@akairos/typeset-studio 0.2.2 → 0.2.4

package/src/core/template.ts

@@ -1,49 +1,61 @@
 import { FlowImage } from "./types";
 
-/**
- * Applies template image layout configurations to current content images based on index intersection:
- * - If current images exist and template has images:
- *   For 0 <= i < min(template.images.length, current.images.length), apply template layout properties
- *   (isAbsolute, layoutPreset, x, y, width, height, rotate, opacity, zIndex, borderRadius, captionHeight, pageIndex)
- *   while preserving the current image's content identity (id, src, alt, caption).
- *   Current images beyond template.images.length remain untouched ("取交集，另外俩图用户自己调").
- * - If current images are empty (0 images), adopt the template's images (with freshly generated IDs).
- * - If template has no images, current images remain untouched.
- */
+// 固定素材标识用于显式替换，同一模板内必须唯一。
+export function validateTemplateAssets(images: FlowImage[] = []): void {
+  if (!Array.isArray(images)) throw new RangeError("模板图片必须是数组");
+  const keys = new Set<string>();
+  for (const image of images) {
+    if (!image || typeof image !== "object") throw new RangeError("无效的模板图片");
+    if (image.templateAssetKey === undefined) continue;
+    const key = image.templateAssetKey;
+    if (image.repeatEveryPage !== undefined && typeof image.repeatEveryPage !== "boolean") throw new RangeError(`素材 ${key} 的每页重复开关必须是布尔值`);
+    if (typeof key !== "string" || !/^[a-zA-Z0-9_-]+$/.test(key)) {
+      throw new RangeError("素材标识只能包含字母、数字、下划线和短横线");
+    }
+    if (image.repeatEveryPage && !image.isAbsolute) throw new RangeError(`素材 ${key} 的每页重复仅支持自由定位模式`);
+    if (keys.has(key)) throw new RangeError(`重复的模板素材标识：${key}`);
+    keys.add(key);
+  }
+}
+
+// 普通配图按位置套用布局，固定素材仅通过标识替换来源。
 export function applyTemplateImages(
   currentImages: FlowImage[],
-  templateImages?: FlowImage[],
+  templateImages: FlowImage[] = [],
+  overrides: Record<string, string> = {},
 ): FlowImage[] {
-  if (!templateImages || templateImages.length === 0) {
-    return currentImages;
+  validateTemplateAssets(templateImages);
+  if (!overrides || typeof overrides !== "object" || Array.isArray(overrides)) throw new RangeError("素材替换必须是标识到图片地址的映射");
+  const fixed = templateImages.filter((image) => image.templateAssetKey);
+  for (const [key, src] of Object.entries(overrides)) {
+    if (!fixed.some((image) => image.templateAssetKey === key)) throw new RangeError(`未知模板素材：${key}`);
+    if (typeof src !== "string" || !src.trim()) throw new RangeError(`素材 ${key} 的替换图片不能为空`);
   }
-
-  if (currentImages.length === 0) {
-    return templateImages.map((tplImg) => ({
-      ...tplImg,
-      id: `img_${Date.now()}_${Math.random().toString(36).substring(2, 6)}`,
-    }));
-  }
-
-  return currentImages.map((currentImg, idx) => {
-    if (idx < templateImages.length) {
-      const tplImg = templateImages[idx];
+  const content = currentImages.filter((image) => !image.templateAssetKey);
+  const slots = templateImages.filter((image) => !image.templateAssetKey);
+  const mapped = content.length === 0
+    ? slots.map((image) => ({ ...image, id: `img_${crypto.randomUUID()}` }))
+    : content.map((image, index) => {
+      const slot = slots[index];
+      if (!slot) return image;
       return {
-        ...currentImg,
-        layoutPreset: tplImg.layoutPreset ?? currentImg.layoutPreset,
-        isAbsolute: tplImg.isAbsolute ?? currentImg.isAbsolute,
-        x: tplImg.x ?? currentImg.x,
-        y: tplImg.y ?? currentImg.y,
-        width: tplImg.width ?? currentImg.width,
-        height: tplImg.height ?? currentImg.height,
-        rotate: tplImg.rotate ?? currentImg.rotate,
-        opacity: tplImg.opacity ?? currentImg.opacity,
-        zIndex: tplImg.zIndex ?? currentImg.zIndex,
-        borderRadius: tplImg.borderRadius ?? currentImg.borderRadius,
-        captionHeight: tplImg.captionHeight ?? currentImg.captionHeight,
-        pageIndex: tplImg.pageIndex ?? currentImg.pageIndex,
+        ...image,
+        layoutPreset: slot.layoutPreset ?? image.layoutPreset,
+        isAbsolute: slot.isAbsolute ?? image.isAbsolute,
+        x: slot.x ?? image.x,
+        y: slot.y ?? image.y,
+        width: slot.width ?? image.width,
+        height: slot.height ?? image.height,
+        rotate: slot.rotate ?? image.rotate,
+        opacity: slot.opacity ?? image.opacity,
+        zIndex: slot.zIndex ?? image.zIndex,
+        borderRadius: slot.borderRadius ?? image.borderRadius,
+        captionHeight: slot.captionHeight ?? image.captionHeight,
+        pageIndex: slot.pageIndex ?? image.pageIndex,
       };
-    }
-    return currentImg;
-  });
+    });
+  return [...mapped, ...fixed.map((image) => ({
+    ...image,
+    src: Object.hasOwn(overrides, image.templateAssetKey!) ? overrides[image.templateAssetKey!] : image.src,
+  }))];
 }

package/src/core/types.ts

@@ -20,6 +20,7 @@ export interface InlineTextRun {
   italic?: boolean;
   highlight?: boolean;
   font?: string;
+  letterSpacing?: number;
 }
 
 export type ContentBlockKind =
@@ -55,6 +56,8 @@ export interface FlowImage {
   src: string;
   alt: string;
   caption?: string;
+  templateAssetKey?: string; // 固定模板素材的唯一标识
+  repeatEveryPage?: boolean; // 开启时忽略页码，在所有输出页重复
   x?: number;
   y?: number;
   width?: number;
@@ -77,6 +80,7 @@ export interface FlowLineFragment {
   highlight?: boolean;
   gapBefore: number;
   occupiedWidth: number;
+  letterSpacing?: number;
 }
 
 export interface FlowLine {
@@ -163,6 +167,7 @@ export interface TypesetConfig {
   watermarkText: string;
   chrome?: TypesetChromeConfig;
   images?: FlowImage[];
+  coverTheme?: PipelineCoverTheme;
 }
 
 export interface TypesetResult {
@@ -171,3 +176,44 @@ export interface TypesetResult {
   canvasSpec: CanvasSpec;
   config: TypesetConfig;
 }
+
+// 流水线解析后的封面主题，与 pipeline 的公开契约保持一致。
+export interface CoverFont {
+  fontFamily: string;
+  fontSize: number;
+  minFontSize: number;
+  fontWeight: number;
+  lineHeight: number;
+  letterSpacing: number;
+}
+export interface CoverImage {
+  src: string;
+  fit: "cover" | "contain" | "fill";
+  position: { x: number; y: number };
+  opacity: number;
+}
+export interface PipelineCoverTheme {
+  id: string;
+  format: "poster-3-4" | "wechat-cover-split";
+  typography: { title: CoverFont; subtitle: CoverFont; footer: CoverFont };
+  colors: { text: string; accent: string; muted: string };
+  background: {
+    fill: { type: "solid"; color: string } |
+      { type: "linear"; angle: number; stops: Array<{ color: string; offset: number }> } |
+      { type: "radial"; position: { x: number; y: number }; stops: Array<{ color: string; offset: number }> };
+    image: CoverImage | null;
+    overlay: { color: string; opacity: number } | null;
+  };
+  decoration: {
+    pattern: "none" | "lines" | "grid" | "dots" | "rings" | "burst";
+    color: string;
+    opacity: number;
+    size: number;
+    image: CoverImage | null;
+  };
+  layout: {
+    textAlign: "left" | "center" | "right";
+    verticalAlign: "top" | "center" | "bottom";
+    safeArea: AlgorithmParams["safeArea"];
+  };
+}

package/src/index.ts

@@ -15,7 +15,7 @@ export {
   readFontFamilyName,
   type LocalFontInfo,
 } from "./core/font-loader";
-export { applyTemplateImages } from "./core/template";
+export { applyTemplateImages, validateTemplateAssets } from "./core/template";
 
 export {
   typesetStudioAdapter,
@@ -34,6 +34,9 @@ export type {
   AspectRatioType,
   CanvasSpec,
   ContentBlockKind,
+  CoverFont,
+  CoverImage,
+  PipelineCoverTheme,
   FlowBlock,
   FlowImage,
   FlowLine,

package/src/server/auth.ts

@@ -1,5 +1,6 @@
 import { existsSync, readFileSync, writeFileSync } from "fs";
 import { resolve } from "path";
+import { randomBytes } from "node:crypto";
 import type { Context, Next } from "hono";
 
 const ENV_PATH = resolve(process.cwd(), ".env");
@@ -26,7 +27,7 @@ export function getOrGenerateAdminKey(): string {
   }
 
   // Generate a new secure key
-  const randomSuffix = Math.random().toString(36).substring(2, 10) + Math.random().toString(36).substring(2, 10);
+  const randomSuffix = randomBytes(24).toString("hex");
   const newKey = `tsk_${randomSuffix}`;
 
   try {
@@ -53,18 +54,6 @@ export async function authMiddleware(c: Context, next: Next) {
 
   const providedKey = headerKey || bearerKey || queryKey;
 
-  // Seamless local use: requests from localhost / loopback are trusted for dev
-  const host = c.req.header("host") || "";
-  const isLocal =
-    host.includes("localhost") ||
-    host.includes("127.0.0.1") ||
-    host.includes("0.0.0.0") ||
-    host.includes("[::1]");
-
-  if (isLocal) {
-    return next();
-  }
-
   if (!providedKey || providedKey !== adminKey) {
     return c.json(
       {
@@ -78,3 +67,19 @@ export async function authMiddleware(c: Context, next: Next) {
 
   return next();
 }
+
+// 仅真实回环连接且来源为本机网页时允许自动取钥。
+export function isLocalRequest(c: Context): boolean {
+  if (c.req.header("forwarded") || c.req.header("x-forwarded-for") || c.req.header("x-forwarded-host")) return false;
+  const peer = c.env?.peerAddress;
+  if (!["127.0.0.1", "::1", "::ffff:127.0.0.1"].includes(peer)) return false;
+  const isLoopback = (value: string) => {
+    try {
+      return ["localhost", "127.0.0.1", "[::1]"].includes(new URL(value).hostname);
+    } catch {
+      return false;
+    }
+  };
+  return isLoopback(c.req.url) && isLoopback(`http://${c.req.header("host") || ""}`) &&
+    (!c.req.header("origin") || isLoopback(c.req.header("origin")!));
+}

package/src/server/index.ts

@@ -1,17 +1,16 @@
 import { existsSync, mkdirSync } from "fs";
 import { join } from "path";
 import { Hono } from "hono";
-import { cors } from "hono/cors";
 import { serveStatic } from "hono/bun";
-import { authMiddleware, getOrGenerateAdminKey } from "./auth";
+import { authMiddleware, getOrGenerateAdminKey, isLocalRequest } from "./auth";
 import { renderRouter } from "./routes/render";
 import { templatesRouter } from "./routes/templates";
 import { uploadRouter } from "./routes/upload";
 import { fontsRouter } from "./routes/fonts";
+import { resolveDataDir } from "../core/data-dir";
 
 export const app = new Hono();
 
-app.use("*", cors());
 
 // Health check (public)
 app.get("/api/health", (c) => {
@@ -36,17 +35,12 @@ app.post("/api/auth/verify", async (c) => {
 
 // Get active admin key for seamless local development
 app.get("/api/auth/current-key", (c) => {
-  const host = c.req.header("host") || "";
-  const isLocal =
-    host.includes("localhost") ||
-    host.includes("127.0.0.1") ||
-    host.includes("0.0.0.0") ||
-    host.includes("[::1]");
+  if (!isLocalRequest(c)) return c.json({ ok: false, isLocal: false }, 403);
   const adminKey = getOrGenerateAdminKey();
   return c.json({
     ok: true,
     key: adminKey,
-    isLocal,
+    isLocal: true,
   });
 });
 
@@ -60,11 +54,11 @@ app.route("/api/upload", uploadRouter);
 app.route("/api/render", renderRouter);
 
 // Static uploads serving
-const UPLOAD_DIR = join(process.cwd(), "data", "uploads");
+const UPLOAD_DIR = join(resolveDataDir(), "uploads");
 if (!existsSync(UPLOAD_DIR)) {
   mkdirSync(UPLOAD_DIR, { recursive: true });
 }
-app.use("/uploads/*", serveStatic({ root: "./data" }));
+app.use("/uploads/*", serveStatic({ root: resolveDataDir() }));
 
 // Static local font serving
 app.get("/fonts/:filename", async (c) => {
@@ -111,19 +105,20 @@ if (existsSync(DIST_DIR)) {
 }
 
 const PORT = Number(process.env.PORT || 4890);
-const adminKey = getOrGenerateAdminKey();
+getOrGenerateAdminKey();
 
 console.log(`
 ┌────────────────────────────────────────────────────────┐
 │               ⚡ Typeset Studio Server                 │
 ├────────────────────────────────────────────────────────┤
 │  Web URL:    http://localhost:${PORT}                   │
-│  Admin Key:  ${adminKey}                      │
 │  Protected:  X-Admin-Key header required               │
 └────────────────────────────────────────────────────────┘
 `);
 
 export default {
+  hostname: process.env.TYPESET_HOST || "127.0.0.1",
   port: PORT,
-  fetch: app.fetch,
+  fetch: (request: Request, server: Bun.Server<undefined>) =>
+    app.fetch(request, { peerAddress: server.requestIP(request)?.address }),
 };

package/src/server/routes/render.ts

@@ -10,6 +10,12 @@ import {
 } from "./templates";
 
 export const renderRouter = new Hono();
+renderRouter.onError((error, c) => {
+  if (error.message.startsWith("模板素材 ")) return c.json({ ok: false, error: error.message }, 422);
+  if (error instanceof RangeError) return c.json({ ok: false, error: error.message }, 400);
+  console.error("渲染失败", error);
+  return c.json({ ok: false, error: "Render failed" }, 500);
+});
 
 export interface RenderRequestBody {
   result?: TypesetResult;
@@ -26,7 +32,16 @@ export interface RenderRequestBody {
   text?: string;
   images?: FlowImage[];
   highlightWords?: string[];
-  config?: Partial<TypesetConfig>;
+  config?: Omit<Partial<TypesetConfig>, "algorithm" | "theme" | "typography"> & {
+    algorithm?: Partial<TypesetConfig["algorithm"]>;
+    theme?: Partial<TypesetConfig["theme"]>;
+    typography?: Partial<TypesetConfig["typography"]>;
+  };
+  minPages?: number;
+  maxPages?: number;
+  pageFillRatios?: Record<number, number>;
+  templateImageOverrides?: Record<string, string>;
+  preserveTemplateStyle?: boolean;
 }
 
 function inferSlot(route?: string, kind?: string, aspectRatio?: string): TemplateSlot | undefined {
@@ -74,6 +89,7 @@ export function resolveTypesetResult(body: RenderRequestBody): {
   let baseConfig: TypesetConfig | null = null;
   if (targetKey) {
     baseConfig = findTemplateByKeyOrName(targetKey);
+    if (!baseConfig) throw new RangeError(`Template '${targetKey}' not found`);
   }
 
   // 2. Resolve by slot and account
@@ -99,35 +115,56 @@ export function resolveTypesetResult(body: RenderRequestBody): {
     baseConfig = getDefaultConfig(isCover ? "wechat-cover-2.35" : "longform-3-4");
   }
 
+  // 插件保留模板样式；直接 API 调用仍允许显式覆盖配置。
+  const overrides = body.preserveTemplateStyle && baseConfig.id ? {} : body.config;
+
   // Merge any config overrides
   const effectiveConfig: TypesetConfig = {
     ...baseConfig,
-    ...(body.config || {}),
+    ...(overrides || {}),
     algorithm: {
       ...baseConfig.algorithm,
-      ...(body.config?.algorithm || {}),
+      ...(overrides?.algorithm || {}),
     },
     theme: {
       ...baseConfig.theme,
-      ...(body.config?.theme || {}),
+      ...(overrides?.theme || {}),
     },
     typography: {
       ...baseConfig.typography,
-      ...(body.config?.typography || {}),
+      ...(overrides?.typography || {}),
     },
+    chrome: { ...baseConfig.chrome, ...overrides?.chrome },
   };
 
-  const inputImages = body.images;
-  const resolvedImages = inputImages && inputImages.length > 0
-    ? (effectiveConfig.images ? applyTemplateImages(inputImages, effectiveConfig.images) : inputImages)
-    : (effectiveConfig.images || []);
-
-  const result = runTypeset({
-    markdown,
-    images: resolvedImages,
-    config: effectiveConfig,
-    highlightWords: body.highlightWords || [],
-  });
+  const resolvedImages = applyTemplateImages(body.images || [], effectiveConfig.images, body.templateImageOverrides);
+
+  // 封面主题先使用目标字号，单页放不下时缩到契约允许的最小字号。
+  let result: TypesetResult;
+  while (true) {
+    try {
+      result = runTypeset({
+        markdown, images: resolvedImages, config: effectiveConfig,
+        highlightWords: body.highlightWords || [],
+        minPages: body.minPages, maxPages: body.maxPages, pageFillRatios: body.pageFillRatios,
+      });
+      break;
+    } catch (error) {
+      const theme = effectiveConfig.coverTheme;
+      if (!theme || body.kind !== "cover" || !(error instanceof Error) ||
+        !/exceeds maxPages|cannot fit/.test(error.message)) throw error;
+      const title = theme.typography.title;
+      if (!Number.isFinite(title.fontSize) || !Number.isFinite(title.minFontSize) || title.minFontSize <= 0) {
+        throw new RangeError("Invalid cover theme font size");
+      }
+      if (title.fontSize <= title.minFontSize) throw error;
+      effectiveConfig.coverTheme = {
+        ...theme, typography: { ...theme.typography, title: {
+          ...title, fontSize: Math.max(title.minFontSize, Math.floor(title.fontSize * 0.9)),
+        } },
+      };
+    }
+  }
 
   return {
     templateId: baseConfig.id,
@@ -162,7 +199,7 @@ renderRouter.post("/png", async (c) => {
   }
 
   const pngBuffer = await renderPageToPng(targetPage, result.canvasSpec, result.config, result.pageCount);
-  return new Response(pngBuffer, {
+  return new Response(new Uint8Array(pngBuffer), {
     status: 200,
     headers: {
       "Content-Type": "image/png",
@@ -186,6 +223,12 @@ renderRouter.post("/export", async (c) => {
       pageNumber: item.pageNumber,
       dataUrl: `data:image/png;base64,${item.buffer.toString("base64")}`,
       byteLength: item.buffer.length,
+      imageIds: result.pages.find((page) => page.pageNumber === item.pageNumber)!.images.map((image) => image.id),
+      bodyImageCount: result.pages.find((page) => page.pageNumber === item.pageNumber)!.images.filter((image) => !image.templateAssetKey).length,
+      bodyImageSources: result.pages.find((page) => page.pageNumber === item.pageNumber)!.images.filter((image) => !image.templateAssetKey).map((image) => image.src),
+      bodyImageIds: result.pages.find((page) => page.pageNumber === item.pageNumber)!.images.filter((image) => !image.templateAssetKey).map((image) => image.id),
+      imageCount: result.pages.find((page) => page.pageNumber === item.pageNumber)!.images.length,
+      imageSources: result.pages.find((page) => page.pageNumber === item.pageNumber)!.images.map((image) => image.src),
     })),
   });
 });

package/src/server/routes/slots.test.ts

@@ -87,3 +87,99 @@ describe("Template Slots & Fallback Compatibility", () => {
     expect(data.result.pageCount).toBeGreaterThanOrEqual(1);
   });
 });
+
+// 鉴权、模板覆盖和数据目录共用隔离测试环境。
+describe("Storage and authentication regressions", () => {
+  it("rejects forged local Hosts and never returns a remote key", async () => {
+    for (const host of ["localhost.attacker.example", "localhost", "127.0.0.1"]) {
+      const response = await app.request("http://remote.example/api/templates", { headers: { host } });
+      expect(response.status).toBe(401);
+      const keyResponse = await app.request("http://remote.example/api/auth/current-key", { headers: { host } });
+      expect(keyResponse.status).toBe(403);
+      expect(await keyResponse.text()).not.toContain(adminKey);
+    }
+    const untrustedOrigin = await app.request("http://localhost/api/auth/current-key", {
+      headers: { host: "localhost", origin: "https://attacker.example" },
+    }, { peerAddress: "127.0.0.1" });
+    expect(untrustedOrigin.status).toBe(403);
+    const local = await app.request("http://localhost/api/auth/current-key", {
+      headers: { host: "localhost", origin: "http://localhost:5173" },
+    }, { peerAddress: "127.0.0.1" });
+    expect(local.status).toBe(200);
+  });
+
+  it("rejects traversal for template CRUD and resolver paths", async () => {
+    const template = { ...(await (await app.request("/api/templates/tpl_wechat_cover_minimal", { headers: authHeaders })).json()).template, id: "../escaped" };
+    const save = await app.request("/api/templates", {
+      method: "POST", headers: authHeaders, body: JSON.stringify(template),
+    });
+    expect(save.status).toBe(400);
+    for (const method of ["GET", "DELETE"]) {
+      const response = await app.request("/api/templates/..%2Fescaped", { method, headers: authHeaders });
+      expect(response.status).toBe(400);
+    }
+    const resolve = await app.request("/api/templates/resolve/..%2Fescaped", { headers: authHeaders });
+    expect(resolve.status).toBe(404);
+  });
+
+  it("uses saved builtin overrides and does not recreate deleted templates", async () => {
+    const id = "tpl_longform_vintage_news";
+    const original = (await (await app.request(`/api/templates/${id}`, { headers: authHeaders })).json()).template;
+    try {
+      const save = await app.request("/api/templates", {
+        method: "POST", headers: authHeaders,
+        body: JSON.stringify({ ...original, footerText: "磁盘覆盖" }),
+      });
+      expect(save.status).toBe(200);
+      const resolved = await (await app.request(`/api/templates/resolve/${id}`, { headers: authHeaders })).json();
+      expect(resolved.template.footerText).toBe("磁盘覆盖");
+      const deleted = await app.request(`/api/templates/${id}`, { method: "DELETE", headers: authHeaders });
+      expect(deleted.status).toBe(200);
+      expect((await app.request(`/api/templates/${id}`, { headers: authHeaders })).status).toBe(404);
+      expect((await app.request(`/api/templates/resolve/${id}`, { headers: authHeaders })).status).toBe(404);
+    } finally {
+      await app.request("/api/templates", { method: "POST", headers: authHeaders, body: JSON.stringify(original) });
+    }
+  });
+
+  it("serves uploaded files from the configured data directory", async () => {
+    const data = new FormData();
+    data.append("file", new File(["uploaded-image-bytes"], "test.png", { type: "image/png" }));
+    const response = await app.request("/api/upload", { method: "POST", headers: { "x-admin-key": adminKey }, body: data });
+    expect(response.status).toBe(200);
+    const uploaded = await response.json();
+    const fetched = await app.request(uploaded.url);
+    expect(fetched.status).toBe(200);
+    expect(await fetched.text()).toBe("uploaded-image-bytes");
+  });
+});
+
+describe("Fixed asset rendering API", () => {
+  it("preserves template styles, validates identifiers, and fails for missing fixed files", async () => {
+    const { getDefaultConfig } = await import("../../core/engine");
+    const id = "fixed_asset_api_test";
+    const template = { ...getDefaultConfig(), id, images: [
+      { id: "bg", src: "/missing-background.png", alt: "", isAbsolute: true, templateAssetKey: "background", zIndex: 0 },
+    ] };
+    try {
+      expect((await app.request("/api/templates", { method: "POST", headers: authHeaders, body: JSON.stringify(template) })).status).toBe(200);
+      const response = await app.request("/api/render", { method: "POST", headers: authHeaders, body: JSON.stringify({
+        template: id, markdown: "正文", preserveTemplateStyle: true,
+        config: { theme: { bgColor: "#123456" }, typography: { bodyFont: "Other Font" } },
+      }) });
+      const rendered = await response.json();
+      expect(rendered.result.config.theme.bgColor).toBe(template.theme.bgColor);
+      expect(rendered.result.config.typography.bodyFont).toBe(template.typography.bodyFont);
+      expect(rendered.result.pages[0].images[0].templateAssetKey).toBe("background");
+      const missing = await app.request("/api/render/export", { method: "POST", headers: authHeaders, body: JSON.stringify({ template: id, markdown: "正文" }) });
+      expect(missing.status).toBe(422);
+      expect((await missing.json()).error).toContain("background");
+      const unknown = await app.request("/api/render", { method: "POST", headers: authHeaders, body: JSON.stringify({ template: id, templateImageOverrides: { unknown: "new.png" } }) });
+      expect(unknown.status).toBe(400);
+      const duplicate = await app.request("/api/templates", { method: "POST", headers: authHeaders, body: JSON.stringify({ ...template, images: [...template.images, { ...template.images[0], id: "bg2" }] }) });
+      expect(duplicate.status).toBe(400);
+    } finally {
+      await app.request(`/api/templates/${id}`, { method: "DELETE", headers: authHeaders });
+    }
+  });
+});