@teamscala/service-boot 0.23.389 → 0.23.391

package/package.json

@@ -6,7 +6,7 @@
   },
   "name": "@teamscala/service-boot",
   "type": "module",
-  "version": "0.23.389",
+  "version": "0.23.391",
   "sideEffects": false,
   "imports": {
     "#service-boot/*": "./src/*",

package/src/fn-routers/email-defaults.ts

@@ -3,20 +3,26 @@
  * @status handwritten
  * @edit edit directly
  *
- * Cached reader for the `email-defaults` config row's `default_sender` — the
- * from-address for outbound transactional email (agreement/proposal/assessment
- * senders). Replaces the former process.env.DEFAULT_EMAIL_SENDER read
- * (configured-primitives: the registry row is the source of truth, not env).
+ * Hot snapshot of `email-defaults.default_sender` (outbound transactional
+ * from-address). Replaces the former process.env.DEFAULT_EMAIL_SENDER read.
+ * Invalidated by NOTIFY on `registry_config_changed`; `staleAfterMs` is the
+ * safety ceiling for an upstream regression that drops notifications.
  */
+import { createNotifyCache } from "@teamscala/notify-cache/create-notify-cache";
 import { loadRegistryConfig } from "@teamscala/db/registry/load-config";
 import * as v from "valibot";
 
 const FALLBACK_SENDER = "noreply@gateway.scala.business";
-let cached: string | undefined;
+const defaultSenderCache = createNotifyCache<string>({
+	name: "service-boot:default-email-sender",
+	load: async () => {
+		const row = await loadRegistryConfig("config", "email-defaults", v.looseObject({}));
+		return (row?.default_sender as string | undefined) ?? FALLBACK_SENDER;
+	},
+	invalidateOn: ["registry_config_changed"],
+	staleAfterMs: 5 * 60 * 1000,
+});
 
 export async function getDefaultEmailSender(): Promise<string> {
-	if (cached !== undefined) return cached;
-	const row = await loadRegistryConfig("config", "email-defaults", v.looseObject({}));
-	cached = (row?.default_sender as string | undefined) ?? FALLBACK_SENDER;
-	return cached;
+	return defaultSenderCache.get();
 }

package/src/fn-routers/email-link-ttl.ts

@@ -3,21 +3,26 @@
  * @status handwritten
  * @edit edit directly
  *
- * Cached reader for the `email-links` config row's `email_link_ttl_ms` — the
- * validity window for agreement/proposal email-access magic links (dedup'd
- * across the 3 fn-routers that mint them). Replaces the former per-file
- * hardcoded EMAIL_LINK_TTL_MS constant (config-constants: the registry row is
- * the source of truth, not the literal).
+ * Hot snapshot of `email-links.email_link_ttl_ms` (magic-link validity
+ * window, dedup'd across the 3 fn-routers that mint them). Replaces the
+ * former per-file EMAIL_LINK_TTL_MS constant. Invalidated by NOTIFY on
+ * `registry_config_changed`.
  */
+import { createNotifyCache } from "@teamscala/notify-cache/create-notify-cache";
 import { loadRegistryConfig } from "@teamscala/db/registry/load-config";
 import * as v from "valibot";
 
 const DEFAULT_EMAIL_LINK_TTL_MS = 30 * 24 * 60 * 60 * 1000;
-let cached: number | undefined;
+const emailLinkTtlCache = createNotifyCache<number>({
+	name: "service-boot:email-link-ttl",
+	load: async () => {
+		const row = await loadRegistryConfig("config", "email-links", v.looseObject({}));
+		return (row?.email_link_ttl_ms as number | undefined) ?? DEFAULT_EMAIL_LINK_TTL_MS;
+	},
+	invalidateOn: ["registry_config_changed"],
+	staleAfterMs: 5 * 60 * 1000,
+});
 
 export async function getEmailLinkTtlMs(): Promise<number> {
-	if (cached !== undefined) return cached;
-	const row = await loadRegistryConfig("config", "email-links", v.looseObject({}));
-	cached = (row?.email_link_ttl_ms as number | undefined) ?? DEFAULT_EMAIL_LINK_TTL_MS;
-	return cached;
+	return emailLinkTtlCache.get();
 }

package/src/fn-routers/public-assessment-router.ts

@@ -25,10 +25,11 @@ import * as v from "valibot";
 import { getAppLogger } from "@teamscala/logger/app-loggers";
 import { sendEmail, initResendClient } from "@teamscala/api-resend/send-email";
 import { applyTemplateVars, lookupTemplate } from "@teamscala/email/templates/lookup";
+import { resolveEmailSender } from "@teamscala/email/identity/resolve-email-sender";
 import { decryptSecretConfig } from "@teamscala/encryption/crypto/secret-config";
 import { loadRegistryConfig } from "@teamscala/db/registry/load-config";
+import { fetchOrgBrand } from "@teamscala/resolver-engine/data-resolvers/fetch-org-brand";
 import { recordEvent } from "@teamscala/event-log/record-event";
-import { getDefaultEmailSender } from "./email-defaults.ts";
 
 interface Context {
 	prisma: any;
@@ -106,9 +107,9 @@ function bandForScore(
 
 /**
  * Best-effort branded Authority Index Report email. Self-contained: loads its
- * own Resend secret, swallows every error — a send failure is logged and NEVER
- * undoes the submit (the agreement-completion-email pattern). Fire-and-forget
- * from the submit handler.
+ * own Resend secret, swallows every error. Sender identity + brand tokens
+ * come from resolveEmailSender (per-org email_sender row). On Resend refusal
+ * the call falls back to the platform sender and logs the reason.
  */
 async function sendAuthorityReportEmail(opts: {
 	to: string;
@@ -117,6 +118,9 @@ async function sendAuthorityReportEmail(opts: {
 	bandLabel: string;
 	categoryScores: Record<string, number>;
 	ctaUrl?: string;
+	organisationId?: string | null;
+	brand?: import("@teamscala/email/identity/resolve-email-sender").OrgBrandTokens;
+	prisma: any;
 }): Promise<void> {
 	const log = getAppLogger();
 	const rawSecret = await loadRegistryConfig(
@@ -132,17 +136,26 @@ async function sendAuthorityReportEmail(opts: {
 		return;
 	}
 	initResendClient(decrypted.token);
-	const from = await getDefaultEmailSender();
+
+	const sender = await resolveEmailSender(opts.organisationId ?? null);
+	const primary = sender.brand.primaryColor;
+	const muted = "#6b7280"; // structural neutral for body labels
+	const logoUrl = sender.brand.logoUrl;
+	const logoHtml =
+		logoUrl && /^https?:\/\//.test(logoUrl)
+			? `<p style="margin:0 0 20px"><img src="${logoUrl}" alt="${sender.brand.orgName || ""}" style="max-height:56px;display:block"></p>`
+			: "";
+
 	// Subject + body from the `authority-index-report` email_template row, not
-	// literals here (email-template-registry-type). The per-pillar rows and the
-	// optional CTA are the only DYNAMIC markup, so they are rendered here and
-	// passed as merge vars — the row still owns all the copy and the layout.
+	// literals here (email-template-registry-type). Dynamic markup is rendered
+	// here and passed as merge vars — the row owns copy + layout; colours +
+	// logo come from the org brand tokens, NOT inline literals.
 	const pillarRows = (
 		Object.entries(opts.categoryScores) as Array<[string, number]>
 	)
 		.map(
 			([name, score]) =>
-				`<tr><td style="padding:6px 0;color:#374151">${name}</td><td style="padding:6px 0;text-align:right;font-weight:600;color:#111827">${score} / 100</td></tr>`,
+				`<tr><td style="padding:6px 0;color:${muted}">${name}</td><td style="padding:6px 0;text-align:right;font-weight:600;color:${primary}">${score} / 100</td></tr>`,
 		)
 		.join("");
 	const pillarsText = (
@@ -156,27 +169,80 @@ async function sendAuthorityReportEmail(opts: {
 		bandLabel: opts.bandLabel,
 		pillarRows,
 		pillarsText,
+		brandPrimaryColor: primary,
+		brandAccentColor: sender.brand.accentColor ?? primary,
+		brandLogoHtml: logoHtml,
+		orgName: sender.brand.orgName,
 		ctaHtml: opts.ctaUrl
-			? `<p style="margin:24px 0 0"><a href="${opts.ctaUrl}" style="display:inline-block;background:#111827;color:#ffffff;text-decoration:none;font-weight:600;padding:12px 22px;border-radius:8px">Book your Authority Growth Session</a></p>`
+			? `<p style="margin:24px 0 0"><a href="${opts.ctaUrl}" style="display:inline-block;background:${primary};color:#ffffff;text-decoration:none;font-weight:600;padding:12px 22px;border-radius:8px">Book your Authority Growth Session</a></p>`
 			: "",
 		ctaText: opts.ctaUrl ? `\nBook your Authority Growth Session: ${opts.ctaUrl}` : "",
 	});
-	const res = await sendEmail({
-		from,
-		to: opts.to,
-		subject: tpl.subject,
-		html: tpl.bodyHtml,
-		text: tpl.bodyText,
-	});
+
+	const sendOnce = async (fromHeader: string, replyToHeader: string | undefined) =>
+		sendEmail({
+			from: fromHeader,
+			to: opts.to,
+			subject: tpl.subject,
+			html: tpl.bodyHtml,
+			text: tpl.bodyText,
+			reply_to: replyToHeader,
+		});
+
+	let res = await sendOnce(sender.from, sender.replyTo);
+	let usedFrom = sender.from;
+	if (!res.success) {
+		// Resend refused the org sender (likely unverified domain). Fall back
+		// to the platform sender; never fail because a verification lookup
+		// failed — the resolver returns the row, the failure is at Resend.
+		const platformRow = await loadRegistryConfig(
+			"config",
+			"email-defaults",
+			v.looseObject({ default_sender: v.optional(v.string()) }),
+		).catch(() => null);
+		const fallbackFrom =
+			(platformRow?.default_sender as string | undefined)?.trim() ||
+			"scala <noreply@gateway.scala.business>";
+		log.warn(
+			`[authority-report-email] org sender ${sender.from} refused by Resend (${res.error ?? "unknown"}); falling back to platform ${fallbackFrom}`,
+		);
+		res = await sendOnce(fallbackFrom, undefined);
+		usedFrom = fallbackFrom;
+	}
+
 	if (res.success) {
 		log.info(
-			`[authority-report-email] sent to ${opts.to}${res.id ? ` (id ${res.id})` : ""}`,
+			`[authority-report-email] sent to ${opts.to}${res.id ? ` (id ${res.id})` : ""} from=${usedFrom}${sender.isOrgIdentity ? "" : " (platform fallback)"}`,
 		);
 	} else {
 		log.error(
 			`[authority-report-email] failed to ${opts.to}: ${res.error ?? "unknown"}`,
 		);
 	}
+
+	// email-send-audited: best-effort audit row. Guarded so a stale prisma
+	// client (scala-quiz schema predates email_send_log) skips cleanly.
+	try {
+		const auditPrisma = opts.prisma as {
+			email_send_log?: { create: (args: unknown) => Promise<unknown> };
+		};
+		if (auditPrisma?.email_send_log) {
+			await auditPrisma.email_send_log.create({
+				data: {
+					to_address: opts.to,
+					template_slug: "authority-index-report",
+					status: res.success ? "sent" : "failed",
+					provider_message_id: res.id ?? null,
+					error: res.success ? null : (res.error ?? "unknown"),
+					from_address: usedFrom,
+				},
+			});
+		}
+	} catch (auditErr) {
+		log.warn(
+			`[authority-report-email] audit row write failed: ${auditErr instanceof Error ? auditErr.message : String(auditErr)}`,
+		);
+	}
 }
 
 function scoreAnswers(
@@ -375,6 +441,21 @@ export const publicAssessmentRouter = {
 				(typeof assessment.cta_url === "string" && assessment.cta_url) ||
 				undefined;
 			if (band) {
+				const prisma = (context as { prisma: unknown }).prisma;
+				const brandRow = opts.organisationId
+					? await fetchOrgBrand(
+							prisma as Parameters<typeof fetchOrgBrand>[0],
+							opts.organisationId,
+						).catch(() => null)
+					: null;
+				const brand = brandRow
+					? {
+							orgName: brandRow.companyName ?? "",
+							primaryColor: brandRow.primaryColor,
+							accentColor: brandRow.accentColor ?? null,
+							logoUrl: brandRow.logo.light ?? null,
+						}
+					: undefined;
 				void sendAuthorityReportEmail({
 					to: email,
 					firstName,
@@ -382,6 +463,9 @@ export const publicAssessmentRouter = {
 					bandLabel: band.label,
 					categoryScores,
 					ctaUrl,
+					organisationId: opts.organisationId,
+					brand,
+					prisma,
 				}).catch((e) =>
 					log.error(
 						`[publicAssessment.submit] report email non-fatal: ${e instanceof Error ? e.message : String(e)}`,