@cosmicdrift/kumiko-bundled-features 0.366.0 → 0.367.0

package/dist/template-resolver/template-system-only.js

@@ -0,0 +1,11 @@
+import { isSystemAdmin } from "./template-draft.js";
+const NOTIFICATION_TEMPLATE_KIND = "mail";
+// A notification registered with systemOnly keeps its mail template as the system default:
+// tenants neither list nor override it, and overrides stored before the flag are ignored.
+export function isSystemOnlyTemplate(registry, slug, kind) {
+    return (kind === NOTIFICATION_TEMPLATE_KIND &&
+        registry.getAllNotifications().get(slug)?.systemOnly === true);
+}
+export function isSystemOnlyTemplateHiddenFrom(user, registry, row) {
+    return !isSystemAdmin(user) && isSystemOnlyTemplate(registry, row.slug, row.kind);
+}

package/dist/template-resolver/template-validation.js

@@ -1,6 +1,6 @@
 import * as z from "zod";
-import { withParsedDocument } from "./document-sanitizer.js";
-import { isDocumentPlaceholderHref, isDocumentReferenceName } from "./document-schema.js";
+import { conditionScopeElement, withParsedDocument } from "./document-sanitizer.js";
+import { DOCUMENT_CONDITION_ATTRIBUTE, isDocumentPlaceholderHref, isDocumentReferenceName, } from "./document-schema.js";
 export const SYSTEM_PLACEHOLDERS = new Set([
     "tenantName",
     "signature",
@@ -34,6 +34,7 @@ const scalarVariableSchema = z.discriminatedUnion("type", [
             .optional(),
     }),
     z.object({ ...variableCommon, type: z.literal("date"), example: textLikeExample }),
+    z.object({ ...variableCommon, type: z.literal("percent"), example: z.number().optional() }),
 ]);
 const variableDefSchema = z.union([
     scalarVariableSchema,
@@ -99,34 +100,47 @@ const NAME_ATTRIBUTE_BY_TAG = {
     span: "data-variable",
     div: "data-steps",
 };
-function scanBodyPlaceholders(body, scope) {
-    withParsedDocument(body, (root) => {
-        for (const element of Array.from(root.querySelectorAll("tr[data-each]"))) {
-            const listName = element.getAttribute("data-each") ?? "";
-            const def = Object.hasOwn(scope.variables, listName) ? scope.variables[listName] : undefined;
-            if (def?.type === "list")
-                scope.used.add(listName);
-            else
-                scope.unknown.add(listName);
+function scanRepeatRows(root, scope) {
+    for (const element of Array.from(root.querySelectorAll("tr[data-each]"))) {
+        const listName = element.getAttribute("data-each") ?? "";
+        const def = Object.hasOwn(scope.variables, listName) ? scope.variables[listName] : undefined;
+        if (def?.type === "list")
+            scope.used.add(listName);
+        else
+            scope.unknown.add(listName);
+    }
+}
+function scanConditions(root, scope) {
+    for (const element of Array.from(root.querySelectorAll(`[${DOCUMENT_CONDITION_ATTRIBUTE}]`))) {
+        const itemFields = listItemFields(scope.variables, enclosingEachName(conditionScopeElement(element)));
+        recordName(element.getAttribute(DOCUMENT_CONDITION_ATTRIBUTE) ?? "", itemFields, scope);
+    }
+}
+function scanReferences(root, scope) {
+    for (const element of Array.from(root.querySelectorAll("span[data-variable], div[data-steps], a[href], img[data-resource]"))) {
+        const itemFields = listItemFields(scope.variables, enclosingEachName(element));
+        const tag = element.tagName.toLowerCase();
+        const nameAttribute = NAME_ATTRIBUTE_BY_TAG[tag];
+        if (nameAttribute !== undefined) {
+            recordName(element.getAttribute(nameAttribute) ?? "", itemFields, scope);
+        }
+        else if (tag === "a") {
+            const href = element.getAttribute("href") ?? "";
+            if (isDocumentPlaceholderHref(href))
+                recordName(href.slice(2, -2), itemFields, scope);
         }
-        for (const element of Array.from(root.querySelectorAll("span[data-variable], div[data-steps], a[href], img[data-resource]"))) {
-            const itemFields = listItemFields(scope.variables, enclosingEachName(element));
-            const tag = element.tagName.toLowerCase();
-            const nameAttribute = NAME_ATTRIBUTE_BY_TAG[tag];
-            if (nameAttribute !== undefined) {
-                recordName(element.getAttribute(nameAttribute) ?? "", itemFields, scope);
-            }
-            else if (tag === "a") {
-                const href = element.getAttribute("href") ?? "";
-                if (isDocumentPlaceholderHref(href))
-                    recordName(href.slice(2, -2), itemFields, scope);
-            }
-            else {
-                const key = element.getAttribute("data-resource") ?? "";
-                if (!scope.resourceKeys.has(key))
-                    scope.unknownResources.add(key);
-            }
+        else {
+            const key = element.getAttribute("data-resource") ?? "";
+            if (!scope.resourceKeys.has(key))
+                scope.unknownResources.add(key);
         }
+    }
+}
+function scanBodyPlaceholders(body, scope) {
+    withParsedDocument(body, (root) => {
+        scanRepeatRows(root, scope);
+        scanConditions(root, scope);
+        scanReferences(root, scope);
     });
 }
 const HANDLEBARS_EXPRESSION = /\{\{([^{}]*)\}\}/g;

package/dist/template-resolver/web/i18n.js

@@ -76,6 +76,7 @@ export const defaultTranslations = {
         "templateResolver.errors.collection.kindNotAllowed": "“{detail}” templates are written through their own editor, not through a collection.",
         "templateResolver.errors.noSystemTemplate": "There is no active system template to reset to.",
         "templateResolver.errors.noDraft": "There is no draft to discard.",
+        "templateResolver.errors.systemOnlyTemplate": "Only the platform maintains this template; it cannot be overridden per tenant.",
         "templateResolver.errors.template.invalidMeta": "The template settings are invalid.",
         "templateResolver.errors.template.meta.subject.required": "The subject is missing.",
         "templateResolver.errors.template.meta.subject.invalid": "The subject is invalid (at most 200 characters, no line breaks).",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@cosmicdrift/kumiko-bundled-features",
-  "version": "0.366.0",
+  "version": "0.367.0",
   "description": "Built-in features — tenant, user, auth, delivery. The stuff you'd rewrite anyway, already typed.",
   "license": "BUSL-1.1",
   "author": "Marc Frost <marc@cosmicdriftgamestudio.com>",
@@ -524,12 +524,12 @@
     }
   },
   "dependencies": {
-    "@cosmicdrift/kumiko-dispatcher-live": "0.366.0",
-    "@cosmicdrift/kumiko-framework": "0.366.0",
-    "@cosmicdrift/kumiko-headless": "0.366.0",
-    "@cosmicdrift/kumiko-renderer": "0.366.0",
-    "@cosmicdrift/kumiko-renderer-web": "0.366.0",
-    "@cosmicdrift/kumiko-types": "0.366.0",
+    "@cosmicdrift/kumiko-dispatcher-live": "0.367.0",
+    "@cosmicdrift/kumiko-framework": "0.367.0",
+    "@cosmicdrift/kumiko-headless": "0.367.0",
+    "@cosmicdrift/kumiko-renderer": "0.367.0",
+    "@cosmicdrift/kumiko-renderer-web": "0.367.0",
+    "@cosmicdrift/kumiko-types": "0.367.0",
     "@mollie/api-client": "^4.5.0",
     "@node-rs/argon2": "^2.0.2",
     "@tiptap/core": "3.31.3",
@@ -1078,9 +1078,9 @@
   ],
   "devDependencies": {
     "@testing-library/user-event": "^14.6.1",
-    "@cosmicdrift/kumiko-locale-de": "0.366.0",
-    "@cosmicdrift/kumiko-locale-es": "0.366.0",
-    "@cosmicdrift/kumiko-renderer-mail-html": "0.366.0",
+    "@cosmicdrift/kumiko-locale-de": "0.367.0",
+    "@cosmicdrift/kumiko-locale-es": "0.367.0",
+    "@cosmicdrift/kumiko-renderer-mail-html": "0.367.0",
     "jsqr": "^1.4.0",
     "unpdf": "^1.8.1"
   }

package/src/channel-email/changes.json

@@ -1,4 +1,10 @@
 [
+  {
+    "version": "0.367.0",
+    "type": "improvement",
+    "title": "Email channel can send through the tenant's own mail provider",
+    "detail": "EmailChannelOptions gets tenantTransport, a resolver called per send with the delivery channel context. mail-foundation exports tenantMailTransport for it: a tenant with a provider configured sends through its own transport, a broken provider fails the send, a tenant without a provider uses the app transport. The transport is built per send and never cached, and the tenant comes from the server-side delivery context only. ChannelContext now carries the tenant's config accessor as config. Without tenantTransport nothing changes."
+  },
   {
     "version": "0.365.0",
     "type": "fix",

package/src/delivery/changes.json

@@ -1,4 +1,16 @@
 [
+  {
+    "version": "0.367.0",
+    "type": "improvement",
+    "title": "Delivery signs unsubscribe links itself",
+    "detail": "r.notification(name, { unsubscribe: true }) makes delivery put a signed data.unsubscribeUrl into every email of that notification when the service has unsubscribeLinks. User recipients get a user token, route recipients an address token (only with a blind-index key, otherwise no link). The token is scoped to tenant, notification and channel; a link the caller passes in data.unsubscribeUrl wins. runProdApp option unsubscribe: { secret } mounts createUnsubscribeRoutes and wires the links; the base URL comes from auth.publicOrigin, auth.mail.baseUrl or APP_BASE_URL, and without one boot warns and no link is added."
+  },
+  {
+    "version": "0.367.0",
+    "type": "improvement",
+    "title": "Unsubscribe links use the tenant's host and the mail's language, apps learn about address opt-outs",
+    "detail": "unsubscribeLinks and the runProdApp option unsubscribe take tenantOrigin, an app callback that returns the sending tenant's own origin (subdomain or custom domain) per send; null, a throw or a non-https value fall back to the app origin and never fail the send. The signed token now carries the mail's locale (notify option locale), so the confirmation, result and undo pages render in that language; tokens without it keep working and show English. A form post to the resubscribe route now answers with an HTML page, JSON callers are unchanged. After a committed address opt-out an app job declared with trigger on DeliveryHandlers.unsubscribeAddress receives addressHash, notificationType and channel (unsubscribeAddressPayloadSchema) with the tenant in ctx.triggeredBy.tenantId; hashUnsubscribeAddress(email) matches it to the app's own subscriber. UNSUBSCRIBE_PAGE_EN exports the English page texts, German and Spanish come with the locale packages."
+  },
   {
     "version": "0.366.0",
     "type": "improvement",

package/src/template-resolver/changes.json

@@ -1,4 +1,29 @@
 [
+  {
+    "version": "0.367.0",
+    "type": "improvement",
+    "title": "Notifications can keep their mail template system-only",
+    "detail": "r.notification(name, { systemOnly: true }) marks the stored mail template as a platform text. Tenant admins no longer see it in the template overview, list or detail, and creating a tenant version (upsert-tenant, copy-locale, import-bundle, also a SystemAdmin writing for a tenant) is refused with access_denied and templateResolver.errors.systemOnlyTemplate. SystemAdmins edit the system template as before, and the mail renderer always uses it, even if a tenant row exists from before."
+  },
+  {
+    "version": "0.367.0",
+    "type": "fix",
+    "title": "Rich text placeholders no longer nest paragraphs",
+    "detail": "A richText placeholder alone in a paragraph compiles into a div that keeps the paragraph attributes, and one inside other text renders inline with line breaks instead of its own paragraphs. Mails and PDFs no longer contain <p><p>. richText and stepIs are now reserved template variable names, like the other renderer helpers.",
+    "migration": "A notification that declares a template variable called richText, stepIs or percent fails at boot; rename the variable."
+  },
+  {
+    "version": "0.367.0",
+    "type": "improvement",
+    "title": "Template bundles with a logo can be seeded",
+    "detail": "seedSystemTemplateBundle(db, bundle, { dispatcher }) now seeds bundles that carry resources such as a logo by running the import-bundle-system write on the given seed dispatcher. With ifExists \"skip\" (default) nothing is written when every locale row already exists; if only some exist, the whole bundle is imported again. Without a dispatcher such a bundle still fails with a message that names the missing option."
+  },
+  {
+    "version": "0.367.0",
+    "type": "improvement",
+    "title": "Template conditions with data-if and a percent variable type",
+    "detail": "A paragraph, heading or table row with data-if=\"name\" renders only when the variable has a value (0 counts as a value); inside a repeat row the name refers to the row field, on the repeat row itself to the root variable. The sanitizer keeps the attribute, and template validation reports a condition on an undeclared variable. New variable type percent (templateVariable.percent()) takes percentage points and renders locale-aware, 12 as \"12 %\" in German and \"12%\" in English; the preview uses its example value. The document designer has no toolbar control for conditions yet; the attribute survives editing."
+  },
   {
     "version": "0.365.0",
     "type": "breaking",

package/src/user-data-rights/changes.json

@@ -1,4 +1,10 @@
 [
+  {
+    "version": "0.367.0",
+    "type": "fix",
+    "title": "Tests seed tenant memberships and events through the framework",
+    "detail": "Test-only change. Integration tests create read_tenant_memberships from tenantMembershipEntity and seed rows with seedRow instead of hand-written DDL and raw INSERTs. Fake events go through the event-store append, and backdated audit events are written with runSeedWritesAt instead of an UPDATE on created_at. No runtime behavior changes."
+  },
   {
     "version": "0.365.0",
     "type": "improvement",