mailery 0.10.2 → 0.12.0

package/dist/index.cjs

@@ -322,7 +322,10 @@ var init_sendgrid = __esm({
           replyTo: args.replyTo,
           subject: args.subject,
           text: args.text,
-          html: args.html,
+          // Omit the key entirely rather than sending `html: undefined` — a
+          // text_only template must produce a single-part text/plain message, and
+          // an explicit undefined can still serialize into an empty HTML part.
+          ...args.html ? { html: args.html } : {},
           headers: args.headers,
           customArgs: args.messageMeta,
           trackingSettings: {
@@ -2161,7 +2164,8 @@ async function dispatchSend(sendId, ctx) {
     await markFailed(send._id, `render error: ${String(err?.message ?? err)}`, ctx);
     throw err;
   }
-  const tracking = applyTracking(rendered.html, {
+  const textOnly = template.bodyFormat === "text_only";
+  const tracking = textOnly ? { html: "", links: [] } : applyTracking(rendered.html, {
     sendId: String(send._id),
     publicUrl: ctx.config.publicUrl,
     trackOpens: template.trackOpens ?? ctx.config.trackOpens,
@@ -2173,7 +2177,9 @@ async function dispatchSend(sendId, ctx) {
     {
       $set: {
         links: tracking.links,
-        bodyHash: sha256(tracking.html),
+        // Hash what actually goes out, so a text_only send's fingerprint
+        // tracks the text body rather than an HTML part it never had.
+        bodyHash: sha256(textOnly ? rendered.plainText : tracking.html),
         status: "sending",
         fromName: rendered.fromName,
         fromEmail: rendered.fromEmail,
@@ -2198,7 +2204,7 @@ async function dispatchSend(sendId, ctx) {
       fromEmail: rendered.fromEmail,
       replyTo: rendered.replyTo ?? void 0,
       subject: rendered.subject,
-      html: tracking.html,
+      ...textOnly ? {} : { html: tracking.html },
       text: rendered.plainText,
       headers,
       messageMeta: { sendId: String(send._id) }
@@ -4703,6 +4709,40 @@ ${input.plainText}`);
       });
     }
   }
+  const offDomain = findOffDomainLinkHosts(input.html, input.fromEmail);
+  if (offDomain.majority && offDomain.hosts.length > 0) {
+    issues.push({
+      rule: "offdomain_links",
+      severity: "warning",
+      message: `Most links point away from the From domain: ${offDomain.hosts.join(", ")}.`,
+      hint: "Link domains that match the sending domain build reputation. Route links through your own domain (or a tracking subdomain of it) where you can."
+    });
+  }
+  const insecure = findInsecureLinkHosts(input.html);
+  if (insecure.length > 0) {
+    issues.push({
+      rule: "insecure_link",
+      severity: "warning",
+      message: `Link uses plain http://: ${insecure.join(", ")}.`,
+      hint: "Mixed-content links get rewritten or warned about by some clients, and http:// correlates with stale spam templates. Use https://."
+    });
+  }
+  if (countImagesMissingAlt(input.html) > 0) {
+    issues.push({
+      rule: "image_missing_alt",
+      severity: "warning",
+      message: "One or more images have no alt text.",
+      hint: "Most clients block images by default on first open. Alt text is what the recipient actually sees, and screen readers need it."
+    });
+  }
+  if (hasImageOnlyLink(input.html)) {
+    issues.push({
+      rule: "image_only_link",
+      severity: "warning",
+      message: "A link wraps an image with no accompanying text.",
+      hint: "With images blocked, an image-only call-to-action is invisible and unclickable. Add a text label inside the link."
+    });
+  }
   const linkCount = countMatches(input.html, /<a\s[^>]*\bhref\s*=/gi);
   if (linkCount > 10) {
     issues.push({
@@ -4757,6 +4797,63 @@ function hasBareUrlInVisibleText(html) {
   const stripped = html.replace(/<a\b[^>]*>.*?<\/a>/gis, " ").replace(/<style\b[^>]*>.*?<\/style>/gis, " ").replace(/<script\b[^>]*>.*?<\/script>/gis, " ").replace(/<head\b[^>]*>.*?<\/head>/gis, " ");
   return /https?:\/\/[^\s<>"']+/i.test(stripped);
 }
+function findOffDomainLinkHosts(html, fromEmail) {
+  const fromDomain = fromEmail.split("@")[1]?.toLowerCase();
+  if (!fromDomain) return { hosts: [], majority: false };
+  const hosts = /* @__PURE__ */ new Set();
+  let total = 0;
+  let off = 0;
+  for (const href of extractHrefs(html)) {
+    if (href.includes("{{")) continue;
+    const host = hostnameOf(href);
+    if (!host) continue;
+    total++;
+    if (sameSite(host, fromDomain)) continue;
+    off++;
+    hosts.add(host);
+  }
+  return { hosts: Array.from(hosts), majority: total > 0 && off * 2 > total };
+}
+function sameSite(a, b) {
+  if (a === b) return true;
+  if (a.endsWith(`.${b}`) || b.endsWith(`.${a}`)) return true;
+  return lastLabels(a) === lastLabels(b);
+}
+function lastLabels(host) {
+  return host.split(".").slice(-2).join(".");
+}
+function findInsecureLinkHosts(html) {
+  const hits = /* @__PURE__ */ new Set();
+  for (const href of extractHrefs(html)) {
+    if (!/^http:\/\//i.test(href)) continue;
+    const host = hostnameOf(href);
+    if (host) hits.add(host);
+  }
+  return Array.from(hits);
+}
+function countImagesMissingAlt(html) {
+  let missing = 0;
+  const re = /<img\b[^>]*>/gi;
+  let m;
+  while (m = re.exec(html)) {
+    const tag = m[0];
+    const alt = /\balt\s*=\s*(?:"([^"]*)"|'([^']*)'|([^\s>]+))/i.exec(tag);
+    const value = alt ? alt[1] ?? alt[2] ?? alt[3] ?? "" : "";
+    if (value.trim().length === 0) missing++;
+  }
+  return missing;
+}
+function hasImageOnlyLink(html) {
+  const re = /<a\b[^>]*>(.*?)<\/a>/gis;
+  let m;
+  while (m = re.exec(html)) {
+    const inner = m[1];
+    if (!/<img\b/i.test(inner)) continue;
+    const text = inner.replace(/<[^>]*>/g, "").replace(/&nbsp;/gi, " ").trim();
+    if (text.length === 0) return true;
+  }
+  return false;
+}
 function findSpamSignals(text) {
   const out = /* @__PURE__ */ new Set();
   for (const { pattern, phrase } of SPAM_PHRASES) {
@@ -4829,6 +4926,9 @@ function isAllCaps(subject) {
 // src/server/api/admin.ts
 init_vars();
 
+// src/shared/enums.ts
+var TEMPLATE_BODY_FORMATS = ["multipart", "text_only"];
+
 // src/server/api/setup-status.ts
 async function runSetupChecks(mailer) {
   const checks = [];
@@ -6488,6 +6588,7 @@ function apiRouter(mailer, opts = {}) {
             lastModifiedAt: now
           },
           tags: [],
+          bodyFormat: "multipart",
           trackOpens: kind === "marketing",
           trackClicks: kind === "marketing",
           stats: { sent: 0, delivered: 0, opened: 0, clicked: 0, bounced: 0, complained: 0, unsubscribed: 0, lastSentAt: null },
@@ -6513,7 +6614,7 @@ function apiRouter(mailer, opts = {}) {
     asyncHandler(async (req, res) => {
       const tpl = await c.templates.findOne({ slug: req.params.slug });
       if (!tpl) return res.status(404).json({ error: "not_found" });
-      const { subject, preheader, mjml, editorJson, notes, name, fromName, fromEmail, replyTo, kind, trackOpens, trackClicks } = req.body ?? {};
+      const { subject, preheader, mjml, editorJson, notes, name, fromName, fromEmail, replyTo, kind, bodyFormat, trackOpens, trackClicks } = req.body ?? {};
       const set = {
         "draft.lastModifiedBy": req.actor,
         "draft.lastModifiedAt": /* @__PURE__ */ new Date(),
@@ -6541,6 +6642,7 @@ function apiRouter(mailer, opts = {}) {
           });
         }
       }
+      if (TEMPLATE_BODY_FORMATS.includes(bodyFormat)) set.bodyFormat = bodyFormat;
       if (typeof trackOpens === "boolean") set.trackOpens = trackOpens;
       if (typeof trackClicks === "boolean") set.trackClicks = trackClicks;
       await c.templates.updateOne({ _id: tpl._id }, { $set: set });
@@ -6626,7 +6728,9 @@ function apiRouter(mailer, opts = {}) {
           fromEmail: tpl.fromEmail,
           replyTo: tpl.replyTo ?? void 0,
           subject: draft.subject,
-          html: compiled.html,
+          // Match the real send shape — a text_only template's deliverability
+          // should be scored on the single-part message it actually sends.
+          ...tpl.bodyFormat === "text_only" ? {} : { html: compiled.html },
           text: compiled.plainText,
           headers: {},
           messageMeta: { mailTesterCheckId: checkId }
@@ -6971,7 +7075,9 @@ function apiRouter(mailer, opts = {}) {
         fromName: rendered.fromName,
         fromEmail: rendered.fromEmail,
         subject: `[TEST] ${rendered.subject}`,
-        html: tracking.html,
+        // Match the real send shape, or a test of a text_only template would
+        // arrive as HTML and hide exactly what the author is checking.
+        ...tpl.bodyFormat === "text_only" ? {} : { html: tracking.html },
         text: rendered.plainText
       });
       await mailer.audit({
@@ -7611,7 +7717,7 @@ var DEDUPE_POLICIES = [
 ];
 
 // src/server/index.ts
-var VERSION = "0.10.2" ;
+var VERSION = "0.12.0" ;
 
 exports.DEDUPE_POLICIES = DEDUPE_POLICIES;
 exports.FLOW_STEP_KINDS = FLOW_STEP_KINDS;