@cosmicdrift/kumiko-bundled-features 0.374.0 → 0.378.0

package/dist/template-resolver/handlers/document-blocks.query.js

@@ -0,0 +1,46 @@
+import { defineQueryHandler } from "@cosmicdrift/kumiko-framework/engine";
+import { NotFoundError } from "@cosmicdrift/kumiko-framework/errors";
+import * as z from "zod";
+import { DOCUMENT_HTML_KINDS } from "../constants.js";
+import { documentBlocksForKind } from "../document-blocks.js";
+import { documentBlocksOf } from "../document-ops.js";
+import { parseDocumentJson } from "../document-sanitizer.js";
+import { resolveTemplateVariables } from "../template-validation.js";
+import { loadDocumentBase } from "./document-base.js";
+import { localeSchema, templateSlugSchema } from "./shared.js";
+import { knownResourceKeysFor } from "./validate.query.js";
+export const documentBlocksQuery = defineQueryHandler({
+    name: "document-blocks",
+    schema: z.object({
+        slug: templateSlugSchema,
+        kind: z.enum(DOCUMENT_HTML_KINDS),
+        locale: localeSchema,
+    }),
+    access: { roles: ["TenantAdmin", "SystemAdmin"] },
+    description: "Reads a mail or PDF document template as a list of blocks with stable ids (b0, b1, ...) for structured editing: each block has its type (paragraph, heading, list, table, repeat, image, button, divider, pageBreak, steps), its text with {{name}} placeholders and its settings, plus the meta, the stored and effective variables (variablesDeclaredByFeature is true when a notification declares them, so they cannot be changed), the block types allowed for the kind and the uploaded image keys. It reads the caller's own version (the open draft if there is one), else the served system default; base carries the scope and version that patch-draft expects back.",
+    handler: async (query, ctx) => {
+        const { slug, kind, locale } = query.payload;
+        const loaded = await loadDocumentBase(ctx, query.user, { slug, kind, locale });
+        if (loaded === null)
+            throw new NotFoundError("template-resource", slug);
+        return {
+            slug,
+            kind,
+            locale,
+            base: loaded.base,
+            status: loaded.status,
+            blocks: documentBlocksOf(parseDocumentJson(loaded.content)),
+            meta: loaded.meta,
+            variableSchema: loaded.variableSchema,
+            variables: resolveTemplateVariables(ctx.registry, slug, loaded.variableSchema),
+            variablesDeclaredByFeature: ctx.registry.getAllNotifications().get(slug)?.variables !== undefined,
+            allowedBlocks: documentBlocksForKind(kind),
+            resourceKeys: await knownResourceKeysFor(ctx, query.user, {
+                slug,
+                kind,
+                scope: "tenant",
+                locale,
+            }),
+        };
+    },
+});

package/dist/template-resolver/handlers/export-bundle.query.d.ts

@@ -21,6 +21,7 @@ export declare const exportBundleQuery: import("@cosmicdrift/kumiko-types/define
     locales: Record<string, {
         body: string;
         meta?: unknown;
+        title?: string;
     }>;
     resources: Record<string, {
         fileName: string;

package/dist/template-resolver/handlers/export-bundle.query.js

@@ -55,6 +55,14 @@ function assertLocalesShareFormat(rows) {
         ],
     });
 }
+function localeEntryOf(row) {
+    const meta = parseStoredJson(row.meta);
+    return {
+        body: row.content ?? "",
+        ...(meta === undefined ? {} : { meta }),
+        ...(row.title === null ? {} : { title: row.title }),
+    };
+}
 export const exportBundleQuery = defineQueryHandler({
     name: "export-bundle",
     schema: z.object({
@@ -79,8 +87,7 @@ export const exportBundleQuery = defineQueryHandler({
         const locales = {};
         const entryByKey = new Map();
         for (const row of rows) {
-            const meta = parseStoredJson(row.meta);
-            locales[row.locale] = { body: row.content ?? "", ...(meta === undefined ? {} : { meta }) };
+            locales[row.locale] = localeEntryOf(row);
             for (const [key, entry] of Object.entries(parseLinkedResourceEntries(row.linkedResources))) {
                 if (!entryByKey.has(key))
                     entryByKey.set(key, entry);

package/dist/template-resolver/handlers/import-bundle-system.write.d.ts

@@ -20,6 +20,7 @@ export declare const importBundleSystemWrite: import("@cosmicdrift/kumiko-types/
         locales: z.ZodRecord<z.ZodString, z.ZodObject<{
             body: z.ZodString;
             meta: z.ZodOptional<z.ZodUnknown>;
+            title: z.ZodOptional<z.ZodString>;
         }, z.core.$strict>>;
         resources: z.ZodDefault<z.ZodRecord<z.ZodString, z.ZodObject<{
             fileName: z.ZodString;

package/dist/template-resolver/handlers/import-bundle.write.d.ts

@@ -1,5 +1,6 @@
 import * as z from "zod";
-export declare const importBundleWrite: import("@cosmicdrift/kumiko-types/define-handler").WriteHandlerDefinition<"import-bundle", z.ZodObject<{
+import { type TemplateEditPolicy } from "../template-edit-policy.ts";
+export declare function makeImportBundleWrite(policy: TemplateEditPolicy): import("@cosmicdrift/kumiko-types/define-handler").WriteHandlerDefinition<"import-bundle", z.ZodObject<{
     bundle: z.ZodObject<{
         slug: z.ZodString;
         kind: z.ZodEnum<{
@@ -20,6 +21,7 @@ export declare const importBundleWrite: import("@cosmicdrift/kumiko-types/define
         locales: z.ZodRecord<z.ZodString, z.ZodObject<{
             body: z.ZodString;
             meta: z.ZodOptional<z.ZodUnknown>;
+            title: z.ZodOptional<z.ZodString>;
         }, z.core.$strict>>;
         resources: z.ZodDefault<z.ZodRecord<z.ZodString, z.ZodObject<{
             fileName: z.ZodString;

package/dist/template-resolver/handlers/import-bundle.write.js

@@ -1,29 +1,34 @@
 import { defineWriteHandler } from "@cosmicdrift/kumiko-framework/engine";
 import * as z from "zod";
 import { templateBundleSchema } from "../template-bundle.js";
+import { refuseTemplateEdit, templateEditAccess, } from "../template-edit-policy.js";
 import { importTemplateBundle, prepareTemplateBundleBeforeTransaction } from "./bundle-import.js";
-export const importBundleWrite = defineWriteHandler({
-    name: "import-bundle",
-    schema: z.object({ bundle: templateBundleSchema, overwrite: z.boolean().default(false) }),
-    access: { roles: ["TenantAdmin", "SystemAdmin"] },
-    description: "Imports a template bundle (all locales plus resource files, as produced by export-bundle) into the caller's tenant as drafts; it refuses a locale that already has an override unless overwrite is set, and publish makes the drafts live.",
-    beforeTransaction: (event, ctx) => prepareTemplateBundleBeforeTransaction({
-        ctx,
-        user: event.user,
-        tenantId: event.user.tenantId,
-        scope: "tenant",
-        status: "draft",
-        bundle: event.payload.bundle,
-        overwrite: event.payload.overwrite,
-    }),
-    handler: (event, ctx) => importTemplateBundle({
-        ctx,
-        user: event.user,
-        tenantId: event.user.tenantId,
-        scope: "tenant",
-        status: "draft",
-        bundle: event.payload.bundle,
-        overwrite: event.payload.overwrite,
-        prepared: event.prepared,
-    }),
-});
+export function makeImportBundleWrite(policy) {
+    return defineWriteHandler({
+        name: "import-bundle",
+        schema: z.object({ bundle: templateBundleSchema, overwrite: z.boolean().default(false) }),
+        access: templateEditAccess(policy.tenantEditable),
+        description: "Imports a template bundle (all locales plus resource files, as produced by export-bundle) into the caller's tenant as drafts; it refuses a locale that already has an override unless overwrite is set, and publish makes the drafts live. Outside the templates the app lists in tenantEditable only a SystemAdmin may use it.",
+        beforeTransaction: async (event, ctx) => refuseTemplateEdit(policy, event.user, event.payload.bundle) ??
+            prepareTemplateBundleBeforeTransaction({
+                ctx,
+                user: event.user,
+                tenantId: event.user.tenantId,
+                scope: "tenant",
+                status: "draft",
+                bundle: event.payload.bundle,
+                overwrite: event.payload.overwrite,
+            }),
+        handler: async (event, ctx) => refuseTemplateEdit(policy, event.user, event.payload.bundle) ??
+            importTemplateBundle({
+                ctx,
+                user: event.user,
+                tenantId: event.user.tenantId,
+                scope: "tenant",
+                status: "draft",
+                bundle: event.payload.bundle,
+                overwrite: event.payload.overwrite,
+                prepared: event.prepared,
+            }),
+    });
+}

package/dist/template-resolver/handlers/overview.query.d.ts

@@ -1,6 +1,7 @@
 import * as z from "zod";
 import { type TemplateStatus } from "../constants.ts";
 import { type TemplateResourceRow } from "../table.ts";
+import { type TemplateEditPolicy } from "../template-edit-policy.ts";
 import { type EffectiveMailLayoutSlugs } from "../template-usage.ts";
 declare const OVERVIEW_KINDS: readonly ["mail", "document-pdf", "mail-layout", "pdf-layout"];
 type OverviewKind = (typeof OVERVIEW_KINDS)[number];
@@ -38,7 +39,7 @@ export type OverviewResponse = {
     readonly truncated: boolean;
 };
 export declare function effectiveMailLayoutSlugs(rows: readonly TemplateResourceRow[]): EffectiveMailLayoutSlugs;
-export declare const overviewQuery: import("@cosmicdrift/kumiko-types/define-handler").QueryHandlerDefinition<"overview", z.ZodObject<{
+export declare function makeOverviewQuery(policy: TemplateEditPolicy): import("@cosmicdrift/kumiko-types/define-handler").QueryHandlerDefinition<"overview", z.ZodObject<{
     search: z.ZodOptional<z.ZodString>;
     filters: z.ZodOptional<z.ZodArray<z.ZodObject<{
         field: z.ZodEnum<{

package/dist/template-resolver/handlers/overview.query.js

@@ -4,6 +4,7 @@ import * as z from "zod";
 import { DEFAULT_MAIL_LAYOUT_SLUG, FALLBACK_LOCALE } from "../constants.js";
 import { templateResourcesTable } from "../table.js";
 import { activeSinceOf, activeVersionOf, draftViewerTenantId, isHiddenSystemDraft, parseTemplateDraft, servedVersionOf, } from "../template-draft.js";
+import { mayEditTemplate } from "../template-edit-policy.js";
 import { isSystemOnlyTemplateHiddenFrom } from "../template-system-only.js";
 import { collectTemplateUsage } from "../template-usage.js";
 import { storedRecord } from "./template-gates.js";
@@ -171,45 +172,48 @@ const filterSchema = z.object({
     op: z.literal("in"),
     value: z.array(z.string()),
 });
-export const overviewQuery = defineQueryHandler({
-    name: "overview",
-    schema: z.object({
-        search: z.string().optional(),
-        filters: z.array(filterSchema).optional(),
-        layoutSlug: z.string().optional(),
-        sort: z.string().optional(),
-        sortDirection: z.enum(["asc", "desc"]).optional(),
-        limit: z.number().int().min(1).max(200).default(50),
-        offset: z.number().int().min(0).optional(),
-        totalCount: z.boolean().optional(),
-    }),
-    access: { roles: ["TenantAdmin", "SystemAdmin"] },
-    description: "Lists mail, PDF and layout templates as one row per slug and kind for the caller's tenant (optionally only the mails and PDFs using one layout slug): where the effective version comes from (own override or system), its locales, status and version (the served one; `draftVersion` is set when an unpublished draft waits beside it, `activeSince` says since when the served version applies), the system version it overrides, the layout it uses and which notifications or templates use it; templates of notifications registered with `systemOnly` are listed for SystemAdmins only; use it to browse and filter all templates at a glance.",
-    handler: async (query, ctx) => {
-        const payload = query.payload;
-        const fetchedRows = await selectMany(ctx.db, templateResourcesTable, { kind: { in: [...OVERVIEW_KINDS] } }, { orderBy: { col: "id", direction: "asc" }, limit: OVERVIEW_ROW_LIMIT + 1 });
-        const truncated = fetchedRows.length > OVERVIEW_ROW_LIMIT;
-        const rows = truncated ? fetchedRows.slice(0, OVERVIEW_ROW_LIMIT) : fetchedRows;
-        if (truncated) {
-            ctx.log?.warn("template overview: row limit reached, result is incomplete", {
-                limit: OVERVIEW_ROW_LIMIT,
-            });
-        }
-        const visibleRows = rows.filter((row) => !isHiddenSystemDraft(query.user, row) &&
-            !isSystemOnlyTemplateHiddenFrom(query.user, ctx.registry, row));
-        const { drafts, layoutSlugByDocument } = buildDrafts(groupBySlugAndKind(visibleRows), query.user);
-        const effectiveLayouts = effectiveMailLayoutSlugs(visibleRows);
-        const overviewRows = drafts.map((draft) => withUsage(draft, layoutSlugByDocument, ctx.registry, effectiveLayouts));
-        const filtered = filterRows(overviewRows, payload.search, payload.filters ?? [], payload.layoutSlug);
-        const sortField = payload.sort !== undefined && isSortField(payload.sort) ? payload.sort : "modifiedAt";
-        const direction = (payload.sortDirection ?? "desc") === "desc" ? -1 : 1;
-        filtered.sort((a, b) => direction * compareBy(sortField, a, b) || a.id.localeCompare(b.id));
-        const offset = payload.offset ?? 0;
-        return {
-            rows: filtered.slice(offset, offset + payload.limit),
-            nextCursor: null,
-            total: filtered.length,
-            truncated,
-        };
-    },
-});
+export function makeOverviewQuery(policy) {
+    return defineQueryHandler({
+        name: "overview",
+        schema: z.object({
+            search: z.string().optional(),
+            filters: z.array(filterSchema).optional(),
+            layoutSlug: z.string().optional(),
+            sort: z.string().optional(),
+            sortDirection: z.enum(["asc", "desc"]).optional(),
+            limit: z.number().int().min(1).max(200).default(50),
+            offset: z.number().int().min(0).optional(),
+            totalCount: z.boolean().optional(),
+        }),
+        access: { roles: ["TenantAdmin", "SystemAdmin"] },
+        description: "Lists mail, PDF and layout templates as one row per slug and kind for the caller's tenant (optionally only the mails and PDFs using one layout slug): where the effective version comes from (own override or system), its locales, status and version (the served one; `draftVersion` is set when an unpublished draft waits beside it, `activeSince` says since when the served version applies), the system version it overrides, the layout it uses and which notifications or templates use it; templates of notifications registered with `systemOnly` are listed for SystemAdmins only, and a TenantAdmin sees only the templates the app lists in tenantEditable; use it to browse and filter all templates at a glance.",
+        handler: async (query, ctx) => {
+            const payload = query.payload;
+            const fetchedRows = await selectMany(ctx.db, templateResourcesTable, { kind: { in: [...OVERVIEW_KINDS] } }, { orderBy: { col: "id", direction: "asc" }, limit: OVERVIEW_ROW_LIMIT + 1 });
+            const truncated = fetchedRows.length > OVERVIEW_ROW_LIMIT;
+            const rows = truncated ? fetchedRows.slice(0, OVERVIEW_ROW_LIMIT) : fetchedRows;
+            if (truncated) {
+                ctx.log?.warn("template overview: row limit reached, result is incomplete", {
+                    limit: OVERVIEW_ROW_LIMIT,
+                });
+            }
+            const visibleRows = rows.filter((row) => !isHiddenSystemDraft(query.user, row) &&
+                !isSystemOnlyTemplateHiddenFrom(query.user, ctx.registry, row) &&
+                mayEditTemplate(policy, query.user, row));
+            const { drafts, layoutSlugByDocument } = buildDrafts(groupBySlugAndKind(visibleRows), query.user);
+            const effectiveLayouts = effectiveMailLayoutSlugs(visibleRows);
+            const overviewRows = drafts.map((draft) => withUsage(draft, layoutSlugByDocument, ctx.registry, effectiveLayouts));
+            const filtered = filterRows(overviewRows, payload.search, payload.filters ?? [], payload.layoutSlug);
+            const sortField = payload.sort !== undefined && isSortField(payload.sort) ? payload.sort : "modifiedAt";
+            const direction = (payload.sortDirection ?? "desc") === "desc" ? -1 : 1;
+            filtered.sort((a, b) => direction * compareBy(sortField, a, b) || a.id.localeCompare(b.id));
+            const offset = payload.offset ?? 0;
+            return {
+                rows: filtered.slice(offset, offset + payload.limit),
+                nextCursor: null,
+                total: filtered.length,
+                truncated,
+            };
+        },
+    });
+}

package/dist/template-resolver/handlers/patch-draft.write.d.ts

@@ -0,0 +1,67 @@
+import * as z from "zod";
+import { type TemplateEditPolicy } from "../template-edit-policy.ts";
+export declare function makePatchDraftWrite(policy: TemplateEditPolicy): import("@cosmicdrift/kumiko-types/define-handler").WriteHandlerDefinition<"patch-draft", z.ZodObject<{
+    slug: z.ZodString;
+    kind: z.ZodEnum<{
+        "document-pdf": "document-pdf";
+        mail: "mail";
+    }>;
+    locale: z.ZodString;
+    base: z.ZodObject<{
+        scope: z.ZodEnum<{
+            system: "system";
+            tenant: "tenant";
+        }>;
+        version: z.ZodNumber;
+    }, z.core.$strip>;
+    ops: z.ZodArray<z.ZodDiscriminatedUnion<[z.ZodObject<{
+        op: z.ZodLiteral<"insertBlock">;
+        after: z.ZodNullable<z.ZodString>;
+        block: z.ZodDiscriminatedUnion<[z.ZodObject<{
+            type: z.ZodLiteral<"paragraph">;
+            text: z.ZodString;
+            align: z.ZodOptional<z.ZodEnum<{
+                center: "center";
+                justify: "justify";
+                left: "left";
+                right: "right";
+            }>>;
+        }, z.core.$strip>, z.ZodObject<{
+            type: z.ZodLiteral<"heading">;
+            level: z.ZodNumber;
+            text: z.ZodString;
+        }, z.core.$strip>, z.ZodObject<{
+            type: z.ZodLiteral<"image">;
+            resource: z.ZodString;
+            alt: z.ZodOptional<z.ZodString>;
+        }, z.core.$strip>, z.ZodObject<{
+            type: z.ZodLiteral<"button">;
+            text: z.ZodString;
+            href: z.ZodString;
+        }, z.core.$strip>, z.ZodObject<{
+            type: z.ZodLiteral<"divider">;
+        }, z.core.$strip>, z.ZodObject<{
+            type: z.ZodLiteral<"pageBreak">;
+        }, z.core.$strip>], "type">;
+    }, z.core.$strip>, z.ZodObject<{
+        op: z.ZodLiteral<"replaceText">;
+        blockId: z.ZodString;
+        find: z.ZodString;
+        replace: z.ZodString;
+    }, z.core.$strip>, z.ZodObject<{
+        op: z.ZodLiteral<"removeBlock">;
+        blockId: z.ZodString;
+    }, z.core.$strip>, z.ZodObject<{
+        op: z.ZodLiteral<"setResource">;
+        blockId: z.ZodString;
+        resource: z.ZodString;
+        alt: z.ZodOptional<z.ZodNullable<z.ZodString>>;
+    }, z.core.$strip>, z.ZodObject<{
+        op: z.ZodLiteral<"setMeta">;
+        meta: z.ZodRecord<z.ZodString, z.ZodUnknown>;
+    }, z.core.$strip>, z.ZodObject<{
+        op: z.ZodLiteral<"setVariable">;
+        name: z.ZodString;
+        definition: z.ZodNullable<z.ZodUnknown>;
+    }, z.core.$strip>], "op">>;
+}, z.core.$strip>, import("./template-write.ts").WrittenTemplateRow, import("@cosmicdrift/kumiko-types/event-type-map").KumikoEventTypeMap, undefined>;

package/dist/template-resolver/handlers/patch-draft.write.js

@@ -0,0 +1,111 @@
+import { defineWriteHandler } from "@cosmicdrift/kumiko-framework/engine";
+import { NotFoundError, ValidationError, VersionConflictError, writeFailure, } from "@cosmicdrift/kumiko-framework/errors";
+import * as z from "zod";
+import { DOCUMENT_HTML_KINDS } from "../constants.js";
+import { applyDocumentOps, documentOpsSchema } from "../document-ops.js";
+import { parseDocumentJson, serializeDocumentJson } from "../document-sanitizer.js";
+import { refuseTemplateEdit, templateEditAccess, } from "../template-edit-policy.js";
+import { resolveTemplateVariables } from "../template-validation.js";
+import { loadDocumentBase } from "./document-base.js";
+import { localeSchema, templateSlugSchema } from "./shared.js";
+import { writeTemplateRow } from "./template-write.js";
+import { validateTemplateDraft } from "./validate.query.js";
+function validationFailure(issue) {
+    return writeFailure(new ValidationError({ fields: [issue] }));
+}
+export function makePatchDraftWrite(policy) {
+    return defineWriteHandler({
+        name: "patch-draft",
+        schema: z.object({
+            slug: templateSlugSchema,
+            kind: z.enum(DOCUMENT_HTML_KINDS),
+            locale: localeSchema,
+            base: z.object({
+                scope: z.enum(["tenant", "system"]),
+                version: z.number().int().nonnegative(),
+            }),
+            ops: documentOpsSchema,
+        }),
+        access: templateEditAccess(policy.tenantEditable),
+        description: "Changes a mail or PDF document template with structured operations instead of a full rewrite and saves the result as the caller's tenant draft (never published, an active version keeps being served until publish): insertBlock after a block id (null = at the start; paragraph, heading, image, button, divider, pageBreak), replaceText inside one block (the text must occur exactly once), removeBlock, setResource on an image block, setMeta (flat merge, null removes a key) and setVariable (adds, replaces or with null removes a variable definition; refused when a notification declares the variables). Block ids and base come from document-blocks and refer to the state that was read; if the template changed since, the call fails with version_conflict and nothing is written. A patch that removes a required placeholder is refused. A TenantAdmin may patch only templates the app lists in tenantEditable, otherwise SystemAdmin only. Returns the written row.",
+        handler: async (event, ctx) => {
+            const { slug, kind, locale, base, ops } = event.payload;
+            const refused = refuseTemplateEdit(policy, event.user, { slug, kind });
+            if (refused !== null)
+                return refused;
+            const loaded = await loadDocumentBase(ctx, event.user, { slug, kind, locale });
+            if (loaded === null)
+                return writeFailure(new NotFoundError("template-resource", slug));
+            if (loaded.base.scope !== base.scope || loaded.base.version !== base.version) {
+                return writeFailure(new VersionConflictError({
+                    entityId: loaded.rowId,
+                    expectedVersion: base.version,
+                    currentVersion: loaded.base.version,
+                }));
+            }
+            const variableOpIndex = ops.findIndex((op) => op.op === "setVariable");
+            if (variableOpIndex !== -1 &&
+                ctx.registry.getAllNotifications().get(slug)?.variables !== undefined) {
+                return validationFailure({
+                    path: `ops.${variableOpIndex}`,
+                    code: "variables_declared_by_feature",
+                    i18nKey: "templateResolver.errors.patch.variablesDeclaredByFeature",
+                    params: { slug },
+                });
+            }
+            const applied = applyDocumentOps({
+                doc: parseDocumentJson(loaded.content),
+                meta: loaded.meta,
+                variableSchema: loaded.variableSchema,
+                kind,
+                ops,
+            });
+            if (!applied.ok)
+                return writeFailure(new ValidationError({ fields: applied.issues }));
+            const content = serializeDocumentJson(applied.doc);
+            const draftOf = (draftContent, meta, variableSchema) => validateTemplateDraft(ctx, event.user, {
+                slug,
+                kind,
+                contentFormat: "html",
+                content: draftContent,
+                meta,
+                variableSchema,
+                locale,
+                scope: "tenant",
+            });
+            const before = await draftOf(loaded.content, loaded.meta, loaded.variableSchema);
+            const after = await draftOf(content, applied.meta, applied.variableSchema);
+            const alreadyMissing = new Set(before.response.missingRequired);
+            const removed = after.response.missingRequired.filter((name) => !alreadyMissing.has(name));
+            if (removed.length > 0) {
+                return validationFailure({
+                    path: "ops",
+                    code: "required_placeholder_removed",
+                    i18nKey: "templateResolver.errors.patch.requiredPlaceholderRemoved",
+                    params: { names: removed },
+                });
+            }
+            return writeTemplateRow({
+                ctx,
+                user: event.user,
+                tenantId: event.user.tenantId,
+                scope: "tenant",
+                status: "draft",
+                variables: resolveTemplateVariables(ctx.registry, slug, applied.variableSchema),
+                payload: {
+                    slug,
+                    kind,
+                    locale,
+                    content,
+                    contentFormat: "html",
+                    variableSchema: applied.variableSchema,
+                    meta: applied.meta,
+                    title: loaded.title,
+                    folder: loaded.folder,
+                    parentTemplateId: loaded.parentTemplateId,
+                },
+                expectedVersion: loaded.base.scope === "tenant" ? loaded.base.version : null,
+            });
+        },
+    });
+}

package/dist/template-resolver/handlers/preview.query.d.ts

@@ -9,4 +9,5 @@ export declare const previewQuery: import("@cosmicdrift/kumiko-types/define-hand
     content: z.ZodOptional<z.ZodString>;
     meta: z.ZodOptional<z.ZodUnknown>;
     variableSchema: z.ZodDefault<z.ZodRecord<z.ZodString, z.ZodUnknown>>;
+    variables: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodUnknown>>;
 }, z.core.$strip>, import("../template-preview.ts").TemplatePreview, import("@cosmicdrift/kumiko-types/event-type-map").KumikoEventTypeMap>;

package/dist/template-resolver/handlers/preview.query.js

@@ -12,9 +12,10 @@ export const previewQuery = defineQueryHandler({
         content: z.string().max(200_000).optional(),
         meta: z.unknown().optional(),
         variableSchema: z.record(z.string(), z.unknown()).default({}),
+        variables: z.record(z.string(), z.unknown()).optional(),
     }),
     access: { roles: ["TenantAdmin", "SystemAdmin"] },
-    description: "Renders a template draft, or the stored template when no content is given, with sample values taken from the declared variable examples, without saving or sending anything: returns the mail subject, html and plain text with its inline images (a PDF template returns its body and layout regions instead), the sample values used, and checks for unresolved images, missing plain text, mail size and unused required placeholders; a draft that fails the write rules is rejected with the same problems as a save.",
+    description: "Renders a template draft, or the stored template when no content is given, with sample values taken from the declared variable examples (values passed in variables replace them and are checked against the variable schema), without saving or sending anything: returns the mail subject, html and plain text with its inline images (a PDF template returns its body and layout regions instead), the sample values used, and checks for unresolved images, missing plain text, mail size and unused required placeholders; a draft that fails the write rules is rejected with the same problems as a save.",
     handler: async (query, ctx) => {
         const outcome = await renderTemplatePreview(ctx, query.user, query.payload);
         if (!outcome.ok)

package/dist/template-resolver/handlers/reset-to-system.write.d.ts

@@ -1,5 +1,6 @@
 import * as z from "zod";
-export declare const resetToSystemWrite: import("@cosmicdrift/kumiko-types/define-handler").WriteHandlerDefinition<"reset-to-system", z.ZodObject<{
+import { type TemplateEditPolicy } from "../template-edit-policy.ts";
+export declare function makeResetToSystemWrite(policy: TemplateEditPolicy): import("@cosmicdrift/kumiko-types/define-handler").WriteHandlerDefinition<"reset-to-system", z.ZodObject<{
     id: z.ZodString;
 }, z.core.$strip>, {
     id: string;

package/dist/template-resolver/handlers/reset-to-system.write.js

@@ -3,48 +3,55 @@ import { defineWriteHandler, SYSTEM_TENANT_ID } from "@cosmicdrift/kumiko-framew
 import { NotFoundError, ValidationError, writeFailure } from "@cosmicdrift/kumiko-framework/errors";
 import * as z from "zod";
 import { templateResourcesTable } from "../table.js";
+import { refuseMissingTemplate, refuseTemplateEdit, templateEditAccess, } from "../template-edit-policy.js";
 import { executor } from "./shared.js";
-export const resetToSystemWrite = defineWriteHandler({
-    name: "reset-to-system",
-    schema: z.object({ id: z.string().min(1) }),
-    access: { roles: ["TenantAdmin", "SystemAdmin"] },
-    description: "Retires a tenant override by archiving it so the resolver serves the active system template again; the override and its content survive and can be published again. Refused when there is no active system template to fall back to.",
-    handler: async (event, ctx) => {
-        const existing = await fetchOne(ctx.db, templateResourcesTable, {
-            id: event.payload.id,
-        });
-        if (!existing || existing.tenantId !== event.user.tenantId || existing.scope !== "tenant") {
-            return writeFailure(new NotFoundError("template-resource", event.payload.id));
-        }
-        const systemRow = await fetchOne(ctx.db, templateResourcesTable, {
-            tenantId: SYSTEM_TENANT_ID,
-            slug: existing.slug,
-            kind: existing.kind,
-            locale: existing.locale,
-            status: "active",
-        });
-        if (!systemRow) {
-            return writeFailure(new ValidationError({
-                fields: [
-                    {
-                        path: "id",
-                        code: "no_system_template",
-                        i18nKey: "templateResolver.errors.noSystemTemplate",
-                    },
-                ],
-            }));
-        }
-        const response = {
-            isSuccess: true,
-            data: {
-                id: String(existing.id),
-                status: "archived",
-                systemTemplateId: String(systemRow.id),
-            },
-        };
-        if (existing.status === "archived")
-            return response;
-        const result = await executor.update({ id: existing.id, version: existing.version, changes: { status: "archived" } }, event.user, ctx.db);
-        return result.isSuccess ? response : result;
-    },
-});
+export function makeResetToSystemWrite(policy) {
+    return defineWriteHandler({
+        name: "reset-to-system",
+        schema: z.object({ id: z.string().min(1) }),
+        access: templateEditAccess(policy.tenantEditable),
+        description: "Retires a tenant override by archiving it so the resolver serves the active system template again; the override and its content survive and can be published again. Refused when there is no active system template to fall back to. Outside the templates the app lists in tenantEditable only a SystemAdmin may use it.",
+        handler: async (event, ctx) => {
+            const existing = await fetchOne(ctx.db, templateResourcesTable, {
+                id: event.payload.id,
+            });
+            if (!existing || existing.tenantId !== event.user.tenantId || existing.scope !== "tenant") {
+                return (refuseMissingTemplate(policy, event.user) ??
+                    writeFailure(new NotFoundError("template-resource", event.payload.id)));
+            }
+            const refused = refuseTemplateEdit(policy, event.user, existing);
+            if (refused !== null)
+                return refused;
+            const systemRow = await fetchOne(ctx.db, templateResourcesTable, {
+                tenantId: SYSTEM_TENANT_ID,
+                slug: existing.slug,
+                kind: existing.kind,
+                locale: existing.locale,
+                status: "active",
+            });
+            if (!systemRow) {
+                return writeFailure(new ValidationError({
+                    fields: [
+                        {
+                            path: "id",
+                            code: "no_system_template",
+                            i18nKey: "templateResolver.errors.noSystemTemplate",
+                        },
+                    ],
+                }));
+            }
+            const response = {
+                isSuccess: true,
+                data: {
+                    id: String(existing.id),
+                    status: "archived",
+                    systemTemplateId: String(systemRow.id),
+                },
+            };
+            if (existing.status === "archived")
+                return response;
+            const result = await executor.update({ id: existing.id, version: existing.version, changes: { status: "archived" } }, event.user, ctx.db);
+            return result.isSuccess ? response : result;
+        },
+    });
+}

package/dist/template-resolver/handlers/resource-link-pdf.write.d.ts

@@ -1,5 +1,6 @@
 import * as z from "zod";
-export declare const resourceLinkPdfWrite: import("@cosmicdrift/kumiko-types/define-handler").WriteHandlerDefinition<"resource-link-pdf", z.ZodObject<{
+import { type TemplateEditPolicy } from "../template-edit-policy.ts";
+export declare function makeResourceLinkPdfWrite(policy: TemplateEditPolicy): import("@cosmicdrift/kumiko-types/define-handler").WriteHandlerDefinition<"resource-link-pdf", z.ZodObject<{
     templateId: z.ZodString;
     key: z.ZodString;
     templateSlug: z.ZodString;