@cosmicdrift/kumiko-bundled-features 0.178.1 → 0.181.0

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@cosmicdrift/kumiko-bundled-features",
-  "version": "0.178.1",
+  "version": "0.181.0",
   "description": "Built-in features — tenant, user, auth, delivery. The stuff you'd rewrite anyway, already typed.",
   "license": "BUSL-1.1",
   "author": "Marc Frost <marc@cosmicdriftgamestudio.com>",
@@ -45,6 +45,7 @@
     "./notes-history": "./src/notes-history/index.ts",
     "./notes-history/web": "./src/notes-history/web/index.ts",
     "./notes-history-user-data": "./src/notes-history-user-data/index.ts",
+    "./template-resolver-user-data": "./src/template-resolver-user-data/index.ts",
     "./folders-user-data": "./src/folders-user-data/index.ts",
     "./ledger": "./src/ledger/index.ts",
     "./ledger/web": "./src/ledger/web/index.ts",
@@ -120,12 +121,12 @@
     "./step-dispatcher": "./src/step-dispatcher/index.ts"
   },
   "dependencies": {
-    "@cosmicdrift/kumiko-dispatcher-live": "0.178.1",
-    "@cosmicdrift/kumiko-framework": "0.178.1",
-    "@cosmicdrift/kumiko-headless": "0.178.1",
-    "@cosmicdrift/kumiko-renderer": "0.178.1",
-    "@cosmicdrift/kumiko-renderer-web": "0.178.1",
-    "@cosmicdrift/kumiko-types": "0.178.1",
+    "@cosmicdrift/kumiko-dispatcher-live": "0.181.0",
+    "@cosmicdrift/kumiko-framework": "0.181.0",
+    "@cosmicdrift/kumiko-headless": "0.181.0",
+    "@cosmicdrift/kumiko-renderer": "0.181.0",
+    "@cosmicdrift/kumiko-renderer-web": "0.181.0",
+    "@cosmicdrift/kumiko-types": "0.181.0",
     "@mollie/api-client": "^4.5.0",
     "imapflow": "^1.3.3",
     "mailparser": "^3.9.8",

package/src/ledger/entity.ts

@@ -1,7 +1,7 @@
 import {
   createDateField,
+  createEmbeddedListField,
   createEntity,
-  createJsonbField,
   createNumberField,
   createSelectField,
   createTextField,
@@ -27,7 +27,7 @@ export const accountEntity = createEntity({
 });
 
 // transaction — a journal entry. The balanced posting lines live embedded as
-// `lines` (jsonb: { accountId, amount }[], Σ amount = 0), so an entry is atomic:
+// `lines` (embedded list: { accountId, amount }[], Σ amount = 0), so an entry is atomic:
 // the Σ=0 invariant holds within a single command, no cross-row write. The
 // framework projects `read_ledger_transactions`; Phase 1 adds a flat
 // `read_ledger_postings` projection (one row per line) for per-account/period
@@ -50,7 +50,19 @@ export const transactionEntity = createEntity({
     // For a Storno entry this points at the reversed transaction's id.
     reference: createTextField({ maxLength: 120 }),
     status: createSelectField({ options: TRANSACTION_STATUS, required: true }),
-    lines: createJsonbField(),
+    // Posting lines are born with the entry and never change on their own —
+    // a correction is a new (reversing) entry. The embedded list validates
+    // each line's shape; `money` pins amount to signed integer minor units
+    // (the entry's currency is a book-level concern, not per line). The
+    // cross-line invariants (Σ=0, ≥2 distinct accounts) stay in
+    // createTransactionPayloadSchema.
+    lines: createEmbeddedListField(
+      {
+        accountId: { type: "text", required: true },
+        amount: { type: "money", required: true },
+      },
+      { required: true },
+    ),
   },
 });
 

package/src/template-resolver/README.md

@@ -208,9 +208,42 @@ Speichern **veröffentlicht sofort** — Status `active`, leeres `variableSchema
 Wer eine Draft-Stufe oder ein Variablen-Schema braucht, nimmt
 `upsertSystem`/`upsertTenant` + `publish`.
 
-`ownership: "user"` (jeder Enduser pflegt seine eigenen Einträge, z.B.
-Signaturen) ist im Typ vorhanden, aber noch nicht implementiert — der Mount
-wirft dann, statt still allen denselben Satz zu zeigen. Siehe #1770.
+### ownership: user vs. tenant
+
+`ownership: "tenant"` (Default) heißt: ein Satz, den alle im Tenant teilen —
+kuratierte Bausteine, AI-Prompts. `ownership: "user"` heißt: jeder Enduser
+pflegt seine eigenen Einträge — Mail-Signaturen, persönliche Antwort-Bausteine.
+
+User-owned Collections liegen in einer **eigenen Tabelle**
+(`read_user_content_entries`, Entity `user-content-entry`) mit `ownerId NOT
+NULL` und Unique-Index `(tenantId, ownerId, slug, kind, locale)`. Zwei Agents
+können damit beide eine Signatur `standard` haben.
+
+Warum nicht eine Tabelle mit nullbarer `ownerId`: das `content`-Feld dort
+trägt `userOwned` (Name, Telefonnummer, Anschrift → crypto-shredding). Diese
+Annotation wird **pro Entity** aufgelöst, nicht pro Zeile, und
+`resolveSubjectForField` wirft, wenn die Owner-Spalte leer ist — jede
+tenant-weite Mail-Template-Zeile würde beim Schreiben scheitern.
+
+Beim Mounten einer user-owned Collection sind zwei Dinge Pflicht:
+
+1. **Migration.** Die Entity kommt nur in den Schema-Diff, wenn mindestens eine
+   user-owned Collection deklariert ist. Danach in der App
+   `bunx kumiko-schema generate add-user-content` + `apply` — ohne die Tabelle
+   antwortet der Handler in Prod mit 500.
+2. **`template-resolver-user-data` mitmounten.** Die Entity trägt Subject-Daten;
+   ohne den EXT_USER_DATA-Hook verweigert der Boot-Guard den Start. Das Feature
+   liefert den Art.-20-Export; die Löschung (Art. 17) läuft über
+   crypto-shredding, nicht über einen physischen DELETE — der wäre bei einer
+   event-sourced Entity nicht replay-fest.
+
+Der Locale-Fallback von `resolveTemplate` gilt für user-owned Einträge **nicht**:
+sie werden gelistet und editiert, nie als Tenant/System-Override aufgelöst. Wer
+im Client eigene *und* geteilte Bausteine zeigen will, mountet zwei Collections
+nebeneinander und führt sie in der UI zusammen.
+
+Unter `tenantIdOverride` (SystemAdmin) bleibt die Zeile die **eigene** des
+Aufrufers im fremden Tenant — ein Admin editiert nie die Signatur eines anderen.
 
 ## Out-of-Scope
 

package/src/template-resolver/__tests__/collection-kinds.integration.test.ts

@@ -262,20 +262,28 @@ describe("public handlers stay public and stay text-block", () => {
   });
 });
 
-describe("mount-time guard", () => {
-  test("ownership 'user' is rejected until the ownerId column exists", () => {
-    expect(() =>
-      createTemplateResolverFeature({
-        collections: [
-          {
-            id: "signatures",
-            kind: "mail-html",
-            ownership: "user",
-            access: { roles: ["Agent"] },
-            nav: { label: "mail:nav.signatures" },
-          },
-        ],
-      }),
-    ).toThrow(/#1770/);
+describe("mount-time entity registration", () => {
+  test("a tenant-only mount does not register the user-content entity", () => {
+    // It carries a `userOwned` field, which makes it subject data and puts the
+    // EXT_USER_DATA boot guard in play. Apps with no user-owned collection
+    // must not inherit that obligation.
+    const entities = Object.keys(feature.entities ?? {});
+    expect(entities).toContain("template-resource");
+    expect(entities).not.toContain("user-content-entry");
+  });
+
+  test("declaring a user-owned collection registers it", () => {
+    const withSignatures = createTemplateResolverFeature({
+      collections: [
+        {
+          id: "signatures",
+          kind: "mail-html",
+          ownership: "user",
+          access: { roles: ["Agent"] },
+          nav: { label: "mail:nav.signatures" },
+        },
+      ],
+    });
+    expect(Object.keys(withSignatures.entities ?? {})).toContain("user-content-entry");
   });
 });

package/src/template-resolver/__tests__/collection-ownership.integration.test.ts

@@ -0,0 +1,336 @@
+// Ownership is the second axis next to access: `access` decides WHO may reach
+// a collection, `ownership` decides WHOSE rows they see once they are in.
+//
+// The four levels this pins, because each one has its own failure mode:
+//   user    — two agents keep separate signatures under the same slug
+//   tenant  — one curated set everyone in the tenant shares
+//   system  — a SystemAdmin crossing tenants still writes their OWN entry
+//   custom  — the app's role vocabulary gates both, independent of ownership
+//
+// The regression that motivates the user level: with one shared table and a
+// nullable owner column, a signature would either collide on the unique index
+// or silently be served to every agent.
+
+import { afterAll, beforeAll, describe, expect, test } from "bun:test";
+import { selectMany } from "@cosmicdrift/kumiko-framework/bun-db";
+import type { DbConnection } from "@cosmicdrift/kumiko-framework/db";
+import { createAnonymousUser, type TenantId } from "@cosmicdrift/kumiko-framework/engine";
+import { createEventsTable } from "@cosmicdrift/kumiko-framework/event-store";
+import {
+  createTestUser,
+  setupTestStack,
+  type TestStack,
+  unsafeCreateEntityTable,
+} from "@cosmicdrift/kumiko-framework/stack";
+import { createTemplateResolverFeature } from "../feature";
+import { collectionHandlerName, collectionQueryName } from "../qualified-names";
+import { templateResourceEntity } from "../table";
+import {
+  type UserContentEntryRow,
+  userContentEntriesTable,
+  userContentEntryEntity,
+} from "../user-content-table";
+
+let stack: TestStack;
+let db: DbConnection;
+
+// Same tenant, same role, different people — the pair the user level is about.
+const agentA = createTestUser({ id: 11, roles: ["Agent"] });
+const agentB = createTestUser({ id: 12, roles: ["Agent"] });
+const tenantAdmin = createTestUser({ id: 13, roles: ["TenantAdmin"] });
+const promptEngineer = createTestUser({ id: 14, roles: ["PromptEngineer"] });
+const sysAdmin = createTestUser({ id: 15, roles: ["SystemAdmin", "Agent"] });
+const otherTenantId = "00000000-0000-4000-8000-0000000000ff" as TenantId;
+const foreignAgent = createTestUser({ id: 16, roles: ["Agent"], tenantId: otherTenantId });
+
+const SIGNATURES_LIST = collectionQueryName("signatures", "list");
+const SIGNATURES_ITEM = collectionQueryName("signatures", "item");
+const SIGNATURES_SET = collectionHandlerName("signatures");
+const SNIPPETS_LIST = collectionQueryName("reply-snippets", "list");
+const SNIPPETS_SET = collectionHandlerName("reply-snippets");
+
+const feature = createTemplateResolverFeature({
+  collections: [
+    {
+      id: "signatures",
+      kind: "mail-html",
+      ownership: "user",
+      access: { roles: ["Agent", "TenantAdmin"] },
+      nav: { label: "mail:nav.signatures" },
+    },
+    {
+      id: "reply-snippets",
+      kind: "mail-html",
+      access: { roles: ["Agent", "TenantAdmin"] },
+      nav: { label: "mail:nav.snippets" },
+    },
+    {
+      id: "ai-prompts",
+      kind: "ai-prompt",
+      ownership: "user",
+      access: { roles: ["PromptEngineer"] },
+      nav: { label: "mail:nav.prompts" },
+    },
+  ],
+});
+
+const signature = (title: string, content: string) => ({
+  slug: "standard",
+  locale: "de",
+  title,
+  content,
+  contentFormat: "html" as const,
+});
+
+beforeAll(async () => {
+  stack = await setupTestStack({ features: [feature] });
+  db = stack.db;
+  await unsafeCreateEntityTable(db, templateResourceEntity);
+  await unsafeCreateEntityTable(db, userContentEntryEntity);
+  await createEventsTable(db);
+});
+
+afterAll(async () => {
+  await stack.cleanup();
+});
+
+describe("ownership 'user' :: every user keeps their own", () => {
+  test("two agents hold the same slug side by side", async () => {
+    const a = await stack.http.writeOk<{ isNew: boolean }>(
+      SIGNATURES_SET,
+      signature("Signatur A", "<p>Viele Grüße, A</p>"),
+      agentA,
+    );
+    const b = await stack.http.writeOk<{ isNew: boolean }>(
+      SIGNATURES_SET,
+      signature("Signatur B", "<p>Beste Grüße, B</p>"),
+      agentB,
+    );
+
+    // Both are creates, not an update of the other's row: the unique index is
+    // (tenantId, ownerId, slug, kind, locale), so the second write does not
+    // collide with the first.
+    expect(a.isNew).toBe(true);
+    expect(b.isNew).toBe(true);
+
+    const rows = await selectMany<UserContentEntryRow>(db, userContentEntriesTable, {
+      tenantId: agentA.tenantId,
+      slug: "standard",
+    });
+    expect(rows.length).toBe(2);
+    expect(new Set(rows.map((r) => r.ownerId))).toEqual(new Set([agentA.id, agentB.id]));
+  });
+
+  test("each agent lists only their own", async () => {
+    const forA = await stack.http.queryOk<{ blocks: readonly { title: string }[] }>(
+      SIGNATURES_LIST,
+      {},
+      agentA,
+    );
+    const forB = await stack.http.queryOk<{ blocks: readonly { title: string }[] }>(
+      SIGNATURES_LIST,
+      {},
+      agentB,
+    );
+    expect(forA.blocks.map((b) => b.title)).toEqual(["Signatur A"]);
+    expect(forB.blocks.map((b) => b.title)).toEqual(["Signatur B"]);
+  });
+
+  test("the item handler reads the caller's row, not the first match", async () => {
+    const forA = await stack.http.queryOk<{ content: string }>(
+      SIGNATURES_ITEM,
+      { slug: "standard", locale: "de" },
+      agentA,
+    );
+    const forB = await stack.http.queryOk<{ content: string }>(
+      SIGNATURES_ITEM,
+      { slug: "standard", locale: "de" },
+      agentB,
+    );
+    expect(forA.content).toBe("<p>Viele Grüße, A</p>");
+    expect(forB.content).toBe("<p>Beste Grüße, B</p>");
+  });
+
+  test("an update stays inside the caller's row", async () => {
+    await stack.http.writeOk(SIGNATURES_SET, signature("Signatur A v2", "<p>MfG, A</p>"), agentA);
+
+    const forB = await stack.http.queryOk<{ title: string; content: string }>(
+      SIGNATURES_ITEM,
+      { slug: "standard", locale: "de" },
+      agentB,
+    );
+    expect(forB.title).toBe("Signatur B");
+    expect(forB.content).toBe("<p>Beste Grüße, B</p>");
+  });
+
+  test("a user with no entry gets an empty list, not someone else's", async () => {
+    const result = await stack.http.queryOk<{ blocks: readonly unknown[] }>(
+      SIGNATURES_LIST,
+      {},
+      tenantAdmin,
+    );
+    expect(result.blocks).toEqual([]);
+  });
+
+  test("and null from the item handler", async () => {
+    const result = await stack.http.queryOk<unknown>(
+      SIGNATURES_ITEM,
+      { slug: "standard", locale: "de" },
+      tenantAdmin,
+    );
+    expect(result).toBeNull();
+  });
+});
+
+describe("ownership 'tenant' :: one set everyone shares", () => {
+  test("what one agent writes, the other sees", async () => {
+    await stack.http.writeOk(
+      SNIPPETS_SET,
+      {
+        slug: "standard",
+        locale: "de",
+        title: "Team-Baustein",
+        content: "<p>Wir melden uns.</p>",
+        contentFormat: "html",
+      },
+      agentA,
+    );
+
+    const forB = await stack.http.queryOk<{ blocks: readonly { title: string }[] }>(
+      SNIPPETS_LIST,
+      {},
+      agentB,
+    );
+    expect(forB.blocks.map((b) => b.title)).toEqual(["Team-Baustein"]);
+  });
+
+  test("a second write to the same slug updates instead of creating", async () => {
+    const result = await stack.http.writeOk<{ isNew: boolean }>(
+      SNIPPETS_SET,
+      {
+        slug: "standard",
+        locale: "de",
+        title: "Team-Baustein v2",
+        content: "<p>Wir melden uns zeitnah.</p>",
+        contentFormat: "html",
+      },
+      agentB,
+    );
+    expect(result.isNew).toBe(false);
+  });
+
+  test("the two collections share a kind and stay separate stores", async () => {
+    // Same kind (mail-html), same slug, same tenant — one is per-user, one is
+    // shared. A single table with a nullable owner column would have to make
+    // these collide.
+    const snippets = await stack.http.queryOk<{ blocks: readonly { title: string }[] }>(
+      SNIPPETS_LIST,
+      {},
+      agentA,
+    );
+    const signatures = await stack.http.queryOk<{ blocks: readonly { title: string }[] }>(
+      SIGNATURES_LIST,
+      {},
+      agentA,
+    );
+    expect(snippets.blocks.map((b) => b.title)).toEqual(["Team-Baustein v2"]);
+    expect(signatures.blocks.map((b) => b.title)).toEqual(["Signatur A v2"]);
+  });
+});
+
+describe("system level :: cross-tenant override", () => {
+  test("a SystemAdmin writing into another tenant still writes their OWN entry", async () => {
+    await stack.http.writeOk(
+      SIGNATURES_SET,
+      { ...signature("Sysadmin-Signatur", "<p>Admin</p>"), tenantIdOverride: otherTenantId },
+      sysAdmin,
+    );
+
+    const rows = await selectMany<UserContentEntryRow>(db, userContentEntriesTable, {
+      tenantId: otherTenantId,
+      slug: "standard",
+    });
+    expect(rows.map((r) => r.ownerId)).toEqual([sysAdmin.id]);
+  });
+
+  test("the foreign tenant's own agent does not see it", async () => {
+    const result = await stack.http.queryOk<{ blocks: readonly unknown[] }>(
+      SIGNATURES_LIST,
+      {},
+      foreignAgent,
+    );
+    expect(result.blocks).toEqual([]);
+  });
+
+  test("and the home tenant is untouched by the cross-tenant write", async () => {
+    const result = await stack.http.queryOk<{ blocks: readonly { title: string }[] }>(
+      SIGNATURES_LIST,
+      {},
+      agentA,
+    );
+    expect(result.blocks.map((b) => b.title)).toEqual(["Signatur A v2"]);
+  });
+
+  test("a non-SystemAdmin may not override the tenant", async () => {
+    const error = await stack.http.writeErr(
+      SIGNATURES_SET,
+      { ...signature("Fremd", "<p>x</p>"), tenantIdOverride: otherTenantId },
+      agentA,
+    );
+    expect(error.code).toBe("access_denied");
+  });
+});
+
+describe("custom roles :: access gates ownership, not the other way round", () => {
+  test("the declared role reaches its user-owned collection", async () => {
+    const result = await stack.http.queryOk<{ blocks: readonly unknown[] }>(
+      collectionQueryName("ai-prompts", "list"),
+      {},
+      promptEngineer,
+    );
+    expect(result.blocks).toEqual([]);
+  });
+
+  test("an agent may not reach the prompt collection, user-owned or not", async () => {
+    const error = await stack.http.queryErr(collectionQueryName("ai-prompts", "list"), {}, agentA);
+    expect(error.code).toBe("access_denied");
+  });
+
+  test("the prompt role may not reach the signatures either", async () => {
+    const error = await stack.http.queryErr(SIGNATURES_LIST, {}, promptEngineer);
+    expect(error.code).toBe("access_denied");
+  });
+
+  test("anonymous reaches no user-owned collection", async () => {
+    const anon = createAnonymousUser(agentA.tenantId);
+    expect((await stack.http.queryErr(SIGNATURES_LIST, {}, anon)).code).toBe("access_denied");
+  });
+});
+
+describe("GDPR :: the owner column is what makes erasure possible", () => {
+  test("content is annotated userOwned against the ownerId column", () => {
+    // The whole reason for a second table: `userOwned` is resolved per entity,
+    // and resolveSubjectForField throws on an empty owner column — so a shared
+    // table with nullable ownerId would break every tenant-wide write.
+    const content = userContentEntryEntity.fields["content"];
+    expect(content).toBeDefined();
+    expect((content as { userOwned?: { ownerField: string } }).userOwned).toEqual({
+      ownerField: "ownerId",
+    });
+  });
+
+  test("the tenant-wide table keeps its business-data declaration", () => {
+    const content = templateResourceEntity.fields["content"];
+    expect((content as { allowPlaintext?: string }).allowPlaintext).toBe("is-business-data");
+    expect((content as { userOwned?: unknown }).userOwned).toBeUndefined();
+  });
+
+  test("every user-owned row names its owner", async () => {
+    const rows = await selectMany<UserContentEntryRow>(db, userContentEntriesTable, {});
+    expect(rows.length).toBeGreaterThan(0);
+    for (const row of rows) {
+      expect(typeof row.ownerId).toBe("string");
+      expect(row.ownerId.length).toBeGreaterThan(0);
+    }
+  });
+});

package/src/template-resolver/feature.ts

@@ -14,6 +14,7 @@ import { archiveWrite, publishWrite } from "./handlers/toggle-status.write";
 import { upsertSystemWrite } from "./handlers/upsert-system.write";
 import { upsertTenantWrite } from "./handlers/upsert-tenant.write";
 import { templateResourceEntity } from "./table";
+import { userContentEntryEntity } from "./user-content-table";
 
 // template-resolver — structured template storage with tenant-override
 // hierarchy, locale fallback and resource linking via file-foundation.
@@ -38,19 +39,10 @@ export type TemplateResolverOptions = {
 
 export function createTemplateResolverFeature(opts: TemplateResolverOptions = {}) {
   const collections = opts.collections ?? [];
-  const userOwned = collections.filter((c) => c.ownership === "user");
-  if (userOwned.length > 0) {
-    // Fail loudly at mount instead of quietly serving one shared set to every
-    // user — the ownerId column doesn't exist yet (#1770).
-    throw new Error(
-      `template-resolver: ownership "user" is not implemented yet (#1770) — ` +
-        `collections ${userOwned.map((c) => `"${c.id}"`).join(", ")} would silently ` +
-        `share one tenant-wide set between all users.`,
-    );
-  }
+  const hasUserOwned = collections.some((c) => c.ownership === "user");
   return defineFeature("template-resolver", (r) => {
     r.describe(
-      "The one content store: notification and mail templates, PDF document templates, AI prompts and plain editable text blocks all live here as one entity, distinguished by `kind` (`notification`, `mail-html`, `document-pdf`, `ai-prompt`, `text-block`, `image-snapshot`). Resolution uses a 4-level fallback: tenant+locale \u2192 system+locale \u2192 tenant+fallback-locale \u2192 system+fallback-locale, so tenants can override system defaults without touching application code. Call `ctx.templateResolver.resolveTemplate({ tenantId, slug, kind, locale })` at render time; manage templates via the `upsertSystem`, `upsertTenant`, `publish` and `archive` write handlers. Apps that want an editable collection in their navigation declare it at mount: `createTemplateResolverFeature({ collections: [{ id, kind, access: { roles }, nav }] })` \u2014 `access` belongs to the mount because a bundled feature does not know the host's role vocabulary. Each collection gets its own `<id>-list` / `<id>-item` / `<id>-set` handlers carrying that collection's access rule, so the dispatcher enforces the separation. Replaces the former `text-content` feature, whose blocks now live here as kind `text-block`.",
+      "The one content store: notification and mail templates, PDF document templates, AI prompts and plain editable text blocks all live here as one entity, distinguished by `kind` (`notification`, `mail-html`, `document-pdf`, `ai-prompt`, `text-block`, `image-snapshot`). Resolution uses a 4-level fallback: tenant+locale \u2192 system+locale \u2192 tenant+fallback-locale \u2192 system+fallback-locale, so tenants can override system defaults without touching application code. Call `ctx.templateResolver.resolveTemplate({ tenantId, slug, kind, locale })` at render time; manage templates via the `upsertSystem`, `upsertTenant`, `publish` and `archive` write handlers. Apps that want an editable collection in their navigation declare it at mount: `createTemplateResolverFeature({ collections: [{ id, kind, access: { roles }, nav }] })` \u2014 `access` belongs to the mount because a bundled feature does not know the host's role vocabulary. Each collection gets its own `<id>-list` / `<id>-item` / `<id>-set` handlers carrying that collection's access rule, so the dispatcher enforces the separation. A collection is either tenant-wide (default) or `ownership: \"user\"`, where every user keeps their own entries (mail signatures) in the separate `user-content-entry` entity — that one carries `userOwned` content, so mounting it also requires the `template-resolver-user-data` feature and an app-side migration. Replaces the former `text-content` feature, whose blocks now live here as kind `text-block`.",
     );
     r.uiHints({
       displayLabel: "Template Resolver",
@@ -58,6 +50,11 @@ export function createTemplateResolverFeature(opts: TemplateResolverOptions = {}
       recommended: false,
     });
     r.entity("template-resource", templateResourceEntity);
+    // Only when the app actually mounts a user-owned collection: the entity's
+    // `content` is `userOwned`, which makes it subject data — the boot guard
+    // then requires an EXT_USER_DATA hook (mount `template-resolver-user-data`).
+    // Registering it unconditionally would impose that on every app.
+    if (hasUserOwned) r.entity("user-content-entry", userContentEntryEntity);
 
     const handlers = {
       upsertSystem: r.writeHandler(upsertSystemWrite),

package/src/template-resolver/handlers/collection-item.query.ts

@@ -5,13 +5,17 @@ import {
   defineQueryHandler,
 } from "@cosmicdrift/kumiko-framework/engine";
 import { z } from "zod";
-import { type TemplateResourceRow, templateResourcesTable } from "../table";
-import { DEFAULT_COLLECTION_ACCESS, ownerFilter } from "./collection-shared";
+import {
+  type CollectionEntryRow,
+  collectionStore,
+  DEFAULT_COLLECTION_ACCESS,
+  toCollectionEntry,
+} from "./collection-shared";
 
 // Single entry of one collection, for the editor behind a tree node. Same
 // per-collection construction as collection-list — see there for why.
 export function makeCollectionItemQuery(collection: ContentCollectionDefinition) {
-  const isUserOwned = collection.ownership === "user";
+  const store = collectionStore(collection);
   return defineQueryHandler({
     name: `${collection.id}-item`,
     schema: z.object({
@@ -30,23 +34,16 @@ export function makeCollectionItemQuery(collection: ContentCollectionDefinition)
       );
       if (overrideDenied) throw overrideDenied;
       const tenantId = override ?? query.user.tenantId;
-      const row = await fetchOne<TemplateResourceRow>(ctx.db, templateResourcesTable, {
+      const row = await fetchOne<CollectionEntryRow>(ctx.db, store.table, {
         tenantId,
         slug: query.payload.slug,
         kind: collection.kind,
         locale: query.payload.locale,
-        ...ownerFilter(isUserOwned, query.user),
+        ...store.scopeOf(query.user),
       });
 
       if (!row) return null;
-      return {
-        slug: row.slug,
-        locale: row.locale,
-        title: row.title,
-        content: row.content,
-        folder: row.folder,
-        updatedAt: row.updatedAt,
-      };
+      return toCollectionEntry(row);
     },
   });
 }

package/src/template-resolver/handlers/collection-list.query.ts

@@ -6,8 +6,12 @@ import {
   defineQueryHandler,
 } from "@cosmicdrift/kumiko-framework/engine";
 import { z } from "zod";
-import { type TemplateResourceRow, templateResourcesTable } from "../table";
-import { DEFAULT_COLLECTION_ACCESS, ownerFilter } from "./collection-shared";
+import {
+  type CollectionEntryRow,
+  collectionStore,
+  DEFAULT_COLLECTION_ACCESS,
+  toCollectionEntry,
+} from "./collection-shared";
 
 // One list handler per declared collection: `kind`, `ownership` and `access`
 // come from the declaration, never from the payload.
@@ -18,7 +22,7 @@ import { DEFAULT_COLLECTION_ACCESS, ownerFilter } from "./collection-shared";
 // in its body — one bug there and a prompt engineer's collection is open to
 // everyone who may edit a signature.
 export function makeCollectionListQuery(collection: ContentCollectionDefinition) {
-  const isUserOwned = collection.ownership === "user";
+  const store = collectionStore(collection);
   return defineQueryHandler({
     name: `${collection.id}-list`,
     schema: z.object({
@@ -35,23 +39,14 @@ export function makeCollectionListQuery(collection: ContentCollectionDefinition)
       );
       if (overrideDenied) throw overrideDenied;
       const tenantId = override ?? query.user.tenantId;
-      const rows = castTenantRows<TemplateResourceRow>(
-        await selectMany(ctx.db, templateResourcesTable, {
+      const rows = castTenantRows<CollectionEntryRow>(
+        await selectMany(ctx.db, store.table, {
           tenantId,
           kind: collection.kind,
-          ...ownerFilter(isUserOwned, query.user),
+          ...store.scopeOf(query.user),
         }),
       );
-      return {
-        blocks: rows.map((row) => ({
-          slug: row.slug,
-          locale: row.locale,
-          title: row.title,
-          content: row.content,
-          folder: row.folder,
-          updatedAt: row.updatedAt,
-        })),
-      };
+      return { blocks: rows.map(toCollectionEntry) };
     },
   });
 }

package/src/template-resolver/handlers/collection-set.write.ts

@@ -3,14 +3,16 @@ import {
   type ContentCollectionDefinition,
   crossTenantOverrideDenied,
   defineWriteHandler,
-  SYSTEM_TENANT_ID,
   type TenantId,
 } from "@cosmicdrift/kumiko-framework/engine";
 import { writeFailure } from "@cosmicdrift/kumiko-framework/errors";
 import { z } from "zod";
-import { type TemplateResourceRow, templateResourcesTable } from "../table";
-import { DEFAULT_COLLECTION_ACCESS, ownerFilter } from "./collection-shared";
-import { contentFormatSchema, executor, folderSchema, localeSchema, slugSchema } from "./shared";
+import {
+  type CollectionEntryRow,
+  collectionStore,
+  DEFAULT_COLLECTION_ACCESS,
+} from "./collection-shared";
+import { contentFormatSchema, folderSchema, localeSchema, slugSchema } from "./shared";
 
 // Upsert inside one collection. Mirrors set.write for text-blocks, but the
 // kind comes from the declaration and the access rule is the collection's own,
@@ -20,7 +22,7 @@ import { contentFormatSchema, executor, folderSchema, localeSchema, slugSchema }
 // Like set.write this publishes on save (status active, empty variableSchema)
 // — the draft stage lives on upsertTenant + publish.
 export function makeCollectionSetWrite(collection: ContentCollectionDefinition) {
-  const isUserOwned = collection.ownership === "user";
+  const store = collectionStore(collection);
   return defineWriteHandler({
     name: `${collection.id}-set`,
     schema: z.object({
@@ -47,9 +49,12 @@ export function makeCollectionSetWrite(collection: ContentCollectionDefinition)
       // user's own tenantId is already TenantId-branded.
       const tenantId = (override ?? event.user.tenantId) as TenantId;
       const executorUser = override !== undefined ? { ...event.user, tenantId } : event.user;
-      const owner = ownerFilter(isUserOwned, event.user);
+      // Scoped to the acting user even under a tenant override: a SystemAdmin
+      // writing into another tenant still writes their own entry, never
+      // someone else's signature.
+      const owner = store.scopeOf(event.user);
 
-      const existing = await fetchOne<TemplateResourceRow>(db, templateResourcesTable, {
+      const existing = await fetchOne<CollectionEntryRow>(db, store.table, {
         tenantId,
         slug: event.payload.slug,
         kind: collection.kind,
@@ -58,7 +63,7 @@ export function makeCollectionSetWrite(collection: ContentCollectionDefinition)
       });
 
       if (existing) {
-        const result = await executor.update(
+        const result = await store.executor.update(
           {
             id: existing.id,
             version: existing.version,
@@ -82,7 +87,7 @@ export function makeCollectionSetWrite(collection: ContentCollectionDefinition)
         };
       }
 
-      const result = await executor.create(
+      const result = await store.executor.create(
         {
           tenantId,
           slug: event.payload.slug,
@@ -92,11 +97,7 @@ export function makeCollectionSetWrite(collection: ContentCollectionDefinition)
           content: event.payload.content,
           contentFormat: event.payload.contentFormat,
           folder: event.payload.folder ?? null,
-          variableSchema: "{}",
-          linkedResources: "{}",
-          scope: tenantId === SYSTEM_TENANT_ID ? ("system" as const) : ("tenant" as const),
-          parentTemplateId: null,
-          status: "active" as const,
+          ...store.createDefaults(tenantId),
           ...owner,
         },
         executorUser,

package/src/template-resolver/handlers/collection-shared.ts

@@ -1,24 +1,87 @@
-import type { AccessRule, SessionUser } from "@cosmicdrift/kumiko-framework/engine";
+import type { EventStoreExecutor } from "@cosmicdrift/kumiko-framework/db";
+import { createEventStoreExecutor } from "@cosmicdrift/kumiko-framework/db";
+import type {
+  AccessRule,
+  ContentCollectionDefinition,
+  SessionUser,
+  TenantId,
+} from "@cosmicdrift/kumiko-framework/engine";
+import { SYSTEM_TENANT_ID } from "@cosmicdrift/kumiko-framework/engine";
+import { templateResourceEntity, templateResourcesTable } from "../table";
+import { userContentEntriesTable, userContentEntryEntity } from "../user-content-table";
 
 // Applies when an app mounts a collection without saying who may reach it.
 // Deliberately narrow: a collection whose access nobody decided should be
 // invisible to normal users rather than open by default.
 export const DEFAULT_COLLECTION_ACCESS: AccessRule = { roles: ["TenantAdmin", "SystemAdmin"] };
 
+const templateExecutor = createEventStoreExecutor(templateResourcesTable, templateResourceEntity, {
+  entityName: "template-resource",
+});
+
+const userContentExecutor = createEventStoreExecutor(
+  userContentEntriesTable,
+  userContentEntryEntity,
+  { entityName: "user-content-entry" },
+);
+
+// The columns a collection reads. Both tables carry them; the tenant-wide one
+// has more (scope, status, variableSchema) that a collection never touches.
+export type CollectionEntryRow = {
+  readonly id: string | number;
+  readonly version: number;
+  readonly slug: string;
+  readonly locale: string;
+  readonly title: string | null;
+  readonly content: string | null;
+  readonly folder: string | null;
+  readonly updatedAt: Date;
+};
+
+export type CollectionStore = {
+  readonly table: typeof templateResourcesTable | typeof userContentEntriesTable;
+  readonly executor: EventStoreExecutor;
+  /** Extra WHERE columns scoping a read to its owner. Empty for tenant-wide. */
+  scopeOf(user: SessionUser): Readonly<Record<string, unknown>>;
+  /** Columns a create needs beyond the editable ones the payload carries. */
+  createDefaults(tenantId: TenantId): Readonly<Record<string, unknown>>;
+};
+
 // `ownership: "user"` means every user keeps their own entries (signatures);
 // "tenant" means one shared set (reply snippets an admin curates).
 //
-// The user-owned column doesn't exist yet — see #1770. Until it does, a
-// user-owned collection would silently behave like a tenant-wide one, so the
-// feature factory rejects `ownership: "user"` at registration time and this
-// helper never sees it.
-export function ownerFilter(
-  isUserOwned: boolean,
-  _user: SessionUser,
-): Readonly<Record<string, unknown>> {
-  if (!isUserOwned) return {};
-  throw new Error(
-    "template-resolver: ownership 'user' needs the ownerId column (#1770) — " +
-      "createTemplateResolverFeature should have rejected this collection at mount.",
-  );
+// The two live in different tables — see user-content-table.ts for why a
+// nullable owner column on one table cannot work with `userOwned`.
+export function collectionStore(collection: ContentCollectionDefinition): CollectionStore {
+  if (collection.ownership === "user") {
+    return {
+      table: userContentEntriesTable,
+      executor: userContentExecutor,
+      scopeOf: (user) => ({ ownerId: user.id }),
+      createDefaults: () => ({}),
+    };
+  }
+  return {
+    table: templateResourcesTable,
+    executor: templateExecutor,
+    scopeOf: () => ({}),
+    createDefaults: (tenantId) => ({
+      variableSchema: "{}",
+      linkedResources: "{}",
+      scope: tenantId === SYSTEM_TENANT_ID ? "system" : "tenant",
+      parentTemplateId: null,
+      status: "active",
+    }),
+  };
+}
+
+export function toCollectionEntry(row: CollectionEntryRow) {
+  return {
+    slug: row.slug,
+    locale: row.locale,
+    title: row.title,
+    content: row.content,
+    folder: row.folder,
+    updatedAt: row.updatedAt,
+  };
 }

package/src/template-resolver/index.ts

@@ -33,3 +33,8 @@ export {
   TemplateResolverQueries,
 } from "./qualified-names";
 export { type TemplateResourceRow, templateResourceEntity, templateResourcesTable } from "./table";
+export {
+  type UserContentEntryRow,
+  userContentEntriesTable,
+  userContentEntryEntity,
+} from "./user-content-table";

package/src/template-resolver/user-content-table.ts

@@ -0,0 +1,66 @@
+import { buildEntityTable } from "@cosmicdrift/kumiko-framework/db";
+import {
+  createEntity,
+  createLongTextField,
+  createSelectField,
+  createTextField,
+} from "@cosmicdrift/kumiko-framework/engine";
+import { CONTENT_FORMATS, TEMPLATE_KINDS } from "./constants";
+
+// UserContentEntry — the per-user half of the content store: mail signatures
+// and personal reply snippets, one row per (tenantId, ownerId, slug, kind,
+// locale).
+//
+// Why a separate table instead of a nullable ownerId on read_template_resources:
+// `content` here carries the owner's name, phone and address, so it needs
+// `userOwned` for crypto-shredding. That annotation is resolved per entity, not
+// per row — `resolveSubjectForField` throws when the owner column is empty
+// (crypto/subject-resolver.ts). On a mixed table every tenant-wide mail template
+// would fail its write. `ownerId` NOT NULL keeps the invariant in the schema and
+// makes the unique index a plain one instead of two partial indexes.
+//
+// Not part of `resolveTemplate`'s 4-level fallback: these entries are listed and
+// edited by their owner, never resolved as a tenant/system template override.
+export const userContentEntryEntity = createEntity({
+  table: "read_user_content_entries",
+  fields: {
+    ownerId: createTextField({ required: true, subjectRef: true }),
+    slug: createTextField({ required: true }),
+    kind: createSelectField({ required: true, options: [...TEMPLATE_KINDS] }),
+    locale: createTextField({ required: true }),
+    title: createTextField({}),
+    folder: createTextField({}),
+    content: createLongTextField({ userOwned: { ownerField: "ownerId" } }),
+    contentFormat: createSelectField({ required: true, options: [...CONTENT_FORMATS] }),
+  },
+  indexes: [
+    {
+      unique: true,
+      columns: ["tenantId", "ownerId", "slug", "kind", "locale"],
+      name: "read_user_content_entries_unique",
+    },
+  ],
+});
+
+export const userContentEntriesTable = buildEntityTable(
+  "user-content-entry",
+  userContentEntryEntity,
+);
+
+export type UserContentEntryRow = {
+  readonly id: string | number;
+  readonly version: number;
+  readonly tenantId: string;
+  readonly ownerId: string;
+  readonly slug: string;
+  readonly kind: string;
+  readonly locale: string;
+  readonly title: string | null;
+  readonly folder: string | null;
+  readonly content: string | null;
+  readonly contentFormat: string;
+  readonly createdAt: Date;
+  readonly updatedAt: Date;
+  readonly createdBy: string;
+  readonly updatedBy: string;
+};

package/src/template-resolver-user-data/hooks.ts

@@ -0,0 +1,40 @@
+// EXT_USER_DATA hooks for the template-resolver's `user-content-entry` entity
+// (GDPR Art. 20 export / Art. 17 erasure). Lives apart from template-resolver
+// so apps without the user-data-rights pipeline don't pull a hard dependency.
+// Mirrors notes-history-user-data: export-only, erasure via crypto-shredding.
+
+import { selectMany } from "@cosmicdrift/kumiko-framework/bun-db";
+import type { UserDataDeleteHook, UserDataExportHook } from "@cosmicdrift/kumiko-framework/engine";
+import { userContentEntriesTable } from "../template-resolver";
+
+// Genuinely per-user content — the export filters by ownerId alone. Tenant
+// scoping comes from the tenant-scoped ctx.db; a user who belongs to two
+// tenants gets each tenant's entries from that tenant's forget run.
+export const userContentExportHook: UserDataExportHook = async (ctx) => {
+  const rows = await selectMany<Record<string, unknown>>(ctx.db, userContentEntriesTable, {
+    ownerId: ctx.userId,
+  });
+  if (rows.length === 0) return null;
+  return {
+    entity: "user-content-entry",
+    rows: rows.map((r) => ({
+      slug: r["slug"],
+      kind: r["kind"],
+      locale: r["locale"],
+      title: r["title"],
+      content: r["content"],
+      folder: r["folder"],
+      updatedAt: String(r["updatedAt"] ?? ""),
+    })),
+  };
+};
+
+// Deliberate no-op: `content` is annotated `userOwned`, so erasure runs via
+// crypto-shredding — destroying the owner's subject key makes every event AND
+// the projected row unreadable at once. A physical DELETE would not be
+// rebuild-safe here: user-content-entry is event-sourced, so a replay would
+// bring the row back (with unreadable content, but back).
+// Precondition: this only erases anything if the app mounts a KMS adapter —
+// without one, userOwned fields fall back to plaintext framework-wide and
+// forget is a true no-op for `content`. Same property as notes-history.
+export const userContentDeleteHook: UserDataDeleteHook = async () => {};

package/src/template-resolver-user-data/index.ts

@@ -0,0 +1,25 @@
+// Provides the EXT_USER_DATA export/delete hooks for the template-resolver's
+// `user-content-entry` entity — mount it alongside template-resolver and
+// user-data-rights when an app declares a collection with `ownership: "user"`.
+// Kept separate from template-resolver so apps with only tenant-wide
+// collections stay usable without the user-data-rights stack. Mirrors
+// notes-history-user-data.
+
+import { defineFeature, EXT_USER_DATA } from "@cosmicdrift/kumiko-framework/engine";
+import { userContentDeleteHook, userContentExportHook } from "./hooks";
+
+export const templateResolverUserDataFeature = defineFeature("template-resolver-user-data", (r) => {
+  r.describe(
+    "GDPR (Art. 20 export / Art. 17 erasure) coverage for the `template-resolver` feature's `user-content-entry` entity — the per-user half of the content store (mail signatures, personal reply snippets). Mounts the EXT_USER_DATA export hook so a user's own entries land in the export bundle; the delete hook is a deliberate no-op because `content` is annotated `userOwned`, so erasure runs via crypto-shredding (destroying the owner's subject key) rather than a physical delete, which would not survive an event replay. Mount this whenever `createTemplateResolverFeature` declares a collection with `ownership: \"user\"` — the boot guard otherwise refuses the entity. Requires `user-data-rights`, optionalRequires `template-resolver`.",
+  );
+  // user-data-rights is the hard dependency (EXT_USER_DATA host).
+  // template-resolver is optional for the same reason as in
+  // notes-history-user-data: a toggleable mount would otherwise trip the
+  // "effectively disabled" boot warning even though the entity is there.
+  r.requires("user-data-rights");
+  r.optionalRequires("template-resolver");
+  r.useExtension(EXT_USER_DATA, "user-content-entry", {
+    export: userContentExportHook,
+    delete: userContentDeleteHook,
+  });
+});