@cosmicdrift/kumiko-bundled-features 0.348.1 → 0.350.0

package/dist/channel-email/email-channel.js

@@ -78,13 +78,15 @@ export function createEmailChannel(options) {
             title: message.title,
             body: message.body,
         };
-        const html = await renderer.render({
+        const rendererInput = {
             template: message.notificationType,
             variables,
             locale: message.locale,
-        });
+        };
+        const html = await renderer.render(rendererInput);
+        const text = renderer.renderText ? await renderer.renderText(rendererInput) : undefined;
         const subject = variables["subject"] ?? message.title; // @cast-boundary dynamic-key
-        return { html, subject };
+        return { html, subject, ...(text !== undefined && { text }) };
     }
     return {
         name: "email",
@@ -101,9 +103,15 @@ export function createEmailChannel(options) {
             return renderMessage(message);
         },
         async send(address, message, _ctx, rendered) {
-            const { html, subject } = rendered ?? (await renderMessage(message));
+            const { html, subject, text } = rendered ?? (await renderMessage(message));
             const envelope = emailEnvelopeFrom(message.data);
-            await transport.send(guardEmailMessage({ to: address, subject, html, ...envelope }));
+            await transport.send(guardEmailMessage({
+                to: address,
+                subject,
+                html,
+                ...(text !== undefined && { text }),
+                ...envelope,
+            }));
             return { status: "sent", address };
         },
     };

package/dist/channel-email/pii-guard.js

@@ -28,7 +28,9 @@ export function guardEmailMessage(message) {
                 `("${PII_CIPHERTEXT_PREFIX}…") — decrypt the stored value before mailing (decryptStoredPii).`);
         }
     }
-    const leaking = message.subject.includes(CIPHERTEXT_MARKER) || message.html.includes(CIPHERTEXT_MARKER);
+    const leaking = message.subject.includes(CIPHERTEXT_MARKER) ||
+        message.html.includes(CIPHERTEXT_MARKER) ||
+        message.text?.includes(CIPHERTEXT_MARKER) === true;
     if (!leaking)
         return message;
     const detail = "[channel-email] mail subject/body contains a PII ciphertext " +
@@ -41,6 +43,9 @@ export function guardEmailMessage(message) {
         ...message,
         subject: message.subject.replace(CIPHERTEXT_RE, "[pii-redacted]"),
         html: message.html.replace(CIPHERTEXT_RE, "[pii-redacted]"),
+        ...(message.text !== undefined && {
+            text: message.text.replace(CIPHERTEXT_RE, "[pii-redacted]"),
+        }),
     };
 }
 export function withPiiCiphertextGuard(transport) {

package/dist/channel-email/smtp-transport.js

@@ -54,6 +54,7 @@ export function createSmtpTransport(options) {
                 to: message.to,
                 subject: message.subject,
                 html: message.html,
+                ...(message.text !== undefined && { text: message.text }),
                 ...(message.replyTo && { replyTo: message.replyTo }),
                 ...(message.headers && { headers: message.headers }),
             });

package/dist/channel-email/types.d.ts

@@ -2,6 +2,7 @@ export type EmailMessage = {
     readonly to: string;
     readonly subject: string;
     readonly html: string;
+    readonly text?: string;
     readonly from?: string;
     readonly fromName?: string;
     readonly replyTo?: string;

package/dist/delivery/jobs.js

@@ -28,7 +28,9 @@ const renderJobPayloadSchema = z.object({
     message: channelMessageSchema,
 });
 const sendJobPayloadSchema = renderJobPayloadSchema.extend({
-    rendered: z.object({ html: z.string(), subject: z.string() }).optional(),
+    rendered: z
+        .object({ html: z.string(), subject: z.string(), text: z.string().optional() })
+        .optional(),
 });
 function requireTenantScopedDeps(ctx, tenantId) {
     const registry = ctx.registry;

package/dist/delivery/types.d.ts

@@ -26,6 +26,7 @@ export type ChannelResult = {
 export type RenderedMessage = {
     readonly html: string;
     readonly subject: string;
+    readonly text?: string;
 };
 export declare const DELIVERY_CHANNEL_MODES: readonly ["inline", "queued"];
 export type DeliveryChannelMode = (typeof DELIVERY_CHANNEL_MODES)[number];
@@ -44,6 +45,8 @@ export type RendererInput = {
 export type NotificationRenderer = {
     readonly name: string;
     render(input: RendererInput): Promise<string>;
+    /** Plain-text version of the same mail; the email channel sends it as the text part of a multipart/alternative mail. */
+    renderText?(input: RendererInput): Promise<string>;
 };
 export type DeliveryLogEntry = {
     readonly tenantId: TenantId;

package/dist/metrics/compute.d.ts

@@ -7,6 +7,8 @@ export type MetricRunParams = {
     readonly range: MetricRange;
     readonly timeZone: string;
     readonly now: Temporal.Instant;
+    /** Payload-driven narrowing (MetricDefinition.filters); scopeWhere wins on conflicts. */
+    readonly filterWhere: WhereObject;
     /** Extra filter that narrows the source to the caller's scope. */
     readonly scopeWhere: WhereObject;
 };

package/dist/metrics/compute.js

@@ -18,8 +18,8 @@ function fractionOf(value, total) {
         return 0;
     return Math.min(1, Math.max(0, value / total));
 }
-function buildWheres(metric, window, scopeWhere) {
-    const baseWhere = { ...metric.where, ...scopeWhere };
+function buildWheres(metric, window, filterWhere, scopeWhere) {
+    const baseWhere = { ...metric.where, ...filterWhere, ...scopeWhere };
     const { timeField } = metric;
     if (timeField === undefined || window === undefined) {
         return { current: baseWhere, previous: undefined };
@@ -112,7 +112,7 @@ export async function runMetric(db, metric, params) {
     const bucketDimension = timeField !== undefined && bucket !== undefined
         ? { field: timeField, bucket, timeZone: params.timeZone }
         : undefined;
-    const wheres = buildWheres(metric, window, params.scopeWhere);
+    const wheres = buildWheres(metric, window, params.filterWhere, params.scopeWhere);
     const aggregates = await fetchAggregates(db, metric, wheres, bucketDimension);
     const value = aggregates.total[0]?.value ?? null;
     const previousValue = aggregates.previous?.[0]?.value ?? null;

package/dist/metrics/feature.js

@@ -4,6 +4,7 @@ import { Temporal } from "temporal-polyfill";
 import * as z from "zod";
 import { runMetric } from "./compute.js";
 import { METRIC_RANGES, METRICS_FEATURE, METRICS_SYSTEM_FEATURE, } from "./constants.js";
+import { metricFilterPayloadShape, metricFilterWhere, resolveMetricFilterWhere, } from "./filters.js";
 import { METRICS_I18N } from "./i18n.js";
 import { metricHasTenantColumn, validateMetrics } from "./validate.js";
 import { isValidTimeZone } from "./window.js";
@@ -17,12 +18,20 @@ const invalidTimeZone = {
     path: ["timeZone"],
     message: "Unknown IANA time zone",
 };
-const tenantPayloadSchema = z
-    .object(windowFields)
-    .refine((payload) => isValidTimeZone(payload.timeZone), invalidTimeZone);
-const systemPayloadSchema = z
-    .object({ ...windowFields, tenantId: z.uuid().optional() })
-    .refine((payload) => isValidTimeZone(payload.timeZone), invalidTimeZone);
+function tenantPayloadSchema(metric) {
+    return z
+        .object({ ...metricFilterPayloadShape(metric), ...windowFields })
+        .refine((payload) => isValidTimeZone(payload.timeZone), invalidTimeZone);
+}
+function systemPayloadSchema(metric) {
+    return z
+        .object({
+        ...metricFilterPayloadShape(metric),
+        ...windowFields,
+        tenantId: z.uuid().optional(),
+    })
+        .refine((payload) => isValidTimeZone(payload.timeZone), invalidTimeZone);
+}
 const defaultClock = () => Temporal.Now.instant();
 function metricsForScope(metrics, scope) {
     return metrics.filter((metric) => metric.scopes.includes(scope));
@@ -35,12 +44,13 @@ function createTenantMetricQuery(metric, now) {
     return defineQueryHandler({
         name: metric.id,
         description: metric.description,
-        schema: tenantPayloadSchema,
+        schema: tenantPayloadSchema(metric),
         access: { roles: access.admin },
-        handler: (query, ctx) => runMetric(ctx.db, metric, {
+        handler: async (query, ctx) => runMetric(ctx.db, metric, {
             range: query.payload.range,
             timeZone: query.payload.timeZone,
             now: now(),
+            filterWhere: await resolveMetricFilterWhere(metric, query.payload, ctx),
             // ctx.db already reads own-tenant + SYSTEM reference rows; this narrows to own-tenant only.
             scopeWhere: { tenantId: query.user.tenantId },
         }),
@@ -50,7 +60,7 @@ function createSystemMetricQuery(metric, now) {
     return defineQueryHandler({
         name: metric.id,
         description: metric.description,
-        schema: systemPayloadSchema,
+        schema: systemPayloadSchema(metric),
         access: { roles: access.systemAdmin },
         handler: (query, ctx) => {
             if (!ctx.systemDb) {
@@ -75,6 +85,7 @@ function createSystemMetricQuery(metric, now) {
                 range: query.payload.range,
                 timeZone: query.payload.timeZone,
                 now: now(),
+                filterWhere: metricFilterWhere(metric, query.payload),
                 scopeWhere: tenantId === undefined ? {} : { tenantId },
             });
         },

package/dist/metrics/filters.d.ts

@@ -0,0 +1,19 @@
+import { type WhereObject } from "@cosmicdrift/kumiko-framework/bun-db";
+import type { HandlerContext } from "@cosmicdrift/kumiko-framework/engine";
+import * as z from "zod";
+import type { MetricDefinition, MetricFilterResolver } from "./types.js";
+export declare const RESERVED_PAYLOAD_KEYS: readonly string[];
+export type FilterValueKind = "uuid" | "number" | "string";
+/** Undefined = the column type cannot be filtered by a payload value without risking a Postgres cast error. */
+export declare function filterValueKindOf(pgType: string | undefined): FilterValueKind | undefined;
+export type MetricFilterEntry = {
+    readonly payloadKey: string;
+    readonly column: string;
+    readonly resolver?: MetricFilterResolver;
+};
+export declare function metricFilterEntries(metric: MetricDefinition): readonly MetricFilterEntry[];
+/** "" and null mean "no filter" (the dashboard's "(all)" option). */
+export declare function metricFilterPayloadShape(metric: MetricDefinition): Record<string, z.ZodType>;
+/** Column-equality filters only; resolver filters need resolveMetricFilterWhere. */
+export declare function metricFilterWhere(metric: MetricDefinition, payload: Readonly<Record<string, unknown>>): WhereObject;
+export declare function resolveMetricFilterWhere(metric: MetricDefinition, payload: Readonly<Record<string, unknown>>, ctx: HandlerContext): Promise<WhereObject>;

package/dist/metrics/filters.js

@@ -0,0 +1,78 @@
+import { extractTableInfo } from "@cosmicdrift/kumiko-framework/bun-db";
+import * as z from "zod";
+export const RESERVED_PAYLOAD_KEYS = ["range", "timeZone", "tenantId"];
+// Dashboard select options always send strings.
+const NUMERIC_STRING = /^-?\d+(\.\d+)?$/;
+const MAX_FILTER_STRING_LENGTH = 200;
+const NUMERIC_PG_TYPES = new Set([
+    "integer",
+    "int4",
+    "smallint",
+    "int2",
+    "bigint",
+    "serial",
+    "bigserial",
+    "double precision",
+]);
+/** Undefined = the column type cannot be filtered by a payload value without risking a Postgres cast error. */
+export function filterValueKindOf(pgType) {
+    if (pgType === undefined)
+        return undefined;
+    if (pgType === "uuid")
+        return "uuid";
+    if (pgType === "text")
+        return "string";
+    if (NUMERIC_PG_TYPES.has(pgType) || pgType.startsWith("numeric"))
+        return "number";
+    return undefined;
+}
+export function metricFilterEntries(metric) {
+    return Object.entries(metric.filters ?? {}).map(([payloadKey, spec]) => typeof spec === "string"
+        ? { payloadKey, column: spec }
+        : { payloadKey, column: spec.column, resolver: spec });
+}
+function filterValueSchema(kind) {
+    if (kind === "uuid")
+        return z.uuid();
+    if (kind === "number")
+        return z.union([z.number(), z.string().regex(NUMERIC_STRING).transform(Number)]);
+    return z.string().min(1).max(MAX_FILTER_STRING_LENGTH);
+}
+/** "" and null mean "no filter" (the dashboard's "(all)" option). */
+export function metricFilterPayloadShape(metric) {
+    const info = extractTableInfo(metric.source);
+    const shape = {};
+    for (const { payloadKey, column, resolver } of metricFilterEntries(metric)) {
+        const kind = resolver !== undefined
+            ? (resolver.valueKind ?? "string")
+            : filterValueKindOf(info.pgTypeOf(info.columnOf(column)));
+        if (kind === undefined)
+            continue;
+        shape[payloadKey] = z.union([z.literal(""), z.null(), filterValueSchema(kind)]).optional();
+    }
+    return shape;
+}
+function activeFilterValue(payload, key) {
+    const value = payload[key];
+    return value === undefined || value === null || value === "" ? undefined : value;
+}
+/** Column-equality filters only; resolver filters need resolveMetricFilterWhere. */
+export function metricFilterWhere(metric, payload) {
+    const where = {};
+    for (const { payloadKey, column, resolver } of metricFilterEntries(metric)) {
+        const value = activeFilterValue(payload, payloadKey);
+        if (resolver === undefined && value !== undefined)
+            where[column] = value;
+    }
+    return where;
+}
+export async function resolveMetricFilterWhere(metric, payload, ctx) {
+    const where = metricFilterWhere(metric, payload);
+    for (const { payloadKey, column, resolver } of metricFilterEntries(metric)) {
+        const value = activeFilterValue(payload, payloadKey);
+        if (resolver === undefined || (typeof value !== "string" && typeof value !== "number"))
+            continue;
+        where[column] = await resolver.resolve(value, ctx);
+    }
+    return where;
+}

package/dist/metrics/index.d.ts

@@ -2,4 +2,4 @@ export { METRIC_RANGES, METRICS_FEATURE, METRICS_SYSTEM_FEATURE, type MetricRang
 export { activeTenantsMetric, activeUsersMetric, auditWritesMetric, DEFAULT_METRICS, deliveriesByChannelMetric, failedDeliveriesMetric, failedJobRunsMetric, jobRunsByStatusMetric, tenantJobFailuresMetric, } from "./default-metrics.js";
 export { createMetricsFeature, createSystemMetricsFeature } from "./feature.js";
 export { METRICS_I18N } from "./i18n.js";
-export { defineMetric, type MetricDefinition, type MetricPoint, type MetricResult, type MetricRow, type MetricSegment, type MetricSeries, type MetricsFeatureOptions, } from "./types.js";
+export { defineMetric, type MetricDefinition, type MetricFilterResolver, type MetricPoint, type MetricResult, type MetricRow, type MetricSegment, type MetricSeries, type MetricsFeatureOptions, } from "./types.js";

package/dist/metrics/types.d.ts

@@ -1,9 +1,17 @@
 import type { EntityTableMeta } from "@cosmicdrift/kumiko-framework/db";
+import type { HandlerContext } from "@cosmicdrift/kumiko-framework/engine";
 import type { AggregateMeasure, AggregateTimeBucket } from "@cosmicdrift/kumiko-types/aggregate-types";
 import type { SchemaTable } from "@cosmicdrift/kumiko-types/schema-table-types";
 import type { WhereObject } from "@cosmicdrift/kumiko-types/where-clause-types";
 import type { Temporal } from "temporal-polyfill";
 import type { MetricRange, MetricScope } from "./constants.js";
+/** Maps a payload value (e.g. a folder id) to the values `column` may have (e.g. the folder and its subfolders' loan ids). Runs with the tenant handler context, so reads stay tenant-scoped; the result only narrows. An empty result yields no rows. */
+export type MetricFilterResolver = {
+    readonly column: string;
+    readonly resolve: (value: string | number, ctx: HandlerContext) => Promise<readonly (string | number)[]>;
+    /** Type of the payload value, not of `column`. Default "string". */
+    readonly valueKind?: "uuid" | "number" | "string";
+};
 export type MetricDefinition = {
     readonly id: string;
     readonly description: string;
@@ -12,6 +20,8 @@ export type MetricDefinition = {
     readonly requires?: string;
     readonly measure: AggregateMeasure;
     readonly where?: WhereObject;
+    /** Payload key → source column (equality) or a resolver (IN). e.g. `{ folderId: "folderId" }`. Narrows the result only; the tenant scope is always applied on top and never replaced. Resolvers need a metric without scope "system". */
+    readonly filters?: Readonly<Record<string, string | MetricFilterResolver>>;
     /** timestamptz column; without it the metric is a snapshot with no window. */
     readonly timeField?: string;
     /** Fixed window, ignores the payload range. */

package/dist/metrics/validate.js

@@ -1,6 +1,8 @@
 import { extractTableInfo, isTimestamptzType } from "@cosmicdrift/kumiko-framework/bun-db";
 import { METRIC_RANGES } from "./constants.js";
+import { filterValueKindOf, metricFilterEntries, RESERVED_PAYLOAD_KEYS } from "./filters.js";
 const KEBAB_ID = /^[a-z][a-z0-9]*(-[a-z0-9]+)*$/;
+const FILTER_PAYLOAD_KEY = /^[a-z][a-zA-Z0-9]*$/;
 const TENANT_ID_FIELD = "tenantId";
 export function metricHasTenantColumn(metric) {
     return extractTableInfo(metric.source).hasColumn(TENANT_ID_FIELD);
@@ -25,6 +27,7 @@ function validateMetric(metric) {
         fail("declares no scopes");
     const info = extractTableInfo(metric.source);
     validateColumns(metric, info, fail);
+    validateFilters(metric, info, fail);
     validateTimeSettings(metric, info, fail);
     validateShape(metric, fail);
     if (metric.scopes.includes("tenant") && !metricHasTenantColumn(metric)) {
@@ -47,6 +50,32 @@ function validateColumns(metric, info, fail) {
     if (metric.timeField !== undefined)
         requireColumn(metric.timeField, "timeField");
 }
+function validateFilters(metric, info, fail) {
+    const baseWhereColumns = new Set(Object.keys(metric.where ?? {}).map((f) => info.columnOf(f)));
+    for (const { payloadKey, column: field, resolver } of metricFilterEntries(metric)) {
+        if (resolver !== undefined && metric.scopes.includes("system")) {
+            fail(`filter "${payloadKey}" uses a resolver, which runs with the tenant context and cannot be combined with scope "system"`);
+        }
+        if (!FILTER_PAYLOAD_KEY.test(payloadKey)) {
+            fail(`has filter key "${payloadKey}" that is not a camelCase identifier`);
+        }
+        if (RESERVED_PAYLOAD_KEYS.includes(payloadKey)) {
+            fail(`has filter key "${payloadKey}" that is reserved by the metric payload`);
+        }
+        if (!info.hasColumn(field))
+            fail(`filter "${payloadKey}" column "${field}" is not a column of ${info.name}`);
+        const column = info.columnOf(field);
+        if (column === info.columnOf(TENANT_ID_FIELD)) {
+            fail(`filter "${payloadKey}" targets the tenant column, which only the scope may set`);
+        }
+        if (baseWhereColumns.has(column)) {
+            fail(`filter "${payloadKey}" column "${field}" is already fixed by the metric where`);
+        }
+        if (filterValueKindOf(info.pgTypeOf(column)) === undefined) {
+            fail(`filter "${payloadKey}" column "${field}" has type ${info.pgTypeOf(column)}, only uuid, text and numeric columns can be filtered`);
+        }
+    }
+}
 function validateTimeSettings(metric, info, fail) {
     const { timeField } = metric;
     if (timeField === undefined) {

package/dist/renderer-simple/simple-renderer.js

@@ -73,25 +73,57 @@ function renderBrandingHeader(branding, primaryColor, logoUrl) {
         : `<span style="font-size:18px;font-weight:700;color:${escapeHtmlAttr(primaryColor)}">${escapeHtml(branding.productName ?? "")}</span>`;
     return `<div style="margin:0 0 24px;padding:0 0 16px;border-bottom:3px solid ${escapeHtmlAttr(primaryColor)}">${logo}</div>`;
 }
-function renderBrandingFooter(branding, locale) {
-    if (!branding)
-        return "";
+function resolveBrandingFooter(branding, locale) {
     const pick = (value) => resolveLocalized(value, locale, branding.defaultLocale);
     const links = (branding.footerLinks ?? []).flatMap((link) => {
         const url = pick(link.url);
         if (url === undefined || !isHttpUrl(url))
             return [];
-        return [
-            `<a href="${escapeHtmlAttr(url)}" style="color:#999">${escapeHtml(pick(link.label) ?? "")}</a>`,
-        ];
+        return [{ label: pick(link.label) ?? "", url }];
     });
-    const footerText = pick(branding.footerText);
+    return { footerText: pick(branding.footerText), links };
+}
+function renderBrandingFooter(branding, locale) {
+    if (!branding)
+        return "";
+    const { footerText, links: resolvedLinks } = resolveBrandingFooter(branding, locale);
+    const links = resolvedLinks.map((link) => `<a href="${escapeHtmlAttr(link.url)}" style="color:#999">${escapeHtml(link.label)}</a>`);
     const footerPartsHtml = [footerText ? escapeHtml(footerText) : "", links.join(" · ")].filter((part) => part !== "");
     if (footerPartsHtml.length === 0)
         return "";
     const footerHtml = footerPartsHtml.join("<br />");
     return `<p style="margin:16px 0 0;color:#999;font-size:12px">${footerHtml}</p>`;
 }
+function brandingFooterLines(branding, locale) {
+    if (!branding)
+        return [];
+    const { footerText, links } = resolveBrandingFooter(branding, locale);
+    return [
+        ...(footerText ? [footerText] : []),
+        ...links.map((link) => (link.label ? `${link.label}: ${link.url}` : link.url)),
+    ];
+}
+function templateContent(variables) {
+    const data = variables; // @cast-boundary render-helper
+    // Without structured fields, title + body become the header and a single text section.
+    return {
+        header: data.header ?? data.title,
+        sections: data.sections ?? (data.body ? [{ text: data.body }] : undefined),
+        footer: data.footer,
+    };
+}
+// Markdown stays as written: its source is already readable plain text.
+function sectionText(section) {
+    if ("text" in section)
+        return section.text;
+    if ("heading" in section)
+        return section.heading;
+    if ("markdown" in section)
+        return section.markdown;
+    if ("button" in section)
+        return `${section.button.label}: ${section.button.url}`;
+    return "";
+}
 function renderSection(section, primaryColor) {
     if ("text" in section) {
         return `<p style="margin:0 0 16px;color:#333;font-size:14px;line-height:1.5">${escapeHtml(section.text)}</p>`;
@@ -118,10 +150,7 @@ export function createSimpleRenderer(branding) {
     return {
         name: "simple",
         async render(input) {
-            const data = input.variables; // @cast-boundary render-helper
-            // Fallback: if no structured fields, use title + body as header + single text section
-            const header = data.header ?? data.title;
-            const sections = data.sections ?? (data.body ? [{ text: data.body }] : undefined);
+            const { header, sections, footer } = templateContent(input.variables);
             const parts = [];
             parts.push('<!DOCTYPE html><html><body style="margin:0;padding:0;font-family:sans-serif">');
             parts.push('<div style="max-width:600px;margin:0 auto;padding:24px">');
@@ -134,13 +163,20 @@ export function createSimpleRenderer(branding) {
                     parts.push(renderSection(section, primaryColor));
                 }
             }
-            if (data.footer) {
-                parts.push(`<p style="margin:24px 0 0;color:#999;font-size:12px;border-top:1px solid #eee;padding-top:16px">${escapeHtml(data.footer)}</p>`);
+            if (footer) {
+                parts.push(`<p style="margin:24px 0 0;color:#999;font-size:12px;border-top:1px solid #eee;padding-top:16px">${escapeHtml(footer)}</p>`);
             }
             parts.push(renderBrandingFooter(branding, input.locale));
             parts.push("</div></body></html>");
             return parts.join("");
         },
+        async renderText(input) {
+            const { header, sections, footer } = templateContent(input.variables);
+            const brandingFooter = brandingFooterLines(branding, input.locale).join("\n");
+            return [header, ...(sections ?? []).map(sectionText), footer, brandingFooter]
+                .filter((block) => block !== undefined && block !== "")
+                .join("\n\n");
+        },
     };
 }
 export const simpleRenderer = createSimpleRenderer();

package/dist/user-data-rights/email-templates.d.ts

@@ -4,6 +4,7 @@ export declare const GDPR_MAIL_EN: Readonly<Record<string, string>>;
 export type RenderedEmail = {
     readonly subject: string;
     readonly html: string;
+    readonly text: string;
 };
 export type RenderExportReadyEmailArgs = {
     readonly downloadUrl: string;

package/dist/user-data-rights/email-templates.js

@@ -45,7 +45,13 @@ export function renderExportReadyEmail(args) {
     <p style="margin: 0 0 24px;">${renderButton({ url: args.downloadUrl, label: t(locale, "gdpr.mail.exportReady.button") })}</p>
     <p style="margin: 0 0 8px; font-size: 13px; color: #555;">${escapeHtml(t(locale, "gdpr.mail.exportReady.expiry", { when: formatTimestamp(args.expiresAt) }))}</p>
     ${renderFallbackUrl({ url: args.downloadUrl, label: t(locale, "gdpr.mail.fallbackUrl") })}`;
-    return { subject, html: renderShell({ title: subject, bodyHtml: wrapCell(body), locale }) };
+    const text = plainTextBody([
+        t(locale, "gdpr.mail.greeting"),
+        t(locale, "gdpr.mail.exportReady.intro", { app }),
+        `${t(locale, "gdpr.mail.exportReady.button")}: ${args.downloadUrl}`,
+        t(locale, "gdpr.mail.exportReady.expiry", { when: formatTimestamp(args.expiresAt) }),
+    ]);
+    return { subject, html: renderShell({ title: subject, bodyHtml: wrapCell(body), locale }), text };
 }
 export function renderExportFailedEmail(args) {
     const locale = args.locale ?? "en";
@@ -54,7 +60,11 @@ export function renderExportFailedEmail(args) {
     const body = `
     <p style="margin: 0 0 16px; font-size: 16px;">${escapeHtml(t(locale, "gdpr.mail.greeting"))}</p>
     <p style="margin: 0; font-size: 14px; line-height: 1.5;">${escapeHtml(t(locale, "gdpr.mail.exportFailed.intro", { app }))}</p>`;
-    return { subject, html: renderShell({ title: subject, bodyHtml: wrapCell(body), locale }) };
+    const text = plainTextBody([
+        t(locale, "gdpr.mail.greeting"),
+        t(locale, "gdpr.mail.exportFailed.intro", { app }),
+    ]);
+    return { subject, html: renderShell({ title: subject, bodyHtml: wrapCell(body), locale }), text };
 }
 export function renderDeletionRequestedEmail(args) {
     const locale = args.locale ?? "en";
@@ -65,7 +75,12 @@ export function renderDeletionRequestedEmail(args) {
     <p style="margin: 0 0 16px; font-size: 16px;">${escapeHtml(t(locale, "gdpr.mail.greeting"))}</p>
     <p style="margin: 0 0 16px; font-size: 14px; line-height: 1.5;">${escapeHtml(t(locale, "gdpr.mail.deletionRequested.intro", { app, when }))}</p>
     <p style="margin: 0; font-size: 13px; color: #555;">${escapeHtml(t(locale, "gdpr.mail.deletionRequested.cancel"))}</p>`;
-    return { subject, html: renderShell({ title: subject, bodyHtml: wrapCell(body), locale }) };
+    const text = plainTextBody([
+        t(locale, "gdpr.mail.greeting"),
+        t(locale, "gdpr.mail.deletionRequested.intro", { app, when }),
+        t(locale, "gdpr.mail.deletionRequested.cancel"),
+    ]);
+    return { subject, html: renderShell({ title: subject, bodyHtml: wrapCell(body), locale }), text };
 }
 export function renderDeletionExecutedEmail(args) {
     const locale = args.locale ?? "en";
@@ -75,7 +90,14 @@ export function renderDeletionExecutedEmail(args) {
     const body = `
     <p style="margin: 0 0 16px; font-size: 16px;">${escapeHtml(t(locale, "gdpr.mail.greeting"))}</p>
     <p style="margin: 0; font-size: 14px; line-height: 1.5;">${escapeHtml(t(locale, "gdpr.mail.deletionExecuted.intro", { app, when }))}</p>`;
-    return { subject, html: renderShell({ title: subject, bodyHtml: wrapCell(body), locale }) };
+    const text = plainTextBody([
+        t(locale, "gdpr.mail.greeting"),
+        t(locale, "gdpr.mail.deletionExecuted.intro", { app, when }),
+    ]);
+    return { subject, html: renderShell({ title: subject, bodyHtml: wrapCell(body), locale }), text };
+}
+function plainTextBody(paragraphs) {
+    return paragraphs.join("\n\n");
 }
 function wrapCell(bodyHtml) {
     return `<tr><td>${bodyHtml}</td></tr>`;

package/dist/user-data-rights/lib/default-mailers.js

@@ -29,34 +29,34 @@ function localeFor(userLocale, defaults) {
 export function makeDefaultExportReadyEmail(resolveTransport, defaults = {}) {
     return async (args) => {
         const transport = await resolveTransport(args.tenantId);
-        const { subject, html } = renderExportReadyEmail({
+        const { subject, html, text } = renderExportReadyEmail({
             downloadUrl: args.downloadUrl,
             expiresAt: args.expiresAt,
             locale: localeFor(args.userLocale, defaults),
             appName: defaults.appName,
         });
-        await transport.send({ to: args.userEmail, subject, html });
+        await transport.send({ to: args.userEmail, subject, html, text });
     };
 }
 export function makeDefaultExportFailedEmail(resolveTransport, defaults = {}) {
     return async (args) => {
         const transport = await resolveTransport(args.tenantId);
-        const { subject, html } = renderExportFailedEmail({
+        const { subject, html, text } = renderExportFailedEmail({
             locale: localeFor(args.userLocale, defaults),
             appName: defaults.appName,
         });
-        await transport.send({ to: args.userEmail, subject, html });
+        await transport.send({ to: args.userEmail, subject, html, text });
     };
 }
 export function makeDefaultDeletionRequestedEmail(resolveTransport, defaults = {}) {
     return async (args) => {
         const transport = await resolveTransport(args.tenantId);
-        const { subject, html } = renderDeletionRequestedEmail({
+        const { subject, html, text } = renderDeletionRequestedEmail({
             gracePeriodEnd: args.gracePeriodEnd,
             locale: localeFor(args.userLocale, defaults),
             appName: defaults.appName,
         });
-        await transport.send({ to: args.userEmail, subject, html });
+        await transport.send({ to: args.userEmail, subject, html, text });
     };
 }
 export function makeDefaultDeletionExecutedEmail(resolveTransport, defaults = {}) {
@@ -70,11 +70,11 @@ export function makeDefaultDeletionExecutedEmail(resolveTransport, defaults = {}
             return;
         }
         const transport = await resolveTransport(tenantId);
-        const { subject, html } = renderDeletionExecutedEmail({
+        const { subject, html, text } = renderDeletionExecutedEmail({
             executedAt: args.executedAt,
             locale: localeFor(args.userLocale, defaults),
             appName: defaults.appName,
         });
-        await transport.send({ to: args.userEmail, subject, html });
+        await transport.send({ to: args.userEmail, subject, html, text });
     };
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@cosmicdrift/kumiko-bundled-features",
-  "version": "0.348.1",
+  "version": "0.350.0",
   "description": "Built-in features — tenant, user, auth, delivery. The stuff you'd rewrite anyway, already typed.",
   "license": "BUSL-1.1",
   "author": "Marc Frost <marc@cosmicdriftgamestudio.com>",
@@ -503,12 +503,12 @@
     }
   },
   "dependencies": {
-    "@cosmicdrift/kumiko-dispatcher-live": "0.348.1",
-    "@cosmicdrift/kumiko-framework": "0.348.1",
-    "@cosmicdrift/kumiko-headless": "0.348.1",
-    "@cosmicdrift/kumiko-renderer": "0.348.1",
-    "@cosmicdrift/kumiko-renderer-web": "0.348.1",
-    "@cosmicdrift/kumiko-types": "0.348.1",
+    "@cosmicdrift/kumiko-dispatcher-live": "0.350.0",
+    "@cosmicdrift/kumiko-framework": "0.350.0",
+    "@cosmicdrift/kumiko-headless": "0.350.0",
+    "@cosmicdrift/kumiko-renderer": "0.350.0",
+    "@cosmicdrift/kumiko-renderer-web": "0.350.0",
+    "@cosmicdrift/kumiko-types": "0.350.0",
     "@mollie/api-client": "^4.5.0",
     "@node-rs/argon2": "^2.0.2",
     "@types/mailparser": "^3.4.6",
@@ -1025,8 +1025,8 @@
   ],
   "devDependencies": {
     "@testing-library/user-event": "^14.6.1",
-    "@cosmicdrift/kumiko-locale-de": "0.348.1",
-    "@cosmicdrift/kumiko-locale-es": "0.348.1",
+    "@cosmicdrift/kumiko-locale-de": "0.350.0",
+    "@cosmicdrift/kumiko-locale-es": "0.350.0",
     "jsqr": "^1.4.0"
   }
 }

package/src/channel-email/changes.json

@@ -1,4 +1,10 @@
 [
+  {
+    "version": "0.350.0",
+    "type": "improvement",
+    "title": "Mails get a plain-text part (EmailMessage.text, NotificationRenderer.renderText, simple renderer and GDPR mails fill it)",
+    "detail": "Email text part\n`EmailMessage` gets an optional `text`. With it the SMTP transport sends `multipart/alternative` with a plain-text part. `NotificationRenderer` gets an optional `renderText`, which the email channel sends next to the HTML through the queued render and send jobs. `createSimpleRenderer` implements it from the template data (header, sections, footer, branding footer; buttons as `label: url`). The GDPR default mails return and send `text` as well. The PII guard checks and redacts `text` like the body."
+  },
   {
     "version": "0.348.1",
     "type": "fix",

package/src/metrics/changes.json

@@ -1,4 +1,10 @@
 [
+  {
+    "version": "0.349.0",
+    "type": "improvement",
+    "title": "Metrics accept payload filters that narrow the aggregate without replacing the tenant scope",
+    "detail": "metrics: payload filters on a metric\n`MetricDefinition.filters` maps payload keys to source columns, e.g. `{ folderId: \"folderId\" }`. The metric query then accepts that key and narrows the aggregate to the value, for the current and previous window and for groups, stacks and series. The tenant scope is applied last, so a filter value from another tenant yields 0, never that tenant's numbers. `\"\"`, `null` and a missing key mean no filter. The value type follows the column (uuid, numeric, text); an invalid value is a 400. Definitions are rejected at boot for non-camelCase keys, the reserved keys `range`/`timeZone`/`tenantId`, unknown columns, the tenant column, columns already fixed by `where`, and column types other than uuid, text and numeric.\nA filter can also be a resolver `{ column, resolve(value, ctx), valueKind? }`: the payload value (e.g. a folder id) is mapped to the allowed values of `column` through the tenant handler context (IN filter, empty result = no rows), for assignments that live in another table. Resolvers are rejected on metrics with scope `system`."
+  },
   {
     "version": "0.335.0",
     "type": "fix",