@cosmicdrift/kumiko-bundled-features 0.387.0 → 0.389.0

package/dist/template-resolver/handlers/tenant-overrides.query.js

@@ -1,5 +1,5 @@
 import { selectMany } from "@cosmicdrift/kumiko-framework/db";
-import { defineQueryHandler, SYSTEM_TENANT_ID } from "@cosmicdrift/kumiko-framework/engine";
+import { defineQueryHandler, MAX_LIST_LIMIT, SYSTEM_TENANT_ID, } from "@cosmicdrift/kumiko-framework/engine";
 import * as z from "zod";
 import { TenantQueries } from "../../tenant/index.js";
 import { templateResourcesTable } from "../table.js";
@@ -10,8 +10,31 @@ import { loadEnabledTenantIds, pickBestRowPerTenant, TENANT_OVERRIDES_REASON, }
 const directorySchema = z.object({
     rows: z.array(z.object({ id: z.string(), label: z.string() })),
 });
-function labelsOf(raw) {
-    return new Map(directorySchema.parse(raw).rows.map((row) => [row.id, row.label]));
+function chunksOf(items, size) {
+    const chunks = [];
+    for (let start = 0; start < items.length; start += size) {
+        chunks.push(items.slice(start, start + size));
+    }
+    return chunks;
+}
+// Looks up only the ids the overrides need, so labels never depend on the directory's default cap.
+async function labelsFor(ctx, queryName, ids) {
+    const labels = new Map();
+    for (const chunk of chunksOf([...ids], MAX_LIST_LIMIT)) {
+        const raw = await ctx.query(queryName, { ids: chunk });
+        for (const row of directorySchema.parse(raw).rows)
+            labels.set(row.id, row.label);
+    }
+    return labels;
+}
+function changerIdsOf(rows) {
+    const ids = new Set();
+    for (const row of rows) {
+        const changedById = row.modifiedById ?? row.insertedById;
+        if (changedById !== null)
+            ids.add(changedById);
+    }
+    return ids;
 }
 function statusOf(row) {
     return row.status === "active" ? "active" : "draft";
@@ -55,10 +78,10 @@ export const tenantOverridesQuery = defineQueryHandler({
         const bestByTenant = pickBestRowPerTenant(found, enabledTenantIds);
         const best = [...bestByTenant.values()];
         const tenantLabels = hasTenantFeature
-            ? labelsOf(await ctx.query(TenantQueries.tenantDirectory, {}))
+            ? await labelsFor(ctx, TenantQueries.tenantDirectory, new Set(best.map((row) => row.tenantId)))
             : new Map();
         const userLabels = hasTenantFeature
-            ? labelsOf(await ctx.query(TenantQueries.memberDirectory, {}))
+            ? await labelsFor(ctx, TenantQueries.memberDirectory, changerIdsOf(best))
             : new Map();
         const rows = best
             .map((row) => toOverrideRow(row, tenantLabels, userLabels))

package/dist/template-resolver/handlers/usage.query.d.ts

@@ -1,5 +1,6 @@
 import * as z from "zod";
-export declare const usageQuery: import("@cosmicdrift/kumiko-types/define-handler").QueryHandlerDefinition<"usage", z.ZodObject<{
+import type { TemplateEditPolicy } from "../template-edit-policy.ts";
+export declare function makeUsageQuery(policy: TemplateEditPolicy): import("@cosmicdrift/kumiko-types/define-handler").QueryHandlerDefinition<"usage", z.ZodObject<{
     slug: z.ZodString;
     kind: z.ZodEnum<{
         "ai-prompt": "ai-prompt";

package/dist/template-resolver/handlers/usage.query.js

@@ -6,20 +6,30 @@ import { deliveryPolicyOf } from "../template-delivery-policy.js";
 import { templateSlugSchema } from "../template-meta.js";
 import { collectTemplateUsage } from "../template-usage.js";
 import { TEMPLATE_KINDS } from "../web/constants.js";
-import { effectiveMailLayoutSlugs } from "./overview.query.js";
+import { effectiveMailLayoutSlugs, isRowVisibleToCaller } from "./overview.query.js";
 const MAIL_ROW_LIMIT = 5000;
-export const usageQuery = defineQueryHandler({
-    name: "usage",
-    schema: z.object({ slug: templateSlugSchema, kind: z.enum(TEMPLATE_KINDS) }),
-    access: { roles: ["TenantAdmin", "SystemAdmin"] },
-    description: "Lists the code-registered notifications that use one template: a mail template is used by the notification whose qualified name is its slug and that has a code template, a mail layout by every mail notification whose effective template (own override, else system) names it, or whose code meta does when no stored template exists, or that falls back to the default layout; use it to show what a change to a template affects.",
-    handler: async (query, ctx) => {
-        const { slug, kind } = query.payload;
-        if (kind !== "mail-layout")
-            return { usedBy: collectTemplateUsage(ctx.registry, slug, kind) };
-        const mailRows = await selectMany(ctx.db, templateResourcesTable, { kind: "mail" }, { limit: MAIL_ROW_LIMIT });
-        return {
-            usedBy: collectTemplateUsage(ctx.registry, slug, kind, effectiveMailLayoutSlugs(mailRows, deliveryPolicyOf(ctx.registry))),
-        };
-    },
-});
+export function makeUsageQuery(policy) {
+    return defineQueryHandler({
+        name: "usage",
+        schema: z.object({ slug: templateSlugSchema, kind: z.enum(TEMPLATE_KINDS) }),
+        access: { roles: ["TenantAdmin", "SystemAdmin"] },
+        description: "Lists the code-registered notifications that use one template: a mail template is used by the notification whose qualified name is its slug and that has a code template, a mail layout by every mail notification whose effective template (own override, else system) names it, or whose code meta does when no stored template exists, or that falls back to the default layout; use it to show what a change to a template affects.",
+        handler: async (query, ctx) => {
+            const { slug, kind } = query.payload;
+            if (kind !== "mail-layout")
+                return { usedBy: collectTemplateUsage(ctx.registry, slug, kind) };
+            const fetchedRows = await selectMany(ctx.db, templateResourcesTable, { kind: "mail" }, { orderBy: { col: "id", direction: "asc" }, limit: MAIL_ROW_LIMIT + 1 });
+            if (fetchedRows.length > MAIL_ROW_LIMIT) {
+                ctx.log?.warn("template usage: row limit reached, result is incomplete", {
+                    limit: MAIL_ROW_LIMIT,
+                });
+            }
+            const visibleRows = fetchedRows
+                .slice(0, MAIL_ROW_LIMIT)
+                .filter((row) => isRowVisibleToCaller(policy, query.user, ctx.registry, row));
+            return {
+                usedBy: collectTemplateUsage(ctx.registry, slug, kind, effectiveMailLayoutSlugs(visibleRows, deliveryPolicyOf(ctx.registry))),
+            };
+        },
+    });
+}

package/dist/template-resolver/handlers/validate.query.js

@@ -1,9 +1,10 @@
 import { selectMany } from "@cosmicdrift/kumiko-framework/db";
 import { defineQueryHandler, SYSTEM_TENANT_ID, } from "@cosmicdrift/kumiko-framework/engine";
 import * as z from "zod";
+import { isRowDeliveredTo } from "../api.js";
 import { imageResourceKeysOf } from "../linked-resources.js";
 import { templateResourcesTable } from "../table.js";
-import { deliveryPolicyOf, isRowServedTo } from "../template-delivery-policy.js";
+import { deliveryPolicyOf } from "../template-delivery-policy.js";
 import { isSystemAdmin } from "../template-draft.js";
 import { resolveTemplateVariables, systemPlaceholdersFor } from "../template-validation.js";
 import { contentFormatSchema, kindSchema, localeSchema, templateSlugSchema } from "./shared.js";
@@ -31,7 +32,11 @@ export async function knownResourceKeysFor(ctx, user, where) {
             locale,
         })),
         ...(scope === "tenant" &&
-            isRowServedTo(deliveryPolicyOf(ctx.registry), user, { tenantId: user.tenantId, kind, slug })
+            (await isRowDeliveredTo(ctx.db, deliveryPolicyOf(ctx.registry), user, {
+                tenantId: user.tenantId,
+                kind,
+                slug,
+            }))
             ? await knownResourceKeys(ctx.db, { tenantId: user.tenantId, slug, kind, scope, locale })
             : []),
     ];

package/dist/template-resolver/seeding.d.ts

@@ -64,4 +64,5 @@ export type LegalContentBlock = {
 export declare function seedLegalContentFromJson(db: DbConnection, blocks: readonly LegalContentBlock[], opts?: {
     readonly tenantId?: TenantId;
     readonly by?: SessionUser;
+    readonly folder?: string;
 }): Promise<void>;

package/dist/template-resolver/seeding.js

@@ -39,10 +39,16 @@ async function resolveExistingForEventStoreSeed(db, tdb, existingRow, tenantId)
     }
     return { id, version: streamVersion };
 }
+// Namespace prefix plus path, no whitespace: keeps free text from passing as a key that the UI
+// would then show raw.
+const I18N_KEY_FORMAT = /^[^\s:]+:\S+$/;
 function seedTitleColumn(opts, label) {
     if (opts.title !== undefined && opts.titleI18nKey !== undefined) {
         throw new Error(`${label} rejected: set either title or titleI18nKey, not both`);
     }
+    if (opts.titleI18nKey !== undefined && !I18N_KEY_FORMAT.test(opts.titleI18nKey)) {
+        throw new Error(`${label} rejected: titleI18nKey "${opts.titleI18nKey}" is not a "namespace:key" i18n key`);
+    }
     return opts.titleI18nKey ?? opts.title ?? null;
 }
 export async function seedSystemTemplate(db, opts) {
@@ -101,16 +107,18 @@ export async function seedSystemTemplate(db, opts) {
             current?.title === rowFields.title &&
             current?.variableSchema === rowFields.variableSchema &&
             current?.meta === rowFields.meta &&
-            current?.status === rowFields.status &&
             current?.parentTemplateId === rowFields.parentTemplateId &&
             (linkedResources === undefined || current?.linkedResources === linkedResources)) {
             return { id: String(row.id) };
         }
-        const result = await executor.update({
-            id: row.id,
-            version: row.version,
-            changes: { ...rowFields, ...activeStampChanges(row) },
-        }, by, tdb);
+        // An archived system row is a SystemAdmin decision (reversible with publish-system) that a
+        // pod-boot re-seed must not undo; content still follows the code. The seed replaces the
+        // content, so an open draft on the old content is dropped with it.
+        const { status: _status, ...contentFields } = rowFields;
+        const changes = current?.status === "archived"
+            ? { ...contentFields, status: "archived", draft: null }
+            : { ...rowFields, ...activeStampChanges(row), draft: null };
+        const result = await executor.update({ id: row.id, version: row.version, changes }, by, tdb);
         if (!result.isSuccess) {
             throw new Error(`seedSystemTemplate update failed: ${JSON.stringify(result)}`);
         }
@@ -191,8 +199,10 @@ async function seedSystemTemplateBundleWithResources(db, bundle, opts) {
     if (!dispatcher) {
         throw new Error(`${label}: bundles with resources need a file provider; pass opts.dispatcher (the dispatcher of the seed deps) so the files are stored through the import-bundle-system write`);
     }
-    if ((opts.ifExists ?? "skip") === "skip") {
-        const existingIds = {};
+    const skipExisting = (opts.ifExists ?? "skip") === "skip";
+    const existingIds = {};
+    let bundleToImport = bundle;
+    if (skipExisting) {
         for (const locale of Object.keys(bundle.locales)) {
             const row = await fetchOne(db, templateResourcesTable, {
                 tenantId: SYSTEM_TENANT_ID,
@@ -206,12 +216,18 @@ async function seedSystemTemplateBundleWithResources(db, bundle, opts) {
         if (Object.keys(existingIds).length === Object.keys(bundle.locales).length) {
             return { ids: existingIds };
         }
+        // import-bundle-system always overwrites, so only the missing locales go in: a
+        // hand-edited system row of an already seeded locale must survive the new-locale boot.
+        bundleToImport = {
+            ...bundle,
+            locales: Object.fromEntries(Object.entries(bundle.locales).filter(([locale]) => !(locale in existingIds))),
+        };
     }
-    const result = await dispatcher.write(TemplateResolverHandlers.importBundleSystem, { bundle }, opts.by ?? createSystemUser(SYSTEM_TENANT_ID, ["SystemAdmin"]));
+    const result = await dispatcher.write(TemplateResolverHandlers.importBundleSystem, { bundle: bundleToImport }, opts.by ?? createSystemUser(SYSTEM_TENANT_ID, ["SystemAdmin"]));
     if (!result.isSuccess) {
         throw new Error(`${label} failed: ${result.error.code}: ${result.error.message}`);
     }
-    return { ids: importedIds(result.data) };
+    return { ids: { ...existingIds, ...importedIds(result.data) } };
 }
 function importedIds(data) {
     const ids = isPlainObject(data) ? data["ids"] : undefined;
@@ -279,11 +295,13 @@ export async function seedTextBlock(db, opts) {
         status: "active",
     };
     const applyUpdate = async (row, current) => {
+        // No folder option keeps the row's folder, so a re-seed cannot drop it from the content tree.
+        const folder = opts.folder === undefined ? (current?.folder ?? null) : fields.folder;
         // Skip no-op updates so a legal re-seed on every pod boot does not bump
         // version/modifiedAt (ETag, "last changed", event-store growth).
         if (current?.title === fields.title &&
             current?.content === fields.content &&
-            current?.folder === fields.folder) {
+            current?.folder === folder) {
             return { id: String(row.id) };
         }
         const result = await executor.update({
@@ -292,7 +310,7 @@ export async function seedTextBlock(db, opts) {
             changes: {
                 title: fields.title,
                 content: fields.content,
-                folder: fields.folder,
+                folder,
                 // A re-seed must not revive an archived block; only a served one gets a new served version.
                 ...(current?.status === "active" && servedStampChanges(row)),
             },
@@ -353,6 +371,7 @@ export async function seedLegalContentFromJson(db, blocks, opts = {}) {
             locale: block.locale,
             title: block.title,
             content: block.content,
+            ...(opts.folder !== undefined && { folder: opts.folder }),
             ifExists: "update",
             by,
         });

package/dist/template-resolver/store-template-resource.d.ts

@@ -42,6 +42,7 @@ export declare function prepareTemplateResourceBeforeTransaction(args: {
 }): Promise<BeforeTransactionResult<PreparedTemplateImage>>;
 export type Release = () => Promise<void>;
 export declare function releaseAll(releases: readonly Release[]): Promise<void>;
+export declare function releaseAfterFailure(ctx: HandlerContext, releases: readonly Release[]): Promise<void>;
 export type PreparedLinkedResourceCopy = {
     readonly key: string;
     readonly entry: LinkedResourceEntry;

package/dist/template-resolver/store-template-resource.js

@@ -1,14 +1,13 @@
 import { fetchOne, selectMany } from "@cosmicdrift/kumiko-framework/db";
 import { NotFoundError, UnprocessableError, writeFailure, } from "@cosmicdrift/kumiko-framework/errors";
 import { createFileRefFromUploadedBytes, uploadFileBytesBeforeTransaction, } from "@cosmicdrift/kumiko-framework/files";
-import { fileContextForTenant } from "../file-foundation/index.js";
+import { fileContextForTenant, readFileRefContent } from "../file-foundation/index.js";
 import { extensionForResourceContentType, requireForTenant } from "../shared/index.js";
 import { DEFAULT_RESOURCE_MAX_BYTES, MAX_FILE_ATTACHMENTS_PER_TEMPLATE, RESOURCE_MAX_BYTES_CONFIG_KEY, } from "./handlers/resource-shared.js";
 import { executor } from "./handlers/shared.js";
-import { attachmentEntriesOf, parseLinkedResourceEntries, templatePdfAttachmentLinkSchema, } from "./linked-resources.js";
+import { attachmentEntriesOf, isFileAttachmentEntry, parseLinkedResourceEntries, templatePdfAttachmentLinkSchema, } from "./linked-resources.js";
 import { normalizeResourceImage } from "./resource-image.js";
 import { templateResourcesTable } from "./table.js";
-import { readTemplateResource } from "./template-resources.js";
 import { ACTIVE_TEMPLATE_STATUS, SYSTEM_TENANT_ID } from "./web/constants.js";
 import { TemplateResolverErrors } from "./web/qualified-names.js";
 export async function readTemplateResourceMaxBytes(config, registry) {
@@ -24,6 +23,9 @@ function keyInUse() {
         details: { code: "key_in_use" },
     }));
 }
+function isImageKey(links, key) {
+    return typeof links[key] === "string";
+}
 function isAttachmentKey(links, key) {
     const occupant = links[key];
     return occupant !== undefined && typeof occupant !== "string";
@@ -129,6 +131,49 @@ export async function releaseAll(releases) {
     if (rejected?.status === "rejected")
         throw rejected.reason;
 }
+// Failure paths: a failing release must not replace the upload error the caller needs to see.
+export async function releaseAfterFailure(ctx, releases) {
+    try {
+        await releaseAll(releases);
+    }
+    catch (releaseError) {
+        ctx.log?.warn("template upload rollback: releasing stored files failed", {
+            error: releaseError instanceof Error ? releaseError.message : String(releaseError),
+        });
+    }
+}
+// The source row's own fileName is personal data and may be ciphertext, so the copy is named from
+// the link entry or the key.
+function copiedFileName(key, entry, contentType) {
+    if (typeof entry !== "string" && isFileAttachmentEntry(entry))
+        return entry.fileName;
+    return `${key}.${extensionForResourceContentType(contentType) ?? "bin"}`;
+}
+function sourceUnreadable() {
+    return writeFailure(new UnprocessableError(TemplateResolverErrors.resourceSourceUnreadable, {
+        i18nKey: "templateResolver.errors.resource.sourceUnreadable",
+    }));
+}
+// Undefined: the fileRef row exists but its bytes cannot be read, which must not look like a
+// deleted file. The provider is chosen by the tenant of the fileRef, not by the caller's.
+async function readCopySource(ctx, fileRefId) {
+    try {
+        const found = await readFileRefContent({
+            db: ctx.db,
+            filesForTenant: (tid) => fileContextForTenant(ctx, ctx.user.tenantId, tid),
+            fileRefId,
+            allowedTenantIds: [SYSTEM_TENANT_ID, ctx.user.tenantId],
+        });
+        return found === null ? null : { contentType: found.contentType, bytes: found.content };
+    }
+    catch (cause) {
+        ctx.log?.warn("template copy: source file could not be read", {
+            fileRefId,
+            errorClass: cause instanceof Error ? cause.name : typeof cause,
+        });
+        return undefined;
+    }
+}
 // beforeTransaction half: copies the file behind every entry into the target tenant's storage, so a
 // template copied from the system default keeps working once the tenant exports it or measures its
 // attachments. An entry whose source file is gone is left out: it could not be resolved at render
@@ -143,12 +188,21 @@ export async function prepareLinkedResourceCopiesBeforeTransaction(args) {
                 copies.push({ key, entry });
                 continue;
             }
-            const file = await readTemplateResource(ctx, typeof entry === "string" ? entry : entry.fileRefId);
-            if (file === null)
+            const source = await readCopySource(ctx, typeof entry === "string" ? entry : entry.fileRefId);
+            if (source === undefined) {
+                await releaseAfterFailure(ctx, releases);
+                return sourceUnreadable();
+            }
+            // skip: the source fileRef is deleted or unknown, so there is nothing to copy
+            if (source === null)
                 continue;
-            const uploaded = await uploadToTenant({ ctx, user, tenantId }, { fileName: file.fileName, mimeType: file.contentType, data: file.bytes });
+            const uploaded = await uploadToTenant({ ctx, user, tenantId }, {
+                fileName: copiedFileName(key, entry, source.contentType),
+                mimeType: source.contentType,
+                data: source.bytes,
+            });
             if (!uploaded.isSuccess) {
-                await releaseAll(releases);
+                await releaseAfterFailure(ctx, releases);
                 return uploaded;
             }
             if (uploaded.release)
@@ -157,7 +211,7 @@ export async function prepareLinkedResourceCopiesBeforeTransaction(args) {
         }
     }
     catch (cause) {
-        await releaseAll(releases);
+        await releaseAfterFailure(ctx, releases);
         throw cause;
     }
     return { isSuccess: true, data: copies, release: () => releaseAll(releases) };
@@ -275,8 +329,7 @@ async function checkAttachmentTarget(args) {
     if (otherAttachmentCount(linked, key) >= MAX_FILE_ATTACHMENTS_PER_TEMPLATE) {
         return attachmentLimitFailure();
     }
-    const occupant = linked[key];
-    if (occupant !== undefined && typeof occupant === "string")
+    if (isImageKey(linked, key))
         return keyInUse();
     return { isSuccess: true, data: { row, linked } };
 }
@@ -387,6 +440,8 @@ export async function linkTemplatePdfAttachment(args) {
     if (row.kind !== "mail")
         return attachmentNeedsMailTemplate();
     const linked = parseLinkedResourceEntries(row.linkedResources);
+    if (isImageKey(linked, key))
+        return keyInUse();
     if (otherAttachmentCount(linked, key) >= MAX_FILE_ATTACHMENTS_PER_TEMPLATE) {
         return attachmentLimitFailure();
     }

package/dist/template-resolver/template-delivery-policy.d.ts

@@ -13,10 +13,5 @@ export declare function isServedByCollectionOnly(policy: TemplateDeliveryPolicy,
 export declare function isRowServed(policy: TemplateDeliveryPolicy, row: DeliveryTarget & {
     readonly tenantId: string;
 }): boolean;
-export declare function isRowServedTo(policy: TemplateDeliveryPolicy, user: {
-    readonly roles: readonly string[];
-}, row: DeliveryTarget & {
-    readonly tenantId: string;
-}): boolean;
 export declare function deliveryPolicyOf(registry: Registry): TemplateDeliveryPolicy;
 export {};

package/dist/template-resolver/template-delivery-policy.js

@@ -1,5 +1,4 @@
 import { isPlainObject, propertyOf } from "@cosmicdrift/kumiko-types/type-guards";
-import { isSystemAdmin } from "./template-draft.js";
 import { SYSTEM_TENANT_ID } from "./web/constants.js";
 import { TEMPLATE_RESOLVER_FEATURE } from "./web/qualified-names.js";
 const NOTHING_UNLOCKED = { tenantEditable: [], collectionKinds: [] };
@@ -16,11 +15,6 @@ export function isServedByCollectionOnly(policy, target) {
 export function isRowServed(policy, row) {
     return row.tenantId === SYSTEM_TENANT_ID || isTenantOverrideServed(policy, row);
 }
-// A SystemAdmin sees every stored row, so a locked override can still be reset; everyone else
-// sees only what is delivered, which keeps a locked override out of the template-resolver queries for a TenantAdmin (the audit log keeps the history).
-export function isRowServedTo(policy, user, row) {
-    return isSystemAdmin(user) || isRowServed(policy, row);
-}
 function isDeliveryTarget(value) {
     return (typeof propertyOf(value, "kind") === "string" && typeof propertyOf(value, "slug") === "string");
 }

package/dist/template-resolver/template-meta.js

@@ -1,6 +1,7 @@
 import * as z from "zod";
 import { HEX_COLOR_PATTERN, PDF_ORIENTATIONS, PDF_PAGE_FORMATS, } from "./web/constants.js";
 import { MAIL_TONES } from "./web/mail-constants.js";
+import { MAIL_LAYOUT_ACCENT_LINES, MAIL_LAYOUT_BUTTON_STYLES, MAIL_LAYOUT_FONTS, MAIL_LAYOUT_WIDTHS, } from "./web/mail-layout-constants.js";
 // One or more kebab segments joined by ":" — notification templates are seeded
 // under their qualified name `feature:notify:name`.
 export const templateSlugSchema = z
@@ -66,12 +67,14 @@ const pdfMetaSchema = z
         .optional(),
 })
     .strict();
-const MAIL_LAYOUT_FONTS = ["sans", "serif"];
-const MAIL_LAYOUT_ACCENT_LINES = ["branding", "none"];
-const MAIL_LAYOUT_BUTTON_STYLES = ["filled-rounded", "filled-square", "outline"];
+const MAIL_LAYOUT_WIDTH_LITERALS = [
+    z.literal(MAIL_LAYOUT_WIDTHS[0]),
+    z.literal(MAIL_LAYOUT_WIDTHS[1]),
+    z.literal(MAIL_LAYOUT_WIDTHS[2]),
+];
 const mailLayoutMetaSchema = z
     .object({
-    width: z.union([z.literal(560), z.literal(600), z.literal(640)]).optional(),
+    width: z.union(MAIL_LAYOUT_WIDTH_LITERALS).optional(),
     font: z.enum(MAIL_LAYOUT_FONTS).optional(),
     outerBackground: z.string().regex(HEX_COLOR_PATTERN, "must be a #rrggbb color").optional(),
     accentLine: z.enum(MAIL_LAYOUT_ACCENT_LINES).optional(),

package/dist/template-resolver/template-preview.js

@@ -8,7 +8,7 @@ import * as z from "zod";
 import { createEmailAttachmentReader, createTemplateMailRenderer } from "../delivery/index.js";
 import { fileContextForTenant } from "../file-foundation/index.js";
 import { collectRendererPlugins, createRendererFoundationApi, RendererError, } from "../renderer-foundation/index.js";
-import { createTemplateResolverApi, TemplateNotFoundError } from "./api.js";
+import { createTemplateResolverApi, isRowDeliveredTo, TemplateNotFoundError, } from "./api.js";
 import { collectDocumentResourceKeys } from "./compile-document-body.js";
 import { parseStoredJson } from "./handlers/template-gates.js";
 import { validateTemplateDraft } from "./handlers/validate.query.js";
@@ -16,7 +16,7 @@ import { readLayoutRegions, sanitizeLayoutHtml, } from "./layout-regions.js";
 import { parseLinkedResourceEntries } from "./linked-resources.js";
 import { buildDisplayHtml } from "./preview-display-html.js";
 import { templateResourcesTable } from "./table.js";
-import { deliveryPolicyOf, isRowServedTo } from "./template-delivery-policy.js";
+import { deliveryPolicyOf } from "./template-delivery-policy.js";
 import { isMailTemplateMeta, parseTemplateMeta, readPdfTemplateMeta, } from "./template-meta.js";
 import { DEFAULT_MAIL_LAYOUT_SLUG, DEFAULT_PDF_LAYOUT_SLUG, MAIL_PREVIEW_MAX_BYTES, SYSTEM_TENANT_ID, } from "./web/constants.js";
 import { TemplateResolverErrors } from "./web/qualified-names.js";
@@ -149,7 +149,8 @@ export function estimateMailBytes(args) {
 async function loadEditedRowResources(ctx, user, input) {
     const rows = await selectMany(ctx.db, templateResourcesTable, { tenantId: user.tenantId, slug: input.slug, kind: "mail", locale: input.locale }, { limit: 1 });
     const row = rows[0];
-    if (row !== undefined && !isRowServedTo(deliveryPolicyOf(ctx.registry), user, row)) {
+    if (row !== undefined &&
+        !(await isRowDeliveredTo(ctx.db, deliveryPolicyOf(ctx.registry), user, row))) {
         return undefined;
     }
     return row === undefined ? undefined : parseLinkedResourceEntries(row.linkedResources);

package/dist/template-resolver/web/constants.d.ts

@@ -10,7 +10,7 @@ export declare const UPSERT_KINDS: readonly ["mail", "document-pdf", "image-snap
 export type UpsertKind = (typeof UPSERT_KINDS)[number];
 export declare const TEXT_BLOCK_KIND: "text-block";
 export declare const COLLECTION_REFUSED_KINDS: readonly ["mail", "mail-layout", "pdf-layout"];
-export declare function isCollectionRefusedKind(kind: string): boolean;
+export declare function isCollectionRefusedKind(kind: unknown): kind is (typeof COLLECTION_REFUSED_KINDS)[number];
 export declare const CONTENT_FORMATS: readonly ["markdown", "mjml", "html", "plain"];
 export type ContentFormat = (typeof CONTENT_FORMATS)[number];
 export declare const TEMPLATE_SCOPES: readonly ["system", "tenant"];
@@ -18,8 +18,8 @@ export type TemplateScope = (typeof TEMPLATE_SCOPES)[number];
 export declare const TEMPLATE_STATUSES: readonly ["draft", "active", "archived"];
 export type TemplateStatus = (typeof TEMPLATE_STATUSES)[number];
 export declare const ACTIVE_TEMPLATE_STATUS = "active";
+export { HEX_COLOR_PATTERN } from "./mail-layout-constants.ts";
 export { PDF_DEFAULT_MARGIN_MM, PDF_FOOTER_MARGIN_MM, PDF_HEADER_MARGIN_MM, PDF_ORIENTATIONS, PDF_PAGE_FORMATS, type PdfOrientation, type PdfPageFormat, } from "./pdf-constants.ts";
-export declare const HEX_COLOR_PATTERN: RegExp;
 export declare const DEFAULT_MAIL_LAYOUT_SLUG = "default";
 export declare const DEFAULT_PDF_LAYOUT_SLUG = "default";
 export declare const MAIL_PREVIEW_MAX_BYTES: number;

package/dist/template-resolver/web/constants.js

@@ -4,6 +4,7 @@
 // RenderKind identifies the consumer class of a template. Plugin renderers in
 // `renderer-foundation` match on kind; the resolver here is kind-agnostic: it
 // only loads, and the content format (markdown/mjml/html) decides who renders it.
+import { isOneOf } from "@cosmicdrift/kumiko-types/type-guards";
 export const RENDER_KINDS = ["mail", "document-pdf", "image-snapshot"];
 // Kinds whose html body is a rich document: the server rebuilds it through the
 // document schema on every write (see document-sanitizer.ts).
@@ -44,15 +45,14 @@ export const COLLECTION_REFUSED_KINDS = [
     "pdf-layout",
 ];
 export function isCollectionRefusedKind(kind) {
-    return COLLECTION_REFUSED_KINDS.some((refused) => refused === kind);
+    return isOneOf(COLLECTION_REFUSED_KINDS, kind);
 }
 export const CONTENT_FORMATS = ["markdown", "mjml", "html", "plain"];
 export const TEMPLATE_SCOPES = ["system", "tenant"];
 export const TEMPLATE_STATUSES = ["draft", "active", "archived"];
 export const ACTIVE_TEMPLATE_STATUS = "active";
+export { HEX_COLOR_PATTERN } from "./mail-layout-constants.js";
 export { PDF_DEFAULT_MARGIN_MM, PDF_FOOTER_MARGIN_MM, PDF_HEADER_MARGIN_MM, PDF_ORIENTATIONS, PDF_PAGE_FORMATS, } from "./pdf-constants.js";
-// Colors end up inside MJML attributes, so only a strict hex is ever written there.
-export const HEX_COLOR_PATTERN = /^#[0-9a-fA-F]{6}$/;
 export const DEFAULT_MAIL_LAYOUT_SLUG = "default";
 export const DEFAULT_PDF_LAYOUT_SLUG = "default";
 // The mail transport enforces no size limit of its own; 10 MiB is a common provider ceiling.

package/dist/template-resolver/web/i18n.js

@@ -72,6 +72,8 @@ export const defaultTranslations = {
         "templateResolver.errors.patch.blockRemoved": "The block {blockId} was already removed by an earlier step.",
         "templateResolver.errors.patch.textNotFound": "The text {find} was not found in the block.",
         "templateResolver.errors.patch.textAmbiguous": "The text {find} occurs {count} times in the block; use a longer text.",
+        "templateResolver.errors.patch.textSpansFormatting": "The text {find} crosses a formatting change in the block; replace each formatted part on its own.",
+        "templateResolver.errors.patch.placeholderNotReplaceable": "The placeholder {find} cannot be replaced as text; set the text around it with another operation or remove the block.",
         "templateResolver.errors.patch.blockNotAllowed": "The block type {type} is not available in {kind} templates.",
         "templateResolver.errors.patch.blockTypeMismatch": "This step needs a {expected} block, but the block is a {actual}.",
         "templateResolver.errors.patch.invalidResourceKey": "The image key {resource} is not valid.",
@@ -86,6 +88,7 @@ export const defaultTranslations = {
         "templateResolver.errors.testMail.noAddress": "Your account has no email address to send the test mail to.",
         "templateResolver.errors.testMail.failed": "The test mail could not be sent.",
         "templateResolver.errors.resource.tooLarge": "The image is too large.",
+        "templateResolver.errors.resource.sourceUnreadable": "A file of the source template could not be read, so nothing was copied.",
         "templateResolver.errors.resource.unsupportedImage": "This file is not a supported image. Use PNG, JPEG, WebP or GIF.",
         "templateResolver.errors.template.systemResourcesNeedSystemTenant": "Resource files of system templates can only be imported or exported by a user of the system tenant.",
         "templateResolver.errors.template.bundleLocalesDiffer": "The locales of this template differ in content format or variables, so they cannot be exported as one bundle.",

package/dist/template-resolver/web/index.d.ts

@@ -2,6 +2,7 @@ export { textBlocksClient } from "./client-plugin.tsx";
 export { DocumentContentEditor } from "./document-editor.tsx";
 export { type DocumentEditorChrome, type DocumentEditorHandle, type DocumentEditorProps, type DocumentResourcePreview, type DocumentToolbarBlock, MAIL_DOCUMENT_BLOCKS, PDF_DOCUMENT_BLOCKS, } from "./document-toolbar-blocks.ts";
 export { MAIL_TONES, type MailTone } from "./mail-constants.ts";
+export { HEX_COLOR_PATTERN, MAIL_LAYOUT_ACCENT_LINES, MAIL_LAYOUT_BUTTON_STYLES, MAIL_LAYOUT_FONTS, MAIL_LAYOUT_WIDTHS, } from "./mail-layout-constants.ts";
 export { PDF_DEFAULT_MARGIN_MM, PDF_FOOTER_MARGIN_MM, PDF_HEADER_MARGIN_MM, PDF_ORIENTATIONS, PDF_PAGE_FORMATS, } from "./pdf-constants.ts";
 export { PlaceholderLineEditor, type PlaceholderLineEditorProps, } from "./placeholder-line-editor-lazy.tsx";
 export { TemplateResolverErrors, TemplateResolverHandlers, TemplateResolverQueries, } from "./qualified-names.ts";

package/dist/template-resolver/web/index.js

@@ -7,6 +7,7 @@ export { textBlocksClient } from "./client-plugin.js";
 export { DocumentContentEditor } from "./document-editor.js";
 export { MAIL_DOCUMENT_BLOCKS, PDF_DOCUMENT_BLOCKS, } from "./document-toolbar-blocks.js";
 export { MAIL_TONES } from "./mail-constants.js";
+export { HEX_COLOR_PATTERN, MAIL_LAYOUT_ACCENT_LINES, MAIL_LAYOUT_BUTTON_STYLES, MAIL_LAYOUT_FONTS, MAIL_LAYOUT_WIDTHS, } from "./mail-layout-constants.js";
 export { PDF_DEFAULT_MARGIN_MM, PDF_FOOTER_MARGIN_MM, PDF_HEADER_MARGIN_MM, PDF_ORIENTATIONS, PDF_PAGE_FORMATS, } from "./pdf-constants.js";
 export { PlaceholderLineEditor, } from "./placeholder-line-editor-lazy.js";
 export { TemplateResolverErrors, TemplateResolverHandlers, TemplateResolverQueries, } from "./qualified-names.js";

package/dist/template-resolver/web/mail-layout-constants.d.ts

@@ -0,0 +1,5 @@
+export declare const MAIL_LAYOUT_WIDTHS: readonly [560, 600, 640];
+export declare const MAIL_LAYOUT_FONTS: readonly ["sans", "serif"];
+export declare const MAIL_LAYOUT_ACCENT_LINES: readonly ["branding", "none"];
+export declare const MAIL_LAYOUT_BUTTON_STYLES: readonly ["filled-rounded", "filled-square", "outline"];
+export declare const HEX_COLOR_PATTERN: RegExp;

package/dist/template-resolver/web/mail-layout-constants.js

@@ -0,0 +1,7 @@
+// No imports: web/ re-exports these, and template-meta.ts pulls in zod and the framework engine.
+export const MAIL_LAYOUT_WIDTHS = [560, 600, 640];
+export const MAIL_LAYOUT_FONTS = ["sans", "serif"];
+export const MAIL_LAYOUT_ACCENT_LINES = ["branding", "none"];
+export const MAIL_LAYOUT_BUTTON_STYLES = ["filled-rounded", "filled-square", "outline"];
+// Colors end up inside MJML attributes, so only a strict hex is ever written there.
+export const HEX_COLOR_PATTERN = /^#[0-9a-fA-F]{6}$/;

package/dist/template-resolver/web/qualified-names.d.ts

@@ -53,6 +53,7 @@ export declare const TemplateResolverErrors: {
     readonly bundleLocalesDiffer: "bundle_locales_differ";
     readonly resourceTooLarge: "template_resource_too_large";
     readonly resourceUnsupportedImage: "template_resource_unsupported_image";
+    readonly resourceSourceUnreadable: "template_resource_source_unreadable";
     readonly attachmentUnsupportedType: "template_attachment_unsupported_type";
     readonly attachmentLimit: "template_attachment_limit";
     readonly attachmentInvalid: "template_attachment_invalid";

package/dist/template-resolver/web/qualified-names.js

@@ -63,6 +63,7 @@ export const TemplateResolverErrors = {
     bundleLocalesDiffer: "bundle_locales_differ",
     resourceTooLarge: "template_resource_too_large",
     resourceUnsupportedImage: "template_resource_unsupported_image",
+    resourceSourceUnreadable: "template_resource_source_unreadable",
     attachmentUnsupportedType: "template_attachment_unsupported_type",
     attachmentLimit: "template_attachment_limit",
     attachmentInvalid: "template_attachment_invalid",

package/dist/tenant/feature.js

@@ -31,6 +31,7 @@ export function collectAssignableAppRoles(features) {
 // --- Feature ---
 export function createTenantFeature(options) {
     return defineFeature("tenant", (r) => {
+        r.adoptsBundledLists();
         r.describe("Registers the three core multi-tenancy entities \u2014 `tenant`, `tenant-membership`, and `tenant-invitation` (DB tables `read_tenants`, `read_tenant_memberships`, and `read_tenant_invitations`) \u2014 along with write handlers for create/update/disable/enable/addMember/removeMember/updateMemberRoles and the matching queries. It also declares a set of per-tenant config keys (companyName, timezone, locale, SMTP credentials) and system-only keys (priceModel, maxUsers) via `r.config({ keys: { ... } })`. Use this feature in every multi-tenant app; membership resolution and invitation flows depend on it, and `auth-email-password` requires it.");
         r.uiHints({
             displayLabel: "Multi-Tenant Core",

package/dist/tenant/handlers/member-directory.query.d.ts

@@ -2,6 +2,7 @@ import * as z from "zod";
 export declare const memberDirectoryQuery: import("@cosmicdrift/kumiko-framework/engine").PagedQueryHandlerDefinition<"memberDirectory", z.ZodObject<{
     limit: z.ZodDefault<z.ZodNumber>;
     search: z.ZodOptional<z.ZodString>;
+    ids: z.ZodOptional<z.ZodArray<z.ZodString>>;
 }, z.core.$strip>, {
     id: string;
     label: string;