@fabrika/app 0.8.0 → 0.8.2

package/package.json

@@ -1,6 +1,6 @@
 {
 	"name": "@fabrika/app",
-	"version": "0.8.0",
+	"version": "0.8.2",
 	"type": "module",
 	"license": "MIT",
 	"repository": {
@@ -93,14 +93,14 @@
 		"test": "bun test --path-ignore-patterns='src/react/**' && bun test --isolate src/react"
 	},
 	"dependencies": {
-		"@fabrika/auth": "0.8.0",
-		"@fabrika/auth-core": "0.8.0",
-		"@fabrika/db": "0.8.0",
-		"@fabrika/email": "0.8.0",
-		"@fabrika/jwks": "0.8.0",
-		"@fabrika/platform": "0.8.0",
-		"@fabrika/platform-node": "0.8.0",
-		"@fabrika/proxy-core": "0.8.0",
+		"@fabrika/auth": "0.8.2",
+		"@fabrika/auth-core": "0.8.2",
+		"@fabrika/db": "0.8.2",
+		"@fabrika/email": "0.8.2",
+		"@fabrika/jwks": "0.8.2",
+		"@fabrika/platform": "0.8.2",
+		"@fabrika/platform-node": "0.8.2",
+		"@fabrika/proxy-core": "0.8.2",
 		"altcha-lib": "2.6.0",
 		"jose": "^5.9.0"
 	},

package/skill/SKILL.md

@@ -1,6 +1,6 @@
 ---
 name: fabrika-app
-version: 0.8.0
+version: 0.8.2
 description: >
   How to write and change a Fabrika application: src/vocabulary.ts, db/migrations/, src/db/tables.ts, the
   slices' endpoints.ts with their handlers, fabrika.contract.ts, jobs, files, webhooks, share links, connectors

package/skill/references/app-setup.md

@@ -19,22 +19,22 @@ the SPA is added with it.
 		"test": "bun test --isolate"
 	},
 	"dependencies": {
-		"@fabrika/app": "0.8.0",
-		"@fabrika/db": "0.8.0",
-		"@fabrika/provider-zerops": "0.8.0",
-		"@fabrika/proxy-core": "0.8.0",
-		"@fabrika/ui": "0.8.0",
+		"@fabrika/app": "0.8.2",
+		"@fabrika/db": "0.8.2",
+		"@fabrika/provider-zerops": "0.8.2",
+		"@fabrika/proxy-core": "0.8.2",
+		"@fabrika/ui": "0.8.2",
 		"kysely": "0.29.6",
 		"react": "^19.0.0",
 		"react-dom": "^19.0.0",
 		"zod": "^3.25.76"
 	},
 	"devDependencies": {
-		"@fabrika/check": "0.8.0",
-		"@fabrika/cli": "0.8.0",
-		"@fabrika/platform": "0.8.0",
+		"@fabrika/check": "0.8.2",
+		"@fabrika/cli": "0.8.2",
+		"@fabrika/platform": "0.8.2",
 		"@happy-dom/global-registrator": "^20.11.2",
-		"@types/bun": "latest",
+		"@types/bun": "^1.4.3",
 		"@types/react": "^19.0.0",
 		"@types/react-dom": "^19.0.0",
 		"typescript": "^5.9.3"
@@ -245,9 +245,9 @@ zerops:
         - bun run build:web
 ```
 
-The platform's build runs the tests, writes the entrypoint, runs `fabrika-check` and the type check. Its start script
-runs `fabrika db migrate`, `fabrika db codegen --verify` and `fabrika db test-isolation` before the server: the
-application is not ready until every generated test passes. It writes every `FABRIKA_*` variable; never set one.
+The platform's build runs the tests, writes the entrypoint, runs `fabrika-check` and the type check. Its init commands
+run `fabrika db migrate`, `fabrika db codegen --verify` and `fabrika db test-isolation` before the server starts: a
+version does not go live until every generated test passes. It writes every `FABRIKA_*` variable; never set one.
 
 ## The SPA (added when the application has one)
 

package/skill/references/jobs.md

@@ -177,7 +177,14 @@ that says so): it records an outbox row and kicks the job (below). `references/p
   (RFC 8058), so a mailbox offers one-click unsubscribe. The URL is a public procedure of your own with a signed token
   (`ctx.url('api.mail.unsubscribe', { query: { t: ctx.tokens.sign('unsubscribe', claims, { days: 400 }) } })`,
   `references/endpoint.md`). There are no free headers. A transport without the header refuses the message.
-- The idempotency key covers the attachments and the unsubscribe URL: a repeated key with other content is refused.
+- `broadcast: true` marks one message of a send to many recipients (a newsletter, an announcement to every student),
+  as opposed to mail a recipient's own action triggers (a sign-in link, a confirmation). Providers keep the two apart
+  and pause an account whose transactional channel carries broadcast mail, so mark every message of a bulk send. It
+  needs `unsubscribe`. A transport without `ctx.mail.capabilities.broadcast` refuses it as `invalid_message`. Under
+  `mailer: 'installation'` the capability is true even where the installation's provider sends none; the first
+  message then fails `invalid_message`, so stop a bulk send at its first refusal instead of failing every row.
+- The idempotency key covers the attachments, the unsubscribe URL and `broadcast`: a repeated key with other content
+  is refused.
 - `idempotencyKey` is 1 to 200 visible ASCII characters, unique per message in the application environment, and
   derived from the outbox row (`intake-link-<link id>`), never random. `ctx.mail` puts a prefix of the installation
   and the environment in front of it, so no other application on the same provider account shares it.

package/src/jobs/mail.ts

@@ -93,6 +93,10 @@ export function jobMail(input: JobMailInput): AppMail {
 			if (typeof key !== 'string' || !APP_MAIL_KEY.test(key)) {
 				throw new EmailDeliveryError(`Email idempotency key is not 1..${MAX_APP_MAIL_KEY_LENGTH} visible ASCII characters`, { code: 'invalid_message' })
 			}
+			// Checked here, not left to the sender: one written before `broadcast` existed would send it as transactional mail.
+			if (available && message.broadcast === true && sender.capabilities.broadcast !== true) {
+				throw new EmailDeliveryError('This mail transport sends no broadcast email', { code: 'invalid_message' })
+			}
 			// Without a transport the send fails `mail_not_configured` below, and no file is read for it.
 			const attachments = available ? await readAttachments(message.attachments ?? [], sender.capabilities.maxAttachmentBytes, open) : []
 			const transported: EmailMessage = {
@@ -104,6 +108,7 @@ export function jobMail(input: JobMailInput): AppMail {
 				...(message.replyTo === undefined ? {} : { replyTo: message.replyTo }),
 				...(message.fromName === undefined ? {} : { fromName: message.fromName }),
 				...(message.unsubscribe === undefined ? {} : { unsubscribeUrl: message.unsubscribe.url }),
+				...(message.broadcast === true ? { broadcast: true } : {}),
 				...(attachments.length === 0 ? {} : { attachments }),
 			}
 			try {
@@ -309,6 +314,9 @@ const SenderCapabilities = z.object({
 	maxBatch: z.int().positive(),
 	listUnsubscribe: z.boolean().optional(),
 	maxAttachmentBytes: z.int().positive().optional(),
+	refusedAttachmentExtensions: z.array(z.string()).readonly().optional(),
+	minBodyLength: z.int().positive().optional(),
+	broadcast: z.boolean().optional(),
 })
 
 /** What `serve`'s `mail` returned: a sender, `null` for none, `undefined` for anything else. */

package/src/jobs/types.ts

@@ -54,6 +54,12 @@ export interface AppMailMessage {
 	 * an `https:` link, usually `ctx.url` of a public procedure that verifies a signed token.
 	 */
 	readonly unsubscribe?: { readonly url: string }
+	/**
+	 * One message of a send to many recipients (a newsletter, an announcement), not a reply to what the recipient did.
+	 * The transport sends it on the provider's channel for broadcast mail, which keeps it apart from sign-in links and
+	 * receipts. It needs `unsubscribe`. A transport without `capabilities.broadcast` refuses it as `invalid_message`.
+	 */
+	readonly broadcast?: boolean
 	/**
 	 * Files the message carries: references this attempt holds and may read, as `ctx.files.open` takes them. Only a
 	 * `live` file is sent; the bytes of all of them together stay within the transport's `maxAttachmentBytes`, and a

package/src/testing/proxy.ts

@@ -25,12 +25,12 @@ import { contractProxyTable } from '@fabrika/proxy-core/manifest'
 export type ProxyOutcome =
 	| {
 		readonly outcome: 'forward'
-		/** Every header only the proxy may assert, with the value the decision gave it. */
-		readonly asserted: ReadonlyMap<string, string>
 		/**
-		 * Whether the request's own `Authorization` reaches the application: not on an anonymous endpoint, except a webhook
-		 * row the decision marked to pass it on.
+		 * Every header only the proxy may assert, with the value the decision gave it. A credentialed request that carried
+		 * `Authorization` has it replaced by the minted token, so the caller's `px_` key never reaches the application.
 		 */
+		readonly asserted: ReadonlyMap<string, string>
+		/** Whether the request's own `Authorization` reaches the application: only on a webhook row the decision marked to pass it on. */
 		readonly keepsAuthorization: boolean
 		/** What the application's answer is given for an admitted cross-origin request, over its own headers. */
 		readonly decorate: (headers: Headers) => void
@@ -105,10 +105,15 @@ export function endpointProxy(options: EndpointProxyOptions): TestProxy {
 				asserted.set(header, value)
 			}
 		}
+		const keepsAuthorization = verification.headers.get(FORWARD_AUTHORIZATION_HEADER) === '1'
+		const minted = asserted.get(PROXY_TOKEN_HEADER)
+		if (!keepsAuthorization && minted !== undefined && request.headers.has('Authorization')) {
+			asserted.set('Authorization', `Bearer ${minted}`)
+		}
 		return {
 			outcome: 'forward',
 			asserted,
-			keepsAuthorization: asserted.has(PROXY_TOKEN_HEADER) || verification.headers.get(FORWARD_AUTHORIZATION_HEADER) === '1',
+			keepsAuthorization,
 			decorate: (answer) => {
 				if (allowOrigin !== null) applyCrossOriginHeaders(answer, crossOriginHeaders(allowOrigin))
 			},