@dforge-core/metadata 0.0.50 → 0.0.52

package/CHANGELOG.md

@@ -5,6 +5,24 @@ All notable changes to `@dforge-core/metadata` are documented here.
 The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/),
 and this package adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
+## [0.0.52] — 2026-11-10
+
+### Changed
+
+- **`ocrExtract` builtin description:** the endpoint argument is `'platform'` (the server's own OCR service) or an
+  external URL, refused when it is a private address the server does not allow. It no longer says the host must be on
+  `Dsl:Limits:AllowedHosts`.
+- **`settings.schema.json`:** `desc` is the help text shown under a setting's name, not another label key; `description`
+  beside a `label` is taken as that help text. The installer now stores `label` and `desc` (core #1649).
+
+## [0.0.51] — 2026-11-08
+
+### Added
+
+- **`params.fieldOptions` on a column:** `entity.schema.json` describes the per-record rules `foreColor`, `backColor`
+  and `canEdit`, each a formula over the record. `$value` stands for the column itself, so one rule on a column domain
+  fits every column using it. Install refuses a rule that does not parse or calls an unknown function.
+
 ## [0.0.50] — 2026-11-04
 
 ### Added

package/dist/dsl/index.js

@@ -854,9 +854,9 @@ var BUILTINS = [
   },
   {
     name: "sendEmail",
-    signature: "sendEmail(to, subjectOrTemplate, dataOrBody?, attachments?)",
+    signature: "sendEmail(to, subjectOrTemplate, dataOrBody?, attachments?, options?)",
     returns: "void",
-    doc: "Queue an outbound email. Three arguments, and the **second** picks the mode: `sendEmail(to, 'order.shipped', { ref: [code] })` sends a template, `sendEmail(to, 'Your order shipped', '<p>\u2026</p>')` sends raw HTML. A second argument with no spaces that contains `.` or `_` is read as a template code \u2014 so a raw subject like `'Shipped.'` silently becomes one; give a raw subject spaces. The optional **fourth** argument attaches files: a `printPdf()`, `attachText()` or `attachBase64()` result, or an array of them (`[a, b]`; pass a single file as itself, because a one-name `[a]` reads as a field reference in the DSL). A `printPdf()` file can be attached only by the user who generated it (or a workspace admin) and not in a scheduled job; a file built with `attachText()` / `attachBase64()` has no owner and works everywhere, a scheduled job included. At most 5 files and 10 MB in all per email (`Email:MaxAttachments`, `Email:MaxAttachmentBytes`). A file the sender may not attach fails the action."
+    doc: "Queue an outbound email. Three arguments, and the **second** picks the mode: `sendEmail(to, 'order.shipped', { ref: [code] })` sends a template, `sendEmail(to, 'Your order shipped', '<p>\u2026</p>')` sends raw HTML. A second argument with no spaces that contains `.` or `_` is read as a template code \u2014 so a raw subject like `'Shipped.'` silently becomes one; give a raw subject spaces. The optional **fourth** argument attaches files: a `printPdf()`, `attachText()` or `attachBase64()` result, or an array of them (`[a, b]`; pass a single file as itself, because a one-name `[a]` reads as a field reference in the DSL). A `printPdf()` file can be attached only by the user who generated it (or a workspace admin) and not in a scheduled job; a file built with `attachText()` / `attachBase64()` has no owner and works everywhere, a scheduled job included. At most 5 files and 10 MB in all per email (`Email:MaxAttachments`, `Email:MaxAttachmentBytes`). A file the sender may not attach fails the action. The optional **fifth** argument sets threading headers so a reply finds this mail: `{ messageId, inReplyTo, references, replyTo }` (ids with angle brackets, `references` an array; pass `null` as the fourth argument when there are no files). Every key is optional; an unknown key, a malformed id (strictly `<word.word@word.word>`) or address, or a line break fails the action by name."
   },
   // External calls
   {
@@ -865,6 +865,12 @@ var BUILTINS = [
     returns: "string",
     doc: "HTTP request to an external API; returns the body as a string. Max 10 calls per script, 120s timeout, 5MB response."
   },
+  {
+    name: "fetchMail",
+    signature: "fetchMail(options)",
+    returns: "object",
+    doc: "Read new mail from one IMAP folder, read-only: nothing is marked seen, moved or deleted, so the mailbox stays the user's and the cursor you store says what was imported. Options: `host`, `username`, `secret` (the code of a module secret \u2014 the password is never written in a script), `port` (993; 143 with `security: 'starttls'`), `security` (`'ssl'` by default or `'starttls'`), `auth` (`'password'`, the only one for now), `folder` (`'INBOX'`), the cursor `uidValidity` + `afterUid` from the previous result, `since` (a date, for the first call), `limit` (messages). Returns `{ uidValidity, lastUid, more, reset, messages }`: store `uidValidity` and `lastUid` for the next call, call again while `more` is true, and treat `reset: true` as a mailbox renumbered by the server (the cursor was dropped and the folder read again). Each message has `uid`, `messageId`, `inReplyTo`, `references`, `date` (ISO 8601), `from`/`replyTo` (`{ address, name }`), `to`, `cc`, `envelopeTo`, `subject`, `text`, `html` (sanitized; remote images parked in `data-remote-src`), `autoReply`, `attachments` and `droppedAttachments`. Each attachment is a staged file `{ $tempId, fileName, mimeType, size, checksum, contentId, inline }`: pass it as the value of a `file` column in `insert()` / `update()` to keep it (an unused one expires with the temp sweep). Failures throw with the code first: `AUTH_FAILED`, `CONNECT_FAILED`, `TLS_FAILED`, `FOLDER_NOT_FOUND`; a host on a private network needs `Dsl:Limits:AllowedHosts`. Meant for scheduled jobs and async actions: up to 3 calls per run, 25 messages and 40 s per call (`Dsl:Limits:MaxMailFetchesPerExecution` / `MaxMailMessagesPerFetch` / `MailFetchBudgetSeconds`)."
+  },
   {
     name: "callService",
     signature: "callService(name, args)",
@@ -937,7 +943,7 @@ var BUILTINS = [
     name: "ocrExtract",
     signature: "ocrExtract(fileField, endpointBaseUrl, schema?, opts?)",
     returns: "string (v1) | object (v2)",
-    doc: "Run OCR extraction against a document. **The return type follows the mode, and only `opts.mode` selects it** \u2014 a third argument alone never does. Without `opts.mode` (v1) the third argument is forwarded as `hints` and the result is the raw bundle as a JSON **string**: `JSON.parse()` it, or every property read is `undefined`. With `{ mode: 'extract' }` the third argument is a schema object and the result is already parsed \u2014 `{ fields, confidence?, unmatched, raw_text, meta }`. `{ mode: 'summary' }` needs no schema and returns `{ summary, raw_text, meta }` parsed. `{ profile: 'module_cd.profile_cd' }` uses a registered extraction profile, implies mode `extract`, and cannot be combined with an inline schema. The OCR host must be on `Dsl:Limits:AllowedHosts`."
+    doc: "Run OCR extraction against a document. **The return type follows the mode, and only `opts.mode` selects it** \u2014 a third argument alone never does. Without `opts.mode` (v1) the third argument is forwarded as `hints` and the result is the raw bundle as a JSON **string**: `JSON.parse()` it, or every property read is `undefined`. With `{ mode: 'extract' }` the third argument is a schema object and the result is already parsed \u2014 `{ fields, confidence?, unmatched, raw_text, meta }`. `{ mode: 'summary' }` needs no schema and returns `{ summary, raw_text, meta }` parsed. `{ profile: 'module_cd.profile_cd' }` uses a registered extraction profile, implies mode `extract`, and cannot be combined with an inline schema. `endpointBaseUrl` `'platform'` is this server's own OCR service; any other value is an external service's URL, refused when it is a private address the server does not allow."
   },
   {
     name: "detectDocument",