@cosmicdrift/kumiko-bundled-features 0.363.0 → 0.365.0

package/dist/channel-slack/slack-channel.js

@@ -1,7 +1,8 @@
 import { chatMessageText, createChatWebhookChannel, } from "../delivery/index.js";
+const SLACK_WEBHOOK_PREFIX = "channel-slack:webhooks.";
 export const SLACK_SECRET_KEYS = {
-    webhookPrefix: "channel-slack:webhooks.",
-    webhookKeyFor: (connection) => `channel-slack:webhooks.${connection}`,
+    webhookPrefix: SLACK_WEBHOOK_PREFIX,
+    webhookKeyFor: (connection) => `${SLACK_WEBHOOK_PREFIX}${connection}`,
 };
 export const SLACK_DEFAULT_ALLOWED_HOSTS = ["hooks.slack.com"];
 // Slack mrkdwn treats & < > as control characters (links, @-mentions via <!channel>).

package/dist/channel-teams/teams-channel.js

@@ -1,7 +1,8 @@
 import { createChatWebhookChannel, } from "../delivery/index.js";
+const TEAMS_WEBHOOK_PREFIX = "channel-teams:webhooks.";
 export const TEAMS_SECRET_KEYS = {
-    webhookPrefix: "channel-teams:webhooks.",
-    webhookKeyFor: (connection) => `channel-teams:webhooks.${connection}`,
+    webhookPrefix: TEAMS_WEBHOOK_PREFIX,
+    webhookKeyFor: (connection) => `${TEAMS_WEBHOOK_PREFIX}${connection}`,
 };
 export const TEAMS_DEFAULT_ALLOWED_HOSTS = [
     ".webhook.office.com",

package/dist/compliance-profiles/handlers/set-profile.write.d.ts

@@ -10,4 +10,4 @@ export declare const setProfileWrite: import("@cosmicdrift/kumiko-types/define-h
 }, z.core.$strip>, {
     profileKey: "de-hr-dsgvo-hgb" | "eu-dsgvo" | "swiss-dsg";
     isNew: boolean;
-}, import("@cosmicdrift/kumiko-types/event-type-map").KumikoEventTypeMap>;
+}, import("@cosmicdrift/kumiko-types/event-type-map").KumikoEventTypeMap, undefined>;

package/dist/config/handlers/reset.write.d.ts

@@ -9,4 +9,4 @@ export declare const resetWrite: import("@cosmicdrift/kumiko-types/define-handle
 }, z.core.$strip>, {
     key: string;
     scope: import("@cosmicdrift/kumiko-types/config-scope").ConfigScope;
-}, import("@cosmicdrift/kumiko-types/event-type-map").KumikoEventTypeMap>;
+}, import("@cosmicdrift/kumiko-types/event-type-map").KumikoEventTypeMap, undefined>;

package/dist/config/handlers/set.write.d.ts

@@ -11,4 +11,4 @@ export declare const setWrite: import("@cosmicdrift/kumiko-types/define-handler"
     key: string;
     value: string | number | boolean;
     scope: import("@cosmicdrift/kumiko-types/config-scope").ConfigScope;
-}, import("@cosmicdrift/kumiko-types/event-type-map").KumikoEventTypeMap>;
+}, import("@cosmicdrift/kumiko-types/event-type-map").KumikoEventTypeMap, undefined>;

package/dist/config/handlers/set.write.js

@@ -1,6 +1,6 @@
 import { requestContext } from "@cosmicdrift/kumiko-framework/api";
 import { configuredPiiSubjectKms, encryptPiiValueForSubject, } from "@cosmicdrift/kumiko-framework/crypto";
-import { createEventStoreExecutor } from "@cosmicdrift/kumiko-framework/db";
+import { createEventStoreExecutor, scopeTenantDbToTenant } from "@cosmicdrift/kumiko-framework/db";
 import { ConfigScopes, defineWriteHandler, isEncryptedAtRest, SYSTEM_TENANT_ID, } from "@cosmicdrift/kumiko-framework/engine";
 import { InternalError, isKumikoError, UnprocessableError, writeFailure, } from "@cosmicdrift/kumiko-framework/errors";
 import * as z from "zod";
@@ -74,7 +74,7 @@ export const setWrite = defineWriteHandler({
                     scope,
                     tenantId,
                     userId,
-                    db,
+                    db: scopeTenantDbToTenant(db, tenantId),
                 });
             }
             catch (error) {

package/dist/config/resolver.d.ts

@@ -7,6 +7,7 @@ export type ConfigResolverOptions = {
     cipher?: EnvelopeCipher;
     appOverrides?: AppConfigOverrides;
 };
+export declare function decryptStoredValue(raw: string, keyDef: ConfigKeyDefinition, cipher: EnvelopeCipher | undefined, qualifiedKey: string): Promise<string>;
 export declare function createConfigResolver(options?: ConfigResolverOptions): ConfigResolver;
 export declare function validateAppOverrides(registry: {
     getConfigKey: (key: string) => import("@cosmicdrift/kumiko-framework/engine").ConfigKeyDefinition | undefined;

package/dist/config/resolver.js

@@ -57,6 +57,15 @@ async function decryptPiiEncrypted(raw, qualifiedKey) {
     const kmsCtx = { requestId: requestContext.get()?.requestId ?? "config:resolver" };
     return decryptPiiValueForSubject(kms, raw, kmsCtx, qualifiedKey);
 }
+// Plaintext form of a stored config_values.value for every read path (resolver,
+// bootstrap idempotency check).
+export async function decryptStoredValue(raw, keyDef, cipher, qualifiedKey) {
+    if (keyDef.encrypted)
+        return decryptEncrypted(cipher, raw, qualifiedKey);
+    if (keyDef.piiEncrypted)
+        return decryptPiiEncrypted(raw, qualifiedKey);
+    return raw;
+}
 // backing="secrets" keys store their value in the secrets store (flat per
 // (tenant,key) at SYSTEM_TENANT_ID), not in config_values. Both read paths
 // (getWithSource + buildCascade) route the system rung here. Missing reader =
@@ -142,13 +151,7 @@ async function buildCascade(qualifiedKey, keyDef, tenantId, userId, db, fetchRow
         }
         const row = await fetchRow(lookup.tenantId, lookup.userId);
         if (row?.value !== null && row?.value !== undefined) {
-            let raw = row.value;
-            if (keyDef.encrypted) {
-                raw = await decryptEncrypted(cipher, raw, qualifiedKey);
-            }
-            else if (keyDef.piiEncrypted) {
-                raw = await decryptPiiEncrypted(raw, qualifiedKey);
-            }
+            const raw = await decryptStoredValue(row.value, keyDef, cipher, qualifiedKey);
             if (activeIndex === -1)
                 activeIndex = levels.length;
             levels.push({
@@ -296,13 +299,7 @@ export function createConfigResolver(options = {}) {
             for (const lookup of lookups) {
                 const row = await findRow(qualifiedKey, lookup.tenantId, lookup.userId, db);
                 if (row?.value !== null && row?.value !== undefined) {
-                    let raw = row.value;
-                    if (keyDef.encrypted) {
-                        raw = await decryptEncrypted(cipher, raw, qualifiedKey);
-                    }
-                    else if (keyDef.piiEncrypted) {
-                        raw = await decryptPiiEncrypted(raw, qualifiedKey);
-                    }
+                    const raw = await decryptStoredValue(row.value, keyDef, cipher, qualifiedKey);
                     return { value: deserializeValue(raw, keyDef.type), source: lookup.source };
                 }
             }

package/dist/config/write-helpers.d.ts

@@ -2,12 +2,14 @@ import type { SubjectId } from "@cosmicdrift/kumiko-framework/crypto";
 import type { DbConnection, TenantDb } from "@cosmicdrift/kumiko-framework/db";
 import { type ConfigKeyDefinition, type ConfigScope, type Registry, type SessionUser, type TenantId } from "@cosmicdrift/kumiko-framework/engine";
 import { type KumikoError, type WriteFailure } from "@cosmicdrift/kumiko-framework/errors";
+import type { EnvelopeCipher } from "@cosmicdrift/kumiko-framework/secrets";
 export type ConfigRowLookup = {
     readonly id: string;
     readonly version: number;
     readonly value: string | null;
 };
 export declare function findConfigRow(db: DbConnection | TenantDb, key: string, tenantId: TenantId, userId: string | null): Promise<ConfigRowLookup | null>;
+export declare function configRowHoldsValue(row: ConfigRowLookup | null, keyDef: ConfigKeyDefinition | undefined, cipher: EnvelopeCipher | undefined, qualifiedKey: string, serializedValue: string): Promise<boolean>;
 export type PrepareConfigWriteArgs = {
     readonly registry: Registry;
     readonly user: SessionUser;

package/dist/config/write-helpers.js

@@ -6,6 +6,7 @@ import { ConfigScopes, extensionSelectorTargets, isEncryptedAtRest, SYSTEM_ROLE,
 import { AccessDeniedError, InternalError, NotFoundError, UnprocessableError, ValidationError, writeFailure, } from "@cosmicdrift/kumiko-framework/errors";
 import { assertUnreachable } from "@cosmicdrift/kumiko-framework/utils";
 import { ConfigErrors } from "./constants.js";
+import { decryptStoredValue } from "./resolver.js";
 import { configValuesTable } from "./table.js";
 // Locate an existing config_values row by the (key, tenant, user) triple —
 // the effective natural key. System-scope rows carry SYSTEM_TENANT_ID on
@@ -26,6 +27,24 @@ export async function findConfigRow(db, key, tenantId, userId) {
         value: row.value ?? null,
     };
 }
+// Idempotency check for declarative writers: does the stored row already hold
+// `serializedValue` (JSON of the plaintext)? Encrypted rows are decrypted
+// first, since their ciphertext differs on every encrypt.
+export async function configRowHoldsValue(row, keyDef, cipher, qualifiedKey, serializedValue) {
+    if (row?.value === null || row?.value === undefined)
+        return false;
+    if (!keyDef?.encrypted && !keyDef?.piiEncrypted)
+        return row.value === serializedValue;
+    if (!keyDef)
+        return false;
+    try {
+        return (await decryptStoredValue(row.value, keyDef, cipher, qualifiedKey)) === serializedValue;
+    }
+    catch {
+        // Unreadable (rotated key, missing cipher/KMS): the caller rewrites the row, which is the repair.
+        return false;
+    }
+}
 export function prepareConfigWrite(args) {
     const { registry, user, key, scope: requestedScope } = args;
     const keyDef = registry.getConfigKey(key);

package/dist/crypto-shredding/handlers/forget-subject.write.d.ts

@@ -48,4 +48,4 @@ export declare const forgetSubjectWrite: import("@cosmicdrift/kumiko-types/defin
     reason: z.ZodString;
 }, z.core.$strip>, {
     subjectKey: string;
-}, import("@cosmicdrift/kumiko-types/event-type-map").KumikoEventTypeMap>;
+}, import("@cosmicdrift/kumiko-types/event-type-map").KumikoEventTypeMap, undefined>;

package/dist/crypto-shredding/handlers/forget-subject.write.js

@@ -1,8 +1,8 @@
 import { requestContext } from "@cosmicdrift/kumiko-framework/api";
 import { ROLES } from "@cosmicdrift/kumiko-framework/auth";
-import { runInSavepointIfSupported } from "@cosmicdrift/kumiko-framework/bun-db";
+import { fetchOne, runInSavepointIfSupported, runnerCanBeginTransaction, transaction, } from "@cosmicdrift/kumiko-framework/bun-db";
 import { computeBlindIndex, configuredBlindIndexKey, configuredPiiSubjectKms, subjectIdSchema, subjectIdToKey, } from "@cosmicdrift/kumiko-framework/crypto";
-import { nullBlindIndexesForSubject, recordEventsOwnedExclusivelyByTenant, recordRowExistsInTenant, recordRowOwningTenantId, subjectRowExistsInTenant, } from "@cosmicdrift/kumiko-framework/db";
+import { nullBlindIndexesForSubject, recordEventsOwnedExclusivelyByTenant, recordRowExistsInTenant, recordRowOwningTenantId, subjectRowExistsInTenant, WritePurposes, } from "@cosmicdrift/kumiko-framework/db";
 import { defineWriteHandler, } from "@cosmicdrift/kumiko-framework/engine";
 import { AccessDeniedError, InternalError, writeFailure, } from "@cosmicdrift/kumiko-framework/errors";
 import { appendDomainEventCore, assertIrreversibleOperationAllowed, } from "@cosmicdrift/kumiko-framework/pipeline";
@@ -12,7 +12,7 @@ import * as z from "zod";
 import { resolveRetentionPolicyForTenant } from "../../data-retention/index.js";
 import { eraseNoteBodiesReachingSubject } from "../../notes-history-user-data/index.js";
 import { revokeAllPatTokensForUser } from "../../personal-access-tokens/index.js";
-import { USER_STATUS } from "../../user/index.js";
+import { USER_STATUS, userTable } from "../../user/index.js";
 import { denyIfTargetOutsideAdminTenant, isSystemAdminActor, updateUserLifecycle, } from "../../user-data-rights/index.js";
 import { CRYPTO_SHREDDING_AGGREGATE_TYPE, CRYPTO_SHREDDING_FEATURE_NAME, RECORD_ENTITY_NOT_REGISTERED, SUBJECT_FORGET_DENIED_EVENT_NAME, SUBJECT_FORGOTTEN_EVENT_NAME, TARGET_RECORD_NOT_ADMIN_TENANT, TARGET_RECORD_RETENTION_BLOCK_DELETE, TARGET_TENANT_NOT_ADMIN_TENANT, } from "../constants.js";
 export { subjectIdSchema };
@@ -241,22 +241,29 @@ async function sweepDerivedSubjectData(ctx, subject, subjectKey, crossTenantRunn
         return sweepErrorLabel(err);
     }
 }
-// Graceful fail: email-subscribers and other non-user entities may use
-// user-style subject keys without having an actual user row — the key erase is
-// the important part for GDPR compliance; the lifecycle update is best-effort for
-// real users. The savepoint confines the failure so the handler transaction
-// stays usable for the audit event.
-async function closeUserLoginDoorBestEffort(ctx, userId, lifecycleRunner) {
-    try {
-        await runInSavepointIfSupported(lifecycleRunner, async (userLifecycleRunner) => {
-            await updateUserLifecycle(userLifecycleRunner, userId, { status: USER_STATUS.Deleted });
-            if (ctx.registry.features.has("personal-access-tokens")) {
-                await revokeAllPatTokensForUser(userLifecycleRunner, userId);
-            }
-        });
+// Email subscribers and other non-user entities use user-style subject keys
+// without a read_users row — the key erase is the GDPR-relevant part, so no row
+// means nothing to close. For an existing row, failures propagate: the handler
+// throws and the retry re-runs the (idempotent) erase plus the door close. With
+// an outside-transaction runner that can open its own transaction, the door
+// closes there and stays committed when the handler throws afterwards (sweep
+// error). Otherwise a savepoint confines a failure to the handler transaction.
+async function closeUserLoginDoor(ctx, userId, outsideRunner, handlerTxRunner) {
+    const userRow = await fetchOne(handlerTxRunner, userTable, { id: userId });
+    // skip: no user row for this subject key (e.g. email subscribers); there is no door to close.
+    if (!userRow)
+        return;
+    const closeDoor = async (runner) => {
+        await updateUserLifecycle(runner, userId, { status: USER_STATUS.Deleted }, { writePurpose: WritePurposes.erasure });
+        if (ctx.registry.features.has("personal-access-tokens")) {
+            await revokeAllPatTokensForUser(runner, userId);
+        }
+    };
+    if (outsideRunner && runnerCanBeginTransaction(outsideRunner)) {
+        await transaction(outsideRunner, closeDoor);
     }
-    catch {
-        // skip: no user row for this subject key (e.g. email subscribers); key erase and sweeps already ran.
+    else {
+        await runInSavepointIfSupported(handlerTxRunner, closeDoor);
     }
 }
 // Through the outside-transaction db when available, so the audit event commits
@@ -351,7 +358,6 @@ export const forgetSubjectWrite = defineWriteHandler({
             userId: event.user.id,
             eraseReason: event.payload.reason,
         });
-        const cleanupError = await sweepDerivedSubjectData(ctx, subject, subjectKey, ctx.db.unsafeRaw(), { requestId, erasedBy: event.user.id });
         // User subject: close the login door. DEK-erase makes the passwordHash
         // ciphertext unreadable, but status + PATs are standalone credentials —
         // the PAT resolver only checks revokedAt/expiresAt, NOT user.status
@@ -367,9 +373,13 @@ export const forgetSubjectWrite = defineWriteHandler({
         // crash recovery is safe. User-feature guard: without the user feature
         // read_users doesn't exist (crypto-only stack). Tenant subjects have no
         // credentials.
+        // Runs before the sweep and in its own transaction: a failing sweep rolls the
+        // handler transaction back, and the handler tx holds no lock on this user's
+        // read_users row yet (only read gates ran), so there is no lock conflict.
         if (raw.kind === "user" && ctx.registry.features.has("user")) {
-            await closeUserLoginDoorBestEffort(ctx, raw.userId, ctx.db.unsafeRaw());
+            await closeUserLoginDoor(ctx, raw.userId, ctx.dbOutsideTransaction?.unsafeRaw(), ctx.db.unsafeRaw());
         }
+        const cleanupError = await sweepDerivedSubjectData(ctx, subject, subjectKey, ctx.db.unsafeRaw(), { requestId, erasedBy: event.user.id });
         await appendSubjectForgotten(ctx, event, subjectAggregateId(raw), {
             subjectKey,
             reason: event.payload.reason,

package/dist/custom-fields/db/queries/retention.d.ts

@@ -1,3 +1,3 @@
-import type { DbRunner } from "@cosmicdrift/kumiko-framework/db";
+import { type DbRunner } from "@cosmicdrift/kumiko-framework/db";
 export declare function selectHostRowsWithCustomFields(db: DbRunner, tableName: string, tenantId: string): Promise<readonly unknown[]>;
 export declare function applyRetentionRemovals(db: DbRunner, tableName: string, deleteKeys: readonly string[], anonymizeKeys: readonly string[], rowId: string): Promise<void>;

package/dist/custom-fields/db/queries/retention.js

@@ -1,4 +1,5 @@
 import { asRawClient, unsafeReadRetrying } from "@cosmicdrift/kumiko-framework/bun-db";
+import { toPostgresArrayLiteral } from "@cosmicdrift/kumiko-framework/db";
 export async function selectHostRowsWithCustomFields(db, tableName, tenantId) {
     const quoted = `"${tableName.replace(/"/g, '""')}"`;
     const rowsResult = await unsafeReadRetrying(db, `SELECT id, modified_at, custom_fields FROM ${quoted} WHERE tenant_id = $1 AND custom_fields IS NOT NULL`, [tenantId]);
@@ -19,5 +20,5 @@ export async function applyRetentionRemovals(db, tableName, deleteKeys, anonymiz
             )
        ELSE custom_fields
      END
-     WHERE id = $3`, [deleteKeys, anonymizeKeys, rowId]);
+     WHERE id = $3`, [toPostgresArrayLiteral(deleteKeys), toPostgresArrayLiteral(anonymizeKeys), rowId]);
 }

package/dist/custom-fields/handlers/update-tenant-field.write.js

@@ -11,7 +11,6 @@ export function createUpdateTenantFieldHandler(opts = {}) {
         schema: updateFieldPayloadSchema,
         access: { roles: opts.roles ?? DEFAULT_FIELD_DEFINITION_WRITE_ROLES },
         description: "Replaces a tenant-owned custom-field definition with a complete new spec; serializedField.type may be omitted, in which case the stored type applies, and a different type is refused. Use it to relabel or re-constrain an existing field rather than to create or remove one.",
-        excludedFields: ["type"],
         handler: async (event, ctx) => {
             const payload = event.payload; // @cast-boundary engine-payload
             const tenantId = event.user.tenantId;

package/dist/data-retention/run-retention-cleanup.js

@@ -40,7 +40,7 @@
 import { selectMany } from "@cosmicdrift/kumiko-framework/bun-db";
 import { collectPiiSubjectFields, configuredPiiSubjectKms, isSelfPiiField, resolveSubjectForField, subjectIdToKey, } from "@cosmicdrift/kumiko-framework/crypto";
 import { createEventStoreExecutor, createTenantDb, nullBlindIndexesForSubject, WritePurposes, } from "@cosmicdrift/kumiko-framework/db";
-import { deleteStoredFileAndDerivatives } from "@cosmicdrift/kumiko-framework/derivatives";
+import { deleteFileRefBytes } from "@cosmicdrift/kumiko-framework/derivatives";
 import { createSystemUser, entityHasAnonymizableSubjectField, } from "@cosmicdrift/kumiko-framework/engine";
 import { fileRefEntity, fileRefsTable, } from "@cosmicdrift/kumiko-framework/files";
 import { propertyOf } from "@cosmicdrift/kumiko-types/type-guards";
@@ -250,9 +250,9 @@ async function isFileRefSharedByOtherRow(db, holders, ownTable, tenantId, rowId,
 }
 // Throws (unsafe key, missing list permission) must fail this row closed,
 // not abort the whole tenant run.
-async function deleteFileFailingClosed(key, store, logContext) {
+async function deleteFileFailingClosed(key, files, logContext) {
     try {
-        return await deleteStoredFileAndDerivatives(key, store, "data-retention:hardDelete");
+        return await deleteFileRefBytes(files, { storageKey: key }, "data-retention:hardDelete");
     }
     catch (err) {
         // biome-ignore lint/suspicious/noConsole: operator-visibility for storage-cleanup failures
@@ -304,13 +304,12 @@ async function purgeHardDeleteRowWithFiles(args) {
         return false;
     }
     const files = args.files;
-    const store = { list: files.list, delete: (key) => files.ref(key).delete() };
     let anyFailed = false;
     for (const fileRef of toDelete) {
         const key = fileRef["storageKey"];
         if (typeof key !== "string" || key.length === 0)
             continue;
-        const failedKeys = await deleteFileFailingClosed(key, store, `tenant=${args.tenantId} entity=${args.entityName} row=${rowId}`);
+        const failedKeys = await deleteFileFailingClosed(key, files, `tenant=${args.tenantId} entity=${args.entityName} row=${rowId}`);
         if (failedKeys.length > 0) {
             anyFailed = true;
             // biome-ignore lint/suspicious/noConsole: operator-visibility for storage-cleanup failures

package/dist/delivery/attachment-ref.d.ts

@@ -4,6 +4,8 @@ export type { FileAttachmentRef, InlineAttachmentRef, RenderedPdfAttachmentRef }
 export type EmailAttachmentRef = InlineAttachmentRef | FileAttachmentRef | RenderedPdfAttachmentRef;
 export declare const MAX_EMAIL_ATTACHMENTS = 20;
 export declare const MAX_RENDERED_PDF_VARIABLES_BYTES = 64000;
+export declare const DELIVERY_ENVELOPE_DATA_KEYS: readonly ["attachments", "from", "fromName", "replyTo", "headers", "unsubscribeUrl"];
+export declare function withoutDeliveryEnvelopeKeys(variables: Readonly<Record<string, unknown>>): Readonly<Record<string, unknown>>;
 export declare const inlineAttachmentRefSchema: z.ZodObject<{
     kind: z.ZodLiteral<"inline">;
     cid: z.ZodString;

package/dist/delivery/attachment-ref.js

@@ -3,6 +3,20 @@ import { attachmentFileNameSchema } from "../shared/index.js";
 import { isDocumentResourceKey, templateSlugSchema } from "../template-resolver/index.js";
 export const MAX_EMAIL_ATTACHMENTS = 20;
 export const MAX_RENDERED_PDF_VARIABLES_BYTES = 64_000;
+// Channel-data keys that steer delivery itself (envelope, headers, attachments);
+// they are not document variables and must not be copied into attached PDF refs.
+export const DELIVERY_ENVELOPE_DATA_KEYS = [
+    "attachments",
+    "from",
+    "fromName",
+    "replyTo",
+    "headers",
+    "unsubscribeUrl",
+];
+const DELIVERY_ENVELOPE_DATA_KEY_SET = new Set(DELIVERY_ENVELOPE_DATA_KEYS);
+export function withoutDeliveryEnvelopeKeys(variables) {
+    return Object.fromEntries(Object.entries(variables).filter(([key]) => !DELIVERY_ENVELOPE_DATA_KEY_SET.has(key)));
+}
 const MAX_ID_LENGTH = 64;
 const fileRefIdSchema = z.string().min(1).max(MAX_ID_LENGTH);
 export const inlineAttachmentRefSchema = z
@@ -19,13 +33,28 @@ export const fileAttachmentRefSchema = z
     fileName: attachmentFileNameSchema,
 })
     .strict();
+// BigInt values and cycles make JSON.stringify throw; that must surface as a validation issue,
+// not a raw TypeError that a retrying job hits again on the same data.
+function isJsonSerializable(value) {
+    try {
+        JSON.stringify(value);
+        return true;
+    }
+    catch {
+        return false;
+    }
+}
+function jsonByteLength(value) {
+    return new TextEncoder().encode(JSON.stringify(value)).byteLength;
+}
 export const renderedPdfAttachmentRefSchema = z
     .object({
     kind: z.literal("rendered-pdf"),
     templateSlug: templateSlugSchema,
     variables: z
         .record(z.string(), z.unknown())
-        .refine((value) => Buffer.byteLength(JSON.stringify(value)) <= MAX_RENDERED_PDF_VARIABLES_BYTES, {
+        .refine(isJsonSerializable, { message: "variables must be JSON-serializable" })
+        .refine((value) => !isJsonSerializable(value) || jsonByteLength(value) <= MAX_RENDERED_PDF_VARIABLES_BYTES, {
         message: `variables must not exceed ${MAX_RENDERED_PDF_VARIABLES_BYTES} bytes as JSON`,
     }),
     fileName: attachmentFileNameSchema.refine((name) => name.toLowerCase().endsWith(".pdf"), {

package/dist/delivery/channel-context.js

@@ -1,5 +1,6 @@
 import { createTenantDb } from "@cosmicdrift/kumiko-framework/db";
 import { SYSTEM_TENANT_ID } from "@cosmicdrift/kumiko-framework/engine";
+import { createFallbackLogger } from "@cosmicdrift/kumiko-framework/logging";
 import { readFileRefContent } from "../file-foundation/index.js";
 import { collectRendererPlugins, createRendererFoundationApi, RendererError, } from "../renderer-foundation/index.js";
 import { FALLBACK_LOCALE } from "../template-resolver/index.js";
@@ -15,7 +16,10 @@ export function createTemplateMailRenderer(db, registry, tenantId, config) {
             html: response.html,
             text: response.text,
             ...(response.previewText !== undefined && { previewText: response.previewText }),
+            ...(response.fromName !== undefined && { fromName: response.fromName }),
+            ...(response.replyTo !== undefined && { replyTo: response.replyTo }),
             ...(response.attachments !== undefined && { attachments: response.attachments }),
+            ...(response.layout !== undefined && { layout: response.layout }),
         };
     };
 }
@@ -40,6 +44,19 @@ function createPdfRenderer(db, registry, tenantId, config, filesForTenant) {
         return { content: response.pdfBytes, contentType: PDF_CONTENT_TYPE };
     };
 }
+// A decorative inline image (logo) that cannot be read must not fail the whole mail.
+async function readInlineImageOrNull(fileRefId, read) {
+    try {
+        return await read();
+    }
+    catch (err) {
+        createFallbackLogger("delivery").warn("inline image could not be read, sending without it", {
+            fileRefId,
+            errorName: err instanceof Error ? err.name : typeof err,
+        });
+        return null;
+    }
+}
 // Inline images and file attachments the renderer took from a template may come from the system
 // tenant (system template or tenant override of one). A file ref from notify data stays limited to
 // the job's own tenant, since a caller picks it. Inline content that is not an image is dropped, so
@@ -49,12 +66,13 @@ export function createEmailAttachmentReader(db, registry, tenantId, config, file
     return async (ref, origin = "message") => {
         if (ref.kind === "rendered-pdf")
             return renderPdf(ref);
-        const found = await readFileRefContent({
+        const readRef = () => readFileRefContent({
             db,
             filesForTenant,
             fileRefId: ref.fileRefId,
             allowedTenantIds: ref.kind === "file" && origin === "message" ? [tenantId] : [tenantId, SYSTEM_TENANT_ID],
         });
+        const found = ref.kind === "inline" ? await readInlineImageOrNull(ref.fileRefId, readRef) : await readRef();
         if (found === null)
             return null;
         if (ref.kind === "inline" && !found.contentType.startsWith(INLINE_IMAGE_CONTENT_TYPE_PREFIX)) {