@drawbridge/drawbridge-utils 0.0.163 → 0.0.165

package/dist/connections/index.cjs

@@ -5808,6 +5808,12 @@ var publicConnectionKeys = Object.freeze([
   // excerpt, guide, and any vendor redirect copy.
   "content",
   "createdAt",
+  // THE MERCHANT'S OWN SWITCH. `enabled : false` is a connection the merchant
+  // paused — kept, configured, and not run — as distinct from a vendor the
+  // platform switched off (which the api overlays as an error). Absent means
+  // on; the dashboard renders Paused from it and the sync gates refuse a paused
+  // connection the way they refuse a missing one.
+  "enabled",
   // The connection DOCUMENT's own errors array — scope-drift entries written by
   // drawbridge-sync. NOT the manifest's error copy, which is content.errors:
   // the document is spread OVER the resolved manifest downstream, so the two

package/dist/connections/index.d.cts

@@ -7500,6 +7500,12 @@ const publicConnectionKeys = Object.freeze([
 	// excerpt, guide, and any vendor redirect copy.
 	'content',
 	'createdAt',
+	// THE MERCHANT'S OWN SWITCH. `enabled : false` is a connection the merchant
+	// paused — kept, configured, and not run — as distinct from a vendor the
+	// platform switched off (which the api overlays as an error). Absent means
+	// on; the dashboard renders Paused from it and the sync gates refuse a paused
+	// connection the way they refuse a missing one.
+	'enabled',
 	// The connection DOCUMENT's own errors array — scope-drift entries written by
 	// drawbridge-sync. NOT the manifest's error copy, which is content.errors:
 	// the document is spread OVER the resolved manifest downstream, so the two

package/dist/connections/index.d.ts

@@ -7500,6 +7500,12 @@ const publicConnectionKeys = Object.freeze([
 	// excerpt, guide, and any vendor redirect copy.
 	'content',
 	'createdAt',
+	// THE MERCHANT'S OWN SWITCH. `enabled : false` is a connection the merchant
+	// paused — kept, configured, and not run — as distinct from a vendor the
+	// platform switched off (which the api overlays as an error). Absent means
+	// on; the dashboard renders Paused from it and the sync gates refuse a paused
+	// connection the way they refuse a missing one.
+	'enabled',
 	// The connection DOCUMENT's own errors array — scope-drift entries written by
 	// drawbridge-sync. NOT the manifest's error copy, which is content.errors:
 	// the document is spread OVER the resolved manifest downstream, so the two

package/dist/connections/index.js

@@ -5732,6 +5732,12 @@ var publicConnectionKeys = Object.freeze([
   // excerpt, guide, and any vendor redirect copy.
   "content",
   "createdAt",
+  // THE MERCHANT'S OWN SWITCH. `enabled : false` is a connection the merchant
+  // paused — kept, configured, and not run — as distinct from a vendor the
+  // platform switched off (which the api overlays as an error). Absent means
+  // on; the dashboard renders Paused from it and the sync gates refuse a paused
+  // connection the way they refuse a missing one.
+  "enabled",
   // The connection DOCUMENT's own errors array — scope-drift entries written by
   // drawbridge-sync. NOT the manifest's error copy, which is content.errors:
   // the document is spread OVER the resolved manifest downstream, so the two

package/dist/notification.cjs

@@ -19,6 +19,8 @@ var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: tru
 // lib/notification.js
 var notification_exports = {};
 __export(notification_exports, {
+  POINTS: () => POINTS,
+  notificationRules: () => notificationRules,
   notificationWarnings: () => notificationWarnings
 });
 module.exports = __toCommonJS(notification_exports);
@@ -49,41 +51,96 @@ var phrasesIn = (value) => {
   return PHRASES.filter((phrase) => lower.includes(phrase));
 };
 var list = (values) => values.map((value) => "\u201C" + value + "\u201D").join(", ");
-var subjectWarnings = ({ brand, subject }) => {
+var POINTS = {
+  currency: 1,
+  emoji: 0.5,
+  length: 0.5,
+  phrase: 1,
+  punctuation: 1,
+  shouting: 1.5
+};
+var subjectRules = ({ subject }) => {
   const value = String(subject || "").trim();
   if (!value) return [];
   const found = phrasesIn(value);
   const emojis = emojiCount(value);
   return [
-    value.length > SUBJECT_DISPLAY_LIMIT && "Most email apps cut the subject around " + SUBJECT_DISPLAY_LIMIT + " characters \u2014 yours is " + value.length + ".",
-    shouting(value) && "Mostly capitals reads as shouting, and filters treat it that way too.",
-    /[!?]{2,}/.test(value) && "Repeated exclamation or question marks are a common spam signal.",
-    emojis > 1 && "More than one emoji in a subject is a common spam signal.",
-    /[$£€]\s?\d/.test(value) && "A currency amount in the subject is a common spam signal.",
-    found.length > 0 && "Reads like a scam to filters and to people: " + list(found) + ".",
-    brand && !value.toLowerCase().includes(String(brand).toLowerCase()) && "Nothing here says the mail is from " + brand + " \u2014 subjects that name the sender get opened more."
-  ].filter(Boolean);
+    value.length > SUBJECT_DISPLAY_LIMIT && {
+      message: "Most email apps cut the subject around " + SUBJECT_DISPLAY_LIMIT + " characters \u2014 yours is " + value.length + ".",
+      points: POINTS.length,
+      rule: "length"
+    },
+    shouting(value) && {
+      message: "Mostly capitals reads as shouting, and filters treat it that way too.",
+      points: POINTS.shouting,
+      rule: "shouting"
+    },
+    /[!?]{2,}/.test(value) && {
+      message: "Repeated exclamation or question marks are a common spam signal.",
+      points: POINTS.punctuation,
+      rule: "punctuation"
+    },
+    emojis > 1 && {
+      message: "More than one emoji in a subject is a common spam signal.",
+      points: POINTS.emoji,
+      rule: "emoji"
+    },
+    /[$£€]\s?\d/.test(value) && {
+      message: "A currency amount in the subject is a common spam signal.",
+      points: POINTS.currency,
+      rule: "currency"
+    },
+    found.length > 0 && {
+      message: "Reads like a scam to filters and to people: " + list(found) + ".",
+      points: POINTS.phrase * found.length,
+      rule: "phrase"
+    }
+  ].filter(Boolean).map((rule) => ({ ...rule, field: "subject" }));
 };
-var messageWarnings = ({ message }) => {
+var messageRules = ({ message }) => {
   const value = String(message || "").trim();
   if (!value) return [];
   const found = phrasesIn(value);
   return [
-    value.length < MESSAGE_SHORT_LIMIT && "Very short messages read as a fragment, and bulk senders send exactly this shape.",
-    shouting(value) && "Mostly capitals reads as shouting, and filters treat it that way too.",
-    /[!?]{2,}/.test(value) && "Repeated exclamation or question marks are a common spam signal.",
-    found.length > 0 && "Reads like a scam to filters and to people: " + list(found) + "."
-  ].filter(Boolean);
+    value.length < MESSAGE_SHORT_LIMIT && {
+      message: "Very short messages read as a fragment, and bulk senders send exactly this shape.",
+      points: POINTS.length,
+      rule: "length"
+    },
+    shouting(value) && {
+      message: "Mostly capitals reads as shouting, and filters treat it that way too.",
+      points: POINTS.shouting,
+      rule: "shouting"
+    },
+    /[!?]{2,}/.test(value) && {
+      message: "Repeated exclamation or question marks are a common spam signal.",
+      points: POINTS.punctuation,
+      rule: "punctuation"
+    },
+    found.length > 0 && {
+      message: "Reads like a scam to filters and to people: " + list(found) + ".",
+      points: POINTS.phrase * found.length,
+      rule: "phrase"
+    }
+  ].filter(Boolean).map((rule) => ({ ...rule, field: "message" }));
 };
-var notificationWarnings = ({
-  brand,
+var notificationRules = ({
   message,
   subject
-} = {}) => ({
-  message: messageWarnings({ message }),
-  subject: subjectWarnings({ brand, subject })
-});
+} = {}) => [
+  ...subjectRules({ subject }),
+  ...messageRules({ message })
+];
+var notificationWarnings = (input) => {
+  const rules = notificationRules(input);
+  return {
+    message: rules.filter((rule) => rule.field === "message").map((rule) => rule.message),
+    subject: rules.filter((rule) => rule.field === "subject").map((rule) => rule.message)
+  };
+};
 // Annotate the CommonJS export names for ESM import in node:
 0 && (module.exports = {
+  POINTS,
+  notificationRules,
   notificationWarnings
 });

package/dist/notification.d.cts

@@ -75,11 +75,41 @@ const phrasesIn = ( value ) => {
 
 const list = ( values ) => values.map( ( value ) => '“' + value + '”' ).join( ', ' );
 
-// `brand` is the organization's own name. A subject that never mentions who is
-// writing is the single most recognisable trait of the mail people delete
-// unread — and the one a merchant can fix in five seconds once it is pointed
-// out. Skipped entirely when no brand is supplied rather than guessed at.
-const subjectWarnings = ({ brand, subject }) => {
+// WHAT EACH RULE IS WORTH, on SpamAssassin's scale — its own rules run 0.1 to
+// about 2.0 and five is the line most installs call spam at.
+//
+// THESE CARRY THE NUMBER. Measured 2026-09-10 through Postmark's SpamCheck:
+// stock SpamAssassin scored "Congratulations!!!" at ZERO — its rules are tuned
+// for 2005-era pharma and lottery mail and header forgery, and a two-line
+// giveaway email trips none of them. So for the copy this product sends, the
+// filter's opinion is close to noise and these rules are the actual signal.
+// A flat half-point each (the first version) left "Congratulations!!!" reading
+// as fine, which is the opposite of what a merchant needs to hear.
+//
+// Weighted by how reliably each one gets mail binned, and by how likely it is
+// to be an accident. Shouting and scam phrasing are never accidents. Repeated
+// punctuation and a currency amount are strong. Emoji and length are habits
+// worth a nudge.
+//
+// NO BRAND RULE. There was one — "nothing here says the mail is from Acme" —
+// and it was asking the merchant to do by hand what the send already does:
+// email goes out with the organization's title as the From name, and SMS puts
+// it on the first line of the body (twilio.sms). Advice to repeat what the
+// envelope carries is noise, and a static default could never satisfy it.
+//
+// PHRASES COUNT PER MATCH. "Congratulations, click here, limited time" is
+// three of them and reads like three of them; one sentence lists them all,
+// the points say how many. A product table, and Darren's to move.
+const POINTS = {
+	currency : 1,
+	emoji : 0.5,
+	length : 0.5,
+	phrase : 1,
+	punctuation : 1,
+	shouting : 1.5
+};
+
+const subjectRules = ({ subject }) => {
 
 	const value = String( subject || '' ).trim();
 
@@ -89,25 +119,41 @@ const subjectWarnings = ({ brand, subject }) => {
 	const emojis = emojiCount( value );
 
 	return [
-		value.length > SUBJECT_DISPLAY_LIMIT
-			&& 'Most email apps cut the subject around ' + SUBJECT_DISPLAY_LIMIT + ' characters — yours is ' + value.length + '.',
-		shouting( value )
-			&& 'Mostly capitals reads as shouting, and filters treat it that way too.',
-		/[!?]{2,}/.test( value )
-			&& 'Repeated exclamation or question marks are a common spam signal.',
-		emojis > 1
-			&& 'More than one emoji in a subject is a common spam signal.',
-		/[$£€]\s?\d/.test( value )
-			&& 'A currency amount in the subject is a common spam signal.',
-		found.length > 0
-			&& 'Reads like a scam to filters and to people: ' + list( found ) + '.',
-		brand && ! value.toLowerCase().includes( String( brand ).toLowerCase() )
-			&& 'Nothing here says the mail is from ' + brand + ' — subjects that name the sender get opened more.'
-	].filter( Boolean );
+		value.length > SUBJECT_DISPLAY_LIMIT && {
+			message : 'Most email apps cut the subject around ' + SUBJECT_DISPLAY_LIMIT + ' characters — yours is ' + value.length + '.',
+			points : POINTS.length,
+			rule : 'length'
+		},
+		shouting( value ) && {
+			message : 'Mostly capitals reads as shouting, and filters treat it that way too.',
+			points : POINTS.shouting,
+			rule : 'shouting'
+		},
+		/[!?]{2,}/.test( value ) && {
+			message : 'Repeated exclamation or question marks are a common spam signal.',
+			points : POINTS.punctuation,
+			rule : 'punctuation'
+		},
+		emojis > 1 && {
+			message : 'More than one emoji in a subject is a common spam signal.',
+			points : POINTS.emoji,
+			rule : 'emoji'
+		},
+		/[$£€]\s?\d/.test( value ) && {
+			message : 'A currency amount in the subject is a common spam signal.',
+			points : POINTS.currency,
+			rule : 'currency'
+		},
+		found.length > 0 && {
+			message : 'Reads like a scam to filters and to people: ' + list( found ) + '.',
+			points : POINTS.phrase * found.length,
+			rule : 'phrase'
+		}
+	].filter( Boolean ).map( ( rule ) => ({ ...rule, field : 'subject' }) );
 
 };
 
-const messageWarnings = ({ message }) => {
+const messageRules = ({ message }) => {
 
 	const value = String( message || '' ).trim();
 
@@ -116,20 +162,38 @@ const messageWarnings = ({ message }) => {
 	const found = phrasesIn( value );
 
 	return [
-		value.length < MESSAGE_SHORT_LIMIT
-			&& 'Very short messages read as a fragment, and bulk senders send exactly this shape.',
-		shouting( value )
-			&& 'Mostly capitals reads as shouting, and filters treat it that way too.',
-		/[!?]{2,}/.test( value )
-			&& 'Repeated exclamation or question marks are a common spam signal.',
-		found.length > 0
-			&& 'Reads like a scam to filters and to people: ' + list( found ) + '.'
-	].filter( Boolean );
+		value.length < MESSAGE_SHORT_LIMIT && {
+			message : 'Very short messages read as a fragment, and bulk senders send exactly this shape.',
+			points : POINTS.length,
+			rule : 'length'
+		},
+		shouting( value ) && {
+			message : 'Mostly capitals reads as shouting, and filters treat it that way too.',
+			points : POINTS.shouting,
+			rule : 'shouting'
+		},
+		/[!?]{2,}/.test( value ) && {
+			message : 'Repeated exclamation or question marks are a common spam signal.',
+			points : POINTS.punctuation,
+			rule : 'punctuation'
+		},
+		found.length > 0 && {
+			message : 'Reads like a scam to filters and to people: ' + list( found ) + '.',
+			points : POINTS.phrase * found.length,
+			rule : 'phrase'
+		}
+	].filter( Boolean ).map( ( rule ) => ({ ...rule, field : 'message' }) );
 
 };
 
-// ONE ENTRY POINT, answering per field so each warning renders against the
-// input it is about rather than as a pile at the bottom of the form.
+// THE RULES, WITH THEIR WEIGHT: `[ { field, message, points, rule } ]`, subject
+// first. This is what the api's scorer folds into the spam score beside
+// SpamAssassin's own rules, so the sentence a merchant reads and the points
+// it cost are one object.
+//
+// The same rule tripped in both fields comes back twice, once per field, each
+// with its points. Whether that is one habit or two is the scorer's call to
+// make; here the facts are just reported.
 //
 // NO CHANNEL ARGUMENT, deliberately, and it is worth saying why since one was
 // tried twice.
@@ -150,13 +214,25 @@ const messageWarnings = ({ message }) => {
 // wording, and the segment mechanics where one emoji drops the limit from 160
 // characters to 70. Those belong with the SMS connection work rather than here,
 // and their absence is a reason to write them, not to stay quiet meanwhile.
-const notificationWarnings = ({
-	brand,
+const notificationRules = ({
 	message,
 	subject
-} = {}) => ({
-	message : messageWarnings({ message }),
-	subject : subjectWarnings({ brand, subject })
-});
+} = {}) => [
+	...subjectRules({ subject }),
+	...messageRules({ message })
+];
+
+// The sentences alone, per field — what the rules looked like before they had
+// points. Kept for anything that only wants the words.
+const notificationWarnings = ( input ) => {
+
+	const rules = notificationRules( input );
+
+	return {
+		message : rules.filter( ( rule ) => rule.field === 'message' ).map( ( rule ) => rule.message ),
+		subject : rules.filter( ( rule ) => rule.field === 'subject' ).map( ( rule ) => rule.message )
+	};
+
+};
 
-export { notificationWarnings };
+export { POINTS, notificationRules, notificationWarnings };

package/dist/notification.d.ts

@@ -75,11 +75,41 @@ const phrasesIn = ( value ) => {
 
 const list = ( values ) => values.map( ( value ) => '“' + value + '”' ).join( ', ' );
 
-// `brand` is the organization's own name. A subject that never mentions who is
-// writing is the single most recognisable trait of the mail people delete
-// unread — and the one a merchant can fix in five seconds once it is pointed
-// out. Skipped entirely when no brand is supplied rather than guessed at.
-const subjectWarnings = ({ brand, subject }) => {
+// WHAT EACH RULE IS WORTH, on SpamAssassin's scale — its own rules run 0.1 to
+// about 2.0 and five is the line most installs call spam at.
+//
+// THESE CARRY THE NUMBER. Measured 2026-09-10 through Postmark's SpamCheck:
+// stock SpamAssassin scored "Congratulations!!!" at ZERO — its rules are tuned
+// for 2005-era pharma and lottery mail and header forgery, and a two-line
+// giveaway email trips none of them. So for the copy this product sends, the
+// filter's opinion is close to noise and these rules are the actual signal.
+// A flat half-point each (the first version) left "Congratulations!!!" reading
+// as fine, which is the opposite of what a merchant needs to hear.
+//
+// Weighted by how reliably each one gets mail binned, and by how likely it is
+// to be an accident. Shouting and scam phrasing are never accidents. Repeated
+// punctuation and a currency amount are strong. Emoji and length are habits
+// worth a nudge.
+//
+// NO BRAND RULE. There was one — "nothing here says the mail is from Acme" —
+// and it was asking the merchant to do by hand what the send already does:
+// email goes out with the organization's title as the From name, and SMS puts
+// it on the first line of the body (twilio.sms). Advice to repeat what the
+// envelope carries is noise, and a static default could never satisfy it.
+//
+// PHRASES COUNT PER MATCH. "Congratulations, click here, limited time" is
+// three of them and reads like three of them; one sentence lists them all,
+// the points say how many. A product table, and Darren's to move.
+const POINTS = {
+	currency : 1,
+	emoji : 0.5,
+	length : 0.5,
+	phrase : 1,
+	punctuation : 1,
+	shouting : 1.5
+};
+
+const subjectRules = ({ subject }) => {
 
 	const value = String( subject || '' ).trim();
 
@@ -89,25 +119,41 @@ const subjectWarnings = ({ brand, subject }) => {
 	const emojis = emojiCount( value );
 
 	return [
-		value.length > SUBJECT_DISPLAY_LIMIT
-			&& 'Most email apps cut the subject around ' + SUBJECT_DISPLAY_LIMIT + ' characters — yours is ' + value.length + '.',
-		shouting( value )
-			&& 'Mostly capitals reads as shouting, and filters treat it that way too.',
-		/[!?]{2,}/.test( value )
-			&& 'Repeated exclamation or question marks are a common spam signal.',
-		emojis > 1
-			&& 'More than one emoji in a subject is a common spam signal.',
-		/[$£€]\s?\d/.test( value )
-			&& 'A currency amount in the subject is a common spam signal.',
-		found.length > 0
-			&& 'Reads like a scam to filters and to people: ' + list( found ) + '.',
-		brand && ! value.toLowerCase().includes( String( brand ).toLowerCase() )
-			&& 'Nothing here says the mail is from ' + brand + ' — subjects that name the sender get opened more.'
-	].filter( Boolean );
+		value.length > SUBJECT_DISPLAY_LIMIT && {
+			message : 'Most email apps cut the subject around ' + SUBJECT_DISPLAY_LIMIT + ' characters — yours is ' + value.length + '.',
+			points : POINTS.length,
+			rule : 'length'
+		},
+		shouting( value ) && {
+			message : 'Mostly capitals reads as shouting, and filters treat it that way too.',
+			points : POINTS.shouting,
+			rule : 'shouting'
+		},
+		/[!?]{2,}/.test( value ) && {
+			message : 'Repeated exclamation or question marks are a common spam signal.',
+			points : POINTS.punctuation,
+			rule : 'punctuation'
+		},
+		emojis > 1 && {
+			message : 'More than one emoji in a subject is a common spam signal.',
+			points : POINTS.emoji,
+			rule : 'emoji'
+		},
+		/[$£€]\s?\d/.test( value ) && {
+			message : 'A currency amount in the subject is a common spam signal.',
+			points : POINTS.currency,
+			rule : 'currency'
+		},
+		found.length > 0 && {
+			message : 'Reads like a scam to filters and to people: ' + list( found ) + '.',
+			points : POINTS.phrase * found.length,
+			rule : 'phrase'
+		}
+	].filter( Boolean ).map( ( rule ) => ({ ...rule, field : 'subject' }) );
 
 };
 
-const messageWarnings = ({ message }) => {
+const messageRules = ({ message }) => {
 
 	const value = String( message || '' ).trim();
 
@@ -116,20 +162,38 @@ const messageWarnings = ({ message }) => {
 	const found = phrasesIn( value );
 
 	return [
-		value.length < MESSAGE_SHORT_LIMIT
-			&& 'Very short messages read as a fragment, and bulk senders send exactly this shape.',
-		shouting( value )
-			&& 'Mostly capitals reads as shouting, and filters treat it that way too.',
-		/[!?]{2,}/.test( value )
-			&& 'Repeated exclamation or question marks are a common spam signal.',
-		found.length > 0
-			&& 'Reads like a scam to filters and to people: ' + list( found ) + '.'
-	].filter( Boolean );
+		value.length < MESSAGE_SHORT_LIMIT && {
+			message : 'Very short messages read as a fragment, and bulk senders send exactly this shape.',
+			points : POINTS.length,
+			rule : 'length'
+		},
+		shouting( value ) && {
+			message : 'Mostly capitals reads as shouting, and filters treat it that way too.',
+			points : POINTS.shouting,
+			rule : 'shouting'
+		},
+		/[!?]{2,}/.test( value ) && {
+			message : 'Repeated exclamation or question marks are a common spam signal.',
+			points : POINTS.punctuation,
+			rule : 'punctuation'
+		},
+		found.length > 0 && {
+			message : 'Reads like a scam to filters and to people: ' + list( found ) + '.',
+			points : POINTS.phrase * found.length,
+			rule : 'phrase'
+		}
+	].filter( Boolean ).map( ( rule ) => ({ ...rule, field : 'message' }) );
 
 };
 
-// ONE ENTRY POINT, answering per field so each warning renders against the
-// input it is about rather than as a pile at the bottom of the form.
+// THE RULES, WITH THEIR WEIGHT: `[ { field, message, points, rule } ]`, subject
+// first. This is what the api's scorer folds into the spam score beside
+// SpamAssassin's own rules, so the sentence a merchant reads and the points
+// it cost are one object.
+//
+// The same rule tripped in both fields comes back twice, once per field, each
+// with its points. Whether that is one habit or two is the scorer's call to
+// make; here the facts are just reported.
 //
 // NO CHANNEL ARGUMENT, deliberately, and it is worth saying why since one was
 // tried twice.
@@ -150,13 +214,25 @@ const messageWarnings = ({ message }) => {
 // wording, and the segment mechanics where one emoji drops the limit from 160
 // characters to 70. Those belong with the SMS connection work rather than here,
 // and their absence is a reason to write them, not to stay quiet meanwhile.
-const notificationWarnings = ({
-	brand,
+const notificationRules = ({
 	message,
 	subject
-} = {}) => ({
-	message : messageWarnings({ message }),
-	subject : subjectWarnings({ brand, subject })
-});
+} = {}) => [
+	...subjectRules({ subject }),
+	...messageRules({ message })
+];
+
+// The sentences alone, per field — what the rules looked like before they had
+// points. Kept for anything that only wants the words.
+const notificationWarnings = ( input ) => {
+
+	const rules = notificationRules( input );
+
+	return {
+		message : rules.filter( ( rule ) => rule.field === 'message' ).map( ( rule ) => rule.message ),
+		subject : rules.filter( ( rule ) => rule.field === 'subject' ).map( ( rule ) => rule.message )
+	};
+
+};
 
-export { notificationWarnings };
+export { POINTS, notificationRules, notificationWarnings };

package/dist/notification.js

@@ -26,40 +26,95 @@ var phrasesIn = (value) => {
   return PHRASES.filter((phrase) => lower.includes(phrase));
 };
 var list = (values) => values.map((value) => "\u201C" + value + "\u201D").join(", ");
-var subjectWarnings = ({ brand, subject }) => {
+var POINTS = {
+  currency: 1,
+  emoji: 0.5,
+  length: 0.5,
+  phrase: 1,
+  punctuation: 1,
+  shouting: 1.5
+};
+var subjectRules = ({ subject }) => {
   const value = String(subject || "").trim();
   if (!value) return [];
   const found = phrasesIn(value);
   const emojis = emojiCount(value);
   return [
-    value.length > SUBJECT_DISPLAY_LIMIT && "Most email apps cut the subject around " + SUBJECT_DISPLAY_LIMIT + " characters \u2014 yours is " + value.length + ".",
-    shouting(value) && "Mostly capitals reads as shouting, and filters treat it that way too.",
-    /[!?]{2,}/.test(value) && "Repeated exclamation or question marks are a common spam signal.",
-    emojis > 1 && "More than one emoji in a subject is a common spam signal.",
-    /[$£€]\s?\d/.test(value) && "A currency amount in the subject is a common spam signal.",
-    found.length > 0 && "Reads like a scam to filters and to people: " + list(found) + ".",
-    brand && !value.toLowerCase().includes(String(brand).toLowerCase()) && "Nothing here says the mail is from " + brand + " \u2014 subjects that name the sender get opened more."
-  ].filter(Boolean);
+    value.length > SUBJECT_DISPLAY_LIMIT && {
+      message: "Most email apps cut the subject around " + SUBJECT_DISPLAY_LIMIT + " characters \u2014 yours is " + value.length + ".",
+      points: POINTS.length,
+      rule: "length"
+    },
+    shouting(value) && {
+      message: "Mostly capitals reads as shouting, and filters treat it that way too.",
+      points: POINTS.shouting,
+      rule: "shouting"
+    },
+    /[!?]{2,}/.test(value) && {
+      message: "Repeated exclamation or question marks are a common spam signal.",
+      points: POINTS.punctuation,
+      rule: "punctuation"
+    },
+    emojis > 1 && {
+      message: "More than one emoji in a subject is a common spam signal.",
+      points: POINTS.emoji,
+      rule: "emoji"
+    },
+    /[$£€]\s?\d/.test(value) && {
+      message: "A currency amount in the subject is a common spam signal.",
+      points: POINTS.currency,
+      rule: "currency"
+    },
+    found.length > 0 && {
+      message: "Reads like a scam to filters and to people: " + list(found) + ".",
+      points: POINTS.phrase * found.length,
+      rule: "phrase"
+    }
+  ].filter(Boolean).map((rule) => ({ ...rule, field: "subject" }));
 };
-var messageWarnings = ({ message }) => {
+var messageRules = ({ message }) => {
   const value = String(message || "").trim();
   if (!value) return [];
   const found = phrasesIn(value);
   return [
-    value.length < MESSAGE_SHORT_LIMIT && "Very short messages read as a fragment, and bulk senders send exactly this shape.",
-    shouting(value) && "Mostly capitals reads as shouting, and filters treat it that way too.",
-    /[!?]{2,}/.test(value) && "Repeated exclamation or question marks are a common spam signal.",
-    found.length > 0 && "Reads like a scam to filters and to people: " + list(found) + "."
-  ].filter(Boolean);
+    value.length < MESSAGE_SHORT_LIMIT && {
+      message: "Very short messages read as a fragment, and bulk senders send exactly this shape.",
+      points: POINTS.length,
+      rule: "length"
+    },
+    shouting(value) && {
+      message: "Mostly capitals reads as shouting, and filters treat it that way too.",
+      points: POINTS.shouting,
+      rule: "shouting"
+    },
+    /[!?]{2,}/.test(value) && {
+      message: "Repeated exclamation or question marks are a common spam signal.",
+      points: POINTS.punctuation,
+      rule: "punctuation"
+    },
+    found.length > 0 && {
+      message: "Reads like a scam to filters and to people: " + list(found) + ".",
+      points: POINTS.phrase * found.length,
+      rule: "phrase"
+    }
+  ].filter(Boolean).map((rule) => ({ ...rule, field: "message" }));
 };
-var notificationWarnings = ({
-  brand,
+var notificationRules = ({
   message,
   subject
-} = {}) => ({
-  message: messageWarnings({ message }),
-  subject: subjectWarnings({ brand, subject })
-});
+} = {}) => [
+  ...subjectRules({ subject }),
+  ...messageRules({ message })
+];
+var notificationWarnings = (input) => {
+  const rules = notificationRules(input);
+  return {
+    message: rules.filter((rule) => rule.field === "message").map((rule) => rule.message),
+    subject: rules.filter((rule) => rule.field === "subject").map((rule) => rule.message)
+  };
+};
 export {
+  POINTS,
+  notificationRules,
   notificationWarnings
 };

package/dist/providers.cjs

@@ -5653,6 +5653,12 @@ var publicConnectionKeys = Object.freeze([
   // excerpt, guide, and any vendor redirect copy.
   "content",
   "createdAt",
+  // THE MERCHANT'S OWN SWITCH. `enabled : false` is a connection the merchant
+  // paused — kept, configured, and not run — as distinct from a vendor the
+  // platform switched off (which the api overlays as an error). Absent means
+  // on; the dashboard renders Paused from it and the sync gates refuse a paused
+  // connection the way they refuse a missing one.
+  "enabled",
   // The connection DOCUMENT's own errors array — scope-drift entries written by
   // drawbridge-sync. NOT the manifest's error copy, which is content.errors:
   // the document is spread OVER the resolved manifest downstream, so the two

package/dist/providers.js

@@ -5604,6 +5604,12 @@ var publicConnectionKeys = Object.freeze([
   // excerpt, guide, and any vendor redirect copy.
   "content",
   "createdAt",
+  // THE MERCHANT'S OWN SWITCH. `enabled : false` is a connection the merchant
+  // paused — kept, configured, and not run — as distinct from a vendor the
+  // platform switched off (which the api overlays as an error). Absent means
+  // on; the dashboard renders Paused from it and the sync gates refuse a paused
+  // connection the way they refuse a missing one.
+  "enabled",
   // The connection DOCUMENT's own errors array — scope-drift entries written by
   // drawbridge-sync. NOT the manifest's error copy, which is content.errors:
   // the document is spread OVER the resolved manifest downstream, so the two

package/dist/sendgrid.cjs

@@ -19,6 +19,8 @@ var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: tru
 // lib/sendgrid.js
 var sendgrid_exports = {};
 __export(sendgrid_exports, {
+  dnsRows: () => dnsRows,
+  domain: () => domain,
   sendWithRetry: () => sendWithRetry,
   sendgrid: () => sendgrid,
   sendgridRequest: () => sendgridRequest
@@ -111,7 +113,48 @@ var sendgridRequest = ({ apiKey, body, method, path, query, request: request2 =
     url: SENDGRID_BASE + path
   });
 };
+var dnsRows = (dns) => Object.values(dns || {}).filter((row) => (row == null ? void 0 : row.host) && (row == null ? void 0 : row.type)).map((row) => ({
+  data: String(row.data ?? ""),
+  host: String(row.host),
+  type: String(row.type),
+  valid: typeof row.valid === "boolean" ? row.valid : null
+}));
+var domain = {
+  // automatic_security is what makes this CNAME-based: the provider holds the
+  // keys and the merchant publishes three CNAMEs. Without it they paste DKIM
+  // keys into TXT records by hand.
+  register: async ({ apiKey, domain: name, via = sendgridRequest }) => {
+    const created = await via({
+      apiKey,
+      body: {
+        automatic_security: true,
+        domain: name
+      },
+      method: "POST",
+      path: "/v3/whitelabel/domains"
+    });
+    return {
+      records: dnsRows(created == null ? void 0 : created.dns),
+      reference: (created == null ? void 0 : created.id) == null ? null : String(created.id)
+    };
+  },
+  // Asks SendGrid to look the records up now. `records` carries per-record
+  // validity so a UI can say WHICH record has not landed rather than only that
+  // something has not; `valid` is the whole domain's verdict.
+  validate: async ({ apiKey, reference, via = sendgridRequest }) => {
+    const result = await via({
+      apiKey,
+      method: "POST",
+      path: "/v3/whitelabel/domains/" + encodeURIComponent(reference) + "/validate"
+    });
+    return {
+      records: dnsRows(result == null ? void 0 : result.validation_results),
+      valid: Boolean(result == null ? void 0 : result.valid)
+    };
+  }
+};
 var sendgrid = {
+  domain,
   // `headers` (optional) carries the List-Unsubscribe pair on lead-facing
   // commercial sends; omitted, the request body is byte-identical to the
   // pre-opt-out-floor shape so system mail is untouched.
@@ -177,6 +220,8 @@ var sendgrid = {
 };
 // Annotate the CommonJS export names for ESM import in node:
 0 && (module.exports = {
+  dnsRows,
+  domain,
   sendWithRetry,
   sendgrid,
   sendgridRequest

package/dist/sendgrid.d.cts

@@ -109,8 +109,79 @@ const sendgridRequest = ({ apiKey, body, method, path, query, request: request$1
 
 };
 
+// SendGrid returns the records to publish as an OBJECT keyed by their role
+// (mail_cname, dkim1, dkim2), not a list. The keys are provider vocabulary the
+// merchant never sees and the set differs by security mode, so they are
+// flattened to the rows the identity schema stores — the UI then renders
+// whatever came back instead of naming roles it would have to keep in step
+// with.
+const dnsRows = ( dns ) => Object.values( dns || {} )
+	.filter( ( row ) => row?.host && row?.type )
+	.map( ( row ) => ({
+		data : String( row.data ?? '' ),
+		host : String( row.host ),
+		type : String( row.type ),
+		valid : typeof row.valid === 'boolean' ? row.valid : null
+	}) );
+
+// DOMAIN AUTHENTICATION, the two calls behind a custom sending domain. They
+// lived inline in sync's identity worker; the api needed the second one too, so
+// a merchant pressing Check now gets an answer in the request rather than a
+// timestamp that a change stream turns into a job that answers a socket later.
+// One copy, both callers, same shape back.
+//
+// `via` is the SendGrid-level call, injectable: sync's identity worker stubs
+// exactly that boundary (its tests assert on the `path`), and tsup's exports
+// are read-only so a test cannot reassign one.
+const domain = {
+
+	// automatic_security is what makes this CNAME-based: the provider holds the
+	// keys and the merchant publishes three CNAMEs. Without it they paste DKIM
+	// keys into TXT records by hand.
+	register : async ({ apiKey, domain : name, via = sendgridRequest }) => {
+
+		const created = await via({
+			apiKey,
+			body : {
+				automatic_security : true,
+				domain : name
+			},
+			method : 'POST',
+			path : '/v3/whitelabel/domains'
+		});
+
+		return {
+			records : dnsRows( created?.dns ),
+			reference : created?.id == null ? null : String( created.id )
+		};
+
+	},
+
+	// Asks SendGrid to look the records up now. `records` carries per-record
+	// validity so a UI can say WHICH record has not landed rather than only that
+	// something has not; `valid` is the whole domain's verdict.
+	validate : async ({ apiKey, reference, via = sendgridRequest }) => {
+
+		const result = await via({
+			apiKey,
+			method : 'POST',
+			path : '/v3/whitelabel/domains/' + encodeURIComponent( reference ) + '/validate'
+		});
+
+		return {
+			records : dnsRows( result?.validation_results ),
+			valid : Boolean( result?.valid )
+		};
+
+	}
+
+};
+
 const sendgrid = {
 
+	domain,
+
+
 	// `headers` (optional) carries the List-Unsubscribe pair on lead-facing
 	// commercial sends; omitted, the request body is byte-identical to the
 	// pre-opt-out-floor shape so system mail is untouched.
@@ -210,4 +281,4 @@ const sendgrid = {
 // domain-authentication endpoints (/v3/whitelabel/domains) through the same
 // authenticated client the mail send uses, rather than minting a second one.
 
-export { sendWithRetry, sendgrid, sendgridRequest };
+export { dnsRows, domain, sendWithRetry, sendgrid, sendgridRequest };

package/dist/sendgrid.d.ts

@@ -109,8 +109,79 @@ const sendgridRequest = ({ apiKey, body, method, path, query, request: request$1
 
 };
 
+// SendGrid returns the records to publish as an OBJECT keyed by their role
+// (mail_cname, dkim1, dkim2), not a list. The keys are provider vocabulary the
+// merchant never sees and the set differs by security mode, so they are
+// flattened to the rows the identity schema stores — the UI then renders
+// whatever came back instead of naming roles it would have to keep in step
+// with.
+const dnsRows = ( dns ) => Object.values( dns || {} )
+	.filter( ( row ) => row?.host && row?.type )
+	.map( ( row ) => ({
+		data : String( row.data ?? '' ),
+		host : String( row.host ),
+		type : String( row.type ),
+		valid : typeof row.valid === 'boolean' ? row.valid : null
+	}) );
+
+// DOMAIN AUTHENTICATION, the two calls behind a custom sending domain. They
+// lived inline in sync's identity worker; the api needed the second one too, so
+// a merchant pressing Check now gets an answer in the request rather than a
+// timestamp that a change stream turns into a job that answers a socket later.
+// One copy, both callers, same shape back.
+//
+// `via` is the SendGrid-level call, injectable: sync's identity worker stubs
+// exactly that boundary (its tests assert on the `path`), and tsup's exports
+// are read-only so a test cannot reassign one.
+const domain = {
+
+	// automatic_security is what makes this CNAME-based: the provider holds the
+	// keys and the merchant publishes three CNAMEs. Without it they paste DKIM
+	// keys into TXT records by hand.
+	register : async ({ apiKey, domain : name, via = sendgridRequest }) => {
+
+		const created = await via({
+			apiKey,
+			body : {
+				automatic_security : true,
+				domain : name
+			},
+			method : 'POST',
+			path : '/v3/whitelabel/domains'
+		});
+
+		return {
+			records : dnsRows( created?.dns ),
+			reference : created?.id == null ? null : String( created.id )
+		};
+
+	},
+
+	// Asks SendGrid to look the records up now. `records` carries per-record
+	// validity so a UI can say WHICH record has not landed rather than only that
+	// something has not; `valid` is the whole domain's verdict.
+	validate : async ({ apiKey, reference, via = sendgridRequest }) => {
+
+		const result = await via({
+			apiKey,
+			method : 'POST',
+			path : '/v3/whitelabel/domains/' + encodeURIComponent( reference ) + '/validate'
+		});
+
+		return {
+			records : dnsRows( result?.validation_results ),
+			valid : Boolean( result?.valid )
+		};
+
+	}
+
+};
+
 const sendgrid = {
 
+	domain,
+
+
 	// `headers` (optional) carries the List-Unsubscribe pair on lead-facing
 	// commercial sends; omitted, the request body is byte-identical to the
 	// pre-opt-out-floor shape so system mail is untouched.
@@ -210,4 +281,4 @@ const sendgrid = {
 // domain-authentication endpoints (/v3/whitelabel/domains) through the same
 // authenticated client the mail send uses, rather than minting a second one.
 
-export { sendWithRetry, sendgrid, sendgridRequest };
+export { dnsRows, domain, sendWithRetry, sendgrid, sendgridRequest };

package/dist/sendgrid.js

@@ -84,7 +84,48 @@ var sendgridRequest = ({ apiKey, body, method, path, query, request: request2 =
     url: SENDGRID_BASE + path
   });
 };
+var dnsRows = (dns) => Object.values(dns || {}).filter((row) => (row == null ? void 0 : row.host) && (row == null ? void 0 : row.type)).map((row) => ({
+  data: String(row.data ?? ""),
+  host: String(row.host),
+  type: String(row.type),
+  valid: typeof row.valid === "boolean" ? row.valid : null
+}));
+var domain = {
+  // automatic_security is what makes this CNAME-based: the provider holds the
+  // keys and the merchant publishes three CNAMEs. Without it they paste DKIM
+  // keys into TXT records by hand.
+  register: async ({ apiKey, domain: name, via = sendgridRequest }) => {
+    const created = await via({
+      apiKey,
+      body: {
+        automatic_security: true,
+        domain: name
+      },
+      method: "POST",
+      path: "/v3/whitelabel/domains"
+    });
+    return {
+      records: dnsRows(created == null ? void 0 : created.dns),
+      reference: (created == null ? void 0 : created.id) == null ? null : String(created.id)
+    };
+  },
+  // Asks SendGrid to look the records up now. `records` carries per-record
+  // validity so a UI can say WHICH record has not landed rather than only that
+  // something has not; `valid` is the whole domain's verdict.
+  validate: async ({ apiKey, reference, via = sendgridRequest }) => {
+    const result = await via({
+      apiKey,
+      method: "POST",
+      path: "/v3/whitelabel/domains/" + encodeURIComponent(reference) + "/validate"
+    });
+    return {
+      records: dnsRows(result == null ? void 0 : result.validation_results),
+      valid: Boolean(result == null ? void 0 : result.valid)
+    };
+  }
+};
 var sendgrid = {
+  domain,
   // `headers` (optional) carries the List-Unsubscribe pair on lead-facing
   // commercial sends; omitted, the request body is byte-identical to the
   // pre-opt-out-floor shape so system mail is untouched.
@@ -149,6 +190,8 @@ var sendgrid = {
   }
 };
 export {
+  dnsRows,
+  domain,
   sendWithRetry,
   sendgrid,
   sendgridRequest

package/dist/twilio.cjs

@@ -71,6 +71,12 @@ var twilio = {
   sms: async ({
     accountSid,
     authToken,
+    // WHO IS TEXTING. A platform number carries no sender name, so the body is
+    // the only place a recipient learns who this is from — and a text from a
+    // bare number with no name is the exact shape of smishing, which carriers
+    // filter on and people delete. Lead-facing sends pass the organization's
+    // title; OTC/auth sends pass nothing and keep their exact copy.
+    brand,
     from,
     link,
     message,
@@ -83,7 +89,9 @@ var twilio = {
   }) => {
     const missing = Object.entries({ accountSid, authToken, from }).filter(([, value]) => !value).map(([name]) => name);
     if (missing.length) throw new Error("Twilio credentials missing \u2014 " + missing.join(", ") + " (the drawbridge provider's smsSid, smsToken and smsFrom)");
+    const named = brand && String(title || "").trim().toLowerCase().startsWith(String(brand).trim().toLowerCase());
     const body = [
+      ...brand && !named ? [brand] : [],
       title,
       message,
       ...prize ? [prize.title + " (" + prize.value + ")"] : [],

package/dist/twilio.d.cts

@@ -15,6 +15,12 @@ const twilio = {
 	sms : async ({
 		accountSid,
 		authToken,
+		// WHO IS TEXTING. A platform number carries no sender name, so the body is
+		// the only place a recipient learns who this is from — and a text from a
+		// bare number with no name is the exact shape of smishing, which carriers
+		// filter on and people delete. Lead-facing sends pass the organization's
+		// title; OTC/auth sends pass nothing and keep their exact copy.
+		brand,
 		from,
 		link,
 		message,
@@ -38,12 +44,23 @@ const twilio = {
 
 		if( missing.length ) throw new Error( 'Twilio credentials missing — ' + missing.join( ', ' ) + ' (the drawbridge provider\'s smsSid, smsToken and smsFrom)' );
 
-		// Newline-separated, brand/title first, and no "Your prize is" /
+		// Newline-separated, BRAND FIRST, then title, and no "Your prize is" /
 		// "Click here to verify your prize" phrasing — textbook carrier-filter
 		// bait that got these messages flagged. The opt-out line is appended
 		// on lead-facing sends (carrier compliance); OTC/auth sends pass
 		// nothing new and keep their exact copy.
+		//
+		// The brand line is what the toll-free verification sample below
+		// promised Twilio we send — "Cedar & Sage / Thanks for entering… / Reply
+		// STOP to opt out" — and for a while it was the one line the real sends
+		// left out. It was a merchant's job to type it into the subject, and a
+		// warning nagged them when they did not; now it is put here, once, and
+		// the warning is gone. Skipped when the title already opens with it, so
+		// a merchant who wrote "Cedar & Sage: your prize" is not branded twice.
+		const named = brand && String( title || '' ).trim().toLowerCase().startsWith( String( brand ).trim().toLowerCase() );
+
 		const body = [
+			...( brand && ! named ? [ brand ] : [] ),
 			title,
 			message,
 			...( prize ? [ prize.title + ' (' + prize.value + ')' ] : [] ),

package/dist/twilio.d.ts

@@ -15,6 +15,12 @@ const twilio = {
 	sms : async ({
 		accountSid,
 		authToken,
+		// WHO IS TEXTING. A platform number carries no sender name, so the body is
+		// the only place a recipient learns who this is from — and a text from a
+		// bare number with no name is the exact shape of smishing, which carriers
+		// filter on and people delete. Lead-facing sends pass the organization's
+		// title; OTC/auth sends pass nothing and keep their exact copy.
+		brand,
 		from,
 		link,
 		message,
@@ -38,12 +44,23 @@ const twilio = {
 
 		if( missing.length ) throw new Error( 'Twilio credentials missing — ' + missing.join( ', ' ) + ' (the drawbridge provider\'s smsSid, smsToken and smsFrom)' );
 
-		// Newline-separated, brand/title first, and no "Your prize is" /
+		// Newline-separated, BRAND FIRST, then title, and no "Your prize is" /
 		// "Click here to verify your prize" phrasing — textbook carrier-filter
 		// bait that got these messages flagged. The opt-out line is appended
 		// on lead-facing sends (carrier compliance); OTC/auth sends pass
 		// nothing new and keep their exact copy.
+		//
+		// The brand line is what the toll-free verification sample below
+		// promised Twilio we send — "Cedar & Sage / Thanks for entering… / Reply
+		// STOP to opt out" — and for a while it was the one line the real sends
+		// left out. It was a merchant's job to type it into the subject, and a
+		// warning nagged them when they did not; now it is put here, once, and
+		// the warning is gone. Skipped when the title already opens with it, so
+		// a merchant who wrote "Cedar & Sage: your prize" is not branded twice.
+		const named = brand && String( title || '' ).trim().toLowerCase().startsWith( String( brand ).trim().toLowerCase() );
+
 		const body = [
+			...( brand && ! named ? [ brand ] : [] ),
 			title,
 			message,
 			...( prize ? [ prize.title + ' (' + prize.value + ')' ] : [] ),

package/dist/twilio.js

@@ -46,6 +46,12 @@ var twilio = {
   sms: async ({
     accountSid,
     authToken,
+    // WHO IS TEXTING. A platform number carries no sender name, so the body is
+    // the only place a recipient learns who this is from — and a text from a
+    // bare number with no name is the exact shape of smishing, which carriers
+    // filter on and people delete. Lead-facing sends pass the organization's
+    // title; OTC/auth sends pass nothing and keep their exact copy.
+    brand,
     from,
     link,
     message,
@@ -58,7 +64,9 @@ var twilio = {
   }) => {
     const missing = Object.entries({ accountSid, authToken, from }).filter(([, value]) => !value).map(([name]) => name);
     if (missing.length) throw new Error("Twilio credentials missing \u2014 " + missing.join(", ") + " (the drawbridge provider's smsSid, smsToken and smsFrom)");
+    const named = brand && String(title || "").trim().toLowerCase().startsWith(String(brand).trim().toLowerCase());
     const body = [
+      ...brand && !named ? [brand] : [],
       title,
       message,
       ...prize ? [prize.title + " (" + prize.value + ")"] : [],

package/package.json

@@ -226,5 +226,5 @@
     "prepublishOnly": ". \"$HOME/.nvm/nvm.sh\" && nvm use && tsup && node --test"
   },
   "types": "dist/index.d.ts",
-  "version": "0.0.163"
+  "version": "0.0.165"
 }