@cosmicdrift/kumiko-bundled-features 0.377.0 → 0.378.0

package/dist/cap-counter/stock-cap-guard.js

@@ -4,8 +4,12 @@
 // tenant, so both are now factory parameters.
 import { UnprocessableError, writeFailure, } from "@cosmicdrift/kumiko-framework/errors";
 import { enforceStockCap } from "./enforce-cap.js";
+// pg_advisory_xact_lock namespace (int4): 'scap' as ASCII, disjoint from the
+// framework's other fixed advisory-lock keys.
+const STOCK_CAP_LOCK_NAMESPACE = 0x73636170;
 export function createStockCapGuard(resolveTierCaps) {
     async function checkStockCap(db, spec, context = {}) {
+        // Lock-free on its own: a direct call outside withStockCap is not atomic.
         const caps = await resolveTierCaps(db, context);
         const current = await db.count(spec.table, { ...spec.where, tenantId: db.tenantId });
         const { state, limit } = enforceStockCap({
@@ -24,6 +28,10 @@ export function createStockCapGuard(resolveTierCaps) {
         return {
             ...handler,
             handler: async (event, ctx) => {
+                // ctx.db is the handler's transaction, so the xact lock releases with its commit or
+                // rollback. A handler wrapped in several caps must list them in the same order
+                // everywhere; Postgres aborts one side of an inverse order with a deadlock error.
+                await ctx.db.advisoryXactLock(STOCK_CAP_LOCK_NAMESPACE, spec.code);
                 const failure = await checkStockCap(ctx.db, spec, { config: ctx.config });
                 return failure ?? handler.handler(event, ctx);
             },

package/dist/config/web/i18n.js

@@ -29,6 +29,7 @@ export const defaultTranslations = {
         "config.errors.unknownExtensionPlugin": "This provider is not available.",
         "config.settings.extensionSelectorHint": "Choose a provider. Its settings appear below and are saved together with it.",
         "config.settings.provider": "Provider",
+        "config.settings.provider.platformDefault": "Platform default",
         "config.settings.audience.system": "Applies to every tenant unless a tenant sets its own value.",
         "config.settings.audience.tenant": "Applies to everyone in this tenant. Platform defaults are shown where nothing is set here.",
         "config.settings.audience.user": "Only applies to you.",

package/dist/inbound-mail-foundation/handlers/list-accounts.query.d.ts

@@ -1,2 +1,2 @@
-import type { QueryHandlerDef } from "@cosmicdrift/kumiko-framework/engine";
+import { type QueryHandlerDef } from "@cosmicdrift/kumiko-framework/engine";
 export declare const listAccountsQuery: QueryHandlerDef;

package/dist/inbound-mail-foundation/handlers/list-accounts.query.js

@@ -8,21 +8,29 @@
 // in-memory nach dem tenant-scoped select — Volumen ist die Anzahl
 // verbundener Postfächer eines Tenants (einstellig bis zweistellig).
 import { configuredPiiSubjectKms, decryptPiiFieldValues, } from "@cosmicdrift/kumiko-framework/crypto";
+import { MAX_LIST_LIMIT } from "@cosmicdrift/kumiko-framework/engine";
 import * as z from "zod";
 import { MAIL_ACCOUNT_PII_FIELDS } from "../entities.js";
 import { mailAccountsProjectionTable } from "../projection.js";
 import { isVisibleToCaller } from "./scope-visibility.js";
-const listAccountsSchema = z.object({}).strict();
+// The projectionList screen always sends `limit`; unknown keys stay rejected.
+const listAccountsSchema = z
+    .object({ limit: z.number().int().min(1).max(MAX_LIST_LIMIT).default(MAX_LIST_LIMIT) })
+    .strict();
 export const listAccountsQuery = {
     name: "account:list",
     schema: listAccountsSchema,
     access: { roles: ["SystemAdmin", "TenantAdmin", "User"] },
     description: "Lists the connected mailboxes of the caller's tenant with the mailbox address decrypted, hiding personal mailboxes the caller neither owns nor administers; use it for the mail connect and settings views.",
-    handler: async (_query, ctx) => {
+    handler: async (query, ctx) => {
+        const { limit } = listAccountsSchema.parse(query.payload);
         const allRows = await ctx.db.selectMany(mailAccountsProjectionTable, {
             tenantId: ctx.user.tenantId,
         });
-        const rows = allRows.filter((row) => isVisibleToCaller(row, ctx.user));
+        const rows = allRows
+            .filter((row) => isVisibleToCaller(row, ctx.user))
+            .sort((a, b) => String(a["id"]).localeCompare(String(b["id"])))
+            .slice(0, limit);
         const piiKms = configuredPiiSubjectKms();
         if (!piiKms)
             return { rows };

package/dist/mail-foundation/i18n.d.ts

@@ -6,9 +6,12 @@ export declare const MAIL_FOUNDATION_I18N: {
         readonly en: "Email sending";
     };
     readonly "mail-foundation.provider": {
-        readonly en: "Own mail server";
+        readonly en: "Send via";
     };
     readonly "mail-foundation.provider.description": {
-        readonly en: "Without one, the platform sends the mails. Reset the choice to go back to that.";
+        readonly en: "Choose who sends your emails. The platform default needs no settings of your own.";
+    };
+    readonly "mail-foundation.provider.platformDefault": {
+        readonly en: "Platform sending (default)";
     };
 };

package/dist/mail-foundation/i18n.js

@@ -1,8 +1,9 @@
 export const MAIL_FOUNDATION_I18N = {
     "screen:mail-foundation-tenant.title": { en: "Email sending" },
     "mail-foundation.settings": { en: "Email sending" },
-    "mail-foundation.provider": { en: "Own mail server" },
+    "mail-foundation.provider": { en: "Send via" },
     "mail-foundation.provider.description": {
-        en: "Without one, the platform sends the mails. Reset the choice to go back to that.",
+        en: "Choose who sends your emails. The platform default needs no settings of your own.",
     },
+    "mail-foundation.provider.platformDefault": { en: "Platform sending (default)" },
 };

package/dist/mail-transport-smtp/i18n.d.ts

@@ -1,6 +1,6 @@
 export declare const MAIL_TRANSPORT_SMTP_I18N: {
     readonly "mail-transport-smtp.settings": {
-        readonly en: "SMTP server";
+        readonly en: "Own SMTP server";
     };
     readonly "mail-transport-smtp.settings.secrets": {
         readonly en: "SMTP sign-in";

package/dist/mail-transport-smtp/i18n.js

@@ -1,6 +1,6 @@
 export const MAIL_TRANSPORT_SMTP_I18N = {
     // Also the option label of mail-foundation's provider select.
-    "mail-transport-smtp.settings": { en: "SMTP server" },
+    "mail-transport-smtp.settings": { en: "Own SMTP server" },
     "mail-transport-smtp.settings.secrets": { en: "SMTP sign-in" },
     "mail-transport-smtp.settings.description": {
         en: "The connection details come from your mail provider, for example Brevo, Postmark, Amazon SES or your own server.",

package/dist/template-resolver/compile-document-body.d.ts

@@ -9,7 +9,10 @@ export type CompileDocumentBodyOptions = {
     readonly buttonInlineStyle?: string;
     readonly headingAsInlineStyle?: boolean;
     readonly stepsColor?: string;
+    readonly recordImagesSrc?: (variable: string) => readonly string[];
+    readonly recordImagesPlaceholder?: boolean;
 };
 export declare function collectDocumentResourceKeys(html: string): readonly string[];
+export declare function collectDocumentImageVariables(html: string): readonly string[];
 export declare function toResourceDataUri(contentType: string, bytes: Uint8Array): string;
 export declare function compileDocumentBodyToHandlebars(html: string, variables: TemplateVariables, options?: CompileDocumentBodyOptions): string;

package/dist/template-resolver/compile-document-body.js

@@ -48,9 +48,13 @@ function valueExpression(path, def, isWholeBlock) {
     }
     return `{{${path}}}`;
 }
+// Never interpolated as text: its value is a list of file ids.
+function isImagesVariable(def) {
+    return def?.type === "images";
+}
 function rewriteVariable(element, state) {
     const name = element.getAttribute("data-variable") ?? "";
-    const replacement = element.ownerDocument.createTextNode(isDocumentReferenceName(name)
+    const replacement = element.ownerDocument.createTextNode(isDocumentReferenceName(name) && !isImagesVariable(pathAndDef(name, element, state)[1])
         ? marker(state, valueExpression(...pathAndDef(name, element, state), state.blockRichTextSpans.has(element)))
         : "");
     element.replaceWith(replacement);
@@ -82,6 +86,9 @@ function wrapVariableOnlyBlock(block, state) {
     if (name === null)
         return;
     const [path, def] = pathAndDef(name, block, state);
+    // skip: images blocks are rewritten by rewriteImagesBlock
+    if (isImagesVariable(def))
+        return;
     const host = def?.type === "richText" && block.tagName === "P" ? richTextBlockHost(block, state) : block;
     const document = host.ownerDocument;
     host.before(document.createTextNode(marker(state, `{{#if ${path} includeZero=true}}`)));
@@ -106,8 +113,8 @@ function rewriteLink(element, state) {
     if (isDocumentPlaceholderHref(href)) {
         const name = href.slice(2, -2);
         if (isDocumentReferenceName(name)) {
-            const [path] = pathAndDef(name, element, state);
-            element.setAttribute("href", marker(state, `{{link ${path}}}`));
+            const [path, def] = pathAndDef(name, element, state);
+            element.setAttribute("href", isImagesVariable(def) ? "#" : marker(state, `{{link ${path}}}`));
         }
         else {
             element.setAttribute("href", "#");
@@ -152,6 +159,7 @@ function stripActiveContent(element) {
 function neutralizeBraces(html) {
     return html.replace(/[{}]/g, (brace) => (brace === "{" ? "{" : "}"));
 }
+const IMAGES_PLACEHOLDER_STYLE = "height:96px;margin:8px 0;border-radius:4px;background:#e5e7eb";
 const MAIL_BUTTON_STYLE = "display:inline-block;padding:10px 20px;border-radius:6px;background-color:#1f5468;color:#ffffff;font-weight:600;text-decoration:none";
 const MAIL_TABLE_STYLE = "width:100%;border-collapse:collapse";
 const MAIL_TABLE_CELL_STYLE = "padding:6px 12px;vertical-align:top;border-bottom:1px solid #e5e5e5";
@@ -179,6 +187,42 @@ export function collectDocumentResourceKeys(html) {
         return [...keys];
     });
 }
+// Unique valid names of the images blocks in document order.
+export function collectDocumentImageVariables(html) {
+    return withParsedDocument(html, (root) => {
+        const names = new Set();
+        for (const element of Array.from(root.querySelectorAll("div[data-images]"))) {
+            const name = element.getAttribute("data-images") ?? "";
+            if (isDocumentReferenceName(name))
+                names.add(name);
+        }
+        return [...names];
+    });
+}
+function rewriteImagesBlock(element, state, options) {
+    const name = element.getAttribute("data-images") ?? "";
+    const declared = isDocumentReferenceName(name) && isImagesVariable(ownVariable(state.variables, name));
+    if (!declared) {
+        element.remove();
+        // skip: an images block bound to anything but a declared images variable renders nothing
+        return;
+    }
+    const document = element.ownerDocument;
+    element.removeAttribute("data-images");
+    if (options.recordImagesPlaceholder === true) {
+        element.setAttribute("class", "kumiko-doc-image-placeholder");
+        element.setAttribute("style", IMAGES_PLACEHOLDER_STYLE);
+        // skip: preview and drafts never resolve record images
+        return;
+    }
+    element.setAttribute("class", "kumiko-doc-images");
+    for (const src of options.recordImagesSrc?.(name) ?? []) {
+        const image = document.createElement("img");
+        image.setAttribute("src", src);
+        image.setAttribute("alt", "");
+        element.append(image);
+    }
+}
 export function toResourceDataUri(contentType, bytes) {
     if (!isResourceImageContentType(contentType)) {
         throw new Error(`resource content type "${contentType}" cannot be embedded as an image`);
@@ -273,6 +317,9 @@ export function compileDocumentBodyToHandlebars(html, variables, options = {}) {
                 color: options.stepsColor,
             });
         }
+        for (const element of Array.from(root.querySelectorAll("div[data-images]"))) {
+            rewriteImagesBlock(element, state, options);
+        }
         for (const block of Array.from(root.querySelectorAll(`[${DOCUMENT_CONDITION_ATTRIBUTE}]`))) {
             rewriteConditionalBlock(block, state);
         }

package/dist/template-resolver/constants.d.ts

@@ -26,3 +26,6 @@ export declare const MAIL_PREVIEW_MAX_BYTES: number;
 export declare const TEST_MAIL_SUBJECT_PREFIX = "[TEST] ";
 export { SYSTEM_TENANT_ID } from "@cosmicdrift/kumiko-framework/engine";
 export declare const FALLBACK_LOCALE = "de";
+export declare const DEFAULT_COLLECTION_ACCESS: {
+    readonly roles: readonly ["SystemAdmin"];
+};

package/dist/template-resolver/constants.js

@@ -66,3 +66,5 @@ export { SYSTEM_TENANT_ID } from "@cosmicdrift/kumiko-framework/engine";
 // Default-Locale wenn Tenant keinen eigenen Default konfiguriert. Resolver
 // fällt darauf zurück wenn requested locale + tenant-default fehlen.
 export const FALLBACK_LOCALE = "de";
+// A collection mounted without `access` is maintained by the platform only; TenantAdmin access is an explicit mount decision.
+export const DEFAULT_COLLECTION_ACCESS = { roles: ["SystemAdmin"] };

package/dist/template-resolver/document-blocks.d.ts

@@ -1,5 +1,5 @@
-export type DocumentToolbarBlock = "image" | "table" | "button" | "divider" | "repeat" | "pageBreak" | "align" | "steps";
+export type DocumentToolbarBlock = "image" | "table" | "button" | "divider" | "repeat" | "pageBreak" | "align" | "steps" | "images";
 export declare const MAIL_DOCUMENT_BLOCKS: readonly ["image", "table", "button", "divider", "repeat", "steps"];
-export declare const PDF_DOCUMENT_BLOCKS: readonly ["align", "image", "table", "divider", "repeat", "steps", "pageBreak"];
+export declare const PDF_DOCUMENT_BLOCKS: readonly ["align", "image", "table", "divider", "repeat", "steps", "images", "pageBreak"];
 /** Block set for a template-resource kind; every kind except "document-pdf" gets the mail set. */
 export declare function documentBlocksForKind(kind: string | undefined): readonly DocumentToolbarBlock[];

package/dist/template-resolver/document-blocks.js

@@ -13,6 +13,7 @@ export const PDF_DOCUMENT_BLOCKS = [
     "divider",
     "repeat",
     "steps",
+    "images",
     "pageBreak",
 ];
 /** Block set for a template-resource kind; every kind except "document-pdf" gets the mail set. */

package/dist/template-resolver/document-images.d.ts

@@ -0,0 +1,2 @@
+import { Node } from "@tiptap/core";
+export declare function createDocumentImagesNode(isReferenceName: (value: string) => boolean): Node<any, any>;

package/dist/template-resolver/document-images.js

@@ -0,0 +1,28 @@
+// @runtime client
+// The record's photos: a block bound to an `images` variable whose FileRef ids the
+// app passes at render time. Universal like document-schema.ts.
+import { Node } from "@tiptap/core";
+export function createDocumentImagesNode(isReferenceName) {
+    return Node.create({
+        name: "images",
+        group: "block",
+        atom: true,
+        addAttributes() {
+            return { variable: { default: null } };
+        },
+        parseHTML() {
+            return [
+                {
+                    tag: "div[data-images]",
+                    getAttrs: (element) => {
+                        const variable = element.getAttribute("data-images");
+                        return variable !== null && isReferenceName(variable) ? { variable } : false;
+                    },
+                },
+            ];
+        },
+        renderHTML({ node }) {
+            return ["div", { "data-images": node.attrs["variable"] }];
+        },
+    });
+}

package/dist/template-resolver/document-sanitizer.d.ts

@@ -2,7 +2,7 @@ import type { FieldIssue } from "@cosmicdrift/kumiko-framework/errors";
 import type { JSONContent } from "@tiptap/core";
 import { type Element as ScanElement } from "happy-dom";
 import type { ContentFormat } from "./constants.ts";
-export type DocumentViolationCode = "script_element" | "event_handler_attribute" | "disallowed_link_href" | "external_image_source" | "image_without_resource" | "invalid_reference_name" | "embedded_content" | "unsafe_attribute_value" | "button_href_not_placeholder" | "document_requires_html_format" | "layout_requires_mjml_format" | "layout_invalid_structure" | "layout_missing_content_slot" | "layout_source_system_only";
+export type DocumentViolationCode = "script_element" | "event_handler_attribute" | "disallowed_link_href" | "external_image_source" | "image_without_resource" | "invalid_reference_name" | "embedded_content" | "unsafe_attribute_value" | "images_block_pdf_only" | "button_href_not_placeholder" | "document_requires_html_format" | "layout_requires_mjml_format" | "layout_invalid_structure" | "layout_missing_content_slot" | "layout_source_system_only";
 export type DocumentViolation = {
     readonly code: DocumentViolationCode;
     readonly detail: string;

package/dist/template-resolver/document-sanitizer.js

@@ -59,6 +59,7 @@ const REFERENCE_ATTRIBUTES = [
     [DOCUMENT_CONDITION_ATTRIBUTE, isDocumentReferenceName],
     ["data-resource", isDocumentResourceKey],
     ["data-steps", isDocumentReferenceName],
+    ["data-images", isDocumentReferenceName],
     ["data-step", isDocumentStepKey],
 ];
 function scanReferences(tag, element, out) {
@@ -182,10 +183,28 @@ function requiredFormatViolation(kind, contentFormat) {
     }
     return null;
 }
+const IMAGES_BLOCK_KIND = "document-pdf";
+// The node is part of the shared document model, so a mail body would keep it after the
+// rebuild; only a PDF resolves the record's images.
+function imagesBlockViolation(input) {
+    if (input.kind === IMAGES_BLOCK_KIND ||
+        !isSanitizedHtmlKind(input.kind) ||
+        input.contentFormat !== "html" ||
+        input.content === null) {
+        return null;
+    }
+    const hasImagesBlock = withParsedDocument(input.content, (body) => body.querySelector("div[data-images]") !== null);
+    return hasImagesBlock
+        ? violation("images_block_pdf_only", input.kind, `Record images blocks are only allowed in templates of kind ${IMAGES_BLOCK_KIND}`)
+        : null;
+}
 export function sanitizeTemplateBody(input) {
     const formatViolation = requiredFormatViolation(input.kind, input.contentFormat);
     if (formatViolation !== null)
         return { ok: false, violations: [formatViolation] };
+    const imagesViolation = imagesBlockViolation(input);
+    if (imagesViolation !== null)
+        return { ok: false, violations: [imagesViolation] };
     if (!isSanitizedHtmlKind(input.kind) ||
         input.contentFormat !== "html" ||
         input.content === null) {
@@ -203,6 +222,7 @@ const VIOLATION_I18N_KEYS = {
     invalid_reference_name: "templateResolver.errors.document.invalidReferenceName",
     embedded_content: "templateResolver.errors.document.embeddedContent",
     unsafe_attribute_value: "templateResolver.errors.document.unsafeAttributeValue",
+    images_block_pdf_only: "templateResolver.errors.document.imagesBlockPdfOnly",
     button_href_not_placeholder: "templateResolver.errors.document.buttonHrefNotPlaceholder",
     document_requires_html_format: "templateResolver.errors.document.documentRequiresHtmlFormat",
     layout_requires_mjml_format: "templateResolver.errors.document.layoutRequiresMjmlFormat",

package/dist/template-resolver/document-schema.d.ts

@@ -3,13 +3,14 @@ export declare function isDocumentPlaceholderHref(href: string): boolean;
 export declare function isAllowedDocumentLinkHref(href: string): boolean;
 export declare function isDocumentReferenceName(value: string): boolean;
 export declare function isDocumentResourceKey(value: string): boolean;
-export declare const DOCUMENT_NODE_NAMES: readonly ["variable", "resource", "button", "divider", "pageBreak", "steps"];
+export declare const DOCUMENT_NODE_NAMES: readonly ["variable", "resource", "button", "divider", "pageBreak", "steps", "images"];
 export declare const DocumentVariable: Node<any, any>;
 export declare const DocumentResource: Node<any, any>;
 export declare const DocumentButton: Node<any, any>;
 export declare const DocumentDivider: Node<any, any>;
 export declare const DocumentPageBreak: Node<any, any>;
 export declare const DocumentSteps: Node<any, any>;
+export declare const DocumentImages: Node<any, any>;
 export declare const DocumentTableRow: Node<import("@tiptap/extension-table").TableRowOptions, any>;
 export declare const DocumentTable: Node<import("@tiptap/extension-table").TableOptions, any>;
 export declare const DocumentTableCell: Node<import("@tiptap/extension-table").TableCellOptions, any>;

package/dist/template-resolver/document-schema.js

@@ -8,6 +8,7 @@ import { Extension, Node } from "@tiptap/core";
 import { Link } from "@tiptap/extension-link";
 import { Table, TableCell, TableHeader, TableRow } from "@tiptap/extension-table";
 import StarterKit from "@tiptap/starter-kit";
+import { createDocumentImagesNode } from "./document-images.js";
 import { createDocumentStepsNode } from "./document-steps.js";
 const PLACEHOLDER_HREF = /^\{\{(.+)\}\}$/;
 const REFERENCE_NAME = /^[A-Za-z_][A-Za-z0-9_]*(\.[A-Za-z_][A-Za-z0-9_]*)*$/;
@@ -65,6 +66,7 @@ export const DOCUMENT_NODE_NAMES = [
     "divider",
     "pageBreak",
     "steps",
+    "images",
 ];
 export const DocumentVariable = Node.create({
     name: "variable",
@@ -170,6 +172,7 @@ export const DocumentPageBreak = Node.create({
     },
 });
 export const DocumentSteps = createDocumentStepsNode(isDocumentReferenceName);
+export const DocumentImages = createDocumentImagesNode(isDocumentReferenceName);
 // A repeat row is a table row carrying `each`: prosemirror-tables requires
 // the tableRow node type, so a separate node type is not an option.
 export const DocumentTableRow = TableRow.extend({
@@ -346,6 +349,7 @@ export const documentExtensions = [
     DocumentDivider,
     DocumentPageBreak,
     DocumentSteps,
+    DocumentImages,
     DocumentTextAlign,
     DocumentTextSize,
     DocumentCondition,

package/dist/template-resolver/feature.d.ts

@@ -1,4 +1,5 @@
 import { type ContentCollectionDefinition } from "@cosmicdrift/kumiko-framework/engine";
+import type { TenantEditableTemplate } from "./template-edit-policy.ts";
 export type TemplateResolverOptions = {
     /** Content collections this app mounts. Declared here rather than inside the
      *  feature because `access` needs the host's role vocabulary — a bundled
@@ -10,6 +11,13 @@ export type TemplateResolverOptions = {
      *  access rule, so the dispatcher enforces the separation instead of a
      *  branch in a shared handler. */
     readonly collections?: readonly ContentCollectionDefinition[];
+    /** Templates a TenantAdmin may edit for the own tenant (override, draft, publish, archive,
+     *  reset, copy-locale, import, resources). Without an entry only a SystemAdmin edits.
+     *  A tenant-edited mail goes out under the platform's name, so the app opts in per
+     *  template instead of the framework guessing which ones a tenant may reword.
+     *  `access` is required: the host decides its role vocabulary here, like for
+     *  `collections`. SystemAdmin always passes. */
+    readonly tenantEditable?: readonly TenantEditableTemplate[];
 };
 export declare function createTemplateResolverFeature(opts?: TemplateResolverOptions): import("@cosmicdrift/kumiko-types/feature").FeatureDefinition & {
     readonly exports: {
@@ -47,6 +55,7 @@ export declare function createTemplateResolverFeature(opts?: TemplateResolverOpt
             preview: import("@cosmicdrift/kumiko-types/handlers").HandlerRef;
             documentBlocks: import("@cosmicdrift/kumiko-types/handlers").HandlerRef;
             exportBundle: import("@cosmicdrift/kumiko-types/handlers").HandlerRef;
+            sendTestStatus: import("@cosmicdrift/kumiko-types/handlers").HandlerRef;
         };
         treeHandle: import("@cosmicdrift/kumiko-types/tree-node").TreeActionsHandle<"template-resolver", {
             readonly edit: {

package/dist/template-resolver/feature.js

@@ -1,33 +1,34 @@
 import { createSystemConfig, defineFeature, } from "@cosmicdrift/kumiko-framework/engine";
-import { isCollectionRefusedKind } from "./constants.js";
+import { DEFAULT_COLLECTION_ACCESS, isCollectionRefusedKind } from "./constants.js";
 import { bySlugQuery } from "./handlers/by-slug.query.js";
 import { byTenantQuery } from "./handlers/by-tenant.query.js";
 import { makeCollectionItemQuery } from "./handlers/collection-item.query.js";
 import { makeCollectionListQuery } from "./handlers/collection-list.query.js";
 import { makeCollectionSetWrite } from "./handlers/collection-set.write.js";
-import { copyLocaleWrite } from "./handlers/copy-locale.write.js";
+import { makeCopyLocaleWrite } from "./handlers/copy-locale.write.js";
 import { diffToSystemQuery } from "./handlers/diff-to-system.query.js";
-import { discardDraftSystemWrite, discardDraftWrite } from "./handlers/discard-draft.write.js";
+import { makeDiscardDraftSystemWrite, makeDiscardDraftWrite, } from "./handlers/discard-draft.write.js";
 import { documentBlocksQuery } from "./handlers/document-blocks.query.js";
 import { exportBundleQuery } from "./handlers/export-bundle.query.js";
 import { findByIdQuery } from "./handlers/find-by-id.query.js";
-import { importBundleWrite } from "./handlers/import-bundle.write.js";
+import { makeImportBundleWrite } from "./handlers/import-bundle.write.js";
 import { importBundleSystemWrite } from "./handlers/import-bundle-system.write.js";
 import { layoutSourceQuery } from "./handlers/layout-source.query.js";
 import { listQuery } from "./handlers/list.query.js";
-import { overviewQuery } from "./handlers/overview.query.js";
-import { patchDraftWrite } from "./handlers/patch-draft.write.js";
+import { makeOverviewQuery } from "./handlers/overview.query.js";
+import { makePatchDraftWrite } from "./handlers/patch-draft.write.js";
 import { previewQuery } from "./handlers/preview.query.js";
-import { resetToSystemWrite } from "./handlers/reset-to-system.write.js";
-import { resourceLinkPdfWrite } from "./handlers/resource-link-pdf.write.js";
-import { resourceRemoveWrite } from "./handlers/resource-remove.write.js";
-import { resourceUploadWrite } from "./handlers/resource-upload.write.js";
-import { sendTestWrite } from "./handlers/send-test.write.js";
-import { setWrite } from "./handlers/set.write.js";
+import { makeResetToSystemWrite } from "./handlers/reset-to-system.write.js";
+import { makeResourceLinkPdfWrite } from "./handlers/resource-link-pdf.write.js";
+import { makeResourceRemoveWrite } from "./handlers/resource-remove.write.js";
+import { makeResourceUploadWrite } from "./handlers/resource-upload.write.js";
+import { makeSendTestWrite } from "./handlers/send-test.write.js";
+import { sendTestStatusQuery } from "./handlers/send-test-status.query.js";
+import { makeSetWrite } from "./handlers/set.write.js";
 import { tenantOverridesQuery } from "./handlers/tenant-overrides.query.js";
-import { archiveSystemWrite, archiveWrite, publishSystemWrite, publishWrite, } from "./handlers/toggle-status.write.js";
+import { makeArchiveSystemWrite, makeArchiveWrite, makePublishSystemWrite, makePublishWrite, } from "./handlers/toggle-status.write.js";
 import { upsertSystemWrite } from "./handlers/upsert-system.write.js";
-import { upsertTenantWrite } from "./handlers/upsert-tenant.write.js";
+import { makeUpsertTenantWrite } from "./handlers/upsert-tenant.write.js";
 import { usageQuery } from "./handlers/usage.query.js";
 import { validateQuery } from "./handlers/validate.query.js";
 import { templateResourceEntity } from "./table.js";
@@ -39,19 +40,39 @@ function assertCollectionKindsAllowed(collections) {
         }
     }
 }
+function assertTenantEditableValid(entries) {
+    const seen = new Set();
+    for (const entry of entries) {
+        const key = `${entry.kind}/${entry.slug}`;
+        if (seen.has(key)) {
+            throw new Error(`template-resolver: tenantEditable lists "${key}" twice`);
+        }
+        seen.add(key);
+        if (entry.slug.trim() === "") {
+            throw new Error(`template-resolver: tenantEditable entry of kind "${entry.kind}" has an empty slug`);
+        }
+        if (entry.access.roles.length === 0) {
+            throw new Error(`template-resolver: tenantEditable entry "${entry.kind}/${entry.slug}" has no roles in access`);
+        }
+    }
+}
 export function createTemplateResolverFeature(opts = {}) {
     const collections = opts.collections ?? [];
     assertCollectionKindsAllowed(collections);
+    const tenantEditable = opts.tenantEditable ?? [];
+    assertTenantEditableValid(tenantEditable);
+    const policy = { tenantEditable };
     const hasUserOwned = collections.some((c) => c.ownership === "user");
     return defineFeature("template-resolver", (r) => {
         r.describe([
             "Every piece of editable text lives here, in one entity: mail bodies, notification texts, PDF document templates, AI prompts and plain text blocks. What a record is used for is the `kind` (`notification`, `mail`, `mail-layout`, `document-pdf`, `pdf-layout`, `ai-prompt`, `text-block`, `snippet`, `image-snapshot`).",
             "Reading is one call — `ctx.templateResolver.resolveTemplate({ tenantId, slug, kind, locale })`. It walks four levels: tenant+locale, system+locale, tenant+fallback-locale, system+fallback-locale. A tenant overrides a system default by simply having its own record; no application code changes. Writing programmatically goes through the `upsertSystem`, `upsertTenant`, `publish` and `archive` write handlers; a SystemAdmin retires or restores a system default with `publishSystem` and `archiveSystem`, and a tenant drops its override with `resetToSystem`. Saving a draft over an active template keeps the active version served and stores the edit beside it (column `draft`); `publish` makes it the served version, `discardDraft` / `discardDraftSystem` throws it away.",
+            'Editing templates is for SystemAdmin only. A TenantAdmin edits only the templates the app unlocks at the mount site, `createTemplateResolverFeature({ tenantEditable: [{ kind: "mail", slug: "status-update", access: { roles: ["TenantAdmin"] } }] })`, and every write handler enforces that on the server (override, draft, publish, archive, reset, copy-locale, import, resources, `set`). Each entry carries the `access` roles allowed to edit it, because a bundled feature cannot know the host\'s roles. Reading and delivery do not depend on it: a tenant override that exists is served. A collection mounted without `access` is SystemAdmin only.',
             "Text an editor should be able to change belongs in a collection, declared at mount: `createTemplateResolverFeature({ collections: [{ id, kind, access: { roles }, nav }] })`. It appears in the navigation, and `access` is part of the mount because a bundled feature cannot know the host's roles. Each collection gets its own `<id>-list` / `<id>-item` / `<id>-set` handlers, so the dispatcher enforces the separation.",
             "How a collection is edited follows from `contentFormat`: `plain` gives a text area, `rich` a small WYSIWYG (bold, italic, headings, lists, links), `markdown` a text area that stores markdown text (same insertable chips as `plain`). All three offer the collection's `variableSchema` as insertable chips and a preview rendered with sample data — an editor sees what `{{firstName}}` becomes without sending a mail. An app can register its own editor for a format; the last `clientFeature` that registers a format wins (a conflict logs a warning).",
             'A collection is tenant-wide by default. With `ownership: "user"` every user keeps their own entries — mail signatures being the obvious case. Those rows live in the separate `user-content-entry` entity and count as user data, so mounting one also requires the `template-resolver-user-data` feature and a migration on the app side.',
             "`validate` dry-runs the write pipeline for a draft (sanitizer, layout rules, placeholders) and reports what the template uses and misses. `export-bundle` / `import-bundle` (and `import-bundle-system`) move one template with all locales and resource files between tenants or environments; `copy-locale` starts a translation from an existing locale. Layouts are structured: a mail or PDF layout is `data-header` / `data-content` / `data-signature` / `data-footer` regions, and mjml layout source is system-only.",
-            "`preview` renders a draft (or the stored template) with sample values taken from the `example` of each declared variable, through the same gates and the same mail renderer as a real send, and returns subject, html, `displayHtml` (the html with cid images as data URIs for an editor), text, attachments (inline images and files) and `checks` (images resolved, plain text present, size under 10 MiB, required placeholders used); nothing is saved or sent. `send-test` mails that rendering to the calling user's own address only, subject prefixed with `[TEST]`, at most 10 per user and hour; it needs `delivery`, `channel-email` and `renderer-mail-html` to be mounted.",
+            "`preview` renders a draft (or the stored template) with sample values taken from the `example` of each declared variable, through the same gates and the same mail renderer as a real send, and returns subject, html, `displayHtml` (the html with cid images as data URIs for an editor), text, attachments (inline images and files) and `checks` (images resolved, plain text present, size under 10 MiB, required placeholders used); nothing is saved or sent. `send-test` mails that rendering to the calling user's own address only, subject prefixed with `[TEST]`, at most 10 per user and hour; it needs `delivery`, `channel-email` and `renderer-mail-html` to be mounted. `send-test-status` tells an editor beforehand whether that send can work for the caller (`canSend`, else `reason` `no_channel` or `no_address`), never returning the address.",
             'Images used by a template (`<img data-resource="logo">`) are uploaded with `resourceUpload`, which re-encodes them, stores a file and links it under the key; `resourceRemove` unlinks it. `linkedResources` is written only through these two handlers. With `purpose: "attachment"` and a `fileName`, `resourceUpload` stores a PDF, PNG or JPEG as a file attachment of a mail template (original bytes, at most 10) that the mail renderer attaches after the inline images. `resourceLinkPdf` instead links a `document-pdf` template under a key: every mail sent from the template then carries that PDF, rendered at send time with the mail\'s own variables and locale, under a file name pattern such as `invoice-{{number}}.pdf`; files and linked PDFs share the limit of 10.',
             "Replaces the former `text-content` feature; its blocks now live here as kind `text-block`.",
         ].join("\n\n"));
@@ -74,23 +95,23 @@ export function createTemplateResolverFeature(opts = {}) {
             r.entity({ name: "user-content-entry", ...userContentEntryEntity });
         const handlers = {
             upsertSystem: r.writeHandler(upsertSystemWrite),
-            upsertTenant: r.writeHandler(upsertTenantWrite),
-            publish: r.writeHandler(publishWrite),
-            archive: r.writeHandler(archiveWrite),
-            publishSystem: r.writeHandler(publishSystemWrite),
-            archiveSystem: r.writeHandler(archiveSystemWrite),
-            discardDraft: r.writeHandler(discardDraftWrite),
-            discardDraftSystem: r.writeHandler(discardDraftSystemWrite),
-            resetToSystem: r.writeHandler(resetToSystemWrite),
-            set: r.writeHandler(setWrite),
-            importBundle: r.writeHandler(importBundleWrite),
+            upsertTenant: r.writeHandler(makeUpsertTenantWrite(policy)),
+            publish: r.writeHandler(makePublishWrite(policy)),
+            archive: r.writeHandler(makeArchiveWrite(policy)),
+            publishSystem: r.writeHandler(makePublishSystemWrite(policy)),
+            archiveSystem: r.writeHandler(makeArchiveSystemWrite(policy)),
+            discardDraft: r.writeHandler(makeDiscardDraftWrite(policy)),
+            discardDraftSystem: r.writeHandler(makeDiscardDraftSystemWrite(policy)),
+            resetToSystem: r.writeHandler(makeResetToSystemWrite(policy)),
+            set: r.writeHandler(makeSetWrite(policy)),
+            importBundle: r.writeHandler(makeImportBundleWrite(policy)),
             importBundleSystem: r.writeHandler(importBundleSystemWrite),
-            copyLocale: r.writeHandler(copyLocaleWrite),
-            resourceUpload: r.writeHandler(resourceUploadWrite),
-            resourceRemove: r.writeHandler(resourceRemoveWrite),
-            resourceLinkPdf: r.writeHandler(resourceLinkPdfWrite),
-            sendTest: r.writeHandler(sendTestWrite),
-            patchDraft: r.writeHandler(patchDraftWrite),
+            copyLocale: r.writeHandler(makeCopyLocaleWrite(policy)),
+            resourceUpload: r.writeHandler(makeResourceUploadWrite(policy)),
+            resourceRemove: r.writeHandler(makeResourceRemoveWrite(policy)),
+            resourceLinkPdf: r.writeHandler(makeResourceLinkPdfWrite(policy)),
+            sendTest: r.writeHandler(makeSendTestWrite(policy)),
+            patchDraft: r.writeHandler(makePatchDraftWrite(policy)),
         };
         const queries = {
             findById: r.queryHandler(findByIdQuery),
@@ -98,7 +119,7 @@ export function createTemplateResolverFeature(opts = {}) {
             bySlug: r.queryHandler(bySlugQuery),
             byTenant: r.queryHandler(byTenantQuery),
             usage: r.queryHandler(usageQuery),
-            overview: r.queryHandler(overviewQuery),
+            overview: r.queryHandler(makeOverviewQuery(policy)),
             layoutSource: r.queryHandler(layoutSourceQuery),
             tenantOverrides: r.queryHandler(tenantOverridesQuery),
             diffToSystem: r.queryHandler(diffToSystemQuery),
@@ -106,9 +127,13 @@ export function createTemplateResolverFeature(opts = {}) {
             preview: r.queryHandler(previewQuery),
             documentBlocks: r.queryHandler(documentBlocksQuery),
             exportBundle: r.queryHandler(exportBundleQuery),
+            sendTestStatus: r.queryHandler(sendTestStatusQuery),
         };
         for (const collection of collections) {
-            r.contentCollection(collection);
+            r.contentCollection({
+                ...collection,
+                access: collection.access ?? DEFAULT_COLLECTION_ACCESS,
+            });
             r.queryHandler(makeCollectionListQuery(collection));
             r.queryHandler(makeCollectionItemQuery(collection));
             r.writeHandler(makeCollectionSetWrite(collection));

package/dist/template-resolver/handlers/collection-item.query.js

@@ -1,7 +1,8 @@
 import { fetchOne } from "@cosmicdrift/kumiko-framework/db";
 import { defineQueryHandler, } from "@cosmicdrift/kumiko-framework/engine";
 import * as z from "zod";
-import { collectionStore, DEFAULT_COLLECTION_ACCESS, toCollectionEntry, } from "./collection-shared.js";
+import { DEFAULT_COLLECTION_ACCESS } from "../constants.js";
+import { collectionStore, toCollectionEntry, } from "./collection-shared.js";
 // Single entry of one collection, for the editor behind a tree node. Same
 // per-collection construction as collection-list — see there for why.
 export function makeCollectionItemQuery(collection) {

package/dist/template-resolver/handlers/collection-list.query.js

@@ -1,7 +1,8 @@
 import { castTenantRows, selectMany } from "@cosmicdrift/kumiko-framework/db";
 import { defineQueryHandler, } from "@cosmicdrift/kumiko-framework/engine";
 import * as z from "zod";
-import { collectionStore, DEFAULT_COLLECTION_ACCESS, toCollectionEntry, } from "./collection-shared.js";
+import { DEFAULT_COLLECTION_ACCESS } from "../constants.js";
+import { collectionStore, toCollectionEntry, } from "./collection-shared.js";
 // One list handler per declared collection: `kind`, `ownership` and `access`
 // come from the declaration, never from the payload.
 //