@cosmicdrift/kumiko-bundled-features 0.362.0 → 0.363.0

package/dist/waitlist/feature.js

@@ -7,6 +7,7 @@ import { rejectHandler } from "./handlers/reject.write.js";
 import { createSubmitHandler } from "./handlers/submit.write.js";
 import { WAITLIST_I18N } from "./i18n.js";
 import { adminAccess } from "./lib.js";
+import { WAITLIST_ADMIN_NOTICE_RECORD, WAITLIST_ADMIN_NOTICE_VARIABLES, WAITLIST_CONFIRMATION_VARIABLES, waitlistAdminNoticeTemplate, waitlistConfirmationTemplate, } from "./mail.js";
 import { waitlistListScreen } from "./screens.js";
 import { waitlistEntryDeleteHook, waitlistEntryExportHook } from "./user-data-hooks.js";
 export function createWaitlistFeature(opts = {}) {
@@ -16,6 +17,15 @@ export function createWaitlistFeature(opts = {}) {
         r.systemScope();
         r.requires("tenant", "auth-email-password", "user-data-rights");
         r.translations({ keys: WAITLIST_I18N });
+        r.notification("confirmation", {
+            variables: WAITLIST_CONFIRMATION_VARIABLES,
+            localizedTemplate: waitlistConfirmationTemplate,
+        });
+        r.notification("admin-notice", {
+            variables: WAITLIST_ADMIN_NOTICE_VARIABLES,
+            record: WAITLIST_ADMIN_NOTICE_RECORD,
+            localizedTemplate: waitlistAdminNoticeTemplate,
+        });
         r.entity("waitlistEntry", waitlistEntryEntity);
         r.writeHandler(createSubmitHandler(opts));
         r.writeHandler(createInviteHandler(opts.invite));

package/dist/waitlist/handlers/submit.write.js

@@ -4,7 +4,7 @@ import { InternalError } from "@cosmicdrift/kumiko-framework/errors";
 import { Temporal } from "@cosmicdrift/kumiko-types/temporal";
 import { WAITLIST_NOTIFICATION_TYPES, WAITLIST_STATUS } from "../constants.js";
 import { normalizeEmail, platformActor, waitlistDb, waitlistExecutor } from "../lib.js";
-import { renderWaitlistAdminNoticeEmail, renderWaitlistConfirmationEmail, resolveWaitlistAdminMailLocale, resolveWaitlistMailLocale, } from "../mail.js";
+import { resolveWaitlistAdminMailLocale, resolveWaitlistMailLocale, waitlistAdminNoticeVariables, waitlistConfirmationVariables, } from "../mail.js";
 import { DEFAULT_SUBMIT_EMAIL_RATE_LIMITS, DEFAULT_SUBMIT_RATE_LIMIT, } from "../options.js";
 import { WaitlistSubmitSchema } from "../payloads.js";
 // pg_advisory_xact_lock namespace (int4): 'wlst' as ASCII, disjoint from the
@@ -81,7 +81,7 @@ export function createSubmitHandler(opts) {
                 return created;
             await sendBestEffort(ctx, "confirmation", (notify) => notify(WAITLIST_NOTIFICATION_TYPES.confirmation, {
                 route: { email },
-                data: renderWaitlistConfirmationEmail({
+                data: waitlistConfirmationVariables({
                     locale: payload.locale,
                     appName: opts.appName,
                 }),
@@ -95,12 +95,11 @@ export function createSubmitHandler(opts) {
                     return;
                 await notify(WAITLIST_NOTIFICATION_TYPES.adminNotice, {
                     route: { email: adminRecipient },
-                    data: renderWaitlistAdminNoticeEmail({
+                    data: waitlistAdminNoticeVariables({
                         name: payload.name,
                         email,
                         company: payload.company,
                         message: payload.message,
-                        adminLocale: ctx.locale,
                     }),
                     priority: "normal",
                     locale: resolveWaitlistAdminMailLocale(ctx.locale),

package/dist/waitlist/mail.d.ts

@@ -1,15 +1,28 @@
-import type { AuthMailContent } from "../auth-email-password/index.js";
+import { type NotificationLocalizedTemplate, type NotificationRecordMapping, type TemplateVariables } from "@cosmicdrift/kumiko-framework/engine";
 export type WaitlistMailLocale = "en" | "de" | "es";
 export declare function resolveWaitlistMailLocale(locale: string | undefined): WaitlistMailLocale;
-export declare function renderWaitlistConfirmationEmail(args: {
+export declare const WAITLIST_CONFIRMATION_VARIABLES: TemplateVariables;
+export declare const WAITLIST_ADMIN_NOTICE_RECORD: NotificationRecordMapping;
+export declare const WAITLIST_ADMIN_NOTICE_VARIABLES: TemplateVariables;
+export declare function waitlistConfirmationVariables(args: {
     readonly locale: string | undefined;
     readonly appName?: string | undefined;
-}): AuthMailContent;
+}): {
+    readonly subject: string;
+    readonly intro: string;
+    readonly footer: string;
+};
+export declare function waitlistConfirmationTemplate(): NotificationLocalizedTemplate;
 export declare function resolveWaitlistAdminMailLocale(adminLocale: string | undefined): "en" | "de";
-export declare function renderWaitlistAdminNoticeEmail(args: {
+export declare function waitlistAdminNoticeVariables(args: {
     readonly name: string;
     readonly email: string;
     readonly company: string | undefined;
     readonly message: string | undefined;
-    readonly adminLocale: string | undefined;
-}): AuthMailContent;
+}): {
+    readonly name: string;
+    readonly details: readonly {
+        readonly text: string;
+    }[];
+};
+export declare function waitlistAdminNoticeTemplate(): NotificationLocalizedTemplate;

package/dist/waitlist/mail.js

@@ -1,3 +1,5 @@
+import { templateVariable, } from "@cosmicdrift/kumiko-framework/engine";
+import { mailHeading, mailParagraph, mailRepeatedRows } from "../shared/index.js";
 const CONFIRMATION_STRINGS = {
     en: {
         subject: (app) => (app ? `You're on the ${app} waitlist` : "You're on the waitlist"),
@@ -42,32 +44,66 @@ export function resolveWaitlistMailLocale(locale) {
     const language = languageOf(locale);
     return isConfirmationLocale(language) ? language : "en";
 }
+export const WAITLIST_CONFIRMATION_VARIABLES = {
+    subject: templateVariable.text({ required: true }),
+    intro: templateVariable.text({ required: true }),
+    footer: templateVariable.text({ required: true }),
+};
+// Only `name` is a plain entry field; the details rows are composed from several fields.
+export const WAITLIST_ADMIN_NOTICE_RECORD = {
+    entity: "waitlistEntry",
+    map: { name: "name" },
+};
+export const WAITLIST_ADMIN_NOTICE_VARIABLES = {
+    name: templateVariable.text({ required: true }),
+    details: templateVariable.list({ text: templateVariable.text({ required: true }) }, { required: true }),
+};
+// The app name is optional, so the sentences that mention it are computed in
+// code and handed over as variables; the template keeps heading and structure.
 // The submitter's name stays out: the address is unverified, so any text in
 // this mail could be planted by whoever typed someone else's email.
-export function renderWaitlistConfirmationEmail(args) {
+export function waitlistConfirmationVariables(args) {
     const t = CONFIRMATION_STRINGS[resolveWaitlistMailLocale(args.locale)];
     return {
         subject: t.subject(args.appName),
-        header: t.header,
-        sections: [{ text: t.intro(args.appName) }],
+        intro: t.intro(args.appName),
         footer: t.footer(args.appName),
     };
 }
+export function waitlistConfirmationTemplate() {
+    return Object.fromEntries(Object.entries(CONFIRMATION_STRINGS).map(([locale, t]) => [
+        locale,
+        {
+            body: [mailHeading(t.header), mailParagraph("{intro}"), mailParagraph("{footer}")].join(""),
+            meta: { subject: "{{subject}}", category: "transactional" },
+        },
+    ]));
+}
 // Operator-facing, so the entrant's locale does not apply: en/de, en default.
 export function resolveWaitlistAdminMailLocale(adminLocale) {
     return languageOf(adminLocale) === "de" ? "de" : "en";
 }
-export function renderWaitlistAdminNoticeEmail(args) {
-    const t = ADMIN_NOTICE_STRINGS[resolveWaitlistAdminMailLocale(args.adminLocale)];
-    const details = [
-        `${args.name} <${args.email}>`,
-        ...(args.company ? [args.company] : []),
-        ...(args.message ? [args.message] : []),
-    ];
+export function waitlistAdminNoticeVariables(args) {
     return {
-        subject: t.subject(args.name),
-        header: t.header,
-        sections: [{ text: t.intro }, { text: details.join("\n") }],
-        footer: t.footer,
+        name: args.name,
+        details: [
+            `${args.name} <${args.email}>`,
+            ...(args.company ? [args.company] : []),
+            ...(args.message ? [args.message] : []),
+        ].map((text) => ({ text })),
     };
 }
+export function waitlistAdminNoticeTemplate() {
+    return Object.fromEntries(Object.entries(ADMIN_NOTICE_STRINGS).map(([locale, t]) => [
+        locale,
+        {
+            body: [
+                mailHeading(t.header),
+                mailParagraph(t.intro),
+                mailRepeatedRows("details", "text"),
+                mailParagraph(t.footer),
+            ].join(""),
+            meta: { subject: t.subject("{{name}}"), category: "transactional" },
+        },
+    ]));
+}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@cosmicdrift/kumiko-bundled-features",
-  "version": "0.362.0",
+  "version": "0.363.0",
   "description": "Built-in features — tenant, user, auth, delivery. The stuff you'd rewrite anyway, already typed.",
   "license": "BUSL-1.1",
   "author": "Marc Frost <marc@cosmicdriftgamestudio.com>",
@@ -394,10 +394,6 @@
       "types": "./dist/channel-telegram/index.d.ts",
       "default": "./dist/channel-telegram/index.js"
     },
-    "./renderer-simple": {
-      "types": "./dist/renderer-simple/index.d.ts",
-      "default": "./dist/renderer-simple/index.js"
-    },
     "./renderer-pdf": {
       "types": "./dist/renderer-pdf/index.d.ts",
       "default": "./dist/renderer-pdf/index.js"
@@ -458,6 +454,10 @@
       "types": "./dist/template-resolver/index.d.ts",
       "default": "./dist/template-resolver/index.js"
     },
+    "./template-resolver/document-schema": {
+      "types": "./dist/template-resolver/document-schema.d.ts",
+      "default": "./dist/template-resolver/document-schema.js"
+    },
     "./template-resolver/seeding": {
       "types": "./dist/template-resolver/seeding.d.ts",
       "default": "./dist/template-resolver/seeding.js"
@@ -520,17 +520,27 @@
     }
   },
   "dependencies": {
-    "@cosmicdrift/kumiko-dispatcher-live": "0.362.0",
-    "@cosmicdrift/kumiko-framework": "0.362.0",
-    "@cosmicdrift/kumiko-headless": "0.362.0",
-    "@cosmicdrift/kumiko-renderer": "0.362.0",
-    "@cosmicdrift/kumiko-renderer-web": "0.362.0",
-    "@cosmicdrift/kumiko-types": "0.362.0",
+    "@cosmicdrift/kumiko-dispatcher-live": "0.363.0",
+    "@cosmicdrift/kumiko-framework": "0.363.0",
+    "@cosmicdrift/kumiko-headless": "0.363.0",
+    "@cosmicdrift/kumiko-renderer": "0.363.0",
+    "@cosmicdrift/kumiko-renderer-web": "0.363.0",
+    "@cosmicdrift/kumiko-types": "0.363.0",
     "@mollie/api-client": "^4.5.0",
     "@node-rs/argon2": "^2.0.2",
+    "@tiptap/core": "3.31.3",
+    "@tiptap/extension-link": "3.31.3",
+    "@tiptap/extension-list": "3.31.3",
+    "@tiptap/extension-table": "3.31.3",
+    "@tiptap/html": "3.31.3",
+    "@tiptap/extensions": "3.31.3",
+    "@tiptap/pm": "3.31.3",
+    "@tiptap/react": "3.31.3",
+    "@tiptap/starter-kit": "3.31.3",
     "@types/mailparser": "^3.4.6",
     "@types/qrcode": "^1.5.5",
     "clsx": "^2.1.1",
+    "happy-dom": "^20.11.2",
     "hono": "^4.13.1",
     "imapflow": "^1.7.8",
     "ioredis": "^5.10.1",
@@ -925,10 +935,6 @@
         "types": "./dist/channel-telegram/index.d.ts",
         "default": "./dist/channel-telegram/index.js"
       },
-      "./renderer-simple": {
-        "types": "./dist/renderer-simple/index.d.ts",
-        "default": "./dist/renderer-simple/index.js"
-      },
       "./renderer-pdf": {
         "types": "./dist/renderer-pdf/index.d.ts",
         "default": "./dist/renderer-pdf/index.js"
@@ -989,6 +995,10 @@
         "types": "./dist/template-resolver/index.d.ts",
         "default": "./dist/template-resolver/index.js"
       },
+      "./template-resolver/document-schema": {
+        "types": "./dist/template-resolver/document-schema.d.ts",
+        "default": "./dist/template-resolver/document-schema.js"
+      },
       "./template-resolver/seeding": {
         "types": "./dist/template-resolver/seeding.d.ts",
         "default": "./dist/template-resolver/seeding.js"
@@ -1059,8 +1069,9 @@
   ],
   "devDependencies": {
     "@testing-library/user-event": "^14.6.1",
-    "@cosmicdrift/kumiko-locale-de": "0.362.0",
-    "@cosmicdrift/kumiko-locale-es": "0.362.0",
+    "@cosmicdrift/kumiko-locale-de": "0.363.0",
+    "@cosmicdrift/kumiko-locale-es": "0.363.0",
+    "@cosmicdrift/kumiko-renderer-mail-html": "0.363.0",
     "jsqr": "^1.4.0",
     "unpdf": "^1.8.1"
   }

package/src/admin-shell/changes.json

@@ -1,4 +1,10 @@
 [
+  {
+    "version": "0.363.0",
+    "type": "improvement",
+    "title": "includeDocumentDesigner lists the template navs in the admin workspaces",
+    "detail": "With includeDocumentDesigner, the tenant workspace shows document-designer:nav:templates and the platform workspace document-designer:nav:platform-templates. The option requires the document-designer feature and defaults to false."
+  },
   {
     "version": "0.330.0",
     "type": "breaking",

package/src/auth-email-password/changes.json

@@ -1,4 +1,18 @@
 [
+  {
+    "version": "0.363.0",
+    "type": "breaking",
+    "title": "AuthMailContent is removed",
+    "detail": "The sections-based content type only fed the retired renderer-simple. Auth mails are template notifications with variables, so nothing builds or consumes AuthMailContent anymore.",
+    "migration": "Drop AuthMailContent imports; the auth mail text lives in the seeded templates and is overridden per tenant in the template editor."
+  },
+  {
+    "version": "0.363.0",
+    "type": "breaking",
+    "title": "Auth mails are notifications with seeded templates, render*Email is gone",
+    "detail": "password-reset, account-unlock, email-verification, signup-activation and invite are declared as r.notification with a localized template and variables, seeded as system templates at boot and rendered by renderer-mail-html, so a tenant can override the text in the template editor. A locale without its own subject key falls back to en, because the renderer has no locale fallback. AuthMailNotificationTypes is exported for the qualified names.",
+    "migration": "The notification types are now `auth-email-password:notify:<name>` (before: the plain names). Update delivery preferences, preference rows and tests that reference the old names. renderResetPasswordEmail, renderUnlockAccountEmail, renderVerifyEmail, renderActivationEmail, renderInviteEmail, AuthMailSection, RenderTokenContentArgs and RenderInviteEmailArgs are removed; AuthMailContent stays. An app that mounts auth-email-password now needs template-resolver, renderer-foundation and @cosmicdrift/kumiko-renderer-mail-html (composeRendererStack() from dev-server mounts all of them; with includeBundled, composeFeatures adds whichever is missing). Boot fails with a clear error otherwise, and apps without the template tables need a schema migration (`kumiko schema generate`). kumiko-schema-check counts the three as implicit features of every HAS_AUTH app, so its check fails until that migration exists. Tests that read the token from a mail use the text part (`mail.text`); the html part encodes `=` as `&#x3D;`."
+  },
   {
     "version": "0.354.0",
     "type": "breaking",

package/src/billing-foundation/changes.json

@@ -1,4 +1,11 @@
 [
+  {
+    "version": "0.363.0",
+    "type": "breaking",
+    "title": "Contract confirmation and termination mails use template variables",
+    "detail": "contract-confirmation, contract-termination-receipt and contract-termination-operator-notice are r.notification declarations with variables and localized templates (de, en). The notification types are qualified names now (billing-foundation:notify:<name>). The notify data is the template variable object (subject, details, contractLines, termsParagraphs, operatorEmail), not sections.",
+    "migration": "Update delivery preferences and tests that referenced the old type strings, and anything that listens to the notification data. An app that mounts it without includeBundled needs template-resolver, renderer-foundation and @cosmicdrift/kumiko-renderer-mail-html at boot (composeRendererStack() from dev-server mounts all of them), plus a delivery with the channel-email feature; apps without the template tables need a schema migration (`kumiko schema generate`)."
+  },
   {
     "version": "0.354.0",
     "type": "breaking",

package/src/channel-email/changes.json

@@ -1,4 +1,23 @@
 [
+  {
+    "version": "0.363.0",
+    "type": "breaking",
+    "title": "A notification without a mail template fails on the email channel",
+    "detail": "The renderer option of createChannelEmailFeature is removed. A notification routed to the email channel without template + meta fails its delivery permanently with \"has no mail template, declare template + meta on r.notification\". r.notification declares no channels, so this is not checked at boot; an app's own mail tests over the inmemory transport catch it.",
+    "migration": "Drop the renderer option. Declare template + meta (or localizedTemplate) and variables on every r.notification that reaches the email channel, or accept that its email delivery fails. Run the app's notification tests after the bump: every email notification without a template now fails there."
+  },
+  {
+    "version": "0.363.0",
+    "type": "improvement",
+    "title": "Email channel sends rendered-pdf attachments",
+    "detail": "The channel resolves rendered-pdf entries from notify data next to file entries; without a locale the message locale is used. A render failure fails the send job, so the retry runs it again."
+  },
+  {
+    "version": "0.363.0",
+    "type": "improvement",
+    "title": "Email channel sends file attachments and inline cid images",
+    "detail": "EmailMessage.attachments is sent through the SMTP transport (inline images with Content-ID). notify data.attachments with kind file entries are resolved through the file store; the PII guard rejects ciphertext file names."
+  },
   {
     "version": "0.350.0",
     "type": "improvement",

package/src/data-retention/changes.json

@@ -1,4 +1,10 @@
 [
+  {
+    "version": "0.363.0",
+    "type": "improvement",
+    "title": "data-retention exports computeCutoff",
+    "detail": "computeCutoff(keepFor, now) and its Instant type are exported from @cosmicdrift/kumiko-bundled-features/data-retention, so apps that compute a retention cutoff themselves (for example a backfill) use the same keepFor parsing as the cleanup job instead of a copy."
+  },
   {
     "version": "0.335.0",
     "type": "fix",

package/src/delivery/changes.json

@@ -1,4 +1,52 @@
 [
+  {
+    "version": "0.363.0",
+    "type": "breaking",
+    "title": "NotificationRenderer and RendererInput removed, immediate notify renders with the tenant config",
+    "detail": "The inline (immediate, job-less) delivery path now gets the tenant config accessor like the delivery.render job, so the mail layout shows the tenant name in both paths. DeliveryServiceOptions and CreateDeliveryTestContextOptions accept tenantConfigFor; runProdApp wires it from the boot config resolver. The types NotificationRenderer and RendererInput are removed from the delivery exports because the legacy renderer path is gone.",
+    "migration": "Drop NotificationRenderer and RendererInput imports; render mails with template + meta on r.notification (see renderer-foundation)."
+  },
+  {
+    "version": "0.363.0",
+    "type": "improvement",
+    "title": "ChannelContext.renderMail renders template notifications for the email channel",
+    "detail": "A notification that declares a template is rendered through the mail renderer plugin with the recipient locale and the notification variables; the email channel fails when renderMail is missing instead of falling back to the legacy renderer. The job path passes the tenant config accessor to the renderer, the inline path renders without one."
+  },
+  {
+    "version": "0.363.0",
+    "type": "improvement",
+    "title": "Mails can attach a PDF that is rendered from a document template when the mail is sent",
+    "detail": "notify data.attachments accepts { kind: \"rendered-pdf\", templateSlug, variables, fileName, locale? }. The send job renders the PDF through the document-pdf renderer, so the job payload carries the variables (at most 64000 bytes as JSON), not the bytes. Variables are stored in the job payload, so keep personal data out of them or accept that retention."
+  },
+  {
+    "version": "0.363.0",
+    "type": "improvement",
+    "title": "ChannelContext.readAttachment takes an attachment origin",
+    "detail": "readAttachment(ref, origin) with origin \"template\" (from the renderer) or \"message\" (default, from notify data). Only template attachments may fall back to the system tenant; file refs from notify data stay limited to the sending tenant."
+  },
+  {
+    "version": "0.363.0",
+    "type": "improvement",
+    "title": "EMAIL_CHANNEL_NAME, createTemplateMailRenderer and createEmailAttachmentReader are exported",
+    "detail": "The email channel name is a shared constant instead of a string literal. The mail renderer and the inline-attachment reader that build the channel context are exported and accept a tenant-bound db, so a handler can send through the same path as a notification."
+  },
+  {
+    "version": "0.363.0",
+    "type": "improvement",
+    "title": "Notification messages carry attachments (file refs and inline cid images)",
+    "detail": "RenderedMessage and the send job payload accept attachments as references (kind file or inline), never bytes. ChannelContext.readAttachment resolves them tenant-scoped at send time; createDeliveryService takes a new filesForTenant option for the inline fallback path."
+  },
+  {
+    "version": "0.363.0",
+    "type": "improvement",
+    "title": "NotifyFactory takes an optional fileProviderResolver, so immediate and bootstrap mails can read attachments too"
+  },
+  {
+    "version": "0.363.0",
+    "type": "fix",
+    "title": "Queued mails render with the tenant's config again",
+    "detail": "The delivery render and send jobs read the tenant config through ctx.configFor, which job contexts do not carry, so queued mails rendered without tenant name, locale, currency and branding. Both jobs now use ctx.config, which the job runner builds for the payload's tenant."
+  },
   {
     "version": "0.357.0",
     "type": "improvement",

package/src/managed-pages/changes.json

@@ -1,4 +1,10 @@
 [
+  {
+    "version": "0.363.0",
+    "type": "improvement",
+    "title": "Branding screen edits the logo file and readBranding returns logoFile",
+    "detail": "The branding settings screen has a logo upload for managed-pages:config:branding-logo-file, and readBranding and the branding query include logoFile next to logoUrl. The template resource errors template_resource_too_large and template_resource_unsupported_image have German and Spanish texts."
+  },
   {
     "version": "0.353.0",
     "type": "fix",

package/src/renderer-foundation/changes.json

@@ -1,4 +1,43 @@
 [
+  {
+    "version": "0.363.0",
+    "type": "breaking",
+    "title": "document-pdf requests name a template, the response carries fileName",
+    "detail": "The document-pdf payload is { slug, locale, variables } instead of ready HTML in content. The response has a fileName, RendererContext gets an optional filesForTenant (file access per tenant) and RendererError has the new code unavailable for a renderer backend that cannot be reached.",
+    "migration": "Callers that sent `payload: { content }` switch to a document-pdf template and pass slug, locale and variables (money-horse credit-schedule-pdf follows in #621); renderer-pdf callers pass slug and locale too. The enterprise package @cosmicdriftgamestudio/kumiko-renderer-puppeteer-client no longer builds against these types and is replaced by @cosmicdrift/kumiko-renderer-puppeteer-client."
+  },
+  {
+    "version": "0.363.0",
+    "type": "improvement",
+    "title": "renderer plugins can preview a document",
+    "detail": "RendererPlugin gets the optional capability previewDocument(req, ctx), which returns the filled-in body and layout regions without calling the print service. template-resolver:query:preview with kind document-pdf uses it, so the editor shows replaced placeholders and the resource and required-placeholder checks; without such a plugin the preview keeps returning the body and raw layout."
+  },
+  {
+    "version": "0.363.0",
+    "type": "improvement",
+    "title": "PdfOptions has landscape",
+    "detail": "The document-pdf options gain landscape, which the puppeteer-service passes to Chromium."
+  },
+  {
+    "version": "0.363.0",
+    "type": "breaking",
+    "title": "RenderRequest kind mail replaces mail-html",
+    "detail": "RenderRequest and RenderResponse use kind mail with a MailPayload ({ slug, locale, variables, unsubscribeUrl? }) and a response of { subject, html, text, previewText? }. The export MailHtmlPayload is removed; use MailPayload. The default plugin name for kind mail stays mail-html. RendererContext gains an optional config accessor that plugins use for tenant locale, currency and branding.",
+    "migration": "Replace kind mail-html with mail in createRendererForTenant and render calls, pass { slug, locale, variables } instead of content/contentFormat, and read the subject from the response instead of building it yourself. Pass ctx.config in the RendererContext to get tenant locale, currency and branding."
+  },
+  {
+    "version": "0.363.0",
+    "type": "breaking",
+    "title": "renderer-simple, MailBranding and renderer kind \"notification\" are removed",
+    "detail": "Every mail is a stored template rendered by renderer-mail-html now. renderer-simple (createRendererSimpleFeature, simpleRenderer, createSimpleRenderer, RendererSimpleOptions, mail blocks with LocalizedText, MailBadge, MailChip, MailStage, MailStageState and MailTone), the MailBranding type, the renderer kind \"notification\" and AuthMailContent are gone. NotificationRenderer and RendererInput are removed from delivery, and createChannelEmailFeature no longer takes a renderer option. The type NotificationPayload is removed from renderer-foundation. The template-resolver keeps \"notification\" only as a stored kind so legacy rows stay readable; RENDER_KINDS is mail, document-pdf and image-snapshot.",
+    "migration": "Remove createRendererSimpleFeature() and any renderer or mailBranding option from your feature list and createChannelEmailFeature call. An r.notification that is sent by email needs template + meta (or localizedTemplate) and variables; the sections/header/footer data it carried is replaced by template variables. Branding (logo, footer) now comes from the tenant branding config and the mail layout of renderer-mail-html. Mount template-resolver, renderer-foundation and @cosmicdrift/kumiko-renderer-mail-html (composeRendererStack() mounts all of them) and run seedNotificationTemplates at boot. Existing template rows with kind \"notification\" are no longer rendered; re-create them as kind \"mail\" or archive them."
+  },
+  {
+    "version": "0.363.0",
+    "type": "improvement",
+    "title": "MailPayload.draft renders an unsaved mail template; RendererContext.db also accepts a TenantDb",
+    "detail": "MailDraft (content, meta, variableSchema) replaces the stored body and subject of the template with the payload's slug and keeps its stored images; a slug without a stored template renders as a tenant draft. The renderer sanitizes the draft body and validates its meta again, and the response carries no template provenance. RendererContext.db is widened from DbConnection to DbRunner | TenantDb."
+  },
   {
     "version": "0.306.0",
     "type": "breaking",

package/src/template-resolver/changes.json

@@ -1,4 +1,122 @@
 [
+  {
+    "version": "0.363.0",
+    "type": "improvement",
+    "title": "Overview and layout-source queries for the template designer",
+    "detail": "template-resolver:query:overview lists the mail, PDF and layout templates of the caller's tenant grouped by slug and kind (effective origin, locales, status, versions, layout slug, last change and the notifications that use it) and template-resolver:query:layout-source returns the header, signature and footer regions of a mail or PDF layout plus the locale a save has to use; a SystemAdmin also receives the MJML source of the system layout. The usage lookup is the exported collectTemplateUsage."
+  },
+  {
+    "version": "0.363.0",
+    "type": "improvement",
+    "title": "contentFormat \"document\" with a toolbar editor for mail and PDF templates",
+    "detail": "ContentEditorFormat gains \"document\". template-resolver registers DocumentContentEditor for it (tiptap, lazy-loaded) and stores the body as html. The toolbar offers paragraph style, bold, italic, lists, links, placeholders and the blocks image, table, button, divider, repeat and page break; the blocks prop picks them (MAIL_DOCUMENT_BLOCKS, PDF_DOCUMENT_BLOCKS). Placeholders are inserted only as variable nodes (data-variable), never as {{name}} text. ContentPreview does not substitute example values for \"document\" content, because substituting a button or link href would make the schema drop that node. New exports from template-resolver/web: DocumentContentEditor, DocumentEditorProps, DocumentToolbarBlock, MAIL_DOCUMENT_BLOCKS, PDF_DOCUMENT_BLOCKS."
+  },
+  {
+    "version": "0.363.0",
+    "type": "fix",
+    "title": "Preview uses the examples of a stored or draft variable schema",
+    "detail": "A template's variableSchema kept only type and required, label and example were dropped, so the preview showed [name] instead of the declared example. The schema now keeps label and example, for mail and document previews."
+  },
+  {
+    "version": "0.363.0",
+    "type": "improvement",
+    "title": "PDF meta gets orientation, printBackground and layoutHeaderFooter; paragraphs and headings get data-align",
+    "detail": "The document-pdf meta accepts orientation (portrait or landscape), printBackground (default true) and layoutHeaderFooter (false prints without the layout header and footer). Paragraphs and headings carry textAlign (left, center, right, justify), serialized as data-align and kept by the sanitizer only with these four values. New exports are evaluateDocumentDraft, localeSchema, DOCUMENT_TEXT_ALIGNMENTS and DocumentTextAlign; compileDocumentBodyToHandlebars accepts alignmentAsInlineStyle."
+  },
+  {
+    "version": "0.363.0",
+    "type": "breaking",
+    "title": "document-pdf templates require contentFormat html, and html bodies are sanitized on write",
+    "detail": "upsertSystem, upsertTenant, the collection-set handlers and seedSystemTemplate rebuild html bodies of kind mail-html and document-pdf through the new document schema (template-resolver/document-schema). Script elements, inline event handlers, embedded content (iframe, frame, object, embed, applet, portal), links and url attributes (svg href, xlink:href, form action, base) outside https/http/mailto/tel/{{placeholder}}, external image sources, alt text containing < or >, and invalid or prototype-chain variable names are rejected with a validation_error (or a thrown Error in seedSystemTemplate); anything the schema cannot express is dropped silently, and links keep only href (no target, rel, class or title). New exports: documentExtensions, DocumentLink and the other Document* nodes, isAllowedDocumentLinkHref, isDocumentReferenceName, isDocumentResourceKey, isDocumentPlaceholderHref, sanitizeDocumentHtml, sanitizeTemplateBody. kind document-pdf with another contentFormat is rejected with document_requires_html_format.",
+    "migration": "Store document-pdf bodies as html and reference images via data-resource instead of src. mail-html with markdown or mjml is unchanged."
+  },
+  {
+    "version": "0.363.0",
+    "type": "improvement",
+    "title": "Mail templates carry file attachments (PDF, PNG, JPEG)",
+    "detail": "linkedResources stays image only; file attachments of a mail template are listed in the optional TemplateResource.fileAttachments (kind file, fileRefId, fileName), sorted by key. template-resolver:write:resource-upload takes purpose \"attachment\" with a fileName; it checks the file by content (PDF, PNG, JPEG), keeps the original bytes, allows at most 10 per mail template and stores the entry next to the inline images. resource-remove, copy-locale and the bundle export/import carry attachments (bundle resource entries get purpose \"attachment\"). The preview lists attachments with kind \"inline\" or \"file\" (PreviewAttachment is now a union), send-test sends them, and the mail renderer attaches them after the inline images within the delivery attachment limit."
+  },
+  {
+    "version": "0.363.0",
+    "type": "improvement",
+    "title": "copy-locale can copy system templates (scope \"system\", system admins only)",
+    "detail": "template-resolver:write:copy-locale takes scope \"tenant\" (default) or \"system\". With \"system\" a system admin copies a system template to another locale as a draft; other callers get access denied."
+  },
+  {
+    "version": "0.363.0",
+    "type": "improvement",
+    "title": "Mail preview returns displayHtml for the editor",
+    "detail": "The preview of a mail template carries displayHtml, the body with cid images replaced by data URIs (png, jpeg, gif, webp, 5 MiB budget in total) so an editor can show it without cid support. The sent mail is unchanged."
+  },
+  {
+    "version": "0.363.0",
+    "type": "improvement",
+    "title": "Document editor gets variable labels, a handle, resource previews, canvas chrome, underline and PlaceholderLineEditor",
+    "detail": "DocumentContentEditor accepts variableLabels, systemVariables, resourcePreviews, chrome (\"default\" or \"canvas\") and onEditorReady (handle with insertPlaceholder, insertResource, focus). The new PlaceholderLineEditor edits plain text with {{name}} placeholders as chips on one line. Underline (u) is part of the document schema and survives the sanitizer."
+  },
+  {
+    "version": "0.363.0",
+    "type": "improvement",
+    "title": "Mail templates link a PDF rendered from a document template (resource-link-pdf)",
+    "detail": "New write template-resolver:write:resource-link-pdf takes templateId, key, templateSlug and fileName and stores a linkedResources entry { kind \"rendered-pdf\", templateSlug, fileName } in a mail template; nothing is uploaded. fileName is a one-line pattern that may use the mail's {{placeholders}} and must end with .pdf (no / \\ \" ; or ..). The document-pdf template must exist for the tenant or the system, otherwise the write fails with template_attachment_pdf_template_missing; an invalid pattern or slug fails with template_attachment_invalid. Uploaded files and linked PDFs share the limit of 10 attachments per template. resource-remove, copy-locale and the bundle export/import carry the entry (the bundle gets an optional pdfAttachments map of key to { templateSlug, fileName }; import does not check that the document template exists). TemplateResource gains pdfAttachmentLinks, LinkedResourceEntry gains the TemplatePdfAttachmentLink variant."
+  },
+  {
+    "version": "0.363.0",
+    "type": "improvement",
+    "title": "Preview and test mail use the images and attachments of the edited row, also while it is a draft",
+    "detail": "When preview or send-test get content and the caller has a row for (slug, kind, locale), that row supplies linkedResources whatever its status (also when it has none, so nothing is borrowed from the system template), so a tenant whose customization is saved as a draft sees its logo and attachments. MailDraft has an optional linkedResources; without it the stored active template's resources are used as before. PreviewAttachment gains the variant { kind \"rendered-pdf\", name, templateSlug } without sizeBytes, because the PDF is not rendered in the preview; size_under_cap does not count it."
+  },
+  {
+    "version": "0.363.0",
+    "type": "improvement",
+    "title": "Preview query and send-test write for mail and PDF templates",
+    "detail": "template-resolver:query:preview renders a draft, or the stored template when no content is given, with sample values from the declared variable examples (list variables get two rows). The draft passes the same write gates as a save and a mail goes through the real mail renderer, so subject, html, plain text and inline images match a real send. The response carries checks (images resolved, plain text present, size under 10 MiB, required placeholders used); a PDF template returns its sanitized body and the layout regions. template-resolver:write:send-test mails the rendered mail to the calling user's own address only, subject prefixed with [TEST], limited to 10 per user and hour. It needs delivery, channel-email and renderer-mail-html."
+  },
+  {
+    "version": "0.363.0",
+    "type": "improvement",
+    "title": "DocumentEditorProps toolbar option for an icon-only toolbar",
+    "detail": "DocumentEditorProps gains toolbar (\"full\" or \"compact\", default \"full\"). Compact renders the placeholder and block buttons icon-only with a tooltip and a narrower paragraph select, for narrow columns such as the layout editor regions. The formatting buttons now carry a tooltip with their label in every mode."
+  },
+  {
+    "version": "0.363.0",
+    "type": "breaking",
+    "title": "kind mail-html is replaced by mail, mail-layout and pdf-layout; templates carry meta",
+    "detail": "The kind mail-html is removed; the new non-render kind snippet holds collection content (reply snippets, signatures; any contentFormat, html is sanitized like a mail body). Mail bodies are kind mail (contentFormat html only, rebuilt through the document schema, meta.subject required), mail frames are kind mail-layout (contentFormat mjml), and pdf-layout (html) is new. The table gains a nullable meta column (JSON per kind, validated by parseTemplateMeta: mail takes subject, previewText, layoutSlug, category, sender; layouts take none; other kinds take no meta) and the template-resource entity moves to eventVersion 2 with an upcaster that reads stored mail-html events as mail. upsertSystem, upsertTenant (active), publish and seedSystemTemplate reject unknown placeholders and, for the same writes, bodies that miss a required variable of the notification with the same qualified name; a tenant draft may be incomplete and returns validation. Slugs must be kebab segments joined by a colon. seedSystemTemplate now validates the slug (templateSlugSchema) and the per-kind meta for every kind. A content collection of kind mail, mail-layout or pdf-layout is refused on collection-set (field issue on kind, templateResolver.errors.collection.kindNotAllowed), because such a tenant row would shadow the system template without the meta and placeholder gates. TemplateResource gains meta. New exports: parseTemplateMeta, isMailTemplateMeta, templateSlugSchema, validateTemplatePlaceholders, resolveTemplateVariables, compileDocumentBodyToHandlebars, MAIL_CATEGORIES and their types; seedNotificationTemplates and hasNotificationTemplates on template-resolver/seeding, which applyBootSeeds now calls. RENDER_KINDS contains mail instead of mail-html.",
+    "migration": "Rename kind mail-html to mail in app code, collections and seeds; mail bodies must be contentFormat html (markdown or mjml mail bodies are rejected) and carry meta.subject, mail layouts use kind mail-layout with contentFormat mjml and slug default. Slugs of every kind must now be kebab segments joined by a colon (upsert handlers and seedSystemTemplate reject dotted, underscored or camelCase slugs). Collections that used kind mail-html move to the new kind snippet (stored mail-html rows are upcast to mail, which collections refuse, so re-create those entries under snippet); collection-set refuses mail, mail-layout and pdf-layout collections. seedSystemTemplate callers must pass a kebab slug and valid meta for every kind, not only mail. Generate and apply the migration that adds the nullable meta column to read_template_resources; it ships a rebuild marker for read_template_resources so existing mail-html rows are read as mail after the rebuild."
+  },
+  {
+    "version": "0.363.0",
+    "type": "improvement",
+    "title": "resolveLayout finds a layout in any locale",
+    "detail": "TemplateResolverApi gains resolveLayout({ tenantId, slug, kind, locale }) for mail-layout and pdf-layout. It looks at the tenant first (requested locale, then the fallback locale, then any active locale) and then at the system layouts the same way, ignoring draft and archived rows. A layout saved by the layout editor under one locale is therefore found for every locale. The template preview uses it for the PDF layout."
+  },
+  {
+    "version": "0.363.0",
+    "type": "improvement",
+    "title": "PDF template meta, render provenance, system template lifecycle and override queries",
+    "detail": "kind document-pdf takes a strict meta (layoutSlug, pageFormat A4/Letter, margins in mm, fileName without / \\ \" ; or .., metadata title/author); new exports PDF_PAGE_FORMATS, PdfPageFormat, PdfTemplateMeta, readPdfTemplateMeta, DEFAULT_MAIL_LAYOUT_SLUG. RenderResponse (renderer-foundation) gains optional template and layout refs ({ templateId, templateVersion, scope }, new types RenderedTemplateRef and RenderProvenance); renderer-mail-html fills them. New handlers template-resolver:write:publish-system and archive-system (SystemAdmin), reset-to-system (TenantAdmin, SystemAdmin), queries usage, tenant-overrides (SystemAdmin, counts only) and diff-to-system. publish and archive answer not_found for rows outside the caller's tenant instead of a version_conflict; find-by-id also returns meta."
+  },
+  {
+    "version": "0.363.0",
+    "type": "breaking",
+    "title": "linkedResources is no longer a payload field of upsertSystem/upsertTenant; resourceUpload and resourceRemove manage it",
+    "detail": "Two steps - upload the image with POST /api/files (multipart, no entityType), then call template-resolver:write:resource-upload with { sourceFileRefId, templateId?, key? }. The handler re-encodes the caller's own unclaimed upload into a new file ref (width at most 1200 px) and links it into the template; resource-remove unlinks a key. upsertSystem and upsertTenant no longer accept linkedResources and leave the stored value untouched on update. The size cap is the system config key resource-max-bytes (default 2 MiB); a cap above the files route's maxUploadSize has no effect because the upload is rejected first. The source upload stays as an unclaimed file.",
+    "migration": "Whoever sent linkedResources with upsertSystem or upsertTenant now uploads the image via POST /api/files (multipart, no entityType) and links it with template-resolver:write:resource-upload { sourceFileRefId, templateId, key }. Server-side seeding (seedSystemTemplate linkedResources) stays."
+  },
+  {
+    "version": "0.363.0",
+    "type": "improvement",
+    "title": "Bundle import re-encodes its images like resource-upload; re-seeding keeps uploaded system resources",
+    "detail": "importBundle and importBundleSystem store each bundle resource through the same normalization as resource-upload (decoded format decides the content type, SVG and non-images are rejected, width at most 1200 px, resource-max-bytes applies), so an exported bundle carries the re-encoded bytes. seedSystemTemplate without linkedResources no longer resets the links of an existing row, so images a system admin uploaded survive the next boot. storeTemplateResource from the template-resolver barrel is the normalizing store; the raw byte variant is gone."
+  },
+  {
+    "version": "0.363.0",
+    "type": "breaking",
+    "title": "Tenant mail-layouts are structured html, pdf-layout and document-pdf are placeholder-validated",
+    "detail": "A new validate query dry-runs the write pipeline (used, unknown and missing placeholders, canSave, canPublish). document-pdf, pdf-layout and mail-layout now go through the same placeholder gate as mail; document-pdf and pdf-layout know the system placeholders page and pages. A tenant mail-layout is html with a data-content slot plus header, signature and footer regions that renderer-mail-html wraps in a fixed MJML frame; raw mjml (with {{{content}}} exactly once) is system-only. New handlers export-bundle, import-bundle, import-bundle-system and copy-locale move a template with its resource files between tenants and locales. r.notification accepts a record mapping from an entity row to the declared variables, validated at boot. publish and archive no longer touch system rows through a tenant-scoped SystemAdmin.",
+    "migration": "Tenant mail-layout rows stored as mjml are ignored by the renderer, which falls back to the system layout; re-create them as html with a data-content slot. upsert-system answers with an extra validation field. seedSystemTemplate errors now read `<label> rejected: <code> (<detail>); ...`. Layout bodies without the content slot are rejected on write. `set` now runs the same gate for mail, document-pdf, pdf-layout and mail-layout rows and rejects unsanitized markup or publish issues, since saving publishes; the mail renderer also re-sanitizes stored tenant html layouts and falls back to the system layout when they fail. upsert-system and upsert-tenant no longer accept linkedResources (resources go through the resource upload; bundle import and copy-locale attach them). Unknown data-resource keys are a validate warning (resource_not_uploaded), not a write error."
+  },
   {
     "version": "0.354.0",
     "type": "fix",