@cosmicdrift/kumiko-samples 0.364.0 → 0.365.0

package/packages/bundled-features/src/template-resolver/store-template-resource.ts

@@ -1,5 +1,6 @@
 import { fetchOne, selectMany } from "@cosmicdrift/kumiko-framework/bun-db";
 import type {
+  BeforeTransactionResult,
   ConfigAccessor,
   HandlerContext,
   Registry,
@@ -12,11 +13,15 @@ import {
   UnprocessableError,
   writeFailure,
 } from "@cosmicdrift/kumiko-framework/errors";
-import { createFileRefFromBytes } from "@cosmicdrift/kumiko-framework/files";
+import {
+  type CreateFileRefInput,
+  createFileRefFromUploadedBytes,
+  type UploadedFileBytes,
+  uploadFileBytesBeforeTransaction,
+} from "@cosmicdrift/kumiko-framework/files";
 import { fileContextForTenant } from "../file-foundation/index.js";
-import type { FileAttachmentRef } from "../renderer-foundation/index.js";
-import { requireForTenant } from "../shared/index.js";
-import { SYSTEM_TENANT_ID } from "./constants.js";
+import { extensionForResourceContentType, requireForTenant } from "../shared/index.js";
+import { ACTIVE_TEMPLATE_STATUS, SYSTEM_TENANT_ID } from "./constants.js";
 import {
   DEFAULT_RESOURCE_MAX_BYTES,
   MAX_FILE_ATTACHMENTS_PER_TEMPLATE,
@@ -32,13 +37,7 @@ import {
 import { TemplateResolverErrors } from "./qualified-names.js";
 import { normalizeResourceImage } from "./resource-image.js";
 import { type TemplateResourceRow, templateResourcesTable } from "./table.js";
-
-const EXTENSION_BY_CONTENT_TYPE: Readonly<Record<string, string>> = {
-  "image/png": "png",
-  "image/jpeg": "jpg",
-  "image/gif": "gif",
-  "image/webp": "webp",
-};
+import { readTemplateResource } from "./template-resources.js";
 
 export async function readTemplateResourceMaxBytes(
   config: ConfigAccessor | undefined,
@@ -60,82 +59,311 @@ export type StoredTemplateResource = {
   readonly size: number;
 };
 
-// Normalizes the image, stores it as a file ref of the target tenant and, with templateId + key,
-// links it into that tenant's template. The caller is responsible for authorization; the function trusts tenantId.
-export async function storeTemplateResource(args: {
+export type PreparedTemplateImage = {
+  readonly kind: "image";
+  readonly contentType: string;
+  readonly width: number;
+  readonly height: number;
+  readonly size: number;
+  readonly upload: UploadedFileBytes;
+};
+
+export type PreparedTemplateAttachment = {
+  readonly kind: "attachment";
+  readonly contentType: string;
+  readonly size: number;
+  readonly fileName: string;
+  readonly upload: UploadedFileBytes;
+};
+
+export type PreparedTemplateFile = PreparedTemplateImage | PreparedTemplateAttachment;
+
+function keyInUse(): WriteResult<never> {
+  return writeFailure(
+    new UnprocessableError(TemplateResolverErrors.attachmentInvalid, {
+      i18nKey: "templateResolver.errors.attachment.invalid",
+      details: { code: "key_in_use" },
+    }),
+  );
+}
+
+function isAttachmentKey(links: Readonly<Record<string, LinkedResourceEntry>>, key: string) {
+  const occupant = links[key];
+  return occupant !== undefined && typeof occupant !== "string";
+}
+
+// The upload goes to the target tenant's storage and the release checks that tenant's fileRef rows,
+// so both receive the target tenant's db and identity.
+function uploadToTenant(
+  args: {
+    readonly ctx: HandlerContext;
+    readonly user: SessionUser;
+    readonly tenantId: TenantId;
+  },
+  input: CreateFileRefInput,
+): Promise<BeforeTransactionResult<UploadedFileBytes>> {
+  const { ctx, user, tenantId } = args;
+  return uploadFileBytesBeforeTransaction(
+    {
+      db: requireForTenant(ctx, tenantId).db,
+      files: fileContextForTenant(ctx, ctx.user.tenantId, tenantId),
+      registry: ctx.registry,
+      user: { ...user, tenantId },
+    },
+    input,
+  );
+}
+
+type TenantScope = {
   readonly ctx: HandlerContext;
   readonly user: SessionUser;
   readonly tenantId: TenantId;
-  readonly bytes: Uint8Array;
-  readonly maxBytes: number;
-  readonly templateId?: string;
-  readonly key?: string;
-}): Promise<WriteResult<StoredTemplateResource>> {
-  const { ctx, user, tenantId, bytes, maxBytes, templateId, key } = args;
+};
+
+function createFileRefFromPrepared(scope: TenantScope, upload: UploadedFileBytes) {
+  const { ctx, user, tenantId } = scope;
+  return createFileRefFromUploadedBytes(
+    { db: requireForTenant(ctx, tenantId).db, user: { ...user, tenantId } },
+    upload,
+  );
+}
+
+async function linkImage(args: {
+  readonly ctx: HandlerContext;
+  readonly user: SessionUser;
+  readonly tenantId: TenantId;
+  readonly row: TemplateResourceRow;
+  readonly key: string;
+  readonly links: Readonly<Record<string, LinkedResourceEntry>>;
+  readonly fileRefId: string;
+}): Promise<WriteResult<null>> {
+  const { ctx, user, tenantId, row, key, links, fileRefId } = args;
+  const { db, streamTenantId } = requireForTenant(ctx, tenantId);
+  // The replaced FileRef stays: copy-locale and tenant overrides can share ids and
+  // there is no reference count to tell when the last user is gone.
+  const updated = await executor.update(
+    {
+      id: row.id,
+      version: row.version,
+      changes: { linkedResources: JSON.stringify({ ...links, [key]: fileRefId }) },
+    },
+    user,
+    db,
+    { streamTenantId },
+  );
+  return updated.isSuccess ? { isSuccess: true, data: null } : updated;
+}
+
+type NormalizedUpload = {
+  readonly image: Awaited<ReturnType<typeof normalizeResourceImage>>;
+};
+
+async function normalizeUpload(
+  bytes: Uint8Array,
+  maxBytes: number,
+): Promise<{ readonly failure: WriteResult<never> } | NormalizedUpload> {
   if (bytes.length > maxBytes) {
-    return writeFailure(
-      new UnprocessableError(TemplateResolverErrors.resourceTooLarge, {
-        i18nKey: "templateResolver.errors.resource.tooLarge",
-        details: { maxBytes, size: bytes.length },
-      }),
-    );
+    return {
+      failure: writeFailure(
+        new UnprocessableError(TemplateResolverErrors.resourceTooLarge, {
+          i18nKey: "templateResolver.errors.resource.tooLarge",
+          details: { maxBytes, size: bytes.length },
+        }),
+      ),
+    };
   }
-  let image: Awaited<ReturnType<typeof normalizeResourceImage>>;
   try {
-    image = await normalizeResourceImage(Buffer.from(bytes));
+    return { image: await normalizeResourceImage(Buffer.from(bytes)) };
   } catch (cause) {
-    return writeFailure(
-      new UnprocessableError(TemplateResolverErrors.resourceUnsupportedImage, {
-        i18nKey: "templateResolver.errors.resource.unsupportedImage",
-        cause: cause instanceof Error ? cause : undefined,
-      }),
-    );
+    return {
+      failure: writeFailure(
+        new UnprocessableError(TemplateResolverErrors.resourceUnsupportedImage, {
+          i18nKey: "templateResolver.errors.resource.unsupportedImage",
+          cause: cause instanceof Error ? cause : undefined,
+        }),
+      ),
+    };
   }
+}
 
-  const { db, streamTenantId } = requireForTenant(ctx, tenantId);
+type ImageTarget = {
+  readonly row: TemplateResourceRow | undefined;
+  readonly links: Readonly<Record<string, LinkedResourceEntry>>;
+};
+
+// Runs before the upload (reject early, store nothing) and again in the transaction on the fresh row.
+async function checkImageTarget(args: {
+  readonly ctx: HandlerContext;
+  readonly tenantId: TenantId;
+  readonly templateId?: string | undefined;
+  readonly key?: string | undefined;
+}): Promise<WriteResult<ImageTarget>> {
+  const { ctx, tenantId, templateId, key } = args;
   let row: TemplateResourceRow | undefined;
   if (templateId !== undefined) {
-    row = await fetchOne<TemplateResourceRow>(db, templateResourcesTable, {
-      tenantId,
-      id: templateId,
-    });
+    row = await fetchOne<TemplateResourceRow>(
+      requireForTenant(ctx, tenantId).db,
+      templateResourcesTable,
+      { tenantId, id: templateId },
+    );
     if (row === undefined) return writeFailure(new NotFoundError("template-resource", templateId));
   }
+  const links = row === undefined ? {} : parseLinkedResourceEntries(row.linkedResources);
+  if (key !== undefined && isAttachmentKey(links, key)) return keyInUse();
+  return { isSuccess: true, data: { row, links } };
+}
 
-  const created = await createFileRefFromBytes(
-    {
-      db,
-      files: fileContextForTenant(ctx, ctx.user.tenantId, tenantId),
-      registry: ctx.registry,
-      user: { ...user, tenantId },
-    },
+// beforeTransaction half: normalizes the image and uploads it to the target tenant's storage.
+// The caller is responsible for authorization; the function trusts tenantId.
+export async function prepareTemplateResourceBeforeTransaction(args: {
+  readonly ctx: HandlerContext;
+  readonly user: SessionUser;
+  readonly tenantId: TenantId;
+  readonly bytes: Uint8Array;
+  readonly maxBytes: number;
+  readonly templateId?: string;
+  readonly key?: string;
+}): Promise<BeforeTransactionResult<PreparedTemplateImage>> {
+  const { ctx, user, tenantId, bytes, maxBytes, templateId, key } = args;
+  const normalized = await normalizeUpload(bytes, maxBytes);
+  if ("failure" in normalized) return normalized.failure;
+  const { image } = normalized;
+
+  const target = await checkImageTarget({ ctx, tenantId, templateId, key });
+  if (!target.isSuccess) return target;
+
+  const uploaded = await uploadToTenant(
+    { ctx, user, tenantId },
     {
       // Neutral name: the source's file name may be personal data.
-      fileName: `${key ?? "resource"}.${EXTENSION_BY_CONTENT_TYPE[image.contentType] ?? "bin"}`,
+      fileName: `${key ?? "resource"}.${extensionForResourceContentType(image.contentType) ?? "bin"}`,
       mimeType: image.contentType,
       data: image.data,
     },
   );
+  if (!uploaded.isSuccess) return uploaded;
+  return {
+    isSuccess: true,
+    data: {
+      kind: "image",
+      contentType: image.contentType,
+      width: image.width,
+      height: image.height,
+      size: image.data.length,
+      upload: uploaded.data,
+    },
+    ...(uploaded.release && { release: uploaded.release }),
+  };
+}
+
+export type Release = () => Promise<void>;
+
+// Tries every release, so one failing delete does not strand the other uploads; the first rejection is rethrown.
+export async function releaseAll(releases: readonly Release[]): Promise<void> {
+  const settled = await Promise.allSettled(releases.map((release) => release()));
+  const rejected = settled.find((outcome) => outcome.status === "rejected");
+  if (rejected?.status === "rejected") throw rejected.reason;
+}
+
+// `upload` is absent for a rendered-PDF link, which carries no file.
+export type PreparedLinkedResourceCopy = {
+  readonly key: string;
+  readonly entry: LinkedResourceEntry;
+  readonly upload?: UploadedFileBytes;
+};
+
+// beforeTransaction half: copies the file behind every entry into the target tenant's storage, so a
+// template copied from the system default keeps working once the tenant exports it or measures its
+// attachments. An entry whose source file is gone is left out: it could not be resolved at render
+// time either. A failed or throwing upload releases the ones before it.
+export async function prepareLinkedResourceCopiesBeforeTransaction(args: {
+  readonly ctx: HandlerContext;
+  readonly user: SessionUser;
+  readonly tenantId: TenantId;
+  readonly resources: Readonly<Record<string, LinkedResourceEntry>>;
+}): Promise<BeforeTransactionResult<readonly PreparedLinkedResourceCopy[]>> {
+  const { ctx, user, tenantId, resources } = args;
+  const copies: PreparedLinkedResourceCopy[] = [];
+  const releases: Release[] = [];
+  try {
+    for (const [key, entry] of Object.entries(resources)) {
+      if (typeof entry !== "string" && entry.kind === "rendered-pdf") {
+        copies.push({ key, entry });
+        continue;
+      }
+      const file = await readTemplateResource(
+        ctx,
+        typeof entry === "string" ? entry : entry.fileRefId,
+      );
+      if (file === null) continue;
+      const uploaded = await uploadToTenant(
+        { ctx, user, tenantId },
+        { fileName: file.fileName, mimeType: file.contentType, data: file.bytes },
+      );
+      if (!uploaded.isSuccess) {
+        await releaseAll(releases);
+        return uploaded;
+      }
+      if (uploaded.release) releases.push(uploaded.release);
+      copies.push({ key, entry, upload: uploaded.data });
+    }
+  } catch (cause) {
+    await releaseAll(releases);
+    throw cause;
+  }
+  return { isSuccess: true, data: copies, release: () => releaseAll(releases) };
+}
+
+// Transaction half: creates the target tenant's fileRef rows and returns the entries pointing at them.
+export async function createLinkedResourceCopies(
+  scope: TenantScope,
+  prepared: readonly PreparedLinkedResourceCopy[],
+): Promise<WriteResult<Record<string, LinkedResourceEntry>>> {
+  const linked: Record<string, LinkedResourceEntry> = {};
+  for (const { key, entry, upload } of prepared) {
+    if (typeof entry !== "string" && entry.kind === "rendered-pdf") {
+      linked[key] = entry;
+      continue;
+    }
+    // skip: a file entry without a copy must not carry the source tenant's fileRefId over
+    if (upload === undefined) continue;
+    const created = await createFileRefFromPrepared(scope, upload);
+    if (!created.isSuccess) return created;
+    linked[key] =
+      typeof entry === "string" ? created.data.id : { ...entry, fileRefId: created.data.id };
+  }
+  return { isSuccess: true, data: linked };
+}
+
+// Transaction half: creates the fileRef row for the prepared upload and, with templateId + key,
+// links it into the target tenant's template.
+export async function storePreparedTemplateResource(args: {
+  readonly ctx: HandlerContext;
+  readonly user: SessionUser;
+  readonly tenantId: TenantId;
+  readonly prepared: PreparedTemplateImage;
+  readonly templateId?: string;
+  readonly key?: string;
+}): Promise<WriteResult<StoredTemplateResource>> {
+  const { ctx, user, tenantId, prepared, templateId, key } = args;
+  const target = await checkImageTarget({ ctx, tenantId, templateId, key });
+  if (!target.isSuccess) return target;
+  const { row, links } = target.data;
+
+  const created = await createFileRefFromPrepared({ ctx, user, tenantId }, prepared.upload);
   if (!created.isSuccess) return created;
 
   if (row !== undefined && key !== undefined) {
-    // The replaced FileRef stays: copy-locale and tenant overrides can share ids and
-    // there is no reference count to tell when the last user is gone.
-    const linkedResources = {
-      ...parseLinkedResourceEntries(row.linkedResources),
-      [key]: created.data.id,
-    };
-    const updated = await executor.update(
-      {
-        id: row.id,
-        version: row.version,
-        changes: { linkedResources: JSON.stringify(linkedResources) },
-      },
+    const linked = await linkImage({
+      ctx,
       user,
-      db,
-      { streamTenantId },
-    );
-    if (!updated.isSuccess) return updated;
+      tenantId,
+      row,
+      key,
+      links,
+      fileRefId: created.data.id,
+    });
+    if (!linked.isSuccess) return linked;
   }
 
   return {
@@ -143,10 +371,10 @@ export async function storeTemplateResource(args: {
     data: {
       fileRefId: created.data.id,
       ...(key !== undefined && { key }),
-      contentType: image.contentType,
-      width: image.width,
-      height: image.height,
-      size: image.data.length,
+      contentType: prepared.contentType,
+      width: prepared.width,
+      height: prepared.height,
+      size: prepared.size,
     },
   };
 }
@@ -228,36 +456,39 @@ function inspectAttachmentBytes(
   return { type };
 }
 
-// Stores the bytes unchanged as a file of the target tenant, without linking it anywhere.
-async function createAttachmentFileRef(args: {
+type AttachmentTarget = {
+  readonly row: TemplateResourceRow;
+  readonly linked: Readonly<Record<string, LinkedResourceEntry>>;
+};
+
+// Runs before the upload (reject early, store nothing) and again in the transaction on the fresh row.
+async function checkAttachmentTarget(args: {
   readonly ctx: HandlerContext;
-  readonly user: SessionUser;
   readonly tenantId: TenantId;
-  readonly bytes: Uint8Array;
+  readonly templateId: string;
   readonly key: string;
-  readonly type: AttachmentType;
-}): Promise<WriteResult<{ readonly id: string }>> {
-  const { ctx, user, tenantId, bytes, key, type } = args;
-  const { db } = requireForTenant(ctx, tenantId);
-  const created = await createFileRefFromBytes(
-    {
-      db,
-      files: fileContextForTenant(ctx, ctx.user.tenantId, tenantId),
-      registry: ctx.registry,
-      user: { ...user, tenantId },
-    },
-    {
-      // Neutral stored name: the admin's file name may be personal data and lives in the link entry.
-      fileName: `${key}.${type.extension}`,
-      mimeType: type.contentType,
-      data: bytes,
-    },
+}): Promise<WriteResult<AttachmentTarget>> {
+  const { ctx, tenantId, templateId, key } = args;
+  const row = await fetchOne<TemplateResourceRow>(
+    requireForTenant(ctx, tenantId).db,
+    templateResourcesTable,
+    { tenantId, id: templateId },
   );
-  return created.isSuccess ? { isSuccess: true, data: { id: created.data.id } } : created;
+  if (row === undefined) return writeFailure(new NotFoundError("template-resource", templateId));
+  if (row.kind !== "mail") return attachmentNeedsMailTemplate();
+
+  const linked = parseLinkedResourceEntries(row.linkedResources);
+  if (otherAttachmentCount(linked, key) >= MAX_FILE_ATTACHMENTS_PER_TEMPLATE) {
+    return attachmentLimitFailure();
+  }
+  const occupant = linked[key];
+  if (occupant !== undefined && typeof occupant === "string") return keyInUse();
+  return { isSuccess: true, data: { row, linked } };
 }
 
-// Stores a PDF/PNG/JPEG for a bundle import: validated like an upload, linked later by the importer.
-export async function storeBundleAttachment(args: {
+// beforeTransaction half: validates a PDF/PNG/JPEG and uploads it unchanged to the target tenant's
+// storage. With templateId the template is checked first; a bundle import has none yet.
+export async function prepareTemplateAttachmentBeforeTransaction(args: {
   readonly ctx: HandlerContext;
   readonly user: SessionUser;
   readonly tenantId: TenantId;
@@ -265,51 +496,81 @@ export async function storeBundleAttachment(args: {
   readonly maxBytes: number;
   readonly key: string;
   readonly fileName: string;
-}): Promise<WriteResult<FileAttachmentRef>> {
-  const inspected = inspectAttachmentBytes(args.bytes, args.maxBytes);
+  readonly templateId?: string;
+}): Promise<BeforeTransactionResult<PreparedTemplateAttachment>> {
+  const { ctx, user, tenantId, bytes, maxBytes, key, fileName, templateId } = args;
+  const inspected = inspectAttachmentBytes(bytes, maxBytes);
   if ("failure" in inspected) return inspected.failure;
-  const created = await createAttachmentFileRef({ ...args, type: inspected.type });
+  const { type } = inspected;
+
+  if (templateId !== undefined) {
+    const target = await checkAttachmentTarget({ ctx, tenantId, templateId, key });
+    if (!target.isSuccess) return target;
+  }
+
+  const uploaded = await uploadToTenant(
+    { ctx, user, tenantId },
+    {
+      // Neutral stored name: the admin's file name may be personal data and lives in the link entry.
+      fileName: `${key}.${type.extension}`,
+      mimeType: type.contentType,
+      data: bytes,
+    },
+  );
+  if (!uploaded.isSuccess) return uploaded;
+  return {
+    isSuccess: true,
+    data: {
+      kind: "attachment",
+      contentType: type.contentType,
+      size: bytes.length,
+      fileName,
+      upload: uploaded.data,
+    },
+    ...(uploaded.release && { release: uploaded.release }),
+  };
+}
+
+// Creates the fileRef rows for a bundle's prepared uploads; the importer links the entries.
+export async function createPreparedBundleResourceEntry(
+  scope: TenantScope,
+  prepared: PreparedTemplateFile,
+): Promise<WriteResult<LinkedResourceEntry>> {
+  const created = await createFileRefFromPrepared(scope, prepared.upload);
   if (!created.isSuccess) return created;
   return {
     isSuccess: true,
-    data: { kind: "file", fileRefId: created.data.id, fileName: args.fileName },
+    data:
+      prepared.kind === "image"
+        ? created.data.id
+        : { kind: "file", fileRefId: created.data.id, fileName: prepared.fileName },
   };
 }
 
-// Stores a PDF/PNG/JPEG byte-for-byte (no re-encoding, the recipient gets what the admin uploaded)
-// and links it under `key` in a mail template of the target tenant. The caller authorizes tenantId.
-export async function storeTemplateAttachment(args: {
+// Transaction half: creates the fileRef row for the prepared upload and links it under `key` in a
+// mail template of the target tenant.
+export async function storePreparedTemplateAttachment(args: {
   readonly ctx: HandlerContext;
   readonly user: SessionUser;
   readonly tenantId: TenantId;
-  readonly bytes: Uint8Array;
-  readonly maxBytes: number;
+  readonly prepared: PreparedTemplateAttachment;
   readonly templateId: string;
   readonly key: string;
-  readonly fileName: string;
 }): Promise<WriteResult<StoredTemplateAttachment>> {
-  const { ctx, user, tenantId, bytes, maxBytes, templateId, key, fileName } = args;
-  const inspected = inspectAttachmentBytes(bytes, maxBytes);
-  if ("failure" in inspected) return inspected.failure;
-  const { type } = inspected;
-
-  const { db, streamTenantId } = requireForTenant(ctx, tenantId);
-  const row = await fetchOne<TemplateResourceRow>(db, templateResourcesTable, {
-    tenantId,
-    id: templateId,
-  });
-  if (row === undefined) return writeFailure(new NotFoundError("template-resource", templateId));
-  if (row.kind !== "mail") return attachmentNeedsMailTemplate();
-
-  const linked = parseLinkedResourceEntries(row.linkedResources);
-  if (otherAttachmentCount(linked, key) >= MAX_FILE_ATTACHMENTS_PER_TEMPLATE) {
-    return attachmentLimitFailure();
-  }
+  const { ctx, user, tenantId, prepared, templateId, key } = args;
+  const target = await checkAttachmentTarget({ ctx, tenantId, templateId, key });
+  if (!target.isSuccess) return target;
+  const { row, linked } = target.data;
 
-  const created = await createAttachmentFileRef({ ctx, user, tenantId, bytes, key, type });
+  const created = await createFileRefFromPrepared({ ctx, user, tenantId }, prepared.upload);
   if (!created.isSuccess) return created;
 
-  const entry: LinkedResourceEntry = { kind: "file", fileRefId: created.data.id, fileName };
+  const entry: LinkedResourceEntry = {
+    kind: "file",
+    fileRefId: created.data.id,
+    fileName: prepared.fileName,
+  };
+  const { db, streamTenantId } = requireForTenant(ctx, tenantId);
   const updated = await executor.update(
     {
       id: row.id,
@@ -327,9 +588,9 @@ export async function storeTemplateAttachment(args: {
     data: {
       fileRefId: created.data.id,
       key,
-      fileName,
-      contentType: type.contentType,
-      size: bytes.length,
+      fileName: prepared.fileName,
+      contentType: prepared.contentType,
+      size: prepared.size,
     },
   };
 }
@@ -384,7 +645,12 @@ export async function linkTemplatePdfAttachment(args: {
   const visibleTemplates = await selectMany<TemplateResourceRow>(
     db,
     templateResourcesTable,
-    { tenantId: [tenantId, SYSTEM_TENANT_ID], slug: link.data.templateSlug, kind: "document-pdf" },
+    {
+      tenantId: [tenantId, SYSTEM_TENANT_ID],
+      slug: link.data.templateSlug,
+      kind: "document-pdf",
+      status: ACTIVE_TEMPLATE_STATUS,
+    },
     { limit: 1 },
   );
   if (visibleTemplates.length === 0) {

package/packages/bundled-features/src/template-resolver/template-bundle.ts

@@ -5,6 +5,7 @@ import { templatePdfAttachmentLinkSchema } from "./linked-resources.js";
 import { templateSlugSchema } from "./template-meta.js";
 
 const MAX_RESOURCES = 20;
+const MAX_LOCALES = 50;
 const MAX_RESOURCE_BYTES = 2 * 1024 * 1024;
 const MAX_BASE64_LENGTH = Math.ceil(MAX_RESOURCE_BYTES / 3) * 4;
 
@@ -52,6 +53,9 @@ export const templateBundleSchema = z
       .record(bundleLocaleSchema, bundleLocaleEntrySchema)
       .refine((locales) => Object.keys(locales).length >= 1, {
         message: "a bundle needs at least one locale",
+      })
+      .refine((locales) => Object.keys(locales).length <= MAX_LOCALES, {
+        message: `a bundle holds at most ${MAX_LOCALES} locales`,
       }),
     resources: z
       .record(

package/packages/bundled-features/src/template-resolver/template-draft.ts

@@ -57,7 +57,7 @@ export type ActiveInfo = { readonly version: number; readonly since: Temporal.In
 export type WorkingRow = TemplateResourceRow & { readonly active: ActiveInfo | null };
 
 // A SystemAdmin edits system rows, so for them those rows count as their own.
-function isSystemAdmin(user: { readonly roles: readonly string[] }): boolean {
+export function isSystemAdmin(user: { readonly roles: readonly string[] }): boolean {
   return user.roles.includes("SystemAdmin");
 }
 

package/packages/bundled-features/src/template-resolver/template-meta.ts

@@ -5,6 +5,7 @@ import {
   PDF_PAGE_FORMATS,
   type TemplateKind,
 } from "./constants.js";
+import { MAIL_TONES, type MailTone } from "./mail-constants.js";
 
 // One or more kebab segments joined by ":" — notification templates are seeded
 // under their qualified name `feature:notify:name`.
@@ -20,6 +21,8 @@ export const templateSlugSchema = z
 export const MAIL_CATEGORIES = ["transactional", "marketing"] as const;
 export type MailCategory = (typeof MAIL_CATEGORIES)[number];
 
+export { MAIL_TONES, type MailTone };
+
 // Header values: a CR/LF would let an author inject extra mail headers.
 const singleLine = (max: number) =>
   z
@@ -44,6 +47,11 @@ const mailMetaSchema = z.preprocess(
       category: z.enum(MAIL_CATEGORIES).optional(),
       senderName: singleLine(80).min(1).optional(),
       replyTo: singleLine(254).pipe(z.email()).optional(),
+      // Placeholder lines like the subject. The tone renders to a MAIL_TONES member;
+      // anything else falls back to the accent tone.
+      headerChip: singleLine(80).optional(),
+      tone: singleLine(80).optional(),
+      footerNote: singleLine(300).optional(),
     })
     .strict(),
 );