@hartl-services/medusa-base 2.2.1 → 2.4.0

package/.medusa/server/src/workflows/hooks/draft-order-confirmation-default.js

@@ -0,0 +1,39 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+const utils_1 = require("@medusajs/framework/utils");
+const workflows_sdk_1 = require("@medusajs/framework/workflows-sdk");
+const core_flows_1 = require("@medusajs/medusa/core-flows");
+/**
+ * A draft order starts without a customer order confirmation: drafts are
+ * Admin tasks (sample shipments, manual orders), and the Admin opts in per
+ * draft through the "Bestellbestätigung" widget. `createOrderWorkflow` is the
+ * workflow behind `POST /admin/draft-orders`; its `no_notification_order`
+ * flag is overridden here because the Admin dashboard never sends it.
+ */
+core_flows_1.createOrderWorkflow.hooks.orderCreated(async ({ order }, { container }) => {
+    const { data } = await container
+        .resolve(utils_1.ContainerRegistrationKeys.QUERY)
+        .graph({
+        entity: "order",
+        fields: ["id", "is_draft_order", "no_notification"],
+        filters: { id: order.id },
+    });
+    const created = data[0];
+    if (!created?.is_draft_order || created.no_notification === true) {
+        return;
+    }
+    await container
+        .resolve(utils_1.Modules.ORDER)
+        .updateOrders(created.id, { no_notification: true });
+    return new workflows_sdk_1.StepResponse(undefined, {
+        id: created.id,
+        no_notification: created.no_notification ?? false,
+    });
+}, async (previous, { container }) => {
+    if (!previous)
+        return;
+    await container
+        .resolve(utils_1.Modules.ORDER)
+        .updateOrders(previous.id, { no_notification: previous.no_notification });
+});
+//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoiZHJhZnQtb3JkZXItY29uZmlybWF0aW9uLWRlZmF1bHQuanMiLCJzb3VyY2VSb290IjoiIiwic291cmNlcyI6WyIuLi8uLi8uLi8uLi8uLi9zcmMvd29ya2Zsb3dzL2hvb2tzL2RyYWZ0LW9yZGVyLWNvbmZpcm1hdGlvbi1kZWZhdWx0LnRzIl0sIm5hbWVzIjpbXSwibWFwcGluZ3MiOiI7O0FBQ0EscURBR2tDO0FBQ2xDLHFFQUFnRTtBQUNoRSw0REFBaUU7QUFhakU7Ozs7OztHQU1HO0FBQ0gsZ0NBQW1CLENBQUMsS0FBSyxDQUFDLFlBQVksQ0FDcEMsS0FBSyxFQUFFLEVBQUUsS0FBSyxFQUFFLEVBQUUsRUFBRSxTQUFTLEVBQUUsRUFBRSxFQUFFO0lBQ2pDLE1BQU0sRUFBRSxJQUFJLEVBQUUsR0FBRyxNQUFNLFNBQVM7U0FDN0IsT0FBTyxDQUFDLGlDQUF5QixDQUFDLEtBQUssQ0FBQztTQUN4QyxLQUFLLENBQUM7UUFDTCxNQUFNLEVBQUUsT0FBTztRQUNmLE1BQU0sRUFBRSxDQUFDLElBQUksRUFBRSxnQkFBZ0IsRUFBRSxpQkFBaUIsQ0FBQztRQUNuRCxPQUFPLEVBQUUsRUFBRSxFQUFFLEVBQUUsS0FBSyxDQUFDLEVBQUUsRUFBRTtLQUMxQixDQUFDLENBQUE7SUFDSixNQUFNLE9BQU8sR0FBRyxJQUFJLENBQUMsQ0FBQyxDQUE2QixDQUFBO0lBQ25ELElBQUksQ0FBQyxPQUFPLEVBQUUsY0FBYyxJQUFJLE9BQU8sQ0FBQyxlQUFlLEtBQUssSUFBSSxFQUFFLENBQUM7UUFDakUsT0FBTTtJQUNSLENBQUM7SUFFRCxNQUFNLFNBQVM7U0FDWixPQUFPLENBQXNCLGVBQU8sQ0FBQyxLQUFLLENBQUM7U0FDM0MsWUFBWSxDQUFDLE9BQU8sQ0FBQyxFQUFFLEVBQUUsRUFBRSxlQUFlLEVBQUUsSUFBSSxFQUFFLENBQUMsQ0FBQTtJQUN0RCxPQUFPLElBQUksNEJBQVksQ0FBa0MsU0FBUyxFQUFFO1FBQ2xFLEVBQUUsRUFBRSxPQUFPLENBQUMsRUFBRTtRQUNkLGVBQWUsRUFBRSxPQUFPLENBQUMsZUFBZSxJQUFJLEtBQUs7S0FDbEQsQ0FBQyxDQUFBO0FBQ0osQ0FBQyxFQUNELEtBQUssRUFBRSxRQUEwQyxFQUFFLEVBQUUsU0FBUyxFQUFFLEVBQUUsRUFBRTtJQUNsRSxJQUFJLENBQUMsUUFBUTtRQUFFLE9BQU07SUFDckIsTUFBTSxTQUFTO1NBQ1osT0FBTyxDQUFzQixlQUFPLENBQUMsS0FBSyxDQUFDO1NBQzNDLFlBQVksQ0FBQyxRQUFRLENBQUMsRUFBRSxFQUFFLEVBQUUsZUFBZSxFQUFFLFFBQVEsQ0FBQyxlQUFlLEVBQUUsQ0FBQyxDQUFBO0FBQzdFLENBQUMsQ0FDRixDQUFBIn0=

package/.medusa/server/src/workflows/order/mark-zero-total-order-paid.js

@@ -0,0 +1,45 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.markZeroTotalOrderPaidWorkflow = void 0;
+const utils_1 = require("@medusajs/framework/utils");
+const workflows_sdk_1 = require("@medusajs/framework/workflows-sdk");
+const core_flows_1 = require("@medusajs/medusa/core-flows");
+/**
+ * An order that costs nothing and has no payment collection (an Admin draft,
+ * e.g. a free sample shipment) would stay "Nicht bezahlt" forever: Medusa
+ * derives the payment status from payment collections only. A completed
+ * 0 € collection makes it "Bezahlt" in the Admin and in database queries,
+ * without a payment provider. Orders that already carry a collection (every
+ * checkout order) are left alone, so the workflow is safe to run twice.
+ */
+exports.markZeroTotalOrderPaidWorkflow = (0, workflows_sdk_1.createWorkflow)("order-mark-zero-total-paid", (input) => {
+    const lockKey = (0, workflows_sdk_1.transform)(input, ({ order_id }) => `order-zero-total-paid:${order_id}`);
+    (0, core_flows_1.acquireLockStep)({ key: lockKey, timeout: 10, ttl: 60 });
+    const { data: orders } = (0, core_flows_1.useQueryGraphStep)({
+        entity: "order",
+        fields: ["id", "total", "payment_collections.id"],
+        filters: { id: input.order_id },
+    });
+    const needsPayment = (0, workflows_sdk_1.transform)(orders, (rows) => {
+        const order = rows[0];
+        return (!!order &&
+            utils_1.MathBN.eq(utils_1.MathBN.convert(order.total), 0) &&
+            !(order.payment_collections ?? []).some(Boolean));
+    });
+    const created = (0, workflows_sdk_1.when)("order-zero-total-needs-payment", needsPayment, (needed) => needed).then(() => {
+        const collections = core_flows_1.createOrderPaymentCollectionWorkflow.runAsStep({
+            input: { order_id: input.order_id, amount: 0 },
+        });
+        const completion = (0, workflows_sdk_1.transform)(collections, (rows) => ({
+            selector: { id: rows[0].id },
+            update: { status: utils_1.PaymentCollectionStatus.COMPLETED },
+        }));
+        (0, core_flows_1.updatePaymentCollectionStep)(completion);
+        return collections;
+    });
+    (0, core_flows_1.releaseLockStep)({ key: lockKey });
+    return new workflows_sdk_1.WorkflowResponse((0, workflows_sdk_1.transform)({ created }, ({ created }) => ({
+        marked_paid: !!created?.length,
+    })));
+});
+//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoibWFyay16ZXJvLXRvdGFsLW9yZGVyLXBhaWQuanMiLCJzb3VyY2VSb290IjoiIiwic291cmNlcyI6WyIuLi8uLi8uLi8uLi8uLi9zcmMvd29ya2Zsb3dzL29yZGVyL21hcmstemVyby10b3RhbC1vcmRlci1wYWlkLnRzIl0sIm5hbWVzIjpbXSwibWFwcGluZ3MiOiI7OztBQUFBLHFEQUdrQztBQUNsQyxxRUFLMEM7QUFDMUMsNERBTW9DO0FBV3BDOzs7Ozs7O0dBT0c7QUFDVSxRQUFBLDhCQUE4QixHQUFHLElBQUEsOEJBQWMsRUFDMUQsNEJBQTRCLEVBQzVCLENBQUMsS0FBa0MsRUFBRSxFQUFFO0lBQ3JDLE1BQU0sT0FBTyxHQUFHLElBQUEseUJBQVMsRUFDdkIsS0FBSyxFQUNMLENBQUMsRUFBRSxRQUFRLEVBQUUsRUFBRSxFQUFFLENBQUMseUJBQXlCLFFBQVEsRUFBRSxDQUN0RCxDQUFBO0lBQ0QsSUFBQSw0QkFBZSxFQUFDLEVBQUUsR0FBRyxFQUFFLE9BQU8sRUFBRSxPQUFPLEVBQUUsRUFBRSxFQUFFLEdBQUcsRUFBRSxFQUFFLEVBQUUsQ0FBQyxDQUFBO0lBRXZELE1BQU0sRUFBRSxJQUFJLEVBQUUsTUFBTSxFQUFFLEdBQUcsSUFBQSw4QkFBaUIsRUFBQztRQUN6QyxNQUFNLEVBQUUsT0FBTztRQUNmLE1BQU0sRUFBRSxDQUFDLElBQUksRUFBRSxPQUFPLEVBQUUsd0JBQXdCLENBQUM7UUFDakQsT0FBTyxFQUFFLEVBQUUsRUFBRSxFQUFFLEtBQUssQ0FBQyxRQUFRLEVBQUU7S0FDaEMsQ0FBQyxDQUFBO0lBQ0YsTUFBTSxZQUFZLEdBQUcsSUFBQSx5QkFBUyxFQUFDLE1BQU0sRUFBRSxDQUFDLElBQUksRUFBVyxFQUFFO1FBQ3ZELE1BQU0sS0FBSyxHQUFJLElBQTRCLENBQUMsQ0FBQyxDQUFDLENBQUE7UUFDOUMsT0FBTyxDQUNMLENBQUMsQ0FBQyxLQUFLO1lBQ1AsY0FBTSxDQUFDLEVBQUUsQ0FBQyxjQUFNLENBQUMsT0FBTyxDQUFDLEtBQUssQ0FBQyxLQUF3QixDQUFDLEVBQUUsQ0FBQyxDQUFDO1lBQzVELENBQUMsQ0FBQyxLQUFLLENBQUMsbUJBQW1CLElBQUksRUFBRSxDQUFDLENBQUMsSUFBSSxDQUFDLE9BQU8sQ0FBQyxDQUNqRCxDQUFBO0lBQ0gsQ0FBQyxDQUFDLENBQUE7SUFFRixNQUFNLE9BQU8sR0FBRyxJQUFBLG9CQUFJLEVBQ2xCLGdDQUFnQyxFQUNoQyxZQUFZLEVBQ1osQ0FBQyxNQUFNLEVBQUUsRUFBRSxDQUFDLE1BQU0sQ0FDbkIsQ0FBQyxJQUFJLENBQUMsR0FBRyxFQUFFO1FBQ1YsTUFBTSxXQUFXLEdBQUcsaURBQW9DLENBQUMsU0FBUyxDQUFDO1lBQ2pFLEtBQUssRUFBRSxFQUFFLFFBQVEsRUFBRSxLQUFLLENBQUMsUUFBUSxFQUFFLE1BQU0sRUFBRSxDQUFDLEVBQUU7U0FDL0MsQ0FBQyxDQUFBO1FBQ0YsTUFBTSxVQUFVLEdBQUcsSUFBQSx5QkFBUyxFQUFDLFdBQVcsRUFBRSxDQUFDLElBQUksRUFBRSxFQUFFLENBQUMsQ0FBQztZQUNuRCxRQUFRLEVBQUUsRUFBRSxFQUFFLEVBQUUsSUFBSSxDQUFDLENBQUMsQ0FBQyxDQUFDLEVBQUUsRUFBRTtZQUM1QixNQUFNLEVBQUUsRUFBRSxNQUFNLEVBQUUsK0JBQXVCLENBQUMsU0FBUyxFQUFFO1NBQ3RELENBQUMsQ0FBQyxDQUFBO1FBQ0gsSUFBQSx3Q0FBMkIsRUFBQyxVQUFVLENBQUMsQ0FBQTtRQUN2QyxPQUFPLFdBQVcsQ0FBQTtJQUNwQixDQUFDLENBQUMsQ0FBQTtJQUVGLElBQUEsNEJBQWUsRUFBQyxFQUFFLEdBQUcsRUFBRSxPQUFPLEVBQUUsQ0FBQyxDQUFBO0lBQ2pDLE9BQU8sSUFBSSxnQ0FBZ0IsQ0FDekIsSUFBQSx5QkFBUyxFQUNQLEVBQUUsT0FBTyxFQUFFLEVBQ1gsQ0FBQyxFQUFFLE9BQU8sRUFBRSxFQUFnQyxFQUFFLENBQUMsQ0FBQztRQUM5QyxXQUFXLEVBQUUsQ0FBQyxDQUFDLE9BQU8sRUFBRSxNQUFNO0tBQy9CLENBQUMsQ0FDSCxDQUNGLENBQUE7QUFDSCxDQUFDLENBQ0YsQ0FBQSJ9

package/README.md

@@ -41,6 +41,9 @@ packing lists) and S3 file storage, and the turnkey `medusa-config.ts` preset
   repair").
 - Requires passwords of at least 15 characters for customers and Admin users
   (see "Password policy").
+- Starts Admin draft orders without a customer order confirmation and marks
+  placed 0 € orders without payment as paid (see "Draft orders and 0 €
+  orders").
 - Exports the shop's `medusa-config.ts` helpers from
   `@hartl-services/medusa-base/config` and Sentry's `register()` from
   `@hartl-services/medusa-base/instrumentation` (see "Config helpers" and
@@ -739,6 +742,36 @@ links itself:
 Nothing to configure; `medusa db:migrate` after installing or upgrading to
 0.4.1 is enough.
 
+## Draft orders and 0 € orders
+
+Draft orders (Medusa's `@medusajs/draft-order` plugin, loaded by default) are
+the shop's way to enter an order in the Admin: sample shipments, orders taken
+by phone, replacements. Item prices and the shipping amount are set directly
+in the draft; converting it never involves a payment provider.
+
+- **Customer order confirmation off by default.** The
+  `createOrderWorkflow.hooks.orderCreated` hook
+  (`workflows/hooks/draft-order-confirmation-default`) sets Medusa's
+  `no_notification` on every new draft, also when an API caller sent
+  `no_notification_order: false`. The Admin switches it per draft in the
+  **Bestellbestätigung** widget on the draft's detail page
+  (`GET`/`POST /admin/draft-orders/:id/order-confirmation`, see the E-Mail
+  "Admin API"). On conversion the `order-placed` subscriber records the
+  customer confirmation as `suppressed` (`notifications_disabled`); the copy
+  to the shop's order address is still sent. The shipment mail follows the
+  Admin's "notify customer" choice per shipment, not this switch.
+- **0 € orders count as paid.** Medusa derives an order's payment status from
+  its payment collections only, so a converted 0 € draft would stay
+  "Nicht bezahlt". The subscriber `order-zero-total-paid` runs
+  `order-mark-zero-total-paid` on `order.placed`: an order with a total of 0
+  and no payment collection gets a completed 0 € payment collection and reads
+  "Bezahlt" (`payment_status: captured`). Orders that already carry a
+  collection, i.e. every checkout order, are left alone. In SQL, a paid
+  order is one whose linked `payment_collection` (via
+  `order_payment_collection`) has `status = 'completed'`.
+
+Orders placed before installing this version keep their state.
+
 ## Config helpers
 
 `@hartl-services/medusa-base/config` holds the generic environment helpers a
@@ -864,6 +897,10 @@ Options of the `email` namespace:
   `orderNotificationEmail` mailbox. `verifyAccountUrl` (optional builder,
   like `passwordResetUrl`; the mail appends `#token=`) is the storefront page
   that confirms an account, needed while `customer_verification` is on.
+  `adminAffiliateApplicationsUrl` (optional builder, receives
+  `{ applicationId }`) is the Admin page of the partner applications; the
+  notification about a new application shows its "Im Admin prüfen" button
+  only with it.
   `layout` and `renderers` are optional overrides, see "Shop configuration and
   default templates".
 
@@ -878,7 +915,7 @@ is off. The former `documentsEnabled` option no longer exists: Documents is
 always part of the base.
 
 The event contracts the module consumes for shipment, cancellation, refund and
-affiliate-reminder e-mails come from
+affiliate-reminder and partner-application e-mails come from
 `@hartl-services/medusa-food-supplements-contracts/events/documents` and
 `/events/affiliate`, so installing the base does not pull in Affiliate.
 
@@ -913,10 +950,10 @@ feature is switched on again.
 | Key                   | Label                  | Default | Gates                                                                                                                                                                                                                    | Keeps running when off                                   |
 | --------------------- | ---------------------- | ------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ | -------------------------------------------------------- |
 | (plugin switch)       | E-Mail                 | on      | every route under `/admin/email/*` (mail log, resends, terms versions; 404); jobs `email-reconcile-attempts`, `email-reconcile-pending-messages`, `email-retry-messages`; every feature below                            | checkout and orders; already queued messages stay stored |
-| `order_mails`         | Bestell-Mails          | on      | subscribers `order-placed`, `email-shipment-created`, `email-order-canceled`, `return-requested`, `return-received`, `documents-shipment-invoice-assignment-decided`, `documents-order-cancellation-ready`, `documents-refund-ready` | jobs, Admin routes, already created messages             |
+| `order_mails`         | Bestell-Mails          | on      | subscribers `order-placed`, `email-shipment-created`, `email-order-canceled`, `return-requested`, `return-received`, `documents-shipment-invoice-assignment-decided`, `documents-order-cancellation-ready`, `documents-refund-ready`; route `/admin/draft-orders/:id/order-confirmation` (404) and its draft-order widget | jobs, Admin routes, already created messages             |
 | `account_mails`       | Konto-Mails            | on      | subscribers `password-reset`, `user-invite`, `customer-verification` (the last one only with `customer_verification` on as well)                                                                                          | jobs, Admin routes, already created messages             |
 | `customer_verification` | Kontobestätigung per E-Mail | off | Medusa's e-mail verification of customer logins (see "Kontobestätigung per E-Mail"), route `POST /store/customer-verification/resend` (404 while off), subscriber `customer-verification`; child of `account_mails` | checkout and orders; confirmed accounts stay confirmed, already created messages |
-| `affiliate_reminders` | Affiliate-Erinnerungen | on      | subscriber `affiliate-consignment-reminder-due`                                                                                                                                                                          | jobs, Admin routes, already created messages             |
+| `affiliate_reminders` | Affiliate-Mails        | on      | subscribers `affiliate-consignment-reminder-due` (reminders to affiliates) and `affiliate-application-submitted` (notification to the shop about a new partner application)                                              | jobs, Admin routes, already created messages             |
 
 With the plugin switched off the three jobs return immediately, so nothing
 is sent, retried or reconciled until it is switched on again; then the jobs
@@ -1043,7 +1080,8 @@ Storefront contract (DTOs, schema and path from the Contracts package,
 ### Ownership
 
 - Documents owns document issuance and publishes immutable document facts.
-- Affiliate owns reminder eligibility and publishes reminder facts.
+- Affiliate owns reminder eligibility and publishes reminder and application
+  facts.
 - Email resolves recipients, renders content, attaches files, and owns delivery
   status plus the append-only global Terms PDF history.
 - Public HTTP DTOs, schemas, and paths remain in
@@ -1167,6 +1205,28 @@ type Payload = {
 };
 ```
 
+`affiliate.application_submitted.v1`
+
+```ts
+type Payload = {
+  schema_version: 1;
+  application_id: string;
+  customer_id: string;
+  customer_email: string | null;
+  customer_first_name: string | null;
+  customer_last_name: string | null;
+  company_name: string | null;
+  message: string | null;
+};
+```
+
+Affiliate publishes it when `POST /store/affiliates/register` has stored an
+application. Email creates one `affiliate.application_submitted.admin` message
+per `application_id` (business key
+`affiliate-application-submitted-admin:<application_id>`, so a replay or a
+concurrent request never sends a second mail) addressed to
+`orderNotificationEmail`. The persisted template data are exactly these facts.
+
 `period_start` is a valid `YYYY-MM-01`, `due_date` is a valid `YYYY-MM-DD`, and
 `reminder_key` is exactly
 `affiliate-consignment:<affiliate_id>:<period_start>`. `locale`, when present,
@@ -1177,7 +1237,8 @@ has at most 35 characters. Email runtime-validates every contract before use.
 - The accepted kinds are exactly `order.received`, `order.received.admin`, `order.shipped`,
   `order.canceled`, `order.return_requested`, `order.return_received`,
   `order.refunded`, `auth.password_reset`, `auth.verification`,
-  `affiliate.consignment_report_due` and `user.invite`.
+  `affiliate.consignment_report_due`, `affiliate.application_submitted.admin`
+  and `user.invite`.
 - Every automatic message has a deterministic business key.
 - Every placed Order creates independent customer and Shop intents. The customer
   intent honors `no_notification`; the Shop intent always targets the static
@@ -1248,7 +1309,7 @@ an info box lists number, customer, e-mail and order time, followed by an
 button is left out without it) and `timeZone` (IANA; the order time is left
 out without it). `buildFoodShopConfig` sets both (`<MEDUSA_BACKEND_URL>/app/
 orders/<id>` and its `timeZone` option). The layout receives `audience`
-(`"shop"` for this kind and `user.invite`, `"customer"` for all others) and
+(`"shop"` for this kind, `affiliate.application_submitted.admin` and `user.invite`, `"customer"` for all others) and
 shows the contact line only to customers.
 
 The shipping confirmation (`order.shipped`, one per fulfillment) receives a
@@ -1329,6 +1390,17 @@ Partnerbereich" button and says the mail can be ignored once the report is
 submitted. The button leads to a 404 while the affiliate plugin's
 `partner_portal` toggle is off.
 
+The partner application notification (`affiliate.application_submitted.admin`)
+goes to `orderNotificationEmail`, like the order notification, and is gated by
+the `affiliate_reminders` feature ("Affiliate-Mails"). Its subject is "Neue
+Partner-Bewerbung von <Firma>" (without a company the applicant's name, then
+the e-mail address; just "Neue Partner-Bewerbung" if none is known). An info
+box lists company, name and e-mail (only the present ones), the applicant's
+message follows as an escaped paragraph, and an "Im Admin prüfen" button links
+`adminAffiliateApplicationsUrl` (left out without it; `buildFoodShopConfig`
+sets `<MEDUSA_BACKEND_URL>/app/affiliates/applications`). Its layout audience
+is `"shop"`. All applicant text is HTML-escaped.
+
 The Admin invite (`user.invite`) has the subject "Einladung ins Admin-Team von
 <displayName>", an "Einladung annehmen" button with the link as copyable text,
 the invite's current expiry ("Die Einladung ist gültig bis 02.10.2026, 01:40
@@ -1430,6 +1502,11 @@ Email exposes authenticated Admin operations at:
   most 5 MiB with its `effective_at` timestamp.
 - `GET /admin/email/terms-versions/:id/download` streams one authenticated,
   non-cacheable PDF download.
+- `GET /admin/draft-orders/:id/order-confirmation` returns
+  `AdminDraftOrderConfirmationResponse` (`{ draft_order_id,
+  send_order_confirmation }`); `POST` with
+  `{ send_order_confirmation: boolean }` switches it. Both answer 404 for an
+  order that is not (or no longer) a draft and while `order_mails` is off.
 
 List and detail responses expose only safe identifiers and linkage metadata,
 kind/status and safe status codes, resource references, trigger, attempt
@@ -1456,10 +1533,18 @@ composes the base's `PluginPageShell` and `PluginFeatureSections` from
 two operations sections below them, in this order: **AGB/PDF-Versionen** and,
 as the last section, the **E-Mail-Protokoll**. They show Terms PDF and mail
 log state to act on, not configuration the plugin reads at run time. The mail
-log provides bounded server pagination, allowlisted status/kind filters, safe
-message and attempt status, and an explicitly confirmed resend action.
+log provides bounded server pagination, allowlisted status/kind filters, a
+search by the exact resource ID (e.g. `order_…`, `cus_…`, as pasted from
+elsewhere), safe message and attempt status, and an explicitly confirmed
+resend action.
 Recipient, template, and payload data are intentionally absent from the page.
 
+The draft-order detail page carries the **Bestellbestätigung** widget (zone
+`draft_order.details.side.after`, hidden while `order_mails` is off). Its
+switch "An Kunden senden" starts off and decides whether the customer receives
+the order confirmation when the draft is converted (see "Draft orders and
+0 € orders").
+
 The `AGB/PDF-Versionen` section manages the global Terms PDFs. Admins can
 upload a PDF of at most 5 MiB with its effective date, review versions newest
 first, and download a selected version. Uploads receive a fresh request UUID;

package/dist/email/types/email-kinds.d.ts

@@ -1,5 +1,5 @@
 import { z } from "@medusajs/framework/zod";
-export declare const EMAIL_KINDS: readonly ["order.received", "order.received.admin", "order.shipped", "order.canceled", "order.return_requested", "order.return_received", "order.refunded", "auth.password_reset", "affiliate.consignment_report_due", "user.invite", "auth.verification"];
+export declare const EMAIL_KINDS: readonly ["order.received", "order.received.admin", "order.shipped", "order.canceled", "order.return_requested", "order.return_received", "order.refunded", "auth.password_reset", "affiliate.consignment_report_due", "affiliate.application_submitted.admin", "user.invite", "auth.verification"];
 export declare const EmailKindSchema: z.ZodEnum<{
     "order.received": "order.received";
     "order.received.admin": "order.received.admin";
@@ -10,6 +10,7 @@ export declare const EmailKindSchema: z.ZodEnum<{
     "order.refunded": "order.refunded";
     "auth.password_reset": "auth.password_reset";
     "affiliate.consignment_report_due": "affiliate.consignment_report_due";
+    "affiliate.application_submitted.admin": "affiliate.application_submitted.admin";
     "user.invite": "user.invite";
     "auth.verification": "auth.verification";
 }>;

package/dist/email/types/email-kinds.js

@@ -12,6 +12,7 @@ exports.EMAIL_KINDS = [
     "order.refunded",
     "auth.password_reset",
     "affiliate.consignment_report_due",
+    "affiliate.application_submitted.admin",
     "user.invite",
     "auth.verification",
 ];

package/dist/email/types/shop-configuration.d.ts

@@ -39,6 +39,14 @@ export type ShopEmailConfiguration = Readonly<{
     adminOrderUrl?: (input: Readonly<{
         orderId: string;
     }>) => string;
+    /**
+     * Link to the partner applications in the Medusa Admin; the shop's
+     * notification about a new partner application shows an "Im Admin prüfen"
+     * button only when it is set.
+     */
+    adminAffiliateApplicationsUrl?: (input: Readonly<{
+        applicationId: string;
+    }>) => string;
     affiliatePortalUrl: string;
     displayName: string;
     inviteUrl: (input: Readonly<{

package/dist/email/types/template-data.d.ts

@@ -362,6 +362,15 @@ export declare const EmailPersistedDataSchemas: {
         due_date: z.ZodString;
         locale: z.ZodNullable<z.ZodString>;
     }, z.core.$strict>;
+    readonly "affiliate.application_submitted.admin": z.ZodObject<{
+        application_id: z.ZodString;
+        customer_id: z.ZodString;
+        customer_email: z.ZodNullable<z.ZodString>;
+        customer_first_name: z.ZodNullable<z.ZodString>;
+        customer_last_name: z.ZodNullable<z.ZodString>;
+        company_name: z.ZodNullable<z.ZodString>;
+        message: z.ZodNullable<z.ZodString>;
+    }, z.core.$strict>;
     readonly "user.invite": z.ZodObject<{}, z.core.$strict>;
     readonly "auth.verification": z.ZodObject<{
         locale: z.ZodNullable<z.ZodString>;
@@ -596,6 +605,15 @@ export declare const EmailRenderDataSchemas: {
         due_date: z.ZodString;
         locale: z.ZodNullable<z.ZodString>;
     }, z.core.$strict>;
+    readonly "affiliate.application_submitted.admin": z.ZodObject<{
+        application_id: z.ZodString;
+        customer_id: z.ZodString;
+        customer_email: z.ZodNullable<z.ZodString>;
+        customer_first_name: z.ZodNullable<z.ZodString>;
+        customer_last_name: z.ZodNullable<z.ZodString>;
+        company_name: z.ZodNullable<z.ZodString>;
+        message: z.ZodNullable<z.ZodString>;
+    }, z.core.$strict>;
 };
 export type EmailPersistedDataMap = {
     readonly [Kind in EmailKind]: Readonly<z.infer<(typeof EmailPersistedDataSchemas)[Kind]>>;

package/dist/email/types/template-data.js

@@ -214,6 +214,17 @@ exports.EmailPersistedDataSchemas = {
         locale: NullableLocaleSchema,
     })
         .strict(),
+    "affiliate.application_submitted.admin": zod_1.z
+        .object({
+        application_id: NonEmptyStringSchema,
+        customer_id: NonEmptyStringSchema,
+        customer_email: NonEmptyStringSchema.nullable(),
+        customer_first_name: NonEmptyStringSchema.nullable(),
+        customer_last_name: NonEmptyStringSchema.nullable(),
+        company_name: NonEmptyStringSchema.nullable(),
+        message: NonEmptyStringSchema.nullable(),
+    })
+        .strict(),
     "user.invite": zod_1.z.object({}).strict(),
     "auth.verification": zod_1.z
         .object({

package/dist/shop-config/build-food-shop-config.js

@@ -144,6 +144,8 @@ function buildFoodShopConfig(options, environment = process.env) {
                 email: {
                     jwtSecret: env.JWT_SECRET,
                     shop: {
+                        // The Admin page lists the applications; the id is not part of the URL.
+                        adminAffiliateApplicationsUrl: () => new URL("/app/affiliates/applications", backendOrigin).toString(),
                         // The Admin dashboard mounts under admin.path ("/app").
                         adminOrderUrl: ({ orderId }) => new URL(`/app/orders/${encodeURIComponent(orderId)}`, backendOrigin).toString(),
                         displayName: options.displayName,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@hartl-services/medusa-base",
-  "version": "2.2.1",
+  "version": "2.4.0",
   "description": "Base plugin for Hartl Services Medusa shops: per-plugin feature toggles with a generic Admin settings page, a Store endpoint for storefronts, enforcement helpers, the complete-cart hook composition, the root redirect, cart-promotion link repair, the built-in E-Mail, Documents and S3 file storage modules, config helpers with the turnkey food-shop preset, and the Sentry logger wrapper and instrumentation.",
   "license": "MIT",
   "files": [
@@ -88,7 +88,7 @@
     "mime-types": "3.0.1",
     "nodemailer": "6.10.1",
     "ulid": "^2.4.0",
-    "@hartl-services/medusa-food-supplements-contracts": "^0.20.0"
+    "@hartl-services/medusa-food-supplements-contracts": "^0.24.0"
   },
   "devDependencies": {
     "@medusajs/admin-sdk": "2.19.0",