@cosmicdrift/kumiko-samples 0.362.0 → 0.364.0

package/packages/bundled-features/src/template-resolver/handlers/upsert-tenant.write.ts

@@ -1,15 +1,8 @@
-import { fetchOne } from "@cosmicdrift/kumiko-framework/bun-db";
-import {
-  defineWriteHandler,
-  SYSTEM_TENANT_ID,
-  type TenantId,
-} from "@cosmicdrift/kumiko-framework/engine";
-import { AccessDeniedError, writeFailure } from "@cosmicdrift/kumiko-framework/errors";
+import { defineWriteHandler, type TenantId } from "@cosmicdrift/kumiko-framework/engine";
 import * as z from "zod";
-import { requireForTenant } from "../../shared/index.js";
-import type { TemplateResourceRow } from "../table.js";
-import { templateResourcesTable } from "../table.js";
-import { executor, upsertPayloadSchema } from "./shared.js";
+import { resolveTemplateVariables } from "../template-validation.js";
+import { upsertPayloadSchema } from "./shared.js";
+import { writeTemplateRow } from "./template-write.js";
 
 // Tenant-Override anlegen/updaten. Liegt unter event.user.tenantId,
 // scope='tenant'. Default-Status='draft' — User publisht explizit
@@ -24,78 +17,24 @@ export const upsertTenantWrite = defineWriteHandler({
   }),
   access: { roles: ["TenantAdmin", "SystemAdmin"] },
   description:
-    "Creates or overwrites a tenant-scoped template override with its variable schema, landing as a draft that only publish makes live; it refuses a system-tenant target, which is what upsert-system is for.",
+    "Creates or overwrites a tenant-scoped template override with its variable schema, landing as a draft that only publish makes live (over an active override the draft is stored beside it, the active version keeps being served until publish); it refuses a system-tenant target, which is what upsert-system is for.",
   handler: async (event, ctx) => {
-    const override = event.payload.tenantIdOverride;
-    // upsertTenant erzeugt scope='tenant'. SYSTEM_TENANT_ID-Override würde
-    // scope='tenant' unter SYSTEM_TENANT_ID schreiben → inkonsistenter Zustand
-    // (Resolver-Logik trennt sauber zwischen system+tenant). SystemAdmin muss
-    // upsertSystem für System-Defaults nutzen.
-    if (override === SYSTEM_TENANT_ID) {
-      return writeFailure(
-        new AccessDeniedError({
-          i18nKey: "templateResolver.errors.useUpsertSystemForSystemTenant",
-          details: { reason: "system_tenant_override_not_allowed_use_upsert_system" },
-        }),
-      );
-    }
     // @cast-boundary engine-payload — override aus Zod-parsed string,
     // event.user.tenantId schon TenantId-branded; union als TenantId casten
     // ist legit (override ist UUID-Format-validiert in schema).
-    const tenantId = (override ?? event.user.tenantId) as TenantId;
-    const { db, streamTenantId } = requireForTenant(ctx, tenantId);
-
-    const existing = await fetchOne<TemplateResourceRow>(db, templateResourcesTable, {
+    const tenantId = (event.payload.tenantIdOverride ?? event.user.tenantId) as TenantId;
+    return writeTemplateRow({
+      ctx,
+      user: event.user,
       tenantId,
-      slug: event.payload.slug,
-      kind: event.payload.kind,
-      locale: event.payload.locale,
-    });
-
-    const fields = {
-      slug: event.payload.slug,
-      kind: event.payload.kind,
-      locale: event.payload.locale,
-      content: event.payload.content,
-      contentFormat: event.payload.contentFormat,
-      variableSchema: JSON.stringify(event.payload.variableSchema),
-      linkedResources: JSON.stringify(event.payload.linkedResources),
-      title: event.payload.title ?? null,
-      folder: event.payload.folder ?? null,
-      scope: "tenant" as const,
-      parentTemplateId: event.payload.parentTemplateId ?? null,
+      scope: "tenant",
       status: event.payload.status,
-    };
-
-    if (existing) {
-      const result = await executor.update(
-        { id: existing.id, version: existing.version, changes: fields },
-        event.user,
-        db,
-        { streamTenantId },
-      );
-      if (!result.isSuccess) return result;
-      return {
-        isSuccess: true as const,
-        data: { id: String(existing.id), slug: event.payload.slug, isNew: false },
-      };
-    }
-
-    const result = await executor.create({ ...fields, tenantId }, event.user, db, {
-      streamTenantId,
+      variables: resolveTemplateVariables(
+        ctx.registry,
+        event.payload.slug,
+        event.payload.variableSchema,
+      ),
+      payload: event.payload,
     });
-    if (!result.isSuccess) return result;
-    // @cast-boundary db-row — executor.create returnt Record-row aus
-    // INSERT RETURNING; shape { id } ist garantiert weil PK in der
-    // Returning-Klausel ist.
-    const createdRow = result.data as { id: string | number };
-    return {
-      isSuccess: true as const,
-      data: {
-        id: String(createdRow.id),
-        slug: event.payload.slug,
-        isNew: true,
-      },
-    };
   },
 });

package/packages/bundled-features/src/template-resolver/handlers/usage.query.ts

@@ -0,0 +1,31 @@
+import { selectMany } from "@cosmicdrift/kumiko-framework/bun-db";
+import { defineQueryHandler } from "@cosmicdrift/kumiko-framework/engine";
+import * as z from "zod";
+import { TEMPLATE_KINDS } from "../constants.js";
+import { type TemplateResourceRow, templateResourcesTable } from "../table.js";
+import { templateSlugSchema } from "../template-meta.js";
+import { collectTemplateUsage } from "../template-usage.js";
+import { effectiveMailLayoutSlugs } from "./overview.query.js";
+
+const MAIL_ROW_LIMIT = 5000;
+
+export const usageQuery = defineQueryHandler({
+  name: "usage",
+  schema: z.object({ slug: templateSlugSchema, kind: z.enum(TEMPLATE_KINDS) }),
+  access: { roles: ["TenantAdmin", "SystemAdmin"] },
+  description:
+    "Lists the code-registered notifications that use one template: a mail template is used by the notification whose qualified name is its slug and that has a code template, a mail layout by every mail notification whose effective template (own override, else system) names it, or whose code meta does when no stored template exists, or that falls back to the default layout; use it to show what a change to a template affects.",
+  handler: async (query, ctx) => {
+    const { slug, kind } = query.payload;
+    if (kind !== "mail-layout") return { usedBy: collectTemplateUsage(ctx.registry, slug, kind) };
+    const mailRows = await selectMany<TemplateResourceRow>(
+      ctx.db,
+      templateResourcesTable,
+      { kind: "mail" },
+      { limit: MAIL_ROW_LIMIT },
+    );
+    return {
+      usedBy: collectTemplateUsage(ctx.registry, slug, kind, effectiveMailLayoutSlugs(mailRows)),
+    };
+  },
+});

package/packages/bundled-features/src/template-resolver/handlers/validate.query.ts

@@ -0,0 +1,116 @@
+import { selectMany } from "@cosmicdrift/kumiko-framework/bun-db";
+import {
+  defineQueryHandler,
+  type HandlerContext,
+  type SessionUser,
+  SYSTEM_TENANT_ID,
+} from "@cosmicdrift/kumiko-framework/engine";
+import * as z from "zod";
+import type { ContentFormat, UpsertKind } from "../constants.js";
+import type { TemplateWriteScope } from "../layout-regions.js";
+import { imageResourceKeysOf } from "../linked-resources.js";
+import { type TemplateResourceRow, templateResourcesTable } from "../table.js";
+import { resolveTemplateVariables, systemPlaceholdersFor } from "../template-validation.js";
+import { contentFormatSchema, kindSchema, localeSchema, templateSlugSchema } from "./shared.js";
+import { evaluateTemplateWrite } from "./template-gates.js";
+
+async function knownResourceKeys(
+  db: Parameters<typeof selectMany>[0],
+  where: {
+    readonly tenantId: string;
+    readonly slug: string;
+    readonly kind: string;
+    readonly scope: "tenant" | "system";
+    readonly locale: string | undefined;
+  },
+): Promise<string[]> {
+  const rows = await selectMany<TemplateResourceRow>(db, templateResourcesTable, {
+    tenantId: where.tenantId,
+    slug: where.slug,
+    kind: where.kind,
+    scope: where.scope,
+    ...(where.locale === undefined ? {} : { locale: where.locale }),
+    ...(where.scope === "system" ? { status: "active" } : {}),
+  });
+  return rows.flatMap((row) => imageResourceKeysOf(row.linkedResources));
+}
+
+type TemplateDraftInput = {
+  readonly slug: string;
+  readonly kind: UpsertKind;
+  readonly contentFormat: ContentFormat;
+  readonly content: string;
+  readonly meta?: unknown;
+  readonly variableSchema: Readonly<Record<string, unknown>>;
+  readonly locale?: string | undefined;
+  readonly scope: TemplateWriteScope;
+};
+
+// The dry run of the write pipeline; preview feeds on the evaluation, validate returns the response.
+export async function validateTemplateDraft(
+  ctx: HandlerContext,
+  user: SessionUser,
+  payload: TemplateDraftInput,
+) {
+  const variables = resolveTemplateVariables(ctx.registry, payload.slug, payload.variableSchema);
+  const { slug, kind, scope, locale } = payload;
+  const known = [
+    ...(await knownResourceKeys(ctx.db, {
+      tenantId: SYSTEM_TENANT_ID,
+      slug,
+      kind,
+      scope: "system",
+      locale,
+    })),
+    ...(scope === "tenant"
+      ? await knownResourceKeys(ctx.db, { tenantId: user.tenantId, slug, kind, scope, locale })
+      : []),
+  ];
+  const evaluation = evaluateTemplateWrite({
+    kind,
+    scope,
+    contentFormat: payload.contentFormat,
+    content: payload.content,
+    rawMeta: payload.meta,
+    variables,
+    resourceKeys: known,
+  });
+  const validation = evaluation.validation;
+  const response = {
+    canSave: evaluation.ok,
+    canPublish: evaluation.ok && evaluation.publishIssues.length === 0,
+    issues: evaluation.ok ? [] : [...evaluation.issues],
+    publishIssues: evaluation.ok ? [...evaluation.publishIssues] : [],
+    used: [...(validation?.used ?? [])],
+    unknown: [...(validation?.unknown ?? [])],
+    missingRequired: [...(validation?.missingRequired ?? [])],
+    warnings: (validation?.unknownResources ?? []).map((key) => ({
+      code: "resource_not_uploaded" as const,
+      detail: key,
+      i18nKey: "templateResolver.warnings.resourceNotUploaded" as const,
+    })),
+    variables,
+    systemPlaceholders: [...systemPlaceholdersFor(kind)].sort(),
+  };
+  return { response, evaluation };
+}
+
+export const validateQuery = defineQueryHandler({
+  name: "validate",
+  schema: z.object({
+    slug: templateSlugSchema,
+    kind: kindSchema,
+    contentFormat: contentFormatSchema,
+    content: z.string().max(200_000),
+    meta: z.unknown().optional(),
+    variableSchema: z.record(z.string(), z.unknown()).default({}),
+    /** Narrows the known resource keys to one locale's rows. */
+    locale: localeSchema.optional(),
+    scope: z.enum(["tenant", "system"]).default("tenant"),
+  }),
+  access: { roles: ["TenantAdmin", "SystemAdmin"] },
+  description:
+    "Dry-runs the write pipeline for a template draft without saving: reports whether it can be saved or published, the sanitizer and placeholder problems, which placeholders it uses, which are unknown, which required variables are missing, and the variables and system placeholders available for the kind; use it to give an editor live feedback.",
+  handler: async (query, ctx) =>
+    (await validateTemplateDraft(ctx, query.user, query.payload)).response,
+});

package/packages/bundled-features/src/template-resolver/index.ts

@@ -6,12 +6,28 @@ export {
   type TemplateResolverApi,
   type TemplateResource,
 } from "./api.js";
+export {
+  type CompileDocumentBodyOptions,
+  collectDocumentResourceKeys,
+  compileDocumentBodyToHandlebars,
+  toResourceDataUri,
+} from "./compile-document-body.js";
 export {
   CONTENT_FORMATS,
   type ContentFormat,
+  DEFAULT_MAIL_LAYOUT_SLUG,
+  DOCUMENT_HTML_KINDS,
+  type DocumentHtmlKind,
   FALLBACK_LOCALE,
   NON_RENDER_KINDS,
   type NonRenderKind,
+  PDF_DEFAULT_MARGIN_MM,
+  PDF_FOOTER_MARGIN_MM,
+  PDF_HEADER_MARGIN_MM,
+  PDF_ORIENTATIONS,
+  PDF_PAGE_FORMATS,
+  type PdfOrientation,
+  type PdfPageFormat,
   RENDER_KINDS,
   type RenderKind,
   SYSTEM_TENANT_ID,
@@ -25,18 +41,113 @@ export {
   UPSERT_KINDS,
   type UpsertKind,
 } from "./constants.js";
+export {
+  type DocumentViolation,
+  type DocumentViolationCode,
+  documentViolationsToFieldIssues,
+  type SanitizeBodyResult,
+  type SanitizeHtmlResult,
+  sanitizeDocumentHtml,
+  sanitizeTemplateBody,
+} from "./document-sanitizer.js";
+export {
+  DOCUMENT_NODE_NAMES,
+  DOCUMENT_TEXT_ALIGNMENTS,
+  DocumentButton,
+  DocumentDivider,
+  DocumentLink,
+  DocumentPageBreak,
+  DocumentResource,
+  DocumentTable,
+  DocumentTableCell,
+  DocumentTableHeader,
+  DocumentTableRow,
+  DocumentTextAlign,
+  type DocumentTextAlignment,
+  DocumentVariable,
+  documentExtensions,
+  isAllowedDocumentLinkHref,
+  isDocumentPlaceholderHref,
+  isDocumentReferenceName,
+  isDocumentResourceKey,
+} from "./document-schema.js";
 export { createTemplateResolverFeature } from "./feature.js";
+export type { LayoutSourceResponse, LayoutSourceRow } from "./handlers/layout-source.query.js";
+export type {
+  OverviewKindGroup,
+  OverviewOrigin,
+  OverviewResponse,
+  OverviewRow,
+  OverviewUsage,
+} from "./handlers/overview.query.js";
+export { localeSchema } from "./handlers/shared.js";
+export {
+  isHexColor,
+  type MailLayoutAppearance,
+  mailLayoutAppearance,
+} from "./layout-appearance.js";
+export {
+  type LayoutRegions,
+  readLayoutRegions,
+  type SanitizeLayoutResult,
+  sanitizeLayoutHtml,
+} from "./layout-regions.js";
+export {
+  fileAttachmentsOf,
+  imageLinksOf,
+  type LinkedResourceEntry,
+  parseLinkedResourceEntries,
+  pdfAttachmentLinksOf,
+  type TemplatePdfAttachmentLink,
+  templatePdfAttachmentLinkSchema,
+} from "./linked-resources.js";
+export { prepareDocumentForPrint } from "./print-document.js";
 export {
   TEMPLATE_RESOLVER_FEATURE,
   TemplateResolverErrors,
   TemplateResolverHandlers,
   TemplateResolverQueries,
 } from "./qualified-names.js";
+export { mapRecordToVariables } from "./record-mapping.js";
+export {
+  readTemplateResourceMaxBytes,
+  type StoredTemplateResource,
+  storeTemplateResource,
+} from "./store-template-resource.js";
 export {
   type TemplateResourceRow,
   templateResourceEntity,
   templateResourcesTable,
 } from "./table.js";
+export { type TemplateBundle, templateBundleSchema } from "./template-bundle.js";
+export {
+  isMailTemplateMeta,
+  type LayoutTemplateMeta,
+  MAIL_CATEGORIES,
+  type MailCategory,
+  type MailLayoutMeta,
+  type MailTemplateMeta,
+  type PdfTemplateMeta,
+  parseTemplateMeta,
+  pdfAttachmentFileNamePatternSchema,
+  readMailLayoutMeta,
+  readPdfTemplateMeta,
+  type TemplateMeta,
+  type TemplateMetaIssue,
+  type TemplateMetaResult,
+  templateSlugSchema,
+} from "./template-meta.js";
+export { type DocumentDraftOutcome, evaluateDocumentDraft } from "./template-preview.js";
+export { readTemplateResource, type TemplateResourceFile } from "./template-resources.js";
+export { collectTemplateUsage, type TemplateUsageEntry } from "./template-usage.js";
+export {
+  hasPlaceholderProblems,
+  resolveTemplateVariables,
+  SYSTEM_PLACEHOLDERS,
+  systemPlaceholdersFor,
+  type TemplateValidation,
+  validateTemplatePlaceholders,
+} from "./template-validation.js";
 export {
   type UserContentEntryRow,
   userContentEntriesTable,

package/packages/bundled-features/src/template-resolver/layout-appearance.ts

@@ -0,0 +1,40 @@
+import { HEX_COLOR_PATTERN } from "./constants.js";
+import { type MailLayoutMeta, readMailLayoutMeta } from "./template-meta.js";
+
+// Every value is a member of a closed set, so it can be written into MJML and inline styles as is.
+export type MailLayoutAppearance = {
+  readonly width: number;
+  readonly fontFamily: string;
+  readonly outerBackground: string;
+  readonly accentLine: boolean;
+  readonly buttonStyle: string;
+};
+
+const FONT_FAMILIES = {
+  sans: "Arial, Helvetica, sans-serif",
+  serif: "Georgia, 'Times New Roman', serif",
+} as const;
+
+const BUTTON_COLOR = "#1f5468";
+const BUTTON_BASE = "display:inline-block;padding:10px 20px;font-weight:600;text-decoration:none";
+
+const BUTTON_STYLES = {
+  "filled-rounded": `${BUTTON_BASE};border-radius:6px;background-color:${BUTTON_COLOR};color:#ffffff`,
+  "filled-square": `${BUTTON_BASE};background-color:${BUTTON_COLOR};color:#ffffff`,
+  outline: `${BUTTON_BASE};border:2px solid ${BUTTON_COLOR};border-radius:6px;color:${BUTTON_COLOR}`,
+} as const;
+
+export function isHexColor(value: string): boolean {
+  return HEX_COLOR_PATTERN.test(value);
+}
+
+export function mailLayoutAppearance(meta: MailLayoutMeta | unknown): MailLayoutAppearance {
+  const parsed = readMailLayoutMeta(meta);
+  return {
+    width: parsed.width ?? 600,
+    fontFamily: FONT_FAMILIES[parsed.font ?? "sans"],
+    outerBackground: parsed.outerBackground ?? "#f5f5f5",
+    accentLine: (parsed.accentLine ?? "none") === "branding",
+    buttonStyle: BUTTON_STYLES[parsed.buttonStyle ?? "filled-rounded"],
+  };
+}

package/packages/bundled-features/src/template-resolver/layout-regions.ts

@@ -0,0 +1,206 @@
+// Server-only (happy-dom). A structured layout is the editable frame around a
+// mail or PDF body: header, signature and footer regions plus one empty
+// content slot. Everything else is rejected so a layout can never carry markup
+// the renderer did not plan for.
+
+import type { Element as ScanElement } from "happy-dom";
+import type { ContentFormat } from "./constants.js";
+import {
+  type DocumentViolation,
+  type SanitizeBodyResult,
+  sanitizeDocumentHtml,
+  sanitizeTemplateBody,
+  violation,
+  withParsedDocument,
+} from "./document-sanitizer.js";
+
+const REGION_ATTRIBUTES = ["data-header", "data-content", "data-signature", "data-footer"] as const;
+type RegionAttribute = (typeof REGION_ATTRIBUTES)[number];
+
+const MAIL_LAYOUT_CONTENT_SLOT = /\{\{\{\s*content\s*\}\}\}/g;
+
+export type LayoutRegions = {
+  readonly header: string;
+  readonly signature: string;
+  readonly footer: string;
+};
+
+export type SanitizeLayoutResult =
+  | { readonly ok: true; readonly html: string }
+  | { readonly ok: false; readonly violations: readonly DocumentViolation[] };
+
+type ParsedRegions = {
+  readonly innerHtml: Partial<Record<RegionAttribute, string>>;
+  readonly contentIsEmpty: boolean;
+  readonly violations: DocumentViolation[];
+};
+
+const ELEMENT_NODE = 1;
+const TEXT_NODE = 3;
+
+function regionAttributeOf(element: ScanElement): RegionAttribute | null {
+  if (element.tagName.toLowerCase() !== "div") return null;
+  const present = REGION_ATTRIBUTES.filter((name) => element.hasAttribute(name));
+  return present.length === 1 ? (present[0] ?? null) : null;
+}
+
+function parseRegions(html: string): ParsedRegions {
+  return withParsedDocument(html, (body) => {
+    const innerHtml: Partial<Record<RegionAttribute, string>> = {};
+    const violations: DocumentViolation[] = [];
+    let contentIsEmpty = true;
+    const invalid = (detail: string, message: string) =>
+      violations.push(violation("layout_invalid_structure", detail, message));
+    for (const node of Array.from(body.childNodes)) {
+      if (node.nodeType === ELEMENT_NODE) continue;
+      if (node.nodeType !== TEXT_NODE || (node.textContent ?? "").trim() !== "") {
+        invalid("text", "Text and comments outside the layout regions are not allowed");
+      }
+    }
+    for (const element of Array.from(body.children)) {
+      const region = regionAttributeOf(element);
+      if (region === null) {
+        invalid(
+          element.tagName.toLowerCase(),
+          "Only <div data-header>, <div data-content>, <div data-signature> and <div data-footer> are allowed at the top level",
+        );
+        continue;
+      }
+      if (innerHtml[region] !== undefined) {
+        invalid(region, `Layout region ${region} may appear only once`);
+        continue;
+      }
+      innerHtml[region] = element.innerHTML;
+      if (region === "data-content") {
+        contentIsEmpty = element.children.length === 0 && (element.textContent ?? "").trim() === "";
+      }
+    }
+    return { innerHtml, contentIsEmpty, violations };
+  });
+}
+
+export function sanitizeLayoutHtml(html: string): SanitizeLayoutResult {
+  const parsed = parseRegions(html);
+  const violations = [...parsed.violations];
+  if (parsed.innerHtml["data-content"] === undefined) {
+    violations.push(
+      violation(
+        "layout_missing_content_slot",
+        "data-content",
+        "A layout needs exactly one empty <div data-content></div> where the body is placed",
+      ),
+    );
+  } else if (!parsed.contentIsEmpty) {
+    violations.push(
+      violation(
+        "layout_invalid_structure",
+        "data-content",
+        "The data-content region must be empty",
+      ),
+    );
+  }
+  const cleanedHtml: Partial<Record<RegionAttribute, string>> = {};
+  for (const name of ["data-header", "data-signature", "data-footer"] as const) {
+    const inner = parsed.innerHtml[name];
+    if (inner === undefined || inner.trim() === "") continue;
+    const result = sanitizeDocumentHtml(inner);
+    if (result.ok) cleanedHtml[name] = result.html;
+    else violations.push(...result.violations);
+  }
+  if (violations.length > 0) return { ok: false, violations };
+  const part = (name: RegionAttribute) => {
+    const regionHtml = cleanedHtml[name];
+    return regionHtml === undefined ? "" : `<div ${name}>${regionHtml}</div>`;
+  };
+  return {
+    ok: true,
+    html: [
+      part("data-header"),
+      "<div data-content></div>",
+      part("data-signature"),
+      part("data-footer"),
+    ].join(""),
+  };
+}
+
+export function readLayoutRegions(html: string): LayoutRegions {
+  const { innerHtml } = parseRegions(html);
+  return {
+    header: innerHtml["data-header"] ?? "",
+    signature: innerHtml["data-signature"] ?? "",
+    footer: innerHtml["data-footer"] ?? "",
+  };
+}
+
+export type TemplateWriteScope = "system" | "tenant";
+
+function rejected(violationItem: DocumentViolation): SanitizeBodyResult {
+  return { ok: false, violations: [violationItem] };
+}
+
+function sanitizeMailLayout(
+  scope: TemplateWriteScope,
+  contentFormat: ContentFormat,
+  content: string,
+): SanitizeBodyResult {
+  if (contentFormat === "html") return fromLayoutResult(sanitizeLayoutHtml(content));
+  if (contentFormat !== "mjml") {
+    return rejected(
+      violation(
+        "layout_requires_mjml_format",
+        contentFormat,
+        `Templates of kind mail-layout require contentFormat mjml or html, got "${contentFormat}"`,
+      ),
+    );
+  }
+  if (scope !== "system") {
+    return rejected(
+      violation(
+        "layout_source_system_only",
+        "mjml",
+        "Only system layouts may use mjml source; tenant layouts use the structured html format",
+      ),
+    );
+  }
+  if ((content.match(MAIL_LAYOUT_CONTENT_SLOT) ?? []).length !== 1) {
+    return rejected(
+      violation(
+        "layout_missing_content_slot",
+        "{{{content}}}",
+        "A mjml layout must contain {{{content}}} exactly once",
+      ),
+    );
+  }
+  return { ok: true, content };
+}
+
+function fromLayoutResult(result: SanitizeLayoutResult): SanitizeBodyResult {
+  return result.ok ? { ok: true, content: result.html } : result;
+}
+
+// One entry for every write path: layout kinds follow the scope-dependent
+// layout rules, everything else the plain document sanitizer.
+export function sanitizeTemplateWriteBody(input: {
+  readonly kind: string;
+  readonly scope: TemplateWriteScope;
+  readonly contentFormat: ContentFormat;
+  readonly content: string | null;
+}): SanitizeBodyResult {
+  const { kind, scope, contentFormat, content } = input;
+  if (kind === "mail-layout" && content !== null) {
+    return sanitizeMailLayout(scope, contentFormat, content);
+  }
+  if (kind === "pdf-layout" && content !== null) {
+    if (contentFormat !== "html") {
+      return rejected(
+        violation(
+          "document_requires_html_format",
+          contentFormat,
+          `Templates of kind pdf-layout require contentFormat html, got "${contentFormat}"`,
+        ),
+      );
+    }
+    return fromLayoutResult(sanitizeLayoutHtml(content));
+  }
+  return sanitizeTemplateBody({ kind, contentFormat, content });
+}