conduyt 1.6.0 → 1.8.0

package/README.md

@@ -39,6 +39,10 @@ conduyt search "acme corp"              # search across the CRM
 conduyt insights summary                # run an AI insight query
 conduyt privacy export <id>             # GDPR data-portability export (owner/admin)
 conduyt privacy forget <id> --confirm FORGET  # GDPR erasure — IRREVERSIBLE, owner only
+conduyt reply-capture status            # inbound reply capture: state, DNS records, provider health
+conduyt reply-capture setup             # create the receiving subdomain (--domain optional)
+conduyt reply-capture verify            # promote it to live once DNS is confirmed
+conduyt reply-capture remove --confirm REMOVE  # remove capture — replies to already-sent email are lost
 conduyt api GET /api/v1/companies       # raw authenticated request (escape hatch)
 conduyt config show                     # show resolved config (key masked)
 ```

package/dist/index.js

@@ -1666,6 +1666,54 @@ dialer
     .command("sync-local-presence")
     .description("Reconcile the Local Presence pool from Twilio. Only adopts numbers whose Twilio FriendlyName contains a standalone 'LP' (or 'LocalPres'), that are voice-capable, and that are US +1 E.164 — first 50 sorted matches; pool entries that no longer match are REMOVED. Name the number in Twilio first, then sync. Requires settings:edit")
     .action(run(async (client) => client.post("/api/v1/dialer/local-presence/sync", {})));
+// ---- reply capture (inbound email) ----
+// The receiving subdomain that makes replies to CRM email record and thread
+// against the contact. Same lifecycle as the sending domain: setup -> DNS ->
+// verify -> live, and the name MUST be a strict subdomain of the account's own
+// VERIFIED sending domain (that rule is the cross-tenant fence, not
+// formatting). Several non-2xx outcomes here are NORMAL, not retry loops:
+// 409 "already configured" (remove first), 409 "contact support to reconcile"
+// (an operator-repair state reachable only through a super-admin session
+// endpoint — an API key deliberately cannot fix it), 429 (per-account budget:
+// DNS takes minutes), and 503 (the shared provider allowance is busy with
+// customer sends — says nothing about the domain).
+const replyCapture = program
+    .command("reply-capture")
+    .description("Inbound reply capture: the receiving subdomain that threads email replies to contacts");
+replyCapture
+    .command("status")
+    .description("Show reply-capture state: configured/live, the capture domain and reply address, pending DNS records, and provider health. health='checking' means the provider is re-checking DNS and capture stays active; degraded=true means it can no longer receive and must be removed and set up again; needsSupport=true means an operator must reconcile it; cleanupPending=true means a previous removal did not finish at the provider — re-run `remove` to complete it. After a removal, draining=true (with drainEndsAt) means the drain window is open — a domain that was live at removal keeps receiving replies until it closes (one that was degraded has no such guarantee); parked=true means it is retired and inbound-inert. Either way that name is permanently unavailable — use suggestedDomain when setting up again")
+    .action(run(async (client) => client.get("/api/v1/email-domains/reply-capture")));
+replyCapture
+    .command("setup")
+    .description("Create the receiving subdomain at the email provider and return the DNS records to add. Requires a verified sending domain; the capture name must be a subdomain of it. Omit --domain to use the suggested reply.<sending-domain>. Add the records, then run `reply-capture verify`. A 409 can also mean the requested name belongs to a retired (drained/parked) domain — retired names are permanently unavailable, so use suggestedDomain from `reply-capture status` (e.g. reply2.<domain>) instead of retrying the old name")
+    .option("--domain <domain>", "capture subdomain, e.g. reply.acme.com (must be a subdomain of your verified sending domain)")
+    .action(run(async (client, opts) => {
+    const domain = opts.domain?.trim();
+    if (opts.domain !== undefined && !domain) {
+        fail("--domain must not be blank. Omit it entirely to use the suggested reply.<sending-domain>.");
+    }
+    // Sent only when supplied — an absent domain is how the API is told to
+    // use its suggestion.
+    return client.post("/api/v1/email-domains/reply-capture", domain ? { domain } : {});
+}));
+replyCapture
+    .command("verify")
+    .description("Check the pending capture domain's DNS and promote it to live once the provider confirms inbound receiving. verified=false with DNS record states is the expected answer while records propagate — poll sparingly, this is budgeted per account")
+    .action(run(async (client) => client.post("/api/v1/email-domains/reply-capture/verify", {})));
+replyCapture
+    .command("remove")
+    .description("Remove reply capture. Outcome depends on the domain's state. LIVE with a provider-backed setup: it DRAINS — the capture Reply-To stops on new email immediately, but the address keeps receiving for 30 days (drainEndsAt in the response) so late replies to already-sent emails still reach the contact's timeline; after that it parks, and the name is permanently retired (no account can ever set it up again — resuming capture means a NEW subdomain, see suggestedDomain on `reply-capture status`). LIVE legacy row with no stored provider id: removed immediately with NO drain — reply threading stops at once and the response says providerCleanup='manual' (an operator finishes the provider side); the name stays reusable. DEGRADED: drain lifecycle and permanent retirement, but receiving was already broken, so no 30-day delivery guarantee. PENDING setup, a domain the provider has already lost, or an interrupted-removal retry (cleanupPending): torn down immediately, the row is deleted, and the name stays reusable. Sending-domain removal stays blocked by every capture row except a released tombstone — pending/cleanup rows clear right here, but a draining/parked row keeps blocking until support releases it after the drain. Requires --confirm REMOVE")
+    // A VALUE, not a boolean flag: `--confirm false` on a boolean would read as
+    // true and delete anyway (same footgun the GDPR forget command guards).
+    .allowExcessArguments(false)
+    .option("--confirm <word>", "required — pass exactly REMOVE to authorize the removal (a provider-backed live/degraded name is permanently retired)")
+    .action(run(async (client, opts) => {
+    if (opts.confirm !== "REMOVE") {
+        fail("Refusing to remove: pass --confirm REMOVE to authorize this. Sending stops immediately, and a provider-backed live or degraded domain's name is permanently retired — there is no undo on the retirement (a legacy id-less live row instead stops threading at once).");
+    }
+    return client.del("/api/v1/email-domains/reply-capture");
+}));
 // ---- lifecycle (master lead status + intake deals) ----
 const lifecycle = program
     .command("lifecycle")

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "conduyt",
-  "version": "1.6.0",
-  "description": "Command-line interface for Conduyt CRM \u2014 manage contacts, deals, pipelines, and run insight queries from your terminal.",
+  "version": "1.8.0",
+  "description": "Command-line interface for Conduyt CRM — manage contacts, deals, pipelines, and run insight queries from your terminal.",
   "type": "module",
   "main": "dist/index.js",
   "bin": {
@@ -48,4 +48,4 @@
     "tsx": "^4.19.0",
     "@types/node": "^22.0.0"
   }
-}
+}