@crombolo/server 0.16.0 → 0.17.0

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@crombolo/server",
-  "version": "0.16.0",
+  "version": "0.17.0",
   "description": "The crombolo HTTP server: routing, configuration, media stores and background jobs.",
   "license": "MIT",
   "author": "Crombolo",
@@ -30,17 +30,17 @@
     "access": "public"
   },
   "dependencies": {
-    "@crombolo/api-delivery": "0.16.0",
-    "@crombolo/api-management": "0.16.0",
-    "@crombolo/assistant": "0.16.0",
-    "@crombolo/auth": "0.16.0",
-    "@crombolo/backoffice-host": "0.16.0",
-    "@crombolo/contracts": "0.16.0",
-    "@crombolo/core": "0.16.0",
-    "@crombolo/data": "0.16.0",
-    "@crombolo/render": "0.16.0",
-    "@crombolo/schema": "0.16.0",
-    "@crombolo/transfer": "0.16.0",
+    "@crombolo/api-delivery": "0.17.0",
+    "@crombolo/api-management": "0.17.0",
+    "@crombolo/assistant": "0.17.0",
+    "@crombolo/auth": "0.17.0",
+    "@crombolo/backoffice-host": "0.17.0",
+    "@crombolo/contracts": "0.17.0",
+    "@crombolo/core": "0.17.0",
+    "@crombolo/data": "0.17.0",
+    "@crombolo/render": "0.17.0",
+    "@crombolo/schema": "0.17.0",
+    "@crombolo/transfer": "0.17.0",
     "@logtape/logtape": "^2.3.8"
   }
 }

package/src/adapters/documents.ts

@@ -75,6 +75,8 @@ export function createDocumentPort(
   tracker: RedirectTracker = NO_REDIRECT_TRACKING,
   /** The site's own directory: where `domains.toml` is, when the site keeps one. */
   siteDir?: string,
+  /** Whether the site can send the e-mails a subscription asks for (story 045). */
+  notificationsAvailable = true,
 ): DocumentPort {
   const repo = new DocumentRepository(db, options)
   const domains = new DomainRepository(db)
@@ -415,9 +417,14 @@ export function createDocumentPort(
     async setNotifications(key, principal, actionIds) {
       const node = await repo.nodes.byKey(key)
       const userId = await userIdOf(principal)
-      if (!node || node.objectType !== repo.objectType || userId === undefined) return false
+      if (!node || node.objectType !== repo.objectType || userId === undefined) return 'notFound'
+      // Clearing is always allowed; asking for something the site cannot send is not.
+      if (!notificationsAvailable) {
+        const had = new Set(await notifications.subscribed(userId, node.id))
+        if (actionIds.some((id) => !had.has(id))) return 'unavailable'
+      }
       await notifications.set(userId, node.id, actionIds)
-      return true
+      return 'saved'
     },
 
     versions: (key) => repo.versions(key),

package/src/adapters/users.ts

@@ -119,6 +119,8 @@ export interface UserPortOptions {
   nodes: NodeLookup
   /** Signs a user out everywhere, as a password change set by someone else does. */
   endSessions: (userId: number) => Promise<void>
+  /** A group save changed what it may do on these pages (story 045: the "rights" notification). */
+  onPagePermissionsChanged?: (principal: Principal, nodeKeys: string[]) => void | Promise<void>
 }
 
 export function createUserPorts(
@@ -661,7 +663,11 @@ export function createUserPorts(
 
   return {
     users: userPort,
-    groups: createUserGroupPort(db, { adminKey, nodes }),
+    groups: createUserGroupPort(db, {
+      adminKey,
+      nodes,
+      onPagePermissionsChanged: options.onPagePermissionsChanged,
+    }),
     userData: createUserDataPort(db),
   }
 }
@@ -763,7 +769,11 @@ function fromPermissions(permissions: UserGroupInput['permissions']): GranularPe
 
 function createUserGroupPort(
   db: Db,
-  deps: { adminKey: () => Promise<string | undefined>; nodes: NodeLookup },
+  deps: {
+    adminKey: () => Promise<string | undefined>
+    nodes: NodeLookup
+    onPagePermissionsChanged?: UserPortOptions['onPagePermissionsChanged']
+  },
 ): UserGroupPort {
   const groups = new UserGroupRepository(db)
   const users = new UserRepository(db)
@@ -827,6 +837,34 @@ function createUserGroupPort(
     return 'Success'
   }
 
+  /** Each page's verbs for the group, by page key. */
+  const pageVerbs = (group: { granular: GranularPermission[] } | undefined) => {
+    const out = new Map<string, Set<string>>()
+    for (const row of group?.granular ?? [])
+      if (row.context === 'Document' && row.key) {
+        const verbs = out.get(row.key) ?? new Set<string>()
+        verbs.add(row.permission)
+        out.set(row.key, verbs)
+      }
+    return out
+  }
+  /** The pages whose verbs for the group a save changed. */
+  const changedPages = (before: Map<string, Set<string>>, after: Map<string, Set<string>>) =>
+    [...new Set([...before.keys(), ...after.keys()])].filter((key) => {
+      const a = before.get(key) ?? new Set<string>()
+      const b = after.get(key) ?? new Set<string>()
+      return a.size !== b.size || [...a].some((verb) => !b.has(verb))
+    })
+  const announcePermissions = async (
+    principal: Principal,
+    before: Map<string, Set<string>>,
+    key: string,
+  ) => {
+    if (!deps.onPagePermissionsChanged) return
+    const changed = changedPages(before, pageVerbs(await groups.byKey(key)))
+    if (changed.length > 0) await deps.onPagePermissionsChanged(principal, changed)
+  }
+
   const save = async (input: UserGroupInput, key: string): Promise<UserGroupStatus> => {
     const result = await groups.save({
       key,
@@ -906,6 +944,7 @@ function createUserGroupPort(
       if (await groups.byKey(key)) return { status: 'DuplicateAlias' }
       const saved = await save(input, key)
       if (saved !== 'Success') return { status: saved }
+      await announcePermissions(principal, new Map(), key)
       // A non-admin who creates a group joins it, as in Umbraco
       if (!principal.isAdmin) await users.addToGroup(key, [principal.id])
       return { status: 'Success', key }
@@ -917,7 +956,10 @@ function createUserGroupPort(
       if (!isMember(principal, group.key)) return 'Forbidden'
       const valid = await validate(principal, input, group)
       if (valid !== 'Success') return valid
-      return save(input, group.key)
+      const before = pageVerbs(group)
+      const saved = await save(input, group.key)
+      if (saved === 'Success') await announcePermissions(principal, before, group.key)
+      return saved
     },
 
     async delete(principal, keys) {

package/src/approvals.ts

@@ -7,6 +7,7 @@
  * This decides: who may act, what an edit does to a waiting request, when a
  * stage is done, and when the page is published.
  */
+
 import type { Principal } from '@crombolo/api-management'
 import {
   approvalsNeeded,
@@ -36,6 +37,7 @@ import {
   type StoredWorkflow,
   UserGroupRepository,
 } from '@crombolo/data'
+import type { ContentNotifier } from './content-notifications.ts'
 import type { EmailPort } from './email.ts'
 
 /** What publishing and unpublishing go through when approval says yes. */
@@ -57,6 +59,8 @@ export interface ApprovalsOptions {
   email?: EmailPort
   /** Where a link in an e-mail points, e.g. `https://site.example/crombolo`. */
   backOfficeUrl?: string
+  /** Queues the content notifications a publish on approval makes (story 045). */
+  notifier?: ContentNotifier
 }
 
 /** A refusal a person reads: why, and what to do instead. */
@@ -426,6 +430,12 @@ export function createApprovals(options: ApprovalsOptions): Approvals {
       request.action === 'publish' ? 'Published on approval' : 'Unpublished on approval',
       `through "${request.workflow.name}"`,
     )
+    if (request.action === 'publish')
+      await options.notifier?.raise(
+        { actions: ['Umb.Document.Publish'], key: request.nodeKey, keyKind: 'document' },
+        principal ? { key: principal.id, name: principal.name } : null,
+        `approved through "${request.workflow.name}"`,
+      )
     await notify(
       'editor',
       request,

package/src/components.ts

@@ -1,4 +1,4 @@
-import { existsSync, readdirSync, statSync } from 'node:fs'
+import { existsSync, readdirSync, readFileSync, statSync } from 'node:fs'
 import { join, relative, resolve, sep } from 'node:path'
 
 /**
@@ -196,6 +196,75 @@ export function componentFileFor(root: string, alias: string): string {
   return join(root, `${alias}.tsx`)
 }
 
+/** What an e-mail template looks like: a default export over `EmailProps`. */
+export function emailScaffold(alias: string): string {
+  const name = componentName(alias)
+  return `import type { EmailProps } from '@crombolo/crombolo'
+
+export default function ${name}({ form, fields, site }: EmailProps) {
+  return (
+    <html lang="en">
+      <body>
+        <h1>{form.name}</h1>
+        <table>
+          {fields.map((field) => (
+            <tr>
+              <th>{field.caption}</th>
+              <td>
+                {field.leftOut
+                  ? 'Not included'
+                  : field.answered
+                    ? field.values.join(', ')
+                    : 'Not answered'}
+              </td>
+            </tr>
+          ))}
+        </table>
+        <p>
+          Sent from <a href={site.url}>{site.name}</a>
+        </p>
+      </body>
+    </html>
+  )
+}
+`
+}
+
+/**
+ * The components the forms designer offers as e-mail designs: those written
+ * over `EmailProps`, and any a form already names, so a picker never loses the
+ * one that is set. A layout takes `EmailLayoutProps`, so it is not offered.
+ */
+export function listEmailTemplates(
+  root: string,
+  named: Iterable<string> = [],
+): { alias: string; name: string }[] {
+  const components = listComponents(root)
+  const found = new Set<string>()
+  for (const component of components)
+    if (/\bEmailProps\b/.test(readFileSync(component.path, 'utf8'))) found.add(component.alias)
+  const present = new Set(components.map((component) => component.alias))
+  for (const alias of named) if (present.has(alias)) found.add(alias)
+  const items = [...found].sort().map((alias) => ({ alias, name: readableName(alias) }))
+  // Two folders with the same file name would read alike, so those keep their path.
+  const counts = new Map<string, number>()
+  for (const item of items) counts.set(item.name, (counts.get(item.name) ?? 0) + 1)
+  return items.map((item) =>
+    (counts.get(item.name) ?? 0) > 1 ? { ...item, name: `${item.name} (${item.alias})` } : item,
+  )
+}
+
+/** `emails/contactReceipt` → "Contact receipt". */
+function readableName(alias: string): string {
+  const base = alias.split('/').pop() ?? alias
+  const words = base
+    .replace(/([a-z0-9])([A-Z])/g, '$1 $2')
+    .replace(/[-_]+/g, ' ')
+    .trim()
+    .toLowerCase()
+  return words.charAt(0).toUpperCase() + words.slice(1)
+}
+
 /** What a component looks like: a function, taking whatever imports it hands it. */
 export function componentScaffold(alias: string): string {
   const name = componentName(alias)

package/src/config.ts

@@ -739,4 +739,4 @@ export function describeDatabase(
   }
 }
 
-export const VERSION = '0.16.0'
+export const VERSION = '0.17.0'

package/src/content-notifications.ts

@@ -0,0 +1,310 @@
+/**
+ * Content notifications, delivered (story 045): an editor who asked to hear
+ * when a page is published — or moved, sorted, rolled back, and the rest of
+ * Umbraco's eleven — gets an e-mail when it is.
+ *
+ * A change is turned into outbox rows when it happens, one per person,
+ * resolved against the subscriptions on the page and the pages above it, and
+ * never for the person who made it. The rows wait a minute, so a save and a
+ * publish arrive as one e-mail, and a background job on the nodes that run
+ * jobs sends them; each person's rows are claimed by one node.
+ */
+import type { RaisedContentChange } from '@crombolo/api-management'
+import { hasPathAccess, isValidEmail, ObjectTypes, permissionsForPath } from '@crombolo/core'
+import {
+  type ContentNotification,
+  ContentNotificationRepository,
+  type Db,
+  DocumentRepository,
+  NOTIFIABLE_ACTIONS,
+  NodeRepository,
+  NotificationRepository,
+  UserRepository,
+} from '@crombolo/data'
+import { createNodeLookup, loadAccess } from './access.ts'
+import type { EmailPort } from './email.ts'
+import { retryAfter } from './form-workflows.ts'
+import { logger } from './logging.ts'
+
+const log = logger('notifications')
+
+/** How long a change waits for others to the same person, so they arrive as one e-mail. */
+export const DIGEST_DELAY_MS = 60_000
+/** A row a node took and never finished is retried after this long: that node died. */
+export const STALE_AFTER_MS = 15 * 60_000
+
+export interface Actor {
+  key: string | null
+  name: string
+}
+
+export interface ContentNotifierOptions {
+  /** False when the site cannot send e-mail: nothing is queued, and nothing piles up. */
+  canSend: boolean
+  delayMs?: number
+}
+
+export interface ContentNotifier {
+  raise(change: RaisedContentChange, actor: Actor | null, detail?: string): Promise<void>
+}
+
+/** The node ids of a path, root first, without the root's own -1 or the recycle bin's. */
+const pathIds = (path: string): number[] =>
+  path
+    .split(',')
+    .map(Number)
+    .filter((id) => Number.isFinite(id) && id > 0)
+
+export function createContentNotifier(db: Db, options: ContentNotifierOptions): ContentNotifier {
+  const nodes = new NodeRepository(db)
+  const documents = new DocumentRepository(db)
+  const subscriptions = new NotificationRepository(db)
+  const outbox = new ContentNotificationRepository(db)
+
+  const resolve = async (change: RaisedContentChange) => {
+    if (change.keyKind === 'version') {
+      const version = await documents.atVersion(change.key)
+      return version ? nodes.byKey(version.document.key) : undefined
+    }
+    return nodes.byKey(change.key)
+  }
+
+  return {
+    async raise(change, actor, detail) {
+      if (!options.canSend) return
+      try {
+        const node = await resolve(change)
+        if (!node || node.objectType !== ObjectTypes.Document) return
+        // A trashed page sits under the recycle bin now; its subscribers are
+        // the ones where it was.
+        let path = pathIds(node.path)
+        if (node.trashed) {
+          const parentKey = await documents.originalParent(node.key)
+          const parent = parentKey ? await nodes.byKey(parentKey) : undefined
+          path = [...(parent ? pathIds(parent.path) : []), node.id]
+        }
+        let summary = detail ?? null
+        if (change.withDescendants) {
+          const [row] = await db.query<{ n: number }>(
+            'SELECT COUNT(*) AS n FROM node WHERE path LIKE ? AND node_object_type = ? AND trashed = ?',
+            [`${node.path},%`, ObjectTypes.Document, db.dialect.boolValue(false)],
+          )
+          const under = Number(row?.n ?? 0)
+          if (under > 0) summary = `and ${under} page${under === 1 ? '' : 's'} under it`
+        }
+        const actorId = actor?.key ? (await new UserRepository(db).byKey(actor.key))?.id : undefined
+        const occurredAt = new Date()
+        const runAfter = new Date(occurredAt.getTime() + (options.delayMs ?? DIGEST_DELAY_MS))
+        const rows = []
+        for (const actionId of change.actions) {
+          const userIds = (await subscriptions.subscribersFor(actionId, path)).filter(
+            (id) => id !== actorId,
+          )
+          if (userIds.length === 0) continue
+          const keys = await db.query<{ key: string }>(
+            `SELECT key FROM user_account WHERE id IN (${userIds.map(() => '?').join(', ')})`,
+            userIds,
+          )
+          for (const { key } of keys)
+            rows.push({
+              recipientUserKey: String(key),
+              actionId,
+              nodeKey: node.key,
+              nodeName: node.text ?? node.key,
+              actorUserKey: actor?.key ?? null,
+              actorName: actor?.name ?? null,
+              detail: summary,
+              occurredAt,
+              runAfter,
+            })
+        }
+        await outbox.enqueue(rows)
+      } catch (error) {
+        // Like the audit log: a notification that cannot be queued never costs the change.
+        log.error('A content notification could not be queued: {error}', { error: String(error) })
+      }
+    },
+  }
+}
+
+const VERBS: Record<string, string> = {
+  'Umb.Document.Duplicate': 'copied',
+  'Umb.Document.Delete': 'moved to the recycle bin',
+  'Umb.Document.Move': 'moved',
+  'Umb.Document.Create': 'created',
+  'Umb.Document.PublicAccess': 'changed who can see',
+  'Umb.Document.Publish': 'published',
+  'Umb.DocumentRecycleBin.Restore': 'restored',
+  'Umb.Document.Permissions': 'changed the permissions on',
+  'Umb.Document.Rollback': 'rolled back',
+  'Umb.Document.Sort': 'sorted the pages under',
+  'Umb.Document.Update': 'saved',
+}
+
+/** What the subscriber asked to hear of, as a reader would say it: "published". */
+export const verbFor = (actionId: string): string => VERBS[actionId] ?? 'changed'
+
+export interface NotificationEmailContext {
+  siteName: string
+  /** The page's address in the back office; undefined when the site's address is not known. */
+  editUrl: (nodeKey: string) => string | undefined
+  /** The recipient's language. Only English so far; the others fall back to it. */
+  language?: string | null
+}
+
+const when = (date: Date) =>
+  date.toLocaleString('en-GB', {
+    hour: '2-digit',
+    minute: '2-digit',
+    day: 'numeric',
+    month: 'short',
+    year: 'numeric',
+    timeZone: 'UTC',
+  })
+
+/** One plain-text e-mail for everything due to one person, oldest first. */
+export function notificationEmail(
+  recipient: { name: string },
+  items: readonly ContentNotification[],
+  context: NotificationEmailContext,
+): { subject: string; text: string } {
+  const who = (item: ContentNotification) => item.actorName ?? 'Someone'
+  const first = items[0] as ContentNotification
+  const subject =
+    items.length === 1
+      ? `[${context.siteName}] ${who(first)} ${verbFor(first.actionId)} "${first.nodeName}"`
+      : `[${context.siteName}] ${items.length} changes to pages you follow`
+  const lines = items.map((item) => {
+    const link = context.editUrl(item.nodeKey)
+    return [
+      `${who(item)} ${verbFor(item.actionId)} "${item.nodeName}"${item.detail ? ` (${item.detail})` : ''}, ${when(item.occurredAt)} UTC.`,
+      ...(link ? [`  ${link}`] : []),
+    ].join('\n')
+  })
+  const verbs = [...new Set(items.map((item) => verbFor(item.actionId)))]
+  const text = [
+    `Hello ${recipient.name},`,
+    '',
+    ...lines,
+    '',
+    `You get this because you asked to hear when pages here are ${verbs.join(', ')}. To change that, open the page's Notifications in the back office.`,
+  ].join('\n')
+  return { subject, text }
+}
+
+export interface ContentNotificationRunReport {
+  claimed: number
+  sent: number
+  skipped: number
+  retrying: number
+  failed: number
+}
+
+export interface ContentNotificationRunner {
+  runDue(now?: Date, limit?: number): Promise<ContentNotificationRunReport>
+  prune(before: Date): Promise<number>
+}
+
+export function createContentNotificationRunner(deps: {
+  db: Db
+  email: EmailPort | undefined
+  siteName: string
+  editUrl: (nodeKey: string) => string | undefined
+}): ContentNotificationRunner {
+  const { db } = deps
+  const outbox = new ContentNotificationRepository(db)
+  const users = new UserRepository(db)
+  const lookup = createNodeLookup(db)
+
+  /** Whether the person may still read the page: a change made since may have taken it away. */
+  const mayRead = async (userId: number, item: ContentNotification) => {
+    const found = (await lookup.documents([item.nodeKey])).get(item.nodeKey)
+    if (!found) return false
+    const access = await loadAccess(db, userId)
+    // Moved to the recycle bin is about where the page was, so the bin does not count against it.
+    const trashed = found.trashed && item.actionId !== 'Umb.Document.Delete'
+    return (
+      hasPathAccess(access.startNodes.document, found.chain, trashed) &&
+      permissionsForPath(access.groups, found.chain).has('Umb.Document.Read')
+    )
+  }
+
+  return {
+    async runDue(now = new Date(), limit = 25) {
+      const report: ContentNotificationRunReport = {
+        claimed: 0,
+        sent: 0,
+        skipped: 0,
+        retrying: 0,
+        failed: 0,
+      }
+      await outbox.releaseStale(new Date(now.getTime() - STALE_AFTER_MS))
+      for (const recipientKey of await outbox.dueRecipients(now, limit)) {
+        const items = await outbox.claimFor(recipientKey, now)
+        if (items.length === 0) continue
+        report.claimed += items.length
+        const skip = async (rows: readonly ContentNotification[], reason: string) => {
+          await outbox.skip(
+            rows.map((row) => row.id),
+            reason,
+          )
+          report.skipped += rows.length
+        }
+        const user = await users.byKey(recipientKey)
+        if (!user) {
+          await skip(items, 'The user no longer exists.')
+          continue
+        }
+        if (!user.isApproved) {
+          await skip(items, 'The user is disabled.')
+          continue
+        }
+        if (!isValidEmail(user.email)) {
+          await skip(items, 'The user has no e-mail address.')
+          continue
+        }
+        const allowed: ContentNotification[] = []
+        for (const item of items) {
+          if (await mayRead(user.id, item)) allowed.push(item)
+          else await skip([item], 'The user can no longer see the page.')
+        }
+        if (allowed.length === 0) continue
+        const ids = allowed.map((item) => item.id)
+        if (!deps.email) {
+          await outbox.fail(ids, 'This site has no e-mail provider.')
+          report.failed += ids.length
+          continue
+        }
+        const message = notificationEmail(user, allowed, {
+          siteName: deps.siteName,
+          editUrl: deps.editUrl,
+          language: user.languageIsoCode,
+        })
+        const result = await deps.email.send({
+          to: [{ email: user.email, name: user.name }],
+          subject: message.subject,
+          text: message.text,
+        })
+        if (result.ok) {
+          await outbox.succeed(ids)
+          report.sent += ids.length
+          continue
+        }
+        const attempts = Math.max(...allowed.map((item) => item.attempts))
+        const retryAt = retryAfter(attempts, now)
+        await outbox.fail(ids, result.error, retryAt)
+        if (retryAt) report.retrying += ids.length
+        else report.failed += ids.length
+        log.warning('A content notification to {email} was not sent: {error}', {
+          email: user.email,
+          error: result.error,
+        })
+      }
+      return report
+    },
+    prune: (before) => outbox.prune(before),
+  }
+}
+
+/** Every action a person can subscribe to, so a caller can say which one a change was. */
+export const NOTIFICATION_ACTION_IDS: readonly string[] = NOTIFIABLE_ACTIONS.map((a) => a.actionId)

package/src/email-text.ts

@@ -0,0 +1,61 @@
+/**
+ * The plain-text part of an e-mail, derived from its HTML. `docs/forms.md`.
+ *
+ * A reader whose client shows text, and every spam filter that weighs an HTML
+ * part with no text beside it, read this. It is a reading of the markup, not a
+ * rendering: block elements become lines, list items "- ", links "text (url)".
+ */
+import { decodeEntities } from '@crombolo/data'
+
+const PARAGRAPH =
+  /<\/?(p|h[1-6]|table|ul|ol|blockquote|pre|hr|section|article|header|footer)\b[^>]*>/gi
+const LINE = /<\/?(div|tr|br|address|dl|dt|dd|figure|figcaption|thead|tbody|tfoot)\b[^>]*\/?>/gi
+
+// Stand-ins for the breaks the markup asks for, kept apart from the source's
+// own whitespace, which HTML collapses to a space.
+const BLANK = '\u0001'
+const BREAK = '\u0002'
+const CELL = '\u0003'
+/** A run of breaks with the spaces around them: a blank line if any asked for one. */
+const BREAKS = new RegExp(`[ \u00a0]*[${BLANK}${BREAK}][${BLANK}${BREAK} \u00a0]*`, 'g')
+
+const attribute = (tag: string, name: string): string | undefined => {
+  const found = new RegExp(`\\s${name}\\s*=\\s*("([^"]*)"|'([^']*)'|([^\\s>]+))`, 'i').exec(tag)
+  return found ? (found[2] ?? found[3] ?? found[4]) : undefined
+}
+
+/** The text a reader of `html` would see, as lines. */
+export function htmlToText(html: string): string {
+  const marked = html
+    .replace(/<!--[\s\S]*?-->/g, '')
+    .replace(/<(head|style|script|title)\b[^>]*>[\s\S]*?<\/\1>/gi, '')
+    .replace(/<a\b([^>]*)>([\s\S]*?)<\/a>/gi, (_whole, attrs: string, inner: string) => {
+      const href = (attribute(attrs, 'href') ?? '').trim()
+      if (!href || href.startsWith('#')) return inner
+      const address = href.replace(/^mailto:/i, '')
+      const label = decodeEntities(inner.replace(/<[^>]*>/g, '')).trim()
+      return label && label !== decodeEntities(address) ? `${inner} (${address})` : address
+    })
+    .replace(/<li\b[^>]*>/gi, `${BREAK}- `)
+    .replace(/<\/li>/gi, BREAK)
+    .replace(PARAGRAPH, BLANK)
+    .replace(LINE, BREAK)
+    // A cell is a column: the row stays one line, its cells spaced apart.
+    .replace(/<\/t[dh]>/gi, CELL)
+    .replace(/<[^>]*>/g, '')
+    .replace(/\s+/g, ' ')
+
+  return decodeEntities(marked)
+    .replace(BREAKS, (run) => (run.includes(BLANK) ? '\n\n' : '\n'))
+    .split('\n')
+    .map((line) =>
+      line
+        .split(CELL)
+        .map((cell) => cell.replace(/[ \u00a0]+/g, ' ').trim())
+        .filter(Boolean)
+        .join('  '),
+    )
+    .join('\n')
+    .replace(/\n{3,}/g, '\n\n')
+    .trim()
+}

package/src/email.ts

@@ -218,6 +218,7 @@ export const EMAIL_DEPENDENT_FEATURES = [
   'Inviting backoffice users',
   'Password reset by e-mail',
   "Forms' Send email workflow",
+  'Notifications about page changes',
 ]
 
 export const EMAIL_SETUP_HINT =

package/src/form-files.ts

@@ -30,6 +30,8 @@ export interface FormFileOptions {
   onChanged?: () => Promise<void>
   /** The field and workflow types the site's wired bundles add. */
   formTypes?: FormTypes
+  /** The components on disk, so a Send email `template` is held to one that exists. */
+  componentAliases?: () => ReadonlySet<string>
 }
 
 export type FormWriteResult =
@@ -243,6 +245,7 @@ export async function saveForm(
   const problems = validateForms([...others, form], {
     contentTypeAliases: new Set(loaded.set.contentTypes.map((type) => type.alias)),
     types: options.formTypes,
+    componentAliases: options.componentAliases?.(),
   })
   if (problems.length > 0) return { ok: false, status: 'invalid', problems }
 

package/src/form-workflows.ts

@@ -14,6 +14,7 @@
 import {
   allFormFields,
   type FormValueToStore,
+  formFieldType,
   type SchemaForm,
   type SchemaFormWorkflow,
 } from '@crombolo/core'
@@ -25,7 +26,9 @@ import {
   type FormWorkflowRun,
   type NodeSchemaState,
 } from '@crombolo/data'
+import type { EmailField, EmailProps, EmailRenderResult } from '@crombolo/render'
 import type { EmailAttachment, EmailPort } from './email.ts'
+import { htmlToText } from './email-text.ts'
 import type { FormWorkflowTypeDefinition } from './form-types.ts'
 import { logger } from './logging.ts'
 import type { MediaFileStore } from './media-files.ts'
@@ -43,8 +46,13 @@ export interface WorkflowContext {
   entryId: string | null
   /** Which attempt this is, from 1. */
   attempt?: number
+  /** When the run was queued; now when absent. */
+  submittedAt?: Date
 }
 
+/** What an e-mail template is rendered from: its props, less the signal the renderer adds. */
+export type EmailTemplateProps = Omit<EmailProps, 'signal'>
+
 /** How long a bundle's workflow may run before its signal aborts. */
 const BUNDLE_WORKFLOW_TIMEOUT_MS = 60_000
 
@@ -60,6 +68,10 @@ export interface WorkflowDeps {
   onContentChanged?: () => void
   /** The workflow types wired bundles add, by type. */
   bundleWorkflows?: ReadonlyMap<string, FormWorkflowTypeDefinition>
+  /** Renders a `template` component to HTML; absent, a workflow naming one cannot send. */
+  renderEmail?: (alias: string, props: EmailTemplateProps) => Promise<EmailRenderResult>
+  /** The site's name and address, for an e-mail template. */
+  site?: () => Promise<{ name: string; url: string }>
 }
 
 export type WorkflowResult =
@@ -105,20 +117,94 @@ const asList = (value: unknown): string[] =>
         .filter(Boolean)
     : []
 
-/** The submission as a reader sees it: caption, then what was entered. */
-export function plainSummary(context: WorkflowContext): string {
+/**
+ * The submission as a reader sees it: caption, then what was entered. A field
+ * in `leftOut` (lower-cased aliases) says it was left out rather than showing
+ * its answer.
+ */
+export function plainSummary(
+  context: WorkflowContext,
+  leftOut: ReadonlySet<string> = new Set(),
+): string {
   const captions = new Map(
     allFormFields(context.form).map((field) => [field.alias, field.caption || field.alias]),
   )
   const lines = context.values.map(
     (value) =>
       `${captions.get(value.fieldAlias) ?? value.fieldAlias}: ${
-        value.values.length > 0 ? shown(value).join(', ') : '(not answered)'
+        leftOut.has(value.fieldAlias.toLowerCase())
+          ? '(sensitive, not included)'
+          : value.values.length > 0
+            ? shown(value).join(', ')
+            : '(not answered)'
       }`,
   )
   return [`${context.form.name}`, '', ...lines].join('\n')
 }
 
+/**
+ * The sensitive fields a workflow leaves out, lower-cased: all of them unless it
+ * sets `include-sensitive = true`.
+ */
+export function leftOutFields(form: SchemaForm, workflow: SchemaFormWorkflow): Set<string> {
+  if (workflow.settings['include-sensitive'] === true) return new Set()
+  return new Set(
+    allFormFields(form)
+      .filter((field) => field.sensitive)
+      .map((field) => field.alias.toLowerCase()),
+  )
+}
+
+/** The values with every left-out field emptied, so substitution shows nothing for it. */
+const withoutLeftOut = (
+  values: readonly FormValueToStore[],
+  leftOut: ReadonlySet<string>,
+): FormValueToStore[] =>
+  values.map((value) =>
+    leftOut.has(value.fieldAlias.toLowerCase())
+      ? { fieldAlias: value.fieldAlias, values: [] }
+      : value,
+  )
+
+/** An e-mail template's props: the form, its fields in order, and where it came from. */
+export function emailTemplateProps(
+  context: WorkflowContext,
+  leftOut: ReadonlySet<string>,
+  subject: string,
+  site: { name: string; url: string },
+): EmailTemplateProps {
+  const sent = withoutLeftOut(context.values, leftOut)
+  const byAlias = new Map(sent.map((value) => [value.fieldAlias.toLowerCase(), value]))
+  const fields: EmailField[] = allFormFields(context.form)
+    // A heading or a paragraph collects nothing; a bundle's type is kept, since
+    // only its own declaration could say it is presentational.
+    .filter((field) => formFieldType(field.type)?.presentational !== true)
+    .map((field) => {
+      const found = byAlias.get(field.alias.toLowerCase())
+      const values = found ? shown(found) : []
+      return {
+        alias: field.alias,
+        caption: field.caption || field.alias,
+        type: field.type,
+        values,
+        answered: values.length > 0,
+        sensitive: field.sensitive,
+        leftOut: leftOut.has(field.alias.toLowerCase()),
+      }
+    })
+  return {
+    form: context.form,
+    fields,
+    value: (alias) => {
+      const found = byAlias.get(alias.toLowerCase())
+      return found ? shown(found).join(', ') : ''
+    },
+    entry: { id: context.entryId, submittedAt: context.submittedAt ?? new Date() },
+    site,
+    subject,
+  }
+}
+
 // ------------------------------------------------------------------ send email
 
 async function sendEmail(
@@ -136,8 +222,26 @@ async function sendEmail(
     }
 
   const settings = workflow.settings
-  const to = asList(substitute(asString(settings.to) ?? '', context.values))
+  // Sensitive answers stay out of every part of the e-mail unless the workflow
+  // asks for them: an inbox is not covered by the sensitive-data permission.
+  const leftOut = leftOutFields(context.form, workflow)
+  const values = withoutLeftOut(context.values, leftOut)
+  const to = asList(substitute(asString(settings.to) ?? '', values))
   if (to.length === 0) return { ok: false, retry: false, error: 'The workflow has no recipient.' }
+  const subject = substitute(asString(settings.subject) ?? context.form.name, values).trim()
+
+  let html: string | undefined
+  let text: string
+  const template = asString(settings.template)
+  if (template) {
+    const rendered = await renderTemplate(template, context, leftOut, subject, deps)
+    if (!rendered.ok) return rendered
+    html = rendered.html
+    text = htmlToText(html)
+  } else
+    text = settings.body
+      ? substitute(String(settings.body), values)
+      : plainSummary(context, leftOut)
 
   const attachments: EmailAttachment[] = []
   if (settings['attach-uploads'] === true && deps.mediaFiles) {
@@ -146,7 +250,7 @@ async function sendEmail(
         .filter((field) => field.type === 'fileUpload')
         .map((field) => field.alias),
     )
-    for (const value of context.values) {
+    for (const value of values) {
       if (!uploadAliases.has(value.fieldAlias)) continue
       for (const src of value.values) {
         const file = await deps.mediaFiles.open(src)
@@ -166,21 +270,67 @@ async function sendEmail(
     bcc: asList(asString(settings.bcc) ?? '').map((email) => ({ email })),
     replyTo: (() => {
       const replyTo = asString(settings['reply-to'])
-      const resolved = replyTo ? substitute(replyTo, context.values) : undefined
+      const resolved = replyTo ? substitute(replyTo, values) : undefined
       return resolved ? { email: resolved } : undefined
     })(),
     from: (() => {
       const from = asString(settings.from)
       return from ? { email: from } : undefined
     })(),
-    subject: substitute(asString(settings.subject) ?? context.form.name, context.values),
-    text: settings.body ? substitute(String(settings.body), context.values) : plainSummary(context),
+    subject,
+    text,
+    ...(html === undefined ? {} : { html }),
     attachments: attachments.length > 0 ? attachments : undefined,
   })
   // A provider that refused is worth another go: a 500 or a timeout is weather.
   return result.ok ? { ok: true } : { ok: false, retry: true, error: result.error }
 }
 
+/**
+ * The HTML of a workflow's e-mail template, or why there is none.
+ *
+ * Both failures are retried. A template missing now may be one a node has not
+ * caught up with after a deploy; one that throws may be reading something that
+ * is briefly unavailable. After the last attempt the run is left failed, with
+ * the reason a person can act on.
+ */
+async function renderTemplate(
+  template: string,
+  context: WorkflowContext,
+  leftOut: ReadonlySet<string>,
+  subject: string,
+  deps: WorkflowDeps,
+): Promise<{ ok: true; html: string } | (WorkflowResult & { ok: false })> {
+  if (!deps.renderEmail)
+    return {
+      ok: false,
+      retry: false,
+      error: `The e-mail template '${template}' cannot be rendered here: this server renders no templates.`,
+    }
+  try {
+    const site = (await deps.site?.()) ?? { name: '', url: '' }
+    const rendered = await deps.renderEmail(
+      template,
+      emailTemplateProps(context, leftOut, subject, site),
+    )
+    if (rendered.status === 'ok') return { ok: true, html: rendered.html }
+    return {
+      ok: false,
+      retry: true,
+      error:
+        rendered.status === 'missing'
+          ? `There is no e-mail template '${template}': no components/${template}.tsx in the views this node serves.`
+          : rendered.message,
+    }
+  } catch (error) {
+    return {
+      ok: false,
+      retry: true,
+      error: `The e-mail template '${template}' failed: ${error instanceof Error ? error.message : String(error)}`,
+    }
+  }
+}
+
 // ------------------------------------------------------------------ save as content
 
 async function saveAsContent(
@@ -404,6 +554,7 @@ export function createWorkflowRunner(
       values: run.payload,
       entryId: run.entryId,
       attempt: run.attempts,
+      submittedAt: run.createDate,
     }
     let result: WorkflowResult
     try {

package/src/index.ts

@@ -25,6 +25,7 @@ export * from './bundles.ts'
 export * from './busy.ts'
 export * from './components.ts'
 export * from './config.ts'
+export * from './content-notifications.ts'
 export * from './content-type-udt.ts'
 export * from './database.ts'
 export * from './diagnostics.ts'
@@ -37,6 +38,7 @@ export * from './email-notice.ts'
 export * from './email-postmark.ts'
 export * from './email-resend.ts'
 export * from './email-ses.ts'
+export * from './email-text.ts'
 export * from './extensions-notice.ts'
 export * from './external-sign-in.ts'
 export * from './file-intake.ts'

package/src/jobs.ts

@@ -1,9 +1,11 @@
 /**
  * Background jobs, as Umbraco runs them: scheduled publishing every minute and
  * version cleanup every hour when it is enabled, plus the search indexer
- * draining its queue and the audit log ageing out old entries hourly. Each run can also be called directly, which is
- * how tests drive them. On a multi-node Postgres site every node runs them;
- * each schedule and queued item is claimed atomically, so it runs once.
+ * draining its queue, the audit log ageing out old entries hourly, and the
+ * form, webhook and content notification queues. Each run can also be called
+ * directly, which is how tests drive them. Every node that owns writes (`all`
+ * and `api`) runs them; each schedule and queued item is claimed atomically, so
+ * it runs once.
  */
 
 import type { NodeSchemaState } from '@crombolo/data'
@@ -16,6 +18,11 @@ import {
 } from '@crombolo/data'
 import type { PublishedCache } from '@crombolo/render'
 import { auditRetainedSince, recordAudit } from './adapters/audit.ts'
+import type {
+  ContentNotificationRunner,
+  ContentNotificationRunReport,
+  ContentNotifier,
+} from './content-notifications.ts'
 import type { WorkflowRunner, WorkflowRunReport } from './form-workflows.ts'
 import { logger } from './logging.ts'
 import type { MediaFileStore } from './media-files.ts'
@@ -49,6 +56,11 @@ export interface JobsOptions {
   searchIndexingMs?: number
   /** Days the audit log keeps an entry; 0 or absent keeps them forever. */
   auditRetentionDays?: number
+  /** Content notifications (story 045): queued by changes, sent here. Absent without e-mail. */
+  contentNotifications?: ContentNotificationRunner
+  contentNotificationsMs?: number
+  /** Queues the notifications scheduled publishing makes, as an editor's publish does. */
+  notifier?: ContentNotifier
 }
 
 export interface ScheduledRun {
@@ -63,6 +75,8 @@ export interface BackgroundJobs {
   runFormWorkflows(now?: Date): Promise<WorkflowRunReport>
   /** Delivers the webhook and bundle events that are due. */
   runWebhooks(now?: Date): Promise<WorkflowRunReport>
+  /** Sends the content notifications that are due (story 045). */
+  runContentNotifications(now?: Date): Promise<ContentNotificationRunReport>
   /** Indexes every queued item, and returns how many. docs/search.md. */
   runSearchIndexing(): Promise<number>
   /** Something was queued here: index it shortly, rather than at the next tick. */
@@ -115,13 +129,24 @@ export function createBackgroundJobs(options: JobsOptions): BackgroundJobs {
       }
     }
     if (run.published.length + run.unpublished.length > 0) options.cache.invalidate()
-    for (const key of run.published)
+    for (const key of run.published) {
       await options.webhooks?.raise({ alias: 'Umbraco.ContentPublish', key })
+      await options.notifier?.raise(
+        { actions: ['Umb.Document.Publish'], key, keyKind: 'document' },
+        { key: null, name: 'The schedule' },
+        'scheduled',
+      )
+    }
     for (const key of run.unpublished)
       await options.webhooks?.raise({ alias: 'Umbraco.ContentUnpublish', key })
     return run
   }
 
+  async function runContentNotifications(now = new Date()): Promise<ContentNotificationRunReport> {
+    const runner = options.contentNotifications
+    return runner ? runner.runDue(now) : { claimed: 0, sent: 0, skipped: 0, retrying: 0, failed: 0 }
+  }
+
   async function runAuditRetention(now = new Date()): Promise<number> {
     const before = auditRetainedSince(options.auditRetentionDays ?? 0, now)
     return before ? new AuditLog(options.db).prune(before) : 0
@@ -184,6 +209,7 @@ export function createBackgroundJobs(options: JobsOptions): BackgroundJobs {
     runAuditRetention,
     runFormWorkflows,
     runWebhooks,
+    runContentNotifications,
     runSearchIndexing,
     kickSearchIndexing() {
       if (timers.length === 0 || kicked) return
@@ -204,6 +230,12 @@ export function createBackgroundJobs(options: JobsOptions): BackgroundJobs {
       if (options.formWorkflows) every(options.formWorkflowsMs ?? 15_000, runFormWorkflows)
       // As often, for the same reason: a receiver that is waiting notices a minute.
       if (options.webhooks) every(options.webhooksMs ?? 15_000, runWebhooks)
+      // A digest waits a minute anyway; this is how soon after that it goes.
+      const notifications = options.contentNotifications
+      if (notifications) {
+        every(options.contentNotificationsMs ?? 15_000, runContentNotifications)
+        every(60 * 60_000, () => notifications.prune(new Date(Date.now() - 30 * 86_400_000)))
+      }
       if (options.versionCleanup.enabled) every(60 * 60_000, runVersionCleanup)
       if (options.auditRetentionDays) every(60 * 60_000, runAuditRetention)
       const files = options.mediaFiles

package/src/ports.ts

@@ -74,6 +74,7 @@ import { createWebhookPort } from './adapters/webhooks.ts'
 import { createApprovals } from './approvals.ts'
 import { COMPONENT_SNIPPETS } from './component-snippets.ts'
 import { type CromboloConfig, type UserLinkSender, VERSION } from './config.ts'
+import type { ContentNotifier } from './content-notifications.ts'
 import { type EmailPort, resolveEmailPort } from './email.ts'
 import { createFileIntake } from './file-intake.ts'
 import { formTypesFor } from './form-types.ts'
@@ -405,6 +406,26 @@ export interface DepsOptions {
   onViewsChange?: (alias: string) => void | Promise<void>
   /** Items were queued for the search index; the indexer can start on them now. */
   onSearchQueued?: () => void
+  /** Queues content notifications for changes made outside the router (story 045). */
+  notifier?: ContentNotifier
+}
+
+/** The back office's address, e.g. `https://site.example/crombolo`; undefined when the site's own is not set. */
+export function backOfficeUrl(
+  config: Pick<CromboloConfig, 'applicationUrl' | 'backOfficePath'>,
+): string | undefined {
+  return config.applicationUrl
+    ? `${config.applicationUrl.replace(/\/$/, '')}${config.backOfficePath}`
+    : undefined
+}
+
+/** A page's address in the back office, for a link in an e-mail. */
+export function documentEditUrl(
+  config: Pick<CromboloConfig, 'applicationUrl' | 'backOfficePath'>,
+  key: string,
+): string | undefined {
+  const base = backOfficeUrl(config)
+  return base ? `${base}/section/content/workspace/document/edit/${key}` : undefined
 }
 
 function createTemporaryFilePort(files: MediaFileStore): TemporaryFilePort {
@@ -493,6 +514,15 @@ export function createDeps(options: DepsOptions): ManagementApiDeps {
       endSessions: async (userId) => {
         await store.endAllSessionsForUser(userId)
       },
+      onPagePermissionsChanged: (principal, nodeKeys) =>
+        Promise.all(
+          nodeKeys.map((key) =>
+            options.notifier?.raise(
+              { actions: ['Umb.Document.Permissions'], key, keyKind: 'document' },
+              { key: principal.id, name: principal.name },
+            ),
+          ),
+        ).then(() => undefined),
     })
     // Story 032: the authenticator provider, offered only where secrets can be sealed.
     const twoFactor = new TwoFactorService(options.db, {
@@ -620,6 +650,7 @@ export function createDeps(options: DepsOptions): ManagementApiDeps {
           enabled: options.config.trackRedirects,
         }),
         options.config.siteDir,
+        Boolean(email),
       )
     if (deps.documents) {
       const documents = deps.documents
@@ -627,6 +658,8 @@ export function createDeps(options: DepsOptions): ManagementApiDeps {
         db: options.db,
         nodeState: options.schema?.nodeState,
         email,
+        backOfficeUrl: backOfficeUrl(options.config),
+        notifier: options.notifier,
         // Through the same port an editor's publish takes, so what approval
         // publishes is cached, tracked and announced as any publish is.
         publisher: {

package/src/server.ts

@@ -98,6 +98,7 @@ import { CommandError, installBundleContent } from './bundle-install.ts'
 import { bundleChains, bundleTablesReport } from './bundle-tables.ts'
 import { createBundleRedirects, createServerBundles, validateServerBundles } from './bundles.ts'
 import { busyResponse } from './busy.ts'
+import { listEmailTemplates } from './components.ts'
 import {
   type CromboloConfig,
   listeningBodyLimit,
@@ -105,6 +106,7 @@ import {
   type ServerRole,
   VERSION,
 } from './config.ts'
+import { createContentNotificationRunner, createContentNotifier } from './content-notifications.ts'
 import { attachDatabase, bootstrapDatabase } from './database.ts'
 import { createDeliveryMemberSecurity } from './delivery-members.ts'
 import { createDiagnostics } from './diagnostics.ts'
@@ -143,7 +145,7 @@ import { mediaStoreFromEnvironment } from './media-store.ts'
 import { createMemberAuth, MEMBER_ROUTE_PREFIX } from './member-auth.ts'
 import { noNodesPage } from './no-nodes.ts'
 import { NotImplementedLog } from './not-implemented.ts'
-import { createDeps, PREVIEW_COOKIE, resolveUserLinkSender } from './ports.ts'
+import { createDeps, documentEditUrl, PREVIEW_COOKIE, resolveUserLinkSender } from './ports.ts'
 import { createRedirectTracker } from './redirects.ts'
 import { createRemote } from './remote.ts'
 import { withRemoteMedia } from './remote-media.ts'
@@ -167,6 +169,7 @@ import { syncConfiguredRedirects } from './redirects.ts'
 import {
   bootSchema,
   CacheInstructionPoller,
+  componentAliasesIn,
   importSchema,
   type SchemaBoot,
   watchSchema,
@@ -751,6 +754,9 @@ export async function createServer(config: CromboloConfig = loadConfig()): Promi
   // gates the options rather than `emailStatus.available`: development delivers
   // to the console, and that is a working flow for the person using it.
   const canSendUserLinks = Boolean(resolveUserLinkSender(config, email))
+  // Story 045: a change queues the e-mails its subscribers asked for. Nothing is
+  // queued on a site that cannot send; development sends to the console.
+  const notifier = createContentNotifier(db, { canSend: Boolean(email) })
   const mediaFiles = new MediaFileStore(mediaStore)
   const images = new ImageProcessor(mediaStore)
   const webhooks = createWebhookService({
@@ -775,6 +781,7 @@ export async function createServer(config: CromboloConfig = loadConfig()): Promi
     schema,
     mediaFiles,
     email,
+    notifier,
     onSearchQueued: () => jobs.kickSearchIndexing(),
     // This node looks again at once; the others are told to. The write has
     // already landed wherever `componentsDir` points, so there is nothing to
@@ -812,6 +819,10 @@ export async function createServer(config: CromboloConfig = loadConfig()): Promi
     onWebhookEvent: (event) => {
       void webhooks.raise(event)
     },
+    // After the response too: the subscribers are worked out and queued, and sent a minute later.
+    onContentChange: (change, principal) => {
+      void notifier.raise(change, principal ? { key: principal.id, name: principal.name } : null)
+    },
     onServerEvent: (event) => {
       events.broadcast('notify', [event])
       // Saves, deletes and moves all announce themselves; whatever they queued gets indexed now.
@@ -874,7 +885,21 @@ export async function createServer(config: CromboloConfig = loadConfig()): Promi
       nodeId: schema.nodeId,
       onContentChanged: () => cache.invalidate(),
       bundleWorkflows: formTypes.workflows,
+      renderEmail: (alias, props) => renderer.renderEmail(alias, props),
+      site: async () => ({
+        name: (await seo.siteDefaults()).siteName || config.siteName,
+        url: config.applicationUrl,
+      }),
     }),
+    notifier,
+    contentNotifications: email
+      ? createContentNotificationRunner({
+          db,
+          email,
+          siteName: config.siteName,
+          editUrl: (key) => documentEditUrl(config, key),
+        })
+      : undefined,
     onDocumentChanged: (key) =>
       events.broadcast('notify', [
         { eventSource: 'Umbraco:CMS:Document', eventType: 'Updated', key },
@@ -1273,6 +1298,7 @@ export async function createServer(config: CromboloConfig = loadConfig()): Promi
         reason: emailStatus.reason,
         affects: emailStatus.affects,
         canSendUserLinks,
+        canSendNotifications: Boolean(email),
       })
     }
 
@@ -1329,6 +1355,18 @@ export async function createServer(config: CromboloConfig = loadConfig()): Promi
       // Hyphenated, so no form alias (letters and digits) can be mistaken for it.
       if (action === 'available-types' && request.method === 'GET')
         return Response.json(describeFormTypes(formTypes.types))
+      // The designer's "E-mail design" picker.
+      if (action === 'email-templates' && request.method === 'GET')
+        return Response.json({
+          items: listEmailTemplates(
+            config.componentsDir,
+            definitions.flatMap((form) =>
+              form.workflows.flatMap((workflow) =>
+                typeof workflow.settings.template === 'string' ? [workflow.settings.template] : [],
+              ),
+            ),
+          ),
+        })
 
       const entries = new FormEntryRepository(db)
       const byKey = formsByKey(definitions)
@@ -1340,6 +1378,7 @@ export async function createServer(config: CromboloConfig = loadConfig()): Promi
         schemaDir: config.schemaDir,
         writable: config.schemaWritable,
         formTypes: formTypes.types,
+        componentAliases: () => componentAliasesIn(config.componentsDir),
         onChanged: config.schemaStore
           ? async () => {
               await publishSchema(config.schemaStore as SchemaStore, config.schemaDir)