@cosmicdrift/kumiko-bundled-features 0.361.0 → 0.363.0

package/dist/sessions/handlers/list.query.js

@@ -1,5 +1,6 @@
 import { selectMany } from "@cosmicdrift/kumiko-framework/bun-db";
 import { access, definePagedQueryHandler, MAX_LIST_LIMIT, } from "@cosmicdrift/kumiko-framework/engine";
+import { isOneOf } from "@cosmicdrift/kumiko-types/type-guards";
 import * as z from "zod";
 import { decryptStoredPii } from "../../shared/index.js";
 import { userSessionTable } from "../schema/user-session.js";
@@ -10,7 +11,7 @@ import { userSessionTable } from "../schema/user-session.js";
 // non-exposed column.
 const SORTABLE_COLUMNS = ["id", "userId", "createdAt", "expiresAt", "revokedAt"];
 function isSortableColumn(value) {
-    return SORTABLE_COLUMNS.includes(value);
+    return isOneOf(SORTABLE_COLUMNS, value);
 }
 // Admin view of every session in the active tenant. ctx.db (TenantDb)
 // applies tenant-scoping automatically on selects from tables with a

package/dist/shared/attachment-file-name.d.ts

@@ -0,0 +1,3 @@
+import * as z from "zod";
+export declare const attachmentFileNameSchema: z.ZodString;
+export declare function sanitizePdfAttachmentFileName(raw: string, templateSlug: string): string;

package/dist/shared/attachment-file-name.js

@@ -0,0 +1,35 @@
+import * as z from "zod";
+const MAX_FILE_NAME_LENGTH = 255;
+function hasControlCharacter(value) {
+    return value.split("").some((char) => {
+        const code = char.charCodeAt(0);
+        return code <= 0x1f || code === 0x7f;
+    });
+}
+export const attachmentFileNameSchema = z
+    .string()
+    .min(1)
+    .max(MAX_FILE_NAME_LENGTH)
+    .refine((name) => !name.includes("/") && !name.includes("\\") && !hasControlCharacter(name), {
+    message: "file name must not contain path separators or control characters",
+});
+const PDF_FILE_NAME_MAX_LENGTH = 200;
+const PDF_EXTENSION = ".pdf";
+// Shared by everything that names a rendered PDF, so a mail attachment and a download of the same
+// template get the same name. The cut leaves room for the extension: the attachment schema caps
+// rendered-pdf names, and a name that only fits without ".pdf" would fail it.
+export function sanitizePdfAttachmentFileName(raw, templateSlug) {
+    const cleaned = raw
+        .split("")
+        .filter((char) => !hasControlCharacter(char))
+        .join("")
+        .replace(/[/\\";]/g, "-")
+        .replaceAll("..", "-")
+        .trim()
+        .slice(0, PDF_FILE_NAME_MAX_LENGTH - PDF_EXTENSION.length)
+        .trim();
+    const lastSegment = templateSlug.split(":").pop() ?? templateSlug;
+    if (cleaned === "")
+        return `${lastSegment}${PDF_EXTENSION}`;
+    return cleaned.toLowerCase().endsWith(PDF_EXTENSION) ? cleaned : `${cleaned}${PDF_EXTENSION}`;
+}

package/dist/shared/index.d.ts

@@ -1,5 +1,6 @@
 export { collectErasureFailure, throwIfErasureFailed } from "./assert-erased.js";
 export { assertNoWhereRuleInOwnershipWrite } from "./assert-no-where-rule-in-ownership-write.js";
+export { attachmentFileNameSchema, sanitizePdfAttachmentFileName, } from "./attachment-file-name.js";
 export { type ChunkedMigrationOptions, type ChunkedMigrationResult, type ChunkedMigrationStopReason, type MigrationRowOutcome, runChunkedMigration, } from "./chunked-entity-migration.js";
 export { classifyStoredEnvelope, type StoredEnvelopeClassification, } from "./classify-stored-envelope.js";
 export { decryptStoredPii } from "./decrypt-stored-pii.js";
@@ -9,6 +10,7 @@ export { isWithinGracePeriod } from "./grace-period.js";
 export { isIdentityV3Hash, verifyIdentityV3Hash } from "./identity-v3-hash.js";
 export { isTenantDb } from "./is-tenant-db.js";
 export { createLockoutCounter, type LockoutCounterState } from "./lockout-counter.js";
+export { mailHeading, mailParagraph, mailRepeatedRows } from "./mail-template-body.js";
 export { mapWithConcurrency } from "./map-with-concurrency.js";
 export { denyUnlessJoinRowParentVisible, hostRowIsGone, joinRowParentIsVisible, parentRowIsVisible, } from "./parent-visibility.js";
 export { hashPassword, verifyDummyPassword, verifyPassword } from "./password-hashing.js";
@@ -20,6 +22,7 @@ export { type RowBoundGrantResult, redeemRowBoundGrant, signRowBoundGrant, } fro
 export { runInSubTransaction } from "./run-in-sub-transaction.js";
 export { registrationLocaleFromRequest, sessionLocaleField } from "./session-locale-field.js";
 export { sessionTimezoneField } from "./session-timezone-field.js";
+export { assertNotSvg, MAX_INPUT_PIXELS, SHARP_INPUT_OPTIONS } from "./sharp-input-limits.js";
 export { peekTokenSubject, signToken, TokenPurpose, type VerifyResult, verifyToken, } from "./signed-token.js";
 export { EXT_SIGNUP_HANDOVER, findSignupHandoverProvider, isSignupHandoverProvider, SIGNUP_HANDOVER_BENIGN_CLAIM_REJECTION_CODE, type SignupHandoverBinding, type SignupHandoverProvider, } from "./signup-handover.js";
 export { createSingleUseTokenStore, hashSingleUseToken } from "./single-use-token-store.js";

package/dist/shared/index.js

@@ -1,5 +1,6 @@
 export { collectErasureFailure, throwIfErasureFailed } from "./assert-erased.js";
 export { assertNoWhereRuleInOwnershipWrite } from "./assert-no-where-rule-in-ownership-write.js";
+export { attachmentFileNameSchema, sanitizePdfAttachmentFileName, } from "./attachment-file-name.js";
 export { runChunkedMigration, } from "./chunked-entity-migration.js";
 export { classifyStoredEnvelope, } from "./classify-stored-envelope.js";
 export { decryptStoredPii } from "./decrypt-stored-pii.js";
@@ -9,6 +10,7 @@ export { isWithinGracePeriod } from "./grace-period.js";
 export { isIdentityV3Hash, verifyIdentityV3Hash } from "./identity-v3-hash.js";
 export { isTenantDb } from "./is-tenant-db.js";
 export { createLockoutCounter } from "./lockout-counter.js";
+export { mailHeading, mailParagraph, mailRepeatedRows } from "./mail-template-body.js";
 export { mapWithConcurrency } from "./map-with-concurrency.js";
 export { denyUnlessJoinRowParentVisible, hostRowIsGone, joinRowParentIsVisible, parentRowIsVisible, } from "./parent-visibility.js";
 export { hashPassword, verifyDummyPassword, verifyPassword } from "./password-hashing.js";
@@ -20,6 +22,7 @@ export { redeemRowBoundGrant, signRowBoundGrant, } from "./row-bound-grant.js";
 export { runInSubTransaction } from "./run-in-sub-transaction.js";
 export { registrationLocaleFromRequest, sessionLocaleField } from "./session-locale-field.js";
 export { sessionTimezoneField } from "./session-timezone-field.js";
+export { assertNotSvg, MAX_INPUT_PIXELS, SHARP_INPUT_OPTIONS } from "./sharp-input-limits.js";
 export { peekTokenSubject, signToken, TokenPurpose, verifyToken, } from "./signed-token.js";
 export { EXT_SIGNUP_HANDOVER, findSignupHandoverProvider, isSignupHandoverProvider, SIGNUP_HANDOVER_BENIGN_CLAIM_REJECTION_CODE, } from "./signup-handover.js";
 export { createSingleUseTokenStore, hashSingleUseToken } from "./single-use-token-store.js";

package/dist/shared/is-tenant-db.js

@@ -3,5 +3,5 @@
 // Shared so retention/compliance-profile resolvers that accept either (bulk cron
 // vs. per-hook TenantDb) branch through one predicate instead of duplicating it.
 export function isTenantDb(db) {
-    return typeof db.unsafeRaw === "function";
+    return "unsafeRaw" in db && typeof db.unsafeRaw === "function";
 }

package/dist/shared/mail-template-body.d.ts

@@ -0,0 +1,4 @@
+export declare function mailTextWithSlotsHtml(text: string): string;
+export declare function mailParagraph(text: string): string;
+export declare function mailHeading(text: string): string;
+export declare function mailRepeatedRows(listName: string, field: string): string;

package/dist/shared/mail-template-body.js

@@ -0,0 +1,17 @@
+import { escapeHtml, escapeHtmlAttr } from "@cosmicdrift/kumiko-headless";
+const SLOT_PATTERN = /\{([A-Za-z_][A-Za-z0-9_]*)\}/g;
+// Author text uses `{name}` slots. The text is escaped first and the slots are
+// swapped for variable nodes afterwards, so a slot can never smuggle markup.
+export function mailTextWithSlotsHtml(text) {
+    return escapeHtml(text).replace(SLOT_PATTERN, (_, name) => `<span data-variable="${escapeHtmlAttr(name)}"></span>`);
+}
+export function mailParagraph(text) {
+    return `<p>${mailTextWithSlotsHtml(text)}</p>`;
+}
+export function mailHeading(text) {
+    return `<h2>${mailTextWithSlotsHtml(text)}</h2>`;
+}
+// One table row per list entry; the cell shows the entry's `field`.
+export function mailRepeatedRows(listName, field) {
+    return `<table><tbody><tr data-each="${escapeHtmlAttr(listName)}"><td><p><span data-variable="${escapeHtmlAttr(field)}"></span></p></td></tr></tbody></table>`;
+}

package/dist/shared/sharp-input-limits.d.ts

@@ -0,0 +1,6 @@
+export declare const MAX_INPUT_PIXELS = 100000000;
+export declare const SHARP_INPUT_OPTIONS: {
+    readonly limitInputPixels: 100000000;
+    readonly sequentialRead: true;
+};
+export declare function assertNotSvg(format: string | undefined): void;

package/dist/shared/sharp-input-limits.js

@@ -0,0 +1,22 @@
+// Sharp-free so callers can import the limits without loading the native binding.
+// Above this, a decoded pixel buffer runs into hundreds of MB before any
+// resize even happens — sharp's own default (~268MP) is still large enough
+// to be an OOM primitive for a single request.
+export const MAX_INPUT_PIXELS = 100_000_000;
+// sequentialRead trades random pixel access for lower peak memory on
+// streamed formats — applied at every decode entry point below since none
+// of them need non-sequential access to the *original* bytes (extract runs
+// against a single already-buffered region per call).
+export const SHARP_INPUT_OPTIONS = {
+    limitInputPixels: MAX_INPUT_PIXELS,
+    sequentialRead: true,
+};
+// Shared trust boundary for every image byte source this renderer decodes —
+// the original upload (renderImage) and an overlay layer's bytes (applyOverlays)
+// alike: a base64 string in a field declaration isn't more trustworthy than
+// an upload just because it came from app code.
+export function assertNotSvg(format) {
+    if (format === "svg") {
+        throw new Error("derivatives-sharp: SVG is not supported — rendering untrusted SVG through libvips is a trust boundary this renderer doesn't need to cross.");
+    }
+}

package/dist/shared/signup-handover.js

@@ -10,6 +10,7 @@
 // The grant itself never crosses this boundary: verifyGrant returns only
 // the { entityType, rowId, sourceTenantId } binding, and mintClaim returns a
 // freshly signed short-lived token rather than handing back the original.
+import { isPlainObject } from "@cosmicdrift/kumiko-types/type-guards";
 export const EXT_SIGNUP_HANDOVER = "signupHandover";
 // Part of the contract: a provider's minted claim write may reject two
 // different ways. Benign — this code, nothing was written (forged,
@@ -20,8 +21,7 @@ export const EXT_SIGNUP_HANDOVER = "signupHandover";
 // together with it, never treat that as a skippable no-op.
 export const SIGNUP_HANDOVER_BENIGN_CLAIM_REJECTION_CODE = "invalid_or_expired_grant";
 export function isSignupHandoverProvider(options) {
-    return (typeof options === "object" &&
-        options !== null &&
+    return (isPlainObject(options) &&
         typeof options["verifyGrant"] === "function" &&
         typeof options["mintClaim"] === "function");
 }

package/dist/tags/handlers/assign-tag.write.js

@@ -1,4 +1,5 @@
 import { NotFoundError, writeFailure } from "@cosmicdrift/kumiko-framework/errors";
+import { isPlainObject } from "@cosmicdrift/kumiko-types/type-guards";
 import { denyUnlessJoinRowParentVisible } from "../../shared/index.js";
 import { tagAssignmentAggregateId } from "../aggregate-id.js";
 import { DEFAULT_TAG_ACCESS } from "../constants.js";
@@ -49,7 +50,8 @@ export function createAssignTagHandler(access = DEFAULT_TAG_ACCESS, assignmentEx
             // above and this restore() call, so restore() correctly refuses with
             // "not_deleted" — but the desired end state is already true. Converge
             // like the create() race below instead of surfacing a spurious error.
-            if (restored.error.details?.reason === "not_deleted") {
+            if (isPlainObject(restored.error.details) &&
+                restored.error.details["reason"] === "not_deleted") {
                 return { isSuccess: true, data: { id } };
             }
             if (restored.error.code !== "not_found")

package/dist/tags/web/tag-chip.js

@@ -14,6 +14,8 @@ function hexToRgb(color) {
     if (match === null)
         return null;
     const short = match[1];
+    if (short === undefined)
+        return null;
     const hex = short.length === 3
         ? `${short[0]}${short[0]}${short[1]}${short[1]}${short[2]}${short[2]}`
         : short;

package/dist/template-resolver/api.d.ts

@@ -1,7 +1,10 @@
-import type { DbRunner } from "@cosmicdrift/kumiko-framework/db";
+import type { DbRunner, TenantDb } from "@cosmicdrift/kumiko-framework/db";
 import type { SessionUser, TenantId } from "@cosmicdrift/kumiko-framework/engine";
 import type { Temporal } from "@cosmicdrift/kumiko-types/temporal";
+import type { FileAttachmentRef } from "../renderer-foundation/index.js";
 import type { ContentFormat, TemplateKind } from "./constants.js";
+import { type TemplatePdfAttachmentLink } from "./linked-resources.js";
+import { type TemplateMeta } from "./template-meta.js";
 export type TemplateResource = {
     readonly id: string;
     readonly version: number;
@@ -14,7 +17,15 @@ export type TemplateResource = {
     readonly content: string;
     readonly contentFormat: ContentFormat;
     readonly variableSchema: Record<string, unknown>;
+    /** Embeddable images: resource key -> fileRef id. */
     readonly linkedResources: Record<string, string>;
+    /** Files attached to every mail rendered from this template, ordered by key. */
+    readonly fileAttachments?: readonly FileAttachmentRef[];
+    /** PDFs rendered from document templates and attached at send time, ordered by key. */
+    readonly pdfAttachmentLinks?: readonly TemplatePdfAttachmentLink[];
+    /** Parsed per kind; null when absent or when the stored JSON no longer
+     *  matches the kind's schema (the renderer then fails with a clear error). */
+    readonly meta: TemplateMeta | null;
     readonly scope: "system" | "tenant";
     readonly parentTemplateId: string | null;
     readonly status: "draft" | "active" | "archived";
@@ -26,6 +37,13 @@ export type ResolveRequest = {
     readonly kind: TemplateKind;
     readonly locale: string;
 };
+export type LayoutKind = "mail-layout" | "pdf-layout";
+export type ResolveLayoutRequest = {
+    readonly tenantId: TenantId;
+    readonly slug: string;
+    readonly kind: LayoutKind;
+    readonly locale: string;
+};
 export type TemplateResolverApi = {
     /**
      * Findet ein konkretes Template by (tenantId, slug, kind, locale).
@@ -60,8 +78,18 @@ export type TemplateResolverApi = {
      * User cross-tenant Templates abfragen (Tenant-Isolation gebrochen).
      */
     readonly resolveTemplate: (args: ResolveRequest) => Promise<TemplateResource>;
+    /**
+     * Layouts are locale-neutral in the product (the layout editor saves under the locale of the
+     * row it loaded), so the locale chain is wider than resolveTemplate: tenant (requested,
+     * FALLBACK_LOCALE, any active locale), then system (same). Only active rows count; among
+     * "any" the highest version wins, then the alphabetically first locale, so the pick is stable.
+     * Throws TemplateNotFoundError when neither scope has an active row.
+     *
+     * **Caller invariant:** `tenantId` must come from the server, as for `resolveTemplate`.
+     */
+    readonly resolveLayout: (args: ResolveLayoutRequest) => Promise<TemplateResource>;
 };
-export declare function createTemplateResolverApi(db: DbRunner): TemplateResolverApi;
+export declare function createTemplateResolverApi(db: DbRunner | TenantDb): TemplateResolverApi;
 export declare class TemplateNotFoundError extends Error {
     readonly query: {
         slug: string;

package/dist/template-resolver/api.js

@@ -4,7 +4,9 @@
 import { selectMany } from "@cosmicdrift/kumiko-framework/bun-db";
 import { InternalError } from "@cosmicdrift/kumiko-framework/errors";
 import { FALLBACK_LOCALE, SYSTEM_TENANT_ID } from "./constants.js";
+import { fileAttachmentsOf, imageLinksOf, parseLinkedResourceEntries, pdfAttachmentLinksOf, } from "./linked-resources.js";
 import { templateResourcesTable } from "./table.js";
+import { parseTemplateMeta } from "./template-meta.js";
 export function createTemplateResolverApi(db) {
     return {
         findExact: async ({ tenantId, slug, kind, locale, scope }) => {
@@ -31,8 +33,30 @@ export function createTemplateResolverApi(db) {
             }
             throw new TemplateNotFoundError({ slug, kind, locale });
         },
+        resolveLayout: async ({ tenantId, slug, kind, locale }) => {
+            for (const tid of [tenantId, SYSTEM_TENANT_ID]) {
+                const rows = await selectMany(db, templateResourcesTable, {
+                    tenantId: tid,
+                    slug,
+                    kind,
+                });
+                const row = pickActiveLayoutRow(rows, locale);
+                if (row !== null)
+                    return toPublic(row);
+            }
+            throw new TemplateNotFoundError({ slug, kind, locale });
+        },
     };
 }
+function pickActiveLayoutRow(rows, locale) {
+    const active = rows
+        .filter((row) => row.status === "active")
+        .sort((a, b) => b.version - a.version || a.locale.localeCompare(b.locale));
+    return (active.find((row) => row.locale === locale) ??
+        active.find((row) => row.locale === FALLBACK_LOCALE) ??
+        active[0] ??
+        null);
+}
 async function fetchTemplate(db, tenantId, slug, kind, locale) {
     const rows = await selectMany(db, templateResourcesTable, { tenantId, slug, kind, locale }, { limit: 1 });
     // @cast-boundary db-row — db.select returnt unbenanntes unknown[],
@@ -43,7 +67,6 @@ function toPublic(row) {
     // @cast-boundary db-row — Drizzle-Schema typisiert kind/contentFormat/
     // scope/status als generic text. CHECK-Constraints in der DB schränken
     // sie auf die Union-Types ein; Cast assertet das Schema-Wissen.
-    // linkedResources ist ein text-column mit JSON-payload (string→string map).
     const kind = row.kind;
     // @cast-boundary db-row — siehe kind.
     const contentFormat = row.contentFormat;
@@ -51,9 +74,7 @@ function toPublic(row) {
     const scope = row.scope;
     // @cast-boundary db-row — siehe kind.
     const status = row.status;
-    // @cast-boundary db-row — parseJson returnt Record<string, unknown>;
-    // linkedResources-Spalte enthält per Schema {key: signedUrl}-Map.
-    const linkedResources = parseJson(row.linkedResources);
+    const linkedEntries = parseLinkedResourceEntries(row.linkedResources);
     return {
         id: String(row.id),
         version: row.version,
@@ -66,13 +87,27 @@ function toPublic(row) {
         content: row.content ?? "",
         contentFormat,
         variableSchema: parseJson(row.variableSchema),
-        linkedResources,
+        linkedResources: imageLinksOf(linkedEntries),
+        fileAttachments: fileAttachmentsOf(linkedEntries),
+        pdfAttachmentLinks: pdfAttachmentLinksOf(linkedEntries),
+        meta: parseStoredMeta(kind, row.meta),
         scope,
         parentTemplateId: row.parentTemplateId,
         status,
         modifiedAt: row.modifiedAt,
     };
 }
+function parseStoredMeta(kind, raw) {
+    if (!raw)
+        return null;
+    try {
+        const result = parseTemplateMeta(kind, JSON.parse(raw));
+        return result.ok ? result.meta : null;
+    }
+    catch {
+        return null;
+    }
+}
 function parseJson(raw) {
     if (!raw)
         return {};

package/dist/template-resolver/compile-document-body.d.ts

@@ -0,0 +1,8 @@
+import type { TemplateVariables } from "@cosmicdrift/kumiko-framework/engine";
+export type CompileDocumentBodyOptions = {
+    readonly resourceSrc?: (key: string) => string | undefined;
+    readonly alignmentAsInlineStyle?: boolean;
+};
+export declare function collectDocumentResourceKeys(html: string): readonly string[];
+export declare function toResourceDataUri(contentType: string, bytes: Uint8Array): string;
+export declare function compileDocumentBodyToHandlebars(html: string, variables: TemplateVariables, options?: CompileDocumentBodyOptions): string;

package/dist/template-resolver/compile-document-body.js

@@ -0,0 +1,163 @@
+import { isOneOf } from "@cosmicdrift/kumiko-types/type-guards";
+import { withParsedDocument } from "./document-sanitizer.js";
+import { DOCUMENT_TEXT_ALIGNMENTS, isAllowedDocumentLinkHref, isDocumentPlaceholderHref, isDocumentReferenceName, isDocumentResourceKey, } from "./document-schema.js";
+// Private-use characters mark where a Handlebars expression goes. Author text
+// is scrubbed of them first and every `{`/`}` is entity-encoded before the
+// markers are swapped for real expressions, so the only Handlebars syntax in
+// the output is the syntax this module wrote.
+const EXPRESSION_OPEN = "\uE000";
+const EXPRESSION_CLOSE = "\uE001";
+const MARKER_PATTERN = /\uE000(\d+)\uE001/g;
+function marker(state, expression) {
+    state.expressions.push(expression);
+    return `${EXPRESSION_OPEN}${state.expressions.length - 1}${EXPRESSION_CLOSE}`;
+}
+function ownVariable(variables, name) {
+    return Object.hasOwn(variables, name) ? variables[name] : undefined;
+}
+function itemFieldsOf(variables, listName) {
+    const def = ownVariable(variables, listName);
+    return def?.type === "list" ? def.item : null;
+}
+function rowScopeOf(element, state) {
+    const listName = element.closest("tr[data-each]")?.getAttribute("data-each") ?? null;
+    if (listName === null)
+        return null;
+    const itemFields = itemFieldsOf(state.variables, listName);
+    return itemFields === null ? null : { listName, itemFields };
+}
+function resolveReference(name, scope, variables) {
+    if (scope !== null && ownVariable(scope.itemFields, name) !== undefined) {
+        return { path: name, def: ownVariable(scope.itemFields, name) };
+    }
+    return { path: scope === null ? name : `@root.${name}`, def: ownVariable(variables, name) };
+}
+function valueExpression(path, def) {
+    if (def?.type === "money")
+        return `{{money ${path}}}`;
+    if (def?.type === "date")
+        return `{{date ${path}}}`;
+    return `{{${path}}}`;
+}
+function rewriteVariable(element, state) {
+    const name = element.getAttribute("data-variable") ?? "";
+    const replacement = element.ownerDocument.createTextNode(isDocumentReferenceName(name)
+        ? marker(state, valueExpression(...pathAndDef(name, element, state)))
+        : "");
+    element.replaceWith(replacement);
+}
+function pathAndDef(name, element, state) {
+    const { path, def } = resolveReference(name, rowScopeOf(element, state), state.variables);
+    return [path, def];
+}
+function rewriteLink(element, state) {
+    const href = element.getAttribute("href") ?? "";
+    if (isDocumentPlaceholderHref(href)) {
+        const name = href.slice(2, -2);
+        if (isDocumentReferenceName(name)) {
+            const [path] = pathAndDef(name, element, state);
+            element.setAttribute("href", marker(state, `{{link ${path}}}`));
+        }
+        else {
+            element.setAttribute("href", "#");
+        }
+    }
+    else if (!isAllowedDocumentLinkHref(href)) {
+        element.setAttribute("href", "#");
+    }
+}
+function rewriteRepeatRow(row, state) {
+    const listName = row.getAttribute("data-each") ?? "";
+    const document = row.ownerDocument;
+    if (itemFieldsOf(state.variables, listName) === null || !isDocumentReferenceName(listName)) {
+        row.remove();
+    }
+    else {
+        row.before(document.createTextNode(marker(state, `{{#each ${listName}}}`)));
+        row.after(document.createTextNode(marker(state, "{{/each}}")));
+        row.removeAttribute("data-each");
+        row.removeAttribute("data-repeat-header");
+    }
+}
+function stripActiveContent(element) {
+    for (const attribute of Array.from(element.attributes)) {
+        if (/^on/i.test(attribute.name))
+            element.removeAttribute(attribute.name);
+    }
+}
+function neutralizeBraces(html) {
+    return html.replace(/[{}]/g, (brace) => (brace === "{" ? "{" : "}"));
+}
+const RESOURCE_IMAGE_CONTENT_TYPES = new Set([
+    "image/png",
+    "image/jpeg",
+    "image/gif",
+    "image/webp",
+]);
+// Unique valid resource keys in document order.
+export function collectDocumentResourceKeys(html) {
+    return withParsedDocument(html, (root) => {
+        const keys = new Set();
+        for (const element of Array.from(root.querySelectorAll("img[data-resource]"))) {
+            const key = element.getAttribute("data-resource") ?? "";
+            if (isDocumentResourceKey(key))
+                keys.add(key);
+        }
+        return [...keys];
+    });
+}
+export function toResourceDataUri(contentType, bytes) {
+    if (!RESOURCE_IMAGE_CONTENT_TYPES.has(contentType)) {
+        throw new Error(`resource content type "${contentType}" cannot be embedded as an image`);
+    }
+    return `data:${contentType};base64,${Buffer.from(bytes).toString("base64")}`;
+}
+function rewriteAlignment(element) {
+    const align = element.getAttribute("data-align");
+    element.removeAttribute("data-align");
+    if (isOneOf(DOCUMENT_TEXT_ALIGNMENTS, align))
+        element.setAttribute("style", `text-align:${align}`);
+}
+function rewriteResourceImage(element, resourceSrc) {
+    const key = element.getAttribute("data-resource") ?? "";
+    const src = isDocumentResourceKey(key) ? resourceSrc?.(key) : undefined;
+    if (src === undefined) {
+        element.remove();
+        // skip: an unresolved resource key drops the image
+        return;
+    }
+    element.setAttribute("src", src);
+    element.removeAttribute("data-resource");
+}
+// Turns a sanitized document body into Handlebars source. Rows and links are
+// rewritten in document order; list rows last so their placeholders still see
+// the `tr[data-each]` ancestor.
+export function compileDocumentBodyToHandlebars(html, variables, options = {}) {
+    const state = { variables, expressions: [] };
+    const scrubbed = html.replaceAll(EXPRESSION_OPEN, "").replaceAll(EXPRESSION_CLOSE, "");
+    const compiled = withParsedDocument(scrubbed, (root) => {
+        for (const element of Array.from(root.querySelectorAll("script")))
+            element.remove();
+        for (const element of Array.from(root.querySelectorAll("img[data-resource]"))) {
+            rewriteResourceImage(element, options.resourceSrc);
+        }
+        for (const element of Array.from(root.querySelectorAll("*")))
+            stripActiveContent(element);
+        if (options.alignmentAsInlineStyle === true) {
+            for (const element of Array.from(root.querySelectorAll("[data-align]"))) {
+                rewriteAlignment(element);
+            }
+        }
+        for (const element of Array.from(root.querySelectorAll("span[data-variable]"))) {
+            rewriteVariable(element, state);
+        }
+        for (const element of Array.from(root.querySelectorAll("a[href]"))) {
+            rewriteLink(element, state);
+        }
+        for (const element of Array.from(root.querySelectorAll("tr[data-each]"))) {
+            rewriteRepeatRow(element, state);
+        }
+        return root.innerHTML;
+    });
+    return neutralizeBraces(compiled).replace(MARKER_PATTERN, (_match, index) => state.expressions[Number(index)] ?? "");
+}

package/dist/template-resolver/constants.d.ts

@@ -1,17 +1,26 @@
-export declare const RENDER_KINDS: readonly ["notification", "mail-html", "document-pdf", "image-snapshot"];
+export declare const RENDER_KINDS: readonly ["mail", "document-pdf", "image-snapshot"];
 export type RenderKind = (typeof RENDER_KINDS)[number];
-export declare const NON_RENDER_KINDS: readonly ["text-block", "ai-prompt"];
+export declare const DOCUMENT_HTML_KINDS: readonly ["mail", "document-pdf"];
+export type DocumentHtmlKind = (typeof DOCUMENT_HTML_KINDS)[number];
+export declare const NON_RENDER_KINDS: readonly ["notification", "text-block", "snippet", "ai-prompt", "mail-layout", "pdf-layout"];
 export type NonRenderKind = (typeof NON_RENDER_KINDS)[number];
-export declare const TEMPLATE_KINDS: readonly ["notification", "mail-html", "document-pdf", "image-snapshot", "text-block", "ai-prompt"];
+export declare const TEMPLATE_KINDS: readonly ["mail", "document-pdf", "image-snapshot", "notification", "text-block", "snippet", "ai-prompt", "mail-layout", "pdf-layout"];
 export type TemplateKind = (typeof TEMPLATE_KINDS)[number];
-export declare const UPSERT_KINDS: readonly ["notification", "mail-html", "document-pdf", "image-snapshot", "ai-prompt"];
+export declare const UPSERT_KINDS: readonly ["mail", "document-pdf", "image-snapshot", "ai-prompt", "mail-layout", "pdf-layout"];
 export type UpsertKind = (typeof UPSERT_KINDS)[number];
 export declare const TEXT_BLOCK_KIND: "text-block";
+export declare const COLLECTION_REFUSED_KINDS: readonly string[];
 export declare const CONTENT_FORMATS: readonly ["markdown", "mjml", "html", "plain"];
 export type ContentFormat = (typeof CONTENT_FORMATS)[number];
 export declare const TEMPLATE_SCOPES: readonly ["system", "tenant"];
 export type TemplateScope = (typeof TEMPLATE_SCOPES)[number];
 export declare const TEMPLATE_STATUSES: readonly ["draft", "active", "archived"];
 export type TemplateStatus = (typeof TEMPLATE_STATUSES)[number];
+export declare const PDF_PAGE_FORMATS: readonly ["A4", "Letter"];
+export type PdfPageFormat = (typeof PDF_PAGE_FORMATS)[number];
+export declare const DEFAULT_MAIL_LAYOUT_SLUG = "default";
+export declare const MAIL_PREVIEW_MAX_BYTES: number;
+export declare const TEST_MAIL_NOTIFICATION_TYPE = "template-resolver:test-mail";
+export declare const TEST_MAIL_SUBJECT_PREFIX = "[TEST] ";
 export { SYSTEM_TENANT_ID } from "@cosmicdrift/kumiko-framework/engine";
 export declare const FALLBACK_LOCALE = "de";

package/dist/template-resolver/constants.js

@@ -6,30 +6,50 @@
 // Plugin-Renderer in `renderer-foundation` matchen auf kind; der
 // Resolver hier ist kind-agnostisch — er lädt nur, das Content-Format
 // (markdown/mjml/html) entscheidet wer's rendert.
-export const RENDER_KINDS = [
+export const RENDER_KINDS = ["mail", "document-pdf", "image-snapshot"];
+// Kinds whose html body is a rich document: the server rebuilds it through the
+// document schema on every write (see document-sanitizer.ts).
+export const DOCUMENT_HTML_KINDS = ["mail", "document-pdf"];
+// Kinds without a renderer plugin: `notification` is the retired sections-JSON
+// notification kind, kept so rows stored before mails moved to `mail` stay
+// valid on replay; nothing writes or renders it any more. `text-block` is the Markdown text store
+// (ex text-content feature), `snippet` is the content of app collections such
+// as reply snippets and signatures (own kind so they stay out of the text-block
+// content tree), `ai-prompt` holds LLM prompts, `mail-layout` and
+// `pdf-layout` hold the frame a mail/pdf body is rendered into. All are read,
+// not rendered on their own — keeping them out of RENDER_KINDS is what stops
+// DEFAULT_PLUGIN_BY_KIND from demanding a plugin for them.
+export const NON_RENDER_KINDS = [
     "notification",
-    "mail-html",
-    "document-pdf",
-    "image-snapshot",
+    "text-block",
+    "snippet",
+    "ai-prompt",
+    "mail-layout",
+    "pdf-layout",
 ];
-// Kinds without a renderer plugin: `text-block` is the Markdown text store
-// (ex text-content feature), `ai-prompt` holds LLM prompts. Both are read,
-// not rendered — keeping them out of RENDER_KINDS is what stops
-// DEFAULT_PLUGIN_BY_KIND from demanding a plugin for them.
-export const NON_RENDER_KINDS = ["text-block", "ai-prompt"];
 // Full kind domain of the entity; RENDER_KINDS is the renderer-foundation subset.
 export const TEMPLATE_KINDS = [...RENDER_KINDS, ...NON_RENDER_KINDS];
 // Kinds written through upsertSystem/upsertTenant. `text-block` is absent on
 // purpose: it goes through set.write (title + folder tree); two write paths
 // onto the same row would drift apart.
-export const UPSERT_KINDS = [...RENDER_KINDS, "ai-prompt"];
+export const UPSERT_KINDS = [...RENDER_KINDS, "ai-prompt", "mail-layout", "pdf-layout"];
 // The only kind served by the anonymous-capable by-slug/by-tenant queries and
 // by set.write — mail templates and AI prompts are operational internals and
 // must not leak through the anonymous path.
 export const TEXT_BLOCK_KIND = "text-block";
+// Kinds a content collection must not write: a tenant row of these kinds would
+// shadow the system notification template or layout without the meta and
+// placeholder gates that upsertTenant applies.
+export const COLLECTION_REFUSED_KINDS = ["mail", "mail-layout", "pdf-layout"];
 export const CONTENT_FORMATS = ["markdown", "mjml", "html", "plain"];
 export const TEMPLATE_SCOPES = ["system", "tenant"];
 export const TEMPLATE_STATUSES = ["draft", "active", "archived"];
+export const PDF_PAGE_FORMATS = ["A4", "Letter"];
+export const DEFAULT_MAIL_LAYOUT_SLUG = "default";
+// The mail transport enforces no size limit of its own; 10 MiB is a common provider ceiling.
+export const MAIL_PREVIEW_MAX_BYTES = 10 * 1024 * 1024;
+export const TEST_MAIL_NOTIFICATION_TYPE = "template-resolver:test-mail";
+export const TEST_MAIL_SUBJECT_PREFIX = "[TEST] ";
 // System-Templates leben unter der canonical SYSTEM_TENANT_ID-Sentinel-UUID.
 // Re-Export aus framework — single source of truth, vermeidet Drift.
 export { SYSTEM_TENANT_ID } from "@cosmicdrift/kumiko-framework/engine";