@cosmicdrift/kumiko-bundled-features 0.400.0 → 0.402.0

package/dist/documents/tab.js

@@ -1,4 +1,4 @@
-import { DocumentsQueries } from "./constants.js";
+import { DOCUMENT_ENTITY, DOCUMENTS_FEATURE_NAME, DocumentsQueries } from "./constants.js";
 import { forTypeQueryQn } from "./queries/for-record.query.js";
 // "Documents" tab for the edit screen of a link target. The tab id is the same on every screen,
 // so deep links like ?tab=documents work across hosts.
@@ -8,7 +8,7 @@ export function documentsTab(entityType) {
         kind: "relatedList",
         title: "documents:tab.title",
         query: forTypeQueryQn(entityType),
-        entity: "documents:document",
+        entity: `${DOCUMENTS_FEATURE_NAME}:${DOCUMENT_ENTITY}`,
         columns: [
             { field: "title", sortable: true },
             { field: "category", sortable: true },

package/dist/documents/target-write-check.js

@@ -9,8 +9,10 @@ function updateHandlerAccessOf(registry, entityType) {
     return undefined;
 }
 // Linking a document changes what readers of the target see, so it needs what saving the target
-// needs: read visibility, the entity's update handler and its row-level write rule. A target that
-// is not visible answers like a missing one.
+// needs: read visibility, a write gate and its row-level write rule. The gate is the entity's
+// update handler; an entity saved only through custom handlers has none, so its declared write
+// roles stand in, and without either the target stays unlinkable. A target that is not visible
+// answers like a missing one.
 export async function canWriteLinkTarget(registry, entityType, entityId, user, db) {
     if (!(await parentRowIsVisible(registry, entityType, entityId, user, db)))
         return false;
@@ -18,8 +20,13 @@ export async function canWriteLinkTarget(registry, entityType, entityId, user, d
     if (entity === undefined)
         return false;
     const updateAccess = updateHandlerAccessOf(registry, entityType);
-    if (updateAccess === undefined || !hasAccess(user, updateAccess))
+    if (updateAccess !== undefined) {
+        if (!hasAccess(user, updateAccess))
+            return false;
+    }
+    else if (!hasAccess(user, { roles: Object.keys(entity.access?.write ?? {}) })) {
         return false;
+    }
     const row = await createEntityExecutor(entityType, entity).executor.detail({ id: entityId }, user, db);
     return row !== null && userCanWriteFieldRow(user, entity.access?.write, row, row);
 }

package/dist/inbound-mail-foundation/entities.js

@@ -214,6 +214,7 @@ export const syncCursorEntity = createEntity({
 export const seenMessageEntity = createEntity({
     table: "store_mail_seen_messages",
     softDelete: false,
+    indexes: [{ unique: true, columns: ["accountId", "providerMessageId"] }],
     fields: {
         accountId: createTextField({
             required: true,

package/dist/inbound-mail-foundation/watch-lease.d.ts

@@ -5,7 +5,7 @@ export type WatchLease = {
     readonly acquire: (account: MailAccountRecord, state: WatcherState) => Promise<WatchLeaseResult>;
 };
 export declare function createWatchLease(deps: {
-    readonly lock: DistributedLock | undefined;
+    readonly lock: DistributedLock;
     readonly ttlSeconds: number;
     readonly renewIntervalMs: number;
     readonly watchers: ReadonlyMap<string, WatcherState>;

package/dist/inbound-mail-foundation/watch-lease.js

@@ -20,7 +20,7 @@ export function createWatchLease(deps) {
     async function renewLeaseOnce(account, state, generation) {
         state.renewTimer = null;
         // skip: supervisor stopped, generation superseded, or lease already lost — stale timer fire, nothing to renew.
-        if (!isRunning() || state.generation !== generation || !state.lockToken || !lock)
+        if (!isRunning() || state.generation !== generation || !state.lockToken)
             return;
         let renewed;
         try {
@@ -55,7 +55,7 @@ export function createWatchLease(deps) {
     }
     // kumiko-lint-ignore complexity-budget yield-point stale-map check after acquire is intentional
     async function acquire(account, state) {
-        if (!lock || state.lockToken)
+        if (state.lockToken)
             return "acquired";
         // A throwing lock (Redis outage) reads as "not claimed": the next tick retries instead of leaving the start flag set.
         const token = await lock.acquire(account.id, { ttlSeconds: ttlSeconds }).catch((err) => {

package/dist/inbound-mail-foundation/watch-supervisor-types.d.ts

@@ -40,15 +40,15 @@ export type InboundMailSupervisorDeps = {
     /** Coordinates the IMAP watch (not the poll) across worker processes:
      *  before `plugin.watch()`, ensureWatcher claims a TTL lease for the
      *  account via `lock.acquire` and renews it via `lock.renew` while the
-     *  watcher lives. Omit for single-process deployments — every active
-     *  account is watched locally, same as before. */
-    readonly lock?: DistributedLock;
+     *  watcher lives. Required: without it every worker would hold its own
+     *  IDLE connection per account. */
+    readonly lock: DistributedLock;
     /** Access-token lifecycle for OAuth accounts. Defaults to a manager built
      *  from `db` + `providerCtx.secrets`; pass the instance shared with
      *  `createInboundMailConnectRoutes` so a fresh connect primes this cache. */
     readonly oauthTokens?: OAuthAccessTokenManager;
     /** TTL (seconds) for the per-account watch lease. Default 90s, renewed
-     *  every ttl/3. Only used when `lock` is set. */
+     *  every ttl/3. */
     readonly watchLeaseTtlSeconds?: number;
     readonly log?: (line: string) => void;
 };
@@ -60,7 +60,7 @@ export type WatcherState = {
      *  an already stopped watcher. */
     generation: number;
     /** Token from `deps.lock.acquire` while this worker owns the account's
-     *  watch lease; null when unclaimed (no `deps.lock`, or claim lost). */
+     *  watch lease; null when unclaimed (claim lost). */
     lockToken: string | null;
     renewTimer: ReturnType<typeof setTimeout> | null;
     /** Consecutive renew() throws — tear down once failures span a full TTL. */

package/dist/inbound-mail-foundation/watch-supervisor.js

@@ -17,11 +17,9 @@
 //     db,
 //     dispatchWrite: ({ handlerQn, payload, tenantId }) =>
 //       deps.dispatchSystemWrite({ handlerQn, payload, tenantId: tenantId as TenantId }),
-//     // Multi-worker deployments: share one DistributedLock (same Redis,
-//     // same key prefix) across every worker process so only one of them
-//     // holds the IMAP IDLE connection per account. Omit `lock`
-//     // for a single-process deployment — every active account gets
-//     // watched locally, as before.
+//     // One DistributedLock (same Redis, same key prefix) shared across
+//     // every worker process, so only one of them holds the IMAP IDLE
+//     // connection per account.
 //     lock: createDistributedLock(redis, `${RedisKeys.lock}inbound-mail:watch:`),
 //   });
 //   await supervisor.start();
@@ -34,7 +32,7 @@
 // **Multi-worker coordination:** the reconciliation poll remains deliberately
 // N-fold: every worker polls every active account, which is idempotent and
 // cheap. Only `plugin.watch()` holds a long-lived connection, and only one
-// worker may hold it per account. With `deps.lock`, `ensureWatcher` claims a
+// worker may hold it per account. `ensureWatcher` claims a
 // TTL lease (`lock.acquire`) before connecting; a worker that fails to claim
 // it leaves the account to its current holder, while the poll still covers
 // it. The holder renews the lease via heartbeat (`lock.renew`, every ttl/3)
@@ -375,7 +373,7 @@ export function createInboundMailSupervisor(deps) {
                 log(`inbound-mail: stop watcher ${accountId} failed: ${describeError(err)}`);
             }
         }
-        if (deps.lock && lockToken) {
+        if (lockToken) {
             try {
                 await deps.lock.release(accountId, lockToken);
             }

package/dist/managed-pages/feature.js

@@ -184,7 +184,15 @@ export function createManagedPagesFeature(opts) {
                 }
                 const html = wrapLayout({
                     title: data.title,
-                    bodyHtml: renderPageBody({ slug, body: data.body, bodyFormat: data.bodyFormat }),
+                    bodyHtml: renderPageBody({
+                        tenantId,
+                        slug,
+                        lang,
+                        version: data.version,
+                        updatedAt: data.updatedAt,
+                        body: data.body,
+                        bodyFormat: data.bodyFormat,
+                    }),
                     lang: data.lang,
                     slug,
                     description: data.description,

package/dist/managed-pages/render-page-body.d.ts

@@ -1,10 +1,21 @@
 import { type Logger } from "@cosmicdrift/kumiko-framework/logging";
+import { sanitizeDocumentHtml } from "../template-resolver/index.ts";
 import type { BodyFormat } from "./constants.ts";
 type WarnLogger = Pick<Logger, "warn">;
 export type RenderablePageBody = {
+    readonly tenantId: string;
     readonly slug: string;
+    readonly lang: string;
+    readonly version: number;
+    readonly updatedAt: string;
     readonly body: string;
     readonly bodyFormat: BodyFormat;
 };
-export declare function renderPageBody(page: RenderablePageBody, log?: WarnLogger): string;
+export type PageBodyRendererDeps = {
+    readonly sanitizeDocument?: typeof sanitizeDocumentHtml;
+    readonly renderMarkdown?: (markdown: string) => string;
+    readonly maxEntries?: number;
+};
+export declare function createPageBodyRenderer(deps?: PageBodyRendererDeps): (page: RenderablePageBody, log?: WarnLogger) => string;
+export declare const renderPageBody: (page: RenderablePageBody, log?: WarnLogger) => string;
 export {};

package/dist/managed-pages/render-page-body.js

@@ -2,18 +2,55 @@ import { createFallbackLogger } from "@cosmicdrift/kumiko-framework/logging";
 import { renderSafeMarkdown } from "../page-render/index.js";
 import { sanitizeDocumentHtml } from "../template-resolver/index.js";
 const defaultLog = createFallbackLogger("managed-pages");
-// A document body is re-sanitized at render time even though writes validate it:
-// rows can predate the validation or arrive through other writers. A rejected
-// document renders as an empty body (never the raw HTML) and is logged.
-export function renderPageBody(page, log = defaultLog) {
-    if (page.bodyFormat === "markdown")
-        return renderSafeMarkdown(page.body);
-    const result = sanitizeDocumentHtml(page.body);
-    if (result.ok)
-        return result.html;
-    log.warn("managed page document body rejected at render, serving an empty body", {
-        slug: page.slug,
-        violations: result.violations.map((violation) => violation.code),
-    });
-    return "";
+const MAX_CACHED_BODIES = 500;
+// Bounds the cache memory: 500 entries of arbitrary size could otherwise pin
+// hundreds of MB. A bigger body is still served, just re-rendered per request.
+const MAX_CACHED_BODY_LENGTH = 256 * 1024;
+// Every write bumps the version, so a (page, version) key never serves stale
+// HTML. A Map keeps insertion order: delete+reinsert on a hit makes the first
+// key the least recently used one.
+function cacheKeyOf(page) {
+    return [page.tenantId, page.slug, page.lang, page.version, page.updatedAt, page.bodyFormat].join("\u0000");
 }
+// Writes store the rebuilt, sanitized HTML, but rows can predate that validation
+// or arrive through other writers, so a render still sanitizes — once per page
+// version instead of once per request. A rejected document renders as an empty
+// body (never the raw HTML), is logged on the miss, and the empty result is cached.
+export function createPageBodyRenderer(deps = {}) {
+    const sanitizeDocument = deps.sanitizeDocument ?? sanitizeDocumentHtml;
+    const renderMarkdown = deps.renderMarkdown ?? renderSafeMarkdown;
+    const maxEntries = deps.maxEntries ?? MAX_CACHED_BODIES;
+    const cache = new Map();
+    function renderUncached(page, log) {
+        if (page.bodyFormat === "markdown")
+            return renderMarkdown(page.body);
+        const result = sanitizeDocument(page.body);
+        if (result.ok)
+            return result.html;
+        log.warn("managed page document body rejected at render, serving an empty body", {
+            slug: page.slug,
+            violations: result.violations.map((violation) => violation.code),
+        });
+        return "";
+    }
+    return (page, log = defaultLog) => {
+        const key = cacheKeyOf(page);
+        const cached = cache.get(key);
+        if (cached !== undefined) {
+            cache.delete(key);
+            cache.set(key, cached);
+            return cached;
+        }
+        const html = renderUncached(page, log);
+        if (html.length > MAX_CACHED_BODY_LENGTH)
+            return html;
+        cache.set(key, html);
+        if (cache.size > maxEntries) {
+            const oldest = cache.keys().next();
+            if (!oldest.done)
+                cache.delete(oldest.value);
+        }
+        return html;
+    };
+}
+export const renderPageBody = createPageBodyRenderer();

package/dist/managed-pages/screens/branding-screen.js

@@ -56,7 +56,7 @@ export function createBrandingSettingsScreen(opts) {
                 reason: "is_business_data",
             }),
             logoFile: createImageField({
-                accept: ["image/png", "image/jpeg", "image/webp"],
+                accept: ["png", "jpg", "jpeg", "webp"],
                 personal: false,
                 reason: "is_business_data",
             }),

package/dist/managed-pages/web/i18n.js

@@ -50,11 +50,10 @@ export const MANAGED_PAGES_I18N = {
     "managed-pages:body.lossy.warning": {
         en: "This page was written in Markdown. Converting it to the editor drops: {features}. Check the result before saving.",
     },
-    "managed-pages:body.lossy.image": { en: "images" },
+    "managed-pages:body.lossy.image": { en: "external images" },
     "managed-pages:body.lossy.blockquote": { en: "block quotes" },
     "managed-pages:body.lossy.code": { en: "code" },
     "managed-pages:body.lossy.deepHeading": { en: "headings below level 3" },
-    "managed-pages:body.lossy.relativeLink": { en: "relative links" },
     // Row-Actions + Confirm (pageListScreen)
     "managed-pages:actions.edit": { en: "Edit" },
     "managed-pages:actions.delete": { en: "Delete" },

package/dist/managed-pages/web/lossy-markdown.d.ts

@@ -1,3 +1,3 @@
-export declare const LOSSY_MARKDOWN_FEATURES: readonly ["image", "blockquote", "code", "deepHeading", "relativeLink"];
+export declare const LOSSY_MARKDOWN_FEATURES: readonly ["image", "blockquote", "code", "deepHeading"];
 export type LossyMarkdownFeature = (typeof LOSSY_MARKDOWN_FEATURES)[number];
 export declare function detectLossyMarkdown(markdown: string): readonly LossyMarkdownFeature[];

package/dist/managed-pages/web/lossy-markdown.js

@@ -1,15 +1,6 @@
-import { isAllowedDocumentLinkHref } from "@cosmicdrift/kumiko-bundled-features/template-resolver/document-schema";
 import { Lexer } from "marked";
-export const LOSSY_MARKDOWN_FEATURES = [
-    "image",
-    "blockquote",
-    "code",
-    "deepHeading",
-    "relativeLink",
-];
-// The document editor has no image, quote or code nodes, only three heading
-// levels, and links must pass the document link policy (absolute http(s),
-// mailto, tel, placeholders).
+export const LOSSY_MARKDOWN_FEATURES = ["image", "blockquote", "code", "deepHeading"];
+// The document editor has no image, quote or code nodes and only three heading levels.
 const MAX_DOCUMENT_HEADING_DEPTH = 3;
 function tokenList(value) {
     return Array.isArray(value) ? value : [];
@@ -23,9 +14,6 @@ function childTokens(token) {
 function isDeepHeading(token) {
     return ("depth" in token && typeof token.depth === "number" && token.depth > MAX_DOCUMENT_HEADING_DEPTH);
 }
-function isRelativeLink(token) {
-    return ("href" in token && typeof token.href === "string" && !isAllowedDocumentLinkHref(token.href));
-}
 function featuresOf(token) {
     switch (token.type) {
         case "image":
@@ -37,8 +25,6 @@ function featuresOf(token) {
             return ["code"];
         case "heading":
             return isDeepHeading(token) ? ["deepHeading"] : [];
-        case "link":
-            return isRelativeLink(token) ? ["relativeLink"] : [];
         default:
             return [];
     }

package/dist/managed-pages/web/markdown-to-document.js

@@ -2,8 +2,8 @@ import { isAllowedDocumentLinkHref } from "@cosmicdrift/kumiko-bundled-features/
 import { escapeHtml } from "@cosmicdrift/kumiko-renderer/headless";
 import { Marked } from "marked";
 // The server sanitizer rejects what it cannot keep, so the conversion drops it up front and the
-// lossy banner stays true: a link outside the document link policy keeps its text, an image
-// (no uploaded resource to point at) is dropped, and raw HTML is shown as text.
+// lossy banner stays true: a link outside the document link policy keeps its text, an external
+// image (no uploaded resource to point at) is dropped, and raw HTML is shown as text.
 const converter = new Marked({ gfm: false, breaks: false });
 converter.use({
     renderer: {

package/dist/managed-pages/web/page-body-section.js

@@ -10,7 +10,6 @@ const LOSSY_LABEL_KEYS = {
     blockquote: "managed-pages:body.lossy.blockquote",
     code: "managed-pages:body.lossy.code",
     deepHeading: "managed-pages:body.lossy.deepHeading",
-    relativeLink: "managed-pages:body.lossy.relativeLink",
 };
 const BODY_EDITOR_ID = "managed-pages-page-body";
 function stringValue(value) {

package/dist/readiness/handlers/run-list.query.js

@@ -18,7 +18,8 @@ export const runListQuery = defineQueryHandler({
             const { counts, outcome } = viewRun(run, query.user);
             return {
                 id: run.id,
-                requestedAt: run.requestedAt.toString(),
+                // Fixed width: pageRows sorts this as a string, and a trimmed fraction ("…20Z" vs "…20.001Z") sorts wrong.
+                requestedAt: run.requestedAt.toString({ fractionalSecondDigits: 6 }),
                 triggeredByUserId: run.triggeredByUserId,
                 triggeredByName: starterNames.get(run.triggeredByUserId) ?? run.triggeredByUserId,
                 status: run.status,

package/dist/readiness/run-view.d.ts

@@ -1,15 +1,13 @@
 import type { TenantDb } from "@cosmicdrift/kumiko-framework/db";
 import type { SessionUser } from "@cosmicdrift/kumiko-framework/engine";
+import type { Temporal } from "@cosmicdrift/kumiko-types/temporal";
 import { type ResultCounts, type RunOutcome, type VisibleProbeResult } from "./visible-results.ts";
-type InstantLike = {
-    readonly toString: () => string;
-};
 export type RunRow = {
     readonly id: string;
     readonly status: string;
-    readonly requestedAt: InstantLike;
-    readonly startedAt: InstantLike | null;
-    readonly finishedAt: InstantLike | null;
+    readonly requestedAt: Temporal.Instant;
+    readonly startedAt: Temporal.Instant | null;
+    readonly finishedAt: Temporal.Instant | null;
     readonly triggeredByUserId: string;
     readonly durationMs: number | null;
     readonly results: unknown;
@@ -22,4 +20,3 @@ export type RunView = {
 export declare const HISTORY_LIMIT = 100;
 export declare function fetchLatestRun(db: TenantDb): Promise<RunRow | undefined>;
 export declare function viewRun(run: RunRow, user: SessionUser): RunView;
-export {};

package/dist/template-resolver/compile-document-body.js

@@ -2,7 +2,7 @@ import { isOneOf } from "@cosmicdrift/kumiko-types/type-guards";
 import { isResourceImageContentType } from "../shared/index.js";
 import { rewriteStepsBlock } from "./compile-steps-block.js";
 import { conditionScopeElement, withParsedDocument } from "./document-sanitizer.js";
-import { DOCUMENT_CONDITION_ATTRIBUTE, DOCUMENT_TEXT_ALIGNMENTS, isAllowedDocumentLinkHref, isDocumentPlaceholderHref, isDocumentReferenceName, isDocumentResourceKey, } from "./web/document-schema.js";
+import { DOCUMENT_CONDITION_ATTRIBUTE, DOCUMENT_TEXT_ALIGNMENTS, isAllowedDocumentUrlHref, isDocumentPlaceholderHref, isDocumentReferenceName, isDocumentResourceKey, } from "./web/document-schema.js";
 // Private-use characters mark where a Handlebars expression goes. Author text
 // is scrubbed of them first and every `{`/`}` is entity-encoded before the
 // markers are swapped for real expressions, so the only Handlebars syntax in
@@ -120,7 +120,7 @@ function rewriteLink(element, state) {
             element.setAttribute("href", "#");
         }
     }
-    else if (!isAllowedDocumentLinkHref(href)) {
+    else if (!isAllowedDocumentUrlHref(href)) {
         element.setAttribute("href", "#");
     }
 }

package/dist/template-resolver/document-sanitizer.js

@@ -2,7 +2,7 @@ import { isOneOf } from "@cosmicdrift/kumiko-types/type-guards";
 import { generateHTML, generateJSON } from "@tiptap/html/server";
 import { Window } from "happy-dom";
 import { DOCUMENT_HTML_KINDS } from "./web/constants.js";
-import { DOCUMENT_CONDITION_ATTRIBUTE, documentExtensions, isAllowedDocumentLinkHref, isDocumentPlaceholderHref, isDocumentReferenceName, isDocumentResourceKey, } from "./web/document-schema.js";
+import { DOCUMENT_CONDITION_ATTRIBUTE, documentExtensions, isAllowedDocumentLinkHref, isAllowedDocumentUrlHref, isDocumentPlaceholderHref, isDocumentReferenceName, isDocumentResourceKey, } from "./web/document-schema.js";
 import { isDocumentStepKey } from "./web/document-steps.js";
 export function violation(code, detail, message) {
     return { code, detail, message };
@@ -38,7 +38,7 @@ function scanScriptAndHandlers(tag, element, out) {
 function scanAnchor(element, out) {
     const href = element.getAttribute("href");
     if (href !== null && !isAllowedDocumentLinkHref(href)) {
-        out.push(violation("disallowed_link_href", href, `Link target "${href}" is not allowed; use https, http, mailto, tel or a {{placeholder}}`));
+        out.push(violation("disallowed_link_href", href, `Link target "${href}" is not allowed; use https, http, mailto, tel, a relative path or a {{placeholder}}`));
     }
     if (element.hasAttribute("data-button") && !isDocumentPlaceholderHref(href ?? "")) {
         out.push(violation("button_href_not_placeholder", href ?? "", `Button target "${href ?? ""}" must be a {{placeholder}}`));
@@ -96,7 +96,7 @@ function scanUrlAttributes(tag, element, out) {
         if (SVG_IMAGE_TAGS.has(tag) && name.endsWith("href")) {
             out.push(violation("external_image_source", value, `Images must reference an uploaded resource via data-resource; image source "${value}" is not allowed`));
         }
-        else if (tag === "base" || !isAllowedDocumentLinkHref(value)) {
+        else if (tag === "base" || !isAllowedDocumentUrlHref(value)) {
             out.push(violation("disallowed_link_href", value, `Link target "${value}" is not allowed; use https, http, mailto, tel or a {{placeholder}}`));
         }
     }

package/dist/template-resolver/index.d.ts

@@ -24,5 +24,5 @@ export { collectTemplateUsage, type TemplateUsageEntry } from "./template-usage.
 export { hasPlaceholderProblems, resolveTemplateVariables, SYSTEM_PLACEHOLDERS, systemPlaceholdersFor, type TemplateValidation, validateTemplatePlaceholders, } from "./template-validation.ts";
 export { type UserContentEntryRow, userContentEntriesTable, userContentEntryEntity, } from "./user-content-table.ts";
 export { CONTENT_FORMATS, type ContentFormat, DEFAULT_MAIL_LAYOUT_SLUG, DEFAULT_PDF_LAYOUT_SLUG, DOCUMENT_HTML_KINDS, type DocumentHtmlKind, FALLBACK_LOCALE, NON_RENDER_KINDS, type NonRenderKind, PDF_DEFAULT_MARGIN_MM, PDF_FOOTER_MARGIN_MM, PDF_HEADER_MARGIN_MM, PDF_ORIENTATIONS, PDF_PAGE_FORMATS, type PdfOrientation, type PdfPageFormat, RENDER_KINDS, type RenderKind, SYSTEM_TENANT_ID, TEMPLATE_KINDS, TEMPLATE_SCOPES, TEMPLATE_STATUSES, TEXT_BLOCK_KIND, type TemplateKind, type TemplateScope, type TemplateStatus, UPSERT_KINDS, type UpsertKind, } from "./web/constants.ts";
-export { DOCUMENT_CONDITION_ATTRIBUTE, DOCUMENT_NODE_NAMES, DOCUMENT_TEXT_ALIGNMENTS, DocumentButton, DocumentCondition, DocumentDivider, DocumentLink, DocumentPageBreak, DocumentResource, DocumentTable, DocumentTableCell, DocumentTableHeader, DocumentTableRow, DocumentTextAlign, type DocumentTextAlignment, DocumentVariable, documentExtensions, isAllowedDocumentLinkHref, isDocumentPlaceholderHref, isDocumentReferenceName, isDocumentResourceKey, } from "./web/document-schema.ts";
+export { DOCUMENT_CONDITION_ATTRIBUTE, DOCUMENT_NODE_NAMES, DOCUMENT_TEXT_ALIGNMENTS, DocumentButton, DocumentCondition, DocumentDivider, DocumentLink, DocumentPageBreak, DocumentResource, DocumentTable, DocumentTableCell, DocumentTableHeader, DocumentTableRow, DocumentTextAlign, type DocumentTextAlignment, DocumentVariable, documentExtensions, isAllowedDocumentLinkHref, isAllowedDocumentUrlHref, isDocumentPlaceholderHref, isDocumentReferenceName, isDocumentResourceKey, } from "./web/document-schema.ts";
 export { TEMPLATE_RESOLVER_FEATURE, TemplateResolverErrors, TemplateResolverHandlers, TemplateResolverQueries, } from "./web/qualified-names.ts";

package/dist/template-resolver/index.js

@@ -21,5 +21,5 @@ export { collectTemplateUsage } from "./template-usage.js";
 export { hasPlaceholderProblems, resolveTemplateVariables, SYSTEM_PLACEHOLDERS, systemPlaceholdersFor, validateTemplatePlaceholders, } from "./template-validation.js";
 export { userContentEntriesTable, userContentEntryEntity, } from "./user-content-table.js";
 export { CONTENT_FORMATS, DEFAULT_MAIL_LAYOUT_SLUG, DEFAULT_PDF_LAYOUT_SLUG, DOCUMENT_HTML_KINDS, FALLBACK_LOCALE, NON_RENDER_KINDS, PDF_DEFAULT_MARGIN_MM, PDF_FOOTER_MARGIN_MM, PDF_HEADER_MARGIN_MM, PDF_ORIENTATIONS, PDF_PAGE_FORMATS, RENDER_KINDS, SYSTEM_TENANT_ID, TEMPLATE_KINDS, TEMPLATE_SCOPES, TEMPLATE_STATUSES, TEXT_BLOCK_KIND, UPSERT_KINDS, } from "./web/constants.js";
-export { DOCUMENT_CONDITION_ATTRIBUTE, DOCUMENT_NODE_NAMES, DOCUMENT_TEXT_ALIGNMENTS, DocumentButton, DocumentCondition, DocumentDivider, DocumentLink, DocumentPageBreak, DocumentResource, DocumentTable, DocumentTableCell, DocumentTableHeader, DocumentTableRow, DocumentTextAlign, DocumentVariable, documentExtensions, isAllowedDocumentLinkHref, isDocumentPlaceholderHref, isDocumentReferenceName, isDocumentResourceKey, } from "./web/document-schema.js";
+export { DOCUMENT_CONDITION_ATTRIBUTE, DOCUMENT_NODE_NAMES, DOCUMENT_TEXT_ALIGNMENTS, DocumentButton, DocumentCondition, DocumentDivider, DocumentLink, DocumentPageBreak, DocumentResource, DocumentTable, DocumentTableCell, DocumentTableHeader, DocumentTableRow, DocumentTextAlign, DocumentVariable, documentExtensions, isAllowedDocumentLinkHref, isAllowedDocumentUrlHref, isDocumentPlaceholderHref, isDocumentReferenceName, isDocumentResourceKey, } from "./web/document-schema.js";
 export { TEMPLATE_RESOLVER_FEATURE, TemplateResolverErrors, TemplateResolverHandlers, TemplateResolverQueries, } from "./web/qualified-names.js";

package/dist/template-resolver/web/document-schema.d.ts

@@ -2,6 +2,7 @@ import { Extension, type Extensions, Node } from "@tiptap/core";
 import { isDocumentReferenceName } from "./document-reference-name.ts";
 export { isDocumentReferenceName };
 export declare function isDocumentPlaceholderHref(href: string): boolean;
+export declare function isAllowedDocumentUrlHref(href: string): boolean;
 export declare function isAllowedDocumentLinkHref(href: string): boolean;
 export declare function isDocumentResourceKey(value: string): boolean;
 export declare const DOCUMENT_NODE_NAMES: readonly ["variable", "resource", "button", "divider", "pageBreak", "steps", "images"];

package/dist/template-resolver/web/document-schema.js

@@ -40,15 +40,30 @@ function hasAllowedLinkScheme(href) {
         return isParsableWebUrl(href, "http:");
     return ALLOWED_LINK_SCHEMES.some((scheme) => href.startsWith(scheme));
 }
+// Relative references are matched by their literal leading character so a
+// scheme can never hide in them: a value starting with a letter ("x:y",
+// "javascript:") is not relative. Protocol-relative "//host" and any backslash
+// (browsers read "/\\host" as "//host") would leave the site.
+const RELATIVE_HREF_PREFIXES = ["/", "./", "../", "#", "?"];
+function isRelativeHref(href) {
+    if (href.includes("\\") || href.startsWith("//"))
+        return false;
+    return RELATIVE_HREF_PREFIXES.some((prefix) => href.startsWith(prefix));
+}
 // Exact lowercase prefix on the unchanged value: no trim, no case folding, so
 // "JaVaScRiPt:", "HTTPS://" or a leading tab can never slip through as a
 // scheme variant. Markup and control characters are refused outright because
 // downstream parsers (MJML, PDF renderer) re-read the serialized attribute.
-export function isAllowedDocumentLinkHref(href) {
+export function isAllowedDocumentUrlHref(href) {
     if (hasUnsafeUrlCharacter(href))
         return false;
     return hasAllowedLinkScheme(href) || isDocumentPlaceholderHref(href);
 }
+// Anchors only: other URL attributes (form action, svg href) resolve against the
+// page and must stay on explicit schemes or placeholders.
+export function isAllowedDocumentLinkHref(href) {
+    return isAllowedDocumentUrlHref(href) || (!hasUnsafeUrlCharacter(href) && isRelativeHref(href));
+}
 export function isDocumentResourceKey(value) {
     return RESOURCE_KEY.test(value);
 }

package/dist/template-resolver/web/i18n.js

@@ -18,7 +18,7 @@ export const defaultTranslations = {
         "template-resolver.documentEditor.insert": "Insert",
         "template-resolver.documentEditor.insertPlaceholder": "Placeholder",
         "template-resolver.documentEditor.invalidImageAlt": "The alt text must not contain < or >.",
-        "template-resolver.documentEditor.invalidLink": "This link target is not allowed. Use https, http, mailto, tel or a placeholder.",
+        "template-resolver.documentEditor.invalidLink": "This link target is not allowed. Use https, http, mailto, tel, a relative path or a placeholder.",
         "template-resolver.documentEditor.invalidResourceKey": "This resource key is not valid.",
         "template-resolver.documentEditor.link": "Link",
         "template-resolver.documentEditor.linkHref": "Link target",
@@ -55,7 +55,7 @@ export const defaultTranslations = {
         "template-resolver.editor.saved": "Saved.",
         "templateResolver.errors.document.imagesBlockPdfOnly": "Photo blocks are only allowed in PDF documents.",
         "templateResolver.errors.document.buttonHrefNotPlaceholder": "The button target “{detail}” must be a placeholder.",
-        "templateResolver.errors.document.disallowedLinkHref": "Link target “{detail}” is not allowed; use https, http, mailto, tel or a placeholder.",
+        "templateResolver.errors.document.disallowedLinkHref": "Link target “{detail}” is not allowed; use https, http, mailto, tel, a relative path or a placeholder.",
         "templateResolver.errors.document.documentRequiresHtmlFormat": "This template kind requires the html format, got “{detail}”.",
         "templateResolver.errors.document.layoutRequiresMjmlFormat": "Mail layouts require the mjml format, got “{detail}”.",
         "templateResolver.errors.document.layoutInvalidStructure": "The layout may only contain the header, content, signature and footer regions: {detail}.",

package/dist/template-resolver/web/use-collection-entry-create.js

@@ -26,9 +26,10 @@ export function useCollectionEntryCreate(target, tenantId) {
     const [content, setContent] = useState("");
     const slugValid = slug.length <= SLUG_MAX_LENGTH && SLUG_PATTERN.test(slug);
     const disabled = submitting || !canWrite || collectionId === undefined;
-    const headerTitle = t("template-resolver.editor.newEntryTitle", {
-        label: collection !== undefined ? t(collection.nav.label) : "",
-    });
+    const entryLabel = collection?.nav.entryLabel;
+    const headerTitle = entryLabel !== undefined
+        ? t("template-resolver.editor.newEntryTitle", { label: t(entryLabel) })
+        : t("template-resolver.editor.newEntry");
     const create = async () => {
         // skip: nothing to write to, or the slug is invalid (the field already shows the issue)
         if (collectionId === undefined || !slugValid)