@cosmicdrift/kumiko-bundled-features 0.378.0 → 0.379.0

package/dist/tags/web/tag-manager.js

@@ -1,5 +1,4 @@
 import { jsx as _jsx, jsxs as _jsxs } from "react/jsx-runtime";
-// @runtime client
 // TagManager — the shared tag-catalog UI, GitLab-labels style. Built ONCE,
 // mounted twice:
 //   - standalone:  <TagManager />                       → the Tags admin screen
@@ -11,8 +10,9 @@ import { jsx as _jsx, jsxs as _jsxs } from "react/jsx-runtime";
 // per-tenant catalog. Selection is buffered by the caller (TagPicker) and only
 // applied on confirm — managing labels and picking them are separate concerns.
 import { useDispatcher, usePrimitives, useQuery, useTranslation, } from "@cosmicdrift/kumiko-renderer";
+import { pluralKey } from "@cosmicdrift/kumiko-renderer/headless";
 import { useState } from "react";
-import { TagsHandlers, TagsQueries } from "../constants.js";
+import { TagsHandlers, TagsQueries } from "./constants.js";
 import { TagChip } from "./tag-chip.js";
 // A small fixed palette so labels stay visually distinct without a color-wheel
 // dependency; the hex field below still accepts any custom value.
@@ -66,6 +66,7 @@ export function TagManager({ entityType, selection, }) {
     const usage = new Map();
     for (const a of assignments.data?.rows ?? [])
         usage.set(a.tagId, (usage.get(a.tagId) ?? 0) + 1);
+    const deletingUsage = usage.get(deleting?.id ?? "") ?? 0;
     const selecting = selection !== undefined;
     const allTags = catalog.data?.rows ?? [];
     const tags = selecting
@@ -162,7 +163,7 @@ export function TagManager({ entityType, selection, }) {
     return (_jsxs("div", { "data-testid": "tag-manager", className: "flex flex-col gap-4", children: [_jsxs("div", { className: "flex flex-col gap-2 rounded-md border p-3", children: [_jsx(Field, { id: "tag-manager-new-name", label: t("tags.manage.newLabel"), children: _jsx(Input, { kind: "text", id: "tag-manager-new-name", name: "newTagName", value: newName, onChange: setNewName, placeholder: t("tags.manage.namePlaceholder") }) }), _jsx(ColorPicker, { value: newColor, onChange: setNewColor, idPrefix: "tag-manager-new-color" }), !selecting && (_jsx(Field, { id: "tag-manager-new-scope", label: t("tags.manage.scopeLabel"), children: _jsx(Input, { kind: "text", id: "tag-manager-new-scope", name: "newTagScope", value: newScope, onChange: setNewScope, placeholder: t("tags.manage.scopePlaceholder") }) })), _jsx("div", { children: _jsx(Button, { variant: "primary", disabled: busy || newName.trim() === "", onClick: () => createTag(), testId: "tag-manager-create", children: busy ? t("tags.section.working") : t("tags.manage.create") }) })] }), tags.length === 0 ? (_jsx(Banner, { variant: "info", testId: "tag-manager-empty", children: _jsx(Text, { children: t("tags.section.empty") }) })) : (_jsx("div", { className: "flex flex-col gap-1", children: tags.map((tag) => editingId === tag.id ? (_jsxs("div", { "data-testid": `tag-manager-edit-${tag.id}`, className: "flex flex-col gap-2 rounded-md border p-3", children: [_jsx(Input, { kind: "text", id: `tag-edit-name-${tag.id}`, name: "editName", value: editName, onChange: setEditName }), _jsx(ColorPicker, { value: editColor, onChange: setEditColor, idPrefix: `tag-edit-color-${tag.id}` }), _jsx(Input, { kind: "text", id: `tag-edit-scope-${tag.id}`, name: "editScope", value: editScope, onChange: setEditScope, placeholder: t("tags.manage.scopePlaceholder") }), _jsxs("div", { className: "flex gap-2", children: [_jsx(Button, { variant: "primary", disabled: busy || editName.trim() === "", onClick: () => saveEdit(tag), testId: `tag-manager-save-${tag.id}`, children: t("tags.manage.save") }), _jsx(Button, { variant: "secondary", disabled: busy, onClick: () => setEditingId(null), children: t("tags.manage.cancel") })] })] }, tag.id)) : (_jsxs("div", { "data-testid": `tag-manager-row-${tag.id}`, className: "flex items-center gap-2 rounded-md px-2 py-1 hover:bg-muted", children: [selecting && (_jsx(Button, { variant: selection?.value.includes(tag.id) ? "primary" : "secondary", onClick: () => toggle(tag.id), testId: `tag-manager-toggle-${tag.id}`, children: selection?.value.includes(tag.id) ? "✓" : "+" })), _jsx(TagChip, { name: tag.name, color: tag.color }), !selecting && (tag.scope ?? "") !== "" && (_jsx(Text, { variant: "small", children: `@${tag.scope}` })), _jsx(Text, { variant: "small", children: t("tags.manage.usage", { count: usage.get(tag.id) ?? 0 }) }), _jsxs("div", { className: "ml-auto flex gap-1", children: [_jsx(Button, { variant: "secondary", disabled: busy, onClick: () => startEdit(tag), testId: `tag-manager-edit-btn-${tag.id}`, children: t("tags.manage.edit") }), _jsx(Button, { variant: "danger", disabled: busy, onClick: () => setDeleting(tag), testId: `tag-manager-delete-btn-${tag.id}`, children: t("tags.manage.delete") })] })] }, tag.id))) })), errorKey !== null && (_jsx(Banner, { variant: "error", testId: "tag-manager-action-error", children: _jsx(Text, { children: t(errorKey) }) })), _jsx(Dialog, { open: deleting !== null, onOpenChange: (open) => {
                     if (!open)
                         setDeleting(null);
-                }, title: t("tags.manage.deleteConfirmTitle", { name: deleting?.name ?? "" }), description: t("tags.manage.deleteConfirmDesc", {
-                    count: usage.get(deleting?.id ?? "") ?? 0,
+                }, title: t("tags.manage.deleteConfirmTitle", { name: deleting?.name ?? "" }), description: t(pluralKey("tags.manage.deleteConfirmDesc", deletingUsage), {
+                    count: deletingUsage,
                 }), confirmLabel: t("tags.manage.delete"), variant: "danger", onConfirm: confirmDelete, testId: "tag-manager-delete-dialog" })] }));
 }

package/dist/tags/web/tag-picker.js

@@ -1,5 +1,4 @@
 import { jsx as _jsx } from "react/jsx-runtime";
-// @runtime client
 // TagPicker — the shared "manage + pick labels" modal. Wraps TagManager in
 // select-mode inside a Dialog: the user can create/recolor/delete labels (those
 // hit the catalog immediately) and toggle which ones apply (buffered). On

package/dist/tags/web/tag-section.js

@@ -1,5 +1,4 @@
 import { jsx as _jsx, jsxs as _jsxs } from "react/jsx-runtime";
-// @runtime client
 // TagSection — drop-in tag editor for ANY entity, GitLab-labels style. Shows the
 // entity's tags as colored chips plus an "Edit tags" button that opens the
 // shared TagPicker modal (pick + manage). Applying the picker diffs the
@@ -14,7 +13,7 @@ import { jsx as _jsx, jsxs as _jsxs } from "react/jsx-runtime";
 //                   (RenderEdit passes { entityName, entityId }).
 import { useDispatcher, usePrimitives, useQuery, useTranslation, } from "@cosmicdrift/kumiko-renderer";
 import { useState } from "react";
-import { TagsHandlers, TagsQueries } from "../constants.js";
+import { TagsHandlers, TagsQueries } from "./constants.js";
 import { TagChip } from "./tag-chip.js";
 import { TagPicker } from "./tag-picker.js";
 // What changed between the entity's current tags and the picker's new selection.

package/dist/tags/web/tags-cell.js

@@ -1,5 +1,4 @@
 import { jsx as _jsx } from "react/jsx-runtime";
-// @runtime client
 // TagsCell — a reusable columnRenderer that shows an entity's tags as colored
 // chips inline in a list row. Drop it into ANY entityList by declaring a labeled
 // virtual column (no host-schema change), after mounting tagsClient():
@@ -16,7 +15,7 @@ import { jsx as _jsx } from "react/jsx-runtime";
 // calls, so the whole column shares two queries, not two-per-row. For huge
 // assignment sets add a server-side entitiesByTag query + join filter.
 import { useQuery } from "@cosmicdrift/kumiko-renderer";
-import { TagsQueries } from "../constants.js";
+import { TagsQueries } from "./constants.js";
 import { TagChip } from "./tag-chip.js";
 export function TagsCell({ row }) {
     const entityId = String(row["id"] ?? "");

package/dist/template-resolver/api.d.ts

@@ -1,10 +1,12 @@
 import type { DbRunner, TenantDb } from "@cosmicdrift/kumiko-framework/db";
-import type { SessionUser, TenantId } from "@cosmicdrift/kumiko-framework/engine";
+import type { Registry, SessionUser, TenantId } from "@cosmicdrift/kumiko-framework/engine";
 import type { Temporal } from "@cosmicdrift/kumiko-types/temporal";
 import type { FileAttachmentRef } from "../renderer-foundation/index.ts";
-import type { ContentFormat, TemplateKind } from "./constants.ts";
 import { type TemplatePdfAttachmentLink } from "./linked-resources.ts";
+import { type TemplateResourceRow } from "./table.ts";
+import { type TemplateDeliveryPolicy } from "./template-delivery-policy.ts";
 import { type TemplateMeta } from "./template-meta.ts";
+import type { ContentFormat, TemplateKind } from "./web/constants.ts";
 export type TemplateResource = {
     readonly id: string;
     readonly version: number;
@@ -46,15 +48,11 @@ export type ResolveLayoutRequest = {
 };
 export type TemplateResolverApi = {
     /**
-     * Findet ein konkretes Template by (tenantId, slug, kind, locale).
-     * Kein Locale-Fallback, keine Override-Hierarchie — Raw-Lookup für
-     * Admin-UI-Edits und Konformitäts-Tests. Für Render-Aufrufe immer
-     * `resolveTemplate` nutzen.
+     * Raw lookup by (tenantId, slug, kind, locale): no locale fallback, no override
+     * hierarchy. Render paths must use `resolveTemplate`. `scope: "system"` forces
+     * SYSTEM_TENANT_ID and ignores the passed tenantId.
      *
-     * `scope: "system"` zwingt Lookup gegen SYSTEM_TENANT_ID (ignoriert
-     * den übergebenen tenantId). Default = Lookup gegen den übergebenen
-     * tenantId direkt (Caller wählt entweder Tenant oder System per
-     * tenantId).
+     * Tenant rows of a template that is not tenantEditable are not returned.
      */
     readonly findExact: (args: {
         readonly tenantId: TenantId;
@@ -64,18 +62,10 @@ export type TemplateResolverApi = {
         readonly scope?: "system";
     }) => Promise<TemplateResource | null>;
     /**
-     * Resolver mit 4-Stufen-Fallback (siehe template-resolver.md):
-     *   1. tenant + requested-locale
-     *   2. system + requested-locale
-     *   3. tenant + FALLBACK_LOCALE
-     *   4. system + FALLBACK_LOCALE
-     * Resource-Substitution wird hier NICHT ausgeführt — das macht der
-     * Caller (renderer-foundation-Plugin) je nach kind-passendem Modus
-     * (inline-base64 vs. signed-url). API liefert TemplateResource pur.
-     *
-     * **Caller-Invariante:** `tenantId` MUSS vom Server kommen (typisch
-     * `ctx.user.tenantId`). Niemals direkt aus User-Input — sonst kann
-     * User cross-tenant Templates abfragen (Tenant-Isolation gebrochen).
+     * Four-step fallback: tenant+locale, system+locale, tenant+FALLBACK_LOCALE,
+     * system+FALLBACK_LOCALE (see template-resolver.md).
+     * Tenant rows count only for templates unlocked for tenants (tenantEditable,
+     * or a collection with access); locked overrides are skipped but stay stored.
      */
     readonly resolveTemplate: (args: ResolveRequest) => Promise<TemplateResource>;
     /**
@@ -89,7 +79,15 @@ export type TemplateResolverApi = {
      */
     readonly resolveLayout: (args: ResolveLayoutRequest) => Promise<TemplateResource>;
 };
-export declare function createTemplateResolverApi(db: DbRunner | TenantDb): TemplateResolverApi;
+export declare function createTemplateResolverApi(db: DbRunner | TenantDb, registry: Registry): TemplateResolverApi;
+export declare function isRowDelivered(db: DbRunner | TenantDb, policy: TemplateDeliveryPolicy, row: TemplateResourceRow): Promise<boolean>;
+export declare function isRowDeliveredTo(db: DbRunner | TenantDb, policy: TemplateDeliveryPolicy, user: {
+    readonly roles: readonly string[];
+}, row: TemplateResourceRow): Promise<boolean>;
+export declare function filterDeliveredTo(db: DbRunner | TenantDb, policy: TemplateDeliveryPolicy, user: {
+    readonly roles: readonly string[];
+}, rows: readonly TemplateResourceRow[]): Promise<TemplateResourceRow[]>;
+export declare function systemTemplateExists(db: DbRunner | TenantDb, kind: string, slug: string): Promise<boolean>;
 export declare class TemplateNotFoundError extends Error {
     readonly query: {
         slug: string;

package/dist/template-resolver/api.js

@@ -3,17 +3,21 @@
 // ctx.templateResolver at runtime.
 import { selectMany } from "@cosmicdrift/kumiko-framework/db";
 import { InternalError } from "@cosmicdrift/kumiko-framework/errors";
-import { FALLBACK_LOCALE, SYSTEM_TENANT_ID } from "./constants.js";
 import { fileAttachmentsOf, imageLinksOf, parseLinkedResourceEntries, pdfAttachmentLinksOf, } from "./linked-resources.js";
 import { templateResourcesTable } from "./table.js";
-import { activeVersionOf, servedVersionOf } from "./template-draft.js";
+import { deliveryPolicyOf, isRowServed, isServedByCollectionOnly, } from "./template-delivery-policy.js";
+import { activeVersionOf, isSystemAdmin, servedVersionOf } from "./template-draft.js";
 import { parseTemplateMeta } from "./template-meta.js";
-export function createTemplateResolverApi(db) {
+import { FALLBACK_LOCALE, SYSTEM_TENANT_ID } from "./web/constants.js";
+export function createTemplateResolverApi(db, registry) {
+    const deliveryPolicy = deliveryPolicyOf(registry);
+    // A collection entry must not shadow a system template of the same slug that the app did not unlock.
+    const isServed = (row) => isRowDelivered(db, deliveryPolicy, row);
     return {
         findExact: async ({ tenantId, slug, kind, locale, scope }) => {
             const effectiveTenantId = scope === "system" ? SYSTEM_TENANT_ID : tenantId;
             const row = await fetchTemplate(db, effectiveTenantId, slug, kind, locale);
-            return row ? toPublic(row) : null;
+            return row && (await isServed(row)) ? toPublic(row) : null;
         },
         resolveTemplate: async ({ tenantId, slug, kind, locale }) => {
             // Fallback-Chain — finde erste passende Variante
@@ -28,14 +32,18 @@ export function createTemplateResolverApi(db) {
                     : []),
             ];
             for (const c of candidates) {
+                if (!isRowServed(deliveryPolicy, { tenantId: c.tid, kind, slug }))
+                    continue;
                 const row = await fetchTemplate(db, c.tid, slug, kind, c.loc);
-                if (row && row.status === "active")
+                if (row && row.status === "active" && (await isServed(row)))
                     return toPublic(row);
             }
             throw new TemplateNotFoundError({ slug, kind, locale });
         },
         resolveLayout: async ({ tenantId, slug, kind, locale }) => {
             for (const tid of [tenantId, SYSTEM_TENANT_ID]) {
+                if (!isRowServed(deliveryPolicy, { tenantId: tid, kind, slug }))
+                    continue;
                 const rows = await selectMany(db, templateResourcesTable, {
                     tenantId: tid,
                     slug,
@@ -49,6 +57,26 @@ export function createTemplateResolverApi(db) {
         },
     };
 }
+// The one delivery rule for a stored row: unlocked, and a collection entry never shadows a system
+// template of the same slug that the app did not unlock.
+export async function isRowDelivered(db, policy, row) {
+    if (!isRowServed(policy, row))
+        return false;
+    if (row.tenantId === SYSTEM_TENANT_ID || !isServedByCollectionOnly(policy, row))
+        return true;
+    return !(await systemTemplateExists(db, row.kind, row.slug));
+}
+export async function isRowDeliveredTo(db, policy, user, row) {
+    return isSystemAdmin(user) || (await isRowDelivered(db, policy, row));
+}
+export async function filterDeliveredTo(db, policy, user, rows) {
+    const flags = await Promise.all(rows.map((row) => isRowDeliveredTo(db, policy, user, row)));
+    return rows.filter((_, index) => flags[index]);
+}
+export async function systemTemplateExists(db, kind, slug) {
+    const rows = await selectMany(db, templateResourcesTable, { tenantId: SYSTEM_TENANT_ID, slug, kind }, { limit: 1 });
+    return rows.length > 0;
+}
 function pickActiveLayoutRow(rows, locale) {
     const active = rows
         .filter((row) => row.status === "active")
@@ -139,7 +167,7 @@ export function requireTemplateResolver(ctx, callerName) {
     if (!api) {
         throw new InternalError({
             message: `[${callerName}] ctx.templateResolver missing — App-Bootstrap muss ` +
-                `extraContext: { templateResolver: createTemplateResolverApi(db) } setzen ` +
+                `extraContext: { templateResolver: createTemplateResolverApi(db, registry) } setzen ` +
                 `(siehe template-resolver/README.md).`,
         });
     }

package/dist/template-resolver/compile-document-body.js

@@ -2,7 +2,7 @@ import { isOneOf } from "@cosmicdrift/kumiko-types/type-guards";
 import { isResourceImageContentType } from "../shared/index.js";
 import { rewriteStepsBlock } from "./compile-steps-block.js";
 import { conditionScopeElement, withParsedDocument } from "./document-sanitizer.js";
-import { DOCUMENT_CONDITION_ATTRIBUTE, DOCUMENT_TEXT_ALIGNMENTS, isAllowedDocumentLinkHref, isDocumentPlaceholderHref, isDocumentReferenceName, isDocumentResourceKey, } from "./document-schema.js";
+import { DOCUMENT_CONDITION_ATTRIBUTE, DOCUMENT_TEXT_ALIGNMENTS, isAllowedDocumentLinkHref, isDocumentPlaceholderHref, isDocumentReferenceName, isDocumentResourceKey, } from "./web/document-schema.js";
 // Private-use characters mark where a Handlebars expression goes. Author text
 // is scrubbed of them first and every `{`/`}` is entity-encoded before the
 // markers are swapped for real expressions, so the only Handlebars syntax in

package/dist/template-resolver/compile-steps-block.js

@@ -1,6 +1,6 @@
-import { isDocumentReferenceName } from "./document-schema.js";
-import { readDocumentSteps } from "./document-steps.js";
 import { isHexColor } from "./layout-appearance.js";
+import { isDocumentReferenceName } from "./web/document-schema.js";
+import { readDocumentSteps } from "./web/document-steps.js";
 export const DEFAULT_STEPS_COLOR = "#1f5468";
 const TODO_BAR_COLOR = "#ECEDEA";
 const REACHED_LABEL_COLOR = "#0B0D12";

package/dist/template-resolver/document-ops.d.ts

@@ -1,7 +1,7 @@
 import type { FieldIssue } from "@cosmicdrift/kumiko-framework/errors";
 import { type JSONContent } from "@tiptap/core";
 import * as z from "zod";
-import type { DocumentHtmlKind } from "./constants.ts";
+import type { DocumentHtmlKind } from "./web/constants.ts";
 export declare const MAX_DOCUMENT_OPS = 50;
 export type DocumentBlockType = "paragraph" | "heading" | "list" | "table" | "repeat" | "image" | "button" | "divider" | "pageBreak" | "steps";
 export type DocumentBlock = {

package/dist/template-resolver/document-ops.js

@@ -1,9 +1,9 @@
 import { getSchema } from "@tiptap/core";
 import * as z from "zod";
-import { documentBlocksForKind } from "./document-blocks.js";
-import { DOCUMENT_TEXT_ALIGNMENTS, documentExtensions, isDocumentPlaceholderHref, isDocumentReferenceName, isDocumentResourceKey, } from "./document-schema.js";
-import { contentToLine, lineToContent, singleLine } from "./placeholder-text.js";
 import { toVariableDef } from "./template-validation.js";
+import { documentBlocksForKind } from "./web/document-blocks.js";
+import { DOCUMENT_TEXT_ALIGNMENTS, documentExtensions, isDocumentPlaceholderHref, isDocumentReferenceName, isDocumentResourceKey, } from "./web/document-schema.js";
+import { contentToLine, lineToContent, singleLine } from "./web/placeholder-text.js";
 export const MAX_DOCUMENT_OPS = 50;
 // Assigning these keys would reach the prototype of the meta object.
 const FORBIDDEN_META_KEYS = new Set(["__proto__", "prototype", "constructor"]);

package/dist/template-resolver/document-sanitizer.d.ts

@@ -1,7 +1,7 @@
 import type { FieldIssue } from "@cosmicdrift/kumiko-framework/errors";
 import type { JSONContent } from "@tiptap/core";
 import { type Element as ScanElement } from "happy-dom";
-import type { ContentFormat } from "./constants.ts";
+import type { ContentFormat } from "./web/constants.ts";
 export type DocumentViolationCode = "script_element" | "event_handler_attribute" | "disallowed_link_href" | "external_image_source" | "image_without_resource" | "invalid_reference_name" | "embedded_content" | "unsafe_attribute_value" | "images_block_pdf_only" | "button_href_not_placeholder" | "document_requires_html_format" | "layout_requires_mjml_format" | "layout_invalid_structure" | "layout_missing_content_slot" | "layout_source_system_only";
 export type DocumentViolation = {
     readonly code: DocumentViolationCode;

package/dist/template-resolver/document-sanitizer.js

@@ -1,9 +1,9 @@
 import { isOneOf } from "@cosmicdrift/kumiko-types/type-guards";
 import { generateHTML, generateJSON } from "@tiptap/html/server";
 import { Window } from "happy-dom";
-import { DOCUMENT_HTML_KINDS } from "./constants.js";
-import { DOCUMENT_CONDITION_ATTRIBUTE, documentExtensions, isAllowedDocumentLinkHref, isDocumentPlaceholderHref, isDocumentReferenceName, isDocumentResourceKey, } from "./document-schema.js";
-import { isDocumentStepKey } from "./document-steps.js";
+import { DOCUMENT_HTML_KINDS } from "./web/constants.js";
+import { DOCUMENT_CONDITION_ATTRIBUTE, documentExtensions, isAllowedDocumentLinkHref, isDocumentPlaceholderHref, isDocumentReferenceName, isDocumentResourceKey, } from "./web/document-schema.js";
+import { isDocumentStepKey } from "./web/document-steps.js";
 export function violation(code, detail, message) {
     return { code, detail, message };
 }

package/dist/template-resolver/feature.d.ts

@@ -1,4 +1,5 @@
 import { type ContentCollectionDefinition } from "@cosmicdrift/kumiko-framework/engine";
+import type { TemplateDeliveryPolicy } from "./template-delivery-policy.ts";
 import type { TenantEditableTemplate } from "./template-edit-policy.ts";
 export type TemplateResolverOptions = {
     /** Content collections this app mounts. Declared here rather than inside the
@@ -71,5 +72,6 @@ export declare function createTemplateResolverFeature(opts?: TemplateResolverOpt
                 };
             };
         }>;
+        deliveryPolicy: TemplateDeliveryPolicy;
     };
 };

package/dist/template-resolver/feature.js

@@ -1,5 +1,4 @@
 import { createSystemConfig, defineFeature, } from "@cosmicdrift/kumiko-framework/engine";
-import { DEFAULT_COLLECTION_ACCESS, isCollectionRefusedKind } from "./constants.js";
 import { bySlugQuery } from "./handlers/by-slug.query.js";
 import { byTenantQuery } from "./handlers/by-tenant.query.js";
 import { makeCollectionItemQuery } from "./handlers/collection-item.query.js";
@@ -31,8 +30,10 @@ import { upsertSystemWrite } from "./handlers/upsert-system.write.js";
 import { makeUpsertTenantWrite } from "./handlers/upsert-tenant.write.js";
 import { usageQuery } from "./handlers/usage.query.js";
 import { validateQuery } from "./handlers/validate.query.js";
+import { TEMPLATE_RESOLVER_I18N } from "./i18n.js";
 import { templateResourceEntity } from "./table.js";
 import { userContentEntryEntity } from "./user-content-table.js";
+import { DEFAULT_COLLECTION_ACCESS, isCollectionRefusedKind } from "./web/constants.js";
 function assertCollectionKindsAllowed(collections) {
     for (const collection of collections) {
         if (isCollectionRefusedKind(collection.kind)) {
@@ -62,12 +63,18 @@ export function createTemplateResolverFeature(opts = {}) {
     const tenantEditable = opts.tenantEditable ?? [];
     assertTenantEditableValid(tenantEditable);
     const policy = { tenantEditable };
+    const deliveryPolicy = {
+        tenantEditable: tenantEditable.map(({ kind, slug }) => ({ kind, slug })),
+        collectionKinds: collections
+            .filter((c) => c.ownership !== "user" && c.access !== undefined)
+            .map((c) => c.kind),
+    };
     const hasUserOwned = collections.some((c) => c.ownership === "user");
     return defineFeature("template-resolver", (r) => {
         r.describe([
             "Every piece of editable text lives here, in one entity: mail bodies, notification texts, PDF document templates, AI prompts and plain text blocks. What a record is used for is the `kind` (`notification`, `mail`, `mail-layout`, `document-pdf`, `pdf-layout`, `ai-prompt`, `text-block`, `snippet`, `image-snapshot`).",
             "Reading is one call — `ctx.templateResolver.resolveTemplate({ tenantId, slug, kind, locale })`. It walks four levels: tenant+locale, system+locale, tenant+fallback-locale, system+fallback-locale. A tenant overrides a system default by simply having its own record; no application code changes. Writing programmatically goes through the `upsertSystem`, `upsertTenant`, `publish` and `archive` write handlers; a SystemAdmin retires or restores a system default with `publishSystem` and `archiveSystem`, and a tenant drops its override with `resetToSystem`. Saving a draft over an active template keeps the active version served and stores the edit beside it (column `draft`); `publish` makes it the served version, `discardDraft` / `discardDraftSystem` throws it away.",
-            'Editing templates is for SystemAdmin only. A TenantAdmin edits only the templates the app unlocks at the mount site, `createTemplateResolverFeature({ tenantEditable: [{ kind: "mail", slug: "status-update", access: { roles: ["TenantAdmin"] } }] })`, and every write handler enforces that on the server (override, draft, publish, archive, reset, copy-locale, import, resources, `set`). Each entry carries the `access` roles allowed to edit it, because a bundled feature cannot know the host\'s roles. Reading and delivery do not depend on it: a tenant override that exists is served. A collection mounted without `access` is SystemAdmin only.',
+            'Editing templates is for SystemAdmin only. A TenantAdmin edits only the templates the app unlocks at the mount site, `createTemplateResolverFeature({ tenantEditable: [{ kind: "mail", slug: "status-update", access: { roles: ["TenantAdmin"] } }] })`, and every write handler enforces that on the server (override, draft, publish, archive, reset, copy-locale, import, resources, `set`). Each entry carries the `access` roles allowed to edit it, because a bundled feature cannot know the host\'s roles. The same list decides delivery: a tenant override is served (mail, PDF, layouts, text blocks) only while its template is listed in tenantEditable; otherwise the system version is served. A locked override stays stored, a SystemAdmin sees it in the overview marked as not delivered, and listing the template makes it effective again. Tenant rows of a collection mounted with `access` are always served. A collection mounted without `access` is SystemAdmin only.',
             "Text an editor should be able to change belongs in a collection, declared at mount: `createTemplateResolverFeature({ collections: [{ id, kind, access: { roles }, nav }] })`. It appears in the navigation, and `access` is part of the mount because a bundled feature cannot know the host's roles. Each collection gets its own `<id>-list` / `<id>-item` / `<id>-set` handlers, so the dispatcher enforces the separation.",
             "How a collection is edited follows from `contentFormat`: `plain` gives a text area, `rich` a small WYSIWYG (bold, italic, headings, lists, links), `markdown` a text area that stores markdown text (same insertable chips as `plain`). All three offer the collection's `variableSchema` as insertable chips and a preview rendered with sample data — an editor sees what `{{firstName}}` becomes without sending a mail. An app can register its own editor for a format; the last `clientFeature` that registers a format wins (a conflict logs a warning).",
             'A collection is tenant-wide by default. With `ownership: "user"` every user keeps their own entries — mail signatures being the obvious case. Those rows live in the separate `user-content-entry` entity and count as user data, so mounting one also requires the `template-resolver-user-data` feature and a migration on the app side.',
@@ -86,6 +93,7 @@ export function createTemplateResolverFeature(opts = {}) {
                 resourceMaxBytes: createSystemConfig("number", { default: 2_097_152, bounds: { min: 1 } }),
             },
         });
+        r.translations({ keys: TEMPLATE_RESOLVER_I18N });
         r.entity({ name: "template-resource", ...templateResourceEntity });
         // Only when the app actually mounts a user-owned collection: the entity's
         // `content` is `userOwned`, which makes it subject data — the boot guard
@@ -136,7 +144,7 @@ export function createTemplateResolverFeature(opts = {}) {
             });
             r.queryHandler(makeCollectionListQuery(collection));
             r.queryHandler(makeCollectionItemQuery(collection));
-            r.writeHandler(makeCollectionSetWrite(collection));
+            r.writeHandler(makeCollectionSetWrite(collection, policy));
         }
         // Visual-tree actions for the text-block content tree. The handle is
         // propagated through the setup export so other features can build
@@ -148,6 +156,6 @@ export function createTemplateResolverFeature(opts = {}) {
             list: {},
             create: { args: { folder: emptyString } },
         });
-        return { handlers, queries, treeHandle };
+        return { handlers, queries, treeHandle, deliveryPolicy };
     });
 }

package/dist/template-resolver/handlers/by-slug.query.js

@@ -1,8 +1,10 @@
 import { fetchOne } from "@cosmicdrift/kumiko-framework/db";
 import { defineQueryHandler } from "@cosmicdrift/kumiko-framework/engine";
 import * as z from "zod";
-import { TEXT_BLOCK_KIND } from "../constants.js";
+import { isRowDeliveredTo } from "../api.js";
 import { templateResourcesTable } from "../table.js";
+import { deliveryPolicyOf } from "../template-delivery-policy.js";
+import { TEXT_BLOCK_KIND } from "../web/constants.js";
 // Public read of a single text-block by (tenantId, slug, locale). Anonymous
 // must be listed explicitly — `openToAll` alone is auth-only (regression
 // guard). The kind is pinned to `text-block` and takes no parameter: mail
@@ -37,6 +39,9 @@ export const bySlugQuery = defineQueryHandler({
         });
         if (!row)
             return null;
+        if (!(await isRowDeliveredTo(ctx.db, deliveryPolicyOf(ctx.registry), query.user, row))) {
+            return null;
+        }
         return {
             slug: row.slug,
             locale: row.locale,

package/dist/template-resolver/handlers/by-tenant.query.js

@@ -1,8 +1,10 @@
 import { castTenantRows, selectMany } from "@cosmicdrift/kumiko-framework/db";
 import { defineQueryHandler } from "@cosmicdrift/kumiko-framework/engine";
 import * as z from "zod";
-import { TEXT_BLOCK_KIND } from "../constants.js";
+import { filterDeliveredTo } from "../api.js";
 import { templateResourcesTable } from "../table.js";
+import { deliveryPolicyOf } from "../template-delivery-policy.js";
+import { TEXT_BLOCK_KIND } from "../web/constants.js";
 export const byTenantQuery = defineQueryHandler({
     name: "by-tenant",
     schema: z.object({
@@ -16,8 +18,10 @@ export const byTenantQuery = defineQueryHandler({
         const override = query.payload.tenantIdOverride;
         const tenantId = override ?? query.user.tenantId;
         const rows = castTenantRows(await selectMany(ctx.db, templateResourcesTable, { tenantId, kind: TEXT_BLOCK_KIND }));
+        const policy = deliveryPolicyOf(ctx.registry);
+        const served = await filterDeliveredTo(ctx.db, policy, query.user, rows);
         return {
-            blocks: rows.map((row) => ({
+            blocks: served.map((row) => ({
                 slug: row.slug,
                 locale: row.locale,
                 title: row.title,

package/dist/template-resolver/handlers/collection-item.query.js

@@ -1,7 +1,7 @@
 import { fetchOne } from "@cosmicdrift/kumiko-framework/db";
 import { defineQueryHandler, } from "@cosmicdrift/kumiko-framework/engine";
 import * as z from "zod";
-import { DEFAULT_COLLECTION_ACCESS } from "../constants.js";
+import { DEFAULT_COLLECTION_ACCESS } from "../web/constants.js";
 import { collectionStore, toCollectionEntry, } from "./collection-shared.js";
 // Single entry of one collection, for the editor behind a tree node. Same
 // per-collection construction as collection-list — see there for why.

package/dist/template-resolver/handlers/collection-list.query.js

@@ -1,7 +1,7 @@
 import { castTenantRows, selectMany } from "@cosmicdrift/kumiko-framework/db";
 import { defineQueryHandler, } from "@cosmicdrift/kumiko-framework/engine";
 import * as z from "zod";
-import { DEFAULT_COLLECTION_ACCESS } from "../constants.js";
+import { DEFAULT_COLLECTION_ACCESS } from "../web/constants.js";
 import { collectionStore, toCollectionEntry, } from "./collection-shared.js";
 // One list handler per declared collection: `kind`, `ownership` and `access`
 // come from the declaration, never from the payload.

package/dist/template-resolver/handlers/collection-set.write.d.ts

@@ -1,6 +1,7 @@
 import { type ContentCollectionDefinition } from "@cosmicdrift/kumiko-framework/engine";
 import * as z from "zod";
-export declare function makeCollectionSetWrite(collection: ContentCollectionDefinition): import("@cosmicdrift/kumiko-types/define-handler").WriteHandlerDefinition<`${string}-set`, z.ZodObject<{
+import { type TemplateEditPolicy } from "../template-edit-policy.ts";
+export declare function makeCollectionSetWrite(collection: ContentCollectionDefinition, editPolicy: TemplateEditPolicy): import("@cosmicdrift/kumiko-types/define-handler").WriteHandlerDefinition<`${string}-set`, z.ZodObject<{
     slug: z.ZodString;
     locale: z.ZodString;
     title: z.ZodString;

package/dist/template-resolver/handlers/collection-set.write.js

@@ -3,8 +3,10 @@ import { defineWriteHandler, } from "@cosmicdrift/kumiko-framework/engine";
 import { ValidationError, writeFailure } from "@cosmicdrift/kumiko-framework/errors";
 import * as z from "zod";
 import { requireForTenant } from "../../shared/index.js";
-import { DEFAULT_COLLECTION_ACCESS, isCollectionRefusedKind } from "../constants.js";
+import { systemTemplateExists } from "../api.js";
 import { documentViolationsToFieldIssues, sanitizeTemplateBody } from "../document-sanitizer.js";
+import { refuseTemplateEdit } from "../template-edit-policy.js";
+import { DEFAULT_COLLECTION_ACCESS, isCollectionRefusedKind } from "../web/constants.js";
 import { collectionStore } from "./collection-shared.js";
 import { contentFormatSchema, folderSchema, localeSchema, slugSchema } from "./shared.js";
 // Upsert inside one collection. Mirrors set.write for text-blocks, but the
@@ -14,7 +16,7 @@ import { contentFormatSchema, folderSchema, localeSchema, slugSchema } from "./s
 //
 // Like set.write this publishes on save (status active, empty variableSchema)
 // — the draft stage lives on upsertTenant + publish.
-export function makeCollectionSetWrite(collection) {
+export function makeCollectionSetWrite(collection, editPolicy) {
     const store = collectionStore(collection);
     return defineWriteHandler({
         name: `${collection.id}-set`,
@@ -63,6 +65,16 @@ export function makeCollectionSetWrite(collection) {
             if (!body.ok) {
                 return writeFailure(new ValidationError({ fields: documentViolationsToFieldIssues(body.violations) }));
             }
+            // The collection's access must not open a system template that the app did not unlock.
+            if (collection.ownership !== "user" &&
+                (await systemTemplateExists(db, collection.kind, event.payload.slug))) {
+                const refused = refuseTemplateEdit(editPolicy, event.user, {
+                    slug: event.payload.slug,
+                    kind: collection.kind,
+                });
+                if (refused)
+                    return refused;
+            }
             const existing = await fetchOne(db, store.table, {
                 tenantId,
                 slug: event.payload.slug,

package/dist/template-resolver/handlers/copy-locale.write.js

@@ -4,15 +4,15 @@ import { AccessDeniedError, NotFoundError, ValidationError, writeFailure, } from
 import { isOneOf } from "@cosmicdrift/kumiko-types/type-guards";
 import * as z from "zod";
 import { requireForTenant } from "../../shared/index.js";
-import { CONTENT_FORMATS } from "../constants.js";
 import { parseLinkedResourceEntries } from "../linked-resources.js";
-import { TemplateResolverErrors } from "../qualified-names.js";
 import { createLinkedResourceCopies, prepareLinkedResourceCopiesBeforeTransaction, } from "../store-template-resource.js";
 import { templateResourcesTable } from "../table.js";
 import { toWorkingRow } from "../template-draft.js";
 import { refuseTemplateEdit, templateEditAccess, } from "../template-edit-policy.js";
 import { attachTemplateResources } from "../template-resources.js";
 import { resolveTemplateVariables } from "../template-validation.js";
+import { CONTENT_FORMATS } from "../web/constants.js";
+import { TemplateResolverErrors } from "../web/qualified-names.js";
 import { targetExistsIssue } from "./bundle-import.js";
 import { kindSchema, localeSchema, templateSlugSchema } from "./shared.js";
 import { parseStoredJson, storedRecord } from "./template-gates.js";

package/dist/template-resolver/handlers/diff-to-system.query.js

@@ -3,6 +3,7 @@ import { defineQueryHandler, SYSTEM_TENANT_ID } from "@cosmicdrift/kumiko-framew
 import { NotFoundError } from "@cosmicdrift/kumiko-framework/errors";
 import * as z from "zod";
 import { templateResourcesTable } from "../table.js";
+import { deliveryPolicyOf, isRowServedTo } from "../template-delivery-policy.js";
 import { isHiddenSystemDraft } from "../template-draft.js";
 import { buildOverrideDiff } from "./override-diff.js";
 export const diffToSystemQuery = defineQueryHandler({
@@ -14,7 +15,10 @@ export const diffToSystemQuery = defineQueryHandler({
         const tenantRow = await fetchOne(ctx.db, templateResourcesTable, {
             id: query.payload.id,
         });
-        if (!tenantRow || tenantRow.tenantId !== query.user.tenantId || tenantRow.scope !== "tenant") {
+        if (!tenantRow ||
+            tenantRow.tenantId !== query.user.tenantId ||
+            tenantRow.scope !== "tenant" ||
+            !isRowServedTo(deliveryPolicyOf(ctx.registry), query.user, tenantRow)) {
             throw new NotFoundError("template-resource", query.payload.id);
         }
         const systemRow = await fetchOne(ctx.db, templateResourcesTable, {

package/dist/template-resolver/handlers/discard-draft.write.js

@@ -1,8 +1,8 @@
 import { defineWriteHandler } from "@cosmicdrift/kumiko-framework/engine";
 import { NotFoundError, ValidationError, writeFailure } from "@cosmicdrift/kumiko-framework/errors";
 import * as z from "zod";
-import { TemplateResolverErrors } from "../qualified-names.js";
 import { refuseMissingTemplate, refuseTemplateEdit, } from "../template-edit-policy.js";
+import { TemplateResolverErrors } from "../web/qualified-names.js";
 import { executor } from "./shared.js";
 import { loadTargetRow, writeAccessFor } from "./toggle-status.write.js";
 function createDiscardDraftHandler(policy, name, target, description) {

package/dist/template-resolver/handlers/document-base.d.ts

@@ -1,5 +1,5 @@
 import { type HandlerContext, type SessionUser } from "@cosmicdrift/kumiko-framework/engine";
-import type { DocumentHtmlKind } from "../constants.ts";
+import type { DocumentHtmlKind } from "../web/constants.ts";
 export type DocumentBase = {
     readonly scope: "tenant" | "system";
     /** The stored row's own version, which counts every draft save. */

package/dist/template-resolver/handlers/document-base.js

@@ -2,6 +2,7 @@ import { fetchOne } from "@cosmicdrift/kumiko-framework/db";
 import { SYSTEM_TENANT_ID, } from "@cosmicdrift/kumiko-framework/engine";
 import { isPlainObject } from "@cosmicdrift/kumiko-types/type-guards";
 import { templateResourcesTable } from "../table.js";
+import { deliveryPolicyOf, isRowServedTo } from "../template-delivery-policy.js";
 import { isHiddenSystemDraft, toWorkingRow } from "../template-draft.js";
 import { isSystemOnlyTemplateHiddenFrom } from "../template-system-only.js";
 import { parseStoredJson } from "./template-gates.js";
@@ -16,7 +17,11 @@ export async function loadDocumentBase(ctx, user, where) {
         tenantId: user.tenantId,
         ...where,
     });
-    if (own !== undefined && !isSystemOnlyTemplateHiddenFrom(user, ctx.registry, own)) {
+    // A locked override is neither shown nor edited by a non-SystemAdmin; the served system default is.
+    const ownIsVisible = own !== undefined &&
+        !isSystemOnlyTemplateHiddenFrom(user, ctx.registry, own) &&
+        isRowServedTo(deliveryPolicyOf(ctx.registry), user, own);
+    if (own !== undefined && ownIsVisible) {
         const working = toWorkingRow(own, user.tenantId);
         return {
             rowId: String(own.id),

package/dist/template-resolver/handlers/document-blocks.query.d.ts

@@ -17,6 +17,6 @@ export declare const documentBlocksQuery: import("@cosmicdrift/kumiko-types/defi
     variableSchema: Readonly<Record<string, unknown>>;
     variables: Readonly<Record<string, import("@cosmicdrift/kumiko-types/config").TemplateVariableDef>>;
     variablesDeclaredByFeature: boolean;
-    allowedBlocks: readonly import("../document-blocks.ts").DocumentToolbarBlock[];
+    allowedBlocks: readonly import("../web/document-blocks.ts").DocumentToolbarBlock[];
     resourceKeys: string[];
 }, import("@cosmicdrift/kumiko-types/event-type-map").KumikoEventTypeMap>;

package/dist/template-resolver/handlers/document-blocks.query.js

@@ -1,11 +1,11 @@
 import { defineQueryHandler } from "@cosmicdrift/kumiko-framework/engine";
 import { NotFoundError } from "@cosmicdrift/kumiko-framework/errors";
 import * as z from "zod";
-import { DOCUMENT_HTML_KINDS } from "../constants.js";
-import { documentBlocksForKind } from "../document-blocks.js";
 import { documentBlocksOf } from "../document-ops.js";
 import { parseDocumentJson } from "../document-sanitizer.js";
 import { resolveTemplateVariables } from "../template-validation.js";
+import { DOCUMENT_HTML_KINDS } from "../web/constants.js";
+import { documentBlocksForKind } from "../web/document-blocks.js";
 import { loadDocumentBase } from "./document-base.js";
 import { localeSchema, templateSlugSchema } from "./shared.js";
 import { knownResourceKeysFor } from "./validate.query.js";