Use {{{reset_url}}} within {{ttl_minutes}} minutes.
', + bodyHtml: 'Use this link within {{ttl_minutes}} minutes.
', + variables: [{ name: 'reset_url', type: 'url', required: true }], }); export const passwordResetZh = defineEmailTemplateDefinition({ @@ -126,7 +139,8 @@ export const passwordResetZh = defineEmailTemplateDefinition({ label: 'Password Reset', locale: 'zh-CN', subject: '重置您的密码', - bodyHtml: '请在 {{ttl_minutes}} 分钟内使用 {{{reset_url}}}。
', + bodyHtml: '请在 {{ttl_minutes}} 分钟内使用此链接。
', + variables: [{ name: 'reset_url', type: 'url', required: true }], }); ``` diff --git a/content/docs/deployment/cli.mdx b/content/docs/deployment/cli.mdx index 81a1be5fad4..73d6fc799fb 100644 --- a/content/docs/deployment/cli.mdx +++ b/content/docs/deployment/cli.mdx @@ -756,7 +756,7 @@ os compile --json # JSON output for CI pipelines → Normalizing stack definition... → Lowering inline handlers... → Validating protocol compliance... - → Running author-time rules (50)... + → Running author-time rules (51)... → Checking that every required capability has a provider installable in this edition... → Collecting package docs (ADR-0046)... 0 collected → Writing artifact... diff --git a/content/docs/deployment/validating-metadata.mdx b/content/docs/deployment/validating-metadata.mdx index 6711a28076c..1900358136c 100644 --- a/content/docs/deployment/validating-metadata.mdx +++ b/content/docs/deployment/validating-metadata.mdx @@ -481,6 +481,7 @@ orthogonal to both, and no cell here can carry it; it is written out in | Platform-schedule `create_record` organization (#6285) | — | — | — | ✓ᶠ | | Public-form anonymous intake on this deployment's tenancy posture — advisory only (#21476) | — | — | — | ✓ᵛ | | Autonumber `{field}` interpolation | ✓ | ✓ | ✓ | ✓ᵒ | +| Email template HTML hole placements — a hole in a placement the mail renderer's encoding does not suit (#25189) | ✓ | ✓ | ✓ | ✓ᵉ | | View references — form targets, view-key collisions (#2554) | ✓ | ✓ | ✓ | — | | Flow authoring anti-patterns (#1874) | ✓ | ✓ | ✓ | ✓ᶠ | | Flow trigger readiness — a flow that looks armed and never launches (#5762) | ✓ | ✓ | ✓ | ✓ᶠ | @@ -495,10 +496,11 @@ orthogonal to both, and no cell here can carry it; it is written out in **Every superscript in the `runtime publish` column is one metadata type whose writes that rule inspects: `✓ᶠ` `flow`, `✓ᵛ` `view`, `✓ᵈ` `dashboard`, `✓ᵒ` `object`, `✓ᵖ` `page`, `✓ˢ` `seed`, `✓ᵇ` `book`, `✓ᵖᵉ` `permission`, -`✓ᵖᵒ` `position`, `✓ᵃ` `app`** — the two `ᵖ`-initial pairs carry a second -letter because `page` already holds `ᵖ` on its own. Read the codes -**longest-first**: `ᵖᵒ` is `position`, never `page` followed by `object`. A cell -lists one superscript per declared type, in the order the rule declares them, and that +`✓ᵖᵒ` `position`, `✓ᵃ` `app`, `✓ᵉ` `email_template`** — the two +`ᵖ`-initial pairs carry a second letter because `page` already holds `ᵖ` on its +own. Read the codes **longest-first**: `ᵖᵒ` is `position`, never `page` +followed by `object`, and `ᵖᵉ` is `permission`, never `page` followed by +`email_template`. A cell lists one superscript per declared type, in the order the rule declares them, and that rule's own `runtimeTypes` in `AUTHORING_RULES` is the authority — the set has grown a type at a time (#4463 shipped P1 as `flow` and four rule families, #7220 moved the whole `views[]` visibility-predicate family across in one edit, #7529 @@ -506,8 +508,9 @@ put widget-binding integrity on `dashboard`, #8307 → #8310 walked the ADR-0090 security-posture block across `seed`, then `permission` and `book`, then `object`, #4716 crossed the five remaining **gating** object rules — functional completeness, managed API methods, autonumber formats, and both -validation-rule enforceability checks — onto `object`, and #19370 took the -vocabulary freeze across all five of its own write types at once), so read the +validation-rule enforceability checks — onto `object`, #19370 took the +vocabulary freeze across all five of its own write types at once, and #25189 +put the email template hole placement rule on `email_template`), so read the rule rather than assuming a save of some other type reaches storage unjudged. That last move is also why the vocabulary freeze is a row of its own. It was @@ -732,7 +735,7 @@ A clean run walks the registry and reports timing: Config: /path/to/support-desk/objectstack.config.ts Load time: 21ms → Validating against ObjectStack Protocol... - → Running author-time rules (50)... + → Running author-time rules (51)... → Checking that every required capability has a provider installable in this edition... → Checking package docs (ADR-0046)... diff --git a/content/docs/getting-started/build-with-claude-code.mdx b/content/docs/getting-started/build-with-claude-code.mdx index 3c0b902c7e7..9ee4a6b60e8 100644 --- a/content/docs/getting-started/build-with-claude-code.mdx +++ b/content/docs/getting-started/build-with-claude-code.mdx @@ -305,7 +305,7 @@ visible: 'status != "resolved"' ◆ Validate ──────────────────────────────────────── → Validating against ObjectStack Protocol... - → Running author-time rules (50)... + → Running author-time rules (51)... ✗ Author-time rules failed (1 issue) • stack · action 'resolve_ticket' visible: bare reference `status` — a diff --git a/content/docs/ui/react-pages.mdx b/content/docs/ui/react-pages.mdx index bec9c89b2ed..39b15dfe5b1 100644 --- a/content/docs/ui/react-pages.mdx +++ b/content/docs/ui/react-pages.mdx @@ -390,7 +390,7 @@ objectstack validate ──────────────────────────────────────── → Loading configuration... → Validating against ObjectStack Protocol... - → Running author-time rules (50)... + → Running author-time rules (51)... → Checking that every required capability has a provider installable in this edition... → Checking package docs (ADR-0046)... diff --git a/packages/formula/src/index.ts b/packages/formula/src/index.ts index aeae3a5e2cb..8a41367803f 100644 --- a/packages/formula/src/index.ts +++ b/packages/formula/src/index.ts @@ -64,6 +64,18 @@ export type { } from './cel-engine'; export { cronEngine } from './cron-engine'; export { templateEngine, TEMPLATE_FORMATTERS, formatValue } from './template-engine'; +// #25189 — where a hole may sit in a mail template's HTML face (ruling +// 6335348115 on #25082, F1 A2 / F3 C2). Here because both readers already +// depend on this package and on nothing else they share: `@objectstack/lint`'s +// authoring rule, and `@objectstack/plugin-email`'s built-in template pin, +// which also holds this grammar to the renderer's. +export { + judgeMailHtmlHoles, + MAIL_HTML_SUPPORTED_PLACEMENTS, + MAIL_HTML_PLACEMENT_LABELS, + MAIL_HTML_SUPPORTED_SHAPES, +} from './mail-html-hole-placement'; +export type { MailHtmlHole, MailHtmlHolePlacement, MailHtmlHoleJudgeOptions } from './mail-html-hole-placement'; export { registerStdLib, buildScope, registerPermissionPredicate, registerCapabilityPredicate } from './stdlib'; export type { PermissionBinding } from './stdlib'; // objectui#4421 / batch #147 — the permission predicate's data door. `can` reads diff --git a/packages/formula/src/mail-html-hole-placement.test.ts b/packages/formula/src/mail-html-hole-placement.test.ts new file mode 100644 index 00000000000..f11bfd4d416 --- /dev/null +++ b/packages/formula/src/mail-html-hole-placement.test.ts @@ -0,0 +1,168 @@ +// Copyright (c) 2026 ObjectStack. Licensed under the Apache-2.0 license. + +/** + * #25189 — the mail HTML hole placement judge, one placement class at a time. + * + * Each case names the class it asserts; the bodies carry holes and markup + * only, never a value. The judge's grammar parity with the renderer is pinned + * in `plugin-email` (`text-field-html-outlets.pin.test.ts`), where the + * renderer is. + */ +import { describe, expect, it } from 'vitest'; + +import { + judgeMailHtmlHoles, + MAIL_HTML_PLACEMENT_LABELS, + MAIL_HTML_SUPPORTED_PLACEMENTS, + type MailHtmlHolePlacement, +} from './mail-html-hole-placement'; + +const one = (html: string, urlVariables: string[] = []) => { + const holes = judgeMailHtmlHoles(html, { urlVariables }); + expect(holes, html).toHaveLength(1); + return holes[0]; +}; + +describe('the supported placements', () => { + it.each([ + ['{{ who }}
', 'element-text'], + ['{{who}}', 'element-text'], + ['| {{ who | upper }} |
x
', 'quoted-attribute'], + ["x
", 'quoted-attribute'], + ['