@cosmicdrift/kumiko-bundled-features 0.362.0 → 0.363.0

package/dist/template-resolver/handlers/resource-shared.d.ts

@@ -0,0 +1,9 @@
+import type { TenantId } from "@cosmicdrift/kumiko-framework/engine";
+import * as z from "zod";
+export declare const RESOURCE_MAX_BYTES_CONFIG_KEY = "template-resolver:config:resource-max-bytes";
+export declare const DEFAULT_RESOURCE_MAX_BYTES: number;
+export declare const resourceKeySchema: z.ZodString;
+export declare const RESOURCE_PURPOSES: readonly ["image", "attachment"];
+export type ResourcePurpose = (typeof RESOURCE_PURPOSES)[number];
+export declare const MAX_FILE_ATTACHMENTS_PER_TEMPLATE = 10;
+export declare function resourceTargetTenantId(tenantIdOverride: string | undefined, sessionTenantId: TenantId): TenantId;

package/dist/template-resolver/handlers/resource-shared.js

@@ -0,0 +1,14 @@
+import * as z from "zod";
+import { isDocumentResourceKey } from "../document-schema.js";
+export const RESOURCE_MAX_BYTES_CONFIG_KEY = "template-resolver:config:resource-max-bytes";
+export const DEFAULT_RESOURCE_MAX_BYTES = 2 * 1024 * 1024;
+export const resourceKeySchema = z.string().min(1).max(64).refine(isDocumentResourceKey, {
+    message: "resource key must be letters, digits, dot, dash or underscore",
+});
+export const RESOURCE_PURPOSES = ["image", "attachment"];
+export const MAX_FILE_ATTACHMENTS_PER_TEMPLATE = 10;
+export function resourceTargetTenantId(tenantIdOverride, sessionTenantId) {
+    // @cast-boundary engine-payload — override is a zod-validated string; forTenant
+    // rejects it for non-SystemAdmins.
+    return (tenantIdOverride ?? sessionTenantId);
+}

package/dist/template-resolver/handlers/resource-upload.write.d.ts

@@ -0,0 +1,13 @@
+import * as z from "zod";
+import { type StoredTemplateAttachment, type StoredTemplateResource } from "../store-template-resource.js";
+export declare const resourceUploadWrite: import("@cosmicdrift/kumiko-types/define-handler").WriteHandlerDefinition<"resource-upload", z.ZodObject<{
+    templateId: z.ZodOptional<z.ZodString>;
+    key: z.ZodOptional<z.ZodString>;
+    sourceFileRefId: z.ZodUUID;
+    tenantIdOverride: z.ZodOptional<z.ZodString>;
+    purpose: z.ZodDefault<z.ZodEnum<{
+        attachment: "attachment";
+        image: "image";
+    }>>;
+    fileName: z.ZodOptional<z.ZodString>;
+}, z.core.$strip>, StoredTemplateAttachment | StoredTemplateResource, import("@cosmicdrift/kumiko-types/event-type-map").KumikoEventTypeMap>;

package/dist/template-resolver/handlers/resource-upload.write.js

@@ -0,0 +1,98 @@
+import { defineWriteHandler } from "@cosmicdrift/kumiko-framework/engine";
+import { NotFoundError, UnprocessableError, writeFailure, } from "@cosmicdrift/kumiko-framework/errors";
+import * as z from "zod";
+import { FileRefTooLargeError, fileContextForTenant, readFileRefContent, } from "../../file-foundation/index.js";
+import { attachmentFileNameSchema } from "../../shared/index.js";
+import { TemplateResolverErrors } from "../qualified-names.js";
+import { readTemplateResourceMaxBytes, storeTemplateAttachment, storeTemplateResource, } from "../store-template-resource.js";
+import { RESOURCE_PURPOSES, resourceKeySchema, resourceTargetTenantId } from "./resource-shared.js";
+function attachmentTargetOf(input) {
+    const { templateId, key, fileName } = input;
+    if (templateId === undefined || key === undefined || fileName === undefined)
+        return null;
+    const parsedName = attachmentFileNameSchema.safeParse(fileName);
+    return parsedName.success ? { templateId, key, fileName: parsedName.data } : null;
+}
+// Purpose "image": stores a re-encoded image as a FileRef and, with templateId + key, links it into
+// the template; without templateId it only creates the FileRef (the branding logo upload path).
+// Purpose "attachment": stores the file as uploaded and links it as a mail attachment.
+export const resourceUploadWrite = defineWriteHandler({
+    name: "resource-upload",
+    schema: z
+        .object({
+        templateId: z.string().min(1).optional(),
+        key: resourceKeySchema.optional(),
+        /** An unclaimed upload of the caller (POST /api/files without entityType). */
+        sourceFileRefId: z.uuid(),
+        /** Cross-tenant target — SystemAdmin only. */
+        tenantIdOverride: z.string().min(1).optional(),
+        /** "attachment" links a PDF/PNG/JPEG as a file attached to every mail of the template. */
+        purpose: z.enum(RESOURCE_PURPOSES).default("image"),
+        /** Name the recipient sees; required for purpose "attachment". */
+        fileName: z.string().optional(),
+    })
+        .refine((p) => p.purpose === "attachment" || (p.templateId === undefined) === (p.key === undefined), {
+        message: "templateId and key must be given together",
+        path: ["key"],
+    }),
+    access: { roles: ["TenantAdmin", "SystemAdmin"] },
+    description: "Turns a file uploaded via POST /api/files (multipart, no entityType) into a template resource. With purpose image (default) the upload is checked against the resource-max-bytes cap, re-encoded to a supported image format and stored as a new file; with templateId and key it is linked into that template under the key, without them only the file is created. With purpose attachment, templateId, key and fileName are required: a PDF, PNG or JPEG is stored unchanged and linked into a mail template as a file attached to every mail sent from it, at most 10 per template. A cap above the files route's maxUploadSize has no effect.",
+    handler: async (event, ctx) => {
+        const { templateId, key, sourceFileRefId, purpose, fileName } = event.payload;
+        const attachmentTarget = purpose === "attachment" ? attachmentTargetOf({ templateId, key, fileName }) : null;
+        if (purpose === "attachment" && attachmentTarget === null) {
+            return writeFailure(new UnprocessableError(TemplateResolverErrors.attachmentInvalid, {
+                i18nKey: "templateResolver.errors.attachment.invalid",
+                details: { code: "target_required" },
+            }));
+        }
+        const maxBytes = await readTemplateResourceMaxBytes(ctx.config, ctx.registry);
+        // The source is read from the session tenant only: with tenantIdOverride the upload
+        // sits in the admin's own tenant while the normalized file lands in the target tenant.
+        // Only the caller's own unclaimed upload qualifies, so a record-attached image of
+        // someone else cannot be copied into a template.
+        let source;
+        try {
+            source = await readFileRefContent({
+                db: ctx.db,
+                filesForTenant: (tid) => fileContextForTenant(ctx, tid),
+                fileRefId: sourceFileRefId,
+                allowedTenantIds: [event.user.tenantId],
+                unclaimedUploadOf: event.user.id,
+                maxBytes,
+            });
+        }
+        catch (cause) {
+            if (cause instanceof FileRefTooLargeError) {
+                return writeFailure(new UnprocessableError(TemplateResolverErrors.resourceTooLarge, {
+                    i18nKey: "templateResolver.errors.resource.tooLarge",
+                    details: { maxBytes, size: cause.size },
+                }));
+            }
+            throw cause;
+        }
+        if (source === null)
+            return writeFailure(new NotFoundError("file-ref", sourceFileRefId));
+        // The source upload stays as an unclaimed file: bundled-features cannot reach the fileRef executor to delete it.
+        const tenantId = resourceTargetTenantId(event.payload.tenantIdOverride, event.user.tenantId);
+        if (attachmentTarget !== null) {
+            return storeTemplateAttachment({
+                ctx,
+                user: event.user,
+                tenantId,
+                bytes: source.content,
+                maxBytes,
+                ...attachmentTarget,
+            });
+        }
+        return storeTemplateResource({
+            ctx,
+            user: event.user,
+            tenantId,
+            bytes: source.content,
+            maxBytes,
+            ...(templateId !== undefined && { templateId }),
+            ...(key !== undefined && { key }),
+        });
+    },
+});

package/dist/template-resolver/handlers/send-test.write.d.ts

@@ -0,0 +1,11 @@
+import * as z from "zod";
+export declare const sendTestWrite: import("@cosmicdrift/kumiko-types/define-handler").WriteHandlerDefinition<"send-test", z.ZodObject<{
+    slug: z.ZodString;
+    locale: z.ZodString;
+    content: z.ZodOptional<z.ZodString>;
+    meta: z.ZodOptional<z.ZodUnknown>;
+    variableSchema: z.ZodDefault<z.ZodRecord<z.ZodString, z.ZodUnknown>>;
+}, z.core.$strip>, {
+    subject: string;
+    checks: readonly import("../template-preview.js").PreviewCheck[];
+}, import("@cosmicdrift/kumiko-types/event-type-map").KumikoEventTypeMap>;

package/dist/template-resolver/handlers/send-test.write.js

@@ -0,0 +1,81 @@
+import { defineWriteHandler } from "@cosmicdrift/kumiko-framework/engine";
+import { UnprocessableError, writeFailure } from "@cosmicdrift/kumiko-framework/errors";
+import * as z from "zod";
+import { collectChannels, createEmailAttachmentReader, EMAIL_CHANNEL_NAME, } from "../../delivery/index.js";
+import { fileContextForTenant } from "../../file-foundation/index.js";
+import { TEST_MAIL_NOTIFICATION_TYPE, TEST_MAIL_SUBJECT_PREFIX } from "../constants.js";
+import { TemplateResolverErrors } from "../qualified-names.js";
+import { renderTemplatePreview } from "../template-preview.js";
+import { localeSchema, templateSlugSchema } from "./shared.js";
+const TEST_MAIL_RATE_LIMIT = { limit: 10, windowSeconds: 3600 };
+function emailChannelOf(registry) {
+    return collectChannels(registry).find((channel) => channel.name === EMAIL_CHANNEL_NAME);
+}
+// Transport errors can carry provider responses or the address, so the client only gets a fixed code.
+function testMailFailed(code) {
+    return writeFailure(new UnprocessableError(TemplateResolverErrors.testMailFailed, {
+        i18nKey: "templateResolver.errors.testMail.failed",
+        details: { code },
+    }));
+}
+// The only recipient is the caller's own address, resolved server-side, so the handler can never mail a third party.
+export const sendTestWrite = defineWriteHandler({
+    name: "send-test",
+    schema: z.object({
+        slug: templateSlugSchema,
+        locale: localeSchema,
+        content: z.string().max(200_000).optional(),
+        meta: z.unknown().optional(),
+        variableSchema: z.record(z.string(), z.unknown()).default({}),
+    }),
+    access: { roles: ["TenantAdmin", "SystemAdmin"] },
+    rateLimit: { per: "user+handler", ...TEST_MAIL_RATE_LIMIT },
+    description: "Sends the rendered preview of a mail template draft, or of the stored template when no content is given, to the calling user's own address with the subject prefixed by [TEST], carrying the inline images and the files attached to the template; there is no recipient input, the sample values come from the declared variable examples, and a draft that fails the write rules is rejected without sending.",
+    handler: async (event, ctx) => {
+        const outcome = await renderTemplatePreview(ctx, event.user, {
+            ...event.payload,
+            kind: "mail",
+        });
+        if (!outcome.ok)
+            return writeFailure(outcome.error);
+        const { preview, mailAttachments } = outcome;
+        const channel = emailChannelOf(ctx.registry);
+        if (channel === undefined) {
+            return writeFailure(new UnprocessableError(TemplateResolverErrors.testMailNoChannel, {
+                i18nKey: "templateResolver.errors.testMail.noChannel",
+            }));
+        }
+        const channelContext = {
+            db: ctx.db,
+            registry: ctx.registry,
+            sseBroker: undefined,
+            tenantId: event.user.tenantId,
+            secrets: ctx.secrets,
+            readAttachment: createEmailAttachmentReader(ctx.db, ctx.registry, event.user.tenantId, ctx.config, (tenantId) => fileContextForTenant(ctx, tenantId)),
+        };
+        const address = (await channel.resolve?.(event.user.id, channelContext)) ?? null;
+        if (address === null) {
+            return writeFailure(new UnprocessableError(TemplateResolverErrors.testMailNoAddress, {
+                i18nKey: "templateResolver.errors.testMail.noAddress",
+            }));
+        }
+        const subject = `${TEST_MAIL_SUBJECT_PREFIX}${preview.subject ?? ""}`;
+        let sent;
+        try {
+            const result = await channel.send(address, {
+                notificationType: TEST_MAIL_NOTIFICATION_TYPE,
+                title: subject,
+                body: undefined,
+                data: undefined,
+                locale: event.payload.locale,
+            }, channelContext, { subject, html: preview.html, text: preview.text ?? "", attachments: mailAttachments });
+            sent = result.status === "sent";
+        }
+        catch {
+            return testMailFailed("channel_error");
+        }
+        if (!sent)
+            return testMailFailed("not_sent");
+        return { isSuccess: true, data: { subject, checks: preview.checks } };
+    },
+});

package/dist/template-resolver/handlers/set.write.d.ts

@@ -6,8 +6,11 @@ export declare const setWrite: import("@cosmicdrift/kumiko-types/define-handler"
         "ai-prompt": "ai-prompt";
         "document-pdf": "document-pdf";
         "image-snapshot": "image-snapshot";
-        "mail-html": "mail-html";
+        mail: "mail";
+        "mail-layout": "mail-layout";
         notification: "notification";
+        "pdf-layout": "pdf-layout";
+        snippet: "snippet";
         "text-block": "text-block";
     }>>;
     title: z.ZodString;

package/dist/template-resolver/handlers/set.write.js

@@ -1,10 +1,14 @@
 import { fetchOne } from "@cosmicdrift/kumiko-framework/bun-db";
 import { defineWriteHandler, SYSTEM_TENANT_ID, } from "@cosmicdrift/kumiko-framework/engine";
+import { isOneOf } from "@cosmicdrift/kumiko-types/type-guards";
 import * as z from "zod";
 import { requireForTenant } from "../../shared/index.js";
-import { TEMPLATE_KINDS, TEXT_BLOCK_KIND } from "../constants.js";
+import { TEMPLATE_KINDS, TEXT_BLOCK_KIND, UPSERT_KINDS } from "../constants.js";
 import { templateResourcesTable } from "../table.js";
+import { resolveTemplateVariables } from "../template-validation.js";
 import { contentFormatSchema, executor, folderSchema, localeSchema, slugSchema } from "./shared.js";
+import { parseStoredJson, storedRecord } from "./template-gates.js";
+import { gateTemplateWrite } from "./template-write.js";
 // Upsert of a single resource, one operation per (tenantId, slug, kind,
 // locale). This is the content-tree authoring path: unlike upsertTenant it
 // takes a title and a folder, has no draft stage (saving publishes) and it may
@@ -21,6 +25,9 @@ import { contentFormatSchema, executor, folderSchema, localeSchema, slugSchema }
 // upsertTenant → publish draft stage. That is the deliberate split between
 // the two authoring routes — use upsertSystem/upsertTenant when a template
 // needs a draft or a variable schema.
+//
+// Kinds that upsertSystem/upsertTenant also write run the same validation
+// pipeline here, and because saving publishes, publish issues reject too.
 export const setWrite = defineWriteHandler({
     name: "set",
     schema: z.object({
@@ -55,17 +62,32 @@ export const setWrite = defineWriteHandler({
             kind,
             locale: event.payload.locale,
         });
+        const scope = tenantId === SYSTEM_TENANT_ID ? "system" : "tenant";
+        let content = event.payload.content;
+        if (isOneOf(UPSERT_KINDS, kind)) {
+            const gated = gateTemplateWrite({
+                kind,
+                scope,
+                contentFormat: event.payload.contentFormat,
+                content,
+                rawMeta: parseStoredJson(existing?.meta ?? null),
+                variables: resolveTemplateVariables(ctx.registry, event.payload.slug, storedRecord(existing?.variableSchema ?? null)),
+            }, "active");
+            if (!gated.ok)
+                return gated.failure;
+            content = gated.evaluated.content;
+        }
         const fields = {
             slug: event.payload.slug,
             kind,
             locale: event.payload.locale,
             title: event.payload.title,
-            content: event.payload.content,
+            content,
             contentFormat: event.payload.contentFormat,
             folder: event.payload.folder ?? null,
             variableSchema: "{}",
             linkedResources: "{}",
-            scope: tenantId === SYSTEM_TENANT_ID ? "system" : "tenant",
+            scope,
             parentTemplateId: null,
             // Text blocks have no draft stage — saving publishes, so resolveTemplate
             // (which only returns active rows) finds them.

package/dist/template-resolver/handlers/shared.d.ts

@@ -1,13 +1,16 @@
 import * as z from "zod";
+import { templateSlugSchema } from "../template-meta.js";
 export declare const executor: import("@cosmicdrift/kumiko-types/event-store-executor-types").EventStoreExecutor;
 export declare const slugSchema: z.ZodString;
+export { templateSlugSchema };
 export declare const localeSchema: z.ZodString;
 export declare const kindSchema: z.ZodEnum<{
     "ai-prompt": "ai-prompt";
     "document-pdf": "document-pdf";
     "image-snapshot": "image-snapshot";
-    "mail-html": "mail-html";
-    notification: "notification";
+    mail: "mail";
+    "mail-layout": "mail-layout";
+    "pdf-layout": "pdf-layout";
 }>;
 export declare const folderSchema: z.ZodString;
 export declare const titleSchema: z.ZodString;
@@ -28,8 +31,9 @@ export declare const upsertPayloadSchema: z.ZodObject<{
         "ai-prompt": "ai-prompt";
         "document-pdf": "document-pdf";
         "image-snapshot": "image-snapshot";
-        "mail-html": "mail-html";
-        notification: "notification";
+        mail: "mail";
+        "mail-layout": "mail-layout";
+        "pdf-layout": "pdf-layout";
     }>;
     locale: z.ZodString;
     content: z.ZodString;
@@ -40,7 +44,7 @@ export declare const upsertPayloadSchema: z.ZodObject<{
         plain: "plain";
     }>;
     variableSchema: z.ZodDefault<z.ZodRecord<z.ZodString, z.ZodUnknown>>;
-    linkedResources: z.ZodDefault<z.ZodRecord<z.ZodString, z.ZodString>>;
+    meta: z.ZodOptional<z.ZodUnknown>;
     parentTemplateId: z.ZodOptional<z.ZodString>;
     title: z.ZodOptional<z.ZodNullable<z.ZodString>>;
     folder: z.ZodOptional<z.ZodNullable<z.ZodString>>;

package/dist/template-resolver/handlers/shared.js

@@ -2,6 +2,7 @@ import { createEventStoreExecutor } from "@cosmicdrift/kumiko-framework/db";
 import * as z from "zod";
 import { CONTENT_FORMATS, TEMPLATE_STATUSES, UPSERT_KINDS } from "../constants.js";
 import { templateResourceEntity, templateResourcesTable } from "../table.js";
+import { templateSlugSchema } from "../template-meta.js";
 // One executor per bundle, shared by all four handlers for create/update via
 // event store + optimistic lock.
 export const executor = createEventStoreExecutor(templateResourcesTable, templateResourceEntity, {
@@ -13,6 +14,7 @@ export const slugSchema = z
     .min(1)
     .max(80)
     .regex(/^[a-z0-9][a-z0-9-]*$/, "slug must be kebab-case (lowercase, digits, dashes)");
+export { templateSlugSchema };
 export const localeSchema = z
     .string()
     .min(2)
@@ -31,13 +33,15 @@ export const statusSchema = z.enum(TEMPLATE_STATUSES);
 // Common Upsert-Payload — geteilt zwischen upsertSystem + upsertTenant.
 // Unterschied: ACL + tenantId-Bestimmung, sonst identisch.
 export const upsertPayloadSchema = z.object({
-    slug: slugSchema,
+    slug: templateSlugSchema,
     kind: kindSchema,
     locale: localeSchema,
     content: z.string().max(200_000),
     contentFormat: contentFormatSchema,
     variableSchema: z.record(z.string(), z.unknown()).default({}),
-    linkedResources: z.record(z.string(), z.string()).default({}),
+    // Shape depends on kind; validated against template-meta.ts in the handler so
+    // problems surface as field issues on `meta.*`.
+    meta: z.unknown().optional(),
     parentTemplateId: z.string().min(1).optional(),
     title: titleSchema.nullable().optional(),
     folder: folderSchema.nullable().optional(),

package/dist/template-resolver/handlers/template-gates.d.ts

@@ -0,0 +1,36 @@
+import type { Registry, TemplateVariables } from "@cosmicdrift/kumiko-framework/engine";
+import type { FieldIssue } from "@cosmicdrift/kumiko-framework/errors";
+import { type ContentFormat, type TemplateKind } from "../constants.js";
+import { type TemplateWriteScope } from "../layout-regions.js";
+import type { TemplateResourceRow } from "../table.js";
+import { type TemplateValidation } from "../template-validation.js";
+export declare function placeholderIssues(validation: TemplateValidation, opts: {
+    readonly requireAllRequired: boolean;
+}): FieldIssue[];
+export type TemplateWriteInput = {
+    readonly kind: TemplateKind;
+    readonly scope: TemplateWriteScope;
+    readonly contentFormat: ContentFormat;
+    readonly content: string | null;
+    readonly rawMeta: unknown;
+    readonly variables: TemplateVariables;
+    /** Keys with an uploaded file besides the built-in `logo`; only feeds the unknownResources warning. */
+    readonly resourceKeys?: readonly string[];
+};
+export type TemplateWriteResult = {
+    readonly ok: true;
+    readonly content: string | null;
+    readonly metaJson: string | null;
+    readonly validation: TemplateValidation | null;
+    /** Problems that still allow a draft but block publishing. */
+    readonly publishIssues: readonly FieldIssue[];
+} | {
+    readonly ok: false;
+    readonly issues: readonly FieldIssue[];
+    /** Set when the placeholder scan ran, so callers can still list what it found. */
+    readonly validation: TemplateValidation | null;
+};
+export declare function evaluateTemplateWrite(input: TemplateWriteInput): TemplateWriteResult;
+export declare function parseStoredJson(raw: string | null): unknown;
+export declare function storedRecord(raw: string | null): Readonly<Record<string, unknown>>;
+export declare function publishGateIssues(registry: Registry, row: TemplateResourceRow): readonly FieldIssue[];

package/dist/template-resolver/handlers/template-gates.js

@@ -0,0 +1,131 @@
+import { isOneOf } from "@cosmicdrift/kumiko-types/type-guards";
+import { CONTENT_FORMATS, TEMPLATE_KINDS, } from "../constants.js";
+import { documentViolationsToFieldIssues } from "../document-sanitizer.js";
+import { sanitizeTemplateWriteBody } from "../layout-regions.js";
+import { imageResourceKeysOf } from "../linked-resources.js";
+import { parseTemplateMeta } from "../template-meta.js";
+import { resolveTemplateVariables, validateTemplatePlaceholders, } from "../template-validation.js";
+const PLACEHOLDER_VALIDATED_KINDS = new Set([
+    "mail",
+    "document-pdf",
+    "pdf-layout",
+]);
+function metaIssueToFieldIssue(issue) {
+    return {
+        path: issue.path,
+        code: "invalid_meta",
+        i18nKey: "templateResolver.errors.template.invalidMeta",
+        params: { detail: issue.message },
+    };
+}
+export function placeholderIssues(validation, opts) {
+    const issues = [];
+    if (validation.unknown.length > 0) {
+        issues.push({
+            path: "content",
+            code: "unknown_placeholder",
+            i18nKey: "templateResolver.errors.template.unknownPlaceholders",
+            params: { detail: validation.unknown.join(", ") },
+        });
+    }
+    if (opts.requireAllRequired && validation.missingRequired.length > 0) {
+        issues.push({
+            path: "content",
+            code: "missing_required_placeholder",
+            i18nKey: "templateResolver.errors.template.missingRequiredPlaceholders",
+            params: { detail: validation.missingRequired.join(", ") },
+        });
+    }
+    return issues;
+}
+const NO_PUBLISH_ISSUES = [];
+function isPlaceholderValidated(kind, contentFormat) {
+    if (kind === "mail-layout")
+        return contentFormat === "html";
+    return PLACEHOLDER_VALIDATED_KINDS.has(kind);
+}
+// The single validation pipeline of every template write: sanitize and layout
+// rules, then meta, then placeholders.
+export function evaluateTemplateWrite(input) {
+    const body = sanitizeTemplateWriteBody({
+        kind: input.kind,
+        scope: input.scope,
+        contentFormat: input.contentFormat,
+        content: input.content,
+    });
+    if (!body.ok)
+        return {
+            ok: false,
+            issues: documentViolationsToFieldIssues(body.violations),
+            validation: null,
+        };
+    const parsedMeta = parseTemplateMeta(input.kind, input.rawMeta);
+    if (!parsedMeta.ok) {
+        return { ok: false, issues: parsedMeta.issues.map(metaIssueToFieldIssue), validation: null };
+    }
+    const metaJson = parsedMeta.meta === null ? null : JSON.stringify(parsedMeta.meta);
+    if (!isPlaceholderValidated(input.kind, input.contentFormat)) {
+        return {
+            ok: true,
+            content: body.content,
+            metaJson,
+            validation: null,
+            publishIssues: NO_PUBLISH_ISSUES,
+        };
+    }
+    const validation = validateTemplatePlaceholders({
+        kind: input.kind,
+        body: body.content ?? "",
+        meta: parsedMeta.meta,
+        variables: input.variables,
+        resourceKeys: input.resourceKeys,
+    });
+    const issues = placeholderIssues(validation, { requireAllRequired: false });
+    if (issues.length > 0)
+        return { ok: false, issues, validation };
+    return {
+        ok: true,
+        content: body.content,
+        metaJson,
+        validation,
+        publishIssues: placeholderIssues(validation, { requireAllRequired: true }),
+    };
+}
+function isTemplateKind(kind) {
+    return isOneOf(TEMPLATE_KINDS, kind);
+}
+export function parseStoredJson(raw) {
+    if (!raw)
+        return undefined;
+    try {
+        return JSON.parse(raw);
+    }
+    catch {
+        return undefined;
+    }
+}
+function isGatedKind(kind) {
+    return isTemplateKind(kind) && (kind === "mail-layout" || PLACEHOLDER_VALIDATED_KINDS.has(kind));
+}
+export function storedRecord(raw) {
+    const parsed = parseStoredJson(raw);
+    return typeof parsed === "object" && parsed !== null && !Array.isArray(parsed)
+        ? Object.fromEntries(Object.entries(parsed))
+        : {};
+}
+// Publishing makes a row servable, so a stored row must pass the same pipeline
+// as an active write would have.
+export function publishGateIssues(registry, row) {
+    if (!isGatedKind(row.kind) || !isOneOf(CONTENT_FORMATS, row.contentFormat))
+        return [];
+    const result = evaluateTemplateWrite({
+        kind: row.kind,
+        scope: row.scope === "system" ? "system" : "tenant",
+        contentFormat: row.contentFormat,
+        content: row.content,
+        rawMeta: parseStoredJson(row.meta),
+        variables: resolveTemplateVariables(registry, row.slug, storedRecord(row.variableSchema)),
+        resourceKeys: imageResourceKeysOf(row.linkedResources),
+    });
+    return result.ok ? result.publishIssues : result.issues;
+}

package/dist/template-resolver/handlers/template-write.d.ts

@@ -0,0 +1,45 @@
+import { type HandlerContext, type SessionUser, type TemplateVariables, type TenantId, type WriteResult } from "@cosmicdrift/kumiko-framework/engine";
+import { type WriteFailure } from "@cosmicdrift/kumiko-framework/errors";
+import type { ContentFormat, TemplateKind } from "../constants.js";
+import type { TemplateWriteScope } from "../layout-regions.js";
+import type { TemplateValidation } from "../template-validation.js";
+import { type TemplateWriteInput, type TemplateWriteResult } from "./template-gates.js";
+export type TemplateRowPayload = {
+    readonly slug: string;
+    readonly kind: TemplateKind;
+    readonly locale: string;
+    readonly content: string | null;
+    readonly contentFormat: ContentFormat;
+    readonly variableSchema: Readonly<Record<string, unknown>>;
+    readonly meta?: unknown;
+    readonly title?: string | null | undefined;
+    readonly folder?: string | null | undefined;
+    readonly parentTemplateId?: string | null | undefined;
+};
+export type WrittenTemplateRow = {
+    readonly id: string;
+    readonly slug: string;
+    readonly isNew: boolean;
+    readonly validation: TemplateValidation | null;
+};
+export type TemplateRowWrite = {
+    readonly ctx: HandlerContext;
+    readonly user: SessionUser;
+    readonly tenantId: TenantId;
+    readonly scope: TemplateWriteScope;
+    readonly status: "draft" | "active";
+    readonly variables: TemplateVariables;
+    readonly payload: TemplateRowPayload;
+};
+export declare function refuseTenantScopeUnderSystemTenant(scope: TemplateWriteScope, tenantId: string): WriteResult<never> | null;
+export type GatedTemplateWrite = {
+    readonly ok: true;
+    readonly evaluated: Extract<TemplateWriteResult, {
+        ok: true;
+    }>;
+} | {
+    readonly ok: false;
+    readonly failure: WriteFailure;
+};
+export declare function gateTemplateWrite(input: TemplateWriteInput, status: "draft" | "active"): GatedTemplateWrite;
+export declare function writeTemplateRow(args: TemplateRowWrite): Promise<WriteResult<WrittenTemplateRow>>;