@cosmicdrift/kumiko-bundled-features 0.374.0 → 0.378.0

package/dist/template-resolver/handlers/upsert-tenant.write.js

@@ -1,5 +1,6 @@
 import { defineWriteHandler } from "@cosmicdrift/kumiko-framework/engine";
 import * as z from "zod";
+import { refuseTemplateEdit, templateEditAccess, } from "../template-edit-policy.js";
 import { resolveTemplateVariables } from "../template-validation.js";
 import { upsertPayloadSchema } from "./shared.js";
 import { writeTemplateRow } from "./template-write.js";
@@ -8,27 +9,32 @@ import { writeTemplateRow } from "./template-write.js";
 // via publish-Handler. SystemAdmin kann via tenantIdOverride für
 // einen anderen Tenant schreiben (typisch: Plattform-Admin-UI das
 // Tenant-Templates kuratiert).
-export const upsertTenantWrite = defineWriteHandler({
-    name: "upsert-tenant",
-    schema: upsertPayloadSchema.extend({
-        tenantIdOverride: z.string().min(1).optional(),
-        status: z.enum(["draft", "active"]).default("draft"),
-    }),
-    access: { roles: ["TenantAdmin", "SystemAdmin"] },
-    description: "Creates or overwrites a tenant-scoped template override with its variable schema, landing as a draft that only publish makes live (over an active override the draft is stored beside it, the active version keeps being served until publish); it refuses a system-tenant target, which is what upsert-system is for.",
-    handler: async (event, ctx) => {
-        // @cast-boundary engine-payload — override aus Zod-parsed string,
-        // event.user.tenantId schon TenantId-branded; union als TenantId casten
-        // ist legit (override ist UUID-Format-validiert in schema).
-        const tenantId = (event.payload.tenantIdOverride ?? event.user.tenantId);
-        return writeTemplateRow({
-            ctx,
-            user: event.user,
-            tenantId,
-            scope: "tenant",
-            status: event.payload.status,
-            variables: resolveTemplateVariables(ctx.registry, event.payload.slug, event.payload.variableSchema),
-            payload: event.payload,
-        });
-    },
-});
+export function makeUpsertTenantWrite(policy) {
+    return defineWriteHandler({
+        name: "upsert-tenant",
+        schema: upsertPayloadSchema.extend({
+            tenantIdOverride: z.string().min(1).optional(),
+            status: z.enum(["draft", "active"]).default("draft"),
+        }),
+        access: templateEditAccess(policy.tenantEditable),
+        description: "Creates or overwrites a tenant-scoped template override with its variable schema, landing as a draft that only publish makes live (over an active override the draft is stored beside it, the active version keeps being served until publish); it refuses a system-tenant target, which is what upsert-system is for; a TenantAdmin may write it only for templates the app lists in tenantEditable, otherwise SystemAdmin only.",
+        handler: async (event, ctx) => {
+            const refused = refuseTemplateEdit(policy, event.user, event.payload);
+            if (refused !== null)
+                return refused;
+            // @cast-boundary engine-payload — override is a zod-validated string and
+            // event.user.tenantId is already TenantId-branded; forTenant rejects the
+            // override for non-SystemAdmins.
+            const tenantId = (event.payload.tenantIdOverride ?? event.user.tenantId);
+            return writeTemplateRow({
+                ctx,
+                user: event.user,
+                tenantId,
+                scope: "tenant",
+                status: event.payload.status,
+                variables: resolveTemplateVariables(ctx.registry, event.payload.slug, event.payload.variableSchema),
+                payload: event.payload,
+            });
+        },
+    });
+}

package/dist/template-resolver/handlers/validate.query.d.ts

@@ -12,12 +12,18 @@ type TemplateDraftInput = {
     readonly locale?: string | undefined;
     readonly scope: TemplateWriteScope;
 };
+export declare function knownResourceKeysFor(ctx: HandlerContext, user: SessionUser, where: {
+    readonly slug: string;
+    readonly kind: string;
+    readonly scope: TemplateWriteScope;
+    readonly locale: string | undefined;
+}): Promise<string[]>;
 export declare function validateTemplateDraft(ctx: HandlerContext, user: SessionUser, payload: TemplateDraftInput): Promise<{
     response: {
         canSave: boolean;
         canPublish: boolean;
-        issues: import("@cosmicdrift/kumiko-headless").FieldIssue[];
-        publishIssues: import("@cosmicdrift/kumiko-headless").FieldIssue[];
+        issues: import("@cosmicdrift/kumiko-framework/errors").FieldIssue[];
+        publishIssues: import("@cosmicdrift/kumiko-framework/errors").FieldIssue[];
         used: string[];
         unknown: string[];
         missingRequired: string[];
@@ -58,8 +64,8 @@ export declare const validateQuery: import("@cosmicdrift/kumiko-types/define-han
 }, z.core.$strip>, {
     canSave: boolean;
     canPublish: boolean;
-    issues: import("@cosmicdrift/kumiko-headless").FieldIssue[];
-    publishIssues: import("@cosmicdrift/kumiko-headless").FieldIssue[];
+    issues: import("@cosmicdrift/kumiko-framework/errors").FieldIssue[];
+    publishIssues: import("@cosmicdrift/kumiko-framework/errors").FieldIssue[];
     used: string[];
     unknown: string[];
     missingRequired: string[];

package/dist/template-resolver/handlers/validate.query.js

@@ -18,13 +18,10 @@ async function knownResourceKeys(db, where) {
     });
     return rows.flatMap((row) => imageResourceKeysOf(row.linkedResources));
 }
-// The dry run of the write pipeline; preview feeds on the evaluation, validate returns the response.
-export async function validateTemplateDraft(ctx, user, payload) {
-    const variables = resolveTemplateVariables(ctx.registry, payload.slug, payload.variableSchema);
-    const { slug, kind, locale } = payload;
-    // The dry run must not promise what the caller's write handlers would refuse.
-    const scope = isSystemAdmin(user) ? payload.scope : "tenant";
-    const known = [
+// Image keys the editor may reference: the system rows plus, for a tenant write, the caller's own.
+export async function knownResourceKeysFor(ctx, user, where) {
+    const { slug, kind, scope, locale } = where;
+    return [
         ...(await knownResourceKeys(ctx.db, {
             tenantId: SYSTEM_TENANT_ID,
             slug,
@@ -36,6 +33,14 @@ export async function validateTemplateDraft(ctx, user, payload) {
             ? await knownResourceKeys(ctx.db, { tenantId: user.tenantId, slug, kind, scope, locale })
             : []),
     ];
+}
+// The dry run of the write pipeline; preview feeds on the evaluation, validate returns the response.
+export async function validateTemplateDraft(ctx, user, payload) {
+    const variables = resolveTemplateVariables(ctx.registry, payload.slug, payload.variableSchema);
+    const { slug, kind, locale } = payload;
+    // The dry run must not promise what the caller's write handlers would refuse.
+    const scope = isSystemAdmin(user) ? payload.scope : "tenant";
+    const known = await knownResourceKeysFor(ctx, user, { slug, kind, scope, locale });
     const evaluation = evaluateTemplateWrite({
         kind,
         scope,

package/dist/template-resolver/index.d.ts

@@ -1,9 +1,10 @@
+export { isResourceImageContentType } from "../shared/index.ts";
 export { createTemplateResolverApi, type ResolveRequest, requireTemplateResolver, TemplateNotFoundError, type TemplateResolverApi, type TemplateResource, } from "./api.ts";
-export { type CompileDocumentBodyOptions, collectDocumentResourceKeys, compileDocumentBodyToHandlebars, toResourceDataUri, } from "./compile-document-body.ts";
+export { type CompileDocumentBodyOptions, collectDocumentImageVariables, collectDocumentResourceKeys, compileDocumentBodyToHandlebars, toResourceDataUri, } from "./compile-document-body.ts";
 export { CONTENT_FORMATS, type ContentFormat, DEFAULT_MAIL_LAYOUT_SLUG, DEFAULT_PDF_LAYOUT_SLUG, DOCUMENT_HTML_KINDS, type DocumentHtmlKind, FALLBACK_LOCALE, NON_RENDER_KINDS, type NonRenderKind, PDF_DEFAULT_MARGIN_MM, PDF_FOOTER_MARGIN_MM, PDF_HEADER_MARGIN_MM, PDF_ORIENTATIONS, PDF_PAGE_FORMATS, type PdfOrientation, type PdfPageFormat, RENDER_KINDS, type RenderKind, SYSTEM_TENANT_ID, TEMPLATE_KINDS, TEMPLATE_SCOPES, TEMPLATE_STATUSES, TEXT_BLOCK_KIND, type TemplateKind, type TemplateScope, type TemplateStatus, UPSERT_KINDS, type UpsertKind, } from "./constants.ts";
 export { type DocumentViolation, type DocumentViolationCode, documentViolationsToFieldIssues, flattenParagraphsToLineBreaks, type SanitizeBodyResult, type SanitizeHtmlResult, sanitizeDocumentHtml, sanitizeTemplateBody, } from "./document-sanitizer.ts";
 export { DOCUMENT_CONDITION_ATTRIBUTE, DOCUMENT_NODE_NAMES, DOCUMENT_TEXT_ALIGNMENTS, DocumentButton, DocumentCondition, DocumentDivider, DocumentLink, DocumentPageBreak, DocumentResource, DocumentTable, DocumentTableCell, DocumentTableHeader, DocumentTableRow, DocumentTextAlign, type DocumentTextAlignment, DocumentVariable, documentExtensions, isAllowedDocumentLinkHref, isDocumentPlaceholderHref, isDocumentReferenceName, isDocumentResourceKey, } from "./document-schema.ts";
-export { createTemplateResolverFeature } from "./feature.ts";
+export { createTemplateResolverFeature, type TemplateResolverOptions } from "./feature.ts";
 export type { LayoutSourceResponse, LayoutSourceRow } from "./handlers/layout-source.query.ts";
 export type { OverviewKindGroup, OverviewOrigin, OverviewResponse, OverviewRow, OverviewUsage, } from "./handlers/overview.query.ts";
 export { localeSchema } from "./handlers/shared.ts";
@@ -16,6 +17,7 @@ export { mapRecordToVariables } from "./record-mapping.ts";
 export { type PreparedTemplateImage, prepareTemplateResourceBeforeTransaction, readTemplateResourceMaxBytes, type StoredTemplateResource, storePreparedTemplateResource, } from "./store-template-resource.ts";
 export { type TemplateResourceRow, templateResourceEntity, templateResourcesTable, } from "./table.ts";
 export { type TemplateBundle, templateBundleSchema } from "./template-bundle.ts";
+export { type TemplateEditPolicy, type TenantEditableTemplate, templateEditAccess, } from "./template-edit-policy.ts";
 export { isMailTemplateMeta, type LayoutTemplateMeta, MAIL_CATEGORIES, MAIL_TONES, type MailCategory, type MailLayoutMeta, type MailTemplateMeta, type MailTone, type PdfTemplateMeta, parseTemplateMeta, pdfAttachmentFileNamePatternSchema, readMailLayoutMeta, readPdfTemplateMeta, type TemplateMeta, type TemplateMetaIssue, type TemplateMetaResult, templateSlugSchema, } from "./template-meta.ts";
 export { type DocumentDraftOutcome, evaluateDocumentDraft } from "./template-preview.ts";
 export { readTemplateResource, type TemplateResourceFile } from "./template-resources.ts";

package/dist/template-resolver/index.js

@@ -1,5 +1,6 @@
+export { isResourceImageContentType } from "../shared/index.js";
 export { createTemplateResolverApi, requireTemplateResolver, TemplateNotFoundError, } from "./api.js";
-export { collectDocumentResourceKeys, compileDocumentBodyToHandlebars, toResourceDataUri, } from "./compile-document-body.js";
+export { collectDocumentImageVariables, collectDocumentResourceKeys, compileDocumentBodyToHandlebars, toResourceDataUri, } from "./compile-document-body.js";
 export { CONTENT_FORMATS, DEFAULT_MAIL_LAYOUT_SLUG, DEFAULT_PDF_LAYOUT_SLUG, DOCUMENT_HTML_KINDS, FALLBACK_LOCALE, NON_RENDER_KINDS, PDF_DEFAULT_MARGIN_MM, PDF_FOOTER_MARGIN_MM, PDF_HEADER_MARGIN_MM, PDF_ORIENTATIONS, PDF_PAGE_FORMATS, RENDER_KINDS, SYSTEM_TENANT_ID, TEMPLATE_KINDS, TEMPLATE_SCOPES, TEMPLATE_STATUSES, TEXT_BLOCK_KIND, UPSERT_KINDS, } from "./constants.js";
 export { documentViolationsToFieldIssues, flattenParagraphsToLineBreaks, sanitizeDocumentHtml, sanitizeTemplateBody, } from "./document-sanitizer.js";
 export { DOCUMENT_CONDITION_ATTRIBUTE, DOCUMENT_NODE_NAMES, DOCUMENT_TEXT_ALIGNMENTS, DocumentButton, DocumentCondition, DocumentDivider, DocumentLink, DocumentPageBreak, DocumentResource, DocumentTable, DocumentTableCell, DocumentTableHeader, DocumentTableRow, DocumentTextAlign, DocumentVariable, documentExtensions, isAllowedDocumentLinkHref, isDocumentPlaceholderHref, isDocumentReferenceName, isDocumentResourceKey, } from "./document-schema.js";
@@ -14,6 +15,7 @@ export { mapRecordToVariables } from "./record-mapping.js";
 export { prepareTemplateResourceBeforeTransaction, readTemplateResourceMaxBytes, storePreparedTemplateResource, } from "./store-template-resource.js";
 export { templateResourceEntity, templateResourcesTable, } from "./table.js";
 export { templateBundleSchema } from "./template-bundle.js";
+export { templateEditAccess, } from "./template-edit-policy.js";
 export { isMailTemplateMeta, MAIL_CATEGORIES, MAIL_TONES, parseTemplateMeta, pdfAttachmentFileNamePatternSchema, readMailLayoutMeta, readPdfTemplateMeta, templateSlugSchema, } from "./template-meta.js";
 export { evaluateDocumentDraft } from "./template-preview.js";
 export { readTemplateResource } from "./template-resources.js";

package/dist/template-resolver/{web/placeholder-text.js → placeholder-text.js}

@@ -1,4 +1,4 @@
-import { isDocumentReferenceName } from "../document-schema.js";
+import { isDocumentReferenceName } from "./document-schema.js";
 const PLACEHOLDER_TOKEN = /\{\{([^{}]*)\}\}/g;
 // Names the schema refuses stay plain text, so a typo never becomes a chip
 // that the server would reject.

package/dist/template-resolver/qualified-names.d.ts

@@ -17,6 +17,7 @@ export declare const TemplateResolverHandlers: {
     readonly resourceRemove: "template-resolver:write:resource-remove";
     readonly resourceLinkPdf: "template-resolver:write:resource-link-pdf";
     readonly sendTest: "template-resolver:write:send-test";
+    readonly patchDraft: "template-resolver:write:patch-draft";
 };
 export declare const TemplateResolverQueries: {
     readonly findById: "template-resolver:query:find-by-id";
@@ -28,7 +29,9 @@ export declare const TemplateResolverQueries: {
     readonly diffToSystem: "template-resolver:query:diff-to-system";
     readonly validate: "template-resolver:query:validate";
     readonly preview: "template-resolver:query:preview";
+    readonly documentBlocks: "template-resolver:query:document-blocks";
     readonly exportBundle: "template-resolver:query:export-bundle";
+    readonly sendTestStatus: "template-resolver:query:send-test-status";
     readonly bySlug: "template-resolver:query:by-slug";
     readonly byTenant: "template-resolver:query:by-tenant";
 };
@@ -45,6 +48,7 @@ export declare const TemplateResolverErrors: {
     readonly targetExists: "target_exists";
     readonly systemResourcesNeedSystemTenant: "system_resources_need_system_tenant";
     readonly systemOnlyTemplate: "system_only_template";
+    readonly templateNotTenantEditable: "template_not_tenant_editable";
     readonly bundleLocalesDiffer: "bundle_locales_differ";
     readonly resourceTooLarge: "template_resource_too_large";
     readonly resourceUnsupportedImage: "template_resource_unsupported_image";

package/dist/template-resolver/qualified-names.js

@@ -19,6 +19,7 @@ export const TemplateResolverHandlers = {
     resourceRemove: "template-resolver:write:resource-remove",
     resourceLinkPdf: "template-resolver:write:resource-link-pdf",
     sendTest: "template-resolver:write:send-test",
+    patchDraft: "template-resolver:write:patch-draft",
 };
 export const TemplateResolverQueries = {
     findById: "template-resolver:query:find-by-id",
@@ -30,7 +31,9 @@ export const TemplateResolverQueries = {
     diffToSystem: "template-resolver:query:diff-to-system",
     validate: "template-resolver:query:validate",
     preview: "template-resolver:query:preview",
+    documentBlocks: "template-resolver:query:document-blocks",
     exportBundle: "template-resolver:query:export-bundle",
+    sendTestStatus: "template-resolver:query:send-test-status",
     // Public pair — anonymous-reachable, kind pinned to text-block.
     bySlug: "template-resolver:query:by-slug",
     byTenant: "template-resolver:query:by-tenant",
@@ -56,6 +59,7 @@ export const TemplateResolverErrors = {
     targetExists: "target_exists",
     systemResourcesNeedSystemTenant: "system_resources_need_system_tenant",
     systemOnlyTemplate: "system_only_template",
+    templateNotTenantEditable: "template_not_tenant_editable",
     bundleLocalesDiffer: "bundle_locales_differ",
     resourceTooLarge: "template_resource_too_large",
     resourceUnsupportedImage: "template_resource_unsupported_image",

package/dist/template-resolver/seeding.d.ts

@@ -15,6 +15,7 @@ export type SeedSystemTemplateOptions = {
      *  system admin uploaded through resource-upload. */
     readonly linkedResources?: Record<string, string>;
     readonly meta?: unknown;
+    readonly title?: string;
     readonly parentTemplateId?: string | null;
     readonly by?: SessionUser;
     readonly ifExists?: SeedIfExists;

package/dist/template-resolver/seeding.js

@@ -81,7 +81,7 @@ export async function seedSystemTemplate(db, opts) {
         variableSchema,
         ...(linkedResources !== undefined && { linkedResources }),
         meta,
-        title: null,
+        title: opts.title ?? null,
         folder: null,
         scope: "system",
         parentTemplateId,
@@ -171,6 +171,7 @@ export async function seedSystemTemplateBundle(db, bundle, opts = {}) {
             contentFormat: bundle.contentFormat,
             variableSchema: bundle.variableSchema ?? {},
             meta: entry.meta,
+            ...(entry.title !== undefined ? { title: entry.title } : {}),
             ...(opts.by !== undefined ? { by: opts.by } : {}),
             ...(opts.ifExists !== undefined ? { ifExists: opts.ifExists } : {}),
         });

package/dist/template-resolver/table.d.ts

@@ -14,7 +14,7 @@ export declare const templateResourceEntity: import("@cosmicdrift/kumiko-types/f
         readonly sensitive?: boolean;
         readonly writeOnly?: boolean;
         readonly readAsInstruction?: boolean;
-        readonly format?: "email" | "url" | "phone" | "password";
+        readonly format?: "email" | "url" | "phone" | "password" | "month";
         readonly default?: string;
         readonly access?: import("@cosmicdrift/kumiko-types/fields").FieldAccess;
         readonly multiline?: boolean | {
@@ -66,7 +66,7 @@ export declare const templateResourceEntity: import("@cosmicdrift/kumiko-types/f
         readonly sensitive?: boolean;
         readonly writeOnly?: boolean;
         readonly readAsInstruction?: boolean;
-        readonly format?: "email" | "url" | "phone" | "password";
+        readonly format?: "email" | "url" | "phone" | "password" | "month";
         readonly default?: string;
         readonly access?: import("@cosmicdrift/kumiko-types/fields").FieldAccess;
         readonly multiline?: boolean | {
@@ -89,7 +89,7 @@ export declare const templateResourceEntity: import("@cosmicdrift/kumiko-types/f
         readonly sensitive?: boolean;
         readonly writeOnly?: boolean;
         readonly readAsInstruction?: boolean;
-        readonly format?: "email" | "url" | "phone" | "password";
+        readonly format?: "email" | "url" | "phone" | "password" | "month";
         readonly default?: string;
         readonly access?: import("@cosmicdrift/kumiko-types/fields").FieldAccess;
         readonly multiline?: boolean | {
@@ -112,7 +112,7 @@ export declare const templateResourceEntity: import("@cosmicdrift/kumiko-types/f
         readonly sensitive?: boolean;
         readonly writeOnly?: boolean;
         readonly readAsInstruction?: boolean;
-        readonly format?: "email" | "url" | "phone" | "password";
+        readonly format?: "email" | "url" | "phone" | "password" | "month";
         readonly default?: string;
         readonly access?: import("@cosmicdrift/kumiko-types/fields").FieldAccess;
         readonly multiline?: boolean | {
@@ -245,7 +245,7 @@ export declare const templateResourceEntity: import("@cosmicdrift/kumiko-types/f
         readonly sensitive?: boolean;
         readonly writeOnly?: boolean;
         readonly readAsInstruction?: boolean;
-        readonly format?: "email" | "url" | "phone" | "password";
+        readonly format?: "email" | "url" | "phone" | "password" | "month";
         readonly default?: string;
         readonly access?: import("@cosmicdrift/kumiko-types/fields").FieldAccess;
         readonly multiline?: boolean | {
@@ -343,7 +343,7 @@ export declare const templateResourcesTable: import("@cosmicdrift/kumiko-framewo
         readonly sensitive?: boolean;
         readonly writeOnly?: boolean;
         readonly readAsInstruction?: boolean;
-        readonly format?: "email" | "url" | "phone" | "password";
+        readonly format?: "email" | "url" | "phone" | "password" | "month";
         readonly default?: string;
         readonly access?: import("@cosmicdrift/kumiko-types/fields").FieldAccess;
         readonly multiline?: boolean | {
@@ -395,7 +395,7 @@ export declare const templateResourcesTable: import("@cosmicdrift/kumiko-framewo
         readonly sensitive?: boolean;
         readonly writeOnly?: boolean;
         readonly readAsInstruction?: boolean;
-        readonly format?: "email" | "url" | "phone" | "password";
+        readonly format?: "email" | "url" | "phone" | "password" | "month";
         readonly default?: string;
         readonly access?: import("@cosmicdrift/kumiko-types/fields").FieldAccess;
         readonly multiline?: boolean | {
@@ -418,7 +418,7 @@ export declare const templateResourcesTable: import("@cosmicdrift/kumiko-framewo
         readonly sensitive?: boolean;
         readonly writeOnly?: boolean;
         readonly readAsInstruction?: boolean;
-        readonly format?: "email" | "url" | "phone" | "password";
+        readonly format?: "email" | "url" | "phone" | "password" | "month";
         readonly default?: string;
         readonly access?: import("@cosmicdrift/kumiko-types/fields").FieldAccess;
         readonly multiline?: boolean | {
@@ -441,7 +441,7 @@ export declare const templateResourcesTable: import("@cosmicdrift/kumiko-framewo
         readonly sensitive?: boolean;
         readonly writeOnly?: boolean;
         readonly readAsInstruction?: boolean;
-        readonly format?: "email" | "url" | "phone" | "password";
+        readonly format?: "email" | "url" | "phone" | "password" | "month";
         readonly default?: string;
         readonly access?: import("@cosmicdrift/kumiko-types/fields").FieldAccess;
         readonly multiline?: boolean | {
@@ -574,7 +574,7 @@ export declare const templateResourcesTable: import("@cosmicdrift/kumiko-framewo
         readonly sensitive?: boolean;
         readonly writeOnly?: boolean;
         readonly readAsInstruction?: boolean;
-        readonly format?: "email" | "url" | "phone" | "password";
+        readonly format?: "email" | "url" | "phone" | "password" | "month";
         readonly default?: string;
         readonly access?: import("@cosmicdrift/kumiko-types/fields").FieldAccess;
         readonly multiline?: boolean | {

package/dist/template-resolver/template-bundle.d.ts

@@ -19,6 +19,7 @@ export declare const templateBundleSchema: z.ZodObject<{
     locales: z.ZodRecord<z.ZodString, z.ZodObject<{
         body: z.ZodString;
         meta: z.ZodOptional<z.ZodUnknown>;
+        title: z.ZodOptional<z.ZodString>;
     }, z.core.$strict>>;
     resources: z.ZodDefault<z.ZodRecord<z.ZodString, z.ZodObject<{
         fileName: z.ZodString;

package/dist/template-resolver/template-bundle.js

@@ -33,7 +33,12 @@ const bundleResourceSchema = z
     .strict();
 const pdfAttachmentLinkBodySchema = templatePdfAttachmentLinkSchema.omit({ kind: true });
 const bundleLocaleEntrySchema = z
-    .object({ body: z.string().max(200_000), meta: z.unknown().optional() })
+    .object({
+    body: z.string().max(200_000),
+    meta: z.unknown().optional(),
+    // Shown in the template overview instead of the slug; one per locale, so it is translated.
+    title: z.string().min(1).max(200).optional(),
+})
     .strict();
 export const templateBundleSchema = z
     .object({

package/dist/template-resolver/template-edit-policy.d.ts

@@ -0,0 +1,22 @@
+import { type HandlerContext, type RoleAccessRule, type SessionUser } from "@cosmicdrift/kumiko-framework/engine";
+import { type WriteFailure } from "@cosmicdrift/kumiko-framework/errors";
+import type { TemplateKind } from "./constants.ts";
+export type TenantEditableTemplate = {
+    readonly kind: TemplateKind;
+    readonly slug: string;
+    readonly access: RoleAccessRule;
+};
+export type TemplateEditPolicy = {
+    readonly tenantEditable: readonly TenantEditableTemplate[];
+};
+type EditTarget = {
+    readonly slug: string;
+    readonly kind: string;
+};
+type EditUser = Pick<SessionUser, "roles">;
+export declare function templateEditAccess(entries: readonly TenantEditableTemplate[]): RoleAccessRule;
+export declare function mayEditTemplate(policy: TemplateEditPolicy, user: EditUser, target: EditTarget): boolean;
+export declare function refuseTemplateEdit(policy: TemplateEditPolicy, user: EditUser, target: EditTarget): WriteFailure | null;
+export declare function refuseMissingTemplate(policy: TemplateEditPolicy, user: EditUser): WriteFailure | null;
+export declare function refuseTemplateEditById(db: HandlerContext["db"], policy: TemplateEditPolicy, user: EditUser, tenantId: string, templateId: string): Promise<WriteFailure | null>;
+export {};

package/dist/template-resolver/template-edit-policy.js

@@ -0,0 +1,45 @@
+import { fetchOne } from "@cosmicdrift/kumiko-framework/db";
+import { hasAccess, } from "@cosmicdrift/kumiko-framework/engine";
+import { AccessDeniedError, writeFailure, } from "@cosmicdrift/kumiko-framework/errors";
+import { TemplateResolverErrors } from "./qualified-names.js";
+import { templateResourcesTable } from "./table.js";
+import { isSystemAdmin } from "./template-draft.js";
+const SYSTEM_ADMIN_ROLE = "SystemAdmin";
+export function templateEditAccess(entries) {
+    const roles = new Set([SYSTEM_ADMIN_ROLE]);
+    for (const entry of entries) {
+        for (const role of entry.access.roles)
+            roles.add(role);
+    }
+    return { roles: [...roles] };
+}
+export function mayEditTemplate(policy, user, target) {
+    if (isSystemAdmin(user))
+        return true;
+    const entry = policy.tenantEditable.find((candidate) => candidate.slug === target.slug && candidate.kind === target.kind);
+    return entry !== undefined && hasAccess(user, entry.access);
+}
+export function refuseTemplateEdit(policy, user, target) {
+    if (mayEditTemplate(policy, user, target))
+        return null;
+    return writeFailure(new AccessDeniedError({
+        i18nKey: "templateResolver.errors.templateNotTenantEditable",
+        details: { reason: TemplateResolverErrors.templateNotTenantEditable },
+    }));
+}
+// Fail closed: a missing row gives a non-SystemAdmin the same refusal as a locked one,
+// so the response never reveals whether an id exists. SystemAdmin keeps the 404.
+export function refuseMissingTemplate(policy, user) {
+    return isSystemAdmin(user) ? null : refuseTemplateEdit(policy, user, { slug: "", kind: "" });
+}
+export async function refuseTemplateEditById(db, policy, user, tenantId, templateId) {
+    if (isSystemAdmin(user))
+        return null;
+    const row = await fetchOne(db, templateResourcesTable, {
+        tenantId,
+        id: templateId,
+    });
+    return row === undefined
+        ? refuseMissingTemplate(policy, user)
+        : refuseTemplateEdit(policy, user, row);
+}

package/dist/template-resolver/template-preview.d.ts

@@ -1,4 +1,4 @@
-import type { HandlerContext, SessionUser, TemplateVariables } from "@cosmicdrift/kumiko-framework/engine";
+import { type HandlerContext, type SessionUser, type TemplateVariables } from "@cosmicdrift/kumiko-framework/engine";
 import { type KumikoError } from "@cosmicdrift/kumiko-framework/errors";
 import { type MailAttachmentRef } from "../renderer-foundation/index.ts";
 import { type TemplateScope } from "./constants.ts";
@@ -41,6 +41,8 @@ export type TemplatePreviewInput = {
     readonly content?: string | undefined;
     readonly meta?: unknown;
     readonly variableSchema: Readonly<Record<string, unknown>>;
+    /** Replaces the declared example values for the named variables. */
+    readonly variables?: Readonly<Record<string, unknown>> | undefined;
 };
 type ValidationResponse = Awaited<ReturnType<typeof validateTemplateDraft>>["response"];
 export type TemplatePreview = {
@@ -59,6 +61,7 @@ export type TemplatePreview = {
         readonly scope: TemplateScope;
         readonly version: number;
     } | null;
+    /** The values the preview was actually rendered with: examples plus any overrides. */
     readonly sampleValues: Readonly<Record<string, unknown>>;
     readonly checks: readonly PreviewCheck[];
     readonly validation: ValidationResponse;

package/dist/template-resolver/template-preview.js

@@ -1,8 +1,10 @@
 import { selectMany } from "@cosmicdrift/kumiko-framework/db";
-import { NotFoundError, UnprocessableError, ValidationError, } from "@cosmicdrift/kumiko-framework/errors";
+import { templateVariablesToZod, } from "@cosmicdrift/kumiko-framework/engine";
+import { NotFoundError, UnprocessableError, ValidationError, validationErrorFromZod, } from "@cosmicdrift/kumiko-framework/errors";
 import { fileRefsTable } from "@cosmicdrift/kumiko-framework/files";
 import { createI18n } from "@cosmicdrift/kumiko-framework/i18n";
-import { escapeHtml } from "@cosmicdrift/kumiko-headless";
+import { escapeHtml } from "@cosmicdrift/kumiko-renderer/headless";
+import * as z from "zod";
 import { createEmailAttachmentReader, createTemplateMailRenderer } from "../delivery/index.js";
 import { fileContextForTenant } from "../file-foundation/index.js";
 import { collectRendererPlugins, createRendererFoundationApi, RendererError, } from "../renderer-foundation/index.js";
@@ -62,12 +64,17 @@ function sampleList(def, labelText) {
         rows.push(sampleRow(def.item, labelText));
     return rows;
 }
+function sampleValueFor(name, def, labelText) {
+    // An images variable has no sample: file ids are record data, never preview content.
+    if (def.type === "images")
+        return [];
+    return def.type === "list" ? sampleList(def, labelText) : sampleScalar(name, def, labelText);
+}
 // Declared examples win; the fallbacks are deterministic so a preview never differs between calls.
 export function sampleValuesFor(variables, labelText = (label) => label) {
     const values = {};
     for (const [name, def] of Object.entries(variables)) {
-        values[name] =
-            def.type === "list" ? sampleList(def, labelText) : sampleScalar(name, def, labelText);
+        values[name] = sampleValueFor(name, def, labelText);
     }
     return values;
 }
@@ -413,7 +420,18 @@ export async function renderTemplatePreview(ctx, user, input) {
         return failed(new ValidationError({ fields: [...evaluation.issues] }));
     const content = evaluation.content ?? "";
     const meta = parseTemplateMeta(input.kind, parseStoredJson(evaluation.metaJson));
-    const sampleValues = sampleValuesFor(validation.variables, labelTextFor(ctx, input.locale));
+    const exampleValues = sampleValuesFor(validation.variables, labelTextFor(ctx, input.locale));
+    let sampleValues = exampleValues;
+    if (input.variables !== undefined) {
+        const overrides = z.object({
+            variables: templateVariablesToZod(validation.variables).partial().strict(),
+        });
+        const checked = overrides.safeParse({ variables: input.variables });
+        if (!checked.success)
+            return failed(validationErrorFromZod(checked.error));
+        // Original values, not the parse result: parsing would strip keys inside list rows.
+        sampleValues = { ...exampleValues, ...input.variables };
+    }
     if (input.kind === "document-pdf") {
         return renderDocumentPreview(ctx, user, {
             input,

package/dist/template-resolver/template-validation.d.ts

@@ -1,4 +1,4 @@
-import type { Registry, TemplateVariables } from "@cosmicdrift/kumiko-framework/engine";
+import type { Registry, TemplateVariableDef, TemplateVariables } from "@cosmicdrift/kumiko-framework/engine";
 import type { TemplateMeta } from "./template-meta.ts";
 export declare const SYSTEM_PLACEHOLDERS: ReadonlySet<string>;
 export declare function systemPlaceholdersFor(kind: string): ReadonlySet<string>;
@@ -9,6 +9,7 @@ export type TemplateValidation = {
     /** data-resource keys with no uploaded file; a warning, never a blocker. */
     readonly unknownResources: readonly string[];
 };
+export declare function toVariableDef(raw: unknown): TemplateVariableDef | null;
 export declare function resolveTemplateVariables(registry: Registry, slug: string, variableSchema: Readonly<Record<string, unknown>>): TemplateVariables;
 export declare function variablesFromSchema(variableSchema: Readonly<Record<string, unknown>>): TemplateVariables;
 export declare function validateTemplatePlaceholders(input: {

package/dist/template-resolver/template-validation.js

@@ -38,6 +38,7 @@ const scalarVariableSchema = z.discriminatedUnion("type", [
 ]);
 const variableDefSchema = z.union([
     scalarVariableSchema,
+    z.object({ ...variableCommon, type: z.literal("images") }),
     z.object({
         ...variableCommon,
         type: z.literal("list"),
@@ -48,7 +49,7 @@ const variableDefSchema = z.union([
 // A stored variableSchema value is either a bare string (legacy "this is a text
 // variable") or a TemplateVariableDef object; anything else is not declared and
 // therefore shows up as an unknown placeholder instead of being guessed at.
-function toVariableDef(raw) {
+export function toVariableDef(raw) {
     if (typeof raw === "string")
         return { type: "text" };
     const parsed = variableDefSchema.safeParse(raw);
@@ -74,7 +75,9 @@ function listItemFields(variables, listName) {
     const def = listName !== null && Object.hasOwn(variables, listName) ? variables[listName] : undefined;
     return def?.type === "list" ? def.item : {};
 }
-function isKnownName(name, scope, itemFields) {
+// An images variable holds file ids: as text it would leak them, so only an images block
+// (and a condition on its presence) may name it.
+function isKnownName(name, scope, itemFields, allowImages = false) {
     const { variables } = scope;
     const root = rootName(name);
     // Declared variables and item fields are scalars: a dotted path under one never renders a value.
@@ -82,12 +85,15 @@ function isKnownName(name, scope, itemFields) {
         return { known: true, used: "" };
     if (scope.systemPlaceholders.has(root))
         return { known: true, used: "" };
-    if (Object.hasOwn(variables, name))
-        return { known: true, used: name };
+    if (Object.hasOwn(variables, name)) {
+        return variables[name]?.type === "images" && !allowImages
+            ? { known: false, used: "" }
+            : { known: true, used: name };
+    }
     return { known: false, used: "" };
 }
-function recordName(name, itemFields, scope) {
-    const resolution = isKnownName(name, scope, itemFields);
+function recordName(name, itemFields, scope, allowImages = false) {
+    const resolution = isKnownName(name, scope, itemFields, allowImages);
     if (!resolution.known)
         scope.unknown.add(name);
     else if (resolution.used !== "")
@@ -96,10 +102,21 @@ function recordName(name, itemFields, scope) {
 function enclosingEachName(element) {
     return element.closest("tr[data-each]")?.getAttribute("data-each") ?? null;
 }
-const NAME_ATTRIBUTE_BY_TAG = {
-    span: "data-variable",
-    div: "data-steps",
-};
+function nameAttributeOf(element) {
+    const tag = element.tagName.toLowerCase();
+    if (tag === "span")
+        return "data-variable";
+    if (tag !== "div")
+        return undefined;
+    return element.hasAttribute("data-images") ? "data-images" : "data-steps";
+}
+function recordImagesName(name, scope) {
+    const def = Object.hasOwn(scope.variables, name) ? scope.variables[name] : undefined;
+    if (def?.type === "images")
+        scope.used.add(name);
+    else
+        scope.unknown.add(name);
+}
 function scanRepeatRows(root, scope) {
     for (const element of Array.from(root.querySelectorAll("tr[data-each]"))) {
         const listName = element.getAttribute("data-each") ?? "";
@@ -113,15 +130,18 @@ function scanRepeatRows(root, scope) {
 function scanConditions(root, scope) {
     for (const element of Array.from(root.querySelectorAll(`[${DOCUMENT_CONDITION_ATTRIBUTE}]`))) {
         const itemFields = listItemFields(scope.variables, enclosingEachName(conditionScopeElement(element)));
-        recordName(element.getAttribute(DOCUMENT_CONDITION_ATTRIBUTE) ?? "", itemFields, scope);
+        recordName(element.getAttribute(DOCUMENT_CONDITION_ATTRIBUTE) ?? "", itemFields, scope, true);
     }
 }
 function scanReferences(root, scope) {
-    for (const element of Array.from(root.querySelectorAll("span[data-variable], div[data-steps], a[href], img[data-resource]"))) {
+    for (const element of Array.from(root.querySelectorAll("span[data-variable], div[data-steps], div[data-images], a[href], img[data-resource]"))) {
         const itemFields = listItemFields(scope.variables, enclosingEachName(element));
         const tag = element.tagName.toLowerCase();
-        const nameAttribute = NAME_ATTRIBUTE_BY_TAG[tag];
-        if (nameAttribute !== undefined) {
+        const nameAttribute = nameAttributeOf(element);
+        if (nameAttribute === "data-images") {
+            recordImagesName(element.getAttribute(nameAttribute) ?? "", scope);
+        }
+        else if (nameAttribute !== undefined) {
             recordName(element.getAttribute(nameAttribute) ?? "", itemFields, scope);
         }
         else if (tag === "a") {