@cosmicdrift/kumiko-bundled-features 0.365.1 → 0.367.0

package/dist/ledger/feature.js

@@ -28,9 +28,9 @@ function registerLedger(r, access, toggleable) {
     });
     if (toggleable !== undefined)
         r.toggleable(toggleable);
-    r.entity("account", accountEntity);
-    r.entity("transaction", transactionEntity);
-    r.entity("schedule", scheduleEntity);
+    r.entity({ name: "account", ...accountEntity });
+    r.entity({ name: "transaction", ...transactionEntity });
+    r.entity({ name: "schedule", ...scheduleEntity });
     // Chart of accounts — plain CRUD, no custom logic. No delete in v1: removing an
     // account that has postings would orphan them; a posting-aware guard lands with
     // the postings projection (Phase 1).
@@ -73,8 +73,8 @@ function registerLedger(r, access, toggleable) {
         access,
         description: "Changes a recurring booking template's description, accounts, amount, interval or date window; use it when a standing order's terms change, already confirmed periods stay booked as they were.",
     }));
-    r.hook("preSave", "schedule:create", requireScheduleSubjectPair);
-    r.hook("preSave", "schedule:update", requireScheduleSubjectPair);
+    r.hook({ type: "preSave", target: "schedule:create", handler: requireScheduleSubjectPair });
+    r.hook({ type: "preSave", target: "schedule:update", handler: requireScheduleSubjectPair });
     r.writeHandler(createConfirmSchedulePeriodHandler(access));
     r.queryHandler(defineEntityListHandler("schedule", scheduleEntity, {
         access,

package/dist/legal-pages/feature.js

@@ -35,7 +35,7 @@ export function createLegalPagesFeature(opts = {}) {
             category: "content",
             recommended: false,
         });
-        r.requires("template-resolver");
+        r.requires({ features: ["template-resolver"] });
         // Public HTML routes (default: 4 DACH routes, configurable via opts.routes)
         for (const route of routes) {
             r.httpRoute({

package/dist/mail-foundation/feature.d.ts

@@ -1,5 +1,5 @@
 import { type EmailTransport } from "@cosmicdrift/kumiko-bundled-features/channel-email";
-import { type ConfigAccessor, type Registry } from "@cosmicdrift/kumiko-framework/engine";
+import { type ConfigAccessor, type Registry, type TenantId } from "@cosmicdrift/kumiko-framework/engine";
 export declare const MAIL_TRANSPORT_EXTENSION: "mailTransport";
 /**
  * Schmaler Surface-Type fuer Transport-Plugins — gespiegelt von
@@ -69,3 +69,18 @@ export declare const mailFoundationFeature: import("@cosmicdrift/kumiko-types/fe
  *   await transport.send({ to, subject, html });
  */
 export declare function createTransportForTenant(ctx: MailTransportContext, tenantId: string, handlerName?: string): Promise<EmailTransport>;
+/**
+ * Like createTransportForTenant, but an empty `provider` key means "this tenant has no
+ * mail provider" and yields null. Every other problem (unknown provider, plugin build
+ * failure) still throws, so a configured tenant never silently falls back.
+ */
+export declare function createTransportForTenantIfConfigured(ctx: MailTransportContext, tenantId: string, handlerName?: string): Promise<EmailTransport | null>;
+export type TenantMailTransportScope = {
+    readonly tenantId: TenantId;
+    readonly config?: ConfigAccessor | undefined;
+    readonly registry: Registry;
+    readonly secrets?: import("@cosmicdrift/kumiko-framework/secrets").SecretsContext | undefined;
+};
+/** The `tenantTransport` resolver for `createChannelEmailFeature`: the tenant's configured
+ *  provider, or null so the channel falls back to its app transport. */
+export declare function tenantMailTransport(scope: TenantMailTransportScope): Promise<EmailTransport | null>;

package/dist/mail-foundation/feature.js

@@ -32,7 +32,7 @@
 // — additive Feature.
 import { withPiiCiphertextGuard, } from "@cosmicdrift/kumiko-bundled-features/channel-email";
 import { requireDefined } from "@cosmicdrift/kumiko-bundled-features/foundation-shared";
-import { access, createTenantConfig, defineFeature, } from "@cosmicdrift/kumiko-framework/engine";
+import { access, createSystemUser, createTenantConfig, defineFeature, } from "@cosmicdrift/kumiko-framework/engine";
 const FEATURE_NAME = "mail-foundation";
 // Extension-point name for transport-provider plugins (mail-transport-smtp,
 // mail-transport-brevo-api, ...).
@@ -46,13 +46,13 @@ export function isMailTransportPlugin(o) {
 // Feature-definition
 // =============================================================================
 export const mailFoundationFeature = defineFeature(FEATURE_NAME, (r) => {
-    r.describe("Defines the `mailTransport` extension point and a per-tenant `provider` config key that selects which registered transport plugin to use at runtime. Call `createTransportForTenant(ctx, tenantId)` to get an `EmailTransport` ready for sending \u2014 use this feature together with at least one `mail-transport-*` feature; use `delivery` + `channel-email` instead when you need the full notification pipeline with delivery attempts and user preferences.");
+    r.describe("Defines the `mailTransport` extension point and a per-tenant `provider` config key that selects which registered transport plugin to use at runtime. Call `createTransportForTenant(ctx, tenantId)` to get an `EmailTransport` ready for sending \u2014 use this feature together with at least one `mail-transport-*` feature; use `delivery` + `channel-email` instead when you need the full notification pipeline with delivery attempts and user preferences. Pass `tenantMailTransport` as `tenantTransport` to `createChannelEmailFeature` so a tenant with a provider configured sends delivery mails through its own transport and other tenants through the app transport.");
     r.uiHints({
         displayLabel: "Mail Transport Foundation",
         category: "notifications",
         recommended: false,
     });
-    r.requires("config");
+    r.requires({ features: ["config"] });
     // Plugin extension-point. Provider-features register here. The
     // entityName at registration time becomes the value tenants pick in
     // `provider` config-key (e.g. "smtp", "brevo-api").
@@ -99,6 +99,21 @@ export const mailFoundationFeature = defineFeature(FEATURE_NAME, (r) => {
  *   await transport.send({ to, subject, html });
  */
 export async function createTransportForTenant(ctx, tenantId, handlerName = "mail-foundation:transport-factory") {
+    const transport = await createTransportForTenantIfConfigured(ctx, tenantId, handlerName);
+    if (transport === null) {
+        const usages = ctx.registry?.getExtensionUsages(MAIL_TRANSPORT_EXTENSION) ?? [];
+        const known = usages.map((u) => u.entityName).join(", ") || "<none>";
+        throw new Error(`${FEATURE_NAME}: no provider selected — set the 'provider' config-key to one of: ${known}. ` +
+            `Mount a mail-transport-* feature first if no plugins are registered.`);
+    }
+    return transport;
+}
+/**
+ * Like createTransportForTenant, but an empty `provider` key means "this tenant has no
+ * mail provider" and yields null. Every other problem (unknown provider, plugin build
+ * failure) still throws, so a configured tenant never silently falls back.
+ */
+export async function createTransportForTenantIfConfigured(ctx, tenantId, handlerName = "mail-foundation:transport-factory") {
     const ctxConfig = ctx.config;
     if (!ctxConfig) {
         throw new Error(`${handlerName}: ctx.config is missing — feature requires the config-feature mounted in the registry`);
@@ -107,12 +122,8 @@ export async function createTransportForTenant(ctx, tenantId, handlerName = "mai
         throw new Error(`${handlerName}: ctx.registry is missing — required to look up registered mail-transport plugins`);
     }
     const provider = requireDefined(await ctxConfig(mailFoundationFeature.exports.providerConfigKey), FEATURE_NAME, "provider"); // @cast-boundary engine-payload
-    if (provider.length === 0) {
-        const usages = ctx.registry.getExtensionUsages(MAIL_TRANSPORT_EXTENSION);
-        const known = usages.map((u) => u.entityName).join(", ") || "<none>";
-        throw new Error(`${FEATURE_NAME}: no provider selected — set the 'provider' config-key to one of: ${known}. ` +
-            `Mount a mail-transport-* feature first if no plugins are registered.`);
-    }
+    if (provider.length === 0)
+        return null;
     const usages = ctx.registry.getExtensionUsages(MAIL_TRANSPORT_EXTENSION);
     const usage = usages.find((u) => u.entityName === provider);
     if (!usage) {
@@ -126,3 +137,13 @@ export async function createTransportForTenant(ctx, tenantId, handlerName = "mai
     }
     return withPiiCiphertextGuard(await usage.options.build(ctx, tenantId));
 }
+/** The `tenantTransport` resolver for `createChannelEmailFeature`: the tenant's configured
+ *  provider, or null so the channel falls back to its app transport. */
+export function tenantMailTransport(scope) {
+    return createTransportForTenantIfConfigured({
+        config: scope.config,
+        registry: scope.registry,
+        secrets: scope.secrets,
+        _userId: createSystemUser(scope.tenantId).id,
+    }, scope.tenantId, "channel-email");
+}

package/dist/mail-foundation/index.d.ts

@@ -1 +1 @@
-export { createTransportForTenant, isMailTransportPlugin, MAIL_TRANSPORT_EXTENSION, type MailTransportContext, type MailTransportPlugin, mailFoundationFeature, } from "./feature.js";
+export { createTransportForTenant, createTransportForTenantIfConfigured, isMailTransportPlugin, MAIL_TRANSPORT_EXTENSION, type MailTransportContext, type MailTransportPlugin, mailFoundationFeature, type TenantMailTransportScope, tenantMailTransport, } from "./feature.js";

package/dist/mail-foundation/index.js

@@ -6,4 +6,4 @@
 //     up the registered transport-plugin, returns its EmailTransport
 //   - `MailTransportPlugin` — type that provider-features implement
 //     when registering via `r.useExtension("mailTransport", ...)`
-export { createTransportForTenant, isMailTransportPlugin, MAIL_TRANSPORT_EXTENSION, mailFoundationFeature, } from "./feature.js";
+export { createTransportForTenant, createTransportForTenantIfConfigured, isMailTransportPlugin, MAIL_TRANSPORT_EXTENSION, mailFoundationFeature, tenantMailTransport, } from "./feature.js";

package/dist/mail-transport-inmemory/feature.js

@@ -62,11 +62,11 @@ export function clearInbox(tenantId) {
 // =============================================================================
 export const mailTransportInMemoryFeature = defineFeature(FEATURE_NAME, (r) => {
     r.describe('Registers an in-process `"inmemory"` provider for `mail-foundation` that buffers sent mails per tenant instead of contacting an SMTP server. Use `getInbox(tenantId)` and `clearInbox(tenantId)` in demo apps and tests; not for production (buffer is process-memory, lost on restart).');
-    // Kein r.requires("config") + kein r.requires("secrets") — der
+    // Kein requires auf "config" oder "secrets" — der
     // In-Memory-Transport hat keine Config (nichts zu konfigurieren) und
     // kein Secret. Der einzige hard-require ist mail-foundation, das den
     // extension-point "mailTransport" definiert.
-    r.requires("mail-foundation");
+    r.requires({ features: ["mail-foundation"] });
     const plugin = {
         build: async (_ctx, tenantId) => {
             // Returnt den per-tenant Buffer. Identitätsstabil zwischen calls

package/dist/mail-transport-smtp/feature.js

@@ -57,9 +57,9 @@ export const mailTransportSmtpFeature = defineFeature(FEATURE_NAME, (r) => {
         category: "notifications",
         recommended: false,
     });
-    r.requires("config");
-    r.requires("secrets");
-    r.requires("mail-foundation");
+    r.requires({ features: ["config"] });
+    r.requires({ features: ["secrets"] });
+    r.requires({ features: ["mail-foundation"] });
     r.envSchema(mailTransportSmtpEnvSchema);
     // Provider-secret. Sensitive: redact-helper for admin-UI display.
     const password = r.secret("smtp.password", {

package/dist/managed-pages/css-gate.js

@@ -15,7 +15,7 @@ import { MANAGED_PAGES_CSS_FEATURE } from "./branding.js";
 export function createManagedPagesCssFeature() {
     return defineFeature(MANAGED_PAGES_CSS_FEATURE, (r) => {
         r.describe('Per-tenant toggle gate for the managed-pages custom-CSS (raw tenant CSS-inject) capability. Handler-less: composing it makes `managed-pages-css` a toggleable feature defaulting OFF, so an operator/tier can grant raw CSS-inject per tenant. managed-pages reads `ctx.hasFeature("managed-pages-css")` in its branding query and emits tenant CSS only when this toggle is on AND the app passed `allowCustomCss: true`. The tenant CSS is allowlist-sanitized + scoped at render regardless; this gate is the commercial/operator control, not the safety boundary.');
-        r.requires("managed-pages");
+        r.requires({ features: ["managed-pages"] });
         r.toggleable({ default: false });
     });
 }

package/dist/managed-pages/feature.js

@@ -86,8 +86,8 @@ export function createManagedPagesFeature(opts) {
             category: "content",
             recommended: false,
         });
-        r.requires("config");
-        r.entity("page", pageEntity);
+        r.requires({ features: ["config"] });
+        r.entity({ name: "page", ...pageEntity });
         // Per-tenant branding config keys (scope: tenant). Write-validated via
         // keyDef.pattern (hex / https) — see branding.ts. read:all so the
         // anonymous render path may resolve them. The raw-CSS key is added only

package/dist/metrics/feature.js

@@ -103,7 +103,7 @@ export function createMetricsFeature(options) {
             recommended: false,
         });
         for (const feature of requiredFeatures(metrics))
-            r.requires(feature);
+            r.requires({ features: [feature] });
         for (const metric of metrics)
             r.queryHandler(createTenantMetricQuery(metric, now));
         r.translations({ keys: METRICS_I18N });
@@ -122,7 +122,7 @@ export function createSystemMetricsFeature(options) {
         });
         r.systemScope();
         for (const feature of requiredFeatures(metrics))
-            r.requires(feature);
+            r.requires({ features: [feature] });
         for (const metric of metrics)
             r.queryHandler(createSystemMetricQuery(metric, now));
         r.translations({ keys: METRICS_I18N });

package/dist/notes-history/feature.js

@@ -27,13 +27,13 @@ function registerNotesHistory(r, access, ownership, parents) {
         recommended: false,
     });
     const entity = createNoteEntryEntity(ownership, parents);
-    r.entity("note-entry", entity);
+    r.entity({ name: "note-entry", ...entity });
     // No write/query handler of its own — populated only as a side effect of
     // add-note (see handlers/add-note.write.ts), looked up by
     // notes-history-user-data's forget cascade. Registering the entity (not
     // just building it inline in the handler) is what makes it visible to the
     // registry-wide GDPR boot guards and to executor.ts's table/projection setup.
-    r.entity("note-mention", noteMentionEntity);
+    r.entity({ name: "note-mention", ...noteMentionEntity });
     r.writeHandler(createAddNoteHandler(access, createNoteEntryExecutor(ownership)));
     r.queryHandler(defineEntityListHandler("note-entry", entity, {
         access,

package/dist/notes-history-user-data/index.js

@@ -13,7 +13,7 @@ export const notesHistoryUserDataFeature = defineFeature("notes-history-user-dat
     // is OPTIONAL: if it's mounted toggleable(default=false), a hard r.requires
     // would throw an "effectively disabled" boot warning even though the
     // note-entry entity exists and the hooks work fine.
-    r.requires("user-data-rights");
+    r.requires({ features: ["user-data-rights"] });
     r.optionalRequires("notes-history");
     r.useExtension(EXT_USER_DATA, "note-entry", {
         export: noteEntryExportHook,

package/dist/personal-access-tokens/feature.js

@@ -52,7 +52,7 @@ export function createPersonalAccessTokensFeature(options) {
         // roles — make both boot-time deps so a mis-wiring fails validateBoot.
         // auth-foundation owns EXT_TOKEN_VERIFIER, which the useExtension below
         // registers against.
-        r.requires("user", "tenant", "auth-foundation");
+        r.requires({ features: ["user", "tenant", "auth-foundation"] });
         // Self-registers as a bearer-auth provider instead of the app wiring a
         // dedicated patResolver callback — the middleware finds it generically
         // via resolveTokenVerifier(), shape-matched by the PAT token prefix.
@@ -83,18 +83,22 @@ export function createPersonalAccessTokensFeature(options) {
         // #497), so a postSave hook on "user" gets a poisoned ctx.db here. The
         // concrete revoker is bound once run{Prod,Dev}App has a real db handle.
         let autoRevokeOnPasswordChange = options.autoRevokeOnPasswordChange;
-        r.hook("postSave", { allOf: "user" }, async (result) => {
-            // skip: nothing bound — same late-bind pattern as sessions/feature.ts
-            if (!autoRevokeOnPasswordChange)
-                return;
-            // skip: brand-new user, no PATs can exist yet
-            if (result.isNew)
-                return;
-            // skip: handler didn't touch any revoke-triggering field
-            if (!PAT_REVOKE_TRIGGERING_FIELDS.some((field) => result.changes[field] !== undefined)) {
-                return;
-            }
-            await autoRevokeOnPasswordChange(String(result.id));
+        r.hook({
+            type: "postSave",
+            target: { allOf: "user" },
+            handler: async (result) => {
+                // skip: nothing bound — same late-bind pattern as sessions/feature.ts
+                if (!autoRevokeOnPasswordChange)
+                    return;
+                // skip: brand-new user, no PATs can exist yet
+                if (result.isNew)
+                    return;
+                // skip: handler didn't touch any revoke-triggering field
+                if (!PAT_REVOKE_TRIGGERING_FIELDS.some((field) => result.changes[field] !== undefined)) {
+                    return;
+                }
+                await autoRevokeOnPasswordChange(String(result.id));
+            },
         });
         const bindAutoRevokeOnPasswordChange = (revoker) => {
             // explicit constructor option wins over the runtime binding

package/dist/readiness/feature.js

@@ -16,8 +16,8 @@ export const readinessFeature = defineFeature("readiness", (r) => {
         category: "operations",
         recommended: false,
     });
-    r.requires("config");
-    r.requires("secrets");
+    r.requires({ features: ["config"] });
+    r.requires({ features: ["secrets"] });
     const queries = {
         status: r.queryHandler(statusQuery),
     };

package/dist/renderer-foundation/feature.js

@@ -17,7 +17,7 @@ export function createRendererFoundationFeature() {
             category: "notifications",
             recommended: false,
         });
-        r.requires("template-resolver");
+        r.requires({ features: ["template-resolver"] });
         r.extendsRegistrar(RENDERER_EXTENSION, {
             onRegister: () => {
                 // Plugin-Konformitäts-Check könnte hier: shape-validation der

package/dist/renderer-pdf/feature.js

@@ -29,7 +29,7 @@ export function createRendererPdfFeature() {
             category: "notifications",
             recommended: false,
         });
-        r.requires("renderer-foundation");
+        r.requires({ features: ["renderer-foundation"] });
         r.useExtension(RENDERER_EXTENSION, "pdf", {
             kinds: ["document-pdf"],
             render: (req) => renderTablePdfRequest(req),

package/dist/secrets/feature.js

@@ -116,7 +116,7 @@ export function createSecretsFeature(opts = {}) {
         // uniqueIndex are not expressible via the field-DSL (jsonb-without-default,
         // now()-default), so the physical table is the DDL truth. Without this the
         // generated migration omitted those columns → prod-500 (publicstatus#116).
-        r.entity("tenant-secret", tenantSecretEntity, { table: tenantSecretsTable });
+        r.entity({ name: "tenant-secret", ...tenantSecretEntity, backingTable: tenantSecretsTable });
         // Read-audit domain-event. Registered here so ops tools + MSPs can
         // discover the type; secrets-context.get parses payloads against
         // `secretReadSchema` at write time because the low-level append() path

package/dist/seo/feature.js

@@ -108,7 +108,7 @@ export function createSeoFeature(opts) {
         // config keys need the config feature's write/read machinery to actually
         // function (same hard dependency managed-pages has) — only legal-pages/
         // managed-pages are genuinely optional (merged only when opted in).
-        r.requires("config");
+        r.requires({ features: ["config"] });
         r.optionalRequires("legal-pages", "managed-pages");
         r.config({ keys: SEO_CONFIG_KEYS });
         r.queryHandler(seoConfigQuery);

package/dist/sessions/feature.js

@@ -59,7 +59,7 @@ export function createSessionsFeature(options) {
         // sessions-without-user wiring fails validateBoot instead of 500ing live.
         // auth-foundation owns EXT_SESSION_STORE, which the useExtension below
         // registers against.
-        r.requires("user", "auth-foundation");
+        r.requires({ features: ["user", "auth-foundation"] });
         // store_user_sessions is a hot-path direct-write store: sessionCreator
         // inserts and the revoke handlers update rows WITHOUT emitting lifecycle
         // events (the row columns ARE the audit trail). Registering it as
@@ -144,21 +144,25 @@ export function createSessionsFeature(options) {
         // regardless.
         const REVOKE_TRIGGERING_FIELDS = ["passwordHash"];
         let autoRevoke = options?.autoRevokeOnPasswordChange;
-        r.hook("postSave", { allOf: "user" }, async (ctx) => {
-            // skip: nothing bound — stateless-JWT deployments without a runtime
-            // that calls bindAutoRevokeOnPasswordChange keep the old behavior.
-            if (!autoRevoke)
-                return;
-            // skip: brand-new user, no sessions can possibly exist yet. The
-            // initial passwordHash on a user:create would trip the second guard
-            // otherwise — every registration would do a mass-revoke roundtrip
-            // for a user who literally has no rows in user_sessions.
-            if (ctx.isNew)
-                return;
-            // skip: handler didn't touch any revoke-triggering field
-            if (!REVOKE_TRIGGERING_FIELDS.some((field) => ctx.changes[field] !== undefined))
-                return;
-            await autoRevoke(String(ctx.id));
+        r.hook({
+            type: "postSave",
+            target: { allOf: "user" },
+            handler: async (ctx) => {
+                // skip: nothing bound — stateless-JWT deployments without a runtime
+                // that calls bindAutoRevokeOnPasswordChange keep the old behavior.
+                if (!autoRevoke)
+                    return;
+                // skip: brand-new user, no sessions can possibly exist yet. The
+                // initial passwordHash on a user:create would trip the second guard
+                // otherwise — every registration would do a mass-revoke roundtrip
+                // for a user who literally has no rows in user_sessions.
+                if (ctx.isNew)
+                    return;
+                // skip: handler didn't touch any revoke-triggering field
+                if (!REVOKE_TRIGGERING_FIELDS.some((field) => ctx.changes[field] !== undefined))
+                    return;
+                await autoRevoke(String(ctx.id));
+            },
         });
         const bindAutoRevokeOnPasswordChange = (revoker) => {
             // explicit constructor option wins over the runtime binding

package/dist/step-dispatcher/feature.js

@@ -34,7 +34,7 @@ export function createStepDispatcherFeature() {
             recommended: false,
         });
         r.envSchema(stepDispatcherEnvSchema);
-        r.requires("secrets");
+        r.requires({ features: ["secrets"] });
         // Literal name: the few-shot corpus parser only reads string-literal job names.
         // StepDispatcherJobNames.deliver mirrors it; feature.boot.test.ts pins the two together.
         r.job("deliver", {

package/dist/subscription-mollie/feature.js

@@ -102,7 +102,7 @@ export function createSubscriptionMollieFeature(options) {
             category: "billing",
             recommended: false,
         });
-        r.requires("billing-foundation");
+        r.requires({ features: ["billing-foundation"] });
         r.envSchema(subscriptionMollieEnvSchema);
         const plugin = {
             verifyAndParseWebhook: verifyAndParse,

package/dist/subscription-stripe/feature.js

@@ -93,9 +93,9 @@ export function createSubscriptionStripeFeature(options = {}) {
         // Hard-deps: billing-foundation (plugin-host) + config (billing-live +
         // backing:"secrets" credentials) + secrets (the store the backing:secrets
         // dispatch reads/writes + its tenant_secrets table).
-        r.requires("billing-foundation");
-        r.requires("config");
-        r.requires("secrets");
+        r.requires({ features: ["billing-foundation"] });
+        r.requires({ features: ["config"] });
+        r.requires({ features: ["secrets"] });
         r.envSchema(subscriptionStripeEnvSchema);
         // Runtime config. api-key + webhook-secret declare backing:"secrets" —
         // the value lives envelope-encrypted in the secrets store under

package/dist/tags/feature.js

@@ -41,8 +41,8 @@ function registerTags(r, access, toggleable, ownership, parents) {
     if (toggleable !== undefined)
         r.toggleable(toggleable);
     const tagAssignmentEntity = createTagAssignmentEntity(ownership, parents);
-    r.entity("tag", tagEntity);
-    r.entity("tag-assignment", tagAssignmentEntity);
+    r.entity({ name: "tag", ...tagEntity });
+    r.entity({ name: "tag-assignment", ...tagAssignmentEntity });
     r.writeHandler(createCreateTagHandler(access));
     r.writeHandler(createUpdateTagHandler(access));
     r.writeHandler(createDeleteTagHandler(access));

package/dist/template-resolver/compile-document-body.js

@@ -1,8 +1,8 @@
 import { isOneOf } from "@cosmicdrift/kumiko-types/type-guards";
 import { isResourceImageContentType } from "../shared/index.js";
 import { rewriteStepsBlock } from "./compile-steps-block.js";
-import { withParsedDocument } from "./document-sanitizer.js";
-import { DOCUMENT_TEXT_ALIGNMENTS, isAllowedDocumentLinkHref, isDocumentPlaceholderHref, isDocumentReferenceName, isDocumentResourceKey, } from "./document-schema.js";
+import { conditionScopeElement, withParsedDocument } from "./document-sanitizer.js";
+import { DOCUMENT_CONDITION_ATTRIBUTE, DOCUMENT_TEXT_ALIGNMENTS, isAllowedDocumentLinkHref, isDocumentPlaceholderHref, isDocumentReferenceName, isDocumentResourceKey, } from "./document-schema.js";
 // Private-use characters mark where a Handlebars expression goes. Author text
 // is scrubbed of them first and every `{`/`}` is entity-encoded before the
 // markers are swapped for real expressions, so the only Handlebars syntax in
@@ -34,19 +34,24 @@ function resolveReference(name, scope, variables) {
     }
     return { path: scope === null ? name : `@root.${name}`, def: ownVariable(variables, name) };
 }
-function valueExpression(path, def) {
+// The sanitized rich text value always consists of blocks; inside a line of
+// other text it renders inline so no paragraph ends up inside a paragraph.
+function valueExpression(path, def, isWholeBlock) {
     if (def?.type === "money")
         return `{{money ${path}}}`;
     if (def?.type === "date")
         return `{{date ${path}}}`;
-    if (def?.type === "richText")
-        return `{{richText ${path}}}`;
+    if (def?.type === "percent")
+        return `{{percent ${path}}}`;
+    if (def?.type === "richText") {
+        return isWholeBlock ? `{{richText ${path}}}` : `{{richText ${path} inline=true}}`;
+    }
     return `{{${path}}}`;
 }
 function rewriteVariable(element, state) {
     const name = element.getAttribute("data-variable") ?? "";
     const replacement = element.ownerDocument.createTextNode(isDocumentReferenceName(name)
-        ? marker(state, valueExpression(...pathAndDef(name, element, state)))
+        ? marker(state, valueExpression(...pathAndDef(name, element, state), state.blockRichTextSpans.has(element)))
         : "");
     element.replaceWith(replacement);
 }
@@ -76,10 +81,25 @@ function wrapVariableOnlyBlock(block, state) {
     // skip: a line with static content or several placeholders stays as it is
     if (name === null)
         return;
-    const [path] = pathAndDef(name, block, state);
-    const document = block.ownerDocument;
-    block.before(document.createTextNode(marker(state, `{{#if ${path} includeZero=true}}`)));
-    block.after(document.createTextNode(marker(state, "{{/if}}")));
+    const [path, def] = pathAndDef(name, block, state);
+    const host = def?.type === "richText" && block.tagName === "P" ? richTextBlockHost(block, state) : block;
+    const document = host.ownerDocument;
+    host.before(document.createTextNode(marker(state, `{{#if ${path} includeZero=true}}`)));
+    host.after(document.createTextNode(marker(state, "{{/if}}")));
+}
+// A paragraph cannot hold the paragraphs of a rich text value, a div can; it
+// keeps the paragraph's attributes so alignment and size still apply.
+function richTextBlockHost(paragraph, state) {
+    const host = paragraph.ownerDocument.createElement("div");
+    for (const attribute of Array.from(paragraph.attributes)) {
+        host.setAttribute(attribute.name, attribute.value ?? "");
+    }
+    for (const span of Array.from(paragraph.querySelectorAll("span[data-variable]"))) {
+        state.blockRichTextSpans.add(span);
+    }
+    host.append(...Array.from(paragraph.childNodes));
+    paragraph.replaceWith(host);
+    return host;
 }
 function rewriteLink(element, state) {
     const href = element.getAttribute("href") ?? "";
@@ -110,6 +130,19 @@ function rewriteRepeatRow(row, state) {
         row.removeAttribute("data-repeat-header");
     }
 }
+function rewriteConditionalBlock(block, state) {
+    const name = block.getAttribute(DOCUMENT_CONDITION_ATTRIBUTE) ?? "";
+    block.removeAttribute(DOCUMENT_CONDITION_ATTRIBUTE);
+    if (!isDocumentReferenceName(name)) {
+        block.remove();
+        // skip: a condition on a name that cannot be a variable never shows
+        return;
+    }
+    const [path] = pathAndDef(name, conditionScopeElement(block), state);
+    const document = block.ownerDocument;
+    block.before(document.createTextNode(marker(state, `{{#if ${path} includeZero=true}}`)));
+    block.after(document.createTextNode(marker(state, "{{/if}}")));
+}
 function stripActiveContent(element) {
     for (const attribute of Array.from(element.attributes)) {
         if (/^on/i.test(attribute.name))
@@ -223,7 +256,7 @@ function rewriteLinks(root, state, options) {
 // rewritten in document order; list rows last so their placeholders still see
 // the `tr[data-each]` ancestor.
 export function compileDocumentBodyToHandlebars(html, variables, options = {}) {
-    const state = { variables, expressions: [] };
+    const state = { variables, expressions: [], blockRichTextSpans: new Set() };
     const scrubbed = html.replaceAll(EXPRESSION_OPEN, "").replaceAll(EXPRESSION_CLOSE, "");
     const compiled = withParsedDocument(scrubbed, (root) => {
         stripScriptsAndActiveContent(root, options);
@@ -240,6 +273,9 @@ export function compileDocumentBodyToHandlebars(html, variables, options = {}) {
                 color: options.stepsColor,
             });
         }
+        for (const block of Array.from(root.querySelectorAll(`[${DOCUMENT_CONDITION_ATTRIBUTE}]`))) {
+            rewriteConditionalBlock(block, state);
+        }
         for (const block of Array.from(root.querySelectorAll(VARIABLE_ONLY_BLOCK_SELECTOR))) {
             wrapVariableOnlyBlock(block, state);
         }

package/dist/template-resolver/document-sanitizer.d.ts

@@ -24,9 +24,11 @@ export type SanitizeBodyResult = {
 export declare function violation(code: DocumentViolationCode, detail: string, message: string): DocumentViolation;
 export declare function withParsedDocument<T>(html: string, read: (body: ScanElement) => T): T;
 export declare function sanitizeDocumentHtml(html: string): SanitizeHtmlResult;
+export declare function flattenParagraphsToLineBreaks(sanitizedHtml: string): string;
 export declare function sanitizeTemplateBody(input: {
     readonly kind: string;
     readonly contentFormat: ContentFormat;
     readonly content: string | null;
 }): SanitizeBodyResult;
 export declare function documentViolationsToFieldIssues(violations: readonly DocumentViolation[]): FieldIssue[];
+export declare function conditionScopeElement(block: ScanElement): ScanElement;

package/dist/template-resolver/document-sanitizer.js

@@ -2,7 +2,7 @@ import { isOneOf } from "@cosmicdrift/kumiko-types/type-guards";
 import { generateHTML, generateJSON } from "@tiptap/html/server";
 import { Window } from "happy-dom";
 import { DOCUMENT_HTML_KINDS } from "./constants.js";
-import { documentExtensions, isAllowedDocumentLinkHref, isDocumentPlaceholderHref, isDocumentReferenceName, isDocumentResourceKey, } from "./document-schema.js";
+import { DOCUMENT_CONDITION_ATTRIBUTE, documentExtensions, isAllowedDocumentLinkHref, isDocumentPlaceholderHref, isDocumentReferenceName, isDocumentResourceKey, } from "./document-schema.js";
 import { isDocumentStepKey } from "./document-steps.js";
 export function violation(code, detail, message) {
     return { code, detail, message };
@@ -56,6 +56,7 @@ function scanImage(element, out) {
 const REFERENCE_ATTRIBUTES = [
     ["data-variable", isDocumentReferenceName],
     ["data-each", isDocumentReferenceName],
+    [DOCUMENT_CONDITION_ATTRIBUTE, isDocumentReferenceName],
     ["data-resource", isDocumentResourceKey],
     ["data-steps", isDocumentReferenceName],
     ["data-step", isDocumentStepKey],
@@ -155,6 +156,15 @@ export function sanitizeDocumentHtml(html) {
         html: generateHTML(generateJSON(html, documentExtensions), documentExtensions),
     };
 }
+// For a sanitized value placed inside a line of text: paragraphs become line
+// breaks. Other blocks (lists, headings) cannot be made inline and stay as they are.
+export function flattenParagraphsToLineBreaks(sanitizedHtml) {
+    return withParsedDocument(sanitizedHtml, (body) => {
+        const blocks = Array.from(body.children);
+        const isParagraphsOnly = blocks.length === body.childNodes.length && blocks.every((block) => block.tagName === "P");
+        return isParagraphsOnly ? blocks.map((block) => block.innerHTML).join("<br>") : sanitizedHtml;
+    });
+}
 // Snippets accept any format, but their html is as untrusted as a mail body.
 function isSanitizedHtmlKind(kind) {
     return kind === "snippet" || isOneOf(DOCUMENT_HTML_KINDS, kind);
@@ -202,3 +212,8 @@ export function documentViolationsToFieldIssues(violations) {
         params: { detail: item.detail },
     }));
 }
+// A repeat row's own data-if is decided per list, outside the row's item scope,
+// because the compiled {{#if}} lands outside its {{#each}}.
+export function conditionScopeElement(block) {
+    return block.matches("tr[data-each]") ? (block.parentElement ?? block) : block;
+}

package/dist/template-resolver/document-schema.d.ts

@@ -19,4 +19,6 @@ export declare const DOCUMENT_TEXT_ALIGNMENTS: readonly ["left", "center", "righ
 export type DocumentTextAlignment = (typeof DOCUMENT_TEXT_ALIGNMENTS)[number];
 export declare const DocumentTextAlign: Extension<any, any>;
 export declare const DocumentTextSize: Extension<any, any>;
+export declare const DOCUMENT_CONDITION_ATTRIBUTE = "data-if";
+export declare const DocumentCondition: Extension<any, any>;
 export declare const documentExtensions: Extensions;