@hachej/boring-core 0.1.44 → 0.1.45

package/dist/app/server/index.js

@@ -9,7 +9,7 @@ import {
   registerRoutes,
   registerSettingsRoutes,
   registerWorkspaceRoutes
-} from "../../chunk-UM5SHYIS.js";
+} from "../../chunk-FZICNVJW.js";
 import {
   PostgresUserStore,
   PostgresWorkspaceStore,
@@ -208,6 +208,13 @@ var FRONTEND_AUTH_PAGES_SPA_ONLY = /* @__PURE__ */ new Set([
   "/auth/callback/github",
   "/auth/callback/google"
 ]);
+function resolveCoreLoadConfigOptions(options = {}, nodeEnv = process.env.NODE_ENV) {
+  return {
+    allowMissingSecrets: nodeEnv !== "production",
+    ...options.appRoot && !options.loadConfigOptions?.tomlPath ? { tomlPath: path.resolve(options.appRoot, "boring.app.toml") } : {},
+    ...options.loadConfigOptions
+  };
+}
 function dedupeStrings(values) {
   return Array.from(new Set(values));
 }
@@ -526,10 +533,7 @@ async function createCoreWorkspaceAgentServer(options = {}) {
     );
   }
   assertCoreStaticPluginEntries(options.plugins);
-  const config = options.config ?? await loadConfig({
-    allowMissingSecrets: process.env.NODE_ENV !== "production",
-    ...options.loadConfigOptions
-  });
+  const config = options.config ?? await loadConfig(resolveCoreLoadConfigOptions(options));
   const { app, sql, db, userStore, workspaceStore } = await createCoreRuntime(config);
   const appRoot = options.appRoot;
   const serveFrontend = options.serveFrontend ?? (process.env.NODE_ENV !== "development" && Boolean(appRoot));

package/dist/{chunk-UM5SHYIS.js → chunk-FZICNVJW.js}

@@ -101,6 +101,30 @@ var SIXTEEN_MB = 16 * 1024 * 1024;
 var INSECURE_PLACEHOLDER_SECRET = "0000000000000000000000000000000000000000000000000000000000000000";
 var INSECURE_DATABASE_URL = "postgres://placeholder:placeholder@localhost:5432/placeholder";
 var INSECURE_ENCRYPTION_KEY = "aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa";
+function formatDisplayName(name) {
+  const trimmed = name.trim().replace(/[<>]/g, "");
+  if (/^[A-Za-z0-9 ._-]+$/.test(trimmed)) return trimmed;
+  return `"${trimmed.replace(/["\\]/g, "\\$&")}"`;
+}
+function isDefaultBoringDisplayName(name) {
+  return name.toLowerCase().replace(/[\s._-]+/g, "") === "boringui";
+}
+function normalizeMailFrom(appName, rawFrom) {
+  const from = rawFrom.trim();
+  const addressWithDisplay = from.match(/^(.*?)\s*<([^>]+)>$/);
+  if (addressWithDisplay) {
+    const displayName = addressWithDisplay[1].trim().replace(/^"(.*)"$/, "$1");
+    const address = addressWithDisplay[2].trim();
+    if (!displayName || isDefaultBoringDisplayName(displayName)) {
+      return `${formatDisplayName(appName)} <${address}>`;
+    }
+    return from;
+  }
+  if (/^[^\s@<>]+@[^\s@<>]+$/.test(from)) {
+    return `${formatDisplayName(appName)} <${from}>`;
+  }
+  return from;
+}
 function parseRateLimitOverrides(raw) {
   if (!raw) return void 0;
   try {
@@ -224,7 +248,18 @@ async function loadConfig(options) {
       ...toml.features?.invite_ttl_days != null && { inviteTtlDays: toml.features.invite_ttl_days }
     }
   };
-  return validateConfig(raw);
+  const config = validateConfig(raw);
+  if (!config.auth.mail) return config;
+  return {
+    ...config,
+    auth: {
+      ...config.auth,
+      mail: {
+        ...config.auth.mail,
+        from: normalizeMailFrom(config.appName, config.auth.mail.from)
+      }
+    }
+  };
 }
 function validateConfig(raw) {
   const result = coreConfigSchema.safeParse(raw);
@@ -1423,6 +1458,7 @@ import { Button as Button4, Section as Section5, Text as Text5 } from "@react-em
 import { jsx as jsx5, jsxs as jsxs5 } from "react/jsx-runtime";
 function WorkspaceInvite({
   acceptUrl,
+  appName,
   inviterName,
   workspaceName,
   role,
@@ -1432,7 +1468,7 @@ function WorkspaceInvite({
     Layout,
     {
       preview: `${inviterName} invited you to ${workspaceName}`,
-      appName: workspaceName,
+      appName,
       children: /* @__PURE__ */ jsxs5(Section5, { style: content4, children: [
         /* @__PURE__ */ jsx5(Text5, { style: heading4, children: "You've been invited" }),
         /* @__PURE__ */ jsxs5(Text5, { style: paragraph4, children: [
@@ -1568,6 +1604,7 @@ async function renderMagicLink(data) {
 async function renderWorkspaceInvite(data) {
   const element = WorkspaceInvite({
     acceptUrl: data.acceptUrl,
+    appName: data.appName,
     inviterName: data.inviterName,
     workspaceName: data.workspaceName,
     role: data.role,
@@ -2426,6 +2463,7 @@ var inviteRoutesPlugin = async (app, opts) => {
           const email = await renderWorkspaceInvite({
             to: parsed.data.email,
             acceptUrl,
+            appName: app.config.appName,
             inviterName: request.user.name ?? request.user.email,
             workspaceName: workspace?.name ?? "Workspace",
             role: parsed.data.role,

package/dist/server/index.d.ts

@@ -326,6 +326,7 @@ declare function renderMagicLink(data: MagicLinkData): Promise<RenderedEmail>;
 interface WorkspaceInviteData {
     to: string;
     acceptUrl: string;
+    appName: string;
     inviterName: string;
     workspaceName: string;
     role: string;

package/dist/server/index.js

@@ -24,7 +24,7 @@ import {
   requireWorkspaceMember,
   validateConfig,
   validatePasswordStrength
-} from "../chunk-UM5SHYIS.js";
+} from "../chunk-FZICNVJW.js";
 import {
   InsufficientCreditError,
   PostgresMeteringStore,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@hachej/boring-core",
-  "version": "0.1.44",
+  "version": "0.1.45",
   "type": "module",
   "license": "MIT",
   "description": "Foundation package for boring-ui-v2 apps: DB, auth, config, HTTP app factory, and frontend app shell.",
@@ -79,9 +79,9 @@
     "react-router-dom": "^7.14.2",
     "smol-toml": "^1.6.1",
     "zod": "^3.25.76",
-    "@hachej/boring-ui-kit": "0.1.44",
-    "@hachej/boring-workspace": "0.1.44",
-    "@hachej/boring-agent": "0.1.44"
+    "@hachej/boring-ui-kit": "0.1.45",
+    "@hachej/boring-workspace": "0.1.45",
+    "@hachej/boring-agent": "0.1.45"
   },
   "devDependencies": {
     "@testing-library/jest-dom": "^6.9.1",