@cosmicdrift/kumiko-bundled-features 0.377.0 → 0.379.0

package/dist/tags/web/i18n.js

@@ -1,4 +1,3 @@
-// @runtime client
 // Default translation bundle for the tags UI. tagsClient() hangs it into the
 // LocaleProvider as a fallback bundle — apps override individual keys via
 // tagsClient({ translations }). Keys follow `tags.<area>.<slug>`.
@@ -22,7 +21,8 @@ export const defaultTranslations = {
         "tags.manage.toggle": "Toggle label",
         "tags.manage.usage": "{count}×",
         "tags.manage.deleteConfirmTitle": "Delete label “{name}”?",
-        "tags.manage.deleteConfirmDesc": "Removes it from {count} objects. This can't be undone.",
+        "tags.manage.deleteConfirmDesc.one": "Removes it from 1 object. This can't be undone.",
+        "tags.manage.deleteConfirmDesc.other": "Removes it from {count} objects. This can't be undone.",
         "tags.picker.title": "Tags",
         "tags.picker.done": "Done",
         "tags.filter.label": "Filter by tag",

package/dist/tags/web/index.d.ts

@@ -1,5 +1,5 @@
-export { TAGS_COLUMN_RENDERER_NAME, TAGS_EDIT_SCREEN_ID, TAGS_FILTER_EXTENSION_NAME, TAGS_SCREEN_ID, TAGS_SECTION_EXTENSION_NAME, TagsHandlers, TagsQueries, } from "../constants.ts";
 export { tagsClient } from "./client-plugin.tsx";
+export { TAGS_COLUMN_RENDERER_NAME, TAGS_EDIT_SCREEN_ID, TAGS_FILTER_EXTENSION_NAME, TAGS_SCREEN_ID, TAGS_SECTION_EXTENSION_NAME, TagsHandlers, TagsQueries, } from "./constants.ts";
 export { EntityTags } from "./entity-tags.tsx";
 export { contrastText, TagChip } from "./tag-chip.tsx";
 export { TagFilter } from "./tag-filter.tsx";

package/dist/tags/web/index.js

@@ -1,6 +1,5 @@
-// @runtime client
-export { TAGS_COLUMN_RENDERER_NAME, TAGS_EDIT_SCREEN_ID, TAGS_FILTER_EXTENSION_NAME, TAGS_SCREEN_ID, TAGS_SECTION_EXTENSION_NAME, TagsHandlers, TagsQueries, } from "../constants.js";
 export { tagsClient } from "./client-plugin.js";
+export { TAGS_COLUMN_RENDERER_NAME, TAGS_EDIT_SCREEN_ID, TAGS_FILTER_EXTENSION_NAME, TAGS_SCREEN_ID, TAGS_SECTION_EXTENSION_NAME, TagsHandlers, TagsQueries, } from "./constants.js";
 export { EntityTags } from "./entity-tags.js";
 export { contrastText, TagChip } from "./tag-chip.js";
 export { TagFilter } from "./tag-filter.js";

package/dist/tags/web/tag-filter.js

@@ -1,5 +1,4 @@
 import { jsx as _jsx, jsxs as _jsxs } from "react/jsx-runtime";
-// @runtime client
 // TagFilter — a drop-in tag filter for ANY entityList toolbar. Register it as
 // the list's header slot (`screen.slots.header`); the renderer passes it the
 // list's screenId, and picking tags resolves the matching row ids and narrows
@@ -15,7 +14,7 @@ import { jsx as _jsx, jsxs as _jsxs } from "react/jsx-runtime";
 // server-side `entitiesByTag` query + a server-side join filter instead.
 import { useListUrlState, usePrimitives, useQuery, useTranslation, } from "@cosmicdrift/kumiko-renderer";
 import { useState } from "react";
-import { TagsQueries } from "../constants.js";
+import { TagsQueries } from "./constants.js";
 import { TagChip } from "./tag-chip.js";
 import { TagPicker } from "./tag-picker.js";
 // Tags chosen but zero matching entities → filter to a value that matches no row

package/dist/tags/web/tag-manager.js

@@ -1,5 +1,4 @@
 import { jsx as _jsx, jsxs as _jsxs } from "react/jsx-runtime";
-// @runtime client
 // TagManager — the shared tag-catalog UI, GitLab-labels style. Built ONCE,
 // mounted twice:
 //   - standalone:  <TagManager />                       → the Tags admin screen
@@ -11,8 +10,9 @@ import { jsx as _jsx, jsxs as _jsxs } from "react/jsx-runtime";
 // per-tenant catalog. Selection is buffered by the caller (TagPicker) and only
 // applied on confirm — managing labels and picking them are separate concerns.
 import { useDispatcher, usePrimitives, useQuery, useTranslation, } from "@cosmicdrift/kumiko-renderer";
+import { pluralKey } from "@cosmicdrift/kumiko-renderer/headless";
 import { useState } from "react";
-import { TagsHandlers, TagsQueries } from "../constants.js";
+import { TagsHandlers, TagsQueries } from "./constants.js";
 import { TagChip } from "./tag-chip.js";
 // A small fixed palette so labels stay visually distinct without a color-wheel
 // dependency; the hex field below still accepts any custom value.
@@ -66,6 +66,7 @@ export function TagManager({ entityType, selection, }) {
     const usage = new Map();
     for (const a of assignments.data?.rows ?? [])
         usage.set(a.tagId, (usage.get(a.tagId) ?? 0) + 1);
+    const deletingUsage = usage.get(deleting?.id ?? "") ?? 0;
     const selecting = selection !== undefined;
     const allTags = catalog.data?.rows ?? [];
     const tags = selecting
@@ -162,7 +163,7 @@ export function TagManager({ entityType, selection, }) {
     return (_jsxs("div", { "data-testid": "tag-manager", className: "flex flex-col gap-4", children: [_jsxs("div", { className: "flex flex-col gap-2 rounded-md border p-3", children: [_jsx(Field, { id: "tag-manager-new-name", label: t("tags.manage.newLabel"), children: _jsx(Input, { kind: "text", id: "tag-manager-new-name", name: "newTagName", value: newName, onChange: setNewName, placeholder: t("tags.manage.namePlaceholder") }) }), _jsx(ColorPicker, { value: newColor, onChange: setNewColor, idPrefix: "tag-manager-new-color" }), !selecting && (_jsx(Field, { id: "tag-manager-new-scope", label: t("tags.manage.scopeLabel"), children: _jsx(Input, { kind: "text", id: "tag-manager-new-scope", name: "newTagScope", value: newScope, onChange: setNewScope, placeholder: t("tags.manage.scopePlaceholder") }) })), _jsx("div", { children: _jsx(Button, { variant: "primary", disabled: busy || newName.trim() === "", onClick: () => createTag(), testId: "tag-manager-create", children: busy ? t("tags.section.working") : t("tags.manage.create") }) })] }), tags.length === 0 ? (_jsx(Banner, { variant: "info", testId: "tag-manager-empty", children: _jsx(Text, { children: t("tags.section.empty") }) })) : (_jsx("div", { className: "flex flex-col gap-1", children: tags.map((tag) => editingId === tag.id ? (_jsxs("div", { "data-testid": `tag-manager-edit-${tag.id}`, className: "flex flex-col gap-2 rounded-md border p-3", children: [_jsx(Input, { kind: "text", id: `tag-edit-name-${tag.id}`, name: "editName", value: editName, onChange: setEditName }), _jsx(ColorPicker, { value: editColor, onChange: setEditColor, idPrefix: `tag-edit-color-${tag.id}` }), _jsx(Input, { kind: "text", id: `tag-edit-scope-${tag.id}`, name: "editScope", value: editScope, onChange: setEditScope, placeholder: t("tags.manage.scopePlaceholder") }), _jsxs("div", { className: "flex gap-2", children: [_jsx(Button, { variant: "primary", disabled: busy || editName.trim() === "", onClick: () => saveEdit(tag), testId: `tag-manager-save-${tag.id}`, children: t("tags.manage.save") }), _jsx(Button, { variant: "secondary", disabled: busy, onClick: () => setEditingId(null), children: t("tags.manage.cancel") })] })] }, tag.id)) : (_jsxs("div", { "data-testid": `tag-manager-row-${tag.id}`, className: "flex items-center gap-2 rounded-md px-2 py-1 hover:bg-muted", children: [selecting && (_jsx(Button, { variant: selection?.value.includes(tag.id) ? "primary" : "secondary", onClick: () => toggle(tag.id), testId: `tag-manager-toggle-${tag.id}`, children: selection?.value.includes(tag.id) ? "✓" : "+" })), _jsx(TagChip, { name: tag.name, color: tag.color }), !selecting && (tag.scope ?? "") !== "" && (_jsx(Text, { variant: "small", children: `@${tag.scope}` })), _jsx(Text, { variant: "small", children: t("tags.manage.usage", { count: usage.get(tag.id) ?? 0 }) }), _jsxs("div", { className: "ml-auto flex gap-1", children: [_jsx(Button, { variant: "secondary", disabled: busy, onClick: () => startEdit(tag), testId: `tag-manager-edit-btn-${tag.id}`, children: t("tags.manage.edit") }), _jsx(Button, { variant: "danger", disabled: busy, onClick: () => setDeleting(tag), testId: `tag-manager-delete-btn-${tag.id}`, children: t("tags.manage.delete") })] })] }, tag.id))) })), errorKey !== null && (_jsx(Banner, { variant: "error", testId: "tag-manager-action-error", children: _jsx(Text, { children: t(errorKey) }) })), _jsx(Dialog, { open: deleting !== null, onOpenChange: (open) => {
                     if (!open)
                         setDeleting(null);
-                }, title: t("tags.manage.deleteConfirmTitle", { name: deleting?.name ?? "" }), description: t("tags.manage.deleteConfirmDesc", {
-                    count: usage.get(deleting?.id ?? "") ?? 0,
+                }, title: t("tags.manage.deleteConfirmTitle", { name: deleting?.name ?? "" }), description: t(pluralKey("tags.manage.deleteConfirmDesc", deletingUsage), {
+                    count: deletingUsage,
                 }), confirmLabel: t("tags.manage.delete"), variant: "danger", onConfirm: confirmDelete, testId: "tag-manager-delete-dialog" })] }));
 }

package/dist/tags/web/tag-picker.js

@@ -1,5 +1,4 @@
 import { jsx as _jsx } from "react/jsx-runtime";
-// @runtime client
 // TagPicker — the shared "manage + pick labels" modal. Wraps TagManager in
 // select-mode inside a Dialog: the user can create/recolor/delete labels (those
 // hit the catalog immediately) and toggle which ones apply (buffered). On

package/dist/tags/web/tag-section.js

@@ -1,5 +1,4 @@
 import { jsx as _jsx, jsxs as _jsxs } from "react/jsx-runtime";
-// @runtime client
 // TagSection — drop-in tag editor for ANY entity, GitLab-labels style. Shows the
 // entity's tags as colored chips plus an "Edit tags" button that opens the
 // shared TagPicker modal (pick + manage). Applying the picker diffs the
@@ -14,7 +13,7 @@ import { jsx as _jsx, jsxs as _jsxs } from "react/jsx-runtime";
 //                   (RenderEdit passes { entityName, entityId }).
 import { useDispatcher, usePrimitives, useQuery, useTranslation, } from "@cosmicdrift/kumiko-renderer";
 import { useState } from "react";
-import { TagsHandlers, TagsQueries } from "../constants.js";
+import { TagsHandlers, TagsQueries } from "./constants.js";
 import { TagChip } from "./tag-chip.js";
 import { TagPicker } from "./tag-picker.js";
 // What changed between the entity's current tags and the picker's new selection.

package/dist/tags/web/tags-cell.js

@@ -1,5 +1,4 @@
 import { jsx as _jsx } from "react/jsx-runtime";
-// @runtime client
 // TagsCell — a reusable columnRenderer that shows an entity's tags as colored
 // chips inline in a list row. Drop it into ANY entityList by declaring a labeled
 // virtual column (no host-schema change), after mounting tagsClient():
@@ -16,7 +15,7 @@ import { jsx as _jsx } from "react/jsx-runtime";
 // calls, so the whole column shares two queries, not two-per-row. For huge
 // assignment sets add a server-side entitiesByTag query + join filter.
 import { useQuery } from "@cosmicdrift/kumiko-renderer";
-import { TagsQueries } from "../constants.js";
+import { TagsQueries } from "./constants.js";
 import { TagChip } from "./tag-chip.js";
 export function TagsCell({ row }) {
     const entityId = String(row["id"] ?? "");

package/dist/template-resolver/api.d.ts

@@ -1,10 +1,12 @@
 import type { DbRunner, TenantDb } from "@cosmicdrift/kumiko-framework/db";
-import type { SessionUser, TenantId } from "@cosmicdrift/kumiko-framework/engine";
+import type { Registry, SessionUser, TenantId } from "@cosmicdrift/kumiko-framework/engine";
 import type { Temporal } from "@cosmicdrift/kumiko-types/temporal";
 import type { FileAttachmentRef } from "../renderer-foundation/index.ts";
-import type { ContentFormat, TemplateKind } from "./constants.ts";
 import { type TemplatePdfAttachmentLink } from "./linked-resources.ts";
+import { type TemplateResourceRow } from "./table.ts";
+import { type TemplateDeliveryPolicy } from "./template-delivery-policy.ts";
 import { type TemplateMeta } from "./template-meta.ts";
+import type { ContentFormat, TemplateKind } from "./web/constants.ts";
 export type TemplateResource = {
     readonly id: string;
     readonly version: number;
@@ -46,15 +48,11 @@ export type ResolveLayoutRequest = {
 };
 export type TemplateResolverApi = {
     /**
-     * Findet ein konkretes Template by (tenantId, slug, kind, locale).
-     * Kein Locale-Fallback, keine Override-Hierarchie — Raw-Lookup für
-     * Admin-UI-Edits und Konformitäts-Tests. Für Render-Aufrufe immer
-     * `resolveTemplate` nutzen.
+     * Raw lookup by (tenantId, slug, kind, locale): no locale fallback, no override
+     * hierarchy. Render paths must use `resolveTemplate`. `scope: "system"` forces
+     * SYSTEM_TENANT_ID and ignores the passed tenantId.
      *
-     * `scope: "system"` zwingt Lookup gegen SYSTEM_TENANT_ID (ignoriert
-     * den übergebenen tenantId). Default = Lookup gegen den übergebenen
-     * tenantId direkt (Caller wählt entweder Tenant oder System per
-     * tenantId).
+     * Tenant rows of a template that is not tenantEditable are not returned.
      */
     readonly findExact: (args: {
         readonly tenantId: TenantId;
@@ -64,18 +62,10 @@ export type TemplateResolverApi = {
         readonly scope?: "system";
     }) => Promise<TemplateResource | null>;
     /**
-     * Resolver mit 4-Stufen-Fallback (siehe template-resolver.md):
-     *   1. tenant + requested-locale
-     *   2. system + requested-locale
-     *   3. tenant + FALLBACK_LOCALE
-     *   4. system + FALLBACK_LOCALE
-     * Resource-Substitution wird hier NICHT ausgeführt — das macht der
-     * Caller (renderer-foundation-Plugin) je nach kind-passendem Modus
-     * (inline-base64 vs. signed-url). API liefert TemplateResource pur.
-     *
-     * **Caller-Invariante:** `tenantId` MUSS vom Server kommen (typisch
-     * `ctx.user.tenantId`). Niemals direkt aus User-Input — sonst kann
-     * User cross-tenant Templates abfragen (Tenant-Isolation gebrochen).
+     * Four-step fallback: tenant+locale, system+locale, tenant+FALLBACK_LOCALE,
+     * system+FALLBACK_LOCALE (see template-resolver.md).
+     * Tenant rows count only for templates unlocked for tenants (tenantEditable,
+     * or a collection with access); locked overrides are skipped but stay stored.
      */
     readonly resolveTemplate: (args: ResolveRequest) => Promise<TemplateResource>;
     /**
@@ -89,7 +79,15 @@ export type TemplateResolverApi = {
      */
     readonly resolveLayout: (args: ResolveLayoutRequest) => Promise<TemplateResource>;
 };
-export declare function createTemplateResolverApi(db: DbRunner | TenantDb): TemplateResolverApi;
+export declare function createTemplateResolverApi(db: DbRunner | TenantDb, registry: Registry): TemplateResolverApi;
+export declare function isRowDelivered(db: DbRunner | TenantDb, policy: TemplateDeliveryPolicy, row: TemplateResourceRow): Promise<boolean>;
+export declare function isRowDeliveredTo(db: DbRunner | TenantDb, policy: TemplateDeliveryPolicy, user: {
+    readonly roles: readonly string[];
+}, row: TemplateResourceRow): Promise<boolean>;
+export declare function filterDeliveredTo(db: DbRunner | TenantDb, policy: TemplateDeliveryPolicy, user: {
+    readonly roles: readonly string[];
+}, rows: readonly TemplateResourceRow[]): Promise<TemplateResourceRow[]>;
+export declare function systemTemplateExists(db: DbRunner | TenantDb, kind: string, slug: string): Promise<boolean>;
 export declare class TemplateNotFoundError extends Error {
     readonly query: {
         slug: string;

package/dist/template-resolver/api.js

@@ -3,17 +3,21 @@
 // ctx.templateResolver at runtime.
 import { selectMany } from "@cosmicdrift/kumiko-framework/db";
 import { InternalError } from "@cosmicdrift/kumiko-framework/errors";
-import { FALLBACK_LOCALE, SYSTEM_TENANT_ID } from "./constants.js";
 import { fileAttachmentsOf, imageLinksOf, parseLinkedResourceEntries, pdfAttachmentLinksOf, } from "./linked-resources.js";
 import { templateResourcesTable } from "./table.js";
-import { activeVersionOf, servedVersionOf } from "./template-draft.js";
+import { deliveryPolicyOf, isRowServed, isServedByCollectionOnly, } from "./template-delivery-policy.js";
+import { activeVersionOf, isSystemAdmin, servedVersionOf } from "./template-draft.js";
 import { parseTemplateMeta } from "./template-meta.js";
-export function createTemplateResolverApi(db) {
+import { FALLBACK_LOCALE, SYSTEM_TENANT_ID } from "./web/constants.js";
+export function createTemplateResolverApi(db, registry) {
+    const deliveryPolicy = deliveryPolicyOf(registry);
+    // A collection entry must not shadow a system template of the same slug that the app did not unlock.
+    const isServed = (row) => isRowDelivered(db, deliveryPolicy, row);
     return {
         findExact: async ({ tenantId, slug, kind, locale, scope }) => {
             const effectiveTenantId = scope === "system" ? SYSTEM_TENANT_ID : tenantId;
             const row = await fetchTemplate(db, effectiveTenantId, slug, kind, locale);
-            return row ? toPublic(row) : null;
+            return row && (await isServed(row)) ? toPublic(row) : null;
         },
         resolveTemplate: async ({ tenantId, slug, kind, locale }) => {
             // Fallback-Chain — finde erste passende Variante
@@ -28,14 +32,18 @@ export function createTemplateResolverApi(db) {
                     : []),
             ];
             for (const c of candidates) {
+                if (!isRowServed(deliveryPolicy, { tenantId: c.tid, kind, slug }))
+                    continue;
                 const row = await fetchTemplate(db, c.tid, slug, kind, c.loc);
-                if (row && row.status === "active")
+                if (row && row.status === "active" && (await isServed(row)))
                     return toPublic(row);
             }
             throw new TemplateNotFoundError({ slug, kind, locale });
         },
         resolveLayout: async ({ tenantId, slug, kind, locale }) => {
             for (const tid of [tenantId, SYSTEM_TENANT_ID]) {
+                if (!isRowServed(deliveryPolicy, { tenantId: tid, kind, slug }))
+                    continue;
                 const rows = await selectMany(db, templateResourcesTable, {
                     tenantId: tid,
                     slug,
@@ -49,6 +57,26 @@ export function createTemplateResolverApi(db) {
         },
     };
 }
+// The one delivery rule for a stored row: unlocked, and a collection entry never shadows a system
+// template of the same slug that the app did not unlock.
+export async function isRowDelivered(db, policy, row) {
+    if (!isRowServed(policy, row))
+        return false;
+    if (row.tenantId === SYSTEM_TENANT_ID || !isServedByCollectionOnly(policy, row))
+        return true;
+    return !(await systemTemplateExists(db, row.kind, row.slug));
+}
+export async function isRowDeliveredTo(db, policy, user, row) {
+    return isSystemAdmin(user) || (await isRowDelivered(db, policy, row));
+}
+export async function filterDeliveredTo(db, policy, user, rows) {
+    const flags = await Promise.all(rows.map((row) => isRowDeliveredTo(db, policy, user, row)));
+    return rows.filter((_, index) => flags[index]);
+}
+export async function systemTemplateExists(db, kind, slug) {
+    const rows = await selectMany(db, templateResourcesTable, { tenantId: SYSTEM_TENANT_ID, slug, kind }, { limit: 1 });
+    return rows.length > 0;
+}
 function pickActiveLayoutRow(rows, locale) {
     const active = rows
         .filter((row) => row.status === "active")
@@ -139,7 +167,7 @@ export function requireTemplateResolver(ctx, callerName) {
     if (!api) {
         throw new InternalError({
             message: `[${callerName}] ctx.templateResolver missing — App-Bootstrap muss ` +
-                `extraContext: { templateResolver: createTemplateResolverApi(db) } setzen ` +
+                `extraContext: { templateResolver: createTemplateResolverApi(db, registry) } setzen ` +
                 `(siehe template-resolver/README.md).`,
         });
     }

package/dist/template-resolver/compile-document-body.d.ts

@@ -9,7 +9,10 @@ export type CompileDocumentBodyOptions = {
     readonly buttonInlineStyle?: string;
     readonly headingAsInlineStyle?: boolean;
     readonly stepsColor?: string;
+    readonly recordImagesSrc?: (variable: string) => readonly string[];
+    readonly recordImagesPlaceholder?: boolean;
 };
 export declare function collectDocumentResourceKeys(html: string): readonly string[];
+export declare function collectDocumentImageVariables(html: string): readonly string[];
 export declare function toResourceDataUri(contentType: string, bytes: Uint8Array): string;
 export declare function compileDocumentBodyToHandlebars(html: string, variables: TemplateVariables, options?: CompileDocumentBodyOptions): string;

package/dist/template-resolver/compile-document-body.js

@@ -2,7 +2,7 @@ import { isOneOf } from "@cosmicdrift/kumiko-types/type-guards";
 import { isResourceImageContentType } from "../shared/index.js";
 import { rewriteStepsBlock } from "./compile-steps-block.js";
 import { conditionScopeElement, withParsedDocument } from "./document-sanitizer.js";
-import { DOCUMENT_CONDITION_ATTRIBUTE, DOCUMENT_TEXT_ALIGNMENTS, isAllowedDocumentLinkHref, isDocumentPlaceholderHref, isDocumentReferenceName, isDocumentResourceKey, } from "./document-schema.js";
+import { DOCUMENT_CONDITION_ATTRIBUTE, DOCUMENT_TEXT_ALIGNMENTS, isAllowedDocumentLinkHref, isDocumentPlaceholderHref, isDocumentReferenceName, isDocumentResourceKey, } from "./web/document-schema.js";
 // Private-use characters mark where a Handlebars expression goes. Author text
 // is scrubbed of them first and every `{`/`}` is entity-encoded before the
 // markers are swapped for real expressions, so the only Handlebars syntax in
@@ -48,9 +48,13 @@ function valueExpression(path, def, isWholeBlock) {
     }
     return `{{${path}}}`;
 }
+// Never interpolated as text: its value is a list of file ids.
+function isImagesVariable(def) {
+    return def?.type === "images";
+}
 function rewriteVariable(element, state) {
     const name = element.getAttribute("data-variable") ?? "";
-    const replacement = element.ownerDocument.createTextNode(isDocumentReferenceName(name)
+    const replacement = element.ownerDocument.createTextNode(isDocumentReferenceName(name) && !isImagesVariable(pathAndDef(name, element, state)[1])
         ? marker(state, valueExpression(...pathAndDef(name, element, state), state.blockRichTextSpans.has(element)))
         : "");
     element.replaceWith(replacement);
@@ -82,6 +86,9 @@ function wrapVariableOnlyBlock(block, state) {
     if (name === null)
         return;
     const [path, def] = pathAndDef(name, block, state);
+    // skip: images blocks are rewritten by rewriteImagesBlock
+    if (isImagesVariable(def))
+        return;
     const host = def?.type === "richText" && block.tagName === "P" ? richTextBlockHost(block, state) : block;
     const document = host.ownerDocument;
     host.before(document.createTextNode(marker(state, `{{#if ${path} includeZero=true}}`)));
@@ -106,8 +113,8 @@ function rewriteLink(element, state) {
     if (isDocumentPlaceholderHref(href)) {
         const name = href.slice(2, -2);
         if (isDocumentReferenceName(name)) {
-            const [path] = pathAndDef(name, element, state);
-            element.setAttribute("href", marker(state, `{{link ${path}}}`));
+            const [path, def] = pathAndDef(name, element, state);
+            element.setAttribute("href", isImagesVariable(def) ? "#" : marker(state, `{{link ${path}}}`));
         }
         else {
             element.setAttribute("href", "#");
@@ -152,6 +159,7 @@ function stripActiveContent(element) {
 function neutralizeBraces(html) {
     return html.replace(/[{}]/g, (brace) => (brace === "{" ? "{" : "}"));
 }
+const IMAGES_PLACEHOLDER_STYLE = "height:96px;margin:8px 0;border-radius:4px;background:#e5e7eb";
 const MAIL_BUTTON_STYLE = "display:inline-block;padding:10px 20px;border-radius:6px;background-color:#1f5468;color:#ffffff;font-weight:600;text-decoration:none";
 const MAIL_TABLE_STYLE = "width:100%;border-collapse:collapse";
 const MAIL_TABLE_CELL_STYLE = "padding:6px 12px;vertical-align:top;border-bottom:1px solid #e5e5e5";
@@ -179,6 +187,42 @@ export function collectDocumentResourceKeys(html) {
         return [...keys];
     });
 }
+// Unique valid names of the images blocks in document order.
+export function collectDocumentImageVariables(html) {
+    return withParsedDocument(html, (root) => {
+        const names = new Set();
+        for (const element of Array.from(root.querySelectorAll("div[data-images]"))) {
+            const name = element.getAttribute("data-images") ?? "";
+            if (isDocumentReferenceName(name))
+                names.add(name);
+        }
+        return [...names];
+    });
+}
+function rewriteImagesBlock(element, state, options) {
+    const name = element.getAttribute("data-images") ?? "";
+    const declared = isDocumentReferenceName(name) && isImagesVariable(ownVariable(state.variables, name));
+    if (!declared) {
+        element.remove();
+        // skip: an images block bound to anything but a declared images variable renders nothing
+        return;
+    }
+    const document = element.ownerDocument;
+    element.removeAttribute("data-images");
+    if (options.recordImagesPlaceholder === true) {
+        element.setAttribute("class", "kumiko-doc-image-placeholder");
+        element.setAttribute("style", IMAGES_PLACEHOLDER_STYLE);
+        // skip: preview and drafts never resolve record images
+        return;
+    }
+    element.setAttribute("class", "kumiko-doc-images");
+    for (const src of options.recordImagesSrc?.(name) ?? []) {
+        const image = document.createElement("img");
+        image.setAttribute("src", src);
+        image.setAttribute("alt", "");
+        element.append(image);
+    }
+}
 export function toResourceDataUri(contentType, bytes) {
     if (!isResourceImageContentType(contentType)) {
         throw new Error(`resource content type "${contentType}" cannot be embedded as an image`);
@@ -273,6 +317,9 @@ export function compileDocumentBodyToHandlebars(html, variables, options = {}) {
                 color: options.stepsColor,
             });
         }
+        for (const element of Array.from(root.querySelectorAll("div[data-images]"))) {
+            rewriteImagesBlock(element, state, options);
+        }
         for (const block of Array.from(root.querySelectorAll(`[${DOCUMENT_CONDITION_ATTRIBUTE}]`))) {
             rewriteConditionalBlock(block, state);
         }

package/dist/template-resolver/compile-steps-block.js

@@ -1,6 +1,6 @@
-import { isDocumentReferenceName } from "./document-schema.js";
-import { readDocumentSteps } from "./document-steps.js";
 import { isHexColor } from "./layout-appearance.js";
+import { isDocumentReferenceName } from "./web/document-schema.js";
+import { readDocumentSteps } from "./web/document-steps.js";
 export const DEFAULT_STEPS_COLOR = "#1f5468";
 const TODO_BAR_COLOR = "#ECEDEA";
 const REACHED_LABEL_COLOR = "#0B0D12";

package/dist/template-resolver/document-ops.d.ts

@@ -1,7 +1,7 @@
 import type { FieldIssue } from "@cosmicdrift/kumiko-framework/errors";
 import { type JSONContent } from "@tiptap/core";
 import * as z from "zod";
-import type { DocumentHtmlKind } from "./constants.ts";
+import type { DocumentHtmlKind } from "./web/constants.ts";
 export declare const MAX_DOCUMENT_OPS = 50;
 export type DocumentBlockType = "paragraph" | "heading" | "list" | "table" | "repeat" | "image" | "button" | "divider" | "pageBreak" | "steps";
 export type DocumentBlock = {

package/dist/template-resolver/document-ops.js

@@ -1,9 +1,9 @@
 import { getSchema } from "@tiptap/core";
 import * as z from "zod";
-import { documentBlocksForKind } from "./document-blocks.js";
-import { DOCUMENT_TEXT_ALIGNMENTS, documentExtensions, isDocumentPlaceholderHref, isDocumentReferenceName, isDocumentResourceKey, } from "./document-schema.js";
-import { contentToLine, lineToContent, singleLine } from "./placeholder-text.js";
 import { toVariableDef } from "./template-validation.js";
+import { documentBlocksForKind } from "./web/document-blocks.js";
+import { DOCUMENT_TEXT_ALIGNMENTS, documentExtensions, isDocumentPlaceholderHref, isDocumentReferenceName, isDocumentResourceKey, } from "./web/document-schema.js";
+import { contentToLine, lineToContent, singleLine } from "./web/placeholder-text.js";
 export const MAX_DOCUMENT_OPS = 50;
 // Assigning these keys would reach the prototype of the meta object.
 const FORBIDDEN_META_KEYS = new Set(["__proto__", "prototype", "constructor"]);

package/dist/template-resolver/document-sanitizer.d.ts

@@ -1,8 +1,8 @@
 import type { FieldIssue } from "@cosmicdrift/kumiko-framework/errors";
 import type { JSONContent } from "@tiptap/core";
 import { type Element as ScanElement } from "happy-dom";
-import type { ContentFormat } from "./constants.ts";
-export type DocumentViolationCode = "script_element" | "event_handler_attribute" | "disallowed_link_href" | "external_image_source" | "image_without_resource" | "invalid_reference_name" | "embedded_content" | "unsafe_attribute_value" | "button_href_not_placeholder" | "document_requires_html_format" | "layout_requires_mjml_format" | "layout_invalid_structure" | "layout_missing_content_slot" | "layout_source_system_only";
+import type { ContentFormat } from "./web/constants.ts";
+export type DocumentViolationCode = "script_element" | "event_handler_attribute" | "disallowed_link_href" | "external_image_source" | "image_without_resource" | "invalid_reference_name" | "embedded_content" | "unsafe_attribute_value" | "images_block_pdf_only" | "button_href_not_placeholder" | "document_requires_html_format" | "layout_requires_mjml_format" | "layout_invalid_structure" | "layout_missing_content_slot" | "layout_source_system_only";
 export type DocumentViolation = {
     readonly code: DocumentViolationCode;
     readonly detail: string;

package/dist/template-resolver/document-sanitizer.js

@@ -1,9 +1,9 @@
 import { isOneOf } from "@cosmicdrift/kumiko-types/type-guards";
 import { generateHTML, generateJSON } from "@tiptap/html/server";
 import { Window } from "happy-dom";
-import { DOCUMENT_HTML_KINDS } from "./constants.js";
-import { DOCUMENT_CONDITION_ATTRIBUTE, documentExtensions, isAllowedDocumentLinkHref, isDocumentPlaceholderHref, isDocumentReferenceName, isDocumentResourceKey, } from "./document-schema.js";
-import { isDocumentStepKey } from "./document-steps.js";
+import { DOCUMENT_HTML_KINDS } from "./web/constants.js";
+import { DOCUMENT_CONDITION_ATTRIBUTE, documentExtensions, isAllowedDocumentLinkHref, isDocumentPlaceholderHref, isDocumentReferenceName, isDocumentResourceKey, } from "./web/document-schema.js";
+import { isDocumentStepKey } from "./web/document-steps.js";
 export function violation(code, detail, message) {
     return { code, detail, message };
 }
@@ -59,6 +59,7 @@ const REFERENCE_ATTRIBUTES = [
     [DOCUMENT_CONDITION_ATTRIBUTE, isDocumentReferenceName],
     ["data-resource", isDocumentResourceKey],
     ["data-steps", isDocumentReferenceName],
+    ["data-images", isDocumentReferenceName],
     ["data-step", isDocumentStepKey],
 ];
 function scanReferences(tag, element, out) {
@@ -182,10 +183,28 @@ function requiredFormatViolation(kind, contentFormat) {
     }
     return null;
 }
+const IMAGES_BLOCK_KIND = "document-pdf";
+// The node is part of the shared document model, so a mail body would keep it after the
+// rebuild; only a PDF resolves the record's images.
+function imagesBlockViolation(input) {
+    if (input.kind === IMAGES_BLOCK_KIND ||
+        !isSanitizedHtmlKind(input.kind) ||
+        input.contentFormat !== "html" ||
+        input.content === null) {
+        return null;
+    }
+    const hasImagesBlock = withParsedDocument(input.content, (body) => body.querySelector("div[data-images]") !== null);
+    return hasImagesBlock
+        ? violation("images_block_pdf_only", input.kind, `Record images blocks are only allowed in templates of kind ${IMAGES_BLOCK_KIND}`)
+        : null;
+}
 export function sanitizeTemplateBody(input) {
     const formatViolation = requiredFormatViolation(input.kind, input.contentFormat);
     if (formatViolation !== null)
         return { ok: false, violations: [formatViolation] };
+    const imagesViolation = imagesBlockViolation(input);
+    if (imagesViolation !== null)
+        return { ok: false, violations: [imagesViolation] };
     if (!isSanitizedHtmlKind(input.kind) ||
         input.contentFormat !== "html" ||
         input.content === null) {
@@ -203,6 +222,7 @@ const VIOLATION_I18N_KEYS = {
     invalid_reference_name: "templateResolver.errors.document.invalidReferenceName",
     embedded_content: "templateResolver.errors.document.embeddedContent",
     unsafe_attribute_value: "templateResolver.errors.document.unsafeAttributeValue",
+    images_block_pdf_only: "templateResolver.errors.document.imagesBlockPdfOnly",
     button_href_not_placeholder: "templateResolver.errors.document.buttonHrefNotPlaceholder",
     document_requires_html_format: "templateResolver.errors.document.documentRequiresHtmlFormat",
     layout_requires_mjml_format: "templateResolver.errors.document.layoutRequiresMjmlFormat",

package/dist/template-resolver/feature.d.ts

@@ -1,4 +1,6 @@
 import { type ContentCollectionDefinition } from "@cosmicdrift/kumiko-framework/engine";
+import type { TemplateDeliveryPolicy } from "./template-delivery-policy.ts";
+import type { TenantEditableTemplate } from "./template-edit-policy.ts";
 export type TemplateResolverOptions = {
     /** Content collections this app mounts. Declared here rather than inside the
      *  feature because `access` needs the host's role vocabulary — a bundled
@@ -10,6 +12,13 @@ export type TemplateResolverOptions = {
      *  access rule, so the dispatcher enforces the separation instead of a
      *  branch in a shared handler. */
     readonly collections?: readonly ContentCollectionDefinition[];
+    /** Templates a TenantAdmin may edit for the own tenant (override, draft, publish, archive,
+     *  reset, copy-locale, import, resources). Without an entry only a SystemAdmin edits.
+     *  A tenant-edited mail goes out under the platform's name, so the app opts in per
+     *  template instead of the framework guessing which ones a tenant may reword.
+     *  `access` is required: the host decides its role vocabulary here, like for
+     *  `collections`. SystemAdmin always passes. */
+    readonly tenantEditable?: readonly TenantEditableTemplate[];
 };
 export declare function createTemplateResolverFeature(opts?: TemplateResolverOptions): import("@cosmicdrift/kumiko-types/feature").FeatureDefinition & {
     readonly exports: {
@@ -47,6 +56,7 @@ export declare function createTemplateResolverFeature(opts?: TemplateResolverOpt
             preview: import("@cosmicdrift/kumiko-types/handlers").HandlerRef;
             documentBlocks: import("@cosmicdrift/kumiko-types/handlers").HandlerRef;
             exportBundle: import("@cosmicdrift/kumiko-types/handlers").HandlerRef;
+            sendTestStatus: import("@cosmicdrift/kumiko-types/handlers").HandlerRef;
         };
         treeHandle: import("@cosmicdrift/kumiko-types/tree-node").TreeActionsHandle<"template-resolver", {
             readonly edit: {
@@ -62,5 +72,6 @@ export declare function createTemplateResolverFeature(opts?: TemplateResolverOpt
                 };
             };
         }>;
+        deliveryPolicy: TemplateDeliveryPolicy;
     };
 };