@cosmicdrift/kumiko-bundled-features 0.364.0 → 0.365.0

package/dist/template-resolver/handlers/bundle-import.js

@@ -1,7 +1,7 @@
 import { fetchOne } from "@cosmicdrift/kumiko-framework/bun-db";
 import { ValidationError, writeFailure, } from "@cosmicdrift/kumiko-framework/errors";
 import { requireForTenant } from "../../shared/index.js";
-import { attachmentLimitFailure, attachmentNeedsMailTemplate, readTemplateResourceMaxBytes, storeBundleAttachment, storeTemplateResource, } from "../store-template-resource.js";
+import { attachmentLimitFailure, attachmentNeedsMailTemplate, createPreparedBundleResourceEntry, prepareTemplateAttachmentBeforeTransaction, prepareTemplateResourceBeforeTransaction, readTemplateResourceMaxBytes, releaseAll, } from "../store-template-resource.js";
 import { templateResourcesTable } from "../table.js";
 import { attachTemplateResources } from "../template-resources.js";
 import { resolveTemplateVariables } from "../template-validation.js";
@@ -49,56 +49,81 @@ async function collectBundleIssues(args, status) {
     }
     return issues;
 }
-async function storeBundleResources(args) {
-    const linked = {};
-    const pdfLinks = Object.entries(args.bundle.pdfAttachments);
-    const attachmentCount = Object.values(args.bundle.resources).filter((resource) => resource.purpose === "attachment")
-        .length + pdfLinks.length;
-    if (attachmentCount > 0 && args.bundle.kind !== "mail")
+function checkBundleAttachments(bundle) {
+    const attachmentCount = Object.values(bundle.resources).filter((resource) => resource.purpose === "attachment").length +
+        Object.keys(bundle.pdfAttachments).length;
+    if (attachmentCount > 0 && bundle.kind !== "mail")
         return attachmentNeedsMailTemplate();
     if (attachmentCount > MAX_FILE_ATTACHMENTS_PER_TEMPLATE)
         return attachmentLimitFailure();
-    // The document template is not looked up: a bundle may carry it later than the mail.
-    for (const [key, link] of pdfLinks)
-        linked[key] = { kind: "rendered-pdf", ...link };
+    return { isSuccess: true, data: null };
+}
+// beforeTransaction half: validates the bundle and uploads every resource file to the target
+// tenant's storage. A failed or throwing upload releases the ones before it.
+export async function prepareTemplateBundleBeforeTransaction(args) {
+    const refused = refuseTenantScopeUnderSystemTenant(args.scope, args.tenantId);
+    if (refused !== null)
+        return refused;
+    const issues = await collectBundleIssues(args, args.status);
+    if (issues.length > 0)
+        return writeFailure(new ValidationError({ fields: [...issues] }));
+    const attachmentCheck = checkBundleAttachments(args.bundle);
+    if (!attachmentCheck.isSuccess)
+        return attachmentCheck;
     const maxBytes = await readTemplateResourceMaxBytes(args.ctx.config, args.ctx.registry);
-    // A bundle is untrusted input like an upload: the same re-encoding decides the stored
-    // content type, so a declared image/png can't smuggle SVG or HTML into a mail or PDF.
-    for (const [key, resource] of Object.entries(args.bundle.resources)) {
-        const bytes = Uint8Array.from(Buffer.from(resource.base64, "base64"));
-        if (resource.purpose === "attachment") {
-            const attachment = await storeBundleAttachment({
+    const prepared = new Map();
+    const releases = [];
+    try {
+        // A bundle is untrusted input like an upload: the same re-encoding decides the stored
+        // content type, so a declared image/png can't smuggle SVG or HTML into a mail or PDF.
+        for (const [key, resource] of Object.entries(args.bundle.resources)) {
+            const bytes = Uint8Array.from(Buffer.from(resource.base64, "base64"));
+            const common = {
                 ctx: args.ctx,
                 user: args.user,
                 tenantId: args.tenantId,
                 bytes,
                 maxBytes,
                 key,
-                fileName: resource.fileName,
-            });
-            if (!attachment.isSuccess)
-                return attachment;
-            linked[key] = attachment.data;
-            continue;
+            };
+            const result = resource.purpose === "attachment"
+                ? await prepareTemplateAttachmentBeforeTransaction({
+                    ...common,
+                    fileName: resource.fileName,
+                })
+                : await prepareTemplateResourceBeforeTransaction(common);
+            if (!result.isSuccess) {
+                await releaseAll(releases);
+                return result;
+            }
+            if (result.release)
+                releases.push(result.release);
+            prepared.set(key, result.data);
         }
-        const stored = await storeTemplateResource({
-            ctx: args.ctx,
-            user: args.user,
-            tenantId: args.tenantId,
-            bytes,
-            maxBytes,
-            key,
-        });
-        if (!stored.isSuccess)
-            return stored;
-        linked[key] = stored.data.fileRefId;
+    }
+    catch (cause) {
+        await releaseAll(releases);
+        throw cause;
+    }
+    return { isSuccess: true, data: prepared, release: () => releaseAll(releases) };
+}
+async function linkPreparedBundleResources(args, prepared) {
+    const linked = {};
+    // The document template is not looked up: a bundle may carry it later than the mail.
+    for (const [key, link] of Object.entries(args.bundle.pdfAttachments)) {
+        linked[key] = { kind: "rendered-pdf", ...link };
+    }
+    for (const [key, file] of prepared) {
+        const entry = await createPreparedBundleResourceEntry({ ctx: args.ctx, user: args.user, tenantId: args.tenantId }, file);
+        if (!entry.isSuccess)
+            return entry;
+        linked[key] = entry.data;
     }
     return { isSuccess: true, data: linked };
 }
-// Validates every locale first, stores the resource files, then writes one row
-// per locale, so a bad locale never leaves files or half a bundle behind. An image
-// that fails re-encoding stops the import before any row is written; files stored
-// for the resources before it stay as unlinked FileRefs, like a replaced upload.
+// Validates every locale first, so a bad locale is refused before anything is written.
+// The resource files are uploaded in the beforeTransaction phase; a rolled-back transaction
+// releases them there. A crash between the upload and the commit leaves the binaries unreferenced.
 export async function importTemplateBundle(args) {
     const refused = refuseTenantScopeUnderSystemTenant(args.scope, args.tenantId);
     if (refused !== null)
@@ -106,7 +131,7 @@ export async function importTemplateBundle(args) {
     const issues = await collectBundleIssues(args, args.status);
     if (issues.length > 0)
         return writeFailure(new ValidationError({ fields: [...issues] }));
-    const linked = await storeBundleResources(args);
+    const linked = await linkPreparedBundleResources(args, args.prepared);
     if (!linked.isSuccess)
         return linked;
     const variableSchema = args.bundle.variableSchema ?? {};

package/dist/template-resolver/handlers/collection-set.write.js

@@ -3,7 +3,7 @@ import { defineWriteHandler, } from "@cosmicdrift/kumiko-framework/engine";
 import { ValidationError, writeFailure } from "@cosmicdrift/kumiko-framework/errors";
 import * as z from "zod";
 import { requireForTenant } from "../../shared/index.js";
-import { COLLECTION_REFUSED_KINDS } from "../constants.js";
+import { isCollectionRefusedKind } from "../constants.js";
 import { documentViolationsToFieldIssues, sanitizeTemplateBody } from "../document-sanitizer.js";
 import { collectionStore, DEFAULT_COLLECTION_ACCESS, } from "./collection-shared.js";
 import { contentFormatSchema, folderSchema, localeSchema, slugSchema } from "./shared.js";
@@ -33,11 +33,12 @@ export function makeCollectionSetWrite(collection) {
             ? `Creates or overwrites the caller's own "${collection.id}" entry at a slug and locale, live on save with no draft stage; it always writes the acting user's entry, never another user's.`
             : `Creates or overwrites the tenant-wide "${collection.id}" entry at a slug and locale, live on save with no draft stage; the change is visible to everyone who may reach this shared collection.`,
         handler: async (event, ctx) => {
-            if (COLLECTION_REFUSED_KINDS.includes(collection.kind)) {
+            // Defense in depth: createTemplateResolverFeature already refuses these kinds at mount.
+            if (isCollectionRefusedKind(collection.kind)) {
                 return writeFailure(new ValidationError({
                     fields: [
                         {
-                            path: "kind",
+                            path: "",
                             code: "kind_not_allowed",
                             i18nKey: "templateResolver.errors.collection.kindNotAllowed",
                             params: { detail: collection.kind },

package/dist/template-resolver/handlers/copy-locale.write.d.ts

@@ -16,4 +16,4 @@ export declare const copyLocaleWrite: import("@cosmicdrift/kumiko-types/define-h
         system: "system";
         tenant: "tenant";
     }>>;
-}, z.core.$strip>, import("./template-write.js").WrittenTemplateRow, import("@cosmicdrift/kumiko-types/event-type-map").KumikoEventTypeMap, undefined>;
+}, z.core.$strip>, import("./template-write.js").WrittenTemplateRow, import("@cosmicdrift/kumiko-types/event-type-map").KumikoEventTypeMap, readonly import("../store-template-resource.js").PreparedLinkedResourceCopy[]>;

package/dist/template-resolver/handlers/copy-locale.write.js

@@ -7,9 +7,10 @@ import { requireForTenant } from "../../shared/index.js";
 import { CONTENT_FORMATS } from "../constants.js";
 import { parseLinkedResourceEntries } from "../linked-resources.js";
 import { TemplateResolverErrors } from "../qualified-names.js";
+import { createLinkedResourceCopies, prepareLinkedResourceCopiesBeforeTransaction, } from "../store-template-resource.js";
 import { templateResourcesTable } from "../table.js";
 import { toWorkingRow } from "../template-draft.js";
-import { attachTemplateResources, duplicateLinkedResourceFiles } from "../template-resources.js";
+import { attachTemplateResources } from "../template-resources.js";
 import { resolveTemplateVariables } from "../template-validation.js";
 import { targetExistsIssue } from "./bundle-import.js";
 import { kindSchema, localeSchema, templateSlugSchema } from "./shared.js";
@@ -39,54 +40,88 @@ async function findCopySource(ctx, where) {
         status: "active",
     });
 }
-export const copyLocaleWrite = defineWriteHandler({
-    name: "copy-locale",
-    schema: z.object({
-        slug: templateSlugSchema,
-        kind: kindSchema,
-        fromLocale: localeSchema,
-        toLocale: localeSchema,
-        overwrite: z.boolean().default(false),
-        /** "system" copies between system-default rows; SystemAdmin only. */
-        scope: z.enum(["tenant", "system"]).default("tenant"),
-    }),
-    access: { roles: ["TenantAdmin", "SystemAdmin"] },
-    description: "Copies the text of one locale of a template into another locale as a draft override of the caller's tenant, taking the tenant's own row or else the system default as the source; use it as the starting point for a translation. It refuses an existing target unless overwrite is set. With scope system (SystemAdmin only) both source and target are system-default rows and the target lands as a system draft; any other caller gets a 403.",
-    handler: async (event, ctx) => {
-        const { slug, kind, fromLocale, toLocale, overwrite, scope } = event.payload;
-        if (scope === "system" && !event.user.roles.includes("SystemAdmin")) {
-            return writeFailure(new AccessDeniedError({
-                i18nKey: "errors.access.denied",
-                details: { reason: TemplateResolverErrors.systemAdminRequired },
-            }));
-        }
-        const tenantId = scope === "system" ? SYSTEM_TENANT_ID : event.user.tenantId;
-        const refused = refuseTenantScopeUnderSystemTenant(scope, tenantId);
-        if (refused !== null)
-            return refused;
-        const readDb = readDbFor(ctx, scope);
-        const storedSource = await findCopySource(ctx, {
-            scope,
+const copyLocaleSchema = z.object({
+    slug: templateSlugSchema,
+    kind: kindSchema,
+    fromLocale: localeSchema,
+    toLocale: localeSchema,
+    overwrite: z.boolean().default(false),
+    /** "system" copies between system-default rows; SystemAdmin only. */
+    scope: z.enum(["tenant", "system"]).default("tenant"),
+});
+// Runs before the upload (reject early, store nothing) and again in the transaction on the fresh rows.
+async function checkCopyRequest(ctx, event) {
+    const { slug, kind, fromLocale, toLocale, overwrite, scope } = event.payload;
+    if (scope === "system" && !event.user.roles.includes("SystemAdmin")) {
+        return writeFailure(new AccessDeniedError({
+            i18nKey: "errors.access.denied",
+            details: { reason: TemplateResolverErrors.systemAdminRequired },
+        }));
+    }
+    const tenantId = scope === "system" ? SYSTEM_TENANT_ID : event.user.tenantId;
+    const refused = refuseTenantScopeUnderSystemTenant(scope, tenantId);
+    if (refused !== null)
+        return refused;
+    const readDb = readDbFor(ctx, scope);
+    const storedSource = await findCopySource(ctx, {
+        scope,
+        tenantId,
+        slug,
+        kind,
+        locale: fromLocale,
+    });
+    const source = storedSource && toWorkingRow(storedSource, tenantId);
+    const contentFormat = source?.contentFormat;
+    if (!source || !isOneOf(CONTENT_FORMATS, contentFormat)) {
+        return writeFailure(new NotFoundError("template-resource", `${slug}/${fromLocale}`));
+    }
+    if (!overwrite) {
+        const target = await fetchOne(readDb, templateResourcesTable, {
             tenantId,
             slug,
             kind,
-            locale: fromLocale,
+            locale: toLocale,
         });
-        const source = storedSource && toWorkingRow(storedSource, tenantId);
-        if (!source || !isOneOf(CONTENT_FORMATS, source.contentFormat)) {
-            return writeFailure(new NotFoundError("template-resource", `${slug}/${fromLocale}`));
-        }
-        if (!overwrite) {
-            const target = await fetchOne(readDb, templateResourcesTable, {
-                tenantId,
-                slug,
-                kind,
-                locale: toLocale,
-            });
-            if (target) {
-                return writeFailure(new ValidationError({ fields: [targetExistsIssue(toLocale)] }));
-            }
+        if (target) {
+            return writeFailure(new ValidationError({ fields: [targetExistsIssue(toLocale)] }));
         }
+    }
+    return {
+        isSuccess: true,
+        data: {
+            scope,
+            tenantId,
+            source,
+            contentFormat,
+            sourceResources: parseLinkedResourceEntries(source.linkedResources),
+            sourceIsForeign: source.tenantId !== tenantId,
+        },
+    };
+}
+export const copyLocaleWrite = defineWriteHandler({
+    name: "copy-locale",
+    schema: copyLocaleSchema,
+    access: { roles: ["TenantAdmin", "SystemAdmin"] },
+    description: "Copies the text of one locale of a template into another locale as a draft override of the caller's tenant, taking the tenant's own row or else the system default as the source; use it as the starting point for a translation. It refuses an existing target unless overwrite is set. With scope system (SystemAdmin only) both source and target are system-default rows and the target lands as a system draft; any other caller gets a 403.",
+    beforeTransaction: async (event, ctx) => {
+        const request = await checkCopyRequest(ctx, event);
+        if (!request.isSuccess)
+            return request;
+        if (!request.data.sourceIsForeign)
+            return { isSuccess: true, data: [] };
+        return prepareLinkedResourceCopiesBeforeTransaction({
+            ctx,
+            user: event.user,
+            tenantId: request.data.tenantId,
+            resources: request.data.sourceResources,
+        });
+    },
+    handler: async (event, ctx) => {
+        const { slug, kind, toLocale } = event.payload;
+        const request = await checkCopyRequest(ctx, event);
+        if (!request.isSuccess)
+            return request;
+        const { scope, tenantId, source, contentFormat, sourceResources, sourceIsForeign } = request.data;
         const variableSchema = storedRecord(source.variableSchema);
         const written = await writeTemplateRow({
             ctx,
@@ -100,7 +135,7 @@ export const copyLocaleWrite = defineWriteHandler({
                 kind,
                 locale: toLocale,
                 content: source.content,
-                contentFormat: source.contentFormat,
+                contentFormat,
                 variableSchema,
                 meta: parseStoredJson(source.meta),
                 title: source.title,
@@ -109,16 +144,9 @@ export const copyLocaleWrite = defineWriteHandler({
         });
         if (!written.isSuccess)
             return written;
-        const sourceResources = parseLinkedResourceEntries(source.linkedResources);
-        // A system source's files belong to the system tenant: the tenant gets its own copies so
-        // previews, exports and the tenant's override keep working independent of the system row.
-        const resources = source.tenantId === tenantId
-            ? { isSuccess: true, data: sourceResources }
-            : await duplicateLinkedResourceFiles(ctx, {
-                user: event.user,
-                tenantId,
-                resources: sourceResources,
-            });
+        const resources = sourceIsForeign
+            ? await createLinkedResourceCopies({ ctx, user: event.user, tenantId }, event.prepared)
+            : { isSuccess: true, data: sourceResources };
         if (!resources.isSuccess)
             return resources;
         const attached = await attachTemplateResources(ctx, {

package/dist/template-resolver/handlers/diff-to-system.query.js

@@ -22,6 +22,7 @@ export const diffToSystemQuery = defineQueryHandler({
             slug: tenantRow.slug,
             kind: tenantRow.kind,
             locale: tenantRow.locale,
+            status: "active",
         });
         if (!systemRow || isHiddenSystemDraft(query.user, systemRow))
             throw new NotFoundError("template-resource", tenantRow.slug);

package/dist/template-resolver/handlers/import-bundle-system.write.d.ts

@@ -36,4 +36,4 @@ export declare const importBundleSystemWrite: import("@cosmicdrift/kumiko-types/
     }, z.core.$strict>;
 }, z.core.$strip>, {
     ids: Record<string, string>;
-}, import("@cosmicdrift/kumiko-types/event-type-map").KumikoEventTypeMap, undefined>;
+}, import("@cosmicdrift/kumiko-types/event-type-map").KumikoEventTypeMap, import("./bundle-import.js").PreparedBundleResources>;

package/dist/template-resolver/handlers/import-bundle-system.write.js

@@ -2,7 +2,7 @@ import { defineWriteHandler, SYSTEM_TENANT_ID } from "@cosmicdrift/kumiko-framew
 import { ValidationError, writeFailure } from "@cosmicdrift/kumiko-framework/errors";
 import * as z from "zod";
 import { templateBundleSchema } from "../template-bundle.js";
-import { importTemplateBundle } from "./bundle-import.js";
+import { importTemplateBundle, prepareTemplateBundleBeforeTransaction } from "./bundle-import.js";
 export const importBundleSystemWrite = defineWriteHandler({
     name: "import-bundle-system",
     schema: z.object({ bundle: templateBundleSchema }),
@@ -10,10 +10,11 @@ export const importBundleSystemWrite = defineWriteHandler({
     // A system template change reaches every tenant without an override.
     agent: { risk: "high" },
     description: "Imports a template bundle as system-default templates, active straight away and overwriting existing system rows; SystemAdmin only. Bundles with resource files need a caller in the system tenant, because the files are stored in the caller's file space.",
-    handler: (event, ctx) => {
+    beforeTransaction: async (event, ctx) => {
         const { bundle } = event.payload;
+        // Must run before any upload.
         if (Object.keys(bundle.resources).length > 0 && event.user.tenantId !== SYSTEM_TENANT_ID) {
-            return Promise.resolve(writeFailure(new ValidationError({
+            return writeFailure(new ValidationError({
                 fields: [
                     {
                         path: "bundle.resources",
@@ -21,9 +22,9 @@ export const importBundleSystemWrite = defineWriteHandler({
                         i18nKey: "templateResolver.errors.template.systemResourcesNeedSystemTenant",
                     },
                 ],
-            })));
+            }));
         }
-        return importTemplateBundle({
+        return prepareTemplateBundleBeforeTransaction({
             ctx,
             user: event.user,
             tenantId: SYSTEM_TENANT_ID,
@@ -33,4 +34,14 @@ export const importBundleSystemWrite = defineWriteHandler({
             overwrite: true,
         });
     },
+    handler: (event, ctx) => importTemplateBundle({
+        ctx,
+        user: event.user,
+        tenantId: SYSTEM_TENANT_ID,
+        scope: "system",
+        status: "active",
+        bundle: event.payload.bundle,
+        overwrite: true,
+        prepared: event.prepared,
+    }),
 });

package/dist/template-resolver/handlers/import-bundle.write.d.ts

@@ -37,4 +37,4 @@ export declare const importBundleWrite: import("@cosmicdrift/kumiko-types/define
     overwrite: z.ZodDefault<z.ZodBoolean>;
 }, z.core.$strip>, {
     ids: Record<string, string>;
-}, import("@cosmicdrift/kumiko-types/event-type-map").KumikoEventTypeMap, undefined>;
+}, import("@cosmicdrift/kumiko-types/event-type-map").KumikoEventTypeMap, import("./bundle-import.js").PreparedBundleResources>;

package/dist/template-resolver/handlers/import-bundle.write.js

@@ -1,12 +1,21 @@
 import { defineWriteHandler } from "@cosmicdrift/kumiko-framework/engine";
 import * as z from "zod";
 import { templateBundleSchema } from "../template-bundle.js";
-import { importTemplateBundle } from "./bundle-import.js";
+import { importTemplateBundle, prepareTemplateBundleBeforeTransaction } from "./bundle-import.js";
 export const importBundleWrite = defineWriteHandler({
     name: "import-bundle",
     schema: z.object({ bundle: templateBundleSchema, overwrite: z.boolean().default(false) }),
     access: { roles: ["TenantAdmin", "SystemAdmin"] },
     description: "Imports a template bundle (all locales plus resource files, as produced by export-bundle) into the caller's tenant as drafts; it refuses a locale that already has an override unless overwrite is set, and publish makes the drafts live.",
+    beforeTransaction: (event, ctx) => prepareTemplateBundleBeforeTransaction({
+        ctx,
+        user: event.user,
+        tenantId: event.user.tenantId,
+        scope: "tenant",
+        status: "draft",
+        bundle: event.payload.bundle,
+        overwrite: event.payload.overwrite,
+    }),
     handler: (event, ctx) => importTemplateBundle({
         ctx,
         user: event.user,
@@ -15,5 +24,6 @@ export const importBundleWrite = defineWriteHandler({
         status: "draft",
         bundle: event.payload.bundle,
         overwrite: event.payload.overwrite,
+        prepared: event.prepared,
     }),
 });

package/dist/template-resolver/handlers/overview.query.d.ts

@@ -34,6 +34,8 @@ export type OverviewResponse = {
     readonly rows: readonly OverviewRow[];
     readonly nextCursor: null;
     readonly total: number;
+    /** True when the tenant has more template rows than the overview reads; rows and total are then incomplete. */
+    readonly truncated: boolean;
 };
 export declare function effectiveMailLayoutSlugs(rows: readonly TemplateResourceRow[]): EffectiveMailLayoutSlugs;
 export declare const overviewQuery: import("@cosmicdrift/kumiko-types/define-handler").QueryHandlerDefinition<"overview", z.ZodObject<{
@@ -61,5 +63,6 @@ export declare const overviewQuery: import("@cosmicdrift/kumiko-types/define-han
     rows: OverviewRow[];
     nextCursor: null;
     total: number;
+    truncated: boolean;
 }, import("@cosmicdrift/kumiko-types/event-type-map").KumikoEventTypeMap>;
 export {};

package/dist/template-resolver/handlers/overview.query.js

@@ -186,7 +186,14 @@ export const overviewQuery = defineQueryHandler({
     description: "Lists mail, PDF and layout templates as one row per slug and kind for the caller's tenant (optionally only the mails and PDFs using one layout slug): where the effective version comes from (own override or system), its locales, status and version (the served one; `draftVersion` is set when an unpublished draft waits beside it, `activeSince` says since when the served version applies), the system version it overrides, the layout it uses and which notifications or templates use it; use it to browse and filter all templates at a glance.",
     handler: async (query, ctx) => {
         const payload = query.payload;
-        const rows = await selectMany(ctx.db, templateResourcesTable, { kind: { in: [...OVERVIEW_KINDS] } }, { limit: OVERVIEW_ROW_LIMIT });
+        const fetchedRows = await selectMany(ctx.db, templateResourcesTable, { kind: { in: [...OVERVIEW_KINDS] } }, { orderBy: { col: "id", direction: "asc" }, limit: OVERVIEW_ROW_LIMIT + 1 });
+        const truncated = fetchedRows.length > OVERVIEW_ROW_LIMIT;
+        const rows = truncated ? fetchedRows.slice(0, OVERVIEW_ROW_LIMIT) : fetchedRows;
+        if (truncated) {
+            ctx.log?.warn("template overview: row limit reached, result is incomplete", {
+                limit: OVERVIEW_ROW_LIMIT,
+            });
+        }
         const visibleRows = rows.filter((row) => !isHiddenSystemDraft(query.user, row));
         const { drafts, layoutSlugByDocument } = buildDrafts(groupBySlugAndKind(visibleRows), query.user);
         const effectiveLayouts = effectiveMailLayoutSlugs(visibleRows);
@@ -200,6 +207,7 @@ export const overviewQuery = defineQueryHandler({
             rows: filtered.slice(offset, offset + payload.limit),
             nextCursor: null,
             total: filtered.length,
+            truncated,
         };
     },
 });

package/dist/template-resolver/handlers/resource-upload.write.d.ts

@@ -1,5 +1,5 @@
 import * as z from "zod";
-import { type StoredTemplateAttachment, type StoredTemplateResource } from "../store-template-resource.js";
+import { type PreparedTemplateFile, type StoredTemplateAttachment, type StoredTemplateResource } from "../store-template-resource.js";
 export declare const resourceUploadWrite: import("@cosmicdrift/kumiko-types/define-handler").WriteHandlerDefinition<"resource-upload", z.ZodObject<{
     templateId: z.ZodOptional<z.ZodString>;
     key: z.ZodOptional<z.ZodString>;
@@ -10,4 +10,4 @@ export declare const resourceUploadWrite: import("@cosmicdrift/kumiko-types/defi
         image: "image";
     }>>;
     fileName: z.ZodOptional<z.ZodString>;
-}, z.core.$strip>, StoredTemplateAttachment | StoredTemplateResource, import("@cosmicdrift/kumiko-types/event-type-map").KumikoEventTypeMap, undefined>;
+}, z.core.$strip>, StoredTemplateAttachment | StoredTemplateResource, import("@cosmicdrift/kumiko-types/event-type-map").KumikoEventTypeMap, PreparedTemplateFile>;

package/dist/template-resolver/handlers/resource-upload.write.js

@@ -1,10 +1,10 @@
-import { defineWriteHandler } from "@cosmicdrift/kumiko-framework/engine";
+import { defineWriteHandler, } from "@cosmicdrift/kumiko-framework/engine";
 import { NotFoundError, UnprocessableError, writeFailure, } from "@cosmicdrift/kumiko-framework/errors";
 import * as z from "zod";
 import { FileRefTooLargeError, fileContextForTenant, readFileRefContent, } from "../../file-foundation/index.js";
 import { attachmentFileNameSchema } from "../../shared/index.js";
 import { TemplateResolverErrors } from "../qualified-names.js";
-import { readTemplateResourceMaxBytes, storeTemplateAttachment, storeTemplateResource, } from "../store-template-resource.js";
+import { prepareTemplateAttachmentBeforeTransaction, prepareTemplateResourceBeforeTransaction, readTemplateResourceMaxBytes, storePreparedTemplateAttachment, storePreparedTemplateResource, } from "../store-template-resource.js";
 import { RESOURCE_PURPOSES, resourceKeySchema, resourceTargetTenantId } from "./resource-shared.js";
 function attachmentTargetOf(input) {
     const { templateId, key, fileName } = input;
@@ -37,7 +37,7 @@ export const resourceUploadWrite = defineWriteHandler({
     }),
     access: { roles: ["TenantAdmin", "SystemAdmin"] },
     description: "Turns a file uploaded via POST /api/files (multipart, no entityType) into a template resource. With purpose image (default) the upload is checked against the resource-max-bytes cap, re-encoded to a supported image format and stored as a new file; with templateId and key it is linked into that template under the key, without them only the file is created. With purpose attachment, templateId, key and fileName are required: a PDF, PNG or JPEG is stored unchanged and linked into a mail template as a file attached to every mail sent from it, at most 10 per template. A cap above the files route's maxUploadSize has no effect.",
-    handler: async (event, ctx) => {
+    beforeTransaction: async (event, ctx) => {
         const { templateId, key, sourceFileRefId, purpose, fileName } = event.payload;
         const attachmentTarget = purpose === "attachment" ? attachmentTargetOf({ templateId, key, fileName }) : null;
         if (purpose === "attachment" && attachmentTarget === null) {
@@ -76,7 +76,7 @@ export const resourceUploadWrite = defineWriteHandler({
         // The source upload stays as an unclaimed file: bundled-features cannot reach the fileRef executor to delete it.
         const tenantId = resourceTargetTenantId(event.payload.tenantIdOverride, event.user.tenantId);
         if (attachmentTarget !== null) {
-            return storeTemplateAttachment({
+            return prepareTemplateAttachmentBeforeTransaction({
                 ctx,
                 user: event.user,
                 tenantId,
@@ -85,7 +85,7 @@ export const resourceUploadWrite = defineWriteHandler({
                 ...attachmentTarget,
             });
         }
-        return storeTemplateResource({
+        return prepareTemplateResourceBeforeTransaction({
             ctx,
             user: event.user,
             tenantId,
@@ -95,4 +95,34 @@ export const resourceUploadWrite = defineWriteHandler({
             ...(key !== undefined && { key }),
         });
     },
+    handler: async (event, ctx) => {
+        const { templateId, key } = event.payload;
+        const tenantId = resourceTargetTenantId(event.payload.tenantIdOverride, event.user.tenantId);
+        const { prepared } = event;
+        if (prepared.kind === "attachment") {
+            // The phase accepts attachments only with a complete target, so these are set.
+            if (templateId === undefined || key === undefined) {
+                return writeFailure(new UnprocessableError(TemplateResolverErrors.attachmentInvalid, {
+                    i18nKey: "templateResolver.errors.attachment.invalid",
+                    details: { code: "target_required" },
+                }));
+            }
+            return storePreparedTemplateAttachment({
+                ctx,
+                user: event.user,
+                tenantId,
+                prepared,
+                templateId,
+                key,
+            });
+        }
+        return storePreparedTemplateResource({
+            ctx,
+            user: event.user,
+            tenantId,
+            prepared,
+            ...(templateId !== undefined && { templateId }),
+            ...(key !== undefined && { key }),
+        });
+    },
 });

package/dist/template-resolver/handlers/validate.query.js

@@ -3,6 +3,7 @@ import { defineQueryHandler, SYSTEM_TENANT_ID, } from "@cosmicdrift/kumiko-frame
 import * as z from "zod";
 import { imageResourceKeysOf } from "../linked-resources.js";
 import { templateResourcesTable } from "../table.js";
+import { isSystemAdmin } from "../template-draft.js";
 import { resolveTemplateVariables, systemPlaceholdersFor } from "../template-validation.js";
 import { contentFormatSchema, kindSchema, localeSchema, templateSlugSchema } from "./shared.js";
 import { evaluateTemplateWrite } from "./template-gates.js";
@@ -20,7 +21,9 @@ async function knownResourceKeys(db, where) {
 // The dry run of the write pipeline; preview feeds on the evaluation, validate returns the response.
 export async function validateTemplateDraft(ctx, user, payload) {
     const variables = resolveTemplateVariables(ctx.registry, payload.slug, payload.variableSchema);
-    const { slug, kind, scope, locale } = payload;
+    const { slug, kind, locale } = payload;
+    // The dry run must not promise what the caller's write handlers would refuse.
+    const scope = isSystemAdmin(user) ? payload.scope : "tenant";
     const known = [
         ...(await knownResourceKeys(ctx.db, {
             tenantId: SYSTEM_TENANT_ID,

package/dist/template-resolver/index.d.ts

@@ -1,6 +1,6 @@
 export { createTemplateResolverApi, type ResolveRequest, requireTemplateResolver, TemplateNotFoundError, type TemplateResolverApi, type TemplateResource, } from "./api.js";
 export { type CompileDocumentBodyOptions, collectDocumentResourceKeys, compileDocumentBodyToHandlebars, toResourceDataUri, } from "./compile-document-body.js";
-export { CONTENT_FORMATS, type ContentFormat, DEFAULT_MAIL_LAYOUT_SLUG, DOCUMENT_HTML_KINDS, type DocumentHtmlKind, FALLBACK_LOCALE, NON_RENDER_KINDS, type NonRenderKind, PDF_DEFAULT_MARGIN_MM, PDF_FOOTER_MARGIN_MM, PDF_HEADER_MARGIN_MM, PDF_ORIENTATIONS, PDF_PAGE_FORMATS, type PdfOrientation, type PdfPageFormat, RENDER_KINDS, type RenderKind, SYSTEM_TENANT_ID, TEMPLATE_KINDS, TEMPLATE_SCOPES, TEMPLATE_STATUSES, TEXT_BLOCK_KIND, type TemplateKind, type TemplateScope, type TemplateStatus, UPSERT_KINDS, type UpsertKind, } from "./constants.js";
+export { CONTENT_FORMATS, type ContentFormat, DEFAULT_MAIL_LAYOUT_SLUG, DEFAULT_PDF_LAYOUT_SLUG, DOCUMENT_HTML_KINDS, type DocumentHtmlKind, FALLBACK_LOCALE, NON_RENDER_KINDS, type NonRenderKind, PDF_DEFAULT_MARGIN_MM, PDF_FOOTER_MARGIN_MM, PDF_HEADER_MARGIN_MM, PDF_ORIENTATIONS, PDF_PAGE_FORMATS, type PdfOrientation, type PdfPageFormat, RENDER_KINDS, type RenderKind, SYSTEM_TENANT_ID, TEMPLATE_KINDS, TEMPLATE_SCOPES, TEMPLATE_STATUSES, TEXT_BLOCK_KIND, type TemplateKind, type TemplateScope, type TemplateStatus, UPSERT_KINDS, type UpsertKind, } from "./constants.js";
 export { type DocumentViolation, type DocumentViolationCode, documentViolationsToFieldIssues, type SanitizeBodyResult, type SanitizeHtmlResult, sanitizeDocumentHtml, sanitizeTemplateBody, } from "./document-sanitizer.js";
 export { DOCUMENT_NODE_NAMES, DOCUMENT_TEXT_ALIGNMENTS, DocumentButton, DocumentDivider, DocumentLink, DocumentPageBreak, DocumentResource, DocumentTable, DocumentTableCell, DocumentTableHeader, DocumentTableRow, DocumentTextAlign, type DocumentTextAlignment, DocumentVariable, documentExtensions, isAllowedDocumentLinkHref, isDocumentPlaceholderHref, isDocumentReferenceName, isDocumentResourceKey, } from "./document-schema.js";
 export { createTemplateResolverFeature } from "./feature.js";
@@ -13,10 +13,10 @@ export { fileAttachmentsOf, imageLinksOf, type LinkedResourceEntry, parseLinkedR
 export { prepareDocumentForPrint } from "./print-document.js";
 export { TEMPLATE_RESOLVER_FEATURE, TemplateResolverErrors, TemplateResolverHandlers, TemplateResolverQueries, } from "./qualified-names.js";
 export { mapRecordToVariables } from "./record-mapping.js";
-export { readTemplateResourceMaxBytes, type StoredTemplateResource, storeTemplateResource, } from "./store-template-resource.js";
+export { type PreparedTemplateImage, prepareTemplateResourceBeforeTransaction, readTemplateResourceMaxBytes, type StoredTemplateResource, storePreparedTemplateResource, } from "./store-template-resource.js";
 export { type TemplateResourceRow, templateResourceEntity, templateResourcesTable, } from "./table.js";
 export { type TemplateBundle, templateBundleSchema } from "./template-bundle.js";
-export { isMailTemplateMeta, type LayoutTemplateMeta, MAIL_CATEGORIES, type MailCategory, type MailLayoutMeta, type MailTemplateMeta, type PdfTemplateMeta, parseTemplateMeta, pdfAttachmentFileNamePatternSchema, readMailLayoutMeta, readPdfTemplateMeta, type TemplateMeta, type TemplateMetaIssue, type TemplateMetaResult, templateSlugSchema, } from "./template-meta.js";
+export { isMailTemplateMeta, type LayoutTemplateMeta, MAIL_CATEGORIES, MAIL_TONES, type MailCategory, type MailLayoutMeta, type MailTemplateMeta, type MailTone, type PdfTemplateMeta, parseTemplateMeta, pdfAttachmentFileNamePatternSchema, readMailLayoutMeta, readPdfTemplateMeta, type TemplateMeta, type TemplateMetaIssue, type TemplateMetaResult, templateSlugSchema, } from "./template-meta.js";
 export { type DocumentDraftOutcome, evaluateDocumentDraft } from "./template-preview.js";
 export { readTemplateResource, type TemplateResourceFile } from "./template-resources.js";
 export { collectTemplateUsage, type TemplateUsageEntry } from "./template-usage.js";