@cosmicdrift/kumiko-bundled-features 0.363.0 → 0.365.0

package/dist/renderer-pdf/render-table-pdf.js

@@ -1,22 +1,44 @@
 import { PDFDocument, rgb, StandardFonts } from "pdf-lib";
 import * as z from "zod";
 import { RendererError } from "../renderer-foundation/index.js";
-export const pdfTableDocumentSchema = z.object({
+// Upper bounds keep a hostile or runaway payload from exhausting memory and CPU in layout.
+const PDF_TABLE_MAX_ROWS = 10_000;
+const PDF_TABLE_MAX_COLUMNS = 30;
+const PDF_TABLE_MAX_CELL_LENGTH = 5_000;
+const pdfTableColumnSchema = z
+    .object({
+    header: z.string(),
+    weight: z.number().positive().optional(),
+    align: z.enum(["left", "right"]).optional(),
+})
+    .readonly();
+export const pdfTableDocumentSchema = z
+    .object({
     title: z.string(),
     subtitle: z.string().optional(),
-    meta: z.array(z.object({ label: z.string(), value: z.string() })).optional(),
-    columns: z
-        .array(z.object({
-        header: z.string(),
-        weight: z.number().positive().optional(),
-        align: z.enum(["left", "right"]).optional(),
-    }))
-        .min(1),
-    rows: z.array(z.array(z.string())),
+    meta: z
+        .array(z.object({ label: z.string(), value: z.string() }).readonly())
+        .readonly()
+        .optional(),
+    columns: z.array(pdfTableColumnSchema).min(1).max(PDF_TABLE_MAX_COLUMNS).readonly(),
+    rows: z
+        .array(z.array(z.string().max(PDF_TABLE_MAX_CELL_LENGTH)).readonly())
+        .max(PDF_TABLE_MAX_ROWS)
+        .readonly(),
     emptyText: z.string().optional(),
     footerText: z.string().optional(),
+    // Template with `{page}` and `{pages}`; default `"{page} / {pages}"`.
     pageLabel: z.string().optional(),
-});
+})
+    .readonly();
+const marginMmSchema = z
+    .object({
+    top: z.number().nonnegative().optional(),
+    right: z.number().nonnegative().optional(),
+    bottom: z.number().nonnegative().optional(),
+    left: z.number().nonnegative().optional(),
+})
+    .readonly();
 const POINTS_PER_MM = 72 / 25.4;
 const PAGE_SIZE_POINTS = {
     A4: { width: 595.28, height: 841.89 },
@@ -31,6 +53,7 @@ const LINE_HEIGHT_FACTOR = 1.3;
 const CELL_PADDING_X = 4;
 const CELL_PADDING_Y = 3;
 const FOOTER_RESERVE = 16;
+const MIN_COLUMN_WIDTH = 20;
 const META_LABEL_GAP = 10;
 const BLOCK_GAP = 10;
 const REPLACEMENT_CHAR = "?";
@@ -46,7 +69,7 @@ function createEncodableText(font) {
     const supported = new Set(font.getCharacterSet());
     return (text) => {
         let result = "";
-        for (const char of text.replace(/\t/g, " ")) {
+        for (const char of text.replace(/\r\n?/g, "\n").replace(/\t/g, " ")) {
             const codePoint = char.codePointAt(0) ?? 0;
             result += codePoint === 0x0a || supported.has(codePoint) ? char : REPLACEMENT_CHAR;
         }
@@ -111,25 +134,22 @@ function assertRowShape(doc) {
         }
     });
 }
-export async function renderTablePdf(doc, options) {
-    if (doc.columns.length === 0) {
-        throw new RendererError("table needs at least one column", "invalid_payload");
+function resolveTableLayout(doc, options, fonts, clean) {
+    const marginMm = marginMmSchema.safeParse(options?.marginMm ?? {});
+    if (!marginMm.success) {
+        throw new RendererError("margins must be non-negative numbers", "invalid_payload");
     }
-    assertRowShape(doc);
-    const pdf = await PDFDocument.create({ updateMetadata: false });
-    const fonts = {
-        regular: await pdf.embedFont(StandardFonts.Helvetica),
-        bold: await pdf.embedFont(StandardFonts.HelveticaBold),
-    };
-    const clean = createEncodableText(fonts.regular);
     const pageSize = PAGE_SIZE_POINTS[options?.format ?? "A4"];
     const margin = {
-        top: (options?.marginMm?.top ?? DEFAULT_MARGIN_MM.top) * POINTS_PER_MM,
-        right: (options?.marginMm?.right ?? DEFAULT_MARGIN_MM.right) * POINTS_PER_MM,
-        bottom: (options?.marginMm?.bottom ?? DEFAULT_MARGIN_MM.bottom) * POINTS_PER_MM,
-        left: (options?.marginMm?.left ?? DEFAULT_MARGIN_MM.left) * POINTS_PER_MM,
+        top: (marginMm.data.top ?? DEFAULT_MARGIN_MM.top) * POINTS_PER_MM,
+        right: (marginMm.data.right ?? DEFAULT_MARGIN_MM.right) * POINTS_PER_MM,
+        bottom: (marginMm.data.bottom ?? DEFAULT_MARGIN_MM.bottom) * POINTS_PER_MM,
+        left: (marginMm.data.left ?? DEFAULT_MARGIN_MM.left) * POINTS_PER_MM,
     };
     const contentWidth = pageSize.width - margin.left - margin.right;
+    if (contentWidth < MIN_COLUMN_WIDTH * doc.columns.length) {
+        throw new RendererError("margins leave no room for table columns", "invalid_payload");
+    }
     const contentBottom = margin.bottom + FOOTER_RESERVE;
     const columnWidths = resolveColumnWidths(doc.columns, contentWidth);
     const bodyLineHeight = lineHeightFor(BODY_SIZE);
@@ -139,6 +159,33 @@ export async function renderTablePdf(doc, options) {
     }
     const headerLines = doc.columns.map((column, index) => wrapText(clean(column.header), fonts.bold, BODY_SIZE, (columnWidths[index] ?? contentWidth) - 2 * CELL_PADDING_X));
     const headerHeight = Math.max(...headerLines.map((lines) => lines.length)) * bodyLineHeight + 2 * CELL_PADDING_Y;
+    // A header this tall would leave every continuation page without room for a row.
+    if (rowSpaceOnEmptyPage - headerHeight < bodyLineHeight + 2 * CELL_PADDING_Y) {
+        throw new RendererError("table header leaves no room for rows", "invalid_payload");
+    }
+    return {
+        pageSize,
+        margin,
+        contentWidth,
+        contentBottom,
+        columnWidths,
+        bodyLineHeight,
+        headerLines,
+        headerHeight,
+    };
+}
+export async function renderTablePdf(doc, options) {
+    if (doc.columns.length === 0) {
+        throw new RendererError("table needs at least one column", "invalid_payload");
+    }
+    assertRowShape(doc);
+    const pdf = await PDFDocument.create({ updateMetadata: false });
+    const fonts = {
+        regular: await pdf.embedFont(StandardFonts.Helvetica),
+        bold: await pdf.embedFont(StandardFonts.HelveticaBold),
+    };
+    const clean = createEncodableText(fonts.regular);
+    const { pageSize, margin, contentWidth, contentBottom, columnWidths, bodyLineHeight, headerLines, headerHeight, } = resolveTableLayout(doc, options, fonts, clean);
     let page = pdf.addPage([pageSize.width, pageSize.height]);
     let cursorY = pageSize.height - margin.top;
     function drawLines(lines, font, size, left, width, topY, align, color = TEXT_COLOR) {
@@ -154,14 +201,27 @@ export async function renderTablePdf(doc, options) {
             });
         });
     }
+    function startBlankPage() {
+        page = pdf.addPage([pageSize.width, pageSize.height]);
+        cursorY = pageSize.height - margin.top;
+    }
+    function ensureRoom(height) {
+        if (cursorY - height < contentBottom)
+            startBlankPage();
+    }
+    // Line by line, so a block taller than one page continues on the next.
+    function flowLines(lines, font, size, left, width, color = TEXT_COLOR) {
+        const lineHeight = lineHeightFor(size);
+        for (const line of lines) {
+            ensureRoom(lineHeight);
+            drawLines([line], font, size, left, width, cursorY, "left", color);
+            cursorY -= lineHeight;
+        }
+    }
     function drawIntroBlock() {
-        const titleLines = wrapText(clean(doc.title), fonts.bold, TITLE_SIZE, contentWidth);
-        drawLines(titleLines, fonts.bold, TITLE_SIZE, margin.left, contentWidth, cursorY, "left");
-        cursorY -= titleLines.length * lineHeightFor(TITLE_SIZE);
+        flowLines(wrapText(clean(doc.title), fonts.bold, TITLE_SIZE, contentWidth), fonts.bold, TITLE_SIZE, margin.left, contentWidth);
         if (doc.subtitle !== undefined) {
-            const subtitleLines = wrapText(clean(doc.subtitle), fonts.regular, SUBTITLE_SIZE, contentWidth);
-            drawLines(subtitleLines, fonts.regular, SUBTITLE_SIZE, margin.left, contentWidth, cursorY, "left", MUTED_COLOR);
-            cursorY -= subtitleLines.length * lineHeightFor(SUBTITLE_SIZE);
+            flowLines(wrapText(clean(doc.subtitle), fonts.regular, SUBTITLE_SIZE, contentWidth), fonts.regular, SUBTITLE_SIZE, margin.left, contentWidth, MUTED_COLOR);
         }
         const meta = doc.meta ?? [];
         if (meta.length > 0) {
@@ -171,9 +231,9 @@ export async function renderTablePdf(doc, options) {
                 META_LABEL_GAP;
             meta.forEach((entry, index) => {
                 const valueLines = wrapText(clean(entry.value), fonts.regular, BODY_SIZE, contentWidth - labelWidth);
+                ensureRoom(bodyLineHeight);
                 drawLines([labels[index] ?? ""], fonts.bold, BODY_SIZE, margin.left, labelWidth, cursorY, "left");
-                drawLines(valueLines, fonts.regular, BODY_SIZE, margin.left + labelWidth, contentWidth - labelWidth, cursorY, "left");
-                cursorY -= valueLines.length * bodyLineHeight;
+                flowLines(valueLines, fonts.regular, BODY_SIZE, margin.left + labelWidth, contentWidth - labelWidth);
             });
         }
         cursorY -= BLOCK_GAP;
@@ -235,6 +295,7 @@ export async function renderTablePdf(doc, options) {
         }
     }
     drawIntroBlock();
+    ensureRoom(headerHeight + bodyLineHeight + 2 * CELL_PADDING_Y);
     drawTableHeader();
     if (doc.rows.length === 0 && doc.emptyText !== undefined) {
         drawRow([

package/dist/secrets/feature.js

@@ -60,20 +60,21 @@ export function requireSecretsContext(ctx, handlerName) {
                 "createSecretsContext({db, masterKeyProvider, registry}) via extraContext.secrets at boot.",
         });
     }
-    const raw = ctx.secrets;
     const userId = ctx._userId;
     if (!userId) {
         throw new InternalError({
             message: `[${handlerName}] ctx._userId missing — cannot audit secret reads without a caller identity.`,
         });
     }
-    return {
+    const withAudit = (raw) => ({
+        withRunner: (runner) => withAudit(raw.withRunner(runner)),
         get: (tenantId, key, overrideAudit) => raw.get(tenantId, key, overrideAudit ?? { userId, handlerName }),
         // No audit injection: has() is metadata-only and never logs a read.
         has: raw.has.bind(raw),
         set: raw.set.bind(raw),
         delete: raw.delete.bind(raw),
-    };
+    });
+    return withAudit(ctx.secrets);
 }
 function resolveSecretsAccess(opts) {
     if (opts.access !== undefined && opts.roles !== undefined) {

package/dist/secrets/handlers/delete.write.d.ts

@@ -4,4 +4,4 @@ export declare function createDeleteHandler(access?: AccessRule): import("@cosmi
     key: z.ZodString;
 }, z.core.$strip>, {
     key: string;
-}, import("@cosmicdrift/kumiko-types/event-type-map").KumikoEventTypeMap>;
+}, import("@cosmicdrift/kumiko-types/event-type-map").KumikoEventTypeMap, undefined>;

package/dist/secrets/handlers/delete.write.js

@@ -16,7 +16,9 @@ export function createDeleteHandler(access = DEFAULT_SECRETS_ACCESS) {
         access,
         handler: async (event, ctx) => {
             const secrets = requireSecretsContext(ctx, "secrets:write:delete");
-            const gate = checkSecretKeyWrite(ctx.registry, event.user.roles, event.payload.key);
+            const gate = checkSecretKeyWrite(ctx.registry, event.user.roles, event.payload.key, {
+                allowUndeclared: true,
+            });
             if (!gate.ok)
                 return gate.failure;
             const removed = await secrets.delete(event.user.tenantId, event.payload.key, {

package/dist/secrets/handlers/set.write.d.ts

@@ -8,4 +8,4 @@ export declare function createSetHandler(access?: AccessRule): import("@cosmicdr
 }, z.core.$strip>, {
     key: string;
     redactedPreview: string;
-}, import("@cosmicdrift/kumiko-types/event-type-map").KumikoEventTypeMap>;
+}, import("@cosmicdrift/kumiko-types/event-type-map").KumikoEventTypeMap, undefined>;

package/dist/secrets/secrets-context.js

@@ -44,12 +44,21 @@ function resolveKey(keyOrHandle) {
     return typeof keyOrHandle === "string" ? keyOrHandle : keyOrHandle.name;
 }
 export function createSecretsContext(opts) {
-    const { db, masterKeyProvider } = opts;
+    const { masterKeyProvider } = opts;
     const provider = withDekCache(masterKeyProvider, opts.dekCache ?? createDekCache());
+    return buildSecretsContext(opts, provider, opts.db, false);
+}
+// `runnerIsTransaction`: the runner is a caller-owned transaction, so audited reads join it
+// instead of opening a second connection (which would deadlock a small pool).
+function buildSecretsContext(opts, provider, db, runnerIsTransaction) {
+    const { masterKeyProvider } = opts;
     async function lookup(tenantId, key) {
         return fetchOne(db, tenantSecretsTable, { tenantId, key });
     }
     return {
+        withRunner(runner) {
+            return buildSecretsContext(opts, provider, runner, true);
+        },
         async get(tenantId, keyOrHandle, auditCtx) {
             const key = resolveKey(keyOrHandle);
             // Atomic audit + read: a decrypt that "escaped" the audit trail
@@ -65,7 +74,7 @@ export function createSecretsContext(opts) {
                 const plaintext = await decryptValue(decodeStoredEnvelope(existing.envelope), provider);
                 return createSecret(plaintext);
             }
-            const plaintext = await transaction(db, async (tx) => {
+            const readAndAudit = async (tx) => {
                 // Inline select inside the TX via raw client — fetchOne's connection
                 // type doesn't widen to the transaction object cleanly.
                 const envelope = await selectTenantSecretEnvelope(tx, tenantId, key);
@@ -99,7 +108,10 @@ export function createSecretsContext(opts) {
                     metadata,
                 });
                 return pt;
-            });
+            };
+            const plaintext = runnerIsTransaction
+                ? await readAndAudit(db)
+                : await transaction(db, readAndAudit);
             if (plaintext === undefined)
                 return undefined;
             // Brand the plaintext only after audit committed. The response

package/dist/secrets/write-gate.d.ts

@@ -7,7 +7,9 @@ export type SecretKeyWriteCheck = {
     readonly ok: false;
     readonly failure: WriteFailure;
 };
-export declare function checkSecretKeyWrite(registry: Registry, userRoles: readonly string[], key: string): SecretKeyWriteCheck;
+export declare function checkSecretKeyWrite(registry: Registry, userRoles: readonly string[], key: string, options?: {
+    readonly allowUndeclared?: boolean;
+}): SecretKeyWriteCheck;
 export type SecretValueSchemaSource = Pick<Registry, "getSecretKey" | "findSecretNamespace">;
 export declare function invalidSecretValueError(): ValidationError;
 export declare function isInvalidSecretValueError(err: unknown): err is ValidationError;

package/dist/secrets/write-gate.js

@@ -15,11 +15,14 @@ function namespaceAcceptsKey(namespace, key) {
 // Only keys declared via r.secret() or under a declared r.secretNamespace()
 // are writable through the API, so a tenant admin cannot plant arbitrary rows
 // next to the feature-owned ones. writeRoles narrows the handler access
-// further for a key or a whole namespace.
-export function checkSecretKeyWrite(registry, userRoles, key) {
+// further for a key or a whole namespace. Delete passes allowUndeclared: it
+// creates nothing, and legacy rows under since-undeclared keys must stay removable.
+export function checkSecretKeyWrite(registry, userRoles, key, options = {}) {
     const keyDef = registry.getSecretKey(key);
     const namespace = keyDef ? undefined : registry.findSecretNamespace(key);
-    if (!keyDef && !(namespace && namespaceAcceptsKey(namespace, key))) {
+    if (!keyDef &&
+        !(namespace && namespaceAcceptsKey(namespace, key)) &&
+        options.allowUndeclared !== true) {
         return unknownKeyFailure(key);
     }
     const writeRoles = keyDef?.writeRoles ?? namespace?.writeRoles;

package/dist/sessions/handlers/revoke-all-for-user.write.d.ts

@@ -6,4 +6,4 @@ export declare const revokeAllForUserWrite: import("@cosmicdrift/kumiko-types/de
 }, z.core.$strip>, {
     count: number;
     userId: string;
-}, import("@cosmicdrift/kumiko-types/event-type-map").KumikoEventTypeMap>;
+}, import("@cosmicdrift/kumiko-types/event-type-map").KumikoEventTypeMap, undefined>;

package/dist/sessions/handlers/revoke-all-others.write.d.ts

@@ -1,4 +1,4 @@
 import * as z from "zod";
 export declare const revokeAllOthersWrite: import("@cosmicdrift/kumiko-types/define-handler").WriteHandlerDefinition<"user-session:revoke-all-others", z.ZodObject<{}, z.core.$strip>, {
     count: number;
-}, import("@cosmicdrift/kumiko-types/event-type-map").KumikoEventTypeMap>;
+}, import("@cosmicdrift/kumiko-types/event-type-map").KumikoEventTypeMap, undefined>;

package/dist/sessions/handlers/revoke.write.d.ts

@@ -3,4 +3,4 @@ export declare const revokeWrite: import("@cosmicdrift/kumiko-types/define-handl
     id: z.ZodUUID;
 }, z.core.$strip>, {
     id: string;
-}, import("@cosmicdrift/kumiko-types/event-type-map").KumikoEventTypeMap>;
+}, import("@cosmicdrift/kumiko-types/event-type-map").KumikoEventTypeMap, undefined>;

package/dist/shared/chunked-entity-migration.d.ts

@@ -12,6 +12,7 @@ export type ChunkedMigrationOptions<Row> = {
     readonly migrateRow: (row: Row) => Promise<MigrationRowOutcome>;
     readonly maxFailures: number;
     readonly deadlineAt: number;
+    readonly minBatches?: number;
     readonly signal?: AbortSignal | undefined;
     readonly onRowError?: (row: Row, err: unknown) => void;
 };

package/dist/shared/chunked-entity-migration.js

@@ -25,7 +25,7 @@ export async function runChunkedMigration(opts) {
             stoppedReason = "signal";
             break;
         }
-        if (Date.now() >= opts.deadlineAt) {
+        if (batchesProcessed >= (opts.minBatches ?? 0) && Date.now() >= opts.deadlineAt) {
             stoppedReason = "timeout";
             break;
         }

package/dist/shared/index.d.ts

@@ -18,6 +18,7 @@ export { rateLimitedTextResponse } from "./rate-limited-text-response.js";
 export { redactBotTokens, redactEmailAddresses, redactErrorText, redactUrls, } from "./redact.js";
 export { REDACTED_PII_PLACEHOLDER, redactPiiCiphertext } from "./redact-pii-ciphertext.js";
 export { requireForTenant } from "./require-for-tenant.js";
+export { extensionForResourceContentType, isResourceImageContentType, isResourceImageFormat, RESOURCE_IMAGE_FORMATS, type ResourceImageContentType, type ResourceImageFormat, } from "./resource-image-formats.js";
 export { type RowBoundGrantResult, redeemRowBoundGrant, signRowBoundGrant, } from "./row-bound-grant.js";
 export { runInSubTransaction } from "./run-in-sub-transaction.js";
 export { registrationLocaleFromRequest, sessionLocaleField } from "./session-locale-field.js";

package/dist/shared/index.js

@@ -18,6 +18,7 @@ export { rateLimitedTextResponse } from "./rate-limited-text-response.js";
 export { redactBotTokens, redactEmailAddresses, redactErrorText, redactUrls, } from "./redact.js";
 export { REDACTED_PII_PLACEHOLDER, redactPiiCiphertext } from "./redact-pii-ciphertext.js";
 export { requireForTenant } from "./require-for-tenant.js";
+export { extensionForResourceContentType, isResourceImageContentType, isResourceImageFormat, RESOURCE_IMAGE_FORMATS, } from "./resource-image-formats.js";
 export { redeemRowBoundGrant, signRowBoundGrant, } from "./row-bound-grant.js";
 export { runInSubTransaction } from "./run-in-sub-transaction.js";
 export { registrationLocaleFromRequest, sessionLocaleField } from "./session-locale-field.js";

package/dist/shared/mail-template-body.d.ts

@@ -1,4 +1,7 @@
 export declare function mailTextWithSlotsHtml(text: string): string;
 export declare function mailParagraph(text: string): string;
 export declare function mailHeading(text: string): string;
+export declare function mailButton(label: string, linkVariable: string): string;
+export declare function mailParagraphWithLink(text: string, linkLabel: string, linkVariable: string): string;
 export declare function mailRepeatedRows(listName: string, field: string): string;
+export declare function mailSubject(text: string): string;

package/dist/shared/mail-template-body.js

@@ -11,7 +11,17 @@ export function mailParagraph(text) {
 export function mailHeading(text) {
     return `<h2>${mailTextWithSlotsHtml(text)}</h2>`;
 }
+export function mailButton(label, linkVariable) {
+    return `<p><a data-button href="{{${escapeHtmlAttr(linkVariable)}}}">${escapeHtml(label)}</a></p>`;
+}
+export function mailParagraphWithLink(text, linkLabel, linkVariable) {
+    return `<p>${mailTextWithSlotsHtml(text)} <a href="{{${escapeHtmlAttr(linkVariable)}}}">${escapeHtml(linkLabel)}</a></p>`;
+}
 // One table row per list entry; the cell shows the entry's `field`.
 export function mailRepeatedRows(listName, field) {
     return `<table><tbody><tr data-each="${escapeHtmlAttr(listName)}"><td><p><span data-variable="${escapeHtmlAttr(field)}"></span></p></td></tr></tbody></table>`;
 }
+// Subjects are Handlebars text, so the same `{name}` slots become `{{name}}`.
+export function mailSubject(text) {
+    return text.replace(SLOT_PATTERN, "{{$1}}");
+}

package/dist/shared/resource-image-formats.d.ts

@@ -0,0 +1,23 @@
+export declare const RESOURCE_IMAGE_FORMATS: {
+    readonly png: {
+        readonly contentType: "image/png";
+        readonly extension: "png";
+    };
+    readonly jpeg: {
+        readonly contentType: "image/jpeg";
+        readonly extension: "jpg";
+    };
+    readonly gif: {
+        readonly contentType: "image/gif";
+        readonly extension: "gif";
+    };
+    readonly webp: {
+        readonly contentType: "image/webp";
+        readonly extension: "webp";
+    };
+};
+export type ResourceImageFormat = keyof typeof RESOURCE_IMAGE_FORMATS;
+export type ResourceImageContentType = (typeof RESOURCE_IMAGE_FORMATS)[ResourceImageFormat]["contentType"];
+export declare function isResourceImageFormat(format: string | undefined): format is ResourceImageFormat;
+export declare function isResourceImageContentType(contentType: string): contentType is ResourceImageContentType;
+export declare function extensionForResourceContentType(contentType: string): string | undefined;

package/dist/shared/resource-image-formats.js

@@ -0,0 +1,21 @@
+// Single source for the raster formats a template resource image may have: the normalizer, the
+// stored file extension, the data-URI embedding and the inline mail attachment name all derive
+// from it, so a new format cannot be accepted in one place and dropped in another.
+export const RESOURCE_IMAGE_FORMATS = {
+    png: { contentType: "image/png", extension: "png" },
+    jpeg: { contentType: "image/jpeg", extension: "jpg" },
+    gif: { contentType: "image/gif", extension: "gif" },
+    webp: { contentType: "image/webp", extension: "webp" },
+};
+export function isResourceImageFormat(format) {
+    return format !== undefined && Object.hasOwn(RESOURCE_IMAGE_FORMATS, format);
+}
+function formatForContentType(contentType) {
+    return Object.values(RESOURCE_IMAGE_FORMATS).find((entry) => entry.contentType === contentType);
+}
+export function isResourceImageContentType(contentType) {
+    return formatForContentType(contentType) !== undefined;
+}
+export function extensionForResourceContentType(contentType) {
+    return formatForContentType(contentType)?.extension;
+}

package/dist/shared/sharp-input-limits.js

@@ -4,19 +4,18 @@
 // to be an OOM primitive for a single request.
 export const MAX_INPUT_PIXELS = 100_000_000;
 // sequentialRead trades random pixel access for lower peak memory on
-// streamed formats — applied at every decode entry point below since none
-// of them need non-sequential access to the *original* bytes (extract runs
-// against a single already-buffered region per call).
+// streamed formats. Shared by every sharp caller since none of them need
+// non-sequential access to the original bytes.
 export const SHARP_INPUT_OPTIONS = {
     limitInputPixels: MAX_INPUT_PIXELS,
     sequentialRead: true,
 };
-// Shared trust boundary for every image byte source this renderer decodes —
-// the original upload (renderImage) and an overlay layer's bytes (applyOverlays)
-// alike: a base64 string in a field declaration isn't more trustworthy than
-// an upload just because it came from app code.
+// Shared trust boundary for every image byte source decoded through sharp:
+// uploads, overlay layers and template resources alike. A base64 string in a
+// field declaration isn't more trustworthy than an upload just because it
+// came from app code.
 export function assertNotSvg(format) {
     if (format === "svg") {
-        throw new Error("derivatives-sharp: SVG is not supported — rendering untrusted SVG through libvips is a trust boundary this renderer doesn't need to cross.");
+        throw new Error("SVG is not supported — rendering untrusted SVG through libvips is a trust boundary this code doesn't need to cross.");
     }
 }

package/dist/step-dispatcher/webhook-runner.js

@@ -79,8 +79,8 @@ let fetchImpl = globalThis.fetch.bind(globalThis);
 export function setWebhookFetch(fn) {
     fetchImpl = fn;
 }
-// One hanging tenant-controlled receiver must not stall the shared
-// step-dispatcher consumer for every tenant.
+// Bounds a single hanging tenant-controlled receiver to this long. The consumer
+// is sequential and shared, so N hanging requests still delay other tenants by N times this.
 export const WEBHOOK_REQUEST_TIMEOUT_MS = 10_000;
 // Never includes the secret name or value — spec.auth.secret is a
 // tenant-chosen name, but the error still reaches the tenant via the

package/dist/subscription-stripe/plugin-methods.js

@@ -75,9 +75,7 @@ export function mapAppLocaleToStripeLocale(locale) {
     return knownLocales.find((known) => known === language) ?? "auto";
 }
 function isUnknownCustomerStripeError(error) {
-    return (isResourceMissingStripeError(error) &&
-        error instanceof Stripe.errors.StripeInvalidRequestError &&
-        error.param === "customer");
+    return isResourceMissingStripeError(error) && error.param === "customer";
 }
 export function createStripeCheckoutSession(runtime, { paymentInvoiceCreation = true } = {}) {
     return async (ctx, options) => {
@@ -147,11 +145,23 @@ export function createStripeCheckoutSession(runtime, { paymentInvoiceCreation =
 export function createStripePortalSession(runtime) {
     return async (ctx, options) => {
         const stripe = await runtime.clientForCtx(ctx);
-        const session = await stripe.billingPortal.sessions.create({
-            customer: options.providerCustomerId,
-            return_url: options.returnUrl,
-        });
-        return { url: session.url };
+        try {
+            const session = await stripe.billingPortal.sessions.create({
+                customer: options.providerCustomerId,
+                return_url: options.returnUrl,
+            });
+            return { url: session.url };
+        }
+        catch (error) {
+            // A portal needs an existing customer, so unlike checkout there is no retry without one.
+            if (!isUnknownCustomerStripeError(error))
+                throw error;
+            throw new UnprocessableError("provider_customer_unknown", {
+                i18nKey: "billing-foundation.errors.providerCustomerUnknown",
+                message: `subscription-stripe: Stripe does not know customer "${options.providerCustomerId}" (account switch or customer deleted).`,
+                cause: error,
+            });
+        }
     };
 }
 export function createStripeCancelSubscription(runtime) {

package/dist/subscription-stripe/verify-webhook.d.ts

@@ -3,7 +3,7 @@ import { type SubscriptionEventType, type SubscriptionStatus } from "@cosmicdrif
 import type { SecretsContext } from "@cosmicdrift/kumiko-framework/secrets";
 import Stripe from "stripe";
 import type { StripeWebhookRuntime } from "./runtime.js";
-export declare function isResourceMissingStripeError(error: unknown): boolean;
+export declare function isResourceMissingStripeError(error: unknown): error is Stripe.errors.StripeInvalidRequestError;
 export type StripeWebhookOptions = {
     /** Price-to-tier-Map. Plugin liest die price-id aus dem event und
      *  mapped auf tier-name. Fehlt die price-id im Mapping → null. App-

package/dist/template-resolver/api.js

@@ -6,6 +6,7 @@ import { InternalError } from "@cosmicdrift/kumiko-framework/errors";
 import { FALLBACK_LOCALE, SYSTEM_TENANT_ID } from "./constants.js";
 import { fileAttachmentsOf, imageLinksOf, parseLinkedResourceEntries, pdfAttachmentLinksOf, } from "./linked-resources.js";
 import { templateResourcesTable } from "./table.js";
+import { activeVersionOf, servedVersionOf } from "./template-draft.js";
 import { parseTemplateMeta } from "./template-meta.js";
 export function createTemplateResolverApi(db) {
     return {
@@ -51,7 +52,7 @@ export function createTemplateResolverApi(db) {
 function pickActiveLayoutRow(rows, locale) {
     const active = rows
         .filter((row) => row.status === "active")
-        .sort((a, b) => b.version - a.version || a.locale.localeCompare(b.locale));
+        .sort((a, b) => activeVersionOf(b) - activeVersionOf(a) || a.locale.localeCompare(b.locale));
     return (active.find((row) => row.locale === locale) ??
         active.find((row) => row.locale === FALLBACK_LOCALE) ??
         active[0] ??
@@ -77,7 +78,7 @@ function toPublic(row) {
     const linkedEntries = parseLinkedResourceEntries(row.linkedResources);
     return {
         id: String(row.id),
-        version: row.version,
+        version: servedVersionOf(row),
         tenantId: row.tenantId,
         slug: row.slug,
         kind,

package/dist/template-resolver/compile-document-body.d.ts

@@ -1,7 +1,14 @@
 import type { TemplateVariables } from "@cosmicdrift/kumiko-framework/engine";
 export type CompileDocumentBodyOptions = {
     readonly resourceSrc?: (key: string) => string | undefined;
+    readonly resourceImageMaxWidthPx?: number;
+    readonly resourceImageMaxHeightPx?: number;
     readonly alignmentAsInlineStyle?: boolean;
+    readonly buttonAsInlineStyle?: boolean;
+    readonly tableAsInlineStyle?: boolean;
+    readonly buttonInlineStyle?: string;
+    readonly headingAsInlineStyle?: boolean;
+    readonly stepsColor?: string;
 };
 export declare function collectDocumentResourceKeys(html: string): readonly string[];
 export declare function toResourceDataUri(contentType: string, bytes: Uint8Array): string;