@cosmicdrift/kumiko-bundled-features 0.377.0 → 0.379.0

package/dist/template-resolver/index.js

@@ -1,19 +1,18 @@
+export { isResourceImageContentType } from "../shared/index.js";
 export { createTemplateResolverApi, requireTemplateResolver, TemplateNotFoundError, } from "./api.js";
-export { collectDocumentResourceKeys, compileDocumentBodyToHandlebars, toResourceDataUri, } from "./compile-document-body.js";
-export { CONTENT_FORMATS, DEFAULT_MAIL_LAYOUT_SLUG, DEFAULT_PDF_LAYOUT_SLUG, DOCUMENT_HTML_KINDS, FALLBACK_LOCALE, NON_RENDER_KINDS, PDF_DEFAULT_MARGIN_MM, PDF_FOOTER_MARGIN_MM, PDF_HEADER_MARGIN_MM, PDF_ORIENTATIONS, PDF_PAGE_FORMATS, RENDER_KINDS, SYSTEM_TENANT_ID, TEMPLATE_KINDS, TEMPLATE_SCOPES, TEMPLATE_STATUSES, TEXT_BLOCK_KIND, UPSERT_KINDS, } from "./constants.js";
+export { collectDocumentImageVariables, collectDocumentResourceKeys, compileDocumentBodyToHandlebars, toResourceDataUri, } from "./compile-document-body.js";
 export { documentViolationsToFieldIssues, flattenParagraphsToLineBreaks, sanitizeDocumentHtml, sanitizeTemplateBody, } from "./document-sanitizer.js";
-export { DOCUMENT_CONDITION_ATTRIBUTE, DOCUMENT_NODE_NAMES, DOCUMENT_TEXT_ALIGNMENTS, DocumentButton, DocumentCondition, DocumentDivider, DocumentLink, DocumentPageBreak, DocumentResource, DocumentTable, DocumentTableCell, DocumentTableHeader, DocumentTableRow, DocumentTextAlign, DocumentVariable, documentExtensions, isAllowedDocumentLinkHref, isDocumentPlaceholderHref, isDocumentReferenceName, isDocumentResourceKey, } from "./document-schema.js";
 export { createTemplateResolverFeature } from "./feature.js";
 export { localeSchema } from "./handlers/shared.js";
 export { isHexColor, mailLayoutAppearance, } from "./layout-appearance.js";
 export { readLayoutRegions, sanitizeLayoutHtml, } from "./layout-regions.js";
 export { fileAttachmentsOf, imageLinksOf, parseLinkedResourceEntries, pdfAttachmentLinksOf, templatePdfAttachmentLinkSchema, } from "./linked-resources.js";
 export { prepareDocumentForPrint } from "./print-document.js";
-export { TEMPLATE_RESOLVER_FEATURE, TemplateResolverErrors, TemplateResolverHandlers, TemplateResolverQueries, } from "./qualified-names.js";
 export { mapRecordToVariables } from "./record-mapping.js";
 export { prepareTemplateResourceBeforeTransaction, readTemplateResourceMaxBytes, storePreparedTemplateResource, } from "./store-template-resource.js";
 export { templateResourceEntity, templateResourcesTable, } from "./table.js";
 export { templateBundleSchema } from "./template-bundle.js";
+export { templateEditAccess, } from "./template-edit-policy.js";
 export { isMailTemplateMeta, MAIL_CATEGORIES, MAIL_TONES, parseTemplateMeta, pdfAttachmentFileNamePatternSchema, readMailLayoutMeta, readPdfTemplateMeta, templateSlugSchema, } from "./template-meta.js";
 export { evaluateDocumentDraft } from "./template-preview.js";
 export { readTemplateResource } from "./template-resources.js";
@@ -21,3 +20,6 @@ export { isSystemOnlyTemplate } from "./template-system-only.js";
 export { collectTemplateUsage } from "./template-usage.js";
 export { hasPlaceholderProblems, resolveTemplateVariables, SYSTEM_PLACEHOLDERS, systemPlaceholdersFor, validateTemplatePlaceholders, } from "./template-validation.js";
 export { userContentEntriesTable, userContentEntryEntity, } from "./user-content-table.js";
+export { CONTENT_FORMATS, DEFAULT_MAIL_LAYOUT_SLUG, DEFAULT_PDF_LAYOUT_SLUG, DOCUMENT_HTML_KINDS, FALLBACK_LOCALE, NON_RENDER_KINDS, PDF_DEFAULT_MARGIN_MM, PDF_FOOTER_MARGIN_MM, PDF_HEADER_MARGIN_MM, PDF_ORIENTATIONS, PDF_PAGE_FORMATS, RENDER_KINDS, SYSTEM_TENANT_ID, TEMPLATE_KINDS, TEMPLATE_SCOPES, TEMPLATE_STATUSES, TEXT_BLOCK_KIND, UPSERT_KINDS, } from "./web/constants.js";
+export { DOCUMENT_CONDITION_ATTRIBUTE, DOCUMENT_NODE_NAMES, DOCUMENT_TEXT_ALIGNMENTS, DocumentButton, DocumentCondition, DocumentDivider, DocumentLink, DocumentPageBreak, DocumentResource, DocumentTable, DocumentTableCell, DocumentTableHeader, DocumentTableRow, DocumentTextAlign, DocumentVariable, documentExtensions, isAllowedDocumentLinkHref, isDocumentPlaceholderHref, isDocumentReferenceName, isDocumentResourceKey, } from "./web/document-schema.js";
+export { TEMPLATE_RESOLVER_FEATURE, TemplateResolverErrors, TemplateResolverHandlers, TemplateResolverQueries, } from "./web/qualified-names.js";

package/dist/template-resolver/layout-appearance.js

@@ -1,5 +1,5 @@
-import { HEX_COLOR_PATTERN } from "./constants.js";
 import { readMailLayoutMeta } from "./template-meta.js";
+import { HEX_COLOR_PATTERN } from "./web/constants.js";
 const FONT_FAMILIES = {
     sans: "Arial, Helvetica, sans-serif",
     serif: "Georgia, 'Times New Roman', serif",

package/dist/template-resolver/layout-regions.d.ts

@@ -1,5 +1,5 @@
-import type { ContentFormat } from "./constants.ts";
 import { type DocumentViolation, type SanitizeBodyResult } from "./document-sanitizer.ts";
+import type { ContentFormat } from "./web/constants.ts";
 export type LayoutRegions = {
     readonly header: string;
     readonly signature: string;

package/dist/template-resolver/seeding.d.ts

@@ -2,8 +2,8 @@ import { type DbConnection } from "@cosmicdrift/kumiko-framework/db";
 import { type Registry, type SessionUser, type TenantId } from "@cosmicdrift/kumiko-framework/engine";
 import type { Dispatcher } from "@cosmicdrift/kumiko-framework/pipeline";
 import { type SeedIfExists } from "@cosmicdrift/kumiko-framework/seeding";
-import { type ContentFormat, type UpsertKind } from "./constants.ts";
 import type { TemplateBundle } from "./template-bundle.ts";
+import { type ContentFormat, type UpsertKind } from "./web/constants.ts";
 export type SeedSystemTemplateOptions = {
     readonly slug: string;
     readonly kind: UpsertKind;
@@ -16,6 +16,9 @@ export type SeedSystemTemplateOptions = {
     readonly linkedResources?: Record<string, string>;
     readonly meta?: unknown;
     readonly title?: string;
+    /** Translatable title for the overview and designer, stored in the title column; the client
+     *  shows the translation and falls back to the key. Mutually exclusive with `title`. */
+    readonly titleI18nKey?: string;
     readonly parentTemplateId?: string | null;
     readonly by?: SessionUser;
     readonly ifExists?: SeedIfExists;

package/dist/template-resolver/seeding.js

@@ -8,19 +8,19 @@
 //
 // Default ifExists="skip". The actor is `createSystemUser(SYSTEM_TENANT_ID)`,
 // deliberately not TestUsers (prod seeds are not test utilities).
-import { createTenantDb, deleteMany, fetchOne, } from "@cosmicdrift/kumiko-framework/db";
+import { createTenantDb, fetchOne, } from "@cosmicdrift/kumiko-framework/db";
 import { createSystemUser, SYSTEM_TENANT_ID, } from "@cosmicdrift/kumiko-framework/engine";
-import { getStreamVersion, getUnscopedStreamMaxVersionForSeed, } from "@cosmicdrift/kumiko-framework/event-store";
+import { deleteRowsWithoutReplayableStream, getStreamVersion, getUnscopedStreamMaxVersionForSeed, } from "@cosmicdrift/kumiko-framework/event-store";
 import { runEventStoreSeed } from "@cosmicdrift/kumiko-framework/seeding";
 import { isPlainObject } from "@cosmicdrift/kumiko-types/type-guards";
-import { TEXT_BLOCK_KIND } from "./constants.js";
 import { executor } from "./handlers/shared.js";
 import { evaluateTemplateWrite } from "./handlers/template-gates.js";
-import { TEMPLATE_RESOLVER_FEATURE, TemplateResolverHandlers } from "./qualified-names.js";
 import { templateResourcesTable } from "./table.js";
 import { activeStampChanges, servedStampChanges } from "./template-draft.js";
 import { templateSlugSchema } from "./template-meta.js";
 import { variablesFromSchema } from "./template-validation.js";
+import { TEXT_BLOCK_KIND } from "./web/constants.js";
+import { TEMPLATE_RESOLVER_FEATURE, TemplateResolverHandlers } from "./web/qualified-names.js";
 /** Drop projection orphans (no events anywhere) so boot seeds can recreate. */
 async function resolveExistingForEventStoreSeed(db, tdb, existingRow, tenantId) {
     if (existingRow == null)
@@ -34,12 +34,17 @@ async function resolveExistingForEventStoreSeed(db, tdb, existingRow, tenantId)
         if (unscoped !== 0) {
             throw new Error(`seed orphan check: projection ${id} has no events for tenant ${tenantId} but unscoped stream version is ${unscoped} — refusing delete/recreate to avoid wiping a live stream`);
         }
-        // The cast strips the executor-only brand that WritableTable rejects; the orphan row has no events, so no executor verb applies.
-        await deleteMany(tdb, templateResourcesTable, { id, tenantId });
+        await deleteRowsWithoutReplayableStream(tdb, { table: templateResourcesTable, ids: [id] });
         return null;
     }
     return { id, version: streamVersion };
 }
+function seedTitleColumn(opts, label) {
+    if (opts.title !== undefined && opts.titleI18nKey !== undefined) {
+        throw new Error(`${label} rejected: set either title or titleI18nKey, not both`);
+    }
+    return opts.titleI18nKey ?? opts.title ?? null;
+}
 export async function seedSystemTemplate(db, opts) {
     const tenantId = SYSTEM_TENANT_ID;
     const by = opts.by ?? createSystemUser(tenantId);
@@ -48,6 +53,7 @@ export async function seedSystemTemplate(db, opts) {
     const slug = templateSlugSchema.safeParse(opts.slug);
     if (!slug.success)
         throw new Error(`${label} rejected: ${slug.error.issues[0]?.message}`);
+    const title = seedTitleColumn(opts, label);
     const evaluated = evaluateTemplateWrite({
         kind: opts.kind,
         scope: "system",
@@ -81,7 +87,7 @@ export async function seedSystemTemplate(db, opts) {
         variableSchema,
         ...(linkedResources !== undefined && { linkedResources }),
         meta,
-        title: opts.title ?? null,
+        title,
         folder: null,
         scope: "system",
         parentTemplateId,

package/dist/template-resolver/store-template-resource.js

@@ -3,14 +3,14 @@ import { NotFoundError, UnprocessableError, writeFailure, } from "@cosmicdrift/k
 import { createFileRefFromUploadedBytes, uploadFileBytesBeforeTransaction, } from "@cosmicdrift/kumiko-framework/files";
 import { fileContextForTenant } from "../file-foundation/index.js";
 import { extensionForResourceContentType, requireForTenant } from "../shared/index.js";
-import { ACTIVE_TEMPLATE_STATUS, SYSTEM_TENANT_ID } from "./constants.js";
 import { DEFAULT_RESOURCE_MAX_BYTES, MAX_FILE_ATTACHMENTS_PER_TEMPLATE, RESOURCE_MAX_BYTES_CONFIG_KEY, } from "./handlers/resource-shared.js";
 import { executor } from "./handlers/shared.js";
 import { attachmentEntriesOf, parseLinkedResourceEntries, templatePdfAttachmentLinkSchema, } from "./linked-resources.js";
-import { TemplateResolverErrors } from "./qualified-names.js";
 import { normalizeResourceImage } from "./resource-image.js";
 import { templateResourcesTable } from "./table.js";
 import { readTemplateResource } from "./template-resources.js";
+import { ACTIVE_TEMPLATE_STATUS, SYSTEM_TENANT_ID } from "./web/constants.js";
+import { TemplateResolverErrors } from "./web/qualified-names.js";
 export async function readTemplateResourceMaxBytes(config, registry) {
     if (config === undefined || registry.getConfigKey(RESOURCE_MAX_BYTES_CONFIG_KEY) === undefined) {
         return DEFAULT_RESOURCE_MAX_BYTES;

package/dist/template-resolver/table.js

@@ -1,6 +1,6 @@
 import { buildEntityTable } from "@cosmicdrift/kumiko-framework/db";
 import { createEntity, createLongTextField, createNumberField, createSelectField, createTextField, createTimestampField, } from "@cosmicdrift/kumiko-framework/engine";
-import { CONTENT_FORMATS, TEMPLATE_KINDS, TEMPLATE_SCOPES, TEMPLATE_STATUSES, } from "./constants.js";
+import { CONTENT_FORMATS, TEMPLATE_KINDS, TEMPLATE_SCOPES, TEMPLATE_STATUSES, } from "./web/constants.js";
 // Stored v1 events name the kind "mail-html", which is now "mail".
 const renameMailHtmlKind = {
     fromVersion: 1,

package/dist/template-resolver/template-bundle.js

@@ -1,8 +1,8 @@
 import * as z from "zod";
-import { CONTENT_FORMATS, UPSERT_KINDS } from "./constants.js";
-import { isDocumentResourceKey } from "./document-schema.js";
 import { templatePdfAttachmentLinkSchema } from "./linked-resources.js";
 import { templateSlugSchema } from "./template-meta.js";
+import { CONTENT_FORMATS, UPSERT_KINDS } from "./web/constants.js";
+import { isDocumentResourceKey } from "./web/document-schema.js";
 const MAX_RESOURCES = 20;
 const MAX_LOCALES = 50;
 const MAX_RESOURCE_BYTES = 2 * 1024 * 1024;

package/dist/template-resolver/template-delivery-policy.d.ts

@@ -0,0 +1,22 @@
+import type { Registry } from "@cosmicdrift/kumiko-framework/engine";
+type DeliveryTarget = {
+    readonly kind: string;
+    readonly slug: string;
+};
+export type TemplateDeliveryPolicy = {
+    readonly tenantEditable: readonly DeliveryTarget[];
+    /** Kinds of collections mounted with an explicit `access`; their tenant rows are edited by design. */
+    readonly collectionKinds: readonly string[];
+};
+export declare function isTenantOverrideServed(policy: TemplateDeliveryPolicy, target: DeliveryTarget): boolean;
+export declare function isServedByCollectionOnly(policy: TemplateDeliveryPolicy, target: DeliveryTarget): boolean;
+export declare function isRowServed(policy: TemplateDeliveryPolicy, row: DeliveryTarget & {
+    readonly tenantId: string;
+}): boolean;
+export declare function isRowServedTo(policy: TemplateDeliveryPolicy, user: {
+    readonly roles: readonly string[];
+}, row: DeliveryTarget & {
+    readonly tenantId: string;
+}): boolean;
+export declare function deliveryPolicyOf(registry: Registry): TemplateDeliveryPolicy;
+export {};

package/dist/template-resolver/template-delivery-policy.js

@@ -0,0 +1,40 @@
+import { isPlainObject, propertyOf } from "@cosmicdrift/kumiko-types/type-guards";
+import { isSystemAdmin } from "./template-draft.js";
+import { SYSTEM_TENANT_ID } from "./web/constants.js";
+import { TEMPLATE_RESOLVER_FEATURE } from "./web/qualified-names.js";
+const NOTHING_UNLOCKED = { tenantEditable: [], collectionKinds: [] };
+export function isTenantOverrideServed(policy, target) {
+    return (policy.collectionKinds.includes(target.kind) ||
+        policy.tenantEditable.some((entry) => entry.kind === target.kind && entry.slug === target.slug));
+}
+// Served only because its kind belongs to a collection with `access`, not because the template
+// is listed in tenantEditable. For these a system row of the same slug must win.
+export function isServedByCollectionOnly(policy, target) {
+    return (policy.collectionKinds.includes(target.kind) &&
+        !policy.tenantEditable.some((entry) => entry.kind === target.kind && entry.slug === target.slug));
+}
+export function isRowServed(policy, row) {
+    return row.tenantId === SYSTEM_TENANT_ID || isTenantOverrideServed(policy, row);
+}
+// A SystemAdmin sees every stored row, so a locked override can still be reset; everyone else
+// sees only what is delivered, which keeps a locked override out of the template-resolver queries for a TenantAdmin (the audit log keeps the history).
+export function isRowServedTo(policy, user, row) {
+    return isSystemAdmin(user) || isRowServed(policy, row);
+}
+function isDeliveryTarget(value) {
+    return (typeof propertyOf(value, "kind") === "string" && typeof propertyOf(value, "slug") === "string");
+}
+function isTemplateDeliveryPolicy(value) {
+    if (!isPlainObject(value))
+        return false;
+    const { tenantEditable, collectionKinds } = value;
+    return (Array.isArray(tenantEditable) &&
+        tenantEditable.every(isDeliveryTarget) &&
+        Array.isArray(collectionKinds) &&
+        collectionKinds.every((kind) => typeof kind === "string"));
+}
+// Fail closed: without the mounted feature (or its exports) no tenant row counts as unlocked.
+export function deliveryPolicyOf(registry) {
+    const exported = propertyOf(propertyOf(registry.getFeature(TEMPLATE_RESOLVER_FEATURE), "exports"), "deliveryPolicy");
+    return isTemplateDeliveryPolicy(exported) ? exported : NOTHING_UNLOCKED;
+}

package/dist/template-resolver/template-draft.d.ts

@@ -1,6 +1,6 @@
 import { Temporal } from "@cosmicdrift/kumiko-types/temporal";
-import { type ContentFormat } from "./constants.ts";
 import type { TemplateResourceRow } from "./table.ts";
+import { type ContentFormat } from "./web/constants.ts";
 export type TemplateDraft = {
     readonly content: string | null;
     readonly contentFormat: ContentFormat;

package/dist/template-resolver/template-draft.js

@@ -1,6 +1,6 @@
 import { Temporal } from "@cosmicdrift/kumiko-types/temporal";
 import * as z from "zod";
-import { CONTENT_FORMATS } from "./constants.js";
+import { CONTENT_FORMATS } from "./web/constants.js";
 const templateDraftSchema = z.object({
     content: z.string().nullable(),
     contentFormat: z.enum(CONTENT_FORMATS),

package/dist/template-resolver/template-edit-policy.d.ts

@@ -0,0 +1,22 @@
+import { type HandlerContext, type RoleAccessRule, type SessionUser } from "@cosmicdrift/kumiko-framework/engine";
+import { type WriteFailure } from "@cosmicdrift/kumiko-framework/errors";
+import type { TemplateKind } from "./web/constants.ts";
+export type TenantEditableTemplate = {
+    readonly kind: TemplateKind;
+    readonly slug: string;
+    readonly access: RoleAccessRule;
+};
+export type TemplateEditPolicy = {
+    readonly tenantEditable: readonly TenantEditableTemplate[];
+};
+type EditTarget = {
+    readonly slug: string;
+    readonly kind: string;
+};
+type EditUser = Pick<SessionUser, "roles">;
+export declare function templateEditAccess(entries: readonly TenantEditableTemplate[]): RoleAccessRule;
+export declare function mayEditTemplate(policy: TemplateEditPolicy, user: EditUser, target: EditTarget): boolean;
+export declare function refuseTemplateEdit(policy: TemplateEditPolicy, user: EditUser, target: EditTarget): WriteFailure | null;
+export declare function refuseMissingTemplate(policy: TemplateEditPolicy, user: EditUser): WriteFailure | null;
+export declare function refuseTemplateEditById(db: HandlerContext["db"], policy: TemplateEditPolicy, user: EditUser, tenantId: string, templateId: string): Promise<WriteFailure | null>;
+export {};

package/dist/template-resolver/template-edit-policy.js

@@ -0,0 +1,45 @@
+import { fetchOne } from "@cosmicdrift/kumiko-framework/db";
+import { hasAccess, } from "@cosmicdrift/kumiko-framework/engine";
+import { AccessDeniedError, writeFailure, } from "@cosmicdrift/kumiko-framework/errors";
+import { templateResourcesTable } from "./table.js";
+import { isSystemAdmin } from "./template-draft.js";
+import { TemplateResolverErrors } from "./web/qualified-names.js";
+const SYSTEM_ADMIN_ROLE = "SystemAdmin";
+export function templateEditAccess(entries) {
+    const roles = new Set([SYSTEM_ADMIN_ROLE]);
+    for (const entry of entries) {
+        for (const role of entry.access.roles)
+            roles.add(role);
+    }
+    return { roles: [...roles] };
+}
+export function mayEditTemplate(policy, user, target) {
+    if (isSystemAdmin(user))
+        return true;
+    const entry = policy.tenantEditable.find((candidate) => candidate.slug === target.slug && candidate.kind === target.kind);
+    return entry !== undefined && hasAccess(user, entry.access);
+}
+export function refuseTemplateEdit(policy, user, target) {
+    if (mayEditTemplate(policy, user, target))
+        return null;
+    return writeFailure(new AccessDeniedError({
+        i18nKey: "templateResolver.errors.templateNotTenantEditable",
+        details: { reason: TemplateResolverErrors.templateNotTenantEditable },
+    }));
+}
+// Fail closed: a missing row gives a non-SystemAdmin the same refusal as a locked one,
+// so the response never reveals whether an id exists. SystemAdmin keeps the 404.
+export function refuseMissingTemplate(policy, user) {
+    return isSystemAdmin(user) ? null : refuseTemplateEdit(policy, user, { slug: "", kind: "" });
+}
+export async function refuseTemplateEditById(db, policy, user, tenantId, templateId) {
+    if (isSystemAdmin(user))
+        return null;
+    const row = await fetchOne(db, templateResourcesTable, {
+        tenantId,
+        id: templateId,
+    });
+    return row === undefined
+        ? refuseMissingTemplate(policy, user)
+        : refuseTemplateEdit(policy, user, row);
+}

package/dist/template-resolver/template-meta.d.ts

@@ -1,6 +1,6 @@
 import * as z from "zod";
-import { type TemplateKind } from "./constants.ts";
-import { MAIL_TONES, type MailTone } from "./mail-constants.ts";
+import { type TemplateKind } from "./web/constants.ts";
+import { MAIL_TONES, type MailTone } from "./web/mail-constants.ts";
 export declare const templateSlugSchema: z.ZodString;
 export declare const MAIL_CATEGORIES: readonly ["transactional", "marketing"];
 export type MailCategory = (typeof MAIL_CATEGORIES)[number];

package/dist/template-resolver/template-meta.js

@@ -1,6 +1,6 @@
 import * as z from "zod";
-import { HEX_COLOR_PATTERN, PDF_ORIENTATIONS, PDF_PAGE_FORMATS, } from "./constants.js";
-import { MAIL_TONES } from "./mail-constants.js";
+import { HEX_COLOR_PATTERN, PDF_ORIENTATIONS, PDF_PAGE_FORMATS, } from "./web/constants.js";
+import { MAIL_TONES } from "./web/mail-constants.js";
 // One or more kebab segments joined by ":" — notification templates are seeded
 // under their qualified name `feature:notify:name`.
 export const templateSlugSchema = z

package/dist/template-resolver/template-preview.d.ts

@@ -1,10 +1,10 @@
 import { type HandlerContext, type SessionUser, type TemplateVariables } from "@cosmicdrift/kumiko-framework/engine";
 import { type KumikoError } from "@cosmicdrift/kumiko-framework/errors";
 import { type MailAttachmentRef } from "../renderer-foundation/index.ts";
-import { type TemplateScope } from "./constants.ts";
 import { validateTemplateDraft } from "./handlers/validate.query.ts";
 import { type LayoutRegions, type TemplateWriteScope } from "./layout-regions.ts";
 import { type PdfTemplateMeta } from "./template-meta.ts";
+import { type TemplateScope } from "./web/constants.ts";
 type LabelText = (label: string) => string;
 export declare function sampleValuesFor(variables: TemplateVariables, labelText?: LabelText): Record<string, unknown>;
 export type PreviewCheckCode = "resources_resolved" | "text_present" | "size_under_cap" | "required_placeholders";

package/dist/template-resolver/template-preview.js

@@ -10,15 +10,16 @@ import { fileContextForTenant } from "../file-foundation/index.js";
 import { collectRendererPlugins, createRendererFoundationApi, RendererError, } from "../renderer-foundation/index.js";
 import { createTemplateResolverApi, TemplateNotFoundError } from "./api.js";
 import { collectDocumentResourceKeys } from "./compile-document-body.js";
-import { DEFAULT_MAIL_LAYOUT_SLUG, DEFAULT_PDF_LAYOUT_SLUG, MAIL_PREVIEW_MAX_BYTES, SYSTEM_TENANT_ID, } from "./constants.js";
 import { parseStoredJson } from "./handlers/template-gates.js";
 import { validateTemplateDraft } from "./handlers/validate.query.js";
 import { readLayoutRegions, sanitizeLayoutHtml, } from "./layout-regions.js";
 import { parseLinkedResourceEntries } from "./linked-resources.js";
 import { buildDisplayHtml } from "./preview-display-html.js";
-import { TemplateResolverErrors } from "./qualified-names.js";
 import { templateResourcesTable } from "./table.js";
+import { deliveryPolicyOf, isRowServedTo } from "./template-delivery-policy.js";
 import { isMailTemplateMeta, parseTemplateMeta, readPdfTemplateMeta, } from "./template-meta.js";
+import { DEFAULT_MAIL_LAYOUT_SLUG, DEFAULT_PDF_LAYOUT_SLUG, MAIL_PREVIEW_MAX_BYTES, SYSTEM_TENANT_ID, } from "./web/constants.js";
+import { TemplateResolverErrors } from "./web/qualified-names.js";
 const SAMPLE_LINK = "https://example.com";
 const SAMPLE_DATE = "2026-01-15";
 const SAMPLE_LIST_ROWS = 3;
@@ -64,12 +65,17 @@ function sampleList(def, labelText) {
         rows.push(sampleRow(def.item, labelText));
     return rows;
 }
+function sampleValueFor(name, def, labelText) {
+    // An images variable has no sample: file ids are record data, never preview content.
+    if (def.type === "images")
+        return [];
+    return def.type === "list" ? sampleList(def, labelText) : sampleScalar(name, def, labelText);
+}
 // Declared examples win; the fallbacks are deterministic so a preview never differs between calls.
 export function sampleValuesFor(variables, labelText = (label) => label) {
     const values = {};
     for (const [name, def] of Object.entries(variables)) {
-        values[name] =
-            def.type === "list" ? sampleList(def, labelText) : sampleScalar(name, def, labelText);
+        values[name] = sampleValueFor(name, def, labelText);
     }
     return values;
 }
@@ -81,7 +87,7 @@ const utf8Bytes = (value) => new TextEncoder().encode(value).length;
 const failed = (error) => ({ ok: false, error });
 async function loadStoredDraft(ctx, user, input) {
     try {
-        return await createTemplateResolverApi(ctx.db).resolveTemplate({
+        return await createTemplateResolverApi(ctx.db, ctx.registry).resolveTemplate({
             tenantId: user.tenantId,
             slug: input.slug,
             kind: input.kind,
@@ -143,10 +149,13 @@ export function estimateMailBytes(args) {
 async function loadEditedRowResources(ctx, user, input) {
     const rows = await selectMany(ctx.db, templateResourcesTable, { tenantId: user.tenantId, slug: input.slug, kind: "mail", locale: input.locale }, { limit: 1 });
     const row = rows[0];
+    if (row !== undefined && !isRowServedTo(deliveryPolicyOf(ctx.registry), user, row)) {
+        return undefined;
+    }
     return row === undefined ? undefined : parseLinkedResourceEntries(row.linkedResources);
 }
 async function resolvePdfLayout(ctx, user, slug, locale) {
-    const api = createTemplateResolverApi(ctx.db);
+    const api = createTemplateResolverApi(ctx.db, ctx.registry);
     const find = async (tenantId) => {
         try {
             return await api.resolveLayout({ tenantId, slug, kind: "pdf-layout", locale });

package/dist/template-resolver/template-usage.d.ts

@@ -1,5 +1,5 @@
 import { type Registry } from "@cosmicdrift/kumiko-framework/engine";
-import { type TemplateKind } from "./constants.ts";
+import { type TemplateKind } from "./web/constants.ts";
 type UsageRole = "template" | "layout";
 export type TemplateUsageEntry = {
     readonly qualifiedName: string;

package/dist/template-resolver/template-usage.js

@@ -1,5 +1,5 @@
 import { parseQn, } from "@cosmicdrift/kumiko-framework/engine";
-import { DEFAULT_MAIL_LAYOUT_SLUG } from "./constants.js";
+import { DEFAULT_MAIL_LAYOUT_SLUG } from "./web/constants.js";
 function layoutSlugsOf(qualifiedName, notification, effectiveLayouts) {
     const stored = effectiveLayouts.get(qualifiedName);
     const locales = new Set([

package/dist/template-resolver/template-validation.js

@@ -1,6 +1,6 @@
 import * as z from "zod";
 import { conditionScopeElement, withParsedDocument } from "./document-sanitizer.js";
-import { DOCUMENT_CONDITION_ATTRIBUTE, isDocumentPlaceholderHref, isDocumentReferenceName, } from "./document-schema.js";
+import { DOCUMENT_CONDITION_ATTRIBUTE, isDocumentPlaceholderHref, isDocumentReferenceName, } from "./web/document-schema.js";
 export const SYSTEM_PLACEHOLDERS = new Set([
     "tenantName",
     "signature",
@@ -38,6 +38,7 @@ const scalarVariableSchema = z.discriminatedUnion("type", [
 ]);
 const variableDefSchema = z.union([
     scalarVariableSchema,
+    z.object({ ...variableCommon, type: z.literal("images") }),
     z.object({
         ...variableCommon,
         type: z.literal("list"),
@@ -74,7 +75,9 @@ function listItemFields(variables, listName) {
     const def = listName !== null && Object.hasOwn(variables, listName) ? variables[listName] : undefined;
     return def?.type === "list" ? def.item : {};
 }
-function isKnownName(name, scope, itemFields) {
+// An images variable holds file ids: as text it would leak them, so only an images block
+// (and a condition on its presence) may name it.
+function isKnownName(name, scope, itemFields, allowImages = false) {
     const { variables } = scope;
     const root = rootName(name);
     // Declared variables and item fields are scalars: a dotted path under one never renders a value.
@@ -82,12 +85,15 @@ function isKnownName(name, scope, itemFields) {
         return { known: true, used: "" };
     if (scope.systemPlaceholders.has(root))
         return { known: true, used: "" };
-    if (Object.hasOwn(variables, name))
-        return { known: true, used: name };
+    if (Object.hasOwn(variables, name)) {
+        return variables[name]?.type === "images" && !allowImages
+            ? { known: false, used: "" }
+            : { known: true, used: name };
+    }
     return { known: false, used: "" };
 }
-function recordName(name, itemFields, scope) {
-    const resolution = isKnownName(name, scope, itemFields);
+function recordName(name, itemFields, scope, allowImages = false) {
+    const resolution = isKnownName(name, scope, itemFields, allowImages);
     if (!resolution.known)
         scope.unknown.add(name);
     else if (resolution.used !== "")
@@ -96,10 +102,21 @@ function recordName(name, itemFields, scope) {
 function enclosingEachName(element) {
     return element.closest("tr[data-each]")?.getAttribute("data-each") ?? null;
 }
-const NAME_ATTRIBUTE_BY_TAG = {
-    span: "data-variable",
-    div: "data-steps",
-};
+function nameAttributeOf(element) {
+    const tag = element.tagName.toLowerCase();
+    if (tag === "span")
+        return "data-variable";
+    if (tag !== "div")
+        return undefined;
+    return element.hasAttribute("data-images") ? "data-images" : "data-steps";
+}
+function recordImagesName(name, scope) {
+    const def = Object.hasOwn(scope.variables, name) ? scope.variables[name] : undefined;
+    if (def?.type === "images")
+        scope.used.add(name);
+    else
+        scope.unknown.add(name);
+}
 function scanRepeatRows(root, scope) {
     for (const element of Array.from(root.querySelectorAll("tr[data-each]"))) {
         const listName = element.getAttribute("data-each") ?? "";
@@ -113,15 +130,18 @@ function scanRepeatRows(root, scope) {
 function scanConditions(root, scope) {
     for (const element of Array.from(root.querySelectorAll(`[${DOCUMENT_CONDITION_ATTRIBUTE}]`))) {
         const itemFields = listItemFields(scope.variables, enclosingEachName(conditionScopeElement(element)));
-        recordName(element.getAttribute(DOCUMENT_CONDITION_ATTRIBUTE) ?? "", itemFields, scope);
+        recordName(element.getAttribute(DOCUMENT_CONDITION_ATTRIBUTE) ?? "", itemFields, scope, true);
     }
 }
 function scanReferences(root, scope) {
-    for (const element of Array.from(root.querySelectorAll("span[data-variable], div[data-steps], a[href], img[data-resource]"))) {
+    for (const element of Array.from(root.querySelectorAll("span[data-variable], div[data-steps], div[data-images], a[href], img[data-resource]"))) {
         const itemFields = listItemFields(scope.variables, enclosingEachName(element));
         const tag = element.tagName.toLowerCase();
-        const nameAttribute = NAME_ATTRIBUTE_BY_TAG[tag];
-        if (nameAttribute !== undefined) {
+        const nameAttribute = nameAttributeOf(element);
+        if (nameAttribute === "data-images") {
+            recordImagesName(element.getAttribute(nameAttribute) ?? "", scope);
+        }
+        else if (nameAttribute !== undefined) {
             recordName(element.getAttribute(nameAttribute) ?? "", itemFields, scope);
         }
         else if (tag === "a") {

package/dist/template-resolver/testing.js

@@ -3,8 +3,8 @@
 // No bun:test here — callers register cases with their own test runner.
 import { seedRow } from "@cosmicdrift/kumiko-testing/helpers";
 import { TemplateNotFoundError } from "./api.js";
-import { FALLBACK_LOCALE, SYSTEM_TENANT_ID, } from "./constants.js";
 import { templateResourcesTable } from "./table.js";
+import { FALLBACK_LOCALE, SYSTEM_TENANT_ID, } from "./web/constants.js";
 export class ConformanceAssertionError extends Error {
     constructor(message) {
         super(message);

package/dist/template-resolver/user-content-table.js

@@ -1,6 +1,6 @@
 import { buildEntityTable } from "@cosmicdrift/kumiko-framework/db";
 import { createEntity, createLongTextField, createSelectField, createTextField, } from "@cosmicdrift/kumiko-framework/engine";
-import { CONTENT_FORMATS, TEMPLATE_KINDS } from "./constants.js";
+import { CONTENT_FORMATS, TEMPLATE_KINDS } from "./web/constants.js";
 // UserContentEntry — the per-user half of the content store: mail signatures
 // and personal reply snippets, one row per (tenantId, ownerId, slug, kind,
 // locale).

package/dist/template-resolver/web/client-plugin.js

@@ -1,6 +1,5 @@
 import { jsx as _jsx, jsxs as _jsxs } from "react/jsx-runtime";
 import { EMPTY_VALUE_PLACEHOLDER } from "@cosmicdrift/kumiko-renderer/headless";
-// @runtime client
 // Client feature factory for the text-block content tree. Apps mount it via
 // createKumikoApp({ clientFeatures: [textBlocksClient()] }); it loads the
 // blocks from the by-tenant query, groups them by their `folder` field and
@@ -16,10 +15,10 @@ import { ContentPreview, useAppFeatures, useContentEditor, useDispatcher, usePri
 import { CSRF_HEADER_NAME, readCsrfToken } from "@cosmicdrift/kumiko-renderer/live";
 import { PlainContentEditor, RichContentEditor, } from "@cosmicdrift/kumiko-renderer/web";
 import { useEffect, useId, useState } from "react";
-import { collectionHandlerName, collectionQueryName, TemplateResolverHandlers, TemplateResolverQueries, } from "../qualified-names.js";
 import { DocumentBlocksContext, DocumentContentEditor } from "./document-editor.js";
 import { documentBlocksForKind } from "./document-toolbar-blocks.js";
 import { defaultTranslations } from "./i18n.js";
+import { collectionHandlerName, collectionQueryName, TemplateResolverHandlers, TemplateResolverQueries, } from "./qualified-names.js";
 function newFolderNode() {
     return { leaves: [], subFolders: new Map() };
 }

package/dist/template-resolver/{constants.d.ts → web/constants.d.ts}

@@ -24,5 +24,8 @@ export declare const DEFAULT_MAIL_LAYOUT_SLUG = "default";
 export declare const DEFAULT_PDF_LAYOUT_SLUG = "default";
 export declare const MAIL_PREVIEW_MAX_BYTES: number;
 export declare const TEST_MAIL_SUBJECT_PREFIX = "[TEST] ";
-export { SYSTEM_TENANT_ID } from "@cosmicdrift/kumiko-framework/engine";
+export { SYSTEM_TENANT_ID } from "@cosmicdrift/kumiko-types/identifiers";
 export declare const FALLBACK_LOCALE = "de";
+export declare const DEFAULT_COLLECTION_ACCESS: {
+    readonly roles: readonly ["SystemAdmin"];
+};

package/dist/template-resolver/{constants.js → web/constants.js}

@@ -1,11 +1,9 @@
-// @runtime client
 // Plain data, no imports — the content tree in web/ needs TEXT_BLOCK_KIND to
 // pick between the public and the admin query.
 //
-// RenderKind identifiziert die Konsumenten-Klasse eines Templates.
-// Plugin-Renderer in `renderer-foundation` matchen auf kind; der
-// Resolver hier ist kind-agnostisch — er lädt nur, das Content-Format
-// (markdown/mjml/html) entscheidet wer's rendert.
+// RenderKind identifies the consumer class of a template. Plugin renderers in
+// `renderer-foundation` match on kind; the resolver here is kind-agnostic: it
+// only loads, and the content format (markdown/mjml/html) decides who renders it.
 export const RENDER_KINDS = ["mail", "document-pdf", "image-snapshot"];
 // Kinds whose html body is a rich document: the server rebuilds it through the
 // document schema on every write (see document-sanitizer.ts).
@@ -60,9 +58,10 @@ export const DEFAULT_PDF_LAYOUT_SLUG = "default";
 // The mail transport enforces no size limit of its own; 10 MiB is a common provider ceiling.
 export const MAIL_PREVIEW_MAX_BYTES = 10 * 1024 * 1024;
 export const TEST_MAIL_SUBJECT_PREFIX = "[TEST] ";
-// System-Templates leben unter der canonical SYSTEM_TENANT_ID-Sentinel-UUID.
-// Re-Export aus framework — single source of truth, vermeidet Drift.
-export { SYSTEM_TENANT_ID } from "@cosmicdrift/kumiko-framework/engine";
-// Default-Locale wenn Tenant keinen eigenen Default konfiguriert. Resolver
-// fällt darauf zurück wenn requested locale + tenant-default fehlen.
+// System templates live under the SYSTEM_TENANT_ID sentinel; the client-safe types package is its single source.
+export { SYSTEM_TENANT_ID } from "@cosmicdrift/kumiko-types/identifiers";
+// Default locale when the tenant configures none. The resolver falls back to
+// it when the requested locale and the tenant default are missing.
 export const FALLBACK_LOCALE = "de";
+// A collection mounted without `access` is maintained by the platform only; TenantAdmin access is an explicit mount decision.
+export const DEFAULT_COLLECTION_ACCESS = { roles: ["SystemAdmin"] };

package/dist/template-resolver/{document-blocks.d.ts → web/document-blocks.d.ts}

@@ -1,5 +1,5 @@
-export type DocumentToolbarBlock = "image" | "table" | "button" | "divider" | "repeat" | "pageBreak" | "align" | "steps";
+export type DocumentToolbarBlock = "image" | "table" | "button" | "divider" | "repeat" | "pageBreak" | "align" | "steps" | "images";
 export declare const MAIL_DOCUMENT_BLOCKS: readonly ["image", "table", "button", "divider", "repeat", "steps"];
-export declare const PDF_DOCUMENT_BLOCKS: readonly ["align", "image", "table", "divider", "repeat", "steps", "pageBreak"];
+export declare const PDF_DOCUMENT_BLOCKS: readonly ["align", "image", "table", "divider", "repeat", "steps", "images", "pageBreak"];
 /** Block set for a template-resource kind; every kind except "document-pdf" gets the mail set. */
 export declare function documentBlocksForKind(kind: string | undefined): readonly DocumentToolbarBlock[];