@cosmicdrift/kumiko-bundled-features 0.377.0 → 0.379.0

package/dist/template-resolver/handlers/set.write.js

@@ -3,9 +3,10 @@ import { defineWriteHandler, SYSTEM_TENANT_ID, } from "@cosmicdrift/kumiko-frame
 import { isOneOf } from "@cosmicdrift/kumiko-types/type-guards";
 import * as z from "zod";
 import { requireForTenant } from "../../shared/index.js";
-import { TEMPLATE_KINDS, TEXT_BLOCK_KIND, UPSERT_KINDS } from "../constants.js";
 import { templateResourcesTable } from "../table.js";
+import { refuseTemplateEdit, templateEditAccess, } from "../template-edit-policy.js";
 import { resolveTemplateVariables } from "../template-validation.js";
+import { TEMPLATE_KINDS, TEXT_BLOCK_KIND, UPSERT_KINDS } from "../web/constants.js";
 import { contentFormatSchema, executor, folderSchema, localeSchema, slugSchema } from "./shared.js";
 import { parseStoredJson, storedRecord } from "./template-gates.js";
 import { gateTemplateWrite } from "./template-write.js";
@@ -28,100 +29,103 @@ import { gateTemplateWrite } from "./template-write.js";
 //
 // Kinds that upsertSystem/upsertTenant also write run the same validation
 // pipeline here, and because saving publishes, publish issues reject too.
-export const setWrite = defineWriteHandler({
-    name: "set",
-    schema: z.object({
-        slug: slugSchema,
-        locale: localeSchema,
-        /** Which kind to author. Defaults to text-block. */
-        kind: z.enum(TEMPLATE_KINDS).optional(),
-        title: z.string().min(1).max(200),
-        content: z.string().max(200_000).nullable(),
-        contentFormat: contentFormatSchema.default("markdown"),
-        /** Folder path for the content tree. Optional + null = root node. */
-        folder: folderSchema.nullable().optional(),
-        /** Optional cross-tenant write — SystemAdmin only. Typical use: the
-         *  editor lets a SystemAdmin write onto SYSTEM_TENANT_ID, otherwise the
-         *  text lands on their own platform tenant and the legal routes miss it. */
-        tenantIdOverride: z.string().min(1).optional(),
-    }),
-    // SystemAdmin is a global role, TenantAdmin is per tenant-membership — both
-    // paths are needed explicitly, otherwise nobody can set SYSTEM_TENANT texts.
-    access: { roles: ["TenantAdmin", "SystemAdmin"] },
-    description: "Creates or overwrites one content-tree resource addressed by slug, kind and locale, carrying a title and folder and going live on save with no draft stage; a SystemAdmin may target the system tenant, where shared legal and marketing copy lives.",
-    handler: async (event, ctx) => {
-        const override = event.payload.tenantIdOverride;
-        // @cast-boundary engine-payload — override is a zod-validated string, the
-        // user's own tenantId is already TenantId-branded.
-        const tenantId = (override ?? event.user.tenantId);
-        const { db, streamTenantId } = requireForTenant(ctx, tenantId);
-        const kind = event.payload.kind ?? TEXT_BLOCK_KIND;
-        const existing = await fetchOne(db, templateResourcesTable, {
-            tenantId,
-            slug: event.payload.slug,
-            kind,
-            locale: event.payload.locale,
-        });
-        const scope = tenantId === SYSTEM_TENANT_ID ? "system" : "tenant";
-        let content = event.payload.content;
-        if (isOneOf(UPSERT_KINDS, kind)) {
-            const gated = gateTemplateWrite({
+export function makeSetWrite(policy) {
+    return defineWriteHandler({
+        name: "set",
+        schema: z.object({
+            slug: slugSchema,
+            locale: localeSchema,
+            /** Which kind to author. Defaults to text-block. */
+            kind: z.enum(TEMPLATE_KINDS).optional(),
+            title: z.string().min(1).max(200),
+            content: z.string().max(200_000).nullable(),
+            contentFormat: contentFormatSchema.default("markdown"),
+            /** Folder path for the content tree. Optional + null = root node. */
+            folder: folderSchema.nullable().optional(),
+            /** Optional cross-tenant write — SystemAdmin only. Typical use: the
+             *  editor lets a SystemAdmin write onto SYSTEM_TENANT_ID, otherwise the
+             *  text lands on their own platform tenant and the legal routes miss it. */
+            tenantIdOverride: z.string().min(1).optional(),
+        }),
+        access: templateEditAccess(policy.tenantEditable),
+        description: "Creates or overwrites one content-tree resource addressed by slug, kind and locale, carrying a title and folder and going live on save with no draft stage; a SystemAdmin may target the system tenant, where shared legal and marketing copy lives. A TenantAdmin may write only the slug and kind pairs the app lists in tenantEditable, otherwise SystemAdmin only.",
+        handler: async (event, ctx) => {
+            const kind = event.payload.kind ?? TEXT_BLOCK_KIND;
+            const refused = refuseTemplateEdit(policy, event.user, { slug: event.payload.slug, kind });
+            if (refused !== null)
+                return refused;
+            const override = event.payload.tenantIdOverride;
+            // @cast-boundary engine-payload — override is a zod-validated string, the
+            // user's own tenantId is already TenantId-branded.
+            const tenantId = (override ?? event.user.tenantId);
+            const { db, streamTenantId } = requireForTenant(ctx, tenantId);
+            const existing = await fetchOne(db, templateResourcesTable, {
+                tenantId,
+                slug: event.payload.slug,
                 kind,
-                scope,
-                contentFormat: event.payload.contentFormat,
+                locale: event.payload.locale,
+            });
+            const scope = tenantId === SYSTEM_TENANT_ID ? "system" : "tenant";
+            let content = event.payload.content;
+            if (isOneOf(UPSERT_KINDS, kind)) {
+                const gated = gateTemplateWrite({
+                    kind,
+                    scope,
+                    contentFormat: event.payload.contentFormat,
+                    content,
+                    rawMeta: parseStoredJson(existing?.meta ?? null),
+                    variables: resolveTemplateVariables(ctx.registry, event.payload.slug, storedRecord(existing?.variableSchema ?? null)),
+                }, "active");
+                if (!gated.ok)
+                    return gated.failure;
+                content = gated.evaluated.content;
+            }
+            const fields = {
+                slug: event.payload.slug,
+                kind,
+                locale: event.payload.locale,
+                title: event.payload.title,
                 content,
-                rawMeta: parseStoredJson(existing?.meta ?? null),
-                variables: resolveTemplateVariables(ctx.registry, event.payload.slug, storedRecord(existing?.variableSchema ?? null)),
-            }, "active");
-            if (!gated.ok)
-                return gated.failure;
-            content = gated.evaluated.content;
-        }
-        const fields = {
-            slug: event.payload.slug,
-            kind,
-            locale: event.payload.locale,
-            title: event.payload.title,
-            content,
-            contentFormat: event.payload.contentFormat,
-            folder: event.payload.folder ?? null,
-            variableSchema: "{}",
-            linkedResources: "{}",
-            scope,
-            parentTemplateId: null,
-            // Text blocks have no draft stage — saving publishes, so resolveTemplate
-            // (which only returns active rows) finds them.
-            status: "active",
-        };
-        if (existing) {
-            const result = await executor.update({
-                id: existing.id,
-                version: existing.version,
-                // Only the editable columns — slug/kind/locale are the unique key,
-                // and rewriting scope/status/variableSchema here would reset whatever
-                // the template upserts put on the row.
-                changes: {
-                    title: fields.title,
-                    content: fields.content,
-                    contentFormat: fields.contentFormat,
-                    folder: fields.folder,
-                },
-            }, event.user, db, { streamTenantId });
+                contentFormat: event.payload.contentFormat,
+                folder: event.payload.folder ?? null,
+                variableSchema: "{}",
+                linkedResources: "{}",
+                scope,
+                parentTemplateId: null,
+                // Text blocks have no draft stage — saving publishes, so resolveTemplate
+                // (which only returns active rows) finds them.
+                status: "active",
+            };
+            if (existing) {
+                const result = await executor.update({
+                    id: existing.id,
+                    version: existing.version,
+                    // Only the editable columns — slug/kind/locale are the unique key,
+                    // and rewriting scope/status/variableSchema here would reset whatever
+                    // the template upserts put on the row.
+                    changes: {
+                        title: fields.title,
+                        content: fields.content,
+                        contentFormat: fields.contentFormat,
+                        folder: fields.folder,
+                    },
+                }, event.user, db, { streamTenantId });
+                if (!result.isSuccess)
+                    return result;
+                return {
+                    isSuccess: true,
+                    data: { slug: event.payload.slug, locale: event.payload.locale, isNew: false },
+                };
+            }
+            const result = await executor.create({ ...fields, tenantId }, event.user, db, {
+                streamTenantId,
+            });
             if (!result.isSuccess)
                 return result;
             return {
                 isSuccess: true,
-                data: { slug: event.payload.slug, locale: event.payload.locale, isNew: false },
+                data: { slug: event.payload.slug, locale: event.payload.locale, isNew: true },
             };
-        }
-        const result = await executor.create({ ...fields, tenantId }, event.user, db, {
-            streamTenantId,
-        });
-        if (!result.isSuccess)
-            return result;
-        return {
-            isSuccess: true,
-            data: { slug: event.payload.slug, locale: event.payload.locale, isNew: true },
-        };
-    },
-});
+        },
+    });
+}

package/dist/template-resolver/handlers/shared.js

@@ -1,8 +1,8 @@
 import { createEventStoreExecutor } from "@cosmicdrift/kumiko-framework/db";
 import * as z from "zod";
-import { CONTENT_FORMATS, TEMPLATE_STATUSES, UPSERT_KINDS } from "../constants.js";
 import { templateResourceEntity, templateResourcesTable } from "../table.js";
 import { templateSlugSchema } from "../template-meta.js";
+import { CONTENT_FORMATS, TEMPLATE_STATUSES, UPSERT_KINDS } from "../web/constants.js";
 // One executor per bundle, shared by all four handlers for create/update via
 // event store + optimistic lock.
 export const executor = createEventStoreExecutor(templateResourcesTable, templateResourceEntity, {

package/dist/template-resolver/handlers/template-gates.d.ts

@@ -1,9 +1,9 @@
 import type { Registry, TemplateVariables } from "@cosmicdrift/kumiko-framework/engine";
 import type { FieldIssue } from "@cosmicdrift/kumiko-framework/errors";
-import { type ContentFormat, type TemplateKind } from "../constants.ts";
 import { type TemplateWriteScope } from "../layout-regions.ts";
 import type { TemplateResourceRow } from "../table.ts";
 import { type TemplateValidation } from "../template-validation.ts";
+import { type ContentFormat, type TemplateKind } from "../web/constants.ts";
 export declare function placeholderIssues(validation: TemplateValidation, opts: {
     readonly requireAllRequired: boolean;
 }): FieldIssue[];

package/dist/template-resolver/handlers/template-gates.js

@@ -1,10 +1,10 @@
 import { isOneOf } from "@cosmicdrift/kumiko-types/type-guards";
-import { CONTENT_FORMATS, TEMPLATE_KINDS, } from "../constants.js";
 import { documentViolationsToFieldIssues } from "../document-sanitizer.js";
 import { sanitizeTemplateWriteBody } from "../layout-regions.js";
 import { imageResourceKeysOf } from "../linked-resources.js";
 import { parseTemplateMeta } from "../template-meta.js";
 import { resolveTemplateVariables, validateTemplatePlaceholders, } from "../template-validation.js";
+import { CONTENT_FORMATS, TEMPLATE_KINDS, } from "../web/constants.js";
 const PLACEHOLDER_VALIDATED_KINDS = new Set([
     "mail",
     "document-pdf",

package/dist/template-resolver/handlers/template-write.d.ts

@@ -1,8 +1,8 @@
 import { type HandlerContext, type Registry, type SessionUser, type TemplateVariables, type TenantId, type WriteResult } from "@cosmicdrift/kumiko-framework/engine";
 import { type WriteFailure } from "@cosmicdrift/kumiko-framework/errors";
-import type { ContentFormat, TemplateKind } from "../constants.ts";
 import type { TemplateWriteScope } from "../layout-regions.ts";
 import type { TemplateValidation } from "../template-validation.ts";
+import type { ContentFormat, TemplateKind } from "../web/constants.ts";
 import { type TemplateWriteInput, type TemplateWriteResult } from "./template-gates.ts";
 export type TemplateRowPayload = {
     readonly slug: string;

package/dist/template-resolver/handlers/template-write.js

@@ -2,10 +2,10 @@ import { fetchOne } from "@cosmicdrift/kumiko-framework/db";
 import { SYSTEM_TENANT_ID, } from "@cosmicdrift/kumiko-framework/engine";
 import { AccessDeniedError, ValidationError, VersionConflictError, writeFailure, } from "@cosmicdrift/kumiko-framework/errors";
 import { requireForTenant } from "../../shared/index.js";
-import { TemplateResolverErrors } from "../qualified-names.js";
 import { templateResourcesTable } from "../table.js";
 import { activationChanges, serializeTemplateDraft } from "../template-draft.js";
 import { isSystemOnlyTemplate } from "../template-system-only.js";
+import { TemplateResolverErrors } from "../web/qualified-names.js";
 import { executor } from "./shared.js";
 import { evaluateTemplateWrite, } from "./template-gates.js";
 // The tenant-scope-under-system-tenant ban lives here so no write path can

package/dist/template-resolver/handlers/toggle-status.write.d.ts

@@ -1,11 +1,10 @@
 import { type HandlerContext } from "@cosmicdrift/kumiko-framework/engine";
 import * as z from "zod";
 import type { TemplateResourceRow } from "../table.ts";
+import { type TemplateEditPolicy } from "../template-edit-policy.ts";
 type TemplateStatus = "active" | "archived";
 export type StatusTarget = "own" | "system";
-export declare function writeAccessFor(target: StatusTarget): {
-    roles: string[];
-};
+export declare function writeAccessFor(target: StatusTarget, policy: TemplateEditPolicy): import("@cosmicdrift/kumiko-types/handlers").RoleAccessRule;
 export declare function loadTargetRow(ctx: HandlerContext, target: StatusTarget, user: {
     readonly tenantId: string;
 }, id: string): Promise<{
@@ -13,25 +12,25 @@ export declare function loadTargetRow(ctx: HandlerContext, target: StatusTarget,
     scoped: import("@cosmicdrift/kumiko-types/handlers").TenantWriteTarget | null;
     row: TemplateResourceRow | null;
 }>;
-export declare const archiveWrite: import("@cosmicdrift/kumiko-types/define-handler").WriteHandlerDefinition<string, z.ZodObject<{
+export declare function makeArchiveWrite(policy: TemplateEditPolicy): import("@cosmicdrift/kumiko-types/define-handler").WriteHandlerDefinition<string, z.ZodObject<{
     id: z.ZodString;
 }, z.core.$strip>, {
     id: string;
     status: TemplateStatus;
 }, import("@cosmicdrift/kumiko-types/event-type-map").KumikoEventTypeMap, undefined>;
-export declare const publishWrite: import("@cosmicdrift/kumiko-types/define-handler").WriteHandlerDefinition<string, z.ZodObject<{
+export declare function makePublishWrite(policy: TemplateEditPolicy): import("@cosmicdrift/kumiko-types/define-handler").WriteHandlerDefinition<string, z.ZodObject<{
     id: z.ZodString;
 }, z.core.$strip>, {
     id: string;
     status: TemplateStatus;
 }, import("@cosmicdrift/kumiko-types/event-type-map").KumikoEventTypeMap, undefined>;
-export declare const archiveSystemWrite: import("@cosmicdrift/kumiko-types/define-handler").WriteHandlerDefinition<string, z.ZodObject<{
+export declare function makeArchiveSystemWrite(policy: TemplateEditPolicy): import("@cosmicdrift/kumiko-types/define-handler").WriteHandlerDefinition<string, z.ZodObject<{
     id: z.ZodString;
 }, z.core.$strip>, {
     id: string;
     status: TemplateStatus;
 }, import("@cosmicdrift/kumiko-types/event-type-map").KumikoEventTypeMap, undefined>;
-export declare const publishSystemWrite: import("@cosmicdrift/kumiko-types/define-handler").WriteHandlerDefinition<string, z.ZodObject<{
+export declare function makePublishSystemWrite(policy: TemplateEditPolicy): import("@cosmicdrift/kumiko-types/define-handler").WriteHandlerDefinition<string, z.ZodObject<{
     id: z.ZodString;
 }, z.core.$strip>, {
     id: string;

package/dist/template-resolver/handlers/toggle-status.write.js

@@ -5,6 +5,7 @@ import * as z from "zod";
 import { requireForTenant } from "../../shared/index.js";
 import { templateResourcesTable } from "../table.js";
 import { activationChanges, parseTemplateDraft, toWorkingRow } from "../template-draft.js";
+import { refuseMissingTemplate, refuseTemplateEdit, templateEditAccess, } from "../template-edit-policy.js";
 import { executor } from "./shared.js";
 import { publishGateIssues } from "./template-gates.js";
 function isRowOfTarget(row, target, callerTenantId) {
@@ -12,8 +13,10 @@ function isRowOfTarget(row, target, callerTenantId) {
         ? row.tenantId === SYSTEM_TENANT_ID && row.scope === "system"
         : row.tenantId === callerTenantId && row.scope === "tenant";
 }
-export function writeAccessFor(target) {
-    return { roles: target === "system" ? ["SystemAdmin"] : ["TenantAdmin", "SystemAdmin"] };
+export function writeAccessFor(target, policy) {
+    return target === "system"
+        ? { roles: ["SystemAdmin"] }
+        : templateEditAccess(policy.tenantEditable);
 }
 // The tenant db also reads system rows; the row's own tenant must match the
 // target or the executor would append to a foreign event stream.
@@ -34,18 +37,25 @@ function planStatusChange(ctx, row, status) {
     }
     return { ok: true, changes: { ...parseTemplateDraft(row.draft), ...activationChanges(row) } };
 }
-function createStatusUpdateHandler(name, target, status, description) {
+function createStatusUpdateHandler(policy, name, target, status, description) {
     return defineWriteHandler({
         name,
         schema: z.object({ id: z.string().min(1) }),
-        access: writeAccessFor(target),
+        access: writeAccessFor(target, policy),
         // A system template change reaches every tenant without an override.
         ...(target === "system" ? { agent: { risk: "high" } } : {}),
         description,
         handler: async (event, ctx) => {
             const { db, scoped, row } = await loadTargetRow(ctx, target, event.user, event.payload.id);
-            if (!row)
-                return writeFailure(new NotFoundError("template-resource", event.payload.id));
+            if (!row) {
+                const refused = target === "own" ? refuseMissingTemplate(policy, event.user) : null;
+                return refused ?? writeFailure(new NotFoundError("template-resource", event.payload.id));
+            }
+            if (target === "own") {
+                const refused = refuseTemplateEdit(policy, event.user, row);
+                if (refused !== null)
+                    return refused;
+            }
             const plan = planStatusChange(ctx, row, status);
             if (!plan.ok)
                 return plan.failure;
@@ -56,7 +66,15 @@ function createStatusUpdateHandler(name, target, status, description) {
         },
     });
 }
-export const archiveWrite = createStatusUpdateHandler("archive", "own", "archived", "Sets one template resource of the caller's tenant to archived so the resolver stops serving it while the row and its content survive; use it to retire a template reversibly instead of deleting it. An open draft stays.");
-export const publishWrite = createStatusUpdateHandler("publish", "own", "active", "Sets one template resource of the caller's tenant to active so the resolver starts serving it; use it to release a draft written by upsert-tenant (a draft saved beside an active version replaces it), or to bring an archived template back; a version with unknown placeholders or unused required variables is refused and the served version stays.");
-export const archiveSystemWrite = createStatusUpdateHandler("archive-system", "system", "archived", "Sets one system-default template to archived so the resolver stops serving it to every tenant that has no override; SystemAdmin only, reversible with publish-system.");
-export const publishSystemWrite = createStatusUpdateHandler("publish-system", "system", "active", "Sets one system-default template to active so the resolver serves it again to every tenant that has no override; an open draft beside the active version replaces it; SystemAdmin only, a version with unknown placeholders or unused required variables is refused.");
+export function makeArchiveWrite(policy) {
+    return createStatusUpdateHandler(policy, "archive", "own", "archived", "Sets one template resource of the caller's tenant to archived so the resolver stops serving it while the row and its content survive; use it to retire a template reversibly instead of deleting it. An open draft stays. Outside the templates the app lists in tenantEditable only a SystemAdmin may use it.");
+}
+export function makePublishWrite(policy) {
+    return createStatusUpdateHandler(policy, "publish", "own", "active", "Sets one template resource of the caller's tenant to active so the resolver starts serving it; use it to release a draft written by upsert-tenant (a draft saved beside an active version replaces it), or to bring an archived template back; a version with unknown placeholders or unused required variables is refused and the served version stays. Outside the templates the app lists in tenantEditable only a SystemAdmin may use it.");
+}
+export function makeArchiveSystemWrite(policy) {
+    return createStatusUpdateHandler(policy, "archive-system", "system", "archived", "Sets one system-default template to archived so the resolver stops serving it to every tenant that has no override; SystemAdmin only, reversible with publish-system.");
+}
+export function makePublishSystemWrite(policy) {
+    return createStatusUpdateHandler(policy, "publish-system", "system", "active", "Sets one system-default template to active so the resolver serves it again to every tenant that has no override; an open draft beside the active version replaces it; SystemAdmin only, a version with unknown placeholders or unused required variables is refused.");
+}

package/dist/template-resolver/handlers/upsert-tenant.write.d.ts

@@ -1,5 +1,6 @@
 import * as z from "zod";
-export declare const upsertTenantWrite: import("@cosmicdrift/kumiko-types/define-handler").WriteHandlerDefinition<"upsert-tenant", z.ZodObject<{
+import { type TemplateEditPolicy } from "../template-edit-policy.ts";
+export declare function makeUpsertTenantWrite(policy: TemplateEditPolicy): import("@cosmicdrift/kumiko-types/define-handler").WriteHandlerDefinition<"upsert-tenant", z.ZodObject<{
     slug: z.ZodString;
     kind: z.ZodEnum<{
         "ai-prompt": "ai-prompt";

package/dist/template-resolver/handlers/upsert-tenant.write.js

@@ -1,5 +1,6 @@
 import { defineWriteHandler } from "@cosmicdrift/kumiko-framework/engine";
 import * as z from "zod";
+import { refuseTemplateEdit, templateEditAccess, } from "../template-edit-policy.js";
 import { resolveTemplateVariables } from "../template-validation.js";
 import { upsertPayloadSchema } from "./shared.js";
 import { writeTemplateRow } from "./template-write.js";
@@ -8,27 +9,32 @@ import { writeTemplateRow } from "./template-write.js";
 // via publish-Handler. SystemAdmin kann via tenantIdOverride für
 // einen anderen Tenant schreiben (typisch: Plattform-Admin-UI das
 // Tenant-Templates kuratiert).
-export const upsertTenantWrite = defineWriteHandler({
-    name: "upsert-tenant",
-    schema: upsertPayloadSchema.extend({
-        tenantIdOverride: z.string().min(1).optional(),
-        status: z.enum(["draft", "active"]).default("draft"),
-    }),
-    access: { roles: ["TenantAdmin", "SystemAdmin"] },
-    description: "Creates or overwrites a tenant-scoped template override with its variable schema, landing as a draft that only publish makes live (over an active override the draft is stored beside it, the active version keeps being served until publish); it refuses a system-tenant target, which is what upsert-system is for.",
-    handler: async (event, ctx) => {
-        // @cast-boundary engine-payload — override aus Zod-parsed string,
-        // event.user.tenantId schon TenantId-branded; union als TenantId casten
-        // ist legit (override ist UUID-Format-validiert in schema).
-        const tenantId = (event.payload.tenantIdOverride ?? event.user.tenantId);
-        return writeTemplateRow({
-            ctx,
-            user: event.user,
-            tenantId,
-            scope: "tenant",
-            status: event.payload.status,
-            variables: resolveTemplateVariables(ctx.registry, event.payload.slug, event.payload.variableSchema),
-            payload: event.payload,
-        });
-    },
-});
+export function makeUpsertTenantWrite(policy) {
+    return defineWriteHandler({
+        name: "upsert-tenant",
+        schema: upsertPayloadSchema.extend({
+            tenantIdOverride: z.string().min(1).optional(),
+            status: z.enum(["draft", "active"]).default("draft"),
+        }),
+        access: templateEditAccess(policy.tenantEditable),
+        description: "Creates or overwrites a tenant-scoped template override with its variable schema, landing as a draft that only publish makes live (over an active override the draft is stored beside it, the active version keeps being served until publish); it refuses a system-tenant target, which is what upsert-system is for; a TenantAdmin may write it only for templates the app lists in tenantEditable, otherwise SystemAdmin only.",
+        handler: async (event, ctx) => {
+            const refused = refuseTemplateEdit(policy, event.user, event.payload);
+            if (refused !== null)
+                return refused;
+            // @cast-boundary engine-payload — override is a zod-validated string and
+            // event.user.tenantId is already TenantId-branded; forTenant rejects the
+            // override for non-SystemAdmins.
+            const tenantId = (event.payload.tenantIdOverride ?? event.user.tenantId);
+            return writeTemplateRow({
+                ctx,
+                user: event.user,
+                tenantId,
+                scope: "tenant",
+                status: event.payload.status,
+                variables: resolveTemplateVariables(ctx.registry, event.payload.slug, event.payload.variableSchema),
+                payload: event.payload,
+            });
+        },
+    });
+}

package/dist/template-resolver/handlers/usage.query.js

@@ -1,10 +1,11 @@
 import { selectMany } from "@cosmicdrift/kumiko-framework/db";
 import { defineQueryHandler } from "@cosmicdrift/kumiko-framework/engine";
 import * as z from "zod";
-import { TEMPLATE_KINDS } from "../constants.js";
 import { templateResourcesTable } from "../table.js";
+import { deliveryPolicyOf } from "../template-delivery-policy.js";
 import { templateSlugSchema } from "../template-meta.js";
 import { collectTemplateUsage } from "../template-usage.js";
+import { TEMPLATE_KINDS } from "../web/constants.js";
 import { effectiveMailLayoutSlugs } from "./overview.query.js";
 const MAIL_ROW_LIMIT = 5000;
 export const usageQuery = defineQueryHandler({
@@ -18,7 +19,7 @@ export const usageQuery = defineQueryHandler({
             return { usedBy: collectTemplateUsage(ctx.registry, slug, kind) };
         const mailRows = await selectMany(ctx.db, templateResourcesTable, { kind: "mail" }, { limit: MAIL_ROW_LIMIT });
         return {
-            usedBy: collectTemplateUsage(ctx.registry, slug, kind, effectiveMailLayoutSlugs(mailRows)),
+            usedBy: collectTemplateUsage(ctx.registry, slug, kind, effectiveMailLayoutSlugs(mailRows, deliveryPolicyOf(ctx.registry))),
         };
     },
 });

package/dist/template-resolver/handlers/validate.query.d.ts

@@ -1,7 +1,7 @@
 import { type HandlerContext, type SessionUser } from "@cosmicdrift/kumiko-framework/engine";
 import * as z from "zod";
-import type { ContentFormat, UpsertKind } from "../constants.ts";
 import type { TemplateWriteScope } from "../layout-regions.ts";
+import type { ContentFormat, UpsertKind } from "../web/constants.ts";
 type TemplateDraftInput = {
     readonly slug: string;
     readonly kind: UpsertKind;

package/dist/template-resolver/handlers/validate.query.js

@@ -3,6 +3,7 @@ import { defineQueryHandler, SYSTEM_TENANT_ID, } from "@cosmicdrift/kumiko-frame
 import * as z from "zod";
 import { imageResourceKeysOf } from "../linked-resources.js";
 import { templateResourcesTable } from "../table.js";
+import { deliveryPolicyOf, isRowServedTo } from "../template-delivery-policy.js";
 import { isSystemAdmin } from "../template-draft.js";
 import { resolveTemplateVariables, systemPlaceholdersFor } from "../template-validation.js";
 import { contentFormatSchema, kindSchema, localeSchema, templateSlugSchema } from "./shared.js";
@@ -29,7 +30,8 @@ export async function knownResourceKeysFor(ctx, user, where) {
             scope: "system",
             locale,
         })),
-        ...(scope === "tenant"
+        ...(scope === "tenant" &&
+            isRowServedTo(deliveryPolicyOf(ctx.registry), user, { tenantId: user.tenantId, kind, slug })
             ? await knownResourceKeys(ctx.db, { tenantId: user.tenantId, slug, kind, scope, locale })
             : []),
     ];

package/dist/template-resolver/i18n.d.ts

@@ -0,0 +1,3 @@
+export declare const TEMPLATE_RESOLVER_I18N: Readonly<Record<string, {
+    readonly en: string;
+}>>;

package/dist/template-resolver/i18n.js

@@ -0,0 +1,24 @@
+import { handlerTitleKey } from "@cosmicdrift/kumiko-framework/engine";
+import { TemplateResolverHandlers as H } from "./web/qualified-names.js";
+// The AI assistant and its approval prompts name a handler by its title key; without
+// one the user reads the raw handler name. de/es/fr/it live in the locale packages.
+export const TEMPLATE_RESOLVER_I18N = {
+    [handlerTitleKey(H.upsertSystem)]: { en: "Save system template" },
+    [handlerTitleKey(H.upsertTenant)]: { en: "Save template" },
+    [handlerTitleKey(H.publish)]: { en: "Publish template" },
+    [handlerTitleKey(H.archive)]: { en: "Archive template" },
+    [handlerTitleKey(H.publishSystem)]: { en: "Publish system template" },
+    [handlerTitleKey(H.archiveSystem)]: { en: "Archive system template" },
+    [handlerTitleKey(H.discardDraft)]: { en: "Discard draft" },
+    [handlerTitleKey(H.discardDraftSystem)]: { en: "Discard system template draft" },
+    [handlerTitleKey(H.resetToSystem)]: { en: "Reset to system template" },
+    [handlerTitleKey(H.set)]: { en: "Save text" },
+    [handlerTitleKey(H.importBundle)]: { en: "Import template" },
+    [handlerTitleKey(H.importBundleSystem)]: { en: "Import system template" },
+    [handlerTitleKey(H.copyLocale)]: { en: "Copy template to another language" },
+    [handlerTitleKey(H.resourceUpload)]: { en: "Upload image or attachment" },
+    [handlerTitleKey(H.resourceRemove)]: { en: "Remove image or attachment" },
+    [handlerTitleKey(H.resourceLinkPdf)]: { en: "Attach PDF template" },
+    [handlerTitleKey(H.sendTest)]: { en: "Send test mail" },
+    [handlerTitleKey(H.patchDraft)]: { en: "Edit template draft" },
+};

package/dist/template-resolver/index.d.ts

@@ -1,9 +1,8 @@
+export { isResourceImageContentType } from "../shared/index.ts";
 export { createTemplateResolverApi, type ResolveRequest, requireTemplateResolver, TemplateNotFoundError, type TemplateResolverApi, type TemplateResource, } from "./api.ts";
-export { type CompileDocumentBodyOptions, collectDocumentResourceKeys, compileDocumentBodyToHandlebars, toResourceDataUri, } from "./compile-document-body.ts";
-export { CONTENT_FORMATS, type ContentFormat, DEFAULT_MAIL_LAYOUT_SLUG, DEFAULT_PDF_LAYOUT_SLUG, DOCUMENT_HTML_KINDS, type DocumentHtmlKind, FALLBACK_LOCALE, NON_RENDER_KINDS, type NonRenderKind, PDF_DEFAULT_MARGIN_MM, PDF_FOOTER_MARGIN_MM, PDF_HEADER_MARGIN_MM, PDF_ORIENTATIONS, PDF_PAGE_FORMATS, type PdfOrientation, type PdfPageFormat, RENDER_KINDS, type RenderKind, SYSTEM_TENANT_ID, TEMPLATE_KINDS, TEMPLATE_SCOPES, TEMPLATE_STATUSES, TEXT_BLOCK_KIND, type TemplateKind, type TemplateScope, type TemplateStatus, UPSERT_KINDS, type UpsertKind, } from "./constants.ts";
+export { type CompileDocumentBodyOptions, collectDocumentImageVariables, collectDocumentResourceKeys, compileDocumentBodyToHandlebars, toResourceDataUri, } from "./compile-document-body.ts";
 export { type DocumentViolation, type DocumentViolationCode, documentViolationsToFieldIssues, flattenParagraphsToLineBreaks, type SanitizeBodyResult, type SanitizeHtmlResult, sanitizeDocumentHtml, sanitizeTemplateBody, } from "./document-sanitizer.ts";
-export { DOCUMENT_CONDITION_ATTRIBUTE, DOCUMENT_NODE_NAMES, DOCUMENT_TEXT_ALIGNMENTS, DocumentButton, DocumentCondition, DocumentDivider, DocumentLink, DocumentPageBreak, DocumentResource, DocumentTable, DocumentTableCell, DocumentTableHeader, DocumentTableRow, DocumentTextAlign, type DocumentTextAlignment, DocumentVariable, documentExtensions, isAllowedDocumentLinkHref, isDocumentPlaceholderHref, isDocumentReferenceName, isDocumentResourceKey, } from "./document-schema.ts";
-export { createTemplateResolverFeature } from "./feature.ts";
+export { createTemplateResolverFeature, type TemplateResolverOptions } from "./feature.ts";
 export type { LayoutSourceResponse, LayoutSourceRow } from "./handlers/layout-source.query.ts";
 export type { OverviewKindGroup, OverviewOrigin, OverviewResponse, OverviewRow, OverviewUsage, } from "./handlers/overview.query.ts";
 export { localeSchema } from "./handlers/shared.ts";
@@ -11,11 +10,12 @@ export { isHexColor, type MailLayoutAppearance, mailLayoutAppearance, } from "./
 export { type LayoutRegions, readLayoutRegions, type SanitizeLayoutResult, sanitizeLayoutHtml, } from "./layout-regions.ts";
 export { fileAttachmentsOf, imageLinksOf, type LinkedResourceEntry, parseLinkedResourceEntries, pdfAttachmentLinksOf, type TemplatePdfAttachmentLink, templatePdfAttachmentLinkSchema, } from "./linked-resources.ts";
 export { prepareDocumentForPrint } from "./print-document.ts";
-export { TEMPLATE_RESOLVER_FEATURE, TemplateResolverErrors, TemplateResolverHandlers, TemplateResolverQueries, } from "./qualified-names.ts";
 export { mapRecordToVariables } from "./record-mapping.ts";
 export { type PreparedTemplateImage, prepareTemplateResourceBeforeTransaction, readTemplateResourceMaxBytes, type StoredTemplateResource, storePreparedTemplateResource, } from "./store-template-resource.ts";
 export { type TemplateResourceRow, templateResourceEntity, templateResourcesTable, } from "./table.ts";
 export { type TemplateBundle, templateBundleSchema } from "./template-bundle.ts";
+export type { TemplateDeliveryPolicy } from "./template-delivery-policy.ts";
+export { type TemplateEditPolicy, type TenantEditableTemplate, templateEditAccess, } from "./template-edit-policy.ts";
 export { isMailTemplateMeta, type LayoutTemplateMeta, MAIL_CATEGORIES, MAIL_TONES, type MailCategory, type MailLayoutMeta, type MailTemplateMeta, type MailTone, type PdfTemplateMeta, parseTemplateMeta, pdfAttachmentFileNamePatternSchema, readMailLayoutMeta, readPdfTemplateMeta, type TemplateMeta, type TemplateMetaIssue, type TemplateMetaResult, templateSlugSchema, } from "./template-meta.ts";
 export { type DocumentDraftOutcome, evaluateDocumentDraft } from "./template-preview.ts";
 export { readTemplateResource, type TemplateResourceFile } from "./template-resources.ts";
@@ -23,3 +23,6 @@ export { isSystemOnlyTemplate } from "./template-system-only.ts";
 export { collectTemplateUsage, type TemplateUsageEntry } from "./template-usage.ts";
 export { hasPlaceholderProblems, resolveTemplateVariables, SYSTEM_PLACEHOLDERS, systemPlaceholdersFor, type TemplateValidation, validateTemplatePlaceholders, } from "./template-validation.ts";
 export { type UserContentEntryRow, userContentEntriesTable, userContentEntryEntity, } from "./user-content-table.ts";
+export { CONTENT_FORMATS, type ContentFormat, DEFAULT_MAIL_LAYOUT_SLUG, DEFAULT_PDF_LAYOUT_SLUG, DOCUMENT_HTML_KINDS, type DocumentHtmlKind, FALLBACK_LOCALE, NON_RENDER_KINDS, type NonRenderKind, PDF_DEFAULT_MARGIN_MM, PDF_FOOTER_MARGIN_MM, PDF_HEADER_MARGIN_MM, PDF_ORIENTATIONS, PDF_PAGE_FORMATS, type PdfOrientation, type PdfPageFormat, RENDER_KINDS, type RenderKind, SYSTEM_TENANT_ID, TEMPLATE_KINDS, TEMPLATE_SCOPES, TEMPLATE_STATUSES, TEXT_BLOCK_KIND, type TemplateKind, type TemplateScope, type TemplateStatus, UPSERT_KINDS, type UpsertKind, } from "./web/constants.ts";
+export { DOCUMENT_CONDITION_ATTRIBUTE, DOCUMENT_NODE_NAMES, DOCUMENT_TEXT_ALIGNMENTS, DocumentButton, DocumentCondition, DocumentDivider, DocumentLink, DocumentPageBreak, DocumentResource, DocumentTable, DocumentTableCell, DocumentTableHeader, DocumentTableRow, DocumentTextAlign, type DocumentTextAlignment, DocumentVariable, documentExtensions, isAllowedDocumentLinkHref, isDocumentPlaceholderHref, isDocumentReferenceName, isDocumentResourceKey, } from "./web/document-schema.ts";
+export { TEMPLATE_RESOLVER_FEATURE, TemplateResolverErrors, TemplateResolverHandlers, TemplateResolverQueries, } from "./web/qualified-names.ts";