@softure-ai/mailing 0.1.10 → 0.1.12

package/CHANGELOG.md

@@ -4,6 +4,47 @@ Newest first. Each version lists what changed for an app that uses `@softure-ai/
 production, the version gets a line `verified in: <app>@<commit>` ([docs/05](../../docs/05-adoption-playbook.md),
 "Definition of done"). Versions before the first one below are described in their GitHub Releases (`mailing@x.y.z`).
 
+## 0.1.12
+
+- New `runDeliveries(ctx, { recipients, build }, { limit, pauseMs, dryRun, onDelivery })` (`/server`, and
+  `runDeliveries(input, options)` in `/next`): one `deliverOnce` per recipient, `build` returning the delivery or
+  `null` to skip. Stops at a refused account or a spent quota (`halted`, `remaining: null`), counts `limit` like
+  `sendCampaign`, and returns `DeliveryRunSummary` (`dryRun`, `recipients`, `skipped`, `sent`, `rejected` by code,
+  `done`, `inFlight`, `retryLater`, `uncertain`, `halted`, `remaining`). A dry run writes and sends nothing.
+- Migration `0005`: a SQL surface for the app's own queries, `mailing.recipient_key(text)` (equal to
+  `getRecipientKey`), `mailing.is_suppressed(text)`, `mailing.was_delivered(scope, text)`, and the views
+  `mailing.delivery_outcomes` and `mailing.suppressed_recipients`. Run `softure migrate`. Dropping
+  `mailing.deliveries` or `mailing.suppressions` now needs `CASCADE`.
+- New `previewMail(config, mail, { env })` (`/server`, `previewMail(mail)` in `/next`): exactly the
+  `ProviderMessage` `sendMail` would hand the provider, footer and RFC 8058 headers included, without sending,
+  logging or reading the database. New `maskAddress` and `redactUnsubscribeSignatures` for operator output.
+- `mailing({ testAddress })` and `softure-mail test [<content-file>] [--kind <kind>] [--preview]`: sends a fixed
+  test mail, or a campaign's content outside the ledger, to that address only.
+- `softure-mail campaign`: the dry run prints the mail as the test address gets it (addresses masked, link
+  signatures redacted); `--content-file <file>` names the content file for `softure-deploy run`, which the README
+  documents. `getCampaignProblems(content, config)` also refuses a body with a pasted unsubscribe link or footer, and
+  `sendCampaign`, `planCampaign` and the command refuse such content.
+- `mailing({ kindAliases: { news: "newsletter" } })` and `resolveMailKind(config, kind)`: campaign files and
+  `softure-mail test --kind` may name a kind by its alias.
+- `checkSenderDns(domain, { inbound: "cloudflare" })` and `softure-mail dns --inbound cloudflare`: Cloudflare Email
+  Routing's MX and one SPF record including `_spf.mx.cloudflare.net` on the reply-to domain (else the checked
+  domain). New finding `missing-include`, new report key `inbound` (`[]` when not asked), new `CLOUDFLARE_INBOUND`.
+  Code that builds a `SenderDnsReport` by hand must add `inbound`.
+- `legacyUnsubscribe.verify(values, ctx, env)` receives the environment `unsubscribe` runs with.
+- New `createUnsubscribePage({ classNames, unstyled, Layout })` in `/next`: slots `root`, `card`, `form`, `submit`,
+  or the app's own layout around the copy and the form. `UnsubscribePage` is unchanged.
+- New `findSuppressedAddresses(ctx, addresses)` (`/server`): which of many addresses unsubscribed, each
+  returned as given, in batched queries; for reports such as the waitlist's suppressed split (#324).
+
+## 0.1.11
+
+- `sendCampaign(ctx, input, { limit })` hands at most `limit` mails to the provider in one run (sent, rejected by it,
+  or not taken now); done, unsubscribed, filtered, in-flight and uncertain recipients do not count. `limit` must be a
+  whole number of at least 1 (`RangeError` otherwise). `softure-mail campaign --limit <n>` passes it, exits 0 when
+  the limit cut the run, and its dry run prints what one limited run would send.
+- `CampaignSummary.remaining` (new, required): recipients past the cut that the next run would send to; `0` when the
+  run reached the end of the list, `null` when it halted. Code that builds a summary by hand must add it.
+
 ## 0.1.10
 
 - `OutgoingMail.replyTo`: an optional reply-to address for one mail (exactly one address, checked like `to`, failure

package/README.md

@@ -31,7 +31,8 @@ can be imported into it, and `softure-mail` sends campaigns from a content file.
   when the recipient unsubscribed. An unsubscribe covers every list kind.
 - The unsubscribe page (`/unsubscribe`) and the one-click route (`/api/mailing/unsubscribe`) in `/next`,
   each mounted with one line (section 4).
-- `@softure-ai/mailing/server`: `isSuppressed(ctx, address)`, `suppressRecipient(ctx, address)` (for
+- `@softure-ai/mailing/server`: `isSuppressed(ctx, address)`, `findSuppressedAddresses(ctx, addresses)`
+  (which of many addresses unsubscribed, for a report), `suppressRecipient(ctx, address)` (for
   scripts, bounce or complaint handlers), `unsubscribe(ctx, link, source)` (a link from
   `readUnsubscribeLink(params, config)`, or a bare token),
   `liftSuppression(ctx, address)` (a new explicit consent lifts the person's own opt-out),
@@ -41,11 +42,18 @@ can be imported into it, and `softure-mail` sends campaigns from a content file.
   adopted the module working (section 10).
 - **Sending once.** `deliverOnce(ctx, { scope, mail })` (`/server`, and `deliverOnce({ scope, mail })`
   in `/next`) sends a mail at most once per scope and recipient through the delivery ledger;
+  `runDeliveries` does it for a whole list of recipients, with a limit, a pause and a dry run;
   `importDeliveries` (and `softure-mail import`) seeds it with the app's earlier history.
+- **Preview and test send.** `previewMail(config, mail)` returns exactly what `sendMail` hands the
+  provider; `softure-mail test` sends a mail to the configured `testAddress` and nowhere else.
+- **A SQL surface** for the app's own queries: `mailing.recipient_key(address)`,
+  `mailing.is_suppressed(address)`, `mailing.was_delivered(scope, address)` and the views
+  `mailing.delivery_outcomes` and `mailing.suppressed_recipients` (section 5).
 - **Campaigns.** `sendCampaign`, `planCampaign` and the content file parser in `/server`; the
   `softure-mail campaign` command sends a campaign from a content file.
 - **Sender DNS.** `checkSenderDns(domain)` and `softure-mail dns` report SPF, DKIM and DMARC, hold DMARC to a
-  required minimum, and check the reply-to domain's MX and the provider's return-path hosts.
+  required minimum, and check the reply-to domain's MX, the provider's return-path hosts and an inbound
+  service (Cloudflare Email Routing).
 - The `MailProvider` contract and `resend()`, the first adapter.
 - `@softure-ai/mailing/testing`: `fakeMailProvider()` and `readMailOutbox(file)`.
 
@@ -145,6 +153,45 @@ const outcome = await deliverOnce({
   claim cannot overwrite the one that took over.
 - A malformed scope or kind throws (a bug); a database failure propagates.
 
+### Many recipients at once: `runDeliveries`
+
+Lifecycle mail (a trial that ends, a renewal) goes to every recipient a query finds, each at most
+once. `runDeliveries` loops over the recipients, builds each one's delivery and sends it through
+`deliverOnce`:
+
+```ts
+import { runDeliveries } from "@softure-ai/mailing/next"; // or /server with ctx first
+
+const summary = await runDeliveries(
+  {
+    recipients: await listTrialsEndingThisWeek(),
+    build: (trial) => (trial.email === null ? null : {
+      scope: `billing.trial-ending:${trial.subscriptionId}`,
+      mail: { to: trial.email, subject: messages.trialEnding.subject, text: renderText(trial), kind: "account-notices" },
+    }),
+  },
+  { limit: 80, pauseMs: 500 },
+);
+// { dryRun, recipients, skipped, sent, rejected: { "mailing.suppressed": 1, … }, done, inFlight, retryLater,
+//   uncertain, halted, remaining }
+```
+
+- `recipients` is an iterable or async iterable of anything; `build` returns the delivery (or a
+  promise of it), or `null` to skip the recipient (`skipped`, nothing stored).
+- **It stops at the account.** A refused key or a spent quota (`halted`) ends the run at once:
+  `halted: { reason, httpStatus }`, `remaining: null`; that recipient and the rest go out on the
+  next run. Rejections of one mail (`suppressed`, `rejected`, `invalid_input`) are counted and the
+  run goes on.
+- **`limit`** counts the mails handed to the provider, like `sendCampaign`'s; once reached, the rest
+  of the list is only counted: `remaining` is how many the next run would send. **`pauseMs`**
+  pauses after each of those mails.
+- **`dryRun: true`** reads the ledger and the suppression list and checks each mail, and writes and
+  sends nothing: `sent` is then what would reach the provider.
+- List mail needs `MAILING_UNSUBSCRIBE_SECRET`: without it the run throws at the first list mail,
+  before any claim, instead of using up every recipient's attempts.
+- `onDelivery(outcome)` sees every outcome (never the address); `deliverOnce`'s options
+  (`maxAttempts`, `retakeUncertain`, the claim windows) pass through.
+
 ### Importing an existing history
 
 An app that already kept its own once-only records (which campaign went to which signup, which
@@ -204,10 +251,25 @@ we shipped something.
 ```
 
 ```bash
-softure-mail campaign launch.md --recipients recipients.txt --dry-run   # counts, sends nothing
+softure-mail campaign launch.md --recipients recipients.txt --dry-run   # counts and previews, sends nothing
 softure-mail campaign launch.md --recipients recipients.txt              # sends
 ```
 
+- **The dry run previews the mail** as the provider would get it: sender, reply-to, subject, the
+  RFC 8058 headers, the text and HTML bodies with the footer. It is rendered for `testAddress`
+  (else `recipient@example.com`), with addresses masked (`o*******@example.com`) and the link
+  signatures replaced by `<signature>`, so the output is safe to paste. Without
+  `MAILING_UNSUBSCRIBE_SECRET` it says so instead.
+- **No pasted footers.** Content that carries an unsubscribe link (the app's unsubscribe or one-click
+  path, or a signed `r=…&t=…` pair) or the footer's copy in any locale is refused before anything
+  runs: the module adds a footer signed for each recipient, and a link pasted from a sent mail would
+  let every recipient unsubscribe the person it was signed for. `getCampaignProblems(content, config)`
+  runs the same check (links on the app's own origin; a link to another site is left alone), and
+  `sendCampaign` and `planCampaign` refuse such content.
+- **Kind aliases.** `mailing({ kindAliases: { news: "newsletter" } })` lets a content file (and
+  `softure-mail test --kind`) say `kind: news`; the campaign is stored and sent as `newsletter`.
+- **Masked output.** No command prints a full address or a working unsubscribe link.
+
 - The recipients file holds one address per line (`#` comments and blank lines skipped).
 - **Recipients from the database.** Without `--recipients` the command asks
   `mailing({ listCampaignRecipients })`, which lists the addresses from the app's own data
@@ -228,6 +290,28 @@ softure-mail campaign launch.md --recipients recipients.txt              # sends
   ```
 
   With the content on standard input, its `html:` file is looked up in the working directory.
+- **Through `softure-deploy run`.** An app deployed with `@softure-ai/deploy` runs the command in the
+  live container without a shell on the server. `softure-deploy run` passes only `--key=value`
+  words, so the content file goes as `--content-file=<file>` (read on the operator's machine and sent
+  on standard input) and the recipients come from `listCampaignRecipients`. One file travels per
+  run, so such a campaign has no `html:` file. One runner per command in `scripts/ops/`, which the
+  app's Dockerfile bundles into `ops/<name>.mjs`:
+
+  ```ts
+  // scripts/ops/mail-campaign.ts
+  import { runMailCli } from "@softure-ai/mailing/cli";
+  import config from "../../softure.config";
+
+  process.exitCode = await runMailCli({ config, argv: ["campaign", ...process.argv.slice(2)] });
+  ```
+
+  ```bash
+  softure-deploy run --host=app-prod mail-campaign --content-file=launch.md --dry-run
+  softure-deploy run --host=app-prod mail-campaign --content-file=launch.md --limit=80
+  softure-deploy run --host=app-prod mail-test --content-file=launch.md   # scripts/ops/mail-test.ts: argv ["test", ...]
+  ```
+
+  The exit status is the command's: 0 done, 1 failed or incomplete, 2 usage.
 - The command loads `softure.config.*` like `softure migrate` (or `--config <file>`), opens the
   config's `database.handle` when set, otherwise its own connection on `database.url`, and needs `MAILING_UNSUBSCRIBE_SECRET` (campaigns are list
   mail). Run `softure migrate` first.
@@ -249,6 +333,15 @@ softure-mail campaign launch.md --recipients recipients.txt              # sends
 - **A refused key or a spent quota stops the run** at the first such answer: the command prints why
   (with the HTTP status) and exits 1; that recipient and every one after it are left for the next
   run. `sendCampaign` returns the same as `halted: { reason, httpStatus }`.
+- **Instalments with `--limit <n>`.** On a plan whose daily quota is shared with other mail (Resend's
+  free plan gives 100 a day), `--limit 80` hands at most 80 mails to the provider in this run and
+  leaves room for the day's transactional mail. Only mails that reach the provider count (sent,
+  rejected by it, or not taken now); done, unsubscribed, filtered, in-flight and uncertain recipients
+  never use a slot. The command prints `limit reached: <n> recipient(s) left for the next run` and
+  exits 0; run it again the next day. With `--dry-run` it also prints what one limited run would
+  send. `sendCampaign(ctx, input, { limit: 80 })` does the same and returns `remaining` (recipients
+  past the cut that the next run would send to, counted like `planCampaign`'s `toSend`, one
+  suppression lookup per address; `0` when the run reached the end of the list, `null` after a halt).
 - **Re-runs are safe.** Recipients with an outcome are skipped; the command exits 1 while some have
   none yet (`retry later`, `in flight`): run the same command again. It also exits 1 for `uncertain`
   recipients (an interrupted send older than `uncertainClaimMs`) and names `--resend-uncertain`. `mailing.campaigns` pins the
@@ -257,6 +350,31 @@ softure-mail campaign launch.md --recipients recipients.txt              # sends
   `runMailCli({ config, argv })` from `@softure-ai/mailing/cli`, or `sendCampaign(ctx, { campaign,
   recipients })` from `/server`, where `recipients` may be an async iterable.
 
+### Test send: `softure-mail test`
+
+```bash
+softure-mail test                         # a short fixed mail, transactional
+softure-mail test --kind newsletter       # the same as list mail: footer and unsubscribe headers
+softure-mail test launch.md               # a campaign's content, as the campaign would send it
+softure-mail test launch.md --preview     # print it, send nothing
+```
+
+It sends to `mailing({ testAddress })` and to no one else; without that option it refuses. A
+campaign file is sent outside the ledger (nothing is registered or recorded), so it can be sent
+again after every edit. `--kind` (an alias of `kindAliases` too) overrides the file's kind; list
+mail opens the database for the suppression check, so an unsubscribed test address answers
+`suppressed`. The output masks the address and names the provider's failure with its HTTP status.
+`--preview` prints what `previewMail` returns, like the campaign's dry run. The preview reads the
+secret from `runMailCli({ env })`, a real send from `process.env`, as every send does.
+
+`previewMail(config, mail, { env, idempotencyKey })` (`/server`, and `previewMail(mail)` in `/next`) is
+the function behind both: `ok(message)` with exactly the `ProviderMessage` `sendMail` would hand the
+provider, `{ error: "mailing.invalid_input", fields }`, or `{ error: "mailing.unavailable", cause:
+"no_unsubscribe_secret" }` for list mail without the secret. It sends, logs and reads nothing: a
+suppressed recipient's mail renders too. Its links work for `mail.to`; show them to that person
+only, or pass the text through `redactUnsubscribeSignatures`. `maskAddress(address)` masks an
+address the same way the commands do.
+
 ### Sender DNS check: `softure-mail dns`
 
 ```bash
@@ -283,6 +401,11 @@ It reports each check as `pass`, `warn` or `fail`, exiting 1 on any `fail`:
   be a CNAME (to `targetDomain` or under it, when set) or have MX records. `resendReturnPath(domain)` (the flag) gives
   Resend's `send.<domain>` and `rsend.<domain>` with target `rmta.net`; a domain Resend set up with MX records on
   `send` and no `rsend` checks `--return-path send.<domain>` alone.
+- **INBOUND** (`inbound: "cloudflare"`, `--inbound cloudflare`): Cloudflare Email Routing receives the reply-to
+  domain's mail (else the checked domain's). Every MX record must be under `mx.cloudflare.net`
+  (`unexpected-target` otherwise, `null-mx`, `missing`), and the domain must publish exactly one SPF record
+  (`multiple`) that includes `_spf.mx.cloudflare.net` (`missing-include`). The report's `inbound` holds the MX and
+  the SPF check, `[]` when not asked.
 
 It cannot see whether the provider signs with the published key. The function takes `resolveTxt`, `resolveMx` and
 `resolveCname` for tests; by default it asks the system resolver.
@@ -323,6 +446,8 @@ mailing({
 | `maxAttempts` | `number \| null` | `5` | Claims before `mailing.unavailable` closes a delivery as rejected, 1 to 100; `null` never closes it (section 1, Retries). |
 | `staleClaimMs` | `number` | `900000` (15 min) | How long a delivery claim may stay open before another sender takes it over. 1 minute to 23 hours. |
 | `uncertainClaimMs` | `number` | `82800000` (23 h) | How old a claim may get before it waits for an operator (`uncertain`). More than `staleClaimMs`, at most 30 days; keep it under the provider's idempotency window. |
+| `testAddress` | `string` | none | The only address `softure-mail test` sends to (section 1, Test send). |
+| `kindAliases` | `Record<string, string>` | none | Alias to kind for campaign files and `softure-mail test --kind`, e.g. `{ news: "newsletter" }`. Kebab-case on both sides; an alias never names a kind another alias points at. |
 | `routes` | `{ unsubscribe?, oneClick? }` | `/unsubscribe`, `/api/mailing/unsubscribe` | Where you mount the page and the route; links are built on `appOrigin` plus these paths. |
 
 `resend({ apiKey?, endpoint?, fetch? })`: without `apiKey` it reads `RESEND_API_KEY` on every send,
@@ -363,6 +488,28 @@ export { UnsubscribePage as default } from "@softure-ai/mailing/next";
 export { getUnsubscribeRoute as GET, postUnsubscribeRoute as POST } from "@softure-ai/mailing/next";
 ```
 
+**The app's look.** `createUnsubscribePage({ classNames, unstyled, Layout })` gives the same page
+with the app's classes on its slots (`root`, the `main` wrapper; `card`; `form`; `submit`), or with
+its own layout around the copy and the form (the `root` and `card` classes then do not apply; the
+`referrer` policy tag is kept):
+
+```tsx
+// app/unsubscribe/page.tsx
+import { createUnsubscribePage, type UnsubscribeLayoutProps } from "@softure-ai/mailing/next";
+
+function AppShell({ title, lead, children }: UnsubscribeLayoutProps) {
+  return (
+    <SiteFrame>
+      <h1>{title}</h1>
+      <p>{lead}</p>
+      {children}
+    </SiteFrame>
+  );
+}
+
+export default createUnsubscribePage({ Layout: AppShell, classNames: { submit: "w-full" } });
+```
+
 Both must stay public: keep them out of the auth guard's `protect` list. The route has no per-IP
 rate limit on purpose: mail providers post from a few shared addresses that act for millions of
 people, so a bucket would refuse real unsubscribes; the signature is checked before any database
@@ -383,6 +530,31 @@ Schema `mailing`, applied by `softure migrate`:
 | | `mailing.deliveries` | primary key (`scope`, `recipient_key`), `kind`, `campaign_id` (then `scope` is `campaign:<id>`), `status` (`pending`, `claimed`, `sent`, `rejected`), `attempts`, `claimed_at`, `finished_at`, `provider_message_id` (exactly when sent; see `0004`), `reason` (exactly when rejected). |
 | `0003_add_delivery_provider_status.sql` | `mailing.deliveries` | `provider_status` (the HTTP status of the last failed or released answer, 100 to 599, else null); `attempts` may be 0 on a `pending` row (a halt gave its attempt back). |
 | `0004_allow_imported_deliveries.sql` | `mailing.deliveries` | `imported_at` (set by `importDeliveries`, only on `sent`/`rejected` rows); `provider_message_id` only on `sent` rows, and required there unless the row was imported. |
+| `0005_add_sql_surface.sql` | functions and views | the SQL surface below. |
+
+**SQL for the app's own queries.** Reports and recipient selections use these, never the tables,
+so a later change to the tables does not silently break them:
+
+| Name | What it gives |
+| --- | --- |
+| `mailing.recipient_key(address text) → text` | `getRecipientKey` in SQL: base64url SHA-256 of the trimmed, lowercased address. IMMUTABLE, so it can sit in an index on the app's table. |
+| `mailing.is_suppressed(address text) → boolean` | whether the address unsubscribed from list mail |
+| `mailing.was_delivered(scope text, address text) → boolean` | whether a mail of that scope was sent to the address (sent by the module or imported) |
+| view `mailing.delivery_outcomes` | `scope`, `recipient_key`, `kind`, `campaign_id`, `status` (`pending`, `claimed`, `sent`, `rejected`), `attempts`, `claimed_at`, `finished_at`, `imported_at` |
+| view `mailing.suppressed_recipients` | `recipient_key`, `source` (`one-click`, `page`, `operator`), `created_at` |
+
+```sql
+-- trials ending this week that were not told yet and did not unsubscribe
+select s.id, u.email
+from subscriptions s join users u on u.id = s.user_id
+where s.trial_ends_at < now() + interval '7 days'
+  and not mailing.was_delivered('billing.trial-ending:' || s.id, u.email)
+  and not mailing.is_suppressed(u.email);
+```
+
+`lower()` follows the database's ctype: under a UTF-8 locale it lowercases like JavaScript, under the
+`C` locale only ASCII letters, so an address with non-ASCII capitals then keys differently in SQL.
+The functions and views are granted like the tables (the app role reads them).
 
 The health check (`checkMailingTables`) runs `select 1 from mailing.<table> limit 0` for the three
 tables.
@@ -407,7 +579,8 @@ None.
 ## 8. Appearance
 
 The unsubscribe page is a `Card` from `@softure-ai/ui` with a plain form (no client JavaScript),
-styled by the app's tokens.
+styled by the app's tokens. `createUnsubscribePage({ classNames, unstyled, Layout })` adds the app's
+classes or its own layout (section 4).
 
 ## 9. Copy
 
@@ -443,7 +616,10 @@ also names ones it may carry, for an app that sent more than one form on the sam
 names in all, at least one required). A link without `r` that carries every required one
 (non-empty, at most 512 characters) is a legacy link, and its values also hold the optional ones it
 has (an empty one counts as absent, one over 512 characters makes the link invalid): the page shows the same button with the values in hidden fields,
-and the action and the one-click POST call `verify(values, ctx)`. It returns the recipient's
+and the action and the one-click POST call `verify(values, ctx, env)`. `env` is the environment the
+unsubscribe runs with (`process.env` in the page and the route; `unsubscribe(ctx, link, source, env)`
+passes its own), so `verify` reads the old signing key from it and a test hands it one without
+stubbing `process.env`. It returns the recipient's
 **address** when the link is genuine, else `null`; the module records the opt-out under that
 address's key and runs `onUnsubscribed`, exactly as for its own links. `verify` must check the
 link's signature itself (in constant time): whatever address it returns is unsubscribed. A throw is
@@ -454,7 +630,7 @@ page and route at the old paths too:
 mailing({
   from: "…",
   provider: resend(),
-  legacyUnsubscribe: { params: ["u", "t"], verify: ({ u, t }, ctx) => verifyOldLink(ctx.db, u, t) },
+  legacyUnsubscribe: { params: ["u", "t"], verify: ({ u, t }, ctx, env) => verifyOldLink(ctx.db, env.OLD_UNSUBSCRIBE_KEY, u, t) },
 }),
 
 // app/old-unsubscribe/page.tsx
@@ -481,9 +657,10 @@ mailing({
 ```
 
 **`liftSuppression(ctx, address)`** is the other direction: a module that has just recorded a new
-explicit consent (the waitlist's sign-up) calls it in that consent's transaction. It deletes the
-row only when its source is `page` or `one-click`; an `operator` row stays. It returns whether it
-lifted one.
+explicit consent calls it in that consent's transaction. The consent must be provably the
+recipient's (the waitlist calls it only when a sign-up's confirmation link is used, never for an
+address typed into a form). It deletes the row only when its source is `page` or `one-click`; an
+`operator` row stays. It returns whether it lifted one.
 
 **Tests and e2e:** `fakeMailProvider()` keeps accepted mail in `provider.sent` (with the id it
 answered) and honours idempotency keys like a real provider. `respond: (message) => ({ status:
@@ -511,7 +688,7 @@ personal data. So the module neither exports nor deletes per user (`privacy: { e
   bounce or complaint webhooks yet.
 - Campaigns have no personalisation, scheduling or markdown: the body is sent as written.
 - Suppression is global per address: no per-list preferences. A person comes back in through a
-  module's explicit consent (`liftSuppression`, e.g. a new waitlist sign-up); an operator row is
+  module's explicit consent (`liftSuppression`, e.g. a confirmed waitlist sign-up); an operator row is
   removed by hand (`getRecipientKey(address)`).
 - Lowercasing the whole address merges `Ada@` and `ada@` (allowed to differ by RFC 5321, never in
   practice); an unsubscribe then covers both.

package/dist/cli/run.d.ts

@@ -7,7 +7,7 @@ export interface CliOutput {
     readonly error: (line: string) => void;
 }
 export interface RunMailCliOptions {
-    /** The app's config. Needed by `campaign` and `import`, and by `dns` without `--domain`. */
+    /** The app's config. Needed by `campaign`, `test` and `import`, and by `dns` without `--domain`. */
     readonly config?: SoftureConfig;
     /** The arguments after the executable, e.g. `["campaign", "launch.md", "--recipients", "list.txt"]`. */
     readonly argv: readonly string[];

package/dist/cli/run.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"run.d.ts","sourceRoot":"","sources":["../../src/cli/run.ts"],"names":[],"mappings":"AAWA,OAAO,EAAe,KAAK,aAAa,EAA8B,MAAM,kBAAkB,CAAC;AAE/F,OAAO,EAA6C,KAAK,cAAc,EAAE,MAAM,gBAAgB,CAAC;AAIhG,OAAO,EAAkI,KAAK,YAAY,EAAE,KAAK,SAAS,EAAE,KAAK,UAAU,EAAuB,MAAM,kBAAkB,CAAC;AAG3O,OAAO,EAAiF,KAAK,GAAG,EAAE,MAAM,+BAA+B,CAAC;AAExI,MAAM,WAAW,SAAS;IACxB,QAAQ,CAAC,GAAG,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,IAAI,CAAC;IACrC,QAAQ,CAAC,KAAK,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,IAAI,CAAC;CACxC;AAED,MAAM,WAAW,iBAAiB;IAChC,4FAA4F;IAC5F,QAAQ,CAAC,MAAM,CAAC,EAAE,aAAa,CAAC;IAChC,wGAAwG;IACxG,QAAQ,CAAC,IAAI,EAAE,SAAS,MAAM,EAAE,CAAC;IACjC,mEAAmE;IACnE,QAAQ,CAAC,GAAG,CAAC,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,MAAM,CAAC,EAAE,SAAS,CAAC;IAC5B,iIAAiI;IACjI,QAAQ,CAAC,YAAY,CAAC,EAAE,CAAC,GAAG,EAAE,MAAM,KAAK,OAAO,CAAC,cAAc,CAAC,CAAC;IACjE,QAAQ,CAAC,UAAU,CAAC,EAAE,UAAU,CAAC;IACjC,QAAQ,CAAC,SAAS,CAAC,EAAE,SAAS,CAAC;IAC/B,QAAQ,CAAC,YAAY,CAAC,EAAE,YAAY,CAAC;IACrC,QAAQ,CAAC,KAAK,CAAC,EAAE,CAAC,EAAE,EAAE,MAAM,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;IAC/C,QAAQ,CAAC,GAAG,CAAC,EAAE,GAAG,CAAC;IACnB,sFAAsF;IACtF,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,OAAO,CAAC,MAAM,CAAC,CAAC;CAC5C;AAED,eAAO,MAAM,OAAO,IAAI,CAAC;AACzB,eAAO,MAAM,WAAW,IAAI,CAAC;AAC7B,eAAO,MAAM,UAAU,IAAI,CAAC;AAE5B,8EAA8E;AAC9E,eAAO,MAAM,gBAAgB,MAAM,CAAC;AAEpC,eAAO,MAAM,UAAU,QA6C8C,CAAC;AAqCtE,yGAAyG;AACzG,wBAAsB,UAAU,CAAC,OAAO,EAAE,iBAAiB,GAAG,OAAO,CAAC,MAAM,CAAC,CAmB5E"}
+{"version":3,"file":"run.d.ts","sourceRoot":"","sources":["../../src/cli/run.ts"],"names":[],"mappings":"AAWA,OAAO,EAAe,KAAK,aAAa,EAA8B,MAAM,kBAAkB,CAAC;AAE/F,OAAO,EAA6C,KAAK,cAAc,EAAE,MAAM,gBAAgB,CAAC;AAKhG,OAAO,EAAkI,KAAK,YAAY,EAAE,KAAK,SAAS,EAAE,KAAK,UAAU,EAAuB,MAAM,kBAAkB,CAAC;AAK3O,OAAO,EAAiF,KAAK,GAAG,EAAE,MAAM,+BAA+B,CAAC;AAExI,MAAM,WAAW,SAAS;IACxB,QAAQ,CAAC,GAAG,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,IAAI,CAAC;IACrC,QAAQ,CAAC,KAAK,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,IAAI,CAAC;CACxC;AAED,MAAM,WAAW,iBAAiB;IAChC,oGAAoG;IACpG,QAAQ,CAAC,MAAM,CAAC,EAAE,aAAa,CAAC;IAChC,wGAAwG;IACxG,QAAQ,CAAC,IAAI,EAAE,SAAS,MAAM,EAAE,CAAC;IACjC,mEAAmE;IACnE,QAAQ,CAAC,GAAG,CAAC,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,MAAM,CAAC,EAAE,SAAS,CAAC;IAC5B,iIAAiI;IACjI,QAAQ,CAAC,YAAY,CAAC,EAAE,CAAC,GAAG,EAAE,MAAM,KAAK,OAAO,CAAC,cAAc,CAAC,CAAC;IACjE,QAAQ,CAAC,UAAU,CAAC,EAAE,UAAU,CAAC;IACjC,QAAQ,CAAC,SAAS,CAAC,EAAE,SAAS,CAAC;IAC/B,QAAQ,CAAC,YAAY,CAAC,EAAE,YAAY,CAAC;IACrC,QAAQ,CAAC,KAAK,CAAC,EAAE,CAAC,EAAE,EAAE,MAAM,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;IAC/C,QAAQ,CAAC,GAAG,CAAC,EAAE,GAAG,CAAC;IACnB,sFAAsF;IACtF,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,OAAO,CAAC,MAAM,CAAC,CAAC;CAC5C;AAED,eAAO,MAAM,OAAO,IAAI,CAAC;AACzB,eAAO,MAAM,WAAW,IAAI,CAAC;AAC7B,eAAO,MAAM,UAAU,IAAI,CAAC;AAE5B,8EAA8E;AAC9E,eAAO,MAAM,gBAAgB,MAAM,CAAC;AAEpC,eAAO,MAAM,UAAU,QAgEwD,CAAC;AAmDhF,yGAAyG;AACzG,wBAAsB,UAAU,CAAC,OAAO,EAAE,iBAAiB,GAAG,OAAO,CAAC,MAAM,CAAC,CAqB5E"}