@hartl-services/medusa-base 2.8.0 → 2.10.0

package/README.md

@@ -50,7 +50,7 @@ packing lists) and S3 file storage, and the turnkey `medusa-config.ts` preset
   `@hartl-services/medusa-base/config` and Sentry's `register()` from
   `@hartl-services/medusa-base/instrumentation` (see "Config helpers" and
   "Sentry instrumentation").
-- Sends the shop's transactional e-mails over SMTP (module `email`, see
+- Sends the shop's transactional e-mails over SMTP or Microsoft 365, chosen in the Admin (module `email`, see
   "E-Mail"), issues invoices, cancellation documents and packing lists as
   private PDFs (module `documents`, see "Dokumente") and stores files in
   S3-compatible storage behind the `/files` gateway (see "Dateispeicher (S3)").
@@ -234,13 +234,18 @@ All optional; the Admin response always carries them (`null`, `[]` or
   unchanged, e.g. by the plugin switch of a switchable plugin). The Admin locks
   the switch of the last enabled top-level feature with a hint. The Admin DTO
   field is `require_enabled_feature: boolean` (`false` when not declared).
-- `setting_groups`: `{ name, description?, note?, requires_feature? }` per
+- `setting_groups`: `{ name, description?, note?, requires_feature?, visible_when? }` per
   settings group. `name` equals the `group` of at least one setting and is
   unique; `requires_feature` is a declared feature key, the Admin dims the group
   (still editable) while that feature is not effectively enabled.
+  `visible_when: { setting, equals }` names a `select` or `boolean` setting
+  outside the group and one of its values: the group applies only while that
+  setting has the value. The Admin hides it otherwise (by the form's current
+  value), and its required settings do not count as `missing`; stored values
+  are kept. The Admin DTO carries `visible_when` or `null`.
 - Per setting: `hint` (short text under the field, shown instead of
   `description`), `placeholder` (not for `boolean`, `select`, `image`,
-  `color`), `width` (`"full"` default or `"half"`: consecutive half settings
+  `color`, `date`), `width` (`"full"` default or `"half"`: consecutive half settings
   share a two-column row; not for `boolean`) and `section` (sub-heading inside
   the group, shared by consecutive settings with the same value).
 
@@ -338,7 +343,7 @@ in-memory copy of the toggle (see "Kontobestätigung per E-Mail").
 
 Configuration a plugin reads at RUN time (for example an external system's
 URL and API key) is declared in the descriptor and edited on the plugin's
-Admin page. Boot-time provider configuration (SMTP, S3, Sentry, Redis) and
+Admin page. Boot-time provider configuration (S3, Sentry, Redis) and
 function-valued options stay in `medusa-config.ts`.
 
 ```ts
@@ -383,7 +388,8 @@ class DemoModuleService extends MedusaService({ /* models */ }) {
   through Medusa's `/admin/uploads` into the public File Module storage and
   previews; replacing or removing it leaves the old file in storage), `color`
   (a hex color `#rrggbb`, stored lowercase; the Admin shows a hex field with a
-  color picker and checks the format before saving). An optional `group`
+  color picker and checks the format before saving), `date` (a calendar day
+  `YYYY-MM-DD`; the Admin shows `AdminDatePicker`). An optional `group`
   (non-empty text) is a section heading: the Admin starts a new section with
   that heading whenever the group changes from one setting to the next. Keys
   follow the feature key format and are unique. A `secret` has no default;
@@ -394,8 +400,8 @@ class DemoModuleService extends MedusaService({ /* models */ }) {
   `api_url` so a stored key is never sent to a new host. `definePluginFeatures`
   throws at import time otherwise (also for an `invalidates` entry that is not
   a secret of the plugin). The Admin renders a `select` as a dropdown, gives
-  number inputs their bounds and shows "Beim Ändern muss … neu eingegeben
-  werden" under a setting with `invalidates`.
+  number inputs their bounds and shows "Wird gelöscht, wenn … sich ändert"
+  under each secret named in an `invalidates`.
 - Precedence per key: stored in the Admin > `pluginSettingsFallback`
   (medusa-config) > declared default > not set. A value that does not fit the
   declared type is skipped. A plugin is `configured` when every required
@@ -1326,7 +1332,7 @@ have no dependency on Medusa; the subpath does not load `@sentry/node`.
 | `resolvePublicOrigin(value, name, allowHttp)`, `shopUrl(origin, path)` | Validate a bare HTTP(S) origin; build an absolute URL that cannot leave the origin |
 | `resolveStripe(values)` | Checks the `sk_` key and the `whsec_` webhook secret |
 | `resolveRedisEventBus(environment, phase)` | `{ url } \| undefined`: optional in development, required at runtime elsewhere, never used in a build, authenticated `rediss://` in production |
-| `createSmtpNotificationModuleConfig`, `resolveSmtp`, `SMTP_ENVIRONMENT_VARIABLES`, `SMTP_BUILD_PLACEHOLDERS`, `defineShopEmailConfiguration` | SMTP notification provider and E-Mail configuration (see "E-Mail") |
+| `createEmailNotificationModuleConfig`, `defineShopEmailConfiguration` (deprecated: `createSmtpNotificationModuleConfig`, `resolveSmtp`, `SMTP_ENVIRONMENT_VARIABLES`, `SMTP_BUILD_PLACEHOLDERS`) | Mail notification provider and E-Mail configuration (see "E-Mail") |
 | `createS3CacheStorageConfig`, `createS3CacheFileModuleConfig`, `resolveS3Credentials`, `resolveExpirationStrategy`, `S3_BUILD_PLACEHOLDERS` | S3 file storage (see "Dateispeicher (S3)") |
 | `createDefaultDocumentHtmlFactory`, `DOCUMENTS_BUILD_PLACEHOLDERS` | Documents markup and build placeholder (see "Dokumente") |
 
@@ -1373,36 +1379,32 @@ this export (or `sentry-logger`) lists `@sentry/node` in its own
 ## E-Mail
 
 The base owns transactional e-mail for the shop: logical email messages,
-attempts, rendering, the Medusa Notification integration, SMTP transport,
-retries and e-mail-specific Admin operations. It is the `email` module, its
-SMTP notification provider (`providers/smtp`), its subscribers, jobs and
+attempts, rendering, the Medusa Notification integration, the SMTP and
+Microsoft 365 transports, retries and e-mail-specific Admin operations. It is
+the `email` module, its notification provider (`providers/smtp`, id `smtp`),
+its subscribers, jobs and
 workflows, and the Admin page `/settings/hartl-services/email`. There is no
 separate e-mail package since 1.0.0.
 
 ### Configuration
 
-The SMTP notification provider is a `modules` entry built by
-`createSmtpNotificationModuleConfig` (from
-`@hartl-services/medusa-base/config`); the branding and rendering
+The notification provider is a `modules` entry built by
+`createEmailNotificationModuleConfig` (from
+`@hartl-services/medusa-base/config`); which service it sends through and the
+credentials are set in the Admin (see "Versand"). The branding and rendering
 configuration goes into the `email` namespace of the base options:
 
 ```ts
-import {
-  createSmtpNotificationModuleConfig,
-  resolveSmtp,
-  SMTP_ENVIRONMENT_VARIABLES,
-} from "@hartl-services/medusa-base/config";
-
-// Validates the seven SMTP_* variables (see "SMTP environment helpers").
-const smtp = resolveSmtp(
-  Object.fromEntries(
-    SMTP_ENVIRONMENT_VARIABLES.map((name) => [name, process.env[name] ?? ""]),
-  ) as Record<(typeof SMTP_ENVIRONMENT_VARIABLES)[number], string>,
-  process.env.NODE_ENV === "development" || process.env.NODE_ENV === "test",
-);
+import { createEmailNotificationModuleConfig } from "@hartl-services/medusa-base/config";
 
 export default defineConfig({
-  modules: [createSmtpNotificationModuleConfig(smtp)],
+  modules: [
+    createEmailNotificationModuleConfig({
+      // Permits "Verschlüsselung: Keine" (a local SMTP server); never in production.
+      allowInsecure:
+        process.env.NODE_ENV === "development" || process.env.NODE_ENV === "test",
+    }),
+  ],
   plugins: [
     {
       resolve: "@hartl-services/medusa-base",
@@ -1456,24 +1458,73 @@ affiliate-reminder and partner-application e-mails come from
 `@hartl-services/medusa-food-supplements-contracts/events/documents` and
 `/events/affiliate`, so installing the base does not pull in Affiliate.
 
-Environment variables (all seven required outside development/test; at least
-one of `SMTP_SECURE`/`SMTP_REQUIRE_TLS` must be `true` outside
-development/test):
-
-```text
-SMTP_HOST=
-SMTP_PORT=
-SMTP_SECURE=
-SMTP_REQUIRE_TLS=
-SMTP_USER=
-SMTP_PASSWORD=
-SMTP_FROM=
-```
+The provider reads no environment variables (since 2.9.0; the former
+`SMTP_*` variables are ignored).
 
 Set `REDIS_URL` to use `@medusajs/event-bus-redis` instead of Medusa's local
 Event Bus; production requires an authenticated `rediss://` URL. See "Event
 Bus" below for retry/backoff behavior.
 
+### Versand
+
+The page E-Mail → "Versand" (`/settings/hartl-services/email/delivery`, linked
+under "Verwaltung") edits the plugin's settings. It stays reachable while the
+E-Mail plugin is off, because the login-code mail is still sent then.
+
+| Key | Type | Required |
+|---|---|---|
+| `provider` (Versand über, group "Anbieter") | select `smtp` \| `microsoft365` | yes |
+| `smtp_host`, `smtp_port` (default 587), `smtp_security` (`starttls` default, `tls`, `none`), `smtp_from` (Absender, `Name <address>` allowed) | string / number / select / string | yes, while SMTP |
+| `smtp_user`, `smtp_password` (secret) | string / secret | no (no login without a user) |
+| `microsoft_tenant_id`, `microsoft_client_id`, `microsoft_client_secret` (secret), `microsoft_client_secret_expires_on` (date), `microsoft_mailbox` (Postfach) | string / secret / date | yes, while Microsoft 365 |
+
+The groups "SMTP" and "Microsoft 365" are shown and required only for the
+selected provider (`visible_when`). Changing the host deletes the SMTP
+password; changing tenant or client id deletes the client secret.
+
+The provider reads the settings on every send, never at boot; a shop without
+them boots and its mails fail as `not_configured` (retried like a connection
+failure, then `failed`; a log warning names the missing keys). `none`
+encryption is accepted only with `allowInsecure`. A rejected login (SMTP
+`EAUTH`, a Graph token or 401/403 error) is `auth_failed` and not retried.
+The test mail of the template editor shows both as their own message.
+
+**Microsoft 365** sends with Microsoft Graph `POST /users/{mailbox}/sendMail`
+and an app-only token (client credentials, cached in memory per tenant,
+client and secret). Graph has one body, so the mail goes out as HTML; it is
+saved to the mailbox's Sent Items. A request above 4 MB (large PDF
+attachments) fails as `invalid_content`. 429 and 5xx are temporary, other 4xx
+permanent. Setup:
+
+1. Microsoft Entra admin center → App registrations → New registration
+   (single tenant, no redirect URI). Note the Application (client) ID and
+   Directory (tenant) ID.
+2. Certificates & secrets → New client secret (at most 24 months); copy the
+   value and its expiry date.
+3. Do **not** grant the Graph application permission `Mail.Send` in Entra: it
+   would allow sending as every mailbox. Grant it in Exchange Online, limited
+   to the shop's mailbox (RBAC for Applications), in Exchange Online
+   PowerShell:
+
+   ```powershell
+   New-ServicePrincipal -AppId <client-id> -ObjectId <enterprise-app-object-id> -DisplayName "Shop Mail"
+   New-ManagementScope -Name "Shop Mailbox" -RecipientRestrictionFilter "PrimarySmtpAddress -eq 'shop@example.com'"
+   New-ManagementRoleAssignment -App <client-id> -Role "Application Mail.Send" -CustomResourceScope "Shop Mailbox"
+   ```
+
+   (`<enterprise-app-object-id>` is the object id under Enterprise
+   applications, not the one of the app registration.)
+4. In the Admin: E-Mail → Versand → Anbieter "Microsoft 365", enter tenant
+   id, client id, secret, its expiry date and the mailbox; send a test mail
+   from a template.
+
+Seven days before "Secret gültig bis" (shop time zone) the daily job
+`email-credential-expiry` (07:00 server time, while the E-Mail plugin is on
+and Microsoft 365 is selected) sends the mail `system.credential_expiry.admin`
+to the e-mail of the Shop-Stammdaten, once per client id and expiry date (a
+log warning when the Shop-Stammdaten have no e-mail). A new secret with a new
+date warns again.
+
 ### Feature toggles
 
 The E-Mail module declares its toggles to `@hartl-services/medusa-base` under the
@@ -1996,30 +2047,14 @@ configuration (blank `displayName`, a non-function `layout` or renderer, an
 unknown renderer kind) fails at startup and not at the first send. Custom
 renderers must escape dynamic values in `bodyHtml` themselves.
 
-### SMTP environment helpers
-
-`@hartl-services/medusa-base/config` exports helpers for the SMTP
-deployment variables:
-
-- `SMTP_ENVIRONMENT_VARIABLES` — the seven variable names.
-- `SMTP_BUILD_PLACEHOLDERS` — placeholder values for all seven variables so
-  `medusa build` can load `medusa-config.ts` without deployment secrets. Use
-  them only while building.
-- `resolveSmtp(values, allowInsecure)` — validates the values and returns the
-  `ResolvedSmtpConfiguration` for `createSmtpNotificationModuleConfig`. It
-  rejects a port outside 1–65535, a non-`"true"`/`"false"` boolean and an
-  invalid `SMTP_FROM`. `allowInsecure` permits plain SMTP (development, test,
-  build); otherwise `SMTP_SECURE` or `SMTP_REQUIRE_TLS` must be `true`.
-
-Runtime requires `SMTP_HOST`, `SMTP_PORT`, `SMTP_SECURE`, `SMTP_REQUIRE_TLS`,
-`SMTP_USER`, `SMTP_PASSWORD`, and `SMTP_FROM`. `SMTP_FROM` is a bare address
-or carries the sender's display name: `Example GmbH <info@example.com>` (quote
-the value in a `.env` file). `SMTP_SECURE=true` selects
-implicit TLS; `SMTP_REQUIRE_TLS=true` requires STARTTLS. Outside development
-and test, at least one must be true. Certificate verification is never
-disabled. Development and test may set both to `false` for an isolated local
-SMTP server. SMTP endpoints and credentials never belong in the shop
-configuration.
+### Deprecated SMTP helpers
+
+`createSmtpNotificationModuleConfig(smtp)`, `resolveSmtp`,
+`SMTP_ENVIRONMENT_VARIABLES` and `SMTP_BUILD_PLACEHOLDERS` remain exported
+for shops that still read `SMTP_*` in their `medusa-config.ts`. The values
+given to `createSmtpNotificationModuleConfig` only fill SMTP settings that are
+not stored in the Admin (the Admin status does not count them as configured).
+Use `createEmailNotificationModuleConfig` and the "Versand" page instead.
 
 ### Delivery Semantics
 
@@ -2339,10 +2374,24 @@ separate documents package since 1.0.0.
   persists the customer company, customer UID and exemption wording in that
   same snapshot. B2C and non-eligible evidence add no tax-proof statement.
 - Freezes a tax breakdown (`totals.tax_breakdown`) grouped by the order's
-  item and shipping tax-line name and rate, as configured on the Medusa tax
-  region. Amounts are rounded to the currency and add up exactly to the
-  tax total; cancellations scale it proportionally. Snapshots issued before
-  this field existed read as an empty breakdown.
+  item tax-line name and rate, as configured on the Medusa tax region, with
+  the tax and the net amount (`taxable_amount`, after discounts) per rate.
+  Shipping follows the items: a shipping tax line with the code
+  `APPORTIONED_SHIPPING_TAX_CODE` (`/lib`; Tax Compliance's "Anteilige
+  Versandsteuer") is split back onto the item rates by the items' net
+  amount after discounts, the key Tax Compliance weights it by, so the
+  invoice never prints a weighted rate. Other shipping tax joins the items'
+  row when the cart has one item rate equal to it, otherwise it keeps its
+  own row.
+  Amounts are rounded to the currency and add up exactly to the tax total;
+  cancellations scale them proportionally. Snapshots issued before these
+  fields existed read as an empty breakdown or without net amounts.
+- Prints net amounts before discounts: line unit price and "Summe",
+  "Zwischensumme" (items), "Versand" (before a free-shipping promotion),
+  then all promotions as one net "Rabatt" (only when there is a discount),
+  the tax rows and the gross "Gesamt"; the rows add up to the total. With
+  several tax rates each tax row also names its net amount ("AT Reduziert
+  10 % auf € 55,00").
 - Persists one immutable decision per shipped Fulfillment. A leased, Order-
   unique coordinator chooses exactly one invoice carrier without assuming
   event delivery order; all other shipments become `non_carrier`.

package/dist/documents/templates/financial-document.js

@@ -63,7 +63,7 @@ const renderLines = (input, timeZone) => input.lines
         </td>
         <td class="number quantity">${(0, lib_1.escapeHtml)(line.quantity)}</td>
         <td class="number">${(0, html_utils_1.renderMoney)(line.unit_price)}</td>
-        <td class="number">${(0, html_utils_1.renderMoney)(line.total)}</td>
+        <td class="number">${(0, html_utils_1.renderMoney)(line.subtotal)}</td>
       </tr>`)
     .join("");
 const isExemptIntraCommunitySupply = (input) => input.order.tax_compliance?.exemption_wording ===
@@ -93,11 +93,30 @@ const formatTaxRate = (rate) => new Intl.NumberFormat(format_1.DEFAULT_FORMAT_LO
 }).format(rate / 100);
 /** One totals row below the Menge/Einzelpreis columns; the amount sits under "Summe". */
 const renderTotalRow = (label, value, className) => `<tr${className ? ` class="${className}"` : ""}><td class="spacer"></td><td class="label" colspan="2">${(0, lib_1.escapeHtml)(label)}</td><td class="number">${value}</td></tr>`;
+/** No discount, no row. */
+const renderDiscountRow = (input) => Number(input.totals.discount_total.amount) === 0
+    ? ""
+    : renderTotalRow("Rabatt", renderDiscountTotal(input));
+/**
+ * One row per tax rate. With several rates each row also names its net
+ * amount, since an invoice states the amount taxed at every rate.
+ */
 const renderTaxRows = (input) => {
     const { tax_breakdown: breakdown, tax_total: taxTotal } = input.totals;
+    const withNetAmount = breakdown.length > 1;
     const rows = breakdown.length > 0
         ? breakdown.map((entry) => ({
-            label: `${entry.name} ${formatTaxRate(entry.rate)}`,
+            label: [
+                `${entry.name} ${formatTaxRate(entry.rate)}`,
+                withNetAmount && entry.taxable_amount
+                    ? `auf ${(0, format_1.formatMoney)({
+                        amount: entry.taxable_amount.amount,
+                        currencyCode: entry.taxable_amount.currency_code,
+                    })}`
+                    : null,
+            ]
+                .filter((part) => Boolean(part))
+                .join(" "),
             money: entry.tax_total,
         }))
         : [{ label: "Umsatzsteuer", money: taxTotal }];
@@ -141,7 +160,7 @@ const renderFinancialDocument = (input, layout, timeZone) => {
       <tbody class="totals">
         ${renderTotalRow("Zwischensumme", (0, html_utils_1.renderMoney)(totals.subtotal))}
         ${renderTotalRow("Versand", (0, html_utils_1.renderMoney)(totals.shipping_total))}
-        ${renderTotalRow("Rabatt", renderDiscountTotal(input))}
+        ${renderDiscountRow(input)}
         ${renderTaxRows(input)}
         ${renderTotalRow("Gesamt", (0, html_utils_1.renderMoney)(totals.total), "grand-total")}
       </tbody>

package/dist/documents/types/documents.d.ts

@@ -40,13 +40,20 @@ export type DocumentTaxBreakdownEntry = {
     code: string | null;
     rate: number;
     tax_total: DocumentMoney;
+    /**
+     * Net amount taxed at this rate (items and their share of shipping, after
+     * discounts). Missing in snapshots issued before it was recorded.
+     */
+    taxable_amount?: DocumentMoney;
 };
 export type DocumentTemplateLine = {
     id: string;
     title: string;
     sku: string | null;
     quantity: number;
+    /** Net, before discounts (older invoice snapshots: Medusa's unit price). */
     unit_price: DocumentMoney;
+    /** Net, before discounts; printed under "Summe". */
     subtotal: DocumentMoney;
     tax_total: DocumentMoney;
     total: DocumentMoney;
@@ -74,6 +81,12 @@ export type DocumentTemplateInput = {
         tax_compliance: DocumentTaxComplianceDTO | null;
     };
     lines: DocumentTemplateLine[];
+    /**
+     * Subtotal (items) and shipping are net amounts before discounts, the
+     * discount is net, so they add up with the tax to the total. Older invoice
+     * snapshots carry Medusa's order subtotal (items plus shipping) and gross
+     * shipping and discount totals.
+     */
     totals: {
         subtotal: DocumentMoney;
         tax_total: DocumentMoney;

package/dist/email/config/index.d.ts

@@ -1,15 +1,20 @@
 import type { ResolvedSmtpConfiguration, ShopEmailConfiguration } from "../types";
-export { createSmtpNotificationModuleConfig } from "./notification-module";
+export { createEmailNotificationModuleConfig, createSmtpNotificationModuleConfig, } from "./notification-module";
 export declare const defineShopEmailConfiguration: <Configuration extends ShopEmailConfiguration>(configuration: Configuration) => Configuration;
 export type { ResolvedSmtpConfiguration, ShopEmailConfiguration, } from "../types";
+/** @deprecated The provider is set in the Admin (E-Mail > Versand). */
 export declare const SMTP_ENVIRONMENT_VARIABLES: readonly ["SMTP_HOST", "SMTP_PORT", "SMTP_SECURE", "SMTP_USER", "SMTP_PASSWORD", "SMTP_FROM", "SMTP_REQUIRE_TLS"];
 /**
+ * @deprecated The provider is set in the Admin (E-Mail > Versand).
+ *
  * `medusa build` loads the configuration without deployment secrets. These
  * placeholders only satisfy the required-variable checks of a build; they
  * never reach a running server.
  */
 export declare const SMTP_BUILD_PLACEHOLDERS: Readonly<Record<string, string>>;
 /**
+ * @deprecated The provider is set in the Admin (E-Mail > Versand).
+ *
  * Validates the SMTP environment values and returns the transport
  * configuration. `allowInsecure` permits plain SMTP for development, tests
  * and builds; otherwise `SMTP_SECURE` or `SMTP_REQUIRE_TLS` must be `true`.

package/dist/email/config/index.js

@@ -1,12 +1,14 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.resolveSmtp = exports.SMTP_BUILD_PLACEHOLDERS = exports.SMTP_ENVIRONMENT_VARIABLES = exports.defineShopEmailConfiguration = exports.createSmtpNotificationModuleConfig = void 0;
+exports.resolveSmtp = exports.SMTP_BUILD_PLACEHOLDERS = exports.SMTP_ENVIRONMENT_VARIABLES = exports.defineShopEmailConfiguration = exports.createSmtpNotificationModuleConfig = exports.createEmailNotificationModuleConfig = void 0;
 const config_1 = require("../../public/config");
 const sender_1 = require("../domain/sender");
 var notification_module_1 = require("./notification-module");
+Object.defineProperty(exports, "createEmailNotificationModuleConfig", { enumerable: true, get: function () { return notification_module_1.createEmailNotificationModuleConfig; } });
 Object.defineProperty(exports, "createSmtpNotificationModuleConfig", { enumerable: true, get: function () { return notification_module_1.createSmtpNotificationModuleConfig; } });
 const defineShopEmailConfiguration = (configuration) => configuration;
 exports.defineShopEmailConfiguration = defineShopEmailConfiguration;
+/** @deprecated The provider is set in the Admin (E-Mail > Versand). */
 exports.SMTP_ENVIRONMENT_VARIABLES = [
     "SMTP_HOST",
     "SMTP_PORT",
@@ -17,6 +19,8 @@ exports.SMTP_ENVIRONMENT_VARIABLES = [
     "SMTP_REQUIRE_TLS",
 ];
 /**
+ * @deprecated The provider is set in the Admin (E-Mail > Versand).
+ *
  * `medusa build` loads the configuration without deployment secrets. These
  * placeholders only satisfy the required-variable checks of a build; they
  * never reach a running server.
@@ -31,6 +35,8 @@ exports.SMTP_BUILD_PLACEHOLDERS = {
     SMTP_USER: "build-user",
 };
 /**
+ * @deprecated The provider is set in the Admin (E-Mail > Versand).
+ *
  * Validates the SMTP environment values and returns the transport
  * configuration. `allowInsecure` permits plain SMTP for development, tests
  * and builds; otherwise `SMTP_SECURE` or `SMTP_REQUIRE_TLS` must be `true`.

package/dist/email/config/notification-module.d.ts

@@ -1,4 +1,29 @@
 import type { ResolvedSmtpConfiguration } from "../types";
+/**
+ * The Notification Module with the shop's mail provider. Provider and
+ * credentials are set in the Admin (E-Mail > Versand); `allowInsecure`
+ * (development and tests only) permits SMTP without encryption there.
+ */
+export declare const createEmailNotificationModuleConfig: (options?: Readonly<{
+    allowInsecure?: boolean;
+}>) => {
+    resolve: string;
+    options: {
+        providers: {
+            id: string;
+            options: {
+                allowInsecure: boolean;
+                channels: string[];
+            };
+            resolve: string;
+        }[];
+    };
+};
+/**
+ * @deprecated Use `createEmailNotificationModuleConfig` and set the provider
+ * in the Admin (E-Mail > Versand). The SMTP values given here only fill the
+ * SMTP settings that are not stored in the Admin.
+ */
 export declare const createSmtpNotificationModuleConfig: (smtp: ResolvedSmtpConfiguration) => {
     resolve: string;
     options: {

package/dist/email/config/notification-module.js

@@ -1,6 +1,32 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.createSmtpNotificationModuleConfig = void 0;
+exports.createSmtpNotificationModuleConfig = exports.createEmailNotificationModuleConfig = void 0;
+/**
+ * The Notification Module with the shop's mail provider. Provider and
+ * credentials are set in the Admin (E-Mail > Versand); `allowInsecure`
+ * (development and tests only) permits SMTP without encryption there.
+ */
+const createEmailNotificationModuleConfig = (options = {}) => ({
+    resolve: "@medusajs/medusa/notification",
+    options: {
+        providers: [
+            {
+                id: "smtp",
+                options: {
+                    allowInsecure: options.allowInsecure === true,
+                    channels: ["email"],
+                },
+                resolve: "@hartl-services/medusa-base/providers/smtp",
+            },
+        ],
+    },
+});
+exports.createEmailNotificationModuleConfig = createEmailNotificationModuleConfig;
+/**
+ * @deprecated Use `createEmailNotificationModuleConfig` and set the provider
+ * in the Admin (E-Mail > Versand). The SMTP values given here only fill the
+ * SMTP settings that are not stored in the Admin.
+ */
 const createSmtpNotificationModuleConfig = (smtp) => ({
     resolve: "@medusajs/medusa/notification",
     options: {

package/dist/email/types/email-kinds.d.ts

@@ -1,5 +1,5 @@
 import { z } from "@medusajs/framework/zod";
-export declare const EMAIL_KINDS: readonly ["order.received", "order.received.admin", "order.shipped", "order.canceled", "order.return_requested", "order.return_received", "order.refunded", "auth.password_reset", "affiliate.consignment_report_due", "affiliate.application_submitted.admin", "user.invite", "auth.verification", "auth.login_code"];
+export declare const EMAIL_KINDS: readonly ["order.received", "order.received.admin", "order.shipped", "order.canceled", "order.return_requested", "order.return_received", "order.refunded", "auth.password_reset", "affiliate.consignment_report_due", "affiliate.application_submitted.admin", "user.invite", "auth.verification", "auth.login_code", "system.credential_expiry.admin"];
 export declare const EmailKindSchema: z.ZodEnum<{
     "order.received": "order.received";
     "order.received.admin": "order.received.admin";
@@ -14,6 +14,7 @@ export declare const EmailKindSchema: z.ZodEnum<{
     "user.invite": "user.invite";
     "auth.verification": "auth.verification";
     "auth.login_code": "auth.login_code";
+    "system.credential_expiry.admin": "system.credential_expiry.admin";
 }>;
 export type EmailKind = (typeof EMAIL_KINDS)[number];
 /**

package/dist/email/types/email-kinds.js

@@ -16,6 +16,7 @@ exports.EMAIL_KINDS = [
     "user.invite",
     "auth.verification",
     "auth.login_code",
+    "system.credential_expiry.admin",
 ];
 exports.EmailKindSchema = zod_1.z.enum(exports.EMAIL_KINDS);
 /**

package/dist/email/types/template-data.d.ts

@@ -376,6 +376,11 @@ export declare const EmailPersistedDataSchemas: {
         locale: z.ZodNullable<z.ZodString>;
     }, z.core.$strict>;
     readonly "auth.login_code": z.ZodObject<{}, z.core.$strict>;
+    readonly "system.credential_expiry.admin": z.ZodObject<{
+        provider: z.ZodLiteral<"microsoft365">;
+        client_id: z.ZodString;
+        expires_on: z.ZodString;
+    }, z.core.$strict>;
 };
 export declare const EmailRenderDataSchemas: {
     readonly "auth.password_reset": z.ZodObject<{
@@ -619,6 +624,11 @@ export declare const EmailRenderDataSchemas: {
         company_name: z.ZodNullable<z.ZodString>;
         message: z.ZodNullable<z.ZodString>;
     }, z.core.$strict>;
+    readonly "system.credential_expiry.admin": z.ZodObject<{
+        provider: z.ZodLiteral<"microsoft365">;
+        client_id: z.ZodString;
+        expires_on: z.ZodString;
+    }, z.core.$strict>;
 };
 export type EmailPersistedDataMap = {
     readonly [Kind in EmailKind]: Readonly<z.infer<(typeof EmailPersistedDataSchemas)[Kind]>>;

package/dist/email/types/template-data.js

@@ -233,6 +233,13 @@ exports.EmailPersistedDataSchemas = {
         .strict(),
     // The code itself is never stored: it only exists in the render context.
     "auth.login_code": zod_1.z.object({}).strict(),
+    "system.credential_expiry.admin": zod_1.z
+        .object({
+        provider: zod_1.z.literal("microsoft365"),
+        client_id: NonEmptyStringSchema,
+        expires_on: affiliate_1.CalendarDateSchema,
+    })
+        .strict(),
 };
 exports.EmailRenderDataSchemas = {
     ...exports.EmailPersistedDataSchemas,

package/dist/shared/lib/index.d.ts

@@ -6,6 +6,7 @@ export * from "./hash";
 export * from "./logging";
 export * from "./money";
 export * from "./refreshing-snapshot";
+export * from "./shipping-tax";
 export * from "./text";
 export * from "./transaction";
 export * from "./wire-response";

package/dist/shared/lib/index.js

@@ -24,6 +24,7 @@ __exportStar(require("./hash"), exports);
 __exportStar(require("./logging"), exports);
 __exportStar(require("./money"), exports);
 __exportStar(require("./refreshing-snapshot"), exports);
+__exportStar(require("./shipping-tax"), exports);
 __exportStar(require("./text"), exports);
 __exportStar(require("./transaction"), exports);
 __exportStar(require("./wire-response"), exports);

package/dist/shared/lib/shipping-tax.d.ts

@@ -0,0 +1,8 @@
+/**
+ * Code of a shipping tax line whose rate is the item rates weighted by the
+ * items' net amount after discounts (shipping follows the main supplies,
+ * split by their Entgelt). Tax Compliance writes it; Documents splits such a
+ * line back onto the item tax rates by the same key, because an invoice
+ * states the tax per actual rate.
+ */
+export declare const APPORTIONED_SHIPPING_TAX_CODE = "shipping_blended";

package/dist/shared/lib/shipping-tax.js

@@ -0,0 +1,11 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.APPORTIONED_SHIPPING_TAX_CODE = void 0;
+/**
+ * Code of a shipping tax line whose rate is the item rates weighted by the
+ * items' net amount after discounts (shipping follows the main supplies,
+ * split by their Entgelt). Tax Compliance writes it; Documents splits such a
+ * line back onto the item tax rates by the same key, because an invoice
+ * states the tax per actual rate.
+ */
+exports.APPORTIONED_SHIPPING_TAX_CODE = "shipping_blended";

package/dist/shop-config/build-food-shop-config.d.ts

@@ -31,7 +31,7 @@ export type FoodShopConfigInput = {
 };
 /**
  * Builds the plain `medusa-config.ts` input of a food shop: Medusa core
- * settings, the Redis event bus, SMTP notifications, S3 file storage, tax and
+ * settings, the Redis event bus, the mail provider (set up in the Admin), S3 file storage, tax and
  * Stripe payment providers, and the Hartl Services plugins (the base plugin
  * with its E-Mail, Documents and file storage modules plus five feature
  * plugins). Deployment

package/dist/shop-config/build-food-shop-config.js

@@ -12,7 +12,7 @@ const sentry_logger_1 = require("../public/sentry-logger");
 const options_1 = require("./options");
 /**
  * Builds the plain `medusa-config.ts` input of a food shop: Medusa core
- * settings, the Redis event bus, SMTP notifications, S3 file storage, tax and
+ * settings, the Redis event bus, the mail provider (set up in the Admin), S3 file storage, tax and
  * Stripe payment providers, and the Hartl Services plugins (the base plugin
  * with its E-Mail, Documents and file storage modules plus five feature
  * plugins). Deployment
@@ -35,7 +35,6 @@ function buildFoodShopConfig(options, environment = process.env) {
         "COOKIE_SECRET",
         "MEDUSA_BACKEND_URL",
         "STOREFRONT_URL",
-        ...config_1.SMTP_ENVIRONMENT_VARIABLES,
         "STRIPE_API_KEY",
         "STRIPE_WEBHOOK_SECRET",
         "S3_CACHE_STORAGE_BUCKET",
@@ -43,7 +42,6 @@ function buildFoodShopConfig(options, environment = process.env) {
         "DOCUMENT_PDF_EXECUTABLE",
     ], phase, {
         ...config_1.MEDUSA_BUILD_PLACEHOLDERS,
-        ...config_1.SMTP_BUILD_PLACEHOLDERS,
         ...config_1.S3_BUILD_PLACEHOLDERS,
         ...config_1.DOCUMENTS_BUILD_PLACEHOLDERS,
     });
@@ -101,7 +99,7 @@ function buildFoodShopConfig(options, environment = process.env) {
                 },
             ]
             : []),
-        (0, config_1.createSmtpNotificationModuleConfig)((0, config_1.resolveSmtp)(env, allowInsecure)),
+        (0, config_1.createEmailNotificationModuleConfig)({ allowInsecure }),
         s3CacheStorage.fileModule,
         {
             // Replaces Medusa's default auth entry (same module key): the same