@drawbridge/drawbridge-utils 0.0.164 → 0.0.165

package/dist/notification.cjs

@@ -52,7 +52,6 @@ var phrasesIn = (value) => {
 };
 var list = (values) => values.map((value) => "\u201C" + value + "\u201D").join(", ");
 var POINTS = {
-  brand: 0,
   currency: 1,
   emoji: 0.5,
   length: 0.5,
@@ -60,7 +59,7 @@ var POINTS = {
   punctuation: 1,
   shouting: 1.5
 };
-var subjectRules = ({ brand, subject }) => {
+var subjectRules = ({ subject }) => {
   const value = String(subject || "").trim();
   if (!value) return [];
   const found = phrasesIn(value);
@@ -95,11 +94,6 @@ var subjectRules = ({ brand, subject }) => {
       message: "Reads like a scam to filters and to people: " + list(found) + ".",
       points: POINTS.phrase * found.length,
       rule: "phrase"
-    },
-    brand && !value.toLowerCase().includes(String(brand).toLowerCase()) && {
-      message: "Nothing here says the mail is from " + brand + " \u2014 subjects that name the sender get opened more.",
-      points: POINTS.brand,
-      rule: "brand"
     }
   ].filter(Boolean).map((rule) => ({ ...rule, field: "subject" }));
 };
@@ -131,11 +125,10 @@ var messageRules = ({ message }) => {
   ].filter(Boolean).map((rule) => ({ ...rule, field: "message" }));
 };
 var notificationRules = ({
-  brand,
   message,
   subject
 } = {}) => [
-  ...subjectRules({ brand, subject }),
+  ...subjectRules({ subject }),
   ...messageRules({ message })
 ];
 var notificationWarnings = (input) => {

package/dist/notification.d.cts

@@ -89,15 +89,18 @@ const list = ( values ) => values.map( ( value ) => '“' + value + '”' ).join
 // Weighted by how reliably each one gets mail binned, and by how likely it is
 // to be an accident. Shouting and scam phrasing are never accidents. Repeated
 // punctuation and a currency amount are strong. Emoji and length are habits
-// worth a nudge. The brand line is advice about context rather than the
-// words — and the default copy every campaign ships with cannot name a brand
-// it does not know — so it is listed at zero and never marks a default down.
+// worth a nudge.
+//
+// NO BRAND RULE. There was one — "nothing here says the mail is from Acme" —
+// and it was asking the merchant to do by hand what the send already does:
+// email goes out with the organization's title as the From name, and SMS puts
+// it on the first line of the body (twilio.sms). Advice to repeat what the
+// envelope carries is noise, and a static default could never satisfy it.
 //
 // PHRASES COUNT PER MATCH. "Congratulations, click here, limited time" is
 // three of them and reads like three of them; one sentence lists them all,
 // the points say how many. A product table, and Darren's to move.
 const POINTS = {
-	brand : 0,
 	currency : 1,
 	emoji : 0.5,
 	length : 0.5,
@@ -106,11 +109,7 @@ const POINTS = {
 	shouting : 1.5
 };
 
-// `brand` is the organization's own name. A subject that never mentions who is
-// writing is the single most recognisable trait of the mail people delete
-// unread — and the one a merchant can fix in five seconds once it is pointed
-// out. Skipped entirely when no brand is supplied rather than guessed at.
-const subjectRules = ({ brand, subject }) => {
+const subjectRules = ({ subject }) => {
 
 	const value = String( subject || '' ).trim();
 
@@ -149,11 +148,6 @@ const subjectRules = ({ brand, subject }) => {
 			message : 'Reads like a scam to filters and to people: ' + list( found ) + '.',
 			points : POINTS.phrase * found.length,
 			rule : 'phrase'
-		},
-		brand && ! value.toLowerCase().includes( String( brand ).toLowerCase() ) && {
-			message : 'Nothing here says the mail is from ' + brand + ' — subjects that name the sender get opened more.',
-			points : POINTS.brand,
-			rule : 'brand'
 		}
 	].filter( Boolean ).map( ( rule ) => ({ ...rule, field : 'subject' }) );
 
@@ -221,11 +215,10 @@ const messageRules = ({ message }) => {
 // characters to 70. Those belong with the SMS connection work rather than here,
 // and their absence is a reason to write them, not to stay quiet meanwhile.
 const notificationRules = ({
-	brand,
 	message,
 	subject
 } = {}) => [
-	...subjectRules({ brand, subject }),
+	...subjectRules({ subject }),
 	...messageRules({ message })
 ];
 

package/dist/notification.d.ts

@@ -89,15 +89,18 @@ const list = ( values ) => values.map( ( value ) => '“' + value + '”' ).join
 // Weighted by how reliably each one gets mail binned, and by how likely it is
 // to be an accident. Shouting and scam phrasing are never accidents. Repeated
 // punctuation and a currency amount are strong. Emoji and length are habits
-// worth a nudge. The brand line is advice about context rather than the
-// words — and the default copy every campaign ships with cannot name a brand
-// it does not know — so it is listed at zero and never marks a default down.
+// worth a nudge.
+//
+// NO BRAND RULE. There was one — "nothing here says the mail is from Acme" —
+// and it was asking the merchant to do by hand what the send already does:
+// email goes out with the organization's title as the From name, and SMS puts
+// it on the first line of the body (twilio.sms). Advice to repeat what the
+// envelope carries is noise, and a static default could never satisfy it.
 //
 // PHRASES COUNT PER MATCH. "Congratulations, click here, limited time" is
 // three of them and reads like three of them; one sentence lists them all,
 // the points say how many. A product table, and Darren's to move.
 const POINTS = {
-	brand : 0,
 	currency : 1,
 	emoji : 0.5,
 	length : 0.5,
@@ -106,11 +109,7 @@ const POINTS = {
 	shouting : 1.5
 };
 
-// `brand` is the organization's own name. A subject that never mentions who is
-// writing is the single most recognisable trait of the mail people delete
-// unread — and the one a merchant can fix in five seconds once it is pointed
-// out. Skipped entirely when no brand is supplied rather than guessed at.
-const subjectRules = ({ brand, subject }) => {
+const subjectRules = ({ subject }) => {
 
 	const value = String( subject || '' ).trim();
 
@@ -149,11 +148,6 @@ const subjectRules = ({ brand, subject }) => {
 			message : 'Reads like a scam to filters and to people: ' + list( found ) + '.',
 			points : POINTS.phrase * found.length,
 			rule : 'phrase'
-		},
-		brand && ! value.toLowerCase().includes( String( brand ).toLowerCase() ) && {
-			message : 'Nothing here says the mail is from ' + brand + ' — subjects that name the sender get opened more.',
-			points : POINTS.brand,
-			rule : 'brand'
 		}
 	].filter( Boolean ).map( ( rule ) => ({ ...rule, field : 'subject' }) );
 
@@ -221,11 +215,10 @@ const messageRules = ({ message }) => {
 // characters to 70. Those belong with the SMS connection work rather than here,
 // and their absence is a reason to write them, not to stay quiet meanwhile.
 const notificationRules = ({
-	brand,
 	message,
 	subject
 } = {}) => [
-	...subjectRules({ brand, subject }),
+	...subjectRules({ subject }),
 	...messageRules({ message })
 ];
 

package/dist/notification.js

@@ -27,7 +27,6 @@ var phrasesIn = (value) => {
 };
 var list = (values) => values.map((value) => "\u201C" + value + "\u201D").join(", ");
 var POINTS = {
-  brand: 0,
   currency: 1,
   emoji: 0.5,
   length: 0.5,
@@ -35,7 +34,7 @@ var POINTS = {
   punctuation: 1,
   shouting: 1.5
 };
-var subjectRules = ({ brand, subject }) => {
+var subjectRules = ({ subject }) => {
   const value = String(subject || "").trim();
   if (!value) return [];
   const found = phrasesIn(value);
@@ -70,11 +69,6 @@ var subjectRules = ({ brand, subject }) => {
       message: "Reads like a scam to filters and to people: " + list(found) + ".",
       points: POINTS.phrase * found.length,
       rule: "phrase"
-    },
-    brand && !value.toLowerCase().includes(String(brand).toLowerCase()) && {
-      message: "Nothing here says the mail is from " + brand + " \u2014 subjects that name the sender get opened more.",
-      points: POINTS.brand,
-      rule: "brand"
     }
   ].filter(Boolean).map((rule) => ({ ...rule, field: "subject" }));
 };
@@ -106,11 +100,10 @@ var messageRules = ({ message }) => {
   ].filter(Boolean).map((rule) => ({ ...rule, field: "message" }));
 };
 var notificationRules = ({
-  brand,
   message,
   subject
 } = {}) => [
-  ...subjectRules({ brand, subject }),
+  ...subjectRules({ subject }),
   ...messageRules({ message })
 ];
 var notificationWarnings = (input) => {

package/dist/sendgrid.cjs

@@ -19,6 +19,8 @@ var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: tru
 // lib/sendgrid.js
 var sendgrid_exports = {};
 __export(sendgrid_exports, {
+  dnsRows: () => dnsRows,
+  domain: () => domain,
   sendWithRetry: () => sendWithRetry,
   sendgrid: () => sendgrid,
   sendgridRequest: () => sendgridRequest
@@ -111,7 +113,48 @@ var sendgridRequest = ({ apiKey, body, method, path, query, request: request2 =
     url: SENDGRID_BASE + path
   });
 };
+var dnsRows = (dns) => Object.values(dns || {}).filter((row) => (row == null ? void 0 : row.host) && (row == null ? void 0 : row.type)).map((row) => ({
+  data: String(row.data ?? ""),
+  host: String(row.host),
+  type: String(row.type),
+  valid: typeof row.valid === "boolean" ? row.valid : null
+}));
+var domain = {
+  // automatic_security is what makes this CNAME-based: the provider holds the
+  // keys and the merchant publishes three CNAMEs. Without it they paste DKIM
+  // keys into TXT records by hand.
+  register: async ({ apiKey, domain: name, via = sendgridRequest }) => {
+    const created = await via({
+      apiKey,
+      body: {
+        automatic_security: true,
+        domain: name
+      },
+      method: "POST",
+      path: "/v3/whitelabel/domains"
+    });
+    return {
+      records: dnsRows(created == null ? void 0 : created.dns),
+      reference: (created == null ? void 0 : created.id) == null ? null : String(created.id)
+    };
+  },
+  // Asks SendGrid to look the records up now. `records` carries per-record
+  // validity so a UI can say WHICH record has not landed rather than only that
+  // something has not; `valid` is the whole domain's verdict.
+  validate: async ({ apiKey, reference, via = sendgridRequest }) => {
+    const result = await via({
+      apiKey,
+      method: "POST",
+      path: "/v3/whitelabel/domains/" + encodeURIComponent(reference) + "/validate"
+    });
+    return {
+      records: dnsRows(result == null ? void 0 : result.validation_results),
+      valid: Boolean(result == null ? void 0 : result.valid)
+    };
+  }
+};
 var sendgrid = {
+  domain,
   // `headers` (optional) carries the List-Unsubscribe pair on lead-facing
   // commercial sends; omitted, the request body is byte-identical to the
   // pre-opt-out-floor shape so system mail is untouched.
@@ -177,6 +220,8 @@ var sendgrid = {
 };
 // Annotate the CommonJS export names for ESM import in node:
 0 && (module.exports = {
+  dnsRows,
+  domain,
   sendWithRetry,
   sendgrid,
   sendgridRequest

package/dist/sendgrid.d.cts

@@ -109,8 +109,79 @@ const sendgridRequest = ({ apiKey, body, method, path, query, request: request$1
 
 };
 
+// SendGrid returns the records to publish as an OBJECT keyed by their role
+// (mail_cname, dkim1, dkim2), not a list. The keys are provider vocabulary the
+// merchant never sees and the set differs by security mode, so they are
+// flattened to the rows the identity schema stores — the UI then renders
+// whatever came back instead of naming roles it would have to keep in step
+// with.
+const dnsRows = ( dns ) => Object.values( dns || {} )
+	.filter( ( row ) => row?.host && row?.type )
+	.map( ( row ) => ({
+		data : String( row.data ?? '' ),
+		host : String( row.host ),
+		type : String( row.type ),
+		valid : typeof row.valid === 'boolean' ? row.valid : null
+	}) );
+
+// DOMAIN AUTHENTICATION, the two calls behind a custom sending domain. They
+// lived inline in sync's identity worker; the api needed the second one too, so
+// a merchant pressing Check now gets an answer in the request rather than a
+// timestamp that a change stream turns into a job that answers a socket later.
+// One copy, both callers, same shape back.
+//
+// `via` is the SendGrid-level call, injectable: sync's identity worker stubs
+// exactly that boundary (its tests assert on the `path`), and tsup's exports
+// are read-only so a test cannot reassign one.
+const domain = {
+
+	// automatic_security is what makes this CNAME-based: the provider holds the
+	// keys and the merchant publishes three CNAMEs. Without it they paste DKIM
+	// keys into TXT records by hand.
+	register : async ({ apiKey, domain : name, via = sendgridRequest }) => {
+
+		const created = await via({
+			apiKey,
+			body : {
+				automatic_security : true,
+				domain : name
+			},
+			method : 'POST',
+			path : '/v3/whitelabel/domains'
+		});
+
+		return {
+			records : dnsRows( created?.dns ),
+			reference : created?.id == null ? null : String( created.id )
+		};
+
+	},
+
+	// Asks SendGrid to look the records up now. `records` carries per-record
+	// validity so a UI can say WHICH record has not landed rather than only that
+	// something has not; `valid` is the whole domain's verdict.
+	validate : async ({ apiKey, reference, via = sendgridRequest }) => {
+
+		const result = await via({
+			apiKey,
+			method : 'POST',
+			path : '/v3/whitelabel/domains/' + encodeURIComponent( reference ) + '/validate'
+		});
+
+		return {
+			records : dnsRows( result?.validation_results ),
+			valid : Boolean( result?.valid )
+		};
+
+	}
+
+};
+
 const sendgrid = {
 
+	domain,
+
+
 	// `headers` (optional) carries the List-Unsubscribe pair on lead-facing
 	// commercial sends; omitted, the request body is byte-identical to the
 	// pre-opt-out-floor shape so system mail is untouched.
@@ -210,4 +281,4 @@ const sendgrid = {
 // domain-authentication endpoints (/v3/whitelabel/domains) through the same
 // authenticated client the mail send uses, rather than minting a second one.
 
-export { sendWithRetry, sendgrid, sendgridRequest };
+export { dnsRows, domain, sendWithRetry, sendgrid, sendgridRequest };

package/dist/sendgrid.d.ts

@@ -109,8 +109,79 @@ const sendgridRequest = ({ apiKey, body, method, path, query, request: request$1
 
 };
 
+// SendGrid returns the records to publish as an OBJECT keyed by their role
+// (mail_cname, dkim1, dkim2), not a list. The keys are provider vocabulary the
+// merchant never sees and the set differs by security mode, so they are
+// flattened to the rows the identity schema stores — the UI then renders
+// whatever came back instead of naming roles it would have to keep in step
+// with.
+const dnsRows = ( dns ) => Object.values( dns || {} )
+	.filter( ( row ) => row?.host && row?.type )
+	.map( ( row ) => ({
+		data : String( row.data ?? '' ),
+		host : String( row.host ),
+		type : String( row.type ),
+		valid : typeof row.valid === 'boolean' ? row.valid : null
+	}) );
+
+// DOMAIN AUTHENTICATION, the two calls behind a custom sending domain. They
+// lived inline in sync's identity worker; the api needed the second one too, so
+// a merchant pressing Check now gets an answer in the request rather than a
+// timestamp that a change stream turns into a job that answers a socket later.
+// One copy, both callers, same shape back.
+//
+// `via` is the SendGrid-level call, injectable: sync's identity worker stubs
+// exactly that boundary (its tests assert on the `path`), and tsup's exports
+// are read-only so a test cannot reassign one.
+const domain = {
+
+	// automatic_security is what makes this CNAME-based: the provider holds the
+	// keys and the merchant publishes three CNAMEs. Without it they paste DKIM
+	// keys into TXT records by hand.
+	register : async ({ apiKey, domain : name, via = sendgridRequest }) => {
+
+		const created = await via({
+			apiKey,
+			body : {
+				automatic_security : true,
+				domain : name
+			},
+			method : 'POST',
+			path : '/v3/whitelabel/domains'
+		});
+
+		return {
+			records : dnsRows( created?.dns ),
+			reference : created?.id == null ? null : String( created.id )
+		};
+
+	},
+
+	// Asks SendGrid to look the records up now. `records` carries per-record
+	// validity so a UI can say WHICH record has not landed rather than only that
+	// something has not; `valid` is the whole domain's verdict.
+	validate : async ({ apiKey, reference, via = sendgridRequest }) => {
+
+		const result = await via({
+			apiKey,
+			method : 'POST',
+			path : '/v3/whitelabel/domains/' + encodeURIComponent( reference ) + '/validate'
+		});
+
+		return {
+			records : dnsRows( result?.validation_results ),
+			valid : Boolean( result?.valid )
+		};
+
+	}
+
+};
+
 const sendgrid = {
 
+	domain,
+
+
 	// `headers` (optional) carries the List-Unsubscribe pair on lead-facing
 	// commercial sends; omitted, the request body is byte-identical to the
 	// pre-opt-out-floor shape so system mail is untouched.
@@ -210,4 +281,4 @@ const sendgrid = {
 // domain-authentication endpoints (/v3/whitelabel/domains) through the same
 // authenticated client the mail send uses, rather than minting a second one.
 
-export { sendWithRetry, sendgrid, sendgridRequest };
+export { dnsRows, domain, sendWithRetry, sendgrid, sendgridRequest };

package/dist/sendgrid.js

@@ -84,7 +84,48 @@ var sendgridRequest = ({ apiKey, body, method, path, query, request: request2 =
     url: SENDGRID_BASE + path
   });
 };
+var dnsRows = (dns) => Object.values(dns || {}).filter((row) => (row == null ? void 0 : row.host) && (row == null ? void 0 : row.type)).map((row) => ({
+  data: String(row.data ?? ""),
+  host: String(row.host),
+  type: String(row.type),
+  valid: typeof row.valid === "boolean" ? row.valid : null
+}));
+var domain = {
+  // automatic_security is what makes this CNAME-based: the provider holds the
+  // keys and the merchant publishes three CNAMEs. Without it they paste DKIM
+  // keys into TXT records by hand.
+  register: async ({ apiKey, domain: name, via = sendgridRequest }) => {
+    const created = await via({
+      apiKey,
+      body: {
+        automatic_security: true,
+        domain: name
+      },
+      method: "POST",
+      path: "/v3/whitelabel/domains"
+    });
+    return {
+      records: dnsRows(created == null ? void 0 : created.dns),
+      reference: (created == null ? void 0 : created.id) == null ? null : String(created.id)
+    };
+  },
+  // Asks SendGrid to look the records up now. `records` carries per-record
+  // validity so a UI can say WHICH record has not landed rather than only that
+  // something has not; `valid` is the whole domain's verdict.
+  validate: async ({ apiKey, reference, via = sendgridRequest }) => {
+    const result = await via({
+      apiKey,
+      method: "POST",
+      path: "/v3/whitelabel/domains/" + encodeURIComponent(reference) + "/validate"
+    });
+    return {
+      records: dnsRows(result == null ? void 0 : result.validation_results),
+      valid: Boolean(result == null ? void 0 : result.valid)
+    };
+  }
+};
 var sendgrid = {
+  domain,
   // `headers` (optional) carries the List-Unsubscribe pair on lead-facing
   // commercial sends; omitted, the request body is byte-identical to the
   // pre-opt-out-floor shape so system mail is untouched.
@@ -149,6 +190,8 @@ var sendgrid = {
   }
 };
 export {
+  dnsRows,
+  domain,
   sendWithRetry,
   sendgrid,
   sendgridRequest

package/dist/twilio.cjs

@@ -71,6 +71,12 @@ var twilio = {
   sms: async ({
     accountSid,
     authToken,
+    // WHO IS TEXTING. A platform number carries no sender name, so the body is
+    // the only place a recipient learns who this is from — and a text from a
+    // bare number with no name is the exact shape of smishing, which carriers
+    // filter on and people delete. Lead-facing sends pass the organization's
+    // title; OTC/auth sends pass nothing and keep their exact copy.
+    brand,
     from,
     link,
     message,
@@ -83,7 +89,9 @@ var twilio = {
   }) => {
     const missing = Object.entries({ accountSid, authToken, from }).filter(([, value]) => !value).map(([name]) => name);
     if (missing.length) throw new Error("Twilio credentials missing \u2014 " + missing.join(", ") + " (the drawbridge provider's smsSid, smsToken and smsFrom)");
+    const named = brand && String(title || "").trim().toLowerCase().startsWith(String(brand).trim().toLowerCase());
     const body = [
+      ...brand && !named ? [brand] : [],
       title,
       message,
       ...prize ? [prize.title + " (" + prize.value + ")"] : [],

package/dist/twilio.d.cts

@@ -15,6 +15,12 @@ const twilio = {
 	sms : async ({
 		accountSid,
 		authToken,
+		// WHO IS TEXTING. A platform number carries no sender name, so the body is
+		// the only place a recipient learns who this is from — and a text from a
+		// bare number with no name is the exact shape of smishing, which carriers
+		// filter on and people delete. Lead-facing sends pass the organization's
+		// title; OTC/auth sends pass nothing and keep their exact copy.
+		brand,
 		from,
 		link,
 		message,
@@ -38,12 +44,23 @@ const twilio = {
 
 		if( missing.length ) throw new Error( 'Twilio credentials missing — ' + missing.join( ', ' ) + ' (the drawbridge provider\'s smsSid, smsToken and smsFrom)' );
 
-		// Newline-separated, brand/title first, and no "Your prize is" /
+		// Newline-separated, BRAND FIRST, then title, and no "Your prize is" /
 		// "Click here to verify your prize" phrasing — textbook carrier-filter
 		// bait that got these messages flagged. The opt-out line is appended
 		// on lead-facing sends (carrier compliance); OTC/auth sends pass
 		// nothing new and keep their exact copy.
+		//
+		// The brand line is what the toll-free verification sample below
+		// promised Twilio we send — "Cedar & Sage / Thanks for entering… / Reply
+		// STOP to opt out" — and for a while it was the one line the real sends
+		// left out. It was a merchant's job to type it into the subject, and a
+		// warning nagged them when they did not; now it is put here, once, and
+		// the warning is gone. Skipped when the title already opens with it, so
+		// a merchant who wrote "Cedar & Sage: your prize" is not branded twice.
+		const named = brand && String( title || '' ).trim().toLowerCase().startsWith( String( brand ).trim().toLowerCase() );
+
 		const body = [
+			...( brand && ! named ? [ brand ] : [] ),
 			title,
 			message,
 			...( prize ? [ prize.title + ' (' + prize.value + ')' ] : [] ),

package/dist/twilio.d.ts

@@ -15,6 +15,12 @@ const twilio = {
 	sms : async ({
 		accountSid,
 		authToken,
+		// WHO IS TEXTING. A platform number carries no sender name, so the body is
+		// the only place a recipient learns who this is from — and a text from a
+		// bare number with no name is the exact shape of smishing, which carriers
+		// filter on and people delete. Lead-facing sends pass the organization's
+		// title; OTC/auth sends pass nothing and keep their exact copy.
+		brand,
 		from,
 		link,
 		message,
@@ -38,12 +44,23 @@ const twilio = {
 
 		if( missing.length ) throw new Error( 'Twilio credentials missing — ' + missing.join( ', ' ) + ' (the drawbridge provider\'s smsSid, smsToken and smsFrom)' );
 
-		// Newline-separated, brand/title first, and no "Your prize is" /
+		// Newline-separated, BRAND FIRST, then title, and no "Your prize is" /
 		// "Click here to verify your prize" phrasing — textbook carrier-filter
 		// bait that got these messages flagged. The opt-out line is appended
 		// on lead-facing sends (carrier compliance); OTC/auth sends pass
 		// nothing new and keep their exact copy.
+		//
+		// The brand line is what the toll-free verification sample below
+		// promised Twilio we send — "Cedar & Sage / Thanks for entering… / Reply
+		// STOP to opt out" — and for a while it was the one line the real sends
+		// left out. It was a merchant's job to type it into the subject, and a
+		// warning nagged them when they did not; now it is put here, once, and
+		// the warning is gone. Skipped when the title already opens with it, so
+		// a merchant who wrote "Cedar & Sage: your prize" is not branded twice.
+		const named = brand && String( title || '' ).trim().toLowerCase().startsWith( String( brand ).trim().toLowerCase() );
+
 		const body = [
+			...( brand && ! named ? [ brand ] : [] ),
 			title,
 			message,
 			...( prize ? [ prize.title + ' (' + prize.value + ')' ] : [] ),

package/dist/twilio.js

@@ -46,6 +46,12 @@ var twilio = {
   sms: async ({
     accountSid,
     authToken,
+    // WHO IS TEXTING. A platform number carries no sender name, so the body is
+    // the only place a recipient learns who this is from — and a text from a
+    // bare number with no name is the exact shape of smishing, which carriers
+    // filter on and people delete. Lead-facing sends pass the organization's
+    // title; OTC/auth sends pass nothing and keep their exact copy.
+    brand,
     from,
     link,
     message,
@@ -58,7 +64,9 @@ var twilio = {
   }) => {
     const missing = Object.entries({ accountSid, authToken, from }).filter(([, value]) => !value).map(([name]) => name);
     if (missing.length) throw new Error("Twilio credentials missing \u2014 " + missing.join(", ") + " (the drawbridge provider's smsSid, smsToken and smsFrom)");
+    const named = brand && String(title || "").trim().toLowerCase().startsWith(String(brand).trim().toLowerCase());
     const body = [
+      ...brand && !named ? [brand] : [],
       title,
       message,
       ...prize ? [prize.title + " (" + prize.value + ")"] : [],

package/package.json

@@ -226,5 +226,5 @@
     "prepublishOnly": ". \"$HOME/.nvm/nvm.sh\" && nvm use && tsup && node --test"
   },
   "types": "dist/index.d.ts",
-  "version": "0.0.164"
+  "version": "0.0.165"
 }