@odla-ai/chapter 0.59.1 → 0.61.0

package/dist/index.js

@@ -1397,12 +1397,15 @@ var DEFAULT_ADMIN_COPY = {
     replyTo: "Reply-to",
     fromName: "From name",
     fromNameHint: "Shown as the sender; the address stays the Worker's configured one.",
+    spamRisk: "Spam-filter risk",
     debugInbox: "Debug inbox",
     debugInboxHint: "Non-production sends redirect here.",
     sendTest: "Send test",
     enabled: "Enabled",
     subject: "Subject",
     body: "Body",
+    htmlBody: "HTML body (optional)",
+    htmlBodyHint: "Sent beside the plain text when present, with the same {{placeholders}} and {{#name}} sections; values are escaped. Leave empty to send the plain text rendered as HTML.",
     save: "Save changes",
     sendLog: "Send log",
     sentColumn: "Sent",
@@ -7336,18 +7339,72 @@ function isRetiredEmailCopy(subject, text8) {
 // src/email.ts
 import { validateEmailCopy } from "@odla-ai/crm";
 
+// src/email-render.ts
+import { renderTemplate, templateLiveVars, templateSectionIssues, templateSectionNames, templateVars } from "@odla-ai/crm";
+
+// src/email-html.ts
+var URL_RE = /https?:\/\/[^\s<>"')\]]+[^\s<>"').,;:!?\]]/g;
+function escapeHtml(s) {
+  return s.replace(/&/g, "&amp;").replace(/</g, "&lt;").replace(/>/g, "&gt;").replace(/"/g, "&quot;");
+}
+function lineHtml(line) {
+  let out = "", last = 0;
+  for (const match of line.matchAll(URL_RE)) {
+    out += escapeHtml(line.slice(last, match.index));
+    const url = escapeHtml(match[0]);
+    out += `<a href="${url}">${url}</a>`;
+    last = match.index + match[0].length;
+  }
+  return out + escapeHtml(line.slice(last));
+}
+function textToHtml(text8) {
+  const paragraphs = text8.replace(/\r\n/g, "\n").trim().split(/\n{2,}/).filter((paragraph) => paragraph.trim());
+  const body = paragraphs.map((paragraph) => `<p>${paragraph.split("\n").map(lineHtml).join("<br>\n")}</p>`).join("\n");
+  return `<!doctype html>
+<html><head><meta charset="utf-8"><meta name="viewport" content="width=device-width"></head>
+<body style="margin:0;padding:24px 16px;background:#ffffff;color:#1a1a1a;font-family:-apple-system,BlinkMacSystemFont,'Segoe UI',Helvetica,Arial,sans-serif;font-size:16px;line-height:1.5">
+${body}
+</body></html>`;
+}
+
+// src/email-render.ts
+function render(template, vars) {
+  return renderTemplate(template, vars);
+}
+var HTML_BODY_LIMIT = 2e5;
+function renderHtmlBody(template, vars) {
+  const escaped = Object.fromEntries(Object.entries(vars).map(([name, value]) => [name, escapeHtml(value).replace(/\r?\n/g, "<br>")]));
+  return renderTemplate(template, escaped);
+}
+function htmlBodyIssues(html, options) {
+  const issues = [];
+  if (html.length > HTML_BODY_LIMIT) issues.push({ code: "html-invalid", message: `Keep the HTML body within ${HTML_BODY_LIMIT.toLocaleString("en-US")} characters.` });
+  for (const message of templateSectionIssues(html)) issues.push({ code: "section-invalid", message: `${message} (HTML body)` });
+  const unknown = new Set(templateVars(html).filter((variable) => options.allowedVariables && !options.allowedVariables.includes(variable)));
+  for (const variable of unknown) issues.push({ code: "variable-unknown", variable, message: `This event does not supply {{${variable}}} (HTML body).` });
+  if (options.values) {
+    for (const name of templateSectionNames(html)) if (typeof options.values[name] !== "string") issues.push({ code: "value-missing", variable: name, message: `Missing event value: ${name} (HTML body).` });
+    for (const variable of templateLiveVars(html, options.values)) {
+      if (unknown.has(variable)) continue;
+      const value = options.values[variable];
+      if (typeof value !== "string" || !value.trim() && !options.optionalVariables?.includes(variable)) issues.push({ code: "value-missing", variable, message: `Missing event value: ${variable} (HTML body).` });
+    }
+  }
+  return issues;
+}
+
 // src/email-events.ts
 var identity = ["firstName", "lastName", "email", "phone", "state"];
 var policy = ["refundPolicyText", "commitmentText", "normsText"];
-var checkout = ["tier", "tierName", "paymentAmount", "paymentAmountSummary"];
-var optionalVariables = ["phone", "state", "paymentAmount", "paymentAmountSummary"];
+var checkout = ["tier", "tierName", "paymentAmount", "paymentAmountSummary", "namedSeat", "namedSeatRecipientName"];
+var optionalVariables = ["phone", "state", "paymentAmount", "paymentAmountSummary", "namedSeat", "namedSeatRecipientName"];
 var event = (label, trigger, audience, variables, requiresTier = true) => ({ label, trigger, audience, variables: [...variables, ...policy], optionalVariables, requiresTier });
 var CHAPTER_EMAIL_EVENTS = {
   adminNotification: event("Application notification", "Application submitted or payment received, according to notification settings", "Administrator", [...identity, ...checkout, "adminUrl", "membersUrl"]),
   submitConfirmation: event("Application receipt", "Application submitted", "Applicant", [...identity, ...checkout, "submitNextStep", "membersUrl"]),
   paymentConfirmation: event("Payment confirmation", "Membership payment received", "Applicant", ["firstName", ...checkout, "paymentNextStep"]),
   prepEmail: event("Call confirmation", "Introduction call booked", "Applicant", [...identity, ...checkout, "startAt", "endAt", "timezone", "meetUrl", "htmlLink", "meetingTime", "meetingLink"]),
-  onboardingInvite: event("Membership welcome", "Membership approved", "Member", ["firstName", "membersUrl", "tierName"]),
+  onboardingInvite: event("Membership welcome", "Membership approved", "Member", ["firstName", "membersUrl", "tierName", "namedSeat", "namedSeatRecipientName"]),
   namedSeatInvitation: event("Gift membership invitation", "A gift membership is ready to be accepted", "Gift recipient", ["firstName", "purchaserName", "chapterName", "acceptBy", "joinUrl", "tierName"]),
   seatAccepted: event("Gift accepted", "Gift recipient accepts their membership", "Purchaser", ["firstName", "purchaserName", "recipientName", "tierName", "chapterName", "membersUrl"])
 };
@@ -7362,9 +7419,6 @@ function chapterEmailEvents(chapter) {
 }
 
 // src/email.ts
-function render(template, vars) {
-  return template.replace(/\{\{(\w+)\}\}/g, (_, key3) => vars[key3] ?? "");
-}
 function groupVars(group, vars) {
   return {
     ...vars,
@@ -7397,7 +7451,9 @@ function planDelivery(input) {
     values: vars,
     tierId: vars.tierId
   });
-  if (issues.length) return { deliver: false, reason: "template-invalid", issues: issues.map((issue) => issue.message) };
+  const html = typeof tpl.html === "string" && tpl.html.trim() ? tpl.html : void 0;
+  const htmlIssues = html ? htmlBodyIssues(html, { allowedVariables: event2?.variables, optionalVariables: event2?.optionalVariables, values: vars }) : [];
+  if (issues.length || htmlIssues.length) return { deliver: false, reason: "template-invalid", issues: [...issues, ...htmlIssues].map((issue) => issue.message) };
   const isProd = input.envName === "prod";
   const redirect = !isProd && !!input.group.debugEmail;
   const transport = !isProd && !redirect ? "log-only" : input.cloudflareReady ? "cloudflare" : "log-only";
@@ -7410,11 +7466,93 @@ function planDelivery(input) {
   const text8 = redirect ? `(dev redirect; original recipient: ${input.to})
 
 ` + renderedText : renderedText;
-  return { deliver: true, transport, to, subject, text: text8, redirected: redirect };
+  const renderedHtml = html ? renderHtmlBody(html, vars) : void 0;
+  const htmlOut = renderedHtml && redirect ? `<p style="font:13px monospace;color:#555;margin:0 0 12px">(dev redirect; original recipient: ${escapeHtml(input.to)})</p>` + renderedHtml : renderedHtml;
+  return { deliver: true, transport, to, subject, text: text8, ...htmlOut ? { html: htmlOut } : {}, redirected: redirect };
+}
+
+// src/email-readiness.ts
+import { isEmailTierName, templateSectionNames as templateSectionNames2, templateVars as templateVars2, validateEmailCopy as validateEmailCopy2 } from "@odla-ai/crm";
+
+// src/email-spam-signals.ts
+var TRIGGER_PHRASES = [
+  "act now",
+  "click here",
+  "limited time",
+  "guaranteed",
+  "risk-free",
+  "risk free",
+  "no obligation",
+  "100% free",
+  "winner",
+  "congratulations",
+  "urgent",
+  "double your",
+  "earn money",
+  "make money",
+  "cash bonus",
+  "once in a lifetime",
+  "exclusive deal",
+  "order now",
+  "buy now",
+  "this is not spam",
+  "dear friend",
+  "dear customer"
+];
+var SUBJECT_TRIGGERS = ["free", ...TRIGGER_PHRASES];
+var DEV_HOSTS = /(?:^|\.)(?:workers\.dev|pages\.dev|localhost|ngrok(?:-free)?\.app|trycloudflare\.com)$/i;
+var SHORTENERS = /^(?:bit\.ly|tinyurl\.com|t\.co|goo\.gl|ow\.ly|is\.gd|buff\.ly|rebrand\.ly|cutt\.ly|tiny\.cc|shorturl\.at|rb\.gy)$/i;
+var URL_RE2 = /https?:\/\/[^\s<>"')\]]+/g;
+var strip = (s) => s.replace(/\{\{\w+\}\}/g, " ");
+var words = (s) => strip(s).split(/\s+/).filter(Boolean);
+var phraseIn = (phrases, haystack) => phrases.find((phrase) => new RegExp(`(?:^|[^a-z0-9])${phrase.replace(/[.*+?^${}()|[\]\\]/g, "\\$&")}(?![a-z0-9])`, "i").test(haystack));
+function emailSpamSignals(copy) {
+  const subject = typeof copy.subject === "string" ? copy.subject : "";
+  const text8 = typeof copy.text === "string" ? copy.text : "";
+  const html = typeof copy.html === "string" ? copy.html : "";
+  const out = [];
+  const letters = strip(subject).replace(/[^A-Za-z]/g, "");
+  const shouting = letters.length >= 6 && letters.replace(/[^A-Z]/g, "").length / letters.length > 0.5 || words(subject).some((word) => /^[A-Z]{4,}$/.test(word.replace(/[^A-Za-z]/g, "")));
+  if (shouting) out.push({ code: "subject-caps", message: "The subject shouts in capital letters. Filters read that as a spam signal; use sentence case." });
+  if (/[!?]{2,}|!\s*$/.test(subject)) out.push({ code: "subject-punctuation", message: "Repeated or trailing exclamation marks in the subject are a classic spam signal." });
+  if (/^\s*(?:re|fw|fwd)\s*:/i.test(subject)) out.push({ code: "subject-fake-reply", message: "A subject that starts like a reply or forward reads as a spoof when the recipient never wrote first." });
+  const subjectHit = phraseIn(SUBJECT_TRIGGERS, strip(subject));
+  if (subjectHit) out.push({ code: "subject-trigger-words", message: `The subject uses "${subjectHit}", a word filters weight against the sender.` });
+  const bodyHit = phraseIn(TRIGGER_PHRASES, strip(text8));
+  if (bodyHit) out.push({ code: "body-trigger-words", message: `The body uses "${bodyHit}", a phrase filters weight against the sender.` });
+  if (/(?:^|\s)[A-Z]{3,}(?:\s+[A-Z]{3,}){2,}(?=\s|$)/.test(strip(text8))) out.push({ code: "body-caps", message: "The body shouts a run of capitalised words; use sentence case." });
+  if (/!{2,}/.test(text8)) out.push({ code: "body-punctuation", message: "Repeated exclamation marks in the body are a classic spam signal." });
+  const urls = [...`${text8}
+${html}`.matchAll(URL_RE2)].map((match) => match[0].replace(/&quot;.*$/, ""));
+  const hosts = urls.map((url) => {
+    try {
+      return new URL(url).hostname;
+    } catch {
+      return "";
+    }
+  });
+  if (urls.some((url) => /^http:\/\//i.test(url))) out.push({ code: "link-insecure", message: "A link uses http:// instead of https://. Filters flag insecure links." });
+  if (hosts.some((host) => DEV_HOSTS.test(host) || /^\d+\.\d+\.\d+\.\d+$/.test(host))) out.push({ code: "link-origin", message: "A link points at a development host (workers.dev, pages.dev, localhost or a raw IP). Link to the site's own domain." });
+  if (hosts.some((host) => SHORTENERS.test(host))) out.push({ code: "link-shortener", message: "A link uses a URL shortener, which hides the destination and is heavily abused. Link to the real address." });
+  if (new Set(urls).size > 5) out.push({ code: "link-many", message: "The body has more than five links. Keep lifecycle mail to the one or two the reader needs." });
+  if (urls.length && words(text8).length < 20) out.push({ code: "body-link-only", message: "The body is little more than a link. Say what the reader is being sent and why before the address." });
+  return out;
+}
+function emailSenderWarnings(input) {
+  const out = [];
+  const from = (input.fromEmail ?? "").trim().toLowerCase().replace(/^.*<([^>]+)>.*$/, "$1");
+  const reply = (input.replyTo ?? "").trim().toLowerCase();
+  const domain = (address) => address.split("@")[1] ?? "";
+  if (/^(?:no-?reply|do-?not-?reply|donotreply)(?:[+.-][^@]*)?@/.test(from)) {
+    out.push({ code: "sender-no-reply", message: "Mail is sent from a no-reply address. Gmail's sender guidelines advise against it; send from a monitored address so replies and unsubscribe requests reach someone." });
+  }
+  if (domain(from) && domain(reply) && domain(from) !== domain(reply)) {
+    out.push({ code: "reply-to-domain", message: `Replies go to ${domain(reply)} while mail is sent from ${domain(from)}. A Reply-To on another domain is a mild spam signal; prefer an address on the sending domain.` });
+  }
+  return out;
 }
 
 // src/email-readiness.ts
-import { isEmailTierName, validateEmailCopy as validateEmailCopy2 } from "@odla-ai/crm";
 function validateEmailReadiness(input) {
   const issues = [];
   for (const key3 of Object.keys(input.templates)) if (!input.events[key3]) {
@@ -7430,18 +7568,44 @@ function validateEmailReadiness(input) {
     const template = input.templates[key3];
     const problems = !template ? [{ code: "template-missing", message: "No email is configured for this event." }] : validateEmailCopy2(template, { allowedVariables: event2.variables });
     if (template && typeof template.enabled !== "boolean") problems.push({ code: "enabled-missing", message: "Choose explicitly whether this email is enabled. Sending is blocked until then." });
+    const html = typeof template?.html === "string" && template.html.trim() ? template.html : "";
+    if (html) problems.push(...htmlBodyIssues(html, { allowedVariables: event2.variables }));
     if (template) {
-      const used = [...`${template.subject ?? ""}
-${template.text ?? ""}`.matchAll(/\{\{(\w+)\}\}/g)].map((match) => match[1]);
-      for (const name of used) if (name in input.groupValues && !input.groupValues[name]?.trim()) {
+      const copy = `${template.subject ?? ""}
+${template.text ?? ""}
+${html}`;
+      const sectionOnly = new Set(templateSectionNames2(copy));
+      for (const name of templateVars2(copy)) if (name in input.groupValues && !input.groupValues[name]?.trim() && !sectionOnly.has(name)) {
         problems.push({ code: "value-missing", variable: name, message: `Add the ${name} used by this email.` });
       }
     }
     if (event2.requiresTier && input.tiersUnavailable) problems.push({ code: "tiers-unavailable", message: "Tier names are unavailable; delivery checks will block unresolved memberships." });
     else if (event2.requiresTier && noTierNames) problems.push({ code: "tiers-missing", message: "Configure the membership tier names needed by this event." });
-    return { ...event2, key: key3, status: template?.enabled === false ? "disabled" : problems.length ? "blocked" : "ready", issues: problems };
+    return {
+      ...event2,
+      key: key3,
+      status: template?.enabled === false ? "disabled" : problems.length ? "blocked" : "ready",
+      issues: problems,
+      warnings: template ? emailSpamSignals(template) : []
+    };
   });
-  return { checkedAt: input.now ?? Date.now(), events: events2, issues };
+  return { checkedAt: input.now ?? Date.now(), events: events2, issues, warnings: emailSenderWarnings(input.sender ?? {}) };
+}
+
+// src/email-deliverability.ts
+var ADMINISTRATOR_AUDIENCE = /^(?:administrator|admin|team|operator|owner|staff)s?$/i;
+function isRecipientFacing(event2) {
+  return !event2 || !ADMINISTRATOR_AUDIENCE.test(event2.audience.trim());
+}
+function listUnsubscribeHeader(replyTo) {
+  const address = replyTo.trim();
+  if (!/^[^\s@,;<>?]+@[^\s@,;<>?]+\.[^\s@,;<>?]+$/.test(address)) return void 0;
+  return `<mailto:${address}?subject=${encodeURIComponent("unsubscribe")}>`;
+}
+function deliverabilityHeaders(input) {
+  if (!isRecipientFacing(input.event)) return void 0;
+  const value = listUnsubscribeHeader(input.replyTo);
+  return value ? { "List-Unsubscribe": value } : void 0;
 }
 
 // src/notify.ts
@@ -7499,10 +7663,14 @@ async function frozenCheckoutVariables(db, app) {
   if (Number.isSafeInteger(amount) && Number(amount) > 0 && typeof currency === "string" && /^[a-z]{3}$/.test(currency)) {
     formatted = new Intl.NumberFormat("en-US", { style: "currency", currency: currency.toUpperCase() }).format(Number(amount) / 100);
   }
+  const seat = quote?.namedSeat, seatCents = quote?.lineItems?.namedSeatCents;
+  const namedSeatRecipientName = typeof seat?.recipientName === "string" ? seat.recipientName.trim() : "";
   return {
     paymentAmount: formatted,
     paymentAmountSummary: formatted ? ` of ${formatted}` : "",
-    tierName: typeof quote?.tierName === "string" ? quote.tierName : ""
+    tierName: typeof quote?.tierName === "string" ? quote.tierName : "",
+    namedSeat: namedSeatRecipientName ? Number.isSafeInteger(seatCents) && Number(seatCents) > 0 ? "paid" : "included" : "",
+    namedSeatRecipientName
   };
 }
 async function catalogTierName(db, group, app) {
@@ -7609,11 +7777,16 @@ async function sendTemplated(deps, input) {
   if (decision.transport === "log-only") return { sent: true };
   let messageId;
   try {
+    const text8 = String(row2.body);
+    const html = deps.renderHtml === false ? void 0 : decision.html ?? (deps.renderHtml ?? textToHtml)(text8);
+    const headers = deliverabilityHeaders({ event: event2, replyTo: input.group.replyTo });
     const response = await deps.sender.send({
       from: fromAddress(deps.from, input.group.fromName),
       to: [decision.to],
       subject: String(row2.subject),
-      text: String(row2.body),
+      text: text8,
+      ...html ? { html } : {},
+      ...headers ? { headers } : {},
       replyTo: input.group.replyTo
     });
     if (!response || typeof response.messageId !== "string" || !response.messageId) throw new Error("missing delivery receipt");
@@ -10372,6 +10545,7 @@ function createMembershipAuthorityIntegration() {
   };
 }
 export {
+  ADMINISTRATOR_AUDIENCE,
   ADMISSION_GRANTS_PATH,
   ADMISSION_GRANTS_SCHEMA_VERSION,
   BUILDER_LIBRARY_ADMIN_PATH,
@@ -10386,6 +10560,7 @@ export {
   DEFAULT_SHARE_FIELDS,
   EDGE_UNPAIRED,
   GIFT_OFFER_CATALOG_VERSION,
+  HTML_BODY_LIMIT,
   JOURNEY_ENDINGS,
   JOURNEY_STAGES,
   MAX_GIFT_OFFERS,
@@ -10438,6 +10613,7 @@ export {
   chapterDb,
   chapterEmailEvents,
   chapterFlowFieldContract,
+  checkoutVariables,
   clampArray,
   classifyMemberStripeEvent,
   classifyMemberSystemWrite,
@@ -10465,9 +10641,12 @@ export {
   dashboardMetricData,
   defaultCrm,
   defineChapter,
+  deliverabilityHeaders,
   drainMembershipEffects,
   edgeUnpaired,
   emailGroupFrom,
+  emailSenderWarnings,
+  emailSpamSignals,
   endForSlot,
   exportChapterPromotion,
   findAdmissionGrant,
@@ -10478,14 +10657,17 @@ export {
   formatChapterCopy,
   formationFields,
   formationFlowFields,
+  frozenCheckoutVariables,
   getVaultSecret,
   giftOfferActive,
   hasDisclaimerAck,
+  htmlBodyIssues,
   hydrateSignupControlTheme,
   injectSignupControlThemeHead,
   introIdempotencyKey,
   isAdminRole,
   isAlreadySent,
+  isRecipientFacing,
   isReconcilable,
   isSlotAvailable,
   isValidEmail,
@@ -10494,6 +10676,7 @@ export {
   joinConfigTiers,
   leaderCrmConfig,
   listStripeObjects,
+  listUnsubscribeHeader,
   loadLatestAdmissionRevision,
   loadOfferableTiers,
   loadTiers,
@@ -10557,6 +10740,7 @@ export {
   refundNetworkMembership,
   refundedPatch,
   render,
+  renderHtmlBody,
   renderSignupControlThemeHead,
   renderSummary,
   renderTemplateBody,
@@ -10611,6 +10795,7 @@ export {
   submitApplication,
   subscriptionIdempotencyKey,
   syncApplicationToCrm,
+  textToHtml,
   tierIsFree,
   tierPayable,
   updateClerkUserMetadata,