@cosmicdrift/kumiko-bundled-features 0.377.0 → 0.378.0

package/dist/template-resolver/handlers/set.write.js

@@ -5,6 +5,7 @@ import * as z from "zod";
 import { requireForTenant } from "../../shared/index.js";
 import { TEMPLATE_KINDS, TEXT_BLOCK_KIND, UPSERT_KINDS } from "../constants.js";
 import { templateResourcesTable } from "../table.js";
+import { refuseTemplateEdit, templateEditAccess, } from "../template-edit-policy.js";
 import { resolveTemplateVariables } from "../template-validation.js";
 import { contentFormatSchema, executor, folderSchema, localeSchema, slugSchema } from "./shared.js";
 import { parseStoredJson, storedRecord } from "./template-gates.js";
@@ -28,100 +29,103 @@ import { gateTemplateWrite } from "./template-write.js";
 //
 // Kinds that upsertSystem/upsertTenant also write run the same validation
 // pipeline here, and because saving publishes, publish issues reject too.
-export const setWrite = defineWriteHandler({
-    name: "set",
-    schema: z.object({
-        slug: slugSchema,
-        locale: localeSchema,
-        /** Which kind to author. Defaults to text-block. */
-        kind: z.enum(TEMPLATE_KINDS).optional(),
-        title: z.string().min(1).max(200),
-        content: z.string().max(200_000).nullable(),
-        contentFormat: contentFormatSchema.default("markdown"),
-        /** Folder path for the content tree. Optional + null = root node. */
-        folder: folderSchema.nullable().optional(),
-        /** Optional cross-tenant write — SystemAdmin only. Typical use: the
-         *  editor lets a SystemAdmin write onto SYSTEM_TENANT_ID, otherwise the
-         *  text lands on their own platform tenant and the legal routes miss it. */
-        tenantIdOverride: z.string().min(1).optional(),
-    }),
-    // SystemAdmin is a global role, TenantAdmin is per tenant-membership — both
-    // paths are needed explicitly, otherwise nobody can set SYSTEM_TENANT texts.
-    access: { roles: ["TenantAdmin", "SystemAdmin"] },
-    description: "Creates or overwrites one content-tree resource addressed by slug, kind and locale, carrying a title and folder and going live on save with no draft stage; a SystemAdmin may target the system tenant, where shared legal and marketing copy lives.",
-    handler: async (event, ctx) => {
-        const override = event.payload.tenantIdOverride;
-        // @cast-boundary engine-payload — override is a zod-validated string, the
-        // user's own tenantId is already TenantId-branded.
-        const tenantId = (override ?? event.user.tenantId);
-        const { db, streamTenantId } = requireForTenant(ctx, tenantId);
-        const kind = event.payload.kind ?? TEXT_BLOCK_KIND;
-        const existing = await fetchOne(db, templateResourcesTable, {
-            tenantId,
-            slug: event.payload.slug,
-            kind,
-            locale: event.payload.locale,
-        });
-        const scope = tenantId === SYSTEM_TENANT_ID ? "system" : "tenant";
-        let content = event.payload.content;
-        if (isOneOf(UPSERT_KINDS, kind)) {
-            const gated = gateTemplateWrite({
+export function makeSetWrite(policy) {
+    return defineWriteHandler({
+        name: "set",
+        schema: z.object({
+            slug: slugSchema,
+            locale: localeSchema,
+            /** Which kind to author. Defaults to text-block. */
+            kind: z.enum(TEMPLATE_KINDS).optional(),
+            title: z.string().min(1).max(200),
+            content: z.string().max(200_000).nullable(),
+            contentFormat: contentFormatSchema.default("markdown"),
+            /** Folder path for the content tree. Optional + null = root node. */
+            folder: folderSchema.nullable().optional(),
+            /** Optional cross-tenant write — SystemAdmin only. Typical use: the
+             *  editor lets a SystemAdmin write onto SYSTEM_TENANT_ID, otherwise the
+             *  text lands on their own platform tenant and the legal routes miss it. */
+            tenantIdOverride: z.string().min(1).optional(),
+        }),
+        access: templateEditAccess(policy.tenantEditable),
+        description: "Creates or overwrites one content-tree resource addressed by slug, kind and locale, carrying a title and folder and going live on save with no draft stage; a SystemAdmin may target the system tenant, where shared legal and marketing copy lives. A TenantAdmin may write only the slug and kind pairs the app lists in tenantEditable, otherwise SystemAdmin only.",
+        handler: async (event, ctx) => {
+            const kind = event.payload.kind ?? TEXT_BLOCK_KIND;
+            const refused = refuseTemplateEdit(policy, event.user, { slug: event.payload.slug, kind });
+            if (refused !== null)
+                return refused;
+            const override = event.payload.tenantIdOverride;
+            // @cast-boundary engine-payload — override is a zod-validated string, the
+            // user's own tenantId is already TenantId-branded.
+            const tenantId = (override ?? event.user.tenantId);
+            const { db, streamTenantId } = requireForTenant(ctx, tenantId);
+            const existing = await fetchOne(db, templateResourcesTable, {
+                tenantId,
+                slug: event.payload.slug,
                 kind,
-                scope,
-                contentFormat: event.payload.contentFormat,
+                locale: event.payload.locale,
+            });
+            const scope = tenantId === SYSTEM_TENANT_ID ? "system" : "tenant";
+            let content = event.payload.content;
+            if (isOneOf(UPSERT_KINDS, kind)) {
+                const gated = gateTemplateWrite({
+                    kind,
+                    scope,
+                    contentFormat: event.payload.contentFormat,
+                    content,
+                    rawMeta: parseStoredJson(existing?.meta ?? null),
+                    variables: resolveTemplateVariables(ctx.registry, event.payload.slug, storedRecord(existing?.variableSchema ?? null)),
+                }, "active");
+                if (!gated.ok)
+                    return gated.failure;
+                content = gated.evaluated.content;
+            }
+            const fields = {
+                slug: event.payload.slug,
+                kind,
+                locale: event.payload.locale,
+                title: event.payload.title,
                 content,
-                rawMeta: parseStoredJson(existing?.meta ?? null),
-                variables: resolveTemplateVariables(ctx.registry, event.payload.slug, storedRecord(existing?.variableSchema ?? null)),
-            }, "active");
-            if (!gated.ok)
-                return gated.failure;
-            content = gated.evaluated.content;
-        }
-        const fields = {
-            slug: event.payload.slug,
-            kind,
-            locale: event.payload.locale,
-            title: event.payload.title,
-            content,
-            contentFormat: event.payload.contentFormat,
-            folder: event.payload.folder ?? null,
-            variableSchema: "{}",
-            linkedResources: "{}",
-            scope,
-            parentTemplateId: null,
-            // Text blocks have no draft stage — saving publishes, so resolveTemplate
-            // (which only returns active rows) finds them.
-            status: "active",
-        };
-        if (existing) {
-            const result = await executor.update({
-                id: existing.id,
-                version: existing.version,
-                // Only the editable columns — slug/kind/locale are the unique key,
-                // and rewriting scope/status/variableSchema here would reset whatever
-                // the template upserts put on the row.
-                changes: {
-                    title: fields.title,
-                    content: fields.content,
-                    contentFormat: fields.contentFormat,
-                    folder: fields.folder,
-                },
-            }, event.user, db, { streamTenantId });
+                contentFormat: event.payload.contentFormat,
+                folder: event.payload.folder ?? null,
+                variableSchema: "{}",
+                linkedResources: "{}",
+                scope,
+                parentTemplateId: null,
+                // Text blocks have no draft stage — saving publishes, so resolveTemplate
+                // (which only returns active rows) finds them.
+                status: "active",
+            };
+            if (existing) {
+                const result = await executor.update({
+                    id: existing.id,
+                    version: existing.version,
+                    // Only the editable columns — slug/kind/locale are the unique key,
+                    // and rewriting scope/status/variableSchema here would reset whatever
+                    // the template upserts put on the row.
+                    changes: {
+                        title: fields.title,
+                        content: fields.content,
+                        contentFormat: fields.contentFormat,
+                        folder: fields.folder,
+                    },
+                }, event.user, db, { streamTenantId });
+                if (!result.isSuccess)
+                    return result;
+                return {
+                    isSuccess: true,
+                    data: { slug: event.payload.slug, locale: event.payload.locale, isNew: false },
+                };
+            }
+            const result = await executor.create({ ...fields, tenantId }, event.user, db, {
+                streamTenantId,
+            });
             if (!result.isSuccess)
                 return result;
             return {
                 isSuccess: true,
-                data: { slug: event.payload.slug, locale: event.payload.locale, isNew: false },
+                data: { slug: event.payload.slug, locale: event.payload.locale, isNew: true },
             };
-        }
-        const result = await executor.create({ ...fields, tenantId }, event.user, db, {
-            streamTenantId,
-        });
-        if (!result.isSuccess)
-            return result;
-        return {
-            isSuccess: true,
-            data: { slug: event.payload.slug, locale: event.payload.locale, isNew: true },
-        };
-    },
-});
+        },
+    });
+}

package/dist/template-resolver/handlers/toggle-status.write.d.ts

@@ -1,11 +1,10 @@
 import { type HandlerContext } from "@cosmicdrift/kumiko-framework/engine";
 import * as z from "zod";
 import type { TemplateResourceRow } from "../table.ts";
+import { type TemplateEditPolicy } from "../template-edit-policy.ts";
 type TemplateStatus = "active" | "archived";
 export type StatusTarget = "own" | "system";
-export declare function writeAccessFor(target: StatusTarget): {
-    roles: string[];
-};
+export declare function writeAccessFor(target: StatusTarget, policy: TemplateEditPolicy): import("@cosmicdrift/kumiko-types/handlers").RoleAccessRule;
 export declare function loadTargetRow(ctx: HandlerContext, target: StatusTarget, user: {
     readonly tenantId: string;
 }, id: string): Promise<{
@@ -13,25 +12,25 @@ export declare function loadTargetRow(ctx: HandlerContext, target: StatusTarget,
     scoped: import("@cosmicdrift/kumiko-types/handlers").TenantWriteTarget | null;
     row: TemplateResourceRow | null;
 }>;
-export declare const archiveWrite: import("@cosmicdrift/kumiko-types/define-handler").WriteHandlerDefinition<string, z.ZodObject<{
+export declare function makeArchiveWrite(policy: TemplateEditPolicy): import("@cosmicdrift/kumiko-types/define-handler").WriteHandlerDefinition<string, z.ZodObject<{
     id: z.ZodString;
 }, z.core.$strip>, {
     id: string;
     status: TemplateStatus;
 }, import("@cosmicdrift/kumiko-types/event-type-map").KumikoEventTypeMap, undefined>;
-export declare const publishWrite: import("@cosmicdrift/kumiko-types/define-handler").WriteHandlerDefinition<string, z.ZodObject<{
+export declare function makePublishWrite(policy: TemplateEditPolicy): import("@cosmicdrift/kumiko-types/define-handler").WriteHandlerDefinition<string, z.ZodObject<{
     id: z.ZodString;
 }, z.core.$strip>, {
     id: string;
     status: TemplateStatus;
 }, import("@cosmicdrift/kumiko-types/event-type-map").KumikoEventTypeMap, undefined>;
-export declare const archiveSystemWrite: import("@cosmicdrift/kumiko-types/define-handler").WriteHandlerDefinition<string, z.ZodObject<{
+export declare function makeArchiveSystemWrite(policy: TemplateEditPolicy): import("@cosmicdrift/kumiko-types/define-handler").WriteHandlerDefinition<string, z.ZodObject<{
     id: z.ZodString;
 }, z.core.$strip>, {
     id: string;
     status: TemplateStatus;
 }, import("@cosmicdrift/kumiko-types/event-type-map").KumikoEventTypeMap, undefined>;
-export declare const publishSystemWrite: import("@cosmicdrift/kumiko-types/define-handler").WriteHandlerDefinition<string, z.ZodObject<{
+export declare function makePublishSystemWrite(policy: TemplateEditPolicy): import("@cosmicdrift/kumiko-types/define-handler").WriteHandlerDefinition<string, z.ZodObject<{
     id: z.ZodString;
 }, z.core.$strip>, {
     id: string;

package/dist/template-resolver/handlers/toggle-status.write.js

@@ -5,6 +5,7 @@ import * as z from "zod";
 import { requireForTenant } from "../../shared/index.js";
 import { templateResourcesTable } from "../table.js";
 import { activationChanges, parseTemplateDraft, toWorkingRow } from "../template-draft.js";
+import { refuseMissingTemplate, refuseTemplateEdit, templateEditAccess, } from "../template-edit-policy.js";
 import { executor } from "./shared.js";
 import { publishGateIssues } from "./template-gates.js";
 function isRowOfTarget(row, target, callerTenantId) {
@@ -12,8 +13,10 @@ function isRowOfTarget(row, target, callerTenantId) {
         ? row.tenantId === SYSTEM_TENANT_ID && row.scope === "system"
         : row.tenantId === callerTenantId && row.scope === "tenant";
 }
-export function writeAccessFor(target) {
-    return { roles: target === "system" ? ["SystemAdmin"] : ["TenantAdmin", "SystemAdmin"] };
+export function writeAccessFor(target, policy) {
+    return target === "system"
+        ? { roles: ["SystemAdmin"] }
+        : templateEditAccess(policy.tenantEditable);
 }
 // The tenant db also reads system rows; the row's own tenant must match the
 // target or the executor would append to a foreign event stream.
@@ -34,18 +37,25 @@ function planStatusChange(ctx, row, status) {
     }
     return { ok: true, changes: { ...parseTemplateDraft(row.draft), ...activationChanges(row) } };
 }
-function createStatusUpdateHandler(name, target, status, description) {
+function createStatusUpdateHandler(policy, name, target, status, description) {
     return defineWriteHandler({
         name,
         schema: z.object({ id: z.string().min(1) }),
-        access: writeAccessFor(target),
+        access: writeAccessFor(target, policy),
         // A system template change reaches every tenant without an override.
         ...(target === "system" ? { agent: { risk: "high" } } : {}),
         description,
         handler: async (event, ctx) => {
             const { db, scoped, row } = await loadTargetRow(ctx, target, event.user, event.payload.id);
-            if (!row)
-                return writeFailure(new NotFoundError("template-resource", event.payload.id));
+            if (!row) {
+                const refused = target === "own" ? refuseMissingTemplate(policy, event.user) : null;
+                return refused ?? writeFailure(new NotFoundError("template-resource", event.payload.id));
+            }
+            if (target === "own") {
+                const refused = refuseTemplateEdit(policy, event.user, row);
+                if (refused !== null)
+                    return refused;
+            }
             const plan = planStatusChange(ctx, row, status);
             if (!plan.ok)
                 return plan.failure;
@@ -56,7 +66,15 @@ function createStatusUpdateHandler(name, target, status, description) {
         },
     });
 }
-export const archiveWrite = createStatusUpdateHandler("archive", "own", "archived", "Sets one template resource of the caller's tenant to archived so the resolver stops serving it while the row and its content survive; use it to retire a template reversibly instead of deleting it. An open draft stays.");
-export const publishWrite = createStatusUpdateHandler("publish", "own", "active", "Sets one template resource of the caller's tenant to active so the resolver starts serving it; use it to release a draft written by upsert-tenant (a draft saved beside an active version replaces it), or to bring an archived template back; a version with unknown placeholders or unused required variables is refused and the served version stays.");
-export const archiveSystemWrite = createStatusUpdateHandler("archive-system", "system", "archived", "Sets one system-default template to archived so the resolver stops serving it to every tenant that has no override; SystemAdmin only, reversible with publish-system.");
-export const publishSystemWrite = createStatusUpdateHandler("publish-system", "system", "active", "Sets one system-default template to active so the resolver serves it again to every tenant that has no override; an open draft beside the active version replaces it; SystemAdmin only, a version with unknown placeholders or unused required variables is refused.");
+export function makeArchiveWrite(policy) {
+    return createStatusUpdateHandler(policy, "archive", "own", "archived", "Sets one template resource of the caller's tenant to archived so the resolver stops serving it while the row and its content survive; use it to retire a template reversibly instead of deleting it. An open draft stays. Outside the templates the app lists in tenantEditable only a SystemAdmin may use it.");
+}
+export function makePublishWrite(policy) {
+    return createStatusUpdateHandler(policy, "publish", "own", "active", "Sets one template resource of the caller's tenant to active so the resolver starts serving it; use it to release a draft written by upsert-tenant (a draft saved beside an active version replaces it), or to bring an archived template back; a version with unknown placeholders or unused required variables is refused and the served version stays. Outside the templates the app lists in tenantEditable only a SystemAdmin may use it.");
+}
+export function makeArchiveSystemWrite(policy) {
+    return createStatusUpdateHandler(policy, "archive-system", "system", "archived", "Sets one system-default template to archived so the resolver stops serving it to every tenant that has no override; SystemAdmin only, reversible with publish-system.");
+}
+export function makePublishSystemWrite(policy) {
+    return createStatusUpdateHandler(policy, "publish-system", "system", "active", "Sets one system-default template to active so the resolver serves it again to every tenant that has no override; an open draft beside the active version replaces it; SystemAdmin only, a version with unknown placeholders or unused required variables is refused.");
+}

package/dist/template-resolver/handlers/upsert-tenant.write.d.ts

@@ -1,5 +1,6 @@
 import * as z from "zod";
-export declare const upsertTenantWrite: import("@cosmicdrift/kumiko-types/define-handler").WriteHandlerDefinition<"upsert-tenant", z.ZodObject<{
+import { type TemplateEditPolicy } from "../template-edit-policy.ts";
+export declare function makeUpsertTenantWrite(policy: TemplateEditPolicy): import("@cosmicdrift/kumiko-types/define-handler").WriteHandlerDefinition<"upsert-tenant", z.ZodObject<{
     slug: z.ZodString;
     kind: z.ZodEnum<{
         "ai-prompt": "ai-prompt";

package/dist/template-resolver/handlers/upsert-tenant.write.js

@@ -1,5 +1,6 @@
 import { defineWriteHandler } from "@cosmicdrift/kumiko-framework/engine";
 import * as z from "zod";
+import { refuseTemplateEdit, templateEditAccess, } from "../template-edit-policy.js";
 import { resolveTemplateVariables } from "../template-validation.js";
 import { upsertPayloadSchema } from "./shared.js";
 import { writeTemplateRow } from "./template-write.js";
@@ -8,27 +9,32 @@ import { writeTemplateRow } from "./template-write.js";
 // via publish-Handler. SystemAdmin kann via tenantIdOverride für
 // einen anderen Tenant schreiben (typisch: Plattform-Admin-UI das
 // Tenant-Templates kuratiert).
-export const upsertTenantWrite = defineWriteHandler({
-    name: "upsert-tenant",
-    schema: upsertPayloadSchema.extend({
-        tenantIdOverride: z.string().min(1).optional(),
-        status: z.enum(["draft", "active"]).default("draft"),
-    }),
-    access: { roles: ["TenantAdmin", "SystemAdmin"] },
-    description: "Creates or overwrites a tenant-scoped template override with its variable schema, landing as a draft that only publish makes live (over an active override the draft is stored beside it, the active version keeps being served until publish); it refuses a system-tenant target, which is what upsert-system is for.",
-    handler: async (event, ctx) => {
-        // @cast-boundary engine-payload — override aus Zod-parsed string,
-        // event.user.tenantId schon TenantId-branded; union als TenantId casten
-        // ist legit (override ist UUID-Format-validiert in schema).
-        const tenantId = (event.payload.tenantIdOverride ?? event.user.tenantId);
-        return writeTemplateRow({
-            ctx,
-            user: event.user,
-            tenantId,
-            scope: "tenant",
-            status: event.payload.status,
-            variables: resolveTemplateVariables(ctx.registry, event.payload.slug, event.payload.variableSchema),
-            payload: event.payload,
-        });
-    },
-});
+export function makeUpsertTenantWrite(policy) {
+    return defineWriteHandler({
+        name: "upsert-tenant",
+        schema: upsertPayloadSchema.extend({
+            tenantIdOverride: z.string().min(1).optional(),
+            status: z.enum(["draft", "active"]).default("draft"),
+        }),
+        access: templateEditAccess(policy.tenantEditable),
+        description: "Creates or overwrites a tenant-scoped template override with its variable schema, landing as a draft that only publish makes live (over an active override the draft is stored beside it, the active version keeps being served until publish); it refuses a system-tenant target, which is what upsert-system is for; a TenantAdmin may write it only for templates the app lists in tenantEditable, otherwise SystemAdmin only.",
+        handler: async (event, ctx) => {
+            const refused = refuseTemplateEdit(policy, event.user, event.payload);
+            if (refused !== null)
+                return refused;
+            // @cast-boundary engine-payload — override is a zod-validated string and
+            // event.user.tenantId is already TenantId-branded; forTenant rejects the
+            // override for non-SystemAdmins.
+            const tenantId = (event.payload.tenantIdOverride ?? event.user.tenantId);
+            return writeTemplateRow({
+                ctx,
+                user: event.user,
+                tenantId,
+                scope: "tenant",
+                status: event.payload.status,
+                variables: resolveTemplateVariables(ctx.registry, event.payload.slug, event.payload.variableSchema),
+                payload: event.payload,
+            });
+        },
+    });
+}

package/dist/template-resolver/index.d.ts

@@ -1,9 +1,10 @@
+export { isResourceImageContentType } from "../shared/index.ts";
 export { createTemplateResolverApi, type ResolveRequest, requireTemplateResolver, TemplateNotFoundError, type TemplateResolverApi, type TemplateResource, } from "./api.ts";
-export { type CompileDocumentBodyOptions, collectDocumentResourceKeys, compileDocumentBodyToHandlebars, toResourceDataUri, } from "./compile-document-body.ts";
+export { type CompileDocumentBodyOptions, collectDocumentImageVariables, collectDocumentResourceKeys, compileDocumentBodyToHandlebars, toResourceDataUri, } from "./compile-document-body.ts";
 export { CONTENT_FORMATS, type ContentFormat, DEFAULT_MAIL_LAYOUT_SLUG, DEFAULT_PDF_LAYOUT_SLUG, DOCUMENT_HTML_KINDS, type DocumentHtmlKind, FALLBACK_LOCALE, NON_RENDER_KINDS, type NonRenderKind, PDF_DEFAULT_MARGIN_MM, PDF_FOOTER_MARGIN_MM, PDF_HEADER_MARGIN_MM, PDF_ORIENTATIONS, PDF_PAGE_FORMATS, type PdfOrientation, type PdfPageFormat, RENDER_KINDS, type RenderKind, SYSTEM_TENANT_ID, TEMPLATE_KINDS, TEMPLATE_SCOPES, TEMPLATE_STATUSES, TEXT_BLOCK_KIND, type TemplateKind, type TemplateScope, type TemplateStatus, UPSERT_KINDS, type UpsertKind, } from "./constants.ts";
 export { type DocumentViolation, type DocumentViolationCode, documentViolationsToFieldIssues, flattenParagraphsToLineBreaks, type SanitizeBodyResult, type SanitizeHtmlResult, sanitizeDocumentHtml, sanitizeTemplateBody, } from "./document-sanitizer.ts";
 export { DOCUMENT_CONDITION_ATTRIBUTE, DOCUMENT_NODE_NAMES, DOCUMENT_TEXT_ALIGNMENTS, DocumentButton, DocumentCondition, DocumentDivider, DocumentLink, DocumentPageBreak, DocumentResource, DocumentTable, DocumentTableCell, DocumentTableHeader, DocumentTableRow, DocumentTextAlign, type DocumentTextAlignment, DocumentVariable, documentExtensions, isAllowedDocumentLinkHref, isDocumentPlaceholderHref, isDocumentReferenceName, isDocumentResourceKey, } from "./document-schema.ts";
-export { createTemplateResolverFeature } from "./feature.ts";
+export { createTemplateResolverFeature, type TemplateResolverOptions } from "./feature.ts";
 export type { LayoutSourceResponse, LayoutSourceRow } from "./handlers/layout-source.query.ts";
 export type { OverviewKindGroup, OverviewOrigin, OverviewResponse, OverviewRow, OverviewUsage, } from "./handlers/overview.query.ts";
 export { localeSchema } from "./handlers/shared.ts";
@@ -16,6 +17,7 @@ export { mapRecordToVariables } from "./record-mapping.ts";
 export { type PreparedTemplateImage, prepareTemplateResourceBeforeTransaction, readTemplateResourceMaxBytes, type StoredTemplateResource, storePreparedTemplateResource, } from "./store-template-resource.ts";
 export { type TemplateResourceRow, templateResourceEntity, templateResourcesTable, } from "./table.ts";
 export { type TemplateBundle, templateBundleSchema } from "./template-bundle.ts";
+export { type TemplateEditPolicy, type TenantEditableTemplate, templateEditAccess, } from "./template-edit-policy.ts";
 export { isMailTemplateMeta, type LayoutTemplateMeta, MAIL_CATEGORIES, MAIL_TONES, type MailCategory, type MailLayoutMeta, type MailTemplateMeta, type MailTone, type PdfTemplateMeta, parseTemplateMeta, pdfAttachmentFileNamePatternSchema, readMailLayoutMeta, readPdfTemplateMeta, type TemplateMeta, type TemplateMetaIssue, type TemplateMetaResult, templateSlugSchema, } from "./template-meta.ts";
 export { type DocumentDraftOutcome, evaluateDocumentDraft } from "./template-preview.ts";
 export { readTemplateResource, type TemplateResourceFile } from "./template-resources.ts";

package/dist/template-resolver/index.js

@@ -1,5 +1,6 @@
+export { isResourceImageContentType } from "../shared/index.js";
 export { createTemplateResolverApi, requireTemplateResolver, TemplateNotFoundError, } from "./api.js";
-export { collectDocumentResourceKeys, compileDocumentBodyToHandlebars, toResourceDataUri, } from "./compile-document-body.js";
+export { collectDocumentImageVariables, collectDocumentResourceKeys, compileDocumentBodyToHandlebars, toResourceDataUri, } from "./compile-document-body.js";
 export { CONTENT_FORMATS, DEFAULT_MAIL_LAYOUT_SLUG, DEFAULT_PDF_LAYOUT_SLUG, DOCUMENT_HTML_KINDS, FALLBACK_LOCALE, NON_RENDER_KINDS, PDF_DEFAULT_MARGIN_MM, PDF_FOOTER_MARGIN_MM, PDF_HEADER_MARGIN_MM, PDF_ORIENTATIONS, PDF_PAGE_FORMATS, RENDER_KINDS, SYSTEM_TENANT_ID, TEMPLATE_KINDS, TEMPLATE_SCOPES, TEMPLATE_STATUSES, TEXT_BLOCK_KIND, UPSERT_KINDS, } from "./constants.js";
 export { documentViolationsToFieldIssues, flattenParagraphsToLineBreaks, sanitizeDocumentHtml, sanitizeTemplateBody, } from "./document-sanitizer.js";
 export { DOCUMENT_CONDITION_ATTRIBUTE, DOCUMENT_NODE_NAMES, DOCUMENT_TEXT_ALIGNMENTS, DocumentButton, DocumentCondition, DocumentDivider, DocumentLink, DocumentPageBreak, DocumentResource, DocumentTable, DocumentTableCell, DocumentTableHeader, DocumentTableRow, DocumentTextAlign, DocumentVariable, documentExtensions, isAllowedDocumentLinkHref, isDocumentPlaceholderHref, isDocumentReferenceName, isDocumentResourceKey, } from "./document-schema.js";
@@ -14,6 +15,7 @@ export { mapRecordToVariables } from "./record-mapping.js";
 export { prepareTemplateResourceBeforeTransaction, readTemplateResourceMaxBytes, storePreparedTemplateResource, } from "./store-template-resource.js";
 export { templateResourceEntity, templateResourcesTable, } from "./table.js";
 export { templateBundleSchema } from "./template-bundle.js";
+export { templateEditAccess, } from "./template-edit-policy.js";
 export { isMailTemplateMeta, MAIL_CATEGORIES, MAIL_TONES, parseTemplateMeta, pdfAttachmentFileNamePatternSchema, readMailLayoutMeta, readPdfTemplateMeta, templateSlugSchema, } from "./template-meta.js";
 export { evaluateDocumentDraft } from "./template-preview.js";
 export { readTemplateResource } from "./template-resources.js";

package/dist/template-resolver/qualified-names.d.ts

@@ -31,6 +31,7 @@ export declare const TemplateResolverQueries: {
     readonly preview: "template-resolver:query:preview";
     readonly documentBlocks: "template-resolver:query:document-blocks";
     readonly exportBundle: "template-resolver:query:export-bundle";
+    readonly sendTestStatus: "template-resolver:query:send-test-status";
     readonly bySlug: "template-resolver:query:by-slug";
     readonly byTenant: "template-resolver:query:by-tenant";
 };
@@ -47,6 +48,7 @@ export declare const TemplateResolverErrors: {
     readonly targetExists: "target_exists";
     readonly systemResourcesNeedSystemTenant: "system_resources_need_system_tenant";
     readonly systemOnlyTemplate: "system_only_template";
+    readonly templateNotTenantEditable: "template_not_tenant_editable";
     readonly bundleLocalesDiffer: "bundle_locales_differ";
     readonly resourceTooLarge: "template_resource_too_large";
     readonly resourceUnsupportedImage: "template_resource_unsupported_image";

package/dist/template-resolver/qualified-names.js

@@ -33,6 +33,7 @@ export const TemplateResolverQueries = {
     preview: "template-resolver:query:preview",
     documentBlocks: "template-resolver:query:document-blocks",
     exportBundle: "template-resolver:query:export-bundle",
+    sendTestStatus: "template-resolver:query:send-test-status",
     // Public pair — anonymous-reachable, kind pinned to text-block.
     bySlug: "template-resolver:query:by-slug",
     byTenant: "template-resolver:query:by-tenant",
@@ -58,6 +59,7 @@ export const TemplateResolverErrors = {
     targetExists: "target_exists",
     systemResourcesNeedSystemTenant: "system_resources_need_system_tenant",
     systemOnlyTemplate: "system_only_template",
+    templateNotTenantEditable: "template_not_tenant_editable",
     bundleLocalesDiffer: "bundle_locales_differ",
     resourceTooLarge: "template_resource_too_large",
     resourceUnsupportedImage: "template_resource_unsupported_image",

package/dist/template-resolver/template-edit-policy.d.ts

@@ -0,0 +1,22 @@
+import { type HandlerContext, type RoleAccessRule, type SessionUser } from "@cosmicdrift/kumiko-framework/engine";
+import { type WriteFailure } from "@cosmicdrift/kumiko-framework/errors";
+import type { TemplateKind } from "./constants.ts";
+export type TenantEditableTemplate = {
+    readonly kind: TemplateKind;
+    readonly slug: string;
+    readonly access: RoleAccessRule;
+};
+export type TemplateEditPolicy = {
+    readonly tenantEditable: readonly TenantEditableTemplate[];
+};
+type EditTarget = {
+    readonly slug: string;
+    readonly kind: string;
+};
+type EditUser = Pick<SessionUser, "roles">;
+export declare function templateEditAccess(entries: readonly TenantEditableTemplate[]): RoleAccessRule;
+export declare function mayEditTemplate(policy: TemplateEditPolicy, user: EditUser, target: EditTarget): boolean;
+export declare function refuseTemplateEdit(policy: TemplateEditPolicy, user: EditUser, target: EditTarget): WriteFailure | null;
+export declare function refuseMissingTemplate(policy: TemplateEditPolicy, user: EditUser): WriteFailure | null;
+export declare function refuseTemplateEditById(db: HandlerContext["db"], policy: TemplateEditPolicy, user: EditUser, tenantId: string, templateId: string): Promise<WriteFailure | null>;
+export {};

package/dist/template-resolver/template-edit-policy.js

@@ -0,0 +1,45 @@
+import { fetchOne } from "@cosmicdrift/kumiko-framework/db";
+import { hasAccess, } from "@cosmicdrift/kumiko-framework/engine";
+import { AccessDeniedError, writeFailure, } from "@cosmicdrift/kumiko-framework/errors";
+import { TemplateResolverErrors } from "./qualified-names.js";
+import { templateResourcesTable } from "./table.js";
+import { isSystemAdmin } from "./template-draft.js";
+const SYSTEM_ADMIN_ROLE = "SystemAdmin";
+export function templateEditAccess(entries) {
+    const roles = new Set([SYSTEM_ADMIN_ROLE]);
+    for (const entry of entries) {
+        for (const role of entry.access.roles)
+            roles.add(role);
+    }
+    return { roles: [...roles] };
+}
+export function mayEditTemplate(policy, user, target) {
+    if (isSystemAdmin(user))
+        return true;
+    const entry = policy.tenantEditable.find((candidate) => candidate.slug === target.slug && candidate.kind === target.kind);
+    return entry !== undefined && hasAccess(user, entry.access);
+}
+export function refuseTemplateEdit(policy, user, target) {
+    if (mayEditTemplate(policy, user, target))
+        return null;
+    return writeFailure(new AccessDeniedError({
+        i18nKey: "templateResolver.errors.templateNotTenantEditable",
+        details: { reason: TemplateResolverErrors.templateNotTenantEditable },
+    }));
+}
+// Fail closed: a missing row gives a non-SystemAdmin the same refusal as a locked one,
+// so the response never reveals whether an id exists. SystemAdmin keeps the 404.
+export function refuseMissingTemplate(policy, user) {
+    return isSystemAdmin(user) ? null : refuseTemplateEdit(policy, user, { slug: "", kind: "" });
+}
+export async function refuseTemplateEditById(db, policy, user, tenantId, templateId) {
+    if (isSystemAdmin(user))
+        return null;
+    const row = await fetchOne(db, templateResourcesTable, {
+        tenantId,
+        id: templateId,
+    });
+    return row === undefined
+        ? refuseMissingTemplate(policy, user)
+        : refuseTemplateEdit(policy, user, row);
+}

package/dist/template-resolver/template-preview.js

@@ -64,12 +64,17 @@ function sampleList(def, labelText) {
         rows.push(sampleRow(def.item, labelText));
     return rows;
 }
+function sampleValueFor(name, def, labelText) {
+    // An images variable has no sample: file ids are record data, never preview content.
+    if (def.type === "images")
+        return [];
+    return def.type === "list" ? sampleList(def, labelText) : sampleScalar(name, def, labelText);
+}
 // Declared examples win; the fallbacks are deterministic so a preview never differs between calls.
 export function sampleValuesFor(variables, labelText = (label) => label) {
     const values = {};
     for (const [name, def] of Object.entries(variables)) {
-        values[name] =
-            def.type === "list" ? sampleList(def, labelText) : sampleScalar(name, def, labelText);
+        values[name] = sampleValueFor(name, def, labelText);
     }
     return values;
 }