The preference page in every language the product speaks
The page behind every unsubscribe link only spoke English. It now speaks all 22 languages the product UI ships: English, Chinese, Hindi, Spanish, French, Arabic...
Pages refetch on org change events instead of loading once
Every successful write through forwardToApi now publishes rt.org.{orgId}.{domain} on core NATS (the domain is the first backend path segment, skipping security/...
An address opted out of marketing is not written to by the sales agent either
The agent's email check was topic-less, so an address that had stopped newsletters and campaigns - but was not on the whole do-not-email list - could still get ...
An unsubscribe by email is honoured, not dropped
Every bulk and shared-article message offered unsubscribe@<sender's domain> in its List-Unsubscribe header, but nothing read that mailbox - for a tenant it was ...
The Opt Out tab and the lead chip update live
Both subscribe to **************** (EmailService and SecurityService publish after every committed change; MediaService relays), so a recipient unsubscribing, a...
Opt-out screens refresh live when anyone changes the list
The ledger now tells OptOutChangePublisher after every committed change - a recipient on the preference page, a bounce, a member in Settings - and it publishes ...
A lead's opt-out change refreshes open screens live
The ledger here tells OptOutChangePublisher after the change commits, which publishes rt.org.{orgId}.email-opt-outs on core NATS (this service's JetStream strea...
The opt-out ledger says when an organization's list changed
An optional listener, told after the change commits, so the screens showing the list can refresh live instead of loading once. It carries only the organization:...
Mail to unsubscribe@hello.kamocrm.com reaches EmailService
Every bulk and shared-article message offers an unsubscribe by email (List-Unsubscribe mailto), but mail to that address went to postmaster and was never acted ...
Label every prerendered page site-hunt, so a deploy's refresh reaches it
getHuntOffer returned early when the hunt was not configured, and the build never is, so the build made no fetch and the pages it baked carried no site-hunt tag...
The sales agent honours the organization's email opt-out list
Before any email touch the outbound gate now asks the organization's email opt-out ledger about the contact's address. The address is the one the contact key po...
Refresh the site hunt's footer line on every pod after a deploy
exec on deploy/ reaches one replica, and each keeps its own cache, so the other served pages without the line for up to ten minutes after every deploy.
Every hunt window wears the site's own pop-up, not a black box
The signal card, pill, exit panel, console and whisper were flat rgba(8,8,8) boxes in monospace with an off-brand green, and read as something dropped on top of...
Pages and settings tabs fill their width instead of a centred column
Drop the max-width and auto-margin caps that held pages and settings tabs to a slim centred column. Where lifting a cap would leave one column of form fields st...
The organization owner sees the Opt Out tab, its menu entry and its card
A brand-new right is held by nobody the day it deploys; gating only on MANAGE_EMAIL_OPT_OUTS would hide the tab from whoever could grant it. Matches Sales Scrip...
The organization owner can open the opt-out list
A brand-new right is granted to nobody on the day it deploys, so a list gated only on MANAGE_EMAIL_OPT_OUTS would ship visible to no organization. The owner hol...
Relay org change events to /topic/rt/org/{orgId}/{domain}
Writers publish rt.org.{orgId}.{domain} on core NATS after a successful change; every pod relays it to the org's topic so open screens refetch instead of loadin...
House rules for UI work — layout, look, shared parts, live data [skip ci]
Pages fill their width, build from the shared components, colour only from the globals.css tokens, and take changing data over STOMP topics instead of loading o...
A hidden, per-visitor site hunt for a capped promotion, and signals that lead visitors into it
The hunt: seven locks per visitor, generated from a seed and HUNT_SECRET, enciphered with the previous answer, hidden on a page that moves every UTC midnight, w...
Issue personal single-use codes from a template promotion
The kamocrm.com site hunt hands each solver a code of their own, and only the first N solvers ever get one. A shared code could not do that: the first solver to...
A background nothing can draw is reported, not a lost batch
The org setup wizard's Backgrounds step resized each picked or suggested image in a loop with no catch. Since resizeBackgroundIfNeeded now refuses, with a reaso...
A saved background shows the member's picture, never the platform's
Behavior & Labeling pointed each tile at the slot's public URL the moment the commit returned, before provisioning had written the slot (it had not even been re...
Show the organization's own backgrounds, as many as it has
The sign-out screen asked for img/bg/1-3.webp whatever config.json's backgroundImageCount said, so an organization with no backgrounds of its own was shown what...
A new organization's folder holds none of the platform's backgrounds, stylesheet or config
Provisioning copied the whole base theme into every new organization's folder, KamoCRM's three sign-in photographs included. They sat at img/bg/1-3.webp under t...
Let the server say whether the viewer sees every organization
/network chose between all-networks and my-networks from the platform-rights context. That read fails closed and stays failed until the page reloads, and a god ...
A god account is shown every organization, wherever it is signed in
GET /org/all-networks - the list behind /network - was gated on the SYSTEM_USER platform right alone, and platform rights resolve only in a top-level-organizati...
Name the sender once at the top of the preference page
With a logo, the name is its alt text and is not written out again beneath it; without one, the name is the header. It was shown, and read aloud, twice.
A real preference page behind every unsubscribe link
The unsubscribe link opened a bare confirm-or-leave card. Someone who only wanted fewer emails had no way to say so, and nothing told them why they were being m...
Email opt-out chip and panel on the lead page
Beside the lead's email address there is now a chip saying whether the person may be emailed: Emails allowed, Opted out of all email, Paused until a date, Some ...
See and change a lead's email opt-out from the lead
A member working a lead can now see whether that person may be emailed, and change it, without the org-wide opt-out settings list. GET **************** answers...
The opt-out list only names contacts from organization books
A member's personal address book is theirs; the org-wide opt-out list must not become a way to see whose private contacts include someone.
An org admin can see and change the whole opt-out list
Settings -> Email -> Opt Out now has its API under /api/email/opt-outs, behind MANAGE_EMAIL_OPT_OUTS (god bypasses): a summary with the last 30 days, the list f...
Settings -> Email -> Opt Out, the organization's do-not-email list
Everyone who asked not to be emailed, in one place. A masthead says how many are off all email and why (unsubscribed, bounced, marked as spam, asked us to stop)...
Square, bevelled buttons and a 2px-cornered thumb on every scrollbar
The bar's four buttons (jump to start, step back, step forward, jump to end) are now 20px squares with hard corners, and the thumb keeps only a 2px radius. Both...
Count PLAY_CHESS, PLAY_HOLDEM and MANAGE_EMAIL_OPT_OUTS
The two game roots shipped without moving the audited shape, so RoleRightHierarchyTest had been red on main since. The opt-out right is a child of MANAGE_EMAIL_...
The opt-out design, and the client both surfaces will call
Settings -> Email -> Opt Out reads /api/email/opt-outs on EmailService; a lead's own address reads **************** on SecurityService. Long ids arrive as strin...
Every suppression check and bounce goes through the opt-out ledger
SuppressionService now asks EmailOptOutLedger, so a check sees the do-not-email list, pauses and topics alike, and a bounce lands in the same history as an unsu...
One opt-out ledger, topics, pauses and a history of every change
The do-not-email list could be written to but not read, changed or explained. This adds the one place it is read and written from, for every service: email_o...
Outbound e-mail hosts, send windows, per-host warm-up and the staged outbox
- Settings → Platform → Configuration gains an Outbound E-Mail Hosts tab, behind the platform right MANAGE_OUTBOUND_EMAIL_HOSTS: the hosts shared with every o...
Several outbound hosts per org, sent round-robin, each warmed on its own, inside a send window
An organization's campaign mail now leaves through any number of outbound hosts, one message at a time in rotation, instead of one bulk provider. - Hosts: an o...
Postfix-bulk accepts any sender from EmailService [skip ci]
The relay is now a platform outbound host that every organization's campaign mail may go through, as whatever From that organization sends as. Only the null sen...
MANAGE_OUTBOUND_EMAIL_HOSTS is enforced in EmailService
PlatformOutboundHostsController checks it through SessionPlatformFacts and the shared PlatformRightsResolver, so it is listed with the rights enforced elsewhere...
MANAGE_OUTBOUND_EMAIL_HOSTS, the platform console's outbound e-mail hosts
A platform right for the outbound e-mail hosts campaign mail leaves through: the hosts shared with every organization and the ones kept for the platform organiz...
The desk is never a client of itself
Sage and Erik both hold EXEC2EXEC_ACCESS, and each owns organizations of their own. Signed into one, the owner arm of Exec2ExecEligibility gave each a "client" ...
Delete, filter and switch off NoReply Outbound rows
The audit page gains a subsystem column and filter, checkbox selection with "select all" and "select all matching", and deletes for one row, the selected rows, ...
The NoReply ledger can be filtered by subsystem, pruned, and told what to record
Each row now names the subsystem that sent it and, for a template send, the template key. EmailTemplateService and the campaign sender open a NoReplyOutboundSou...
A saved campaign reopens inside its template, and the From is always the bulk sender's
The body is saved between two comment markers inside the finished email, and reopening a campaign puts only that part back in the middle of the template, where ...
Every campaign is sent as the org's bulk sender, and its From never pauses it
A campaign's own from_email/from_name are no longer read: the From is always the address and name on Settings > Email > Bulk Email Sender (else the org's NoRepl...
The unique (campaign, address) index, for a fresh environment
EmailService used to create **************** on every startup; DDL on this cluster belongs here instead. Idempotent, auto-committed (YugabyteDB builds indexes o...
Startup checks for the one-address-per-campaign index instead of creating it
EmailService ran CREATE UNIQUE INDEX on every startup. DDL on this cluster costs every service about fifteen minutes of "schema version mismatch", too much to r...
Like what you see shipping?
Every one of these updates lands in your workspace automatically. Start free and watch it grow week after week.