@mccaskie-labs/workbench-config 0.1.40 → 0.1.41

package/CHANGELOG.md

@@ -1,5 +1,11 @@
 # @mccaskie-labs/workbench-config
 
+## 0.1.41
+
+### Patch Changes
+
+- The email-sending and email-inbound guides and manifests no longer name one install's domain. They say `<projects domain>` and tell Claude to read it from the project's README (hard rule 13).
+
 ## 0.1.40
 
 ### Patch Changes

package/capabilities/email-inbound.json

@@ -105,7 +105,7 @@
       "title": "Store inbound mail",
       "lang": "ts",
       "probe": "email-inbound.roundtrip",
-      "code": "export async function handleEmail(mail, env, ctx, { reject }) {\n  if (!mail.to.some((t) => t.address === 'inbox@wb-probe-staging.mccaskielabs.app')) return reject('Unknown mailbox')\n  await saveMail(env, { message_id: mail.message_id, subject: mail.subject, text: mail.text, received_at: mail.received_at })\n}"
+      "code": "export async function handleEmail(mail, env, ctx, { reject }) {\n  if (!mail.to.some((t) => t.address === 'inbox@<id>-staging.<projects domain>')) return reject('Unknown mailbox')\n  await saveMail(env, { message_id: mail.message_id, subject: mail.subject, text: mail.text, received_at: mail.received_at })\n}"
     }
   ],
   "probes": [

package/capabilities/email-inbound.md

@@ -1,6 +1,6 @@
 # Inbound email
 
-A project receives mail on a domain in its namespace, for example `wb-probe-staging.mccaskielabs.app`, and each address it uses is routed to one of its own Workers. Project-owned zones such as `wbprobe.com` join the namespace with `cf_zone_attach` (phase 6).
+A project receives mail on a domain in its namespace, for example `<id>-staging.<projects domain>`, and each address it uses is routed to one of its own Workers. `<projects domain>` is the domain this Workbench install keeps its projects under: it is the last part of the project's staging address in its README, so read it there and never assume one. A domain the project owns joins the namespace with `cf_zone_attach` (phase 6).
 
 ## Setting it up (Claude, through Control)
 

package/capabilities/email-sending.json

@@ -24,13 +24,13 @@
     { "code": "missing_permission", "http": 403, "retryable": false, "meaning": "Control's Cloudflare token lacks Email Sending (edit)" }
   ],
   "rules": [
-    { "id": "email-sending.namespace-only", "kind": "must", "text": "Onboard a domain in the project's own namespace, for example mail.<id>.mccaskielabs.app. Project-owned zones such as wbprobe.com follow cf_zone_attach (step 6.1).", "enforced_by": "control", "probe": "email-sending.onboard" },
+    { "id": "email-sending.namespace-only", "kind": "must", "text": "Onboard a domain in the project's own namespace, for example mail.<id>.<projects domain> (the domain this install keeps its projects under). A domain the project owns follows cf_zone_attach (step 6.1).", "enforced_by": "control", "probe": "email-sending.onboard" },
     { "id": "email-sending.onboard-before-sender", "kind": "must", "text": "Onboard the domain before adding senders on it. gw_sender_add refuses a domain the project hasn't onboarded.", "enforced_by": "control", "probe": "email-sending.sender-add" },
     { "id": "email-sending.never-adopt", "kind": "must_not", "text": "Expect Control to take over a domain onboarded by hand. It refuses with name_taken.", "enforced_by": "control", "probe": "email-sending.onboard" },
     { "id": "email-sending.verified-over-doh", "kind": "must", "text": "Treat a domain as ready only when cf_email_sending_status says ready: every expected record is in the zone and visible over DNS-over-HTTPS.", "enforced_by": "control", "probe": "email-sending.status" }
   ],
   "probes": [
-    { "id": "email-sending.onboard", "half": "drill", "expect": "pass", "cost_hint_usd": 0, "note": "cf_email_sending_onboard on mail.<id>.mccaskielabs.app; a second call changes nothing" },
+    { "id": "email-sending.onboard", "half": "drill", "expect": "pass", "cost_hint_usd": 0, "note": "cf_email_sending_onboard on mail.<id>.<projects domain>; a second call changes nothing" },
     { "id": "email-sending.status", "half": "drill", "expect": "pass", "cost_hint_usd": 0 },
     { "id": "email-sending.sender-add", "half": "drill", "expect": "pass", "cost_hint_usd": 0, "note": "Then a runtime send from the new address (email.send.transactional)" },
     { "id": "email-sending.out-of-scope", "half": "drill", "expect": "refused_as_expected", "refusal": "out_of_scope", "cost_hint_usd": 0, "note": "Another project's namespace" }

package/capabilities/email-sending.md

@@ -1,9 +1,9 @@
 # Email sending domains
 
-A project sends from addresses on a domain Control onboarded for it. Today that is a domain in the project's namespace in `mccaskielabs.app`, usually `mail.<id>.mccaskielabs.app`. Project-owned zones such as `wbprobe.com` follow `cf_zone_attach` in step 6.1.
+A project sends from addresses on a domain Control onboarded for it. Today that is a domain in the project's namespace under the install's projects domain, usually `mail.<id>.<projects domain>`. `<projects domain>` is the domain this Workbench install keeps its projects under: it is the last part of the project's staging address in its README, so read it there and never assume one. A domain the project owns follows `cf_zone_attach` in step 6.1.
 
-1. `cf_email_sending_onboard domain=mail.<id>.mccaskielabs.app` creates the Email Sending subdomain in the projects account, adds the records Cloudflare expects (the `cf-bounce` MX and SPF, and DKIM) and the domain's own DMARC record (`p=reject; adkim=s; aspf=r`), records them, and checks each over DNS-over-HTTPS. A record in the way stops it; it changes nothing it didn't make.
+1. `cf_email_sending_onboard domain=mail.<id>.<projects domain>` creates the Email Sending subdomain in the projects account, adds the records Cloudflare expects (the `cf-bounce` MX and SPF, and DKIM) and the domain's own DMARC record (`p=reject; adkim=s; aspf=r`), records them, and checks each over DNS-over-HTTPS. A record in the way stops it; it changes nothing it didn't make.
 2. `cf_email_sending_status` says `ready` once every record is visible. Records can take a few minutes.
-3. `gw_sender_add address=hello@mail.<id>.mccaskielabs.app` allows the address. The Gateway accepts it within a minute.
+3. `gw_sender_add address=hello@mail.<id>.<projects domain>` allows the address. The Gateway accepts it within a minute.
 
 The DNS records are ordinary `dns_record` rows for the project, so removing one is `cf_dns_delete` (two-step).

package/dist/capabilities.gen.d.ts

@@ -1,4 +1,4 @@
-export declare const MANIFEST_VERSION: "90023fb27145";
+export declare const MANIFEST_VERSION: "b986177e8690";
 export declare const capabilities: {
     readonly ai: {
         readonly $schema: "./schema.json";
@@ -985,7 +985,7 @@ export declare const capabilities: {
             readonly id: "email-inbound.example.handler";
             readonly title: "Store inbound mail";
             readonly lang: "ts";
-            readonly code: "export async function handleEmail(mail, env, ctx, { reject }) {\n  if (!mail.to.some((t) => t.address === 'inbox@wb-probe-staging.mccaskielabs.app')) return reject('Unknown mailbox')\n  await saveMail(env, { message_id: mail.message_id, subject: mail.subject, text: mail.text, received_at: mail.received_at })\n}";
+            readonly code: "export async function handleEmail(mail, env, ctx, { reject }) {\n  if (!mail.to.some((t) => t.address === 'inbox@<id>-staging.<projects domain>')) return reject('Unknown mailbox')\n  await saveMail(env, { message_id: mail.message_id, subject: mail.subject, text: mail.text, received_at: mail.received_at })\n}";
             readonly probe: "email-inbound.roundtrip";
         }];
         readonly probes: readonly [{
@@ -1070,7 +1070,7 @@ export declare const capabilities: {
         readonly rules: readonly [{
             readonly id: "email-sending.namespace-only";
             readonly kind: "must";
-            readonly text: "Onboard a domain in the project's own namespace, for example mail.<id>.mccaskielabs.app. Project-owned zones such as wbprobe.com follow cf_zone_attach (step 6.1).";
+            readonly text: "Onboard a domain in the project's own namespace, for example mail.<id>.<projects domain> (the domain this install keeps its projects under). A domain the project owns follows cf_zone_attach (step 6.1).";
             readonly enforced_by: "control";
             readonly probe: "email-sending.onboard";
         }, {
@@ -1097,7 +1097,7 @@ export declare const capabilities: {
             readonly half: "drill";
             readonly expect: "pass";
             readonly cost_hint_usd: 0;
-            readonly note: "cf_email_sending_onboard on mail.<id>.mccaskielabs.app; a second call changes nothing";
+            readonly note: "cf_email_sending_onboard on mail.<id>.<projects domain>; a second call changes nothing";
         }, {
             readonly id: "email-sending.status";
             readonly half: "drill";

package/dist/capabilities.gen.js

@@ -1,6 +1,6 @@
 // Generated by `npm run capabilities:build` from capabilities/*.json. Do not edit.
 // check:capabilities fails in Checks when this file is stale.
-export const MANIFEST_VERSION = "90023fb27145";
+export const MANIFEST_VERSION = "b986177e8690";
 export const capabilities = {
     "ai": {
         "$schema": "./schema.json",
@@ -1344,7 +1344,7 @@ export const capabilities = {
                 "id": "email-inbound.example.handler",
                 "title": "Store inbound mail",
                 "lang": "ts",
-                "code": "export async function handleEmail(mail, env, ctx, { reject }) {\n  if (!mail.to.some((t) => t.address === 'inbox@wb-probe-staging.mccaskielabs.app')) return reject('Unknown mailbox')\n  await saveMail(env, { message_id: mail.message_id, subject: mail.subject, text: mail.text, received_at: mail.received_at })\n}",
+                "code": "export async function handleEmail(mail, env, ctx, { reject }) {\n  if (!mail.to.some((t) => t.address === 'inbox@<id>-staging.<projects domain>')) return reject('Unknown mailbox')\n  await saveMail(env, { message_id: mail.message_id, subject: mail.subject, text: mail.text, received_at: mail.received_at })\n}",
                 "probe": "email-inbound.roundtrip"
             }
         ],
@@ -1452,7 +1452,7 @@ export const capabilities = {
             {
                 "id": "email-sending.namespace-only",
                 "kind": "must",
-                "text": "Onboard a domain in the project's own namespace, for example mail.<id>.mccaskielabs.app. Project-owned zones such as wbprobe.com follow cf_zone_attach (step 6.1).",
+                "text": "Onboard a domain in the project's own namespace, for example mail.<id>.<projects domain> (the domain this install keeps its projects under). A domain the project owns follows cf_zone_attach (step 6.1).",
                 "enforced_by": "control",
                 "probe": "email-sending.onboard"
             },
@@ -1484,7 +1484,7 @@ export const capabilities = {
                 "half": "drill",
                 "expect": "pass",
                 "cost_hint_usd": 0,
-                "note": "cf_email_sending_onboard on mail.<id>.mccaskielabs.app; a second call changes nothing"
+                "note": "cf_email_sending_onboard on mail.<id>.<projects domain>; a second call changes nothing"
             },
             {
                 "id": "email-sending.status",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@mccaskie-labs/workbench-config",
-  "version": "0.1.40",
+  "version": "0.1.41",
   "description": "Workbench app configuration: WORKBENCH_ENV, typed variables that fail by name, secrets that are never printed, and the capabilities manifest.",
   "license": "UNLICENSED",
   "type": "module",