@cosmicdrift/kumiko-bundled-features 0.374.0 → 0.378.0

package/dist/personal-access-tokens/i18n.js

@@ -1,5 +1,5 @@
 import { ACTION_FORM_ENTITY } from "@cosmicdrift/kumiko-framework/ui-types";
-import { fieldLabelKey, fieldOptionLabelKey } from "@cosmicdrift/kumiko-headless";
+import { fieldLabelKey, fieldOptionLabelKey } from "@cosmicdrift/kumiko-renderer/headless";
 import { PAT_FEATURE } from "./constants.js";
 const mintFieldKey = (field) => fieldLabelKey(PAT_FEATURE, ACTION_FORM_ENTITY, field);
 const scopeOptionKey = (grant) => fieldOptionLabelKey(PAT_FEATURE, ACTION_FORM_ENTITY, "scopes", grant);

package/dist/personal-access-tokens/schema/api-token.d.ts

@@ -13,7 +13,7 @@ export declare const apiTokenEntity: import("@cosmicdrift/kumiko-types/fields").
         readonly sensitive?: boolean;
         readonly writeOnly?: boolean;
         readonly readAsInstruction?: boolean;
-        readonly format?: "email" | "url" | "phone" | "password";
+        readonly format?: "email" | "url" | "phone" | "password" | "month";
         readonly default?: string;
         readonly access?: import("@cosmicdrift/kumiko-types/fields").FieldAccess;
         readonly multiline?: boolean | {
@@ -36,7 +36,7 @@ export declare const apiTokenEntity: import("@cosmicdrift/kumiko-types/fields").
         readonly sensitive?: boolean;
         readonly writeOnly?: boolean;
         readonly readAsInstruction?: boolean;
-        readonly format?: "email" | "url" | "phone" | "password";
+        readonly format?: "email" | "url" | "phone" | "password" | "month";
         readonly default?: string;
         readonly access?: import("@cosmicdrift/kumiko-types/fields").FieldAccess;
         readonly multiline?: boolean | {
@@ -59,7 +59,7 @@ export declare const apiTokenEntity: import("@cosmicdrift/kumiko-types/fields").
         readonly sensitive?: boolean;
         readonly writeOnly?: boolean;
         readonly readAsInstruction?: boolean;
-        readonly format?: "email" | "url" | "phone" | "password";
+        readonly format?: "email" | "url" | "phone" | "password" | "month";
         readonly default?: string;
         readonly access?: import("@cosmicdrift/kumiko-types/fields").FieldAccess;
         readonly multiline?: boolean | {
@@ -82,7 +82,7 @@ export declare const apiTokenEntity: import("@cosmicdrift/kumiko-types/fields").
         readonly sensitive?: boolean;
         readonly writeOnly?: boolean;
         readonly readAsInstruction?: boolean;
-        readonly format?: "email" | "url" | "phone" | "password";
+        readonly format?: "email" | "url" | "phone" | "password" | "month";
         readonly default?: string;
         readonly access?: import("@cosmicdrift/kumiko-types/fields").FieldAccess;
         readonly multiline?: boolean | {
@@ -105,7 +105,7 @@ export declare const apiTokenEntity: import("@cosmicdrift/kumiko-types/fields").
         readonly sensitive?: boolean;
         readonly writeOnly?: boolean;
         readonly readAsInstruction?: boolean;
-        readonly format?: "email" | "url" | "phone" | "password";
+        readonly format?: "email" | "url" | "phone" | "password" | "month";
         readonly default?: string;
         readonly access?: import("@cosmicdrift/kumiko-types/fields").FieldAccess;
         readonly multiline?: boolean | {
@@ -128,7 +128,7 @@ export declare const apiTokenEntity: import("@cosmicdrift/kumiko-types/fields").
         readonly sensitive?: boolean;
         readonly writeOnly?: boolean;
         readonly readAsInstruction?: boolean;
-        readonly format?: "email" | "url" | "phone" | "password";
+        readonly format?: "email" | "url" | "phone" | "password" | "month";
         readonly default?: string;
         readonly access?: import("@cosmicdrift/kumiko-types/fields").FieldAccess;
         readonly multiline?: boolean | {

package/dist/personal-access-tokens/screens.js

@@ -1,6 +1,6 @@
 import { i18nKey, MAX_LIST_LIMIT, } from "@cosmicdrift/kumiko-framework/engine";
 import { ACTION_FORM_ENTITY } from "@cosmicdrift/kumiko-framework/ui-types";
-import { fieldOptionLabelKeyPrefix } from "@cosmicdrift/kumiko-headless";
+import { fieldOptionLabelKeyPrefix } from "@cosmicdrift/kumiko-renderer/headless";
 import { PAT_FEATURE, PAT_MINT_SCREEN_ID, PAT_SCREEN_ID, PatHandlers, PatQueries, } from "./constants.js";
 const PAT_STATUS_OPTION_KEY_PREFIX = "pat.list.status.";
 // Same keys the mint form's `scopes` multiSelect options resolve through

package/dist/secrets/feature.d.ts

@@ -26,7 +26,7 @@ export { type StoredEnvelope, type StoredMetadata, tenantSecretsTable } from "./
 export declare const JOIN_REQUEST_TRANSACTION_REASON = "the secret write runs on the request transaction so a failing batch rolls it back together with the config writes";
 export declare function requireSecretsContext(ctx: {
     readonly secrets?: SecretsContext;
-    readonly _userId?: string | undefined;
+    readonly auditUserId?: string | undefined;
     readonly user?: {
         readonly id: string;
     };

package/dist/secrets/feature.js

@@ -57,7 +57,7 @@ export const JOIN_REQUEST_TRANSACTION_REASON = "the secret write runs on the req
 // FileProviderContext-Pfade (S3-Plugin im Worker) liefern dieselben
 // zwei Felder, also reicht die schmale ctx-shape — kein voller
 // HandlerContext-Import noetig.
-// Handler contexts carry the caller as ctx.user, provider contexts set _userId (takes precedence).
+// Handler contexts carry the caller as ctx.user, provider contexts set auditUserId (takes precedence).
 export function requireSecretsContext(ctx, handlerName) {
     if (!ctx.secrets) {
         throw new InternalError({
@@ -65,10 +65,10 @@ export function requireSecretsContext(ctx, handlerName) {
                 "createSecretsContext({db, masterKeyProvider, registry}) via extraContext.secrets at boot.",
         });
     }
-    const userId = ctx._userId ?? ctx.user?.id;
+    const userId = ctx.auditUserId ?? ctx.user?.id;
     if (!userId) {
         throw new InternalError({
-            message: `[${handlerName}] ctx._userId missing (and no ctx.user) — cannot audit secret reads without a caller identity.`,
+            message: `[${handlerName}] ctx.auditUserId missing (and no ctx.user) — cannot audit secret reads without a caller identity.`,
         });
     }
     const withAudit = (raw) => ({

package/dist/secrets/table.d.ts

@@ -18,7 +18,7 @@ export declare const tenantSecretEntity: import("@cosmicdrift/kumiko-types/field
         readonly sensitive?: boolean;
         readonly writeOnly?: boolean;
         readonly readAsInstruction?: boolean;
-        readonly format?: "email" | "url" | "phone" | "password";
+        readonly format?: "email" | "url" | "phone" | "password" | "month";
         readonly default?: string;
         readonly access?: import("@cosmicdrift/kumiko-types/fields").FieldAccess;
         readonly multiline?: boolean | {

package/dist/seo/sitemap.js

@@ -1,4 +1,4 @@
-import { escapeXml } from "@cosmicdrift/kumiko-headless";
+import { escapeXml } from "@cosmicdrift/kumiko-renderer/headless";
 // Pure XML builder — sitemaps.org urlset + xhtml:link alternates. No
 // dedup/sort: callers control ordering, entries are trusted app/feature data
 // (see feature.ts's trust boundary — same posture as ApexCta.href).

package/dist/sessions/schema/user-session.d.ts

@@ -13,7 +13,7 @@ export declare const userSessionEntity: import("@cosmicdrift/kumiko-types/fields
         readonly sensitive?: boolean;
         readonly writeOnly?: boolean;
         readonly readAsInstruction?: boolean;
-        readonly format?: "email" | "url" | "phone" | "password";
+        readonly format?: "email" | "url" | "phone" | "password" | "month";
         readonly default?: string;
         readonly access?: import("@cosmicdrift/kumiko-types/fields").FieldAccess;
         readonly multiline?: boolean | {
@@ -36,7 +36,7 @@ export declare const userSessionEntity: import("@cosmicdrift/kumiko-types/fields
         readonly sensitive?: boolean;
         readonly writeOnly?: boolean;
         readonly readAsInstruction?: boolean;
-        readonly format?: "email" | "url" | "phone" | "password";
+        readonly format?: "email" | "url" | "phone" | "password" | "month";
         readonly default?: string;
         readonly access?: import("@cosmicdrift/kumiko-types/fields").FieldAccess;
         readonly multiline?: boolean | {
@@ -119,7 +119,7 @@ export declare const userSessionEntity: import("@cosmicdrift/kumiko-types/fields
         readonly sensitive?: boolean;
         readonly writeOnly?: boolean;
         readonly readAsInstruction?: boolean;
-        readonly format?: "email" | "url" | "phone" | "password";
+        readonly format?: "email" | "url" | "phone" | "password" | "month";
         readonly default?: string;
         readonly access?: import("@cosmicdrift/kumiko-types/fields").FieldAccess;
         readonly multiline?: boolean | {
@@ -142,7 +142,7 @@ export declare const userSessionEntity: import("@cosmicdrift/kumiko-types/fields
         readonly sensitive?: boolean;
         readonly writeOnly?: boolean;
         readonly readAsInstruction?: boolean;
-        readonly format?: "email" | "url" | "phone" | "password";
+        readonly format?: "email" | "url" | "phone" | "password" | "month";
         readonly default?: string;
         readonly access?: import("@cosmicdrift/kumiko-types/fields").FieldAccess;
         readonly multiline?: boolean | {

package/dist/shared/mail-template-body.js

@@ -1,4 +1,4 @@
-import { escapeHtml, escapeHtmlAttr } from "@cosmicdrift/kumiko-headless";
+import { escapeHtml, escapeHtmlAttr } from "@cosmicdrift/kumiko-renderer/headless";
 const SLOT_PATTERN = /\{([A-Za-z_][A-Za-z0-9_]*)\}/g;
 // Author text uses `{name}` slots. The text is escaped first and the slots are
 // swapped for variable nodes afterwards, so a slot can never smuggle markup.

package/dist/shared/purge-files-reaching-subject.js

@@ -1,7 +1,7 @@
 import { resolveSubjectForField, SubjectResolutionError, subjectIdToKey, } from "@cosmicdrift/kumiko-framework/crypto";
 import { createEventStoreExecutor, createTenantDb, selectMany, } from "@cosmicdrift/kumiko-framework/db";
-import { createSystemUser, parseTenantId, } from "@cosmicdrift/kumiko-framework/engine";
-import { fileRefEntity, fileRefsTable } from "@cosmicdrift/kumiko-framework/files";
+import { createSystemUser, parseTenantId, SYSTEM_USER_ID, } from "@cosmicdrift/kumiko-framework/engine";
+import { FILE_REF_ENTITY_NAME, fileRefEntity, fileRefsTable, } from "@cosmicdrift/kumiko-framework/files";
 import { collectSingleFileHolders, planFileFields, purgeRowFileRefs, } from "./purge-row-file-refs.js";
 // Callers' error labels read err.code, so audit events name the failure class.
 export class FileSweepError extends Error {
@@ -95,7 +95,8 @@ export async function purgeFilesReachingSubject(args) {
     const fileHolders = collectSingleFileHolders(registry);
     const storageByTenant = new Map();
     let firstFailure;
-    for (const fileEntity of collectFileEntities(registry)) {
+    const fileEntities = collectFileEntities(registry);
+    for (const fileEntity of fileEntities) {
         const seenRowIds = new Set();
         for (const where of candidateWheres(subject, recordTenantId, fileEntity)) {
             const rows = await selectMany(db, fileEntity.table, where);
@@ -141,6 +142,100 @@ export async function purgeFilesReachingSubject(args) {
             }
         }
     }
+    // Runs even after an entity-sweep failure: one failed row must not leave the pending uploads.
+    const pendingFailure = await purgePendingUploadsOfUser({
+        db,
+        registry,
+        subject,
+        fileFieldKeys: pendingFieldKeys(fileEntities),
+        fileHolders,
+        storageByTenant,
+        resolveDeleteBytes,
+        missingStorage,
+    });
+    firstFailure ??= pendingFailure;
     if (firstFailure)
         throw firstFailure;
 }
+const pendingFieldKey = (entityType, fieldName) => `${entityType}\u0000${fieldName}`;
+function pendingFieldKeys(fileEntities) {
+    const keys = new Set();
+    for (const { entityName, fileFields } of fileEntities) {
+        for (const fieldName of fileFields)
+            keys.add(pendingFieldKey(entityName, fieldName));
+    }
+    return keys;
+}
+async function isFileRefHeldByRecord(db, holders, tenantId, fileRefId) {
+    for (const holder of holders) {
+        for (const field of holder.singleFields) {
+            const where = { [field]: fileRefId };
+            if (holder.tableHasTenantId)
+                where["tenantId"] = tenantId;
+            if ((await selectMany(db, holder.table, where, { limit: 1 })).length > 0)
+                return true;
+        }
+    }
+    return false;
+}
+// An upload the user made but never bound to a record has no entity row to find it through, so
+// the uploader id is the only link. Only refs that originate from a registered entity file
+// field count as pending uploads: config saves (a tenant logo) and server-made files never
+// bind and must outlive the uploader. A legacy unbound ref a record's single file column still
+// names is not pending but in use and stays with that record.
+async function purgePendingUploadsOfUser(args) {
+    const { db, registry, subject, fileFieldKeys } = args;
+    // skip: only a user uploads files without binding them to a record
+    if (subject.kind !== "user")
+        return undefined;
+    // skip: the system user is not a person; its server-made files are not pending uploads
+    if (subject.userId === SYSTEM_USER_ID)
+        return undefined;
+    // skip: without the files feature there is no file_refs table to sweep
+    if (registry.getEntity(FILE_REF_ENTITY_NAME) === undefined)
+        return undefined;
+    const pending = await selectMany(db, fileRefsTable, {
+        insertedById: subject.userId,
+        entityId: null,
+    });
+    let firstFailure;
+    for (const fileRef of pending) {
+        // skip: not uploaded for a registered entity file field (config, server-made, unknown origin)
+        if (!fileFieldKeys.has(pendingFieldKey(fileRef["entityType"], fileRef["fieldName"])))
+            continue;
+        firstFailure ??= await purgePendingFileRef(args, fileRef);
+    }
+    return firstFailure;
+}
+async function purgePendingFileRef(args, fileRef) {
+    const { db, fileHolders, storageByTenant, resolveDeleteBytes, missingStorage } = args;
+    const tenantId = parseTenantId(fileRef["tenantId"]);
+    const fileRefId = String(fileRef["id"]);
+    const storageKey = fileRef["storageKey"];
+    // skip: a ref without tenant or key has no bytes this sweep could address
+    if (tenantId === null || typeof storageKey !== "string" || storageKey === "")
+        return undefined;
+    // skip: a record still uses this file
+    if (await isFileRefHeldByRecord(db, fileHolders, tenantId, fileRefId))
+        return undefined;
+    let storagePromise = storageByTenant.get(tenantId);
+    if (storagePromise === undefined) {
+        storagePromise = resolveDeleteBytes(tenantId);
+        storageByTenant.set(tenantId, storagePromise);
+    }
+    const deleteBytes = await storagePromise;
+    if (deleteBytes === undefined) {
+        if (missingStorage.mode === "skip") {
+            missingStorage.warn(tenantId);
+            return undefined;
+        }
+        return new FileSweepError("missing_file_storage", FILE_REF_ENTITY_NAME);
+    }
+    if ((await deleteBytesFailingClosed(deleteBytes, storageKey)).length > 0) {
+        return new FileSweepError("file_delete_failed", FILE_REF_ENTITY_NAME);
+    }
+    const forgotten = await fileRefExecutor.forget({ id: fileRefId }, createSystemUser(tenantId), createTenantDb({ db, tenantId, mode: "system" }));
+    return forgotten.isSuccess
+        ? undefined
+        : new FileSweepError("file_delete_failed", FILE_REF_ENTITY_NAME);
+}

package/dist/tags/entity.d.ts

@@ -14,7 +14,7 @@ export declare const tagEntity: EntityDefinition<{
         readonly sensitive?: boolean;
         readonly writeOnly?: boolean;
         readonly readAsInstruction?: boolean;
-        readonly format?: "email" | "url" | "phone" | "password";
+        readonly format?: "email" | "url" | "phone" | "password" | "month";
         readonly default?: string;
         readonly access?: import("@cosmicdrift/kumiko-types/fields").FieldAccess;
         readonly multiline?: boolean | {
@@ -37,7 +37,7 @@ export declare const tagEntity: EntityDefinition<{
         readonly sensitive?: boolean;
         readonly writeOnly?: boolean;
         readonly readAsInstruction?: boolean;
-        readonly format?: "email" | "url" | "phone" | "password";
+        readonly format?: "email" | "url" | "phone" | "password" | "month";
         readonly default?: string;
         readonly access?: import("@cosmicdrift/kumiko-types/fields").FieldAccess;
         readonly multiline?: boolean | {
@@ -60,7 +60,7 @@ export declare const tagEntity: EntityDefinition<{
         readonly sensitive?: boolean;
         readonly writeOnly?: boolean;
         readonly readAsInstruction?: boolean;
-        readonly format?: "email" | "url" | "phone" | "password";
+        readonly format?: "email" | "url" | "phone" | "password" | "month";
         readonly default?: string;
         readonly access?: import("@cosmicdrift/kumiko-types/fields").FieldAccess;
         readonly multiline?: boolean | {
@@ -85,7 +85,7 @@ export declare function createTagAssignmentEntity(access?: EntityDefinition["acc
         readonly sensitive?: boolean;
         readonly writeOnly?: boolean;
         readonly readAsInstruction?: boolean;
-        readonly format?: "email" | "url" | "phone" | "password";
+        readonly format?: "email" | "url" | "phone" | "password" | "month";
         readonly default?: string;
         readonly access?: import("@cosmicdrift/kumiko-types/fields").FieldAccess;
         readonly multiline?: boolean | {
@@ -108,7 +108,7 @@ export declare function createTagAssignmentEntity(access?: EntityDefinition["acc
         readonly sensitive?: boolean;
         readonly writeOnly?: boolean;
         readonly readAsInstruction?: boolean;
-        readonly format?: "email" | "url" | "phone" | "password";
+        readonly format?: "email" | "url" | "phone" | "password" | "month";
         readonly default?: string;
         readonly access?: import("@cosmicdrift/kumiko-types/fields").FieldAccess;
         readonly multiline?: boolean | {
@@ -131,7 +131,7 @@ export declare function createTagAssignmentEntity(access?: EntityDefinition["acc
         readonly sensitive?: boolean;
         readonly writeOnly?: boolean;
         readonly readAsInstruction?: boolean;
-        readonly format?: "email" | "url" | "phone" | "password";
+        readonly format?: "email" | "url" | "phone" | "password" | "month";
         readonly default?: string;
         readonly access?: import("@cosmicdrift/kumiko-types/fields").FieldAccess;
         readonly multiline?: boolean | {
@@ -156,7 +156,7 @@ export declare const tagAssignmentEntity: EntityDefinition<{
         readonly sensitive?: boolean;
         readonly writeOnly?: boolean;
         readonly readAsInstruction?: boolean;
-        readonly format?: "email" | "url" | "phone" | "password";
+        readonly format?: "email" | "url" | "phone" | "password" | "month";
         readonly default?: string;
         readonly access?: import("@cosmicdrift/kumiko-types/fields").FieldAccess;
         readonly multiline?: boolean | {
@@ -179,7 +179,7 @@ export declare const tagAssignmentEntity: EntityDefinition<{
         readonly sensitive?: boolean;
         readonly writeOnly?: boolean;
         readonly readAsInstruction?: boolean;
-        readonly format?: "email" | "url" | "phone" | "password";
+        readonly format?: "email" | "url" | "phone" | "password" | "month";
         readonly default?: string;
         readonly access?: import("@cosmicdrift/kumiko-types/fields").FieldAccess;
         readonly multiline?: boolean | {
@@ -202,7 +202,7 @@ export declare const tagAssignmentEntity: EntityDefinition<{
         readonly sensitive?: boolean;
         readonly writeOnly?: boolean;
         readonly readAsInstruction?: boolean;
-        readonly format?: "email" | "url" | "phone" | "password";
+        readonly format?: "email" | "url" | "phone" | "password" | "month";
         readonly default?: string;
         readonly access?: import("@cosmicdrift/kumiko-types/fields").FieldAccess;
         readonly multiline?: boolean | {

package/dist/tags/web/client-plugin.d.ts

@@ -1,2 +1,2 @@
-import type { ClientFeatureDefinition } from "@cosmicdrift/kumiko-renderer-web";
+import type { ClientFeatureDefinition } from "@cosmicdrift/kumiko-renderer/web";
 export declare function tagsClient(): ClientFeatureDefinition;

package/dist/template-resolver/compile-document-body.d.ts

@@ -9,7 +9,10 @@ export type CompileDocumentBodyOptions = {
     readonly buttonInlineStyle?: string;
     readonly headingAsInlineStyle?: boolean;
     readonly stepsColor?: string;
+    readonly recordImagesSrc?: (variable: string) => readonly string[];
+    readonly recordImagesPlaceholder?: boolean;
 };
 export declare function collectDocumentResourceKeys(html: string): readonly string[];
+export declare function collectDocumentImageVariables(html: string): readonly string[];
 export declare function toResourceDataUri(contentType: string, bytes: Uint8Array): string;
 export declare function compileDocumentBodyToHandlebars(html: string, variables: TemplateVariables, options?: CompileDocumentBodyOptions): string;

package/dist/template-resolver/compile-document-body.js

@@ -48,9 +48,13 @@ function valueExpression(path, def, isWholeBlock) {
     }
     return `{{${path}}}`;
 }
+// Never interpolated as text: its value is a list of file ids.
+function isImagesVariable(def) {
+    return def?.type === "images";
+}
 function rewriteVariable(element, state) {
     const name = element.getAttribute("data-variable") ?? "";
-    const replacement = element.ownerDocument.createTextNode(isDocumentReferenceName(name)
+    const replacement = element.ownerDocument.createTextNode(isDocumentReferenceName(name) && !isImagesVariable(pathAndDef(name, element, state)[1])
         ? marker(state, valueExpression(...pathAndDef(name, element, state), state.blockRichTextSpans.has(element)))
         : "");
     element.replaceWith(replacement);
@@ -82,6 +86,9 @@ function wrapVariableOnlyBlock(block, state) {
     if (name === null)
         return;
     const [path, def] = pathAndDef(name, block, state);
+    // skip: images blocks are rewritten by rewriteImagesBlock
+    if (isImagesVariable(def))
+        return;
     const host = def?.type === "richText" && block.tagName === "P" ? richTextBlockHost(block, state) : block;
     const document = host.ownerDocument;
     host.before(document.createTextNode(marker(state, `{{#if ${path} includeZero=true}}`)));
@@ -106,8 +113,8 @@ function rewriteLink(element, state) {
     if (isDocumentPlaceholderHref(href)) {
         const name = href.slice(2, -2);
         if (isDocumentReferenceName(name)) {
-            const [path] = pathAndDef(name, element, state);
-            element.setAttribute("href", marker(state, `{{link ${path}}}`));
+            const [path, def] = pathAndDef(name, element, state);
+            element.setAttribute("href", isImagesVariable(def) ? "#" : marker(state, `{{link ${path}}}`));
         }
         else {
             element.setAttribute("href", "#");
@@ -152,6 +159,7 @@ function stripActiveContent(element) {
 function neutralizeBraces(html) {
     return html.replace(/[{}]/g, (brace) => (brace === "{" ? "{" : "}"));
 }
+const IMAGES_PLACEHOLDER_STYLE = "height:96px;margin:8px 0;border-radius:4px;background:#e5e7eb";
 const MAIL_BUTTON_STYLE = "display:inline-block;padding:10px 20px;border-radius:6px;background-color:#1f5468;color:#ffffff;font-weight:600;text-decoration:none";
 const MAIL_TABLE_STYLE = "width:100%;border-collapse:collapse";
 const MAIL_TABLE_CELL_STYLE = "padding:6px 12px;vertical-align:top;border-bottom:1px solid #e5e5e5";
@@ -179,6 +187,42 @@ export function collectDocumentResourceKeys(html) {
         return [...keys];
     });
 }
+// Unique valid names of the images blocks in document order.
+export function collectDocumentImageVariables(html) {
+    return withParsedDocument(html, (root) => {
+        const names = new Set();
+        for (const element of Array.from(root.querySelectorAll("div[data-images]"))) {
+            const name = element.getAttribute("data-images") ?? "";
+            if (isDocumentReferenceName(name))
+                names.add(name);
+        }
+        return [...names];
+    });
+}
+function rewriteImagesBlock(element, state, options) {
+    const name = element.getAttribute("data-images") ?? "";
+    const declared = isDocumentReferenceName(name) && isImagesVariable(ownVariable(state.variables, name));
+    if (!declared) {
+        element.remove();
+        // skip: an images block bound to anything but a declared images variable renders nothing
+        return;
+    }
+    const document = element.ownerDocument;
+    element.removeAttribute("data-images");
+    if (options.recordImagesPlaceholder === true) {
+        element.setAttribute("class", "kumiko-doc-image-placeholder");
+        element.setAttribute("style", IMAGES_PLACEHOLDER_STYLE);
+        // skip: preview and drafts never resolve record images
+        return;
+    }
+    element.setAttribute("class", "kumiko-doc-images");
+    for (const src of options.recordImagesSrc?.(name) ?? []) {
+        const image = document.createElement("img");
+        image.setAttribute("src", src);
+        image.setAttribute("alt", "");
+        element.append(image);
+    }
+}
 export function toResourceDataUri(contentType, bytes) {
     if (!isResourceImageContentType(contentType)) {
         throw new Error(`resource content type "${contentType}" cannot be embedded as an image`);
@@ -273,6 +317,9 @@ export function compileDocumentBodyToHandlebars(html, variables, options = {}) {
                 color: options.stepsColor,
             });
         }
+        for (const element of Array.from(root.querySelectorAll("div[data-images]"))) {
+            rewriteImagesBlock(element, state, options);
+        }
         for (const block of Array.from(root.querySelectorAll(`[${DOCUMENT_CONDITION_ATTRIBUTE}]`))) {
             rewriteConditionalBlock(block, state);
         }

package/dist/template-resolver/constants.d.ts

@@ -26,3 +26,6 @@ export declare const MAIL_PREVIEW_MAX_BYTES: number;
 export declare const TEST_MAIL_SUBJECT_PREFIX = "[TEST] ";
 export { SYSTEM_TENANT_ID } from "@cosmicdrift/kumiko-framework/engine";
 export declare const FALLBACK_LOCALE = "de";
+export declare const DEFAULT_COLLECTION_ACCESS: {
+    readonly roles: readonly ["SystemAdmin"];
+};

package/dist/template-resolver/constants.js

@@ -66,3 +66,5 @@ export { SYSTEM_TENANT_ID } from "@cosmicdrift/kumiko-framework/engine";
 // Default-Locale wenn Tenant keinen eigenen Default konfiguriert. Resolver
 // fällt darauf zurück wenn requested locale + tenant-default fehlen.
 export const FALLBACK_LOCALE = "de";
+// A collection mounted without `access` is maintained by the platform only; TenantAdmin access is an explicit mount decision.
+export const DEFAULT_COLLECTION_ACCESS = { roles: ["SystemAdmin"] };

package/dist/template-resolver/document-blocks.d.ts

@@ -0,0 +1,5 @@
+export type DocumentToolbarBlock = "image" | "table" | "button" | "divider" | "repeat" | "pageBreak" | "align" | "steps" | "images";
+export declare const MAIL_DOCUMENT_BLOCKS: readonly ["image", "table", "button", "divider", "repeat", "steps"];
+export declare const PDF_DOCUMENT_BLOCKS: readonly ["align", "image", "table", "divider", "repeat", "steps", "images", "pageBreak"];
+/** Block set for a template-resource kind; every kind except "document-pdf" gets the mail set. */
+export declare function documentBlocksForKind(kind: string | undefined): readonly DocumentToolbarBlock[];

package/dist/template-resolver/document-blocks.js

@@ -0,0 +1,22 @@
+export const MAIL_DOCUMENT_BLOCKS = [
+    "image",
+    "table",
+    "button",
+    "divider",
+    "repeat",
+    "steps",
+];
+export const PDF_DOCUMENT_BLOCKS = [
+    "align",
+    "image",
+    "table",
+    "divider",
+    "repeat",
+    "steps",
+    "images",
+    "pageBreak",
+];
+/** Block set for a template-resource kind; every kind except "document-pdf" gets the mail set. */
+export function documentBlocksForKind(kind) {
+    return kind === "document-pdf" ? PDF_DOCUMENT_BLOCKS : MAIL_DOCUMENT_BLOCKS;
+}

package/dist/template-resolver/document-images.d.ts

@@ -0,0 +1,2 @@
+import { Node } from "@tiptap/core";
+export declare function createDocumentImagesNode(isReferenceName: (value: string) => boolean): Node<any, any>;

package/dist/template-resolver/document-images.js

@@ -0,0 +1,28 @@
+// @runtime client
+// The record's photos: a block bound to an `images` variable whose FileRef ids the
+// app passes at render time. Universal like document-schema.ts.
+import { Node } from "@tiptap/core";
+export function createDocumentImagesNode(isReferenceName) {
+    return Node.create({
+        name: "images",
+        group: "block",
+        atom: true,
+        addAttributes() {
+            return { variable: { default: null } };
+        },
+        parseHTML() {
+            return [
+                {
+                    tag: "div[data-images]",
+                    getAttrs: (element) => {
+                        const variable = element.getAttribute("data-images");
+                        return variable !== null && isReferenceName(variable) ? { variable } : false;
+                    },
+                },
+            ];
+        },
+        renderHTML({ node }) {
+            return ["div", { "data-images": node.attrs["variable"] }];
+        },
+    });
+}