@technomoron/mail-magic 1.0.37 → 1.0.40

package/CHANGES

@@ -1,3 +1,39 @@
+CHANGES
+=======
+
+Unreleased (2026-02-22)
+
+- chore(release): add package-level `release:check` script and wire `release` to shared publish script.
+- chore(scripts): replace `rm -rf` cleanup scripts with `rimraf`.
+- test(logging): suppress noisy SQL/startup stdout in automated tests by default (`DB_LOG=false` in test setup; startup logs debug-only).
+- test(logging): quiet package test output by default (silent Vitest + silent sync step) and remove Node `DEP0170` warning in schema-drift test DB setup.
+- (Changes generated/assisted by Codex (profile: chatgpt-5.3-codex/medium).)
+
+Version 1.0.40 (2026-02-22)
+
+- chore(changes): normalize this package changelog to required CHANGES format.
+- (Changes generated/assisted by Codex (profile: chatgpt-5.3-codex/medium).)
+
+Version 1.0.39 (2026-02-19)
+
+- Code clarity pass: restore `DB_LOG` env-driven logging config (was commented
+  out), normalize import path in `db.ts`.
+- Simplify `create_mail_transport` by removing unnecessary spread and
+  intermediate variable.
+- Simplify `buildReplyToValue` by removing redundant variable and duplicate
+  return path in `forms.ts`.
+- Replace `forEach` with `for...of` and use separate `const` declarations in
+  `validateEmails` (`mailer.ts`).
+
+Version 1.0.38 (2026-02-17)
+
+- Prefer `fs.watch` for init-data auto-reload with automatic fallback to
+  `fs.watchFile` when native file watching is unavailable.
+- Add regression tests for auto-reload watcher behavior (`watch`, fallback,
+  disabled mode).
+- Add schema-drift regression tests that assert Zod schema keys match Sequelize
+  model attributes for core API models.
+
 Version 1.0.37 (2026-02-17)
 
 - Remove stale commented-out debug code from server mailer/store paths.

package/README.md

@@ -308,5 +308,5 @@ pnpm -w --filter @technomoron/mail-magic cleanbuild
 
 Documentation:
 
-- `packages/mail-magic/docs/tutorial.md` is a hands-on config walkthrough.
-- `packages/mail-magic/docs/form-security.md` covers the public form endpoint contract and recommended mitigations.
+- `packages/server/docs/tutorial.md` is a hands-on config walkthrough.
+- `packages/server/docs/form-security.md` covers the public form endpoint contract and recommended mitigations.

package/dist/cjs/package.json

@@ -1,3 +1,3 @@
 {
-  "type": "commonjs"
+	"type": "commonjs"
 }

package/dist/esm/api/mailer.js

@@ -11,12 +11,13 @@ export class MailerAPI extends ApiModule {
     // and valid email addresses.
     //
     validateEmails(list) {
-        const valid = [], invalid = [];
+        const valid = [];
+        const invalid = [];
         const emails = list
             .split(',')
             .map((email) => email.trim())
             .filter((email) => email !== '');
-        emails.forEach((email) => {
+        for (const email of emails) {
             const addr = validateEmail(email);
             if (addr) {
                 valid.push(addr);
@@ -24,7 +25,7 @@ export class MailerAPI extends ApiModule {
             else {
                 invalid.push(email);
             }
-        });
+        }
         return { valid, invalid };
     }
     // Store a template in the database

package/dist/esm/models/db.js

@@ -97,10 +97,10 @@ export async function init_api_db(db, store) {
     store.print_debug('API Database Initialized...');
 }
 export async function connect_api_db(store) {
-    console.log('DB INIT');
+    store.print_debug('DB INIT');
     const env = store.vars;
     const dbparams = {
-        logging: false, // env.DB_LOG ? console.log : false,
+        logging: env.DB_LOG ? console.log : false,
         dialect: env.DB_TYPE,
         dialectOptions: {
             charset: 'utf8mb4'

package/dist/esm/models/domain.js

@@ -15,8 +15,6 @@ export const api_domain_schema = z
     is_default: z.boolean().default(false).describe('If true, this is the default domain for the user.')
 })
     .describe('Domain configuration record.');
-// Sequelize typing pattern: merge the Zod-inferred attribute type onto the model instance type.
-// eslint-disable-next-line @typescript-eslint/no-unsafe-declaration-merging
 export class api_domain extends Model {
 }
 export async function init_api_domain(api_db) {

package/dist/esm/models/form.js

@@ -68,8 +68,6 @@ export const api_form_schema = z
         .describe('Derived list of template-referenced assets (inline cids and external links) resolved during preprocessing/import.')
 })
     .describe('Form configuration and template used by the public form submission endpoint.');
-// Sequelize typing pattern: merge the Zod-inferred attribute type onto the model instance type.
-// eslint-disable-next-line @typescript-eslint/no-unsafe-declaration-merging
 export class api_form extends Model {
 }
 export async function init_api_form(api_db) {

package/dist/esm/models/init.js

@@ -1,8 +1,8 @@
 import fs from 'fs';
 import path from 'path';
-import { Unyuck } from '@technomoron/unyuck';
 import { z } from 'zod';
 import { buildAssetUrl } from '../util/paths.js';
+import { flattenTemplateWithAssets } from '../util/shared-template-flatten.js';
 import { user_and_domain } from '../util.js';
 import { api_domain, api_domain_schema } from './domain.js';
 import { api_form_schema, upsert_form } from './form.js';
@@ -52,35 +52,14 @@ async function _load_template(store, filename, pathname, user, domain, locale, t
         }
         const assetBaseUrl = store.vars.ASSET_PUBLIC_BASE?.trim() ? store.vars.ASSET_PUBLIC_BASE : store.vars.API_URL;
         const assetRoute = store.vars.ASSET_ROUTE;
-        const processor = new Unyuck({
-            basePath: domainRoot,
+        const { html, assets } = flattenTemplateWithAssets({
+            domainRoot,
+            templateKey,
             baseUrl: assetBaseUrl,
-            collectAssets: true,
-            assetFormatter: (ctx) => buildAssetUrl(assetBaseUrl, assetRoute, domain.name, ctx.urlPath)
+            assetFormatter: (urlPath) => buildAssetUrl(assetBaseUrl, assetRoute, domain.name, urlPath),
+            normalizeInlineCid: buildInlineAssetCid
         });
-        const { html: mergedHtml, assets } = processor.flattenWithAssets(templateKey);
-        let html = mergedHtml;
-        const mappedAssets = assets.map((asset) => {
-            const rel = asset.filename.replace(/\\/g, '/');
-            const urlPath = rel.startsWith('assets/') ? rel.slice('assets/'.length) : rel;
-            return {
-                filename: urlPath,
-                path: asset.path,
-                cid: asset.cid ? buildInlineAssetCid(urlPath) : undefined
-            };
-        });
-        for (const asset of assets) {
-            if (!asset.cid) {
-                continue;
-            }
-            const rel = asset.filename.replace(/\\/g, '/');
-            const urlPath = rel.startsWith('assets/') ? rel.slice('assets/'.length) : rel;
-            const desiredCid = buildInlineAssetCid(urlPath);
-            if (asset.cid !== desiredCid) {
-                html = html.replaceAll(`cid:${asset.cid}`, `cid:${desiredCid}`);
-            }
-        }
-        return { html, assets: mappedAssets };
+        return { html, assets: assets };
     }
     catch (err) {
         throw new Error(`Template "${absPath}" failed to preprocess: ${err.message}`);

package/dist/esm/models/recipient.js

@@ -11,8 +11,6 @@ export const api_recipient_schema = z
     name: z.string().default('').describe('Optional recipient display name.')
 })
     .describe('Recipient routing record for form submissions.');
-// Sequelize typing pattern: merge the Zod-inferred attribute type onto the model instance type.
-// eslint-disable-next-line @typescript-eslint/no-unsafe-declaration-merging
 export class api_recipient extends Model {
 }
 export async function init_api_recipient(api_db) {

package/dist/esm/models/txmail.js

@@ -26,8 +26,6 @@ export const api_txmail_schema = z
         .describe('Derived list of template-referenced assets resolved during preprocessing/import.')
 })
     .describe('Transactional email template configuration.');
-// Sequelize typing pattern: merge the Zod-inferred attribute type onto the model instance type.
-// eslint-disable-next-line @typescript-eslint/no-unsafe-declaration-merging
 export class api_txmail extends Model {
 }
 export async function upsert_txmail(record) {

package/dist/esm/models/user.js

@@ -13,8 +13,6 @@ export const api_user_schema = z
     locale: z.string().default('').describe('Default locale for the user.')
 })
     .describe('User account record and API credentials.');
-// Sequelize typing pattern: merge the Zod-inferred attribute type onto the model instance type.
-// eslint-disable-next-line @typescript-eslint/no-unsafe-declaration-merging
 export class api_user extends Model {
 }
 export function apiTokenToHmac(token, pepper) {

package/dist/esm/store/envloader.js

@@ -67,6 +67,11 @@ export const envOptions = defineEnvOptions({
         description: 'Path to directory where config files are located',
         default: './data/'
     },
+    GEN_ENV_TEMPLATE: {
+        description: 'Write .env-dist to current working directory on startup',
+        default: false,
+        type: 'boolean'
+    },
     DB_USER: {
         description: 'Database username for API database'
     },

package/dist/esm/store/store.js

@@ -22,10 +22,36 @@ function create_mail_transport(vars) {
     if (user && pass) {
         args.auth = { user, pass };
     }
-    const mailer = createTransport({
-        ...args
-    });
-    return mailer;
+    return createTransport(args);
+}
+export function enableInitDataAutoReload(ctx, reload) {
+    if (!ctx.vars.DB_AUTO_RELOAD) {
+        return null;
+    }
+    const initDataPath = ctx.config_filename('init-data.json');
+    ctx.print_debug('Enabling auto reload of init-data.json');
+    const onChange = () => {
+        ctx.print_debug('Config file changed, reloading...');
+        try {
+            reload();
+        }
+        catch (err) {
+            ctx.print_debug(`Failed to reload config: ${err}`);
+        }
+    };
+    try {
+        const watcher = fs.watch(initDataPath, { persistent: false }, onChange);
+        return {
+            close: () => watcher.close()
+        };
+    }
+    catch (err) {
+        ctx.print_debug(`fs.watch unavailable; falling back to fs.watchFile: ${err}`);
+        fs.watchFile(initDataPath, { interval: 2000 }, onChange);
+        return {
+            close: () => fs.unwatchFile(initDataPath, onChange)
+        };
+    }
 }
 export class mailStore {
     env;
@@ -35,6 +61,7 @@ export class mailStore {
     configpath = '';
     uploadTemplate;
     uploadStagingPath;
+    autoReloadHandle = null;
     print_debug(msg) {
         if (this.vars.DEBUG) {
             console.log(msg);
@@ -137,10 +164,12 @@ export class mailStore {
         if (this.vars.FORM_CAPTCHA_REQUIRED && !String(this.vars.FORM_CAPTCHA_SECRET ?? '').trim()) {
             throw new Error('FORM_CAPTCHA_SECRET must be set when FORM_CAPTCHA_REQUIRED=true');
         }
-        EnvLoader.genTemplate(envOptions, '.env-dist');
+        if (this.vars.GEN_ENV_TEMPLATE) {
+            EnvLoader.genTemplate(envOptions, '.env-dist');
+        }
         const p = this.vars.CONFIG_PATH;
         this.configpath = path.isAbsolute(p) ? p : path.resolve(process.cwd(), p);
-        console.log(`Config path is ${this.configpath}`);
+        this.print_debug(`Config path is ${this.configpath}`);
         if (this.vars.UPLOAD_PATH && this.vars.UPLOAD_PATH.includes('{domain}')) {
             this.uploadTemplate = this.vars.UPLOAD_PATH;
             this.uploadStagingPath = path.resolve(this.configpath, '_uploads');
@@ -153,18 +182,8 @@ export class mailStore {
         }
         this.transport = await create_mail_transport(this.vars);
         this.api_db = await connect_api_db(this);
-        if (this.vars.DB_AUTO_RELOAD) {
-            this.print_debug('Enabling auto reload of init-data.json');
-            fs.watchFile(this.config_filename('init-data.json'), { interval: 2000 }, () => {
-                this.print_debug('Config file changed, reloading...');
-                try {
-                    importData(this);
-                }
-                catch (err) {
-                    this.print_debug(`Failed to reload config: ${err}`);
-                }
-            });
-        }
+        this.autoReloadHandle?.close();
+        this.autoReloadHandle = enableInitDataAutoReload(this, () => importData(this));
         return this;
     }
 }

package/dist/esm/util/forms.js

@@ -90,15 +90,13 @@ export async function enforceCaptchaPolicy(params) {
 }
 export function buildReplyToValue(form, fields) {
     const forced = typeof form.replyto_email === 'string' ? form.replyto_email.trim() : '';
-    const forcedValue = forced ? forced : '';
     if (form.replyto_from_fields) {
         const extracted = extractReplyToFromSubmission(fields);
         if (extracted) {
             return extracted;
         }
-        return forcedValue || undefined;
     }
-    return forcedValue || undefined;
+    return forced || undefined;
 }
 export function parseIdnameList(value, field) {
     if (value === undefined || value === null || value === '') {

package/dist/esm/util/shared-template-flatten.js

@@ -0,0 +1,41 @@
+// AUTO-GENERATED by scripts/sync-shared-code.cjs. Do not edit directly.
+import { Unyuck } from '@technomoron/unyuck';
+function defaultInlineAssetCid(urlPath) {
+    const normalized = String(urlPath || '')
+        .trim()
+        .replace(/\\/g, '/');
+    const safe = normalized.replace(/[^A-Za-z0-9._-]/g, '_').replace(/_+/g, '_');
+    return (safe || 'asset').slice(0, 200);
+}
+export function flattenTemplateWithAssets(options) {
+    const processor = new Unyuck({
+        basePath: options.domainRoot,
+        baseUrl: options.baseUrl,
+        collectAssets: true,
+        assetFormatter: (ctx) => options.assetFormatter(ctx.urlPath)
+    });
+    const { html: mergedHtml, assets } = processor.flattenWithAssets(options.templateKey);
+    let html = mergedHtml;
+    const normalizeCid = options.normalizeInlineCid ?? defaultInlineAssetCid;
+    const mappedAssets = assets.map((asset) => {
+        const rel = asset.filename.replace(/\\/g, '/');
+        const urlPath = rel.startsWith('assets/') ? rel.slice('assets/'.length) : rel;
+        return {
+            filename: urlPath,
+            path: asset.path,
+            cid: asset.cid ? normalizeCid(urlPath) : undefined
+        };
+    });
+    for (const asset of assets) {
+        if (!asset.cid) {
+            continue;
+        }
+        const rel = asset.filename.replace(/\\/g, '/');
+        const urlPath = rel.startsWith('assets/') ? rel.slice('assets/'.length) : rel;
+        const desiredCid = normalizeCid(urlPath);
+        if (asset.cid !== desiredCid) {
+            html = html.split(`cid:${asset.cid}`).join(`cid:${desiredCid}`);
+        }
+    }
+    return { html, assets: mappedAssets };
+}

package/docs/tutorial.md

@@ -19,7 +19,7 @@ export CONFIG_ROOT=$(realpath ../myorg-config)
 
 Update your `.env` (or runtime environment) to point at the new workspace:
 
-```
+```dotenv
 API_TOKEN_PEPPER=<generate-a-long-random-string>
 CONFIG_PATH=${CONFIG_ROOT}
 DB_AUTO_RELOAD=1  # optional: hot-reload init-data and templates
@@ -41,7 +41,7 @@ mkdir -p \
 
 The resulting tree should look like this (logo placement shown for clarity — add the file in step 4):
 
-```
+```text
 myorg-config/
 ├── init-data.json
 └── myorg.com/

package/package.json

@@ -1,86 +1,89 @@
 {
-	"name": "@technomoron/mail-magic",
-	"version": "1.0.37",
-	"main": "dist/cjs/index.js",
-	"module": "dist/esm/index.js",
-	"type": "module",
-	"bin": {
-		"mail-magic": "dist/esm/bin/mail-magic.js"
-	},
-	"exports": {
-		".": {
-			"import": "./dist/esm/index.js",
-			"require": "./dist/cjs/index.js"
-		}
-	},
-	"files": [
-		"dist",
-		"docs",
-		"README.md",
-		"CHANGES"
-	],
-	"repository": {
-		"type": "git",
-		"url": "git+https://github.com/technomoron/mail-magic.git",
-		"directory": "packages/mail-magic"
-	},
-	"scripts": {
-		"start": "node dist/esm/index.js",
-		"dev": "NODE_ENV=development nodemon --watch 'src/**/*.ts' --watch 'config/**/*.*' --watch '.env' --exec 'tsx' src/index.ts",
-		"run": "NODE_ENV=production npm run start",
-		"build:esm": "tsc --project tsconfig/tsconfig.esm.json",
-		"build:cjs": "node scripts/add-shebang.cjs --cjs-only",
-		"build": "npm run build:esm && npm run build:cjs",
-		"postbuild": "node scripts/add-shebang.cjs",
-		"prepack": "npm run build",
-		"test": "vitest run",
-		"test:watch": "vitest",
-		"scrub": "rm -rf ./node_modules/ ./dist/ pnpm-lock.yaml",
-		"lint": "node ../../node_modules/eslint/bin/eslint.js --config ../../eslint.config.mjs --no-error-on-unmatched-pattern --ext .js,.cjs,.mjs,.ts,.mts,.tsx,.vue,.json ./",
-		"lintfix": "node ../../node_modules/eslint/bin/eslint.js --config ../../eslint.config.mjs --fix --no-error-on-unmatched-pattern --ext .js,.cjs,.mjs,.ts,.mts,.tsx,.vue,.json ./",
-		"pretty": "node ../../node_modules/prettier/bin/prettier.cjs --config ../../.prettierrc --write \"**/*.{js,jsx,cjs,mjs,ts,tsx,mts,vue,json,md}\"",
-		"format": "npm run lintfix && npm run pretty",
-		"cleanbuild": "rm -rf ./dist/ && npm run format && npm run build",
-		"lintconfig": "node ../../lintconfig.cjs"
-	},
-	"keywords": [],
-	"author": "Bjørn Erik Jacobsen",
-	"license": "MIT",
-	"copyright": "Copyright (c) 2025 Bjørn Erik Jacobsen",
-	"bugs": {
-		"url": "https://github.com/technomoron/mail-magic/issues"
-	},
-	"dependencies": {
-		"@technomoron/api-server-base": "2.0.0-beta.18",
-		"@technomoron/env-loader": "^1.0.8",
-		"@technomoron/unyuck": "^1.0.4",
-		"bcryptjs": "^3.0.2",
-		"dotenv": "^16.4.5",
-		"email-addresses": "^5.0.0",
-		"html-to-text": "^9.0.5",
-		"nanoid": "^5.1.6",
-		"nodemailer": "^6.10.1",
-		"nunjucks": "^3.2.4",
-		"sequelize": "^6.37.7",
-		"sqlite3": "^5.1.7",
-		"swagger-jsdoc": "^6.2.8",
-		"swagger-ui-express": "^5.0.1",
-		"zod": "^4.1.5"
-	},
-	"devDependencies": {
-		"@types/express": "^5.0.6",
-		"@types/html-to-text": "^9.0.4",
-		"@types/nodemailer": "^6.4.19",
-		"@types/nunjucks": "^3.2.6",
-		"@types/supertest": "^6.0.3",
-		"mailparser": "^3.9.1",
-		"nodemon": "^3.1.10",
-		"smtp-server": "^3.18.0",
-		"supertest": "^7.1.4",
-		"tsx": "^4.20.5",
-		"typescript": "^5.9.3",
-		"vitest": "^4.0.16"
-	},
-	"homepage": "https://github.com/technomoron/mail-magic#readme",
-	"packageManager": "pnpm@10.26.1+sha512.664074abc367d2c9324fdc18037097ce0a8f126034160f709928e9e9f95d98714347044e5c3164d65bd5da6c59c6be362b107546292a8eecb7999196e5ce58fa"
-}
+  "name": "@technomoron/mail-magic",
+  "version": "1.0.40",
+  "main": "dist/cjs/index.js",
+  "module": "dist/esm/index.js",
+  "type": "module",
+  "bin": {
+    "mail-magic": "dist/esm/bin/mail-magic.js"
+  },
+  "exports": {
+    ".": {
+      "import": "./dist/esm/index.js",
+      "require": "./dist/cjs/index.js"
+    }
+  },
+  "files": [
+    "dist",
+    "docs",
+    "README.md",
+    "CHANGES"
+  ],
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/technomoron/mail-magic.git",
+    "directory": "packages/server"
+  },
+  "keywords": [],
+  "author": "Bjørn Erik Jacobsen",
+  "license": "MIT",
+  "copyright": "Copyright (c) 2025 Bjørn Erik Jacobsen",
+  "bugs": {
+    "url": "https://github.com/technomoron/mail-magic/issues"
+  },
+  "dependencies": {
+    "@technomoron/api-server-base": "2.0.0-beta.20",
+    "@technomoron/env-loader": "^1.0.8",
+    "@technomoron/unyuck": "^1.0.4",
+    "bcryptjs": "^3.0.2",
+    "dotenv": "^16.4.5",
+    "email-addresses": "^5.0.0",
+    "html-to-text": "^9.0.5",
+    "nanoid": "^5.1.6",
+    "nodemailer": "^6.10.1",
+    "nunjucks": "^3.2.4",
+    "sequelize": "^6.37.7",
+    "sqlite3": "^5.1.7",
+    "swagger-jsdoc": "^6.2.8",
+    "swagger-ui-express": "^5.0.1",
+    "zod": "^4.1.5"
+  },
+  "devDependencies": {
+    "@types/express": "^5.0.6",
+    "@types/html-to-text": "^9.0.4",
+    "@types/nodemailer": "^6.4.19",
+    "@types/nunjucks": "^3.2.6",
+    "@types/supertest": "^6.0.3",
+    "mailparser": "^3.9.1",
+    "nodemon": "^3.1.10",
+    "smtp-server": "^3.18.0",
+    "supertest": "^7.1.4",
+    "tsx": "^4.20.5",
+    "typescript": "^5.9.3",
+    "vitest": "^4.0.16"
+  },
+  "homepage": "https://github.com/technomoron/mail-magic#readme",
+  "scripts": {
+    "start": "node dist/esm/index.js",
+    "dev": "NODE_ENV=development nodemon --watch 'src/**/*.ts' --watch 'config/**/*.*' --watch '.env' --exec 'tsx' src/index.ts",
+    "run": "NODE_ENV=production npm run start",
+    "sync:shared": "node ../../scripts/sync-shared-code.cjs >/dev/null",
+    "build:esm": "tsc --project tsconfig/tsconfig.esm.json",
+    "build:cjs": "node scripts/add-shebang.cjs --cjs-only",
+    "build": "run-s sync:shared build:esm build:cjs",
+    "postbuild": "node scripts/add-shebang.cjs",
+    "test:unit": "vitest run --silent --reporter=dot",
+    "test": "run-s --silent sync:shared test:unit",
+    "test:watch": "vitest",
+    "scrub": "rimraf ./node_modules/ ./dist/ pnpm-lock.yaml package-lock.json yarn.lock",
+    "lint": "node ../../node_modules/eslint/bin/eslint.js --config ../../eslint.config.mjs --no-error-on-unmatched-pattern --ext .js,.cjs,.mjs,.ts,.mts,.tsx,.vue,.json ./",
+    "lintfix": "node ../../node_modules/eslint/bin/eslint.js --config ../../eslint.config.mjs --fix --no-error-on-unmatched-pattern --ext .js,.cjs,.mjs,.ts,.mts,.tsx,.vue,.json ./",
+    "pretty": "node ../../node_modules/prettier/bin/prettier.cjs --config ../../.prettierrc --write \"**/*.{js,jsx,cjs,mjs,ts,tsx,mts,vue,json,md}\"",
+    "format": "run-s lintfix pretty",
+    "cleanbuild": "run-s clean:dist format build",
+    "lintconfig": "node ../../lintconfig.cjs",
+    "clean:dist": "rimraf ./dist/",
+    "release": "bash ../../scripts/release-package.sh .",
+    "release:check": "bash ../../scripts/release-package-check.sh ."
+  }
+}