feat(email): headless authoring — projection, lens on the row, rule surface, scope hooks

[agreenspan]

Stacked on #96 (→ #91 → #74). Headless only: no forms, no components.

The vocabulary this PR implements (rulings 2026-09-09)

• Projection — what the system provides: a synthetic-root lens (EmailRuleContext → recipient, sender, data) over the field map, no narrowing of its own; the space a lens is built from. Today the whole map; it must become what the authoring actor's perspective can reach (COMM-012 §1).
• Lens — a lens has a starting point. Each slot on the row is its own lens, built from the projection by choosing an entry point and then relations: recipient (entry fixed at User), sender (entry = the sender model), data (entry chosen by the author, lens.data.model; with none chosen it is the unknown bag — a Json root addressable at any depth, validated as beneath-Json, a warning never a rejection). EmailTemplate.lens holds the three, authored on the default-tier row, inherited through the cascade.
• Surface — exposedSurface(lens): what the builder receives. Never carries a where; the floor is bound from the sender at send time and never stored.

packages/email/src/rules/emailProjection.ts: emailProjection → emailLens → emailSurface, plus emailRuleDecoration.

Commits

1. deps — rules-builder 0.27.0 (the blessed version Zealot consumes) into packages/ui; mjml-preset-core for the nesting table.
2. db — EmailTemplate.lens Json?, EmailComponent.expectations String[].
3. rules/ — projection/lens/surface/decoration + the Zealot rules layer ported (#1689/#1655/#2171): collectHydrationPaths, walkLensPath, componentExpectations (rail-provided field is system.unsubscribeUrl here), collectJsonOpacityWarnings. Component save derives expectations from the body.
4. render/ — regions.ts (collect/collapse/removeSlotOverride/slotDefaultContent), mjmlNesting.ts, and the authoring barrel (Zealot #1698/#2090).
5. api — POST /api/admin/emailTemplate/ruleSurface (superadmin; platform-level authoring for now): projection from the registry entry, narrowed by the default row's lens, plus decoration. Recipient-only for a slug the registry does not know.
6. ui — useEmailRuleSurface (fetch) and useEmailVariableScope (resolve through rules-builder, walk as a scope stack: values are tokens, to-many relations are loop portals, entering one re-anchors at the element model and wraps copied values in the enclosing {{#each}} blocks with collision-free kebab bindings — the COMM-010 builder-surface ruling).
7. COMM-012 — the adhoc-template design (demarcation, perspective, sender entry point for adhoc rows, registry picks vs the row lens, entry-from-row, the model-keyed-surface caveat) and the palette/shell plan for the forms PR.

Validation

packages/email 422/422 (rules 37, regions/nesting 26, projection 11); apps/api 1035 pass / 2 fail (the lens count-scope tests #95 fixes on main); route test 3/3; typecheck clean on db/email/api/ui; biome clean.

Not in this PR

The editor shell, variable picker, condition builder, and cascade-region list components (Zealot's ~1,400 lines of admin-dashboard React) — they consume exactly the exports and hooks landed here. Save-time lens validation for tenant saves (needs the registry, so it lands with the save endpoint). The registry-then-row entry fallback in sendEmail (COMM-012 §4).

🤖 Generated with Claude Code

https://claude.ai/code/session_01Uyo2oHpjDz4zjRyqRWH6bP