@cosmicdrift/kumiko-samples 0.365.1 → 0.367.0

package/packages/bundled-features/src/template-resolver/changes.json

@@ -1,4 +1,29 @@
 [
+  {
+    "version": "0.367.0",
+    "type": "improvement",
+    "title": "Notifications can keep their mail template system-only",
+    "detail": "r.notification(name, { systemOnly: true }) marks the stored mail template as a platform text. Tenant admins no longer see it in the template overview, list or detail, and creating a tenant version (upsert-tenant, copy-locale, import-bundle, also a SystemAdmin writing for a tenant) is refused with access_denied and templateResolver.errors.systemOnlyTemplate. SystemAdmins edit the system template as before, and the mail renderer always uses it, even if a tenant row exists from before."
+  },
+  {
+    "version": "0.367.0",
+    "type": "fix",
+    "title": "Rich text placeholders no longer nest paragraphs",
+    "detail": "A richText placeholder alone in a paragraph compiles into a div that keeps the paragraph attributes, and one inside other text renders inline with line breaks instead of its own paragraphs. Mails and PDFs no longer contain <p><p>. richText and stepIs are now reserved template variable names, like the other renderer helpers.",
+    "migration": "A notification that declares a template variable called richText, stepIs or percent fails at boot; rename the variable."
+  },
+  {
+    "version": "0.367.0",
+    "type": "improvement",
+    "title": "Template bundles with a logo can be seeded",
+    "detail": "seedSystemTemplateBundle(db, bundle, { dispatcher }) now seeds bundles that carry resources such as a logo by running the import-bundle-system write on the given seed dispatcher. With ifExists \"skip\" (default) nothing is written when every locale row already exists; if only some exist, the whole bundle is imported again. Without a dispatcher such a bundle still fails with a message that names the missing option."
+  },
+  {
+    "version": "0.367.0",
+    "type": "improvement",
+    "title": "Template conditions with data-if and a percent variable type",
+    "detail": "A paragraph, heading or table row with data-if=\"name\" renders only when the variable has a value (0 counts as a value); inside a repeat row the name refers to the row field, on the repeat row itself to the root variable. The sanitizer keeps the attribute, and template validation reports a condition on an undeclared variable. New variable type percent (templateVariable.percent()) takes percentage points and renders locale-aware, 12 as \"12 %\" in German and \"12%\" in English; the preview uses its example value. The document designer has no toolbar control for conditions yet; the attribute survives editing."
+  },
   {
     "version": "0.365.0",
     "type": "breaking",

package/packages/bundled-features/src/template-resolver/compile-document-body.ts

@@ -3,8 +3,9 @@ import { isOneOf } from "@cosmicdrift/kumiko-types/type-guards";
 import type { Element as ScanElement } from "happy-dom";
 import { isResourceImageContentType } from "../shared/index.js";
 import { rewriteStepsBlock } from "./compile-steps-block.js";
-import { withParsedDocument } from "./document-sanitizer.js";
+import { conditionScopeElement, withParsedDocument } from "./document-sanitizer.js";
 import {
+  DOCUMENT_CONDITION_ATTRIBUTE,
   DOCUMENT_TEXT_ALIGNMENTS,
   isAllowedDocumentLinkHref,
   isDocumentPlaceholderHref,
@@ -25,6 +26,8 @@ type RowScope = { readonly listName: string; readonly itemFields: TemplateVariab
 type CompileState = {
   readonly variables: TemplateVariables;
   readonly expressions: string[];
+  // richText spans that fill a whole block; their value brings its own paragraphs.
+  readonly blockRichTextSpans: Set<ScanElement>;
 };
 
 function marker(state: CompileState, expression: string): string {
@@ -59,10 +62,19 @@ function resolveReference(
   return { path: scope === null ? name : `@root.${name}`, def: ownVariable(variables, name) };
 }
 
-function valueExpression(path: string, def: TemplateVariableDef | undefined): string {
+// The sanitized rich text value always consists of blocks; inside a line of
+// other text it renders inline so no paragraph ends up inside a paragraph.
+function valueExpression(
+  path: string,
+  def: TemplateVariableDef | undefined,
+  isWholeBlock: boolean,
+): string {
   if (def?.type === "money") return `{{money ${path}}}`;
   if (def?.type === "date") return `{{date ${path}}}`;
-  if (def?.type === "richText") return `{{richText ${path}}}`;
+  if (def?.type === "percent") return `{{percent ${path}}}`;
+  if (def?.type === "richText") {
+    return isWholeBlock ? `{{richText ${path}}}` : `{{richText ${path} inline=true}}`;
+  }
   return `{{${path}}}`;
 }
 
@@ -70,7 +82,13 @@ function rewriteVariable(element: ScanElement, state: CompileState): void {
   const name = element.getAttribute("data-variable") ?? "";
   const replacement = element.ownerDocument.createTextNode(
     isDocumentReferenceName(name)
-      ? marker(state, valueExpression(...pathAndDef(name, element, state)))
+      ? marker(
+          state,
+          valueExpression(
+            ...pathAndDef(name, element, state),
+            state.blockRichTextSpans.has(element),
+          ),
+        )
       : "",
   );
   element.replaceWith(replacement);
@@ -112,10 +130,27 @@ function wrapVariableOnlyBlock(block: ScanElement, state: CompileState): void {
   const name = soleVariableName(block);
   // skip: a line with static content or several placeholders stays as it is
   if (name === null) return;
-  const [path] = pathAndDef(name, block, state);
-  const document = block.ownerDocument;
-  block.before(document.createTextNode(marker(state, `{{#if ${path} includeZero=true}}`)));
-  block.after(document.createTextNode(marker(state, "{{/if}}")));
+  const [path, def] = pathAndDef(name, block, state);
+  const host =
+    def?.type === "richText" && block.tagName === "P" ? richTextBlockHost(block, state) : block;
+  const document = host.ownerDocument;
+  host.before(document.createTextNode(marker(state, `{{#if ${path} includeZero=true}}`)));
+  host.after(document.createTextNode(marker(state, "{{/if}}")));
+}
+
+// A paragraph cannot hold the paragraphs of a rich text value, a div can; it
+// keeps the paragraph's attributes so alignment and size still apply.
+function richTextBlockHost(paragraph: ScanElement, state: CompileState): ScanElement {
+  const host = paragraph.ownerDocument.createElement("div");
+  for (const attribute of Array.from(paragraph.attributes)) {
+    host.setAttribute(attribute.name, attribute.value ?? "");
+  }
+  for (const span of Array.from(paragraph.querySelectorAll("span[data-variable]"))) {
+    state.blockRichTextSpans.add(span);
+  }
+  host.append(...Array.from(paragraph.childNodes));
+  paragraph.replaceWith(host);
+  return host;
 }
 
 function rewriteLink(element: ScanElement, state: CompileState): void {
@@ -146,6 +181,20 @@ function rewriteRepeatRow(row: ScanElement, state: CompileState): void {
   }
 }
 
+function rewriteConditionalBlock(block: ScanElement, state: CompileState): void {
+  const name = block.getAttribute(DOCUMENT_CONDITION_ATTRIBUTE) ?? "";
+  block.removeAttribute(DOCUMENT_CONDITION_ATTRIBUTE);
+  if (!isDocumentReferenceName(name)) {
+    block.remove();
+    // skip: a condition on a name that cannot be a variable never shows
+    return;
+  }
+  const [path] = pathAndDef(name, conditionScopeElement(block), state);
+  const document = block.ownerDocument;
+  block.before(document.createTextNode(marker(state, `{{#if ${path} includeZero=true}}`)));
+  block.after(document.createTextNode(marker(state, "{{/if}}")));
+}
+
 function stripActiveContent(element: ScanElement): void {
   for (const attribute of Array.from(element.attributes)) {
     if (/^on/i.test(attribute.name)) element.removeAttribute(attribute.name);
@@ -311,7 +360,7 @@ export function compileDocumentBodyToHandlebars(
   variables: TemplateVariables,
   options: CompileDocumentBodyOptions = {},
 ): string {
-  const state: CompileState = { variables, expressions: [] };
+  const state: CompileState = { variables, expressions: [], blockRichTextSpans: new Set() };
   const scrubbed = html.replaceAll(EXPRESSION_OPEN, "").replaceAll(EXPRESSION_CLOSE, "");
   const compiled = withParsedDocument(scrubbed, (root) => {
     stripScriptsAndActiveContent(root, options);
@@ -325,6 +374,9 @@ export function compileDocumentBodyToHandlebars(
         color: options.stepsColor,
       });
     }
+    for (const block of Array.from(root.querySelectorAll(`[${DOCUMENT_CONDITION_ATTRIBUTE}]`))) {
+      rewriteConditionalBlock(block, state);
+    }
     for (const block of Array.from(root.querySelectorAll(VARIABLE_ONLY_BLOCK_SELECTOR))) {
       wrapVariableOnlyBlock(block, state);
     }

package/packages/bundled-features/src/template-resolver/document-sanitizer.ts

@@ -7,6 +7,7 @@ import { type Element as ScanElement, Window } from "happy-dom";
 import type { ContentFormat } from "./constants.js";
 import { DOCUMENT_HTML_KINDS } from "./constants.js";
 import {
+  DOCUMENT_CONDITION_ATTRIBUTE,
   documentExtensions,
   isAllowedDocumentLinkHref,
   isDocumentPlaceholderHref,
@@ -138,6 +139,7 @@ function scanImage(element: ScanElement, out: DocumentViolation[]): void {
 const REFERENCE_ATTRIBUTES: ReadonlyArray<readonly [string, (value: string) => boolean]> = [
   ["data-variable", isDocumentReferenceName],
   ["data-each", isDocumentReferenceName],
+  [DOCUMENT_CONDITION_ATTRIBUTE, isDocumentReferenceName],
   ["data-resource", isDocumentResourceKey],
   ["data-steps", isDocumentReferenceName],
   ["data-step", isDocumentStepKey],
@@ -270,6 +272,17 @@ export function sanitizeDocumentHtml(html: string): SanitizeHtmlResult {
   };
 }
 
+// For a sanitized value placed inside a line of text: paragraphs become line
+// breaks. Other blocks (lists, headings) cannot be made inline and stay as they are.
+export function flattenParagraphsToLineBreaks(sanitizedHtml: string): string {
+  return withParsedDocument(sanitizedHtml, (body) => {
+    const blocks = Array.from(body.children);
+    const isParagraphsOnly =
+      blocks.length === body.childNodes.length && blocks.every((block) => block.tagName === "P");
+    return isParagraphsOnly ? blocks.map((block) => block.innerHTML).join("<br>") : sanitizedHtml;
+  });
+}
+
 // Snippets accept any format, but their html is as untrusted as a mail body.
 function isSanitizedHtmlKind(kind: string): boolean {
   return kind === "snippet" || isOneOf(DOCUMENT_HTML_KINDS, kind);
@@ -336,3 +349,9 @@ export function documentViolationsToFieldIssues(
     params: { detail: item.detail },
   }));
 }
+
+// A repeat row's own data-if is decided per list, outside the row's item scope,
+// because the compiled {{#if}} lands outside its {{#each}}.
+export function conditionScopeElement(block: ScanElement): ScanElement {
+  return block.matches("tr[data-each]") ? (block.parentElement ?? block) : block;
+}

package/packages/bundled-features/src/template-resolver/document-schema.ts

@@ -314,6 +314,38 @@ export const DocumentTextSize = Extension.create({
   },
 });
 
+// A block shown only when the named variable has a value (data-if, the
+// conditional counterpart of data-each). Table rows qualify so an invoice can
+// drop a discount line; tiptap merges the attribute into paragraph, heading
+// and row markup only.
+export const DOCUMENT_CONDITION_ATTRIBUTE = "data-if";
+
+export const DocumentCondition = Extension.create({
+  name: "documentCondition",
+  addGlobalAttributes() {
+    return [
+      {
+        types: ["paragraph", "heading", "tableRow"],
+        attributes: {
+          showIf: {
+            default: null,
+            parseHTML: (element) => {
+              const name = element.getAttribute(DOCUMENT_CONDITION_ATTRIBUTE);
+              return name !== null && isDocumentReferenceName(name) ? name : null;
+            },
+            renderHTML: (attributes) => {
+              const name: unknown = attributes["showIf"];
+              return typeof name === "string" && isDocumentReferenceName(name)
+                ? { [DOCUMENT_CONDITION_ATTRIBUTE]: name }
+                : {};
+            },
+          },
+        },
+      },
+    ];
+  },
+});
+
 export const documentExtensions: Extensions = [
   StarterKit.configure({
     blockquote: false,
@@ -348,4 +380,5 @@ export const documentExtensions: Extensions = [
   DocumentSteps,
   DocumentTextAlign,
   DocumentTextSize,
+  DocumentCondition,
 ];

package/packages/bundled-features/src/template-resolver/feature.ts

@@ -99,12 +99,12 @@ export function createTemplateResolverFeature(opts: TemplateResolverOptions = {}
         resourceMaxBytes: createSystemConfig("number", { default: 2_097_152, bounds: { min: 1 } }),
       },
     });
-    r.entity("template-resource", templateResourceEntity);
+    r.entity({ name: "template-resource", ...templateResourceEntity });
     // Only when the app actually mounts a user-owned collection: the entity's
     // `content` is `userOwned`, which makes it subject data — the boot guard
     // then requires an EXT_USER_DATA hook (mount `template-resolver-user-data`).
     // Registering it unconditionally would impose that on every app.
-    if (hasUserOwned) r.entity("user-content-entry", userContentEntryEntity);
+    if (hasUserOwned) r.entity({ name: "user-content-entry", ...userContentEntryEntity });
 
     const handlers = {
       upsertSystem: r.writeHandler(upsertSystemWrite),

package/packages/bundled-features/src/template-resolver/handlers/bundle-import.ts

@@ -32,6 +32,7 @@ import { resolveTemplateVariables } from "../template-validation.js";
 import { MAX_FILE_ATTACHMENTS_PER_TEMPLATE } from "./resource-shared.js";
 import { evaluateTemplateWrite } from "./template-gates.js";
 import {
+  refuseSystemOnlyTenantOverride,
   refuseTenantScopeUnderSystemTenant,
   type TemplateRowPayload,
   writeTemplateRow,
@@ -113,7 +114,14 @@ function checkBundleAttachments(bundle: TemplateBundle): WriteResult<null> {
 export async function prepareTemplateBundleBeforeTransaction(
   args: BundleImport & { readonly status: BundleImportStatus },
 ): Promise<BeforeTransactionResult<PreparedBundleResources>> {
-  const refused = refuseTenantScopeUnderSystemTenant(args.scope, args.tenantId);
+  const refused =
+    refuseTenantScopeUnderSystemTenant(args.scope, args.tenantId) ??
+    refuseSystemOnlyTenantOverride(
+      args.ctx.registry,
+      args.scope,
+      args.bundle.slug,
+      args.bundle.kind,
+    );
   if (refused !== null) return refused;
   const issues = await collectBundleIssues(args, args.status);
   if (issues.length > 0) return writeFailure(new ValidationError({ fields: [...issues] }));

package/packages/bundled-features/src/template-resolver/handlers/copy-locale.write.ts

@@ -30,7 +30,11 @@ import { resolveTemplateVariables } from "../template-validation.js";
 import { targetExistsIssue } from "./bundle-import.js";
 import { kindSchema, localeSchema, templateSlugSchema } from "./shared.js";
 import { parseStoredJson, storedRecord } from "./template-gates.js";
-import { refuseTenantScopeUnderSystemTenant, writeTemplateRow } from "./template-write.js";
+import {
+  refuseSystemOnlyTenantOverride,
+  refuseTenantScopeUnderSystemTenant,
+  writeTemplateRow,
+} from "./template-write.js";
 
 type CopyScope = "tenant" | "system";
 type WriteCtx = HandlerContext;
@@ -108,7 +112,9 @@ async function checkCopyRequest(
     );
   }
   const tenantId = scope === "system" ? SYSTEM_TENANT_ID : event.user.tenantId;
-  const refused = refuseTenantScopeUnderSystemTenant(scope, tenantId);
+  const refused =
+    refuseTenantScopeUnderSystemTenant(scope, tenantId) ??
+    refuseSystemOnlyTenantOverride(ctx.registry, scope, slug, kind);
   if (refused !== null) return refused;
 
   const readDb = readDbFor(ctx, scope);

package/packages/bundled-features/src/template-resolver/handlers/find-by-id.query.ts

@@ -3,6 +3,7 @@ import { defineQueryHandler } from "@cosmicdrift/kumiko-framework/engine";
 import * as z from "zod";
 import { type TemplateResourceRow, templateResourcesTable } from "../table.js";
 import { draftViewerTenantId, isHiddenSystemDraft, toWorkingRow } from "../template-draft.js";
+import { isSystemOnlyTemplateHiddenFrom } from "../template-system-only.js";
 
 // Admin-Lookup für UI-Edit-Flow. Returnt das raw Template inkl. draft/
 // archived Status. Tenant-Isolation: User sieht nur Templates des
@@ -19,7 +20,13 @@ export const findByIdQuery = defineQueryHandler({
     const stored = await fetchOne<TemplateResourceRow>(ctx.db, templateResourcesTable, {
       id: query.payload.id,
     });
-    if (!stored || isHiddenSystemDraft(query.user, stored)) return null;
+    if (
+      !stored ||
+      isHiddenSystemDraft(query.user, stored) ||
+      isSystemOnlyTemplateHiddenFrom(query.user, ctx.registry, stored)
+    ) {
+      return null;
+    }
     const row = toWorkingRow(stored, draftViewerTenantId(query.user, stored));
     const isOwnTenant = row.tenantId === query.user.tenantId;
     const isSystemTemplate = row.scope === "system";

package/packages/bundled-features/src/template-resolver/handlers/list.query.ts

@@ -4,6 +4,7 @@ import * as z from "zod";
 import { TEMPLATE_KINDS, TEMPLATE_STATUSES } from "../constants.js";
 import { type TemplateResourceRow, templateResourcesTable } from "../table.js";
 import { isHiddenSystemDraft } from "../template-draft.js";
+import { isSystemOnlyTemplateHiddenFrom } from "../template-system-only.js";
 
 // ctx.db is tenant-scoped even for SystemAdmin: every caller sees its own
 // tenant's rows plus the system defaults, never another tenant's rows.
@@ -45,7 +46,11 @@ export const listQuery = defineQueryHandler({
     })) as TemplateResourceRow[];
 
     return rows
-      .filter((row) => !isHiddenSystemDraft(query.user, row))
+      .filter(
+        (row) =>
+          !isHiddenSystemDraft(query.user, row) &&
+          !isSystemOnlyTemplateHiddenFrom(query.user, ctx.registry, row),
+      )
       .map((row) => ({
         id: String(row.id),
         tenantId: row.tenantId,

package/packages/bundled-features/src/template-resolver/handlers/overview.query.ts

@@ -11,6 +11,7 @@ import {
   parseTemplateDraft,
   servedVersionOf,
 } from "../template-draft.js";
+import { isSystemOnlyTemplateHiddenFrom } from "../template-system-only.js";
 import { collectTemplateUsage, type EffectiveMailLayoutSlugs } from "../template-usage.js";
 import { storedRecord } from "./template-gates.js";
 
@@ -284,7 +285,7 @@ export const overviewQuery = defineQueryHandler({
   }),
   access: { roles: ["TenantAdmin", "SystemAdmin"] },
   description:
-    "Lists mail, PDF and layout templates as one row per slug and kind for the caller's tenant (optionally only the mails and PDFs using one layout slug): where the effective version comes from (own override or system), its locales, status and version (the served one; `draftVersion` is set when an unpublished draft waits beside it, `activeSince` says since when the served version applies), the system version it overrides, the layout it uses and which notifications or templates use it; use it to browse and filter all templates at a glance.",
+    "Lists mail, PDF and layout templates as one row per slug and kind for the caller's tenant (optionally only the mails and PDFs using one layout slug): where the effective version comes from (own override or system), its locales, status and version (the served one; `draftVersion` is set when an unpublished draft waits beside it, `activeSince` says since when the served version applies), the system version it overrides, the layout it uses and which notifications or templates use it; templates of notifications registered with `systemOnly` are listed for SystemAdmins only; use it to browse and filter all templates at a glance.",
   handler: async (query, ctx) => {
     const payload = query.payload;
     const fetchedRows = await selectMany<TemplateResourceRow>(
@@ -301,7 +302,11 @@ export const overviewQuery = defineQueryHandler({
       });
     }
 
-    const visibleRows = rows.filter((row) => !isHiddenSystemDraft(query.user, row));
+    const visibleRows = rows.filter(
+      (row) =>
+        !isHiddenSystemDraft(query.user, row) &&
+        !isSystemOnlyTemplateHiddenFrom(query.user, ctx.registry, row),
+    );
     const { drafts, layoutSlugByDocument } = buildDrafts(
       groupBySlugAndKind(visibleRows),
       query.user,

package/packages/bundled-features/src/template-resolver/handlers/template-write.ts

@@ -1,6 +1,7 @@
 import { fetchOne } from "@cosmicdrift/kumiko-framework/bun-db";
 import {
   type HandlerContext,
+  type Registry,
   type SessionUser,
   SYSTEM_TENANT_ID,
   type TemplateVariables,
@@ -16,8 +17,10 @@ import {
 import { requireForTenant } from "../../shared/index.js";
 import type { ContentFormat, TemplateKind } from "../constants.js";
 import type { TemplateWriteScope } from "../layout-regions.js";
+import { TemplateResolverErrors } from "../qualified-names.js";
 import { type TemplateResourceRow, templateResourcesTable } from "../table.js";
 import { activationChanges, serializeTemplateDraft } from "../template-draft.js";
+import { isSystemOnlyTemplate } from "../template-system-only.js";
 import type { TemplateValidation } from "../template-validation.js";
 import { executor } from "./shared.js";
 import {
@@ -71,6 +74,21 @@ export function refuseTenantScopeUnderSystemTenant(
   );
 }
 
+export function refuseSystemOnlyTenantOverride(
+  registry: Registry,
+  scope: TemplateWriteScope,
+  slug: string,
+  kind: string,
+): WriteFailure | null {
+  if (scope !== "tenant" || !isSystemOnlyTemplate(registry, slug, kind)) return null;
+  return writeFailure(
+    new AccessDeniedError({
+      i18nKey: "templateResolver.errors.systemOnlyTemplate",
+      details: { reason: TemplateResolverErrors.systemOnlyTemplate },
+    }),
+  );
+}
+
 export type GatedTemplateWrite =
   | { readonly ok: true; readonly evaluated: Extract<TemplateWriteResult, { ok: true }> }
   | { readonly ok: false; readonly failure: WriteFailure };
@@ -141,7 +159,9 @@ export async function writeTemplateRow(
   args: TemplateRowWrite,
 ): Promise<WriteResult<WrittenTemplateRow>> {
   const { ctx, user, tenantId, scope, status, payload } = args;
-  const refused = refuseTenantScopeUnderSystemTenant(scope, tenantId);
+  const refused =
+    refuseTenantScopeUnderSystemTenant(scope, tenantId) ??
+    refuseSystemOnlyTenantOverride(ctx.registry, scope, payload.slug, payload.kind);
   if (refused !== null) return refused;
   const { db, streamTenantId } = requireForTenant(ctx, tenantId);
 

package/packages/bundled-features/src/template-resolver/index.ts

@@ -46,15 +46,18 @@ export {
   type DocumentViolation,
   type DocumentViolationCode,
   documentViolationsToFieldIssues,
+  flattenParagraphsToLineBreaks,
   type SanitizeBodyResult,
   type SanitizeHtmlResult,
   sanitizeDocumentHtml,
   sanitizeTemplateBody,
 } from "./document-sanitizer.js";
 export {
+  DOCUMENT_CONDITION_ATTRIBUTE,
   DOCUMENT_NODE_NAMES,
   DOCUMENT_TEXT_ALIGNMENTS,
   DocumentButton,
+  DocumentCondition,
   DocumentDivider,
   DocumentLink,
   DocumentPageBreak,
@@ -144,6 +147,7 @@ export {
 } from "./template-meta.js";
 export { type DocumentDraftOutcome, evaluateDocumentDraft } from "./template-preview.js";
 export { readTemplateResource, type TemplateResourceFile } from "./template-resources.js";
+export { isSystemOnlyTemplate } from "./template-system-only.js";
 export { collectTemplateUsage, type TemplateUsageEntry } from "./template-usage.js";
 export {
   hasPlaceholderProblems,

package/packages/bundled-features/src/template-resolver/qualified-names.ts

@@ -60,6 +60,7 @@ export const TemplateResolverErrors = {
   alreadyArchived: "template_already_archived",
   targetExists: "target_exists",
   systemResourcesNeedSystemTenant: "system_resources_need_system_tenant",
+  systemOnlyTemplate: "system_only_template",
   bundleLocalesDiffer: "bundle_locales_differ",
   resourceTooLarge: "template_resource_too_large",
   resourceUnsupportedImage: "template_resource_unsupported_image",

package/packages/bundled-features/src/template-resolver/seeding.ts

@@ -28,11 +28,13 @@ import {
   getStreamVersion,
   getUnscopedStreamMaxVersionForSeed,
 } from "@cosmicdrift/kumiko-framework/event-store";
+import type { Dispatcher } from "@cosmicdrift/kumiko-framework/pipeline";
 import { runEventStoreSeed, type SeedIfExists } from "@cosmicdrift/kumiko-framework/seeding";
+import { isPlainObject } from "@cosmicdrift/kumiko-types/type-guards";
 import { type ContentFormat, TEXT_BLOCK_KIND, type UpsertKind } from "./constants.js";
 import { executor } from "./handlers/shared.js";
 import { evaluateTemplateWrite } from "./handlers/template-gates.js";
-import { TEMPLATE_RESOLVER_FEATURE } from "./qualified-names.js";
+import { TEMPLATE_RESOLVER_FEATURE, TemplateResolverHandlers } from "./qualified-names.js";
 import { type TemplateResourceRow, templateResourcesTable } from "./table.js";
 import type { TemplateBundle } from "./template-bundle.js";
 import { activeStampChanges, servedStampChanges } from "./template-draft.js";
@@ -233,20 +235,21 @@ export async function seedSystemTemplate(
 export type SeedSystemTemplateBundleOptions = {
   readonly by?: SessionUser;
   readonly ifExists?: SeedIfExists;
+  /** Required for bundles with resources (e.g. a `logo`): the files go through the
+   *  import-bundle-system write, which needs the file provider of the system tenant. */
+  readonly dispatcher?: Dispatcher;
 };
 
-// Seeds one system row per bundle locale. Bundled resources need a file
-// provider and the system tenant's file space, which a boot seed does not
-// have, so those go through the import-bundle-system write instead.
+// Seeds one system row per bundle locale. Bundled resources need a file provider and
+// the system tenant's file space, so those bundles are written through the
+// import-bundle-system handler on the seed dispatcher instead of directly.
 export async function seedSystemTemplateBundle(
   db: DbConnection,
   bundle: TemplateBundle,
   opts: SeedSystemTemplateBundleOptions = {},
 ): Promise<{ ids: Record<string, string> }> {
   if (Object.keys(bundle.resources).length > 0) {
-    throw new Error(
-      `seedSystemTemplateBundle ${bundle.slug}/${bundle.kind}: bundles with resources cannot be seeded; use the import-bundle-system write`,
-    );
+    return seedSystemTemplateBundleWithResources(db, bundle, opts);
   }
   const ids: Record<string, string> = {};
   for (const [locale, entry] of Object.entries(bundle.locales)) {
@@ -266,6 +269,50 @@ export async function seedSystemTemplateBundle(
   return { ids };
 }
 
+async function seedSystemTemplateBundleWithResources(
+  db: DbConnection,
+  bundle: TemplateBundle,
+  opts: SeedSystemTemplateBundleOptions,
+): Promise<{ ids: Record<string, string> }> {
+  const label = `seedSystemTemplateBundle ${bundle.slug}/${bundle.kind}`;
+  const { dispatcher } = opts;
+  if (!dispatcher) {
+    throw new Error(
+      `${label}: bundles with resources need a file provider; pass opts.dispatcher (the dispatcher of the seed deps) so the files are stored through the import-bundle-system write`,
+    );
+  }
+  if ((opts.ifExists ?? "skip") === "skip") {
+    const existingIds: Record<string, string> = {};
+    for (const locale of Object.keys(bundle.locales)) {
+      const row = await fetchOne<TemplateResourceRow>(db, templateResourcesTable, {
+        tenantId: SYSTEM_TENANT_ID,
+        slug: bundle.slug,
+        kind: bundle.kind,
+        locale,
+      });
+      if (row) existingIds[locale] = String(row.id);
+    }
+    if (Object.keys(existingIds).length === Object.keys(bundle.locales).length) {
+      return { ids: existingIds };
+    }
+  }
+  const result = await dispatcher.write(
+    TemplateResolverHandlers.importBundleSystem,
+    { bundle },
+    opts.by ?? createSystemUser(SYSTEM_TENANT_ID, ["SystemAdmin"]),
+  );
+  if (!result.isSuccess) {
+    throw new Error(`${label} failed: ${result.error.code}: ${result.error.message}`);
+  }
+  return { ids: importedIds(result.data) };
+}
+
+function importedIds(data: unknown): Record<string, string> {
+  const ids = isPlainObject(data) ? data["ids"] : undefined;
+  if (!isPlainObject(ids)) throw new Error("seedSystemTemplateBundle: import returned no ids");
+  return Object.fromEntries(Object.entries(ids).map(([locale, id]) => [locale, String(id)]));
+}
+
 export function hasNotificationTemplates(registry: Registry): boolean {
   return Array.from(registry.getAllNotifications().values()).some(
     (notification) => notification.template !== undefined,

package/packages/bundled-features/src/template-resolver/template-preview.ts

@@ -69,6 +69,8 @@ function sampleScalar(name: string, def: TemplateScalarVariableDef): unknown {
       return 0;
     case "date":
       return SAMPLE_DATE;
+    case "percent":
+      return 0;
   }
 }
 

package/packages/bundled-features/src/template-resolver/template-system-only.ts

@@ -0,0 +1,21 @@
+import type { Registry } from "@cosmicdrift/kumiko-framework/engine";
+import { isSystemAdmin } from "./template-draft.js";
+
+const NOTIFICATION_TEMPLATE_KIND = "mail";
+
+// A notification registered with systemOnly keeps its mail template as the system default:
+// tenants neither list nor override it, and overrides stored before the flag are ignored.
+export function isSystemOnlyTemplate(registry: Registry, slug: string, kind: string): boolean {
+  return (
+    kind === NOTIFICATION_TEMPLATE_KIND &&
+    registry.getAllNotifications().get(slug)?.systemOnly === true
+  );
+}
+
+export function isSystemOnlyTemplateHiddenFrom(
+  user: { readonly roles: readonly string[] },
+  registry: Registry,
+  row: { readonly slug: string; readonly kind: string },
+): boolean {
+  return !isSystemAdmin(user) && isSystemOnlyTemplate(registry, row.slug, row.kind);
+}