written id would win.
+	if( ! /^[A-Za-z0-9]+$/.test( tag ) ) return email;
+
+	const at = email.lastIndexOf( '@' );
+
+	if( at < 1 || at === email.length - 1 ) return email;
+
+	const local = email.slice( 0, at );
+
+	// Already tagged. Re-tagging would nest (`org+a+b@`), and the first tag is
+	// the one a receiving mailbox would route on — so the second would be a
+	// silent lie about which tenant the mail belongs to.
+	if( local.includes( '+' ) ) return email;
+
+	if( local.length + 1 + tag.length > LOCAL_PART_LIMIT ) return email;
+
+	return local + '+' + tag + '@' + email.slice( at + 1 );
+
+};
+
+export { subAddress, toCanonicalEmail };

package/dist/email.d.ts

@@ -33,4 +33,56 @@ const toCanonicalEmail = ( value ) => {
 
 };
 
-export { toCanonicalEmail };
+// RFC 5322 caps the local part at 64 octets. Everything here is ASCII, so
+// length is octets.
+const LOCAL_PART_LIMIT = 64;
+
+// The inverse of toCanonicalEmail: put a tag INTO the local part rather than
+// strip one out. `subAddress( 'org@send.drwbrdg.com', '507f…' )` gives
+// `org+507f…@send.drwbrdg.com` — RFC 5233 sub-addressing, which Google delivers
+// to the untagged mailbox natively.
+//
+// This is how the platform's lead-facing sender carries the ORGANIZATION.
+// Shopify does the same thing with `store+<shopId>@shopifyemail.com`: one
+// mailbox, one MX record, one authenticated domain, and the tenant rides in the
+// address instead of in infrastructure. There is no per-organization address to
+// store, so there is nothing to migrate or backfill.
+//
+// It is derived at send time, never persisted. Worth settling BEFORE the first
+// send rather than after: the From line is frozen into every message already
+// delivered, so a shared address cannot be split apart retroactively.
+//
+// Returns the address UNCHANGED whenever it cannot be tagged safely — a flat
+// from-address is a working email, a malformed one is a send the provider
+// rejects outright. Callers rely on that: the sender resolvers fall through to
+// their own defaults on a falsy return, and never on a broken string.
+const subAddress = ( email, tag ) => {
+
+	if( ! email || typeof email !== 'string' ) return email;
+	if( ! tag || typeof tag !== 'string' ) return email;
+
+	// Organization ids are 24-char ObjectId hex, and the short-id generator is
+	// base36 — both alphanumeric, both safely atext. Checked rather than assumed
+	// because the api schema types `id` as a bare string with no pattern, and
+	// `formats.documents.insert` spreads caller data OVER the generated id, so a
+	// hand-written id would win.
+	if( ! /^[A-Za-z0-9]+$/.test( tag ) ) return email;
+
+	const at = email.lastIndexOf( '@' );
+
+	if( at < 1 || at === email.length - 1 ) return email;
+
+	const local = email.slice( 0, at );
+
+	// Already tagged. Re-tagging would nest (`org+a+b@`), and the first tag is
+	// the one a receiving mailbox would route on — so the second would be a
+	// silent lie about which tenant the mail belongs to.
+	if( local.includes( '+' ) ) return email;
+
+	if( local.length + 1 + tag.length > LOCAL_PART_LIMIT ) return email;
+
+	return local + '+' + tag + '@' + email.slice( at + 1 );
+
+};
+
+export { subAddress, toCanonicalEmail };

package/dist/email.js

@@ -13,6 +13,19 @@ var toCanonicalEmail = (value) => {
   if (!local) return null;
   return local + "@" + domain;
 };
+var LOCAL_PART_LIMIT = 64;
+var subAddress = (email, tag) => {
+  if (!email || typeof email !== "string") return email;
+  if (!tag || typeof tag !== "string") return email;
+  if (!/^[A-Za-z0-9]+$/.test(tag)) return email;
+  const at = email.lastIndexOf("@");
+  if (at < 1 || at === email.length - 1) return email;
+  const local = email.slice(0, at);
+  if (local.includes("+")) return email;
+  if (local.length + 1 + tag.length > LOCAL_PART_LIMIT) return email;
+  return local + "+" + tag + "@" + email.slice(at + 1);
+};
 export {
+  subAddress,
   toCanonicalEmail
 };

package/package.json

@@ -216,5 +216,5 @@
     "prepublishOnly": ". \"$HOME/.nvm/nvm.sh\" && nvm use && tsup && node --test"
   },
   "types": "dist/index.d.ts",
-  "version": "0.0.155"
+  "version": "0.0.156"
 }