@cosmicdrift/kumiko-samples 0.362.0 → 0.364.0

package/packages/bundled-features/src/template-resolver/store-template-resource.ts

@@ -0,0 +1,416 @@
+import { fetchOne, selectMany } from "@cosmicdrift/kumiko-framework/bun-db";
+import type {
+  ConfigAccessor,
+  HandlerContext,
+  Registry,
+  SessionUser,
+  TenantId,
+  WriteResult,
+} from "@cosmicdrift/kumiko-framework/engine";
+import {
+  NotFoundError,
+  UnprocessableError,
+  writeFailure,
+} from "@cosmicdrift/kumiko-framework/errors";
+import { createFileRefFromBytes } from "@cosmicdrift/kumiko-framework/files";
+import { fileContextForTenant } from "../file-foundation/index.js";
+import type { FileAttachmentRef } from "../renderer-foundation/index.js";
+import { requireForTenant } from "../shared/index.js";
+import { SYSTEM_TENANT_ID } from "./constants.js";
+import {
+  DEFAULT_RESOURCE_MAX_BYTES,
+  MAX_FILE_ATTACHMENTS_PER_TEMPLATE,
+  RESOURCE_MAX_BYTES_CONFIG_KEY,
+} from "./handlers/resource-shared.js";
+import { executor } from "./handlers/shared.js";
+import {
+  attachmentEntriesOf,
+  type LinkedResourceEntry,
+  parseLinkedResourceEntries,
+  templatePdfAttachmentLinkSchema,
+} from "./linked-resources.js";
+import { TemplateResolverErrors } from "./qualified-names.js";
+import { normalizeResourceImage } from "./resource-image.js";
+import { type TemplateResourceRow, templateResourcesTable } from "./table.js";
+
+const EXTENSION_BY_CONTENT_TYPE: Readonly<Record<string, string>> = {
+  "image/png": "png",
+  "image/jpeg": "jpg",
+  "image/gif": "gif",
+  "image/webp": "webp",
+};
+
+export async function readTemplateResourceMaxBytes(
+  config: ConfigAccessor | undefined,
+  registry: Registry,
+): Promise<number> {
+  if (config === undefined || registry.getConfigKey(RESOURCE_MAX_BYTES_CONFIG_KEY) === undefined) {
+    return DEFAULT_RESOURCE_MAX_BYTES;
+  }
+  const value = await config(RESOURCE_MAX_BYTES_CONFIG_KEY);
+  return typeof value === "number" ? value : DEFAULT_RESOURCE_MAX_BYTES;
+}
+
+export type StoredTemplateResource = {
+  readonly fileRefId: string;
+  readonly key?: string;
+  readonly contentType: string;
+  readonly width: number;
+  readonly height: number;
+  readonly size: number;
+};
+
+// Normalizes the image, stores it as a file ref of the target tenant and, with templateId + key,
+// links it into that tenant's template. The caller is responsible for authorization; the function trusts tenantId.
+export async function storeTemplateResource(args: {
+  readonly ctx: HandlerContext;
+  readonly user: SessionUser;
+  readonly tenantId: TenantId;
+  readonly bytes: Uint8Array;
+  readonly maxBytes: number;
+  readonly templateId?: string;
+  readonly key?: string;
+}): Promise<WriteResult<StoredTemplateResource>> {
+  const { ctx, user, tenantId, bytes, maxBytes, templateId, key } = args;
+  if (bytes.length > maxBytes) {
+    return writeFailure(
+      new UnprocessableError(TemplateResolverErrors.resourceTooLarge, {
+        i18nKey: "templateResolver.errors.resource.tooLarge",
+        details: { maxBytes, size: bytes.length },
+      }),
+    );
+  }
+  let image: Awaited<ReturnType<typeof normalizeResourceImage>>;
+  try {
+    image = await normalizeResourceImage(Buffer.from(bytes));
+  } catch (cause) {
+    return writeFailure(
+      new UnprocessableError(TemplateResolverErrors.resourceUnsupportedImage, {
+        i18nKey: "templateResolver.errors.resource.unsupportedImage",
+        cause: cause instanceof Error ? cause : undefined,
+      }),
+    );
+  }
+
+  const { db, streamTenantId } = requireForTenant(ctx, tenantId);
+  let row: TemplateResourceRow | undefined;
+  if (templateId !== undefined) {
+    row = await fetchOne<TemplateResourceRow>(db, templateResourcesTable, {
+      tenantId,
+      id: templateId,
+    });
+    if (row === undefined) return writeFailure(new NotFoundError("template-resource", templateId));
+  }
+
+  const created = await createFileRefFromBytes(
+    {
+      db,
+      files: fileContextForTenant(ctx, ctx.user.tenantId, tenantId),
+      registry: ctx.registry,
+      user: { ...user, tenantId },
+    },
+    {
+      // Neutral name: the source's file name may be personal data.
+      fileName: `${key ?? "resource"}.${EXTENSION_BY_CONTENT_TYPE[image.contentType] ?? "bin"}`,
+      mimeType: image.contentType,
+      data: image.data,
+    },
+  );
+  if (!created.isSuccess) return created;
+
+  if (row !== undefined && key !== undefined) {
+    // The replaced FileRef stays: copy-locale and tenant overrides can share ids and
+    // there is no reference count to tell when the last user is gone.
+    const linkedResources = {
+      ...parseLinkedResourceEntries(row.linkedResources),
+      [key]: created.data.id,
+    };
+    const updated = await executor.update(
+      {
+        id: row.id,
+        version: row.version,
+        changes: { linkedResources: JSON.stringify(linkedResources) },
+      },
+      user,
+      db,
+      { streamTenantId },
+    );
+    if (!updated.isSuccess) return updated;
+  }
+
+  return {
+    isSuccess: true as const,
+    data: {
+      fileRefId: created.data.id,
+      ...(key !== undefined && { key }),
+      contentType: image.contentType,
+      width: image.width,
+      height: image.height,
+      size: image.data.length,
+    },
+  };
+}
+
+const PDF_MAGIC = [0x25, 0x50, 0x44, 0x46, 0x2d] as const;
+const PNG_MAGIC = [0x89, 0x50, 0x4e, 0x47, 0x0d, 0x0a, 0x1a, 0x0a] as const;
+const JPEG_MAGIC = [0xff, 0xd8, 0xff] as const;
+
+const ATTACHMENT_TYPES = [
+  { contentType: "application/pdf", extension: "pdf", magic: PDF_MAGIC },
+  { contentType: "image/png", extension: "png", magic: PNG_MAGIC },
+  { contentType: "image/jpeg", extension: "jpg", magic: JPEG_MAGIC },
+] as const;
+
+function detectAttachmentType(bytes: Uint8Array) {
+  return ATTACHMENT_TYPES.find(({ magic }) => magic.every((byte, index) => bytes[index] === byte));
+}
+
+export type StoredTemplateAttachment = {
+  readonly fileRefId: string;
+  readonly key: string;
+  readonly fileName: string;
+  readonly contentType: string;
+  readonly size: number;
+};
+
+type AttachmentType = NonNullable<ReturnType<typeof detectAttachmentType>>;
+
+export function attachmentNeedsMailTemplate(): WriteResult<never> {
+  return writeFailure(
+    new UnprocessableError(TemplateResolverErrors.attachmentInvalid, {
+      i18nKey: "templateResolver.errors.attachment.invalid",
+      details: { code: "mail_only" },
+    }),
+  );
+}
+
+export function attachmentLimitFailure(): WriteResult<never> {
+  return writeFailure(
+    new UnprocessableError(TemplateResolverErrors.attachmentLimit, {
+      i18nKey: "templateResolver.errors.attachment.limit",
+      i18nParams: { max: MAX_FILE_ATTACHMENTS_PER_TEMPLATE },
+      details: { max: MAX_FILE_ATTACHMENTS_PER_TEMPLATE },
+    }),
+  );
+}
+
+// Files and rendered PDFs share one cap; the entry being replaced under `key` does not count.
+export function otherAttachmentCount(
+  linked: Readonly<Record<string, LinkedResourceEntry>>,
+  key: string,
+): number {
+  return attachmentEntriesOf(linked).filter(([linkedKey]) => linkedKey !== key).length;
+}
+
+function inspectAttachmentBytes(
+  bytes: Uint8Array,
+  maxBytes: number,
+): { readonly failure: WriteResult<never> } | { readonly type: AttachmentType } {
+  if (bytes.length > maxBytes) {
+    return {
+      failure: writeFailure(
+        new UnprocessableError(TemplateResolverErrors.resourceTooLarge, {
+          details: { maxBytes, size: bytes.length },
+        }),
+      ),
+    };
+  }
+  const type = detectAttachmentType(bytes);
+  if (type === undefined) {
+    return {
+      failure: writeFailure(
+        new UnprocessableError(TemplateResolverErrors.attachmentUnsupportedType, {
+          i18nKey: "templateResolver.errors.attachment.unsupportedType",
+        }),
+      ),
+    };
+  }
+  return { type };
+}
+
+// Stores the bytes unchanged as a file of the target tenant, without linking it anywhere.
+async function createAttachmentFileRef(args: {
+  readonly ctx: HandlerContext;
+  readonly user: SessionUser;
+  readonly tenantId: TenantId;
+  readonly bytes: Uint8Array;
+  readonly key: string;
+  readonly type: AttachmentType;
+}): Promise<WriteResult<{ readonly id: string }>> {
+  const { ctx, user, tenantId, bytes, key, type } = args;
+  const { db } = requireForTenant(ctx, tenantId);
+  const created = await createFileRefFromBytes(
+    {
+      db,
+      files: fileContextForTenant(ctx, ctx.user.tenantId, tenantId),
+      registry: ctx.registry,
+      user: { ...user, tenantId },
+    },
+    {
+      // Neutral stored name: the admin's file name may be personal data and lives in the link entry.
+      fileName: `${key}.${type.extension}`,
+      mimeType: type.contentType,
+      data: bytes,
+    },
+  );
+  return created.isSuccess ? { isSuccess: true, data: { id: created.data.id } } : created;
+}
+
+// Stores a PDF/PNG/JPEG for a bundle import: validated like an upload, linked later by the importer.
+export async function storeBundleAttachment(args: {
+  readonly ctx: HandlerContext;
+  readonly user: SessionUser;
+  readonly tenantId: TenantId;
+  readonly bytes: Uint8Array;
+  readonly maxBytes: number;
+  readonly key: string;
+  readonly fileName: string;
+}): Promise<WriteResult<FileAttachmentRef>> {
+  const inspected = inspectAttachmentBytes(args.bytes, args.maxBytes);
+  if ("failure" in inspected) return inspected.failure;
+  const created = await createAttachmentFileRef({ ...args, type: inspected.type });
+  if (!created.isSuccess) return created;
+  return {
+    isSuccess: true,
+    data: { kind: "file", fileRefId: created.data.id, fileName: args.fileName },
+  };
+}
+
+// Stores a PDF/PNG/JPEG byte-for-byte (no re-encoding, the recipient gets what the admin uploaded)
+// and links it under `key` in a mail template of the target tenant. The caller authorizes tenantId.
+export async function storeTemplateAttachment(args: {
+  readonly ctx: HandlerContext;
+  readonly user: SessionUser;
+  readonly tenantId: TenantId;
+  readonly bytes: Uint8Array;
+  readonly maxBytes: number;
+  readonly templateId: string;
+  readonly key: string;
+  readonly fileName: string;
+}): Promise<WriteResult<StoredTemplateAttachment>> {
+  const { ctx, user, tenantId, bytes, maxBytes, templateId, key, fileName } = args;
+  const inspected = inspectAttachmentBytes(bytes, maxBytes);
+  if ("failure" in inspected) return inspected.failure;
+  const { type } = inspected;
+
+  const { db, streamTenantId } = requireForTenant(ctx, tenantId);
+  const row = await fetchOne<TemplateResourceRow>(db, templateResourcesTable, {
+    tenantId,
+    id: templateId,
+  });
+  if (row === undefined) return writeFailure(new NotFoundError("template-resource", templateId));
+  if (row.kind !== "mail") return attachmentNeedsMailTemplate();
+
+  const linked = parseLinkedResourceEntries(row.linkedResources);
+  if (otherAttachmentCount(linked, key) >= MAX_FILE_ATTACHMENTS_PER_TEMPLATE) {
+    return attachmentLimitFailure();
+  }
+
+  const created = await createAttachmentFileRef({ ctx, user, tenantId, bytes, key, type });
+  if (!created.isSuccess) return created;
+
+  const entry: LinkedResourceEntry = { kind: "file", fileRefId: created.data.id, fileName };
+  const updated = await executor.update(
+    {
+      id: row.id,
+      version: row.version,
+      changes: { linkedResources: JSON.stringify({ ...linked, [key]: entry }) },
+    },
+    user,
+    db,
+    { streamTenantId },
+  );
+  if (!updated.isSuccess) return updated;
+
+  return {
+    isSuccess: true as const,
+    data: {
+      fileRefId: created.data.id,
+      key,
+      fileName,
+      contentType: type.contentType,
+      size: bytes.length,
+    },
+  };
+}
+
+export type LinkedTemplatePdfAttachment = {
+  readonly key: string;
+  readonly templateSlug: string;
+  readonly fileName: string;
+};
+
+function pdfAttachmentInvalid(code: string): WriteResult<never> {
+  return writeFailure(
+    new UnprocessableError(TemplateResolverErrors.attachmentInvalid, {
+      i18nKey: "templateResolver.errors.attachment.invalid",
+      details: { code },
+    }),
+  );
+}
+
+// Links a PDF that is rendered from a document template at send time into a mail template of the
+// target tenant. Nothing is stored besides the link entry. The caller authorizes tenantId.
+export async function linkTemplatePdfAttachment(args: {
+  readonly ctx: HandlerContext;
+  readonly user: SessionUser;
+  readonly tenantId: TenantId;
+  readonly templateId: string;
+  readonly key: string;
+  readonly templateSlug: string;
+  readonly fileName: string;
+}): Promise<WriteResult<LinkedTemplatePdfAttachment>> {
+  const { ctx, user, tenantId, templateId, key } = args;
+  const link = templatePdfAttachmentLinkSchema.safeParse({
+    kind: "rendered-pdf",
+    templateSlug: args.templateSlug,
+    fileName: args.fileName,
+  });
+  if (!link.success) return pdfAttachmentInvalid("invalid_pdf_link");
+
+  const { db, streamTenantId } = requireForTenant(ctx, tenantId);
+  const row = await fetchOne<TemplateResourceRow>(db, templateResourcesTable, {
+    tenantId,
+    id: templateId,
+  });
+  if (row === undefined) return writeFailure(new NotFoundError("template-resource", templateId));
+  if (row.kind !== "mail") return attachmentNeedsMailTemplate();
+
+  const linked = parseLinkedResourceEntries(row.linkedResources);
+  if (otherAttachmentCount(linked, key) >= MAX_FILE_ATTACHMENTS_PER_TEMPLATE) {
+    return attachmentLimitFailure();
+  }
+
+  const visibleTemplates = await selectMany<TemplateResourceRow>(
+    db,
+    templateResourcesTable,
+    { tenantId: [tenantId, SYSTEM_TENANT_ID], slug: link.data.templateSlug, kind: "document-pdf" },
+    { limit: 1 },
+  );
+  if (visibleTemplates.length === 0) {
+    return writeFailure(
+      new UnprocessableError(TemplateResolverErrors.attachmentPdfTemplateMissing, {
+        i18nKey: "templateResolver.errors.attachment.pdfTemplateMissing",
+        i18nParams: { slug: link.data.templateSlug },
+        details: { templateSlug: link.data.templateSlug },
+      }),
+    );
+  }
+
+  const updated = await executor.update(
+    {
+      id: row.id,
+      version: row.version,
+      changes: { linkedResources: JSON.stringify({ ...linked, [key]: link.data }) },
+    },
+    user,
+    db,
+    { streamTenantId },
+  );
+  if (!updated.isSuccess) return updated;
+
+  return {
+    isSuccess: true as const,
+    data: { key, templateSlug: link.data.templateSlug, fileName: link.data.fileName },
+  };
+}

package/packages/bundled-features/src/template-resolver/table.ts

@@ -2,9 +2,12 @@ import { buildEntityTable } from "@cosmicdrift/kumiko-framework/db";
 import {
   createEntity,
   createLongTextField,
+  createNumberField,
   createSelectField,
   createTextField,
+  createTimestampField,
 } from "@cosmicdrift/kumiko-framework/engine";
+import type { EntityEventMigration } from "@cosmicdrift/kumiko-types/fields";
 import type { Temporal } from "@cosmicdrift/kumiko-types/temporal";
 import {
   CONTENT_FORMATS,
@@ -13,10 +16,19 @@ import {
   TEMPLATE_STATUSES,
 } from "./constants.js";
 
+// Stored v1 events name the kind "mail-html", which is now "mail".
+const renameMailHtmlKind: EntityEventMigration = {
+  fromVersion: 1,
+  toVersion: 2,
+  transform: (fields) => (fields["kind"] === "mail-html" ? { ...fields, kind: "mail" } : fields),
+};
+
 // TemplateResource — strukturierte Template-Definition mit Tenant-
 // Override-Hierarchie, Locale-Fallback und Resource-Linking via
 // file-foundation. Pro (tenantId, slug, kind, locale) genau eine Row;
-// scope/status/version differenzieren Lifecycle.
+// scope/status/version differenzieren Lifecycle. Der Entwurf neben einer
+// aktiven Fassung liegt in `draft`; die Hauptfelder bleiben die ausgelieferte
+// Fassung.
 //
 // `variableSchema` + `linkedResources` sind JSON-Strings in longText
 // (Pattern aus compliance-profiles — kein dedizierter jsonbField im
@@ -44,9 +56,17 @@ export const templateResourceEntity = createEntity({
     contentFormat: createSelectField({ required: true, options: [...CONTENT_FORMATS] }),
     variableSchema: createLongTextField({ personal: false, reason: "technical_reference" }),
     linkedResources: createLongTextField({ personal: false, reason: "technical_reference" }),
+    // Per-kind JSON (mail: subject, preview text, layout slug, ...), validated
+    // against template-meta.ts on write. Authored by TenantAdmin/Operator.
+    meta: createLongTextField({ personal: false, reason: "is_business_data" }),
     scope: createSelectField({ required: true, options: [...TEMPLATE_SCOPES] }),
     parentTemplateId: createTextField({ personal: false, reason: "technical_reference" }),
     status: createSelectField({ required: true, options: [...TEMPLATE_STATUSES] }),
+    // JSON of the unpublished edit beside the active version (see template-draft.ts).
+    draft: createLongTextField({ personal: false, reason: "is_business_data" }),
+    // `version` counts every save including drafts; these two describe the served version.
+    activeVersion: createNumberField({ integer: true, min: 1 }),
+    activeSince: createTimestampField({}),
   },
   indexes: [
     {
@@ -55,6 +75,8 @@ export const templateResourceEntity = createEntity({
       name: "read_template_resources_unique",
     },
   ],
+  eventVersion: 2,
+  eventMigrations: [renameMailHtmlKind],
 });
 
 export const templateResourcesTable = buildEntityTable("template-resource", templateResourceEntity);
@@ -84,7 +106,11 @@ export type TemplateResourceRow = {
   readonly contentFormat: string;
   readonly variableSchema: string | null;
   readonly linkedResources: string | null;
+  readonly meta: string | null;
   readonly scope: string;
   readonly parentTemplateId: string | null;
   readonly status: string;
+  readonly draft: string | null;
+  readonly activeVersion: number | null;
+  readonly activeSince: Temporal.Instant | null;
 } & EntityAuditColumns;

package/packages/bundled-features/src/template-resolver/template-bundle.ts

@@ -0,0 +1,79 @@
+import * as z from "zod";
+import { CONTENT_FORMATS, UPSERT_KINDS } from "./constants.js";
+import { isDocumentResourceKey } from "./document-schema.js";
+import { templatePdfAttachmentLinkSchema } from "./linked-resources.js";
+import { templateSlugSchema } from "./template-meta.js";
+
+const MAX_RESOURCES = 20;
+const MAX_RESOURCE_BYTES = 2 * 1024 * 1024;
+const MAX_BASE64_LENGTH = Math.ceil(MAX_RESOURCE_BYTES / 3) * 4;
+
+const STRICT_BASE64 = /^(?:[A-Za-z0-9+/]{4})*(?:[A-Za-z0-9+/]{2}==|[A-Za-z0-9+/]{3}=)?$/;
+const CONTENT_TYPE = /^[a-z0-9][a-z0-9!#$&^_.+-]*\/[a-z0-9][a-z0-9!#$&^_.+-]*$/i;
+const UNSAFE_FILE_NAME_CHARACTERS = /[/\\";]|\p{Cc}/u;
+
+const bundleLocaleSchema = z
+  .string()
+  .min(2)
+  .max(8)
+  .regex(/^[a-z]{2}(-[a-z]{2})?$/i, "locale must be ISO 639-1 (e.g. de, en, en-us)");
+
+const bundleFileNameSchema = z
+  .string()
+  .min(1)
+  .max(200)
+  .refine((name) => !UNSAFE_FILE_NAME_CHARACTERS.test(name) && !name.includes(".."), {
+    message: 'file name must not contain / \\ " ; control characters or ".."',
+  });
+
+const bundleResourceSchema = z
+  .object({
+    fileName: bundleFileNameSchema,
+    contentType: z.string().max(100).regex(CONTENT_TYPE, "content type must be type/subtype"),
+    base64: z.string().max(MAX_BASE64_LENGTH).regex(STRICT_BASE64, "base64 is not valid"),
+    // Absent means an image the body embeds; "attachment" is a file attached to the mail.
+    purpose: z.enum(["attachment"]).optional(),
+  })
+  .strict();
+
+const pdfAttachmentLinkBodySchema = templatePdfAttachmentLinkSchema.omit({ kind: true });
+
+const bundleLocaleEntrySchema = z
+  .object({ body: z.string().max(200_000), meta: z.unknown().optional() })
+  .strict();
+
+export const templateBundleSchema = z
+  .object({
+    slug: templateSlugSchema,
+    kind: z.enum(UPSERT_KINDS),
+    contentFormat: z.enum(CONTENT_FORMATS),
+    variableSchema: z.record(z.string(), z.unknown()).optional(),
+    locales: z
+      .record(bundleLocaleSchema, bundleLocaleEntrySchema)
+      .refine((locales) => Object.keys(locales).length >= 1, {
+        message: "a bundle needs at least one locale",
+      }),
+    resources: z
+      .record(
+        z.string().refine(isDocumentResourceKey, { message: "not a valid resource key" }),
+        bundleResourceSchema,
+      )
+      .refine((resources) => Object.keys(resources).length <= MAX_RESOURCES, {
+        message: `a bundle holds at most ${MAX_RESOURCES} resources`,
+      })
+      .default({}),
+    // PDFs rendered from document templates at send time; nothing to store, so no bytes.
+    pdfAttachments: z
+      .record(
+        z.string().refine(isDocumentResourceKey, { message: "not a valid resource key" }),
+        pdfAttachmentLinkBodySchema,
+      )
+      .default({}),
+  })
+  .strict()
+  .refine(
+    (bundle) => Object.keys(bundle.pdfAttachments).every((key) => !(key in bundle.resources)),
+    { message: "a key is used by a resource and a PDF attachment", path: ["pdfAttachments"] },
+  );
+
+export type TemplateBundle = z.infer<typeof templateBundleSchema>;

package/packages/bundled-features/src/template-resolver/template-diff.ts

@@ -0,0 +1,78 @@
+import { withParsedDocument } from "./document-sanitizer.js";
+
+export type TemplateDiffChange = "same" | "added" | "removed";
+
+export type TemplateDiffBlock = { readonly change: TemplateDiffChange; readonly content: string };
+
+// Beyond this the quadratic LCS table is not worth it for a preview.
+const MAX_LCS_CELLS = 1_000_000;
+
+function splitHtmlBlocks(content: string): string[] {
+  return withParsedDocument(content, (body) => {
+    const blocks: string[] = [];
+    for (const node of Array.from(body.childNodes)) {
+      const markup =
+        "outerHTML" in node && typeof node.outerHTML === "string" ? node.outerHTML : "";
+      const text = markup === "" ? (node.textContent ?? "").trim() : markup;
+      if (text !== "") blocks.push(text);
+    }
+    return blocks;
+  });
+}
+
+export function splitTemplateBlocks(content: string, contentFormat: string): string[] {
+  if (contentFormat === "html") return splitHtmlBlocks(content);
+  return content
+    .split(/\r?\n[ \t]*\r?\n/)
+    .map((block) => block.trim())
+    .filter((block) => block !== "");
+}
+
+// "removed" = only in the system template, "added" = only in the tenant version.
+export function diffTemplateBlocks(
+  system: readonly string[],
+  tenant: readonly string[],
+): TemplateDiffBlock[] {
+  if (system.length * tenant.length > MAX_LCS_CELLS) {
+    return [
+      ...system.map((content) => ({ change: "removed" as const, content })),
+      ...tenant.map((content) => ({ change: "added" as const, content })),
+    ];
+  }
+  const rows = system.length;
+  const cols = tenant.length;
+  const width = cols + 1;
+  // lengths[i * width + j] = LCS length of system[i..] and tenant[j..]
+  const lengths = new Uint32Array((rows + 1) * width);
+  const lengthAt = (i: number, j: number): number => lengths[i * width + j] ?? 0;
+  for (let i = rows - 1; i >= 0; i--) {
+    for (let j = cols - 1; j >= 0; j--) {
+      lengths[i * width + j] =
+        system[i] === tenant[j]
+          ? lengthAt(i + 1, j + 1) + 1
+          : Math.max(lengthAt(i + 1, j), lengthAt(i, j + 1));
+    }
+  }
+  const result: TemplateDiffBlock[] = [];
+  let i = 0;
+  let j = 0;
+  while (i < rows || j < cols) {
+    const systemBlock = system[i];
+    const tenantBlock = tenant[j];
+    if (systemBlock !== undefined && systemBlock === tenantBlock) {
+      result.push({ change: "same", content: systemBlock });
+      i++;
+      j++;
+    } else if (
+      systemBlock !== undefined &&
+      (tenantBlock === undefined || lengthAt(i + 1, j) >= lengthAt(i, j + 1))
+    ) {
+      result.push({ change: "removed", content: systemBlock });
+      i++;
+    } else if (tenantBlock !== undefined) {
+      result.push({ change: "added", content: tenantBlock });
+      j++;
+    }
+  }
+  return result;
+}