@cosmicdrift/kumiko-bundled-features 0.386.0 → 0.388.0

package/dist/template-resolver/handlers/diff-to-system.query.js

@@ -2,8 +2,9 @@ import { fetchOne } from "@cosmicdrift/kumiko-framework/db";
 import { defineQueryHandler, SYSTEM_TENANT_ID } from "@cosmicdrift/kumiko-framework/engine";
 import { NotFoundError } from "@cosmicdrift/kumiko-framework/errors";
 import * as z from "zod";
+import { isRowDeliveredTo } from "../api.js";
 import { templateResourcesTable } from "../table.js";
-import { deliveryPolicyOf, isRowServedTo } from "../template-delivery-policy.js";
+import { deliveryPolicyOf } from "../template-delivery-policy.js";
 import { isHiddenSystemDraft } from "../template-draft.js";
 import { buildOverrideDiff } from "./override-diff.js";
 export const diffToSystemQuery = defineQueryHandler({
@@ -18,7 +19,7 @@ export const diffToSystemQuery = defineQueryHandler({
         if (!tenantRow ||
             tenantRow.tenantId !== query.user.tenantId ||
             tenantRow.scope !== "tenant" ||
-            !isRowServedTo(deliveryPolicyOf(ctx.registry), query.user, tenantRow)) {
+            !(await isRowDeliveredTo(ctx.db, deliveryPolicyOf(ctx.registry), query.user, tenantRow))) {
             throw new NotFoundError("template-resource", query.payload.id);
         }
         const systemRow = await fetchOne(ctx.db, templateResourcesTable, {

package/dist/template-resolver/handlers/document-base.js

@@ -1,8 +1,9 @@
 import { fetchOne } from "@cosmicdrift/kumiko-framework/db";
 import { SYSTEM_TENANT_ID, } from "@cosmicdrift/kumiko-framework/engine";
 import { isPlainObject } from "@cosmicdrift/kumiko-types/type-guards";
+import { isRowDeliveredTo } from "../api.js";
 import { templateResourcesTable } from "../table.js";
-import { deliveryPolicyOf, isRowServedTo } from "../template-delivery-policy.js";
+import { deliveryPolicyOf } from "../template-delivery-policy.js";
 import { isHiddenSystemDraft, toWorkingRow } from "../template-draft.js";
 import { isSystemOnlyTemplateHiddenFrom } from "../template-system-only.js";
 import { parseStoredJson } from "./template-gates.js";
@@ -20,7 +21,7 @@ export async function loadDocumentBase(ctx, user, where) {
     // A locked override is neither shown nor edited by a non-SystemAdmin; the served system default is.
     const ownIsVisible = own !== undefined &&
         !isSystemOnlyTemplateHiddenFrom(user, ctx.registry, own) &&
-        isRowServedTo(deliveryPolicyOf(ctx.registry), user, own);
+        (await isRowDeliveredTo(ctx.db, deliveryPolicyOf(ctx.registry), user, own));
     if (own !== undefined && ownIsVisible) {
         const working = toWorkingRow(own, user.tenantId);
         return {

package/dist/template-resolver/handlers/find-by-id.query.js

@@ -1,15 +1,16 @@
 import { fetchOne } from "@cosmicdrift/kumiko-framework/db";
 import { defineQueryHandler } from "@cosmicdrift/kumiko-framework/engine";
 import * as z from "zod";
+import { isRowDeliveredTo } from "../api.js";
 import { templateResourcesTable } from "../table.js";
-import { deliveryPolicyOf, isRowServedTo } from "../template-delivery-policy.js";
+import { deliveryPolicyOf } from "../template-delivery-policy.js";
 import { draftViewerTenantId, isHiddenSystemDraft, toWorkingRow } from "../template-draft.js";
 import { isSystemOnlyTemplateHiddenFrom } from "../template-system-only.js";
-// Admin-Lookup für UI-Edit-Flow. Returnt das raw Template inkl. draft/
-// archived Status. Tenant-Isolation: User sieht nur Templates des
-// eigenen Tenants oder SYSTEM_TENANT (system-defaults sind public-
-// readable); ctx.db is tenant-scoped for every role, so the check below is defense in depth. Anonymous bleibt aus — Public-
-// Read geht über resolveTemplate aus der API, nicht hier.
+// Admin lookup for the UI editing flow. Returns the raw template, including draft/
+// archived status. Tenant isolation: users see only templates belonging to their own
+// tenant or SYSTEM_TENANT (system defaults are publicly readable); ctx.db is tenant-
+// scoped for every role, so the check below is defense in depth. Anonymous access is
+// excluded—public reads go through resolveTemplate in the API, not here.
 export const findByIdQuery = defineQueryHandler({
     name: "find-by-id",
     schema: z.object({ id: z.string().min(1) }),
@@ -22,7 +23,7 @@ export const findByIdQuery = defineQueryHandler({
         if (!stored ||
             isHiddenSystemDraft(query.user, stored) ||
             isSystemOnlyTemplateHiddenFrom(query.user, ctx.registry, stored) ||
-            !isRowServedTo(deliveryPolicyOf(ctx.registry), query.user, stored)) {
+            !(await isRowDeliveredTo(ctx.db, deliveryPolicyOf(ctx.registry), query.user, stored))) {
             return null;
         }
         const row = toWorkingRow(stored, draftViewerTenantId(query.user, stored));

package/dist/template-resolver/handlers/list.query.js

@@ -1,8 +1,9 @@
 import { selectMany } from "@cosmicdrift/kumiko-framework/db";
 import { defineQueryHandler } from "@cosmicdrift/kumiko-framework/engine";
 import * as z from "zod";
+import { filterDeliveredTo } from "../api.js";
 import { templateResourcesTable } from "../table.js";
-import { deliveryPolicyOf, isRowServedTo } from "../template-delivery-policy.js";
+import { deliveryPolicyOf } from "../template-delivery-policy.js";
 import { isHiddenSystemDraft } from "../template-draft.js";
 import { isSystemOnlyTemplateHiddenFrom } from "../template-system-only.js";
 import { TEMPLATE_KINDS, TEMPLATE_STATUSES } from "../web/constants.js";
@@ -35,17 +36,15 @@ export const listQuery = defineQueryHandler({
         if (query.payload.status) {
             where["status"] = query.payload.status;
         }
-        // @cast-boundary db-row — selectMany returnt unknown[]; Row-Shape ist
+        // @cast-boundary db-row — selectMany returns unknown[]; Row shape is
         // durch templateResourcesTable + buildBaseColumns garantiert.
         const rows = (await selectMany(ctx.db, templateResourcesTable, where, {
             limit: 500,
         }));
         const deliveryPolicy = deliveryPolicyOf(ctx.registry);
-        return rows
-            .filter((row) => !isHiddenSystemDraft(query.user, row) &&
-            !isSystemOnlyTemplateHiddenFrom(query.user, ctx.registry, row) &&
-            isRowServedTo(deliveryPolicy, query.user, row))
-            .map((row) => ({
+        const candidates = rows.filter((row) => !isHiddenSystemDraft(query.user, row) &&
+            !isSystemOnlyTemplateHiddenFrom(query.user, ctx.registry, row));
+        return (await filterDeliveredTo(ctx.db, deliveryPolicy, query.user, candidates)).map((row) => ({
             id: String(row.id),
             tenantId: row.tenantId,
             slug: row.slug,

package/dist/template-resolver/handlers/overview.query.d.ts

@@ -1,7 +1,9 @@
 import * as z from "zod";
 import { type TemplateResourceRow } from "../table.ts";
 import { type TemplateDeliveryPolicy } from "../template-delivery-policy.ts";
+import { isHiddenSystemDraft } from "../template-draft.ts";
 import { type TemplateEditPolicy } from "../template-edit-policy.ts";
+import { isSystemOnlyTemplateHiddenFrom } from "../template-system-only.ts";
 import { type EffectiveMailLayoutSlugs } from "../template-usage.ts";
 import { type TemplateStatus } from "../web/constants.ts";
 declare const OVERVIEW_KINDS: readonly ["mail", "document-pdf", "mail-layout", "pdf-layout"];
@@ -51,6 +53,7 @@ export type OverviewResponse = {
     /** True when the tenant has more template rows than the overview reads; rows and total are then incomplete. */
     readonly truncated: boolean;
 };
+export declare function isRowVisibleToCaller(policy: TemplateEditPolicy, user: Parameters<typeof isHiddenSystemDraft>[0], registry: Parameters<typeof isSystemOnlyTemplateHiddenFrom>[1], row: TemplateResourceRow): boolean;
 export declare function effectiveMailLayoutSlugs(rows: readonly TemplateResourceRow[], policy: TemplateDeliveryPolicy): EffectiveMailLayoutSlugs;
 export declare function makeOverviewQuery(policy: TemplateEditPolicy): import("@cosmicdrift/kumiko-types/define-handler").QueryHandlerDefinition<"overview", z.ZodObject<{
     search: z.ZodOptional<z.ZodString>;

package/dist/template-resolver/handlers/overview.query.js

@@ -69,6 +69,11 @@ function effectiveRowsOf(rows, policy) {
         ? { origin: "tenant", rows: tenantRows, lockedOverride: false, lockedOverrideId: null }
         : null;
 }
+export function isRowVisibleToCaller(policy, user, registry, row) {
+    return (!isHiddenSystemDraft(user, row) &&
+        !isSystemOnlyTemplateHiddenFrom(user, registry, row) &&
+        mayEditTemplate(policy, user, row));
+}
 export function effectiveMailLayoutSlugs(rows, policy) {
     const byLocale = new Map();
     for (const row of rows) {
@@ -242,9 +247,7 @@ export function makeOverviewQuery(policy) {
                     limit: OVERVIEW_ROW_LIMIT,
                 });
             }
-            const visibleRows = rows.filter((row) => !isHiddenSystemDraft(query.user, row) &&
-                !isSystemOnlyTemplateHiddenFrom(query.user, ctx.registry, row) &&
-                mayEditTemplate(policy, query.user, row));
+            const visibleRows = rows.filter((row) => isRowVisibleToCaller(policy, query.user, ctx.registry, row));
             const deliveryPolicy = deliveryPolicyOf(ctx.registry);
             const { drafts, layoutSlugByDocument } = buildDrafts(groupBySlugAndKind(visibleRows), query.user, deliveryPolicy);
             const effectiveLayouts = effectiveMailLayoutSlugs(visibleRows, deliveryPolicy);

package/dist/template-resolver/handlers/shared.js

@@ -30,8 +30,8 @@ export const folderSchema = z
 export const titleSchema = z.string().min(1).max(200);
 export const contentFormatSchema = z.enum(CONTENT_FORMATS);
 export const statusSchema = z.enum(TEMPLATE_STATUSES);
-// Common Upsert-Payload — geteilt zwischen upsertSystem + upsertTenant.
-// Unterschied: ACL + tenantId-Bestimmung, sonst identisch.
+// Common upsert payload shared by upsertSystem and upsertTenant.
+// Only ACL and tenantId determination differ.
 export const upsertPayloadSchema = z.object({
     slug: templateSlugSchema,
     kind: kindSchema,

package/dist/template-resolver/handlers/template-write.js

@@ -148,9 +148,9 @@ export async function writeTemplateRow(args) {
     }, user, db, { streamTenantId });
     if (!result.isSuccess)
         return result;
-    // @cast-boundary db-row — executor.create returnt Record-row aus
-    // INSERT RETURNING; shape { id } ist garantiert weil PK in der
-    // Returning-Klausel ist.
+    // @cast-boundary db-row — executor.create returns a row from
+    // INSERT RETURNING; the { id } shape is guaranteed because the primary key is in the
+    // RETURNING clause.
     const createdRow = result.data;
     return {
         isSuccess: true,

package/dist/template-resolver/handlers/tenant-override-counts.query.js

@@ -14,9 +14,7 @@ export const tenantOverrideCountsQuery = defineQueryHandler({
     description: "Counts, per template slug and kind, the enabled tenants that override it with an active version, next to the number of enabled tenants; one query for the whole template overview instead of one tenant-overrides call per row.",
     escapeHatch: { grants: ["unsafeRaw"], reason: TENANT_OVERRIDES_REASON },
     handler: async (_query, ctx) => {
-        const found = await selectMany(ctx.db.unsafeRaw(), templateResourcesTable, {
-            scope: "tenant",
-        });
+        const found = await selectMany(ctx.db.unsafeRaw(), templateResourcesTable, { scope: "tenant" }, { fields: ["tenantId", "slug", "kind", "status", "version"] });
         const enabledTenantIds = await loadEnabledTenantIds(ctx);
         const rowsBySlugAndKind = new Map();
         for (const row of found) {

package/dist/template-resolver/handlers/tenant-override-selection.d.ts

@@ -8,5 +8,6 @@ type TenantIdQueryContext = {
 };
 /** Null when the tenant feature is not installed: every tenant row then counts. */
 export declare function loadEnabledTenantIds(ctx: TenantIdQueryContext): Promise<ReadonlySet<string> | null>;
-export declare function pickBestRowPerTenant(found: readonly TemplateResourceRow[], enabledTenantIds: ReadonlySet<string> | null): Map<string, TemplateResourceRow>;
+export type OverrideCandidate = Pick<TemplateResourceRow, "tenantId" | "status" | "version">;
+export declare function pickBestRowPerTenant<TRow extends OverrideCandidate>(found: readonly TRow[], enabledTenantIds: ReadonlySet<string> | null): Map<string, TRow>;
 export {};

package/dist/template-resolver/handlers/tenant-overrides.query.js

@@ -1,5 +1,5 @@
 import { selectMany } from "@cosmicdrift/kumiko-framework/db";
-import { defineQueryHandler, SYSTEM_TENANT_ID } from "@cosmicdrift/kumiko-framework/engine";
+import { defineQueryHandler, MAX_LIST_LIMIT, SYSTEM_TENANT_ID, } from "@cosmicdrift/kumiko-framework/engine";
 import * as z from "zod";
 import { TenantQueries } from "../../tenant/index.js";
 import { templateResourcesTable } from "../table.js";
@@ -10,8 +10,31 @@ import { loadEnabledTenantIds, pickBestRowPerTenant, TENANT_OVERRIDES_REASON, }
 const directorySchema = z.object({
     rows: z.array(z.object({ id: z.string(), label: z.string() })),
 });
-function labelsOf(raw) {
-    return new Map(directorySchema.parse(raw).rows.map((row) => [row.id, row.label]));
+function chunksOf(items, size) {
+    const chunks = [];
+    for (let start = 0; start < items.length; start += size) {
+        chunks.push(items.slice(start, start + size));
+    }
+    return chunks;
+}
+// Looks up only the ids the overrides need, so labels never depend on the directory's default cap.
+async function labelsFor(ctx, queryName, ids) {
+    const labels = new Map();
+    for (const chunk of chunksOf([...ids], MAX_LIST_LIMIT)) {
+        const raw = await ctx.query(queryName, { ids: chunk });
+        for (const row of directorySchema.parse(raw).rows)
+            labels.set(row.id, row.label);
+    }
+    return labels;
+}
+function changerIdsOf(rows) {
+    const ids = new Set();
+    for (const row of rows) {
+        const changedById = row.modifiedById ?? row.insertedById;
+        if (changedById !== null)
+            ids.add(changedById);
+    }
+    return ids;
 }
 function statusOf(row) {
     return row.status === "active" ? "active" : "draft";
@@ -55,10 +78,10 @@ export const tenantOverridesQuery = defineQueryHandler({
         const bestByTenant = pickBestRowPerTenant(found, enabledTenantIds);
         const best = [...bestByTenant.values()];
         const tenantLabels = hasTenantFeature
-            ? labelsOf(await ctx.query(TenantQueries.tenantDirectory, {}))
+            ? await labelsFor(ctx, TenantQueries.tenantDirectory, new Set(best.map((row) => row.tenantId)))
             : new Map();
         const userLabels = hasTenantFeature
-            ? labelsOf(await ctx.query(TenantQueries.memberDirectory, {}))
+            ? await labelsFor(ctx, TenantQueries.memberDirectory, changerIdsOf(best))
             : new Map();
         const rows = best
             .map((row) => toOverrideRow(row, tenantLabels, userLabels))

package/dist/template-resolver/handlers/upsert-system.write.js

@@ -2,10 +2,9 @@ import { defineWriteHandler, SYSTEM_TENANT_ID } from "@cosmicdrift/kumiko-framew
 import { resolveTemplateVariables } from "../template-validation.js";
 import { upsertPayloadSchema } from "./shared.js";
 import { writeTemplateRow } from "./template-write.js";
-// System-Template anlegen/updaten. Liegt unter SYSTEM_TENANT_ID,
-// scope='system'. Nur SystemAdmin (globale Rolle). TenantAdmin kann
-// keine System-Defaults überschreiben — der nutzt upsertTenant für
-// Overrides.
+// Creates or updates a system template under SYSTEM_TENANT_ID with
+// scope='system'. Only SystemAdmin can change these global defaults;
+// TenantAdmin uses upsertTenant for overrides instead.
 export const upsertSystemWrite = defineWriteHandler({
     name: "upsert-system",
     schema: upsertPayloadSchema,

package/dist/template-resolver/handlers/upsert-tenant.write.js

@@ -4,11 +4,10 @@ import { refuseTemplateEdit, templateEditAccess, } from "../template-edit-policy
 import { resolveTemplateVariables } from "../template-validation.js";
 import { upsertPayloadSchema } from "./shared.js";
 import { writeTemplateRow } from "./template-write.js";
-// Tenant-Override anlegen/updaten. Liegt unter event.user.tenantId,
-// scope='tenant'. Default-Status='draft' — User publisht explizit
-// via publish-Handler. SystemAdmin kann via tenantIdOverride für
-// einen anderen Tenant schreiben (typisch: Plattform-Admin-UI das
-// Tenant-Templates kuratiert).
+// Creates or updates a tenant override under event.user.tenantId with scope='tenant'.
+// The default status is 'draft'; users must publish explicitly via the publish handler.
+// SystemAdmin can write for another tenant through tenantIdOverride, typically to
+// curate tenant templates from a platform admin UI.
 export function makeUpsertTenantWrite(policy) {
     return defineWriteHandler({
         name: "upsert-tenant",

package/dist/template-resolver/handlers/usage.query.d.ts

@@ -1,5 +1,6 @@
 import * as z from "zod";
-export declare const usageQuery: import("@cosmicdrift/kumiko-types/define-handler").QueryHandlerDefinition<"usage", z.ZodObject<{
+import type { TemplateEditPolicy } from "../template-edit-policy.ts";
+export declare function makeUsageQuery(policy: TemplateEditPolicy): import("@cosmicdrift/kumiko-types/define-handler").QueryHandlerDefinition<"usage", z.ZodObject<{
     slug: z.ZodString;
     kind: z.ZodEnum<{
         "ai-prompt": "ai-prompt";

package/dist/template-resolver/handlers/usage.query.js

@@ -6,20 +6,30 @@ import { deliveryPolicyOf } from "../template-delivery-policy.js";
 import { templateSlugSchema } from "../template-meta.js";
 import { collectTemplateUsage } from "../template-usage.js";
 import { TEMPLATE_KINDS } from "../web/constants.js";
-import { effectiveMailLayoutSlugs } from "./overview.query.js";
+import { effectiveMailLayoutSlugs, isRowVisibleToCaller } from "./overview.query.js";
 const MAIL_ROW_LIMIT = 5000;
-export const usageQuery = defineQueryHandler({
-    name: "usage",
-    schema: z.object({ slug: templateSlugSchema, kind: z.enum(TEMPLATE_KINDS) }),
-    access: { roles: ["TenantAdmin", "SystemAdmin"] },
-    description: "Lists the code-registered notifications that use one template: a mail template is used by the notification whose qualified name is its slug and that has a code template, a mail layout by every mail notification whose effective template (own override, else system) names it, or whose code meta does when no stored template exists, or that falls back to the default layout; use it to show what a change to a template affects.",
-    handler: async (query, ctx) => {
-        const { slug, kind } = query.payload;
-        if (kind !== "mail-layout")
-            return { usedBy: collectTemplateUsage(ctx.registry, slug, kind) };
-        const mailRows = await selectMany(ctx.db, templateResourcesTable, { kind: "mail" }, { limit: MAIL_ROW_LIMIT });
-        return {
-            usedBy: collectTemplateUsage(ctx.registry, slug, kind, effectiveMailLayoutSlugs(mailRows, deliveryPolicyOf(ctx.registry))),
-        };
-    },
-});
+export function makeUsageQuery(policy) {
+    return defineQueryHandler({
+        name: "usage",
+        schema: z.object({ slug: templateSlugSchema, kind: z.enum(TEMPLATE_KINDS) }),
+        access: { roles: ["TenantAdmin", "SystemAdmin"] },
+        description: "Lists the code-registered notifications that use one template: a mail template is used by the notification whose qualified name is its slug and that has a code template, a mail layout by every mail notification whose effective template (own override, else system) names it, or whose code meta does when no stored template exists, or that falls back to the default layout; use it to show what a change to a template affects.",
+        handler: async (query, ctx) => {
+            const { slug, kind } = query.payload;
+            if (kind !== "mail-layout")
+                return { usedBy: collectTemplateUsage(ctx.registry, slug, kind) };
+            const fetchedRows = await selectMany(ctx.db, templateResourcesTable, { kind: "mail" }, { orderBy: { col: "id", direction: "asc" }, limit: MAIL_ROW_LIMIT + 1 });
+            if (fetchedRows.length > MAIL_ROW_LIMIT) {
+                ctx.log?.warn("template usage: row limit reached, result is incomplete", {
+                    limit: MAIL_ROW_LIMIT,
+                });
+            }
+            const visibleRows = fetchedRows
+                .slice(0, MAIL_ROW_LIMIT)
+                .filter((row) => isRowVisibleToCaller(policy, query.user, ctx.registry, row));
+            return {
+                usedBy: collectTemplateUsage(ctx.registry, slug, kind, effectiveMailLayoutSlugs(visibleRows, deliveryPolicyOf(ctx.registry))),
+            };
+        },
+    });
+}

package/dist/template-resolver/handlers/validate.query.js

@@ -1,9 +1,10 @@
 import { selectMany } from "@cosmicdrift/kumiko-framework/db";
 import { defineQueryHandler, SYSTEM_TENANT_ID, } from "@cosmicdrift/kumiko-framework/engine";
 import * as z from "zod";
+import { isRowDeliveredTo } from "../api.js";
 import { imageResourceKeysOf } from "../linked-resources.js";
 import { templateResourcesTable } from "../table.js";
-import { deliveryPolicyOf, isRowServedTo } from "../template-delivery-policy.js";
+import { deliveryPolicyOf } from "../template-delivery-policy.js";
 import { isSystemAdmin } from "../template-draft.js";
 import { resolveTemplateVariables, systemPlaceholdersFor } from "../template-validation.js";
 import { contentFormatSchema, kindSchema, localeSchema, templateSlugSchema } from "./shared.js";
@@ -31,7 +32,11 @@ export async function knownResourceKeysFor(ctx, user, where) {
             locale,
         })),
         ...(scope === "tenant" &&
-            isRowServedTo(deliveryPolicyOf(ctx.registry), user, { tenantId: user.tenantId, kind, slug })
+            (await isRowDeliveredTo(ctx.db, deliveryPolicyOf(ctx.registry), user, {
+                tenantId: user.tenantId,
+                kind,
+                slug,
+            }))
             ? await knownResourceKeys(ctx.db, { tenantId: user.tenantId, slug, kind, scope, locale })
             : []),
     ];

package/dist/template-resolver/seeding.js

@@ -12,7 +12,7 @@ import { createTenantDb, fetchOne, } from "@cosmicdrift/kumiko-framework/db";
 import { createSystemUser, SYSTEM_TENANT_ID, } from "@cosmicdrift/kumiko-framework/engine";
 import { deleteRowsWithoutReplayableStream, getStreamVersion, getUnscopedStreamMaxVersionForSeed, } from "@cosmicdrift/kumiko-framework/event-store";
 import { runEventStoreSeed } from "@cosmicdrift/kumiko-framework/seeding";
-import { isPlainObject } from "@cosmicdrift/kumiko-types/type-guards";
+import { isPlainObject, propertyOf } from "@cosmicdrift/kumiko-types/type-guards";
 import { executor } from "./handlers/shared.js";
 import { evaluateTemplateWrite } from "./handlers/template-gates.js";
 import { templateResourcesTable } from "./table.js";
@@ -39,10 +39,16 @@ async function resolveExistingForEventStoreSeed(db, tdb, existingRow, tenantId)
     }
     return { id, version: streamVersion };
 }
+// Namespace prefix plus path, no whitespace: keeps free text from passing as a key that the UI
+// would then show raw.
+const I18N_KEY_FORMAT = /^[^\s:]+:\S+$/;
 function seedTitleColumn(opts, label) {
     if (opts.title !== undefined && opts.titleI18nKey !== undefined) {
         throw new Error(`${label} rejected: set either title or titleI18nKey, not both`);
     }
+    if (opts.titleI18nKey !== undefined && !I18N_KEY_FORMAT.test(opts.titleI18nKey)) {
+        throw new Error(`${label} rejected: titleI18nKey "${opts.titleI18nKey}" is not a "namespace:key" i18n key`);
+    }
     return opts.titleI18nKey ?? opts.title ?? null;
 }
 export async function seedSystemTemplate(db, opts) {
@@ -101,16 +107,18 @@ export async function seedSystemTemplate(db, opts) {
             current?.title === rowFields.title &&
             current?.variableSchema === rowFields.variableSchema &&
             current?.meta === rowFields.meta &&
-            current?.status === rowFields.status &&
             current?.parentTemplateId === rowFields.parentTemplateId &&
             (linkedResources === undefined || current?.linkedResources === linkedResources)) {
             return { id: String(row.id) };
         }
-        const result = await executor.update({
-            id: row.id,
-            version: row.version,
-            changes: { ...rowFields, ...activeStampChanges(row) },
-        }, by, tdb);
+        // An archived system row is a SystemAdmin decision (reversible with publish-system) that a
+        // pod-boot re-seed must not undo; content still follows the code. The seed replaces the
+        // content, so an open draft on the old content is dropped with it.
+        const { status: _status, ...contentFields } = rowFields;
+        const changes = current?.status === "archived"
+            ? { ...contentFields, status: "archived", draft: null }
+            : { ...rowFields, ...activeStampChanges(row), draft: null };
+        const result = await executor.update({ id: row.id, version: row.version, changes }, by, tdb);
         if (!result.isSuccess) {
             throw new Error(`seedSystemTemplate update failed: ${JSON.stringify(result)}`);
         }
@@ -151,11 +159,11 @@ export async function seedSystemTemplate(db, opts) {
                 }
                 throw new Error(`seedSystemTemplate create failed: ${JSON.stringify(result)}`);
             }
-            const data = result.data;
-            if (data.id === undefined) {
+            const createdId = propertyOf(result.data, "id");
+            if (createdId === undefined) {
                 throw new Error("seedSystemTemplate: executor.create did not return an id");
             }
-            return { id: String(data.id) };
+            return { id: String(createdId) };
         },
         update: (row) => applyUpdate(row, existingRow),
     });
@@ -191,8 +199,10 @@ async function seedSystemTemplateBundleWithResources(db, bundle, opts) {
     if (!dispatcher) {
         throw new Error(`${label}: bundles with resources need a file provider; pass opts.dispatcher (the dispatcher of the seed deps) so the files are stored through the import-bundle-system write`);
     }
-    if ((opts.ifExists ?? "skip") === "skip") {
-        const existingIds = {};
+    const skipExisting = (opts.ifExists ?? "skip") === "skip";
+    const existingIds = {};
+    let bundleToImport = bundle;
+    if (skipExisting) {
         for (const locale of Object.keys(bundle.locales)) {
             const row = await fetchOne(db, templateResourcesTable, {
                 tenantId: SYSTEM_TENANT_ID,
@@ -206,12 +216,18 @@ async function seedSystemTemplateBundleWithResources(db, bundle, opts) {
         if (Object.keys(existingIds).length === Object.keys(bundle.locales).length) {
             return { ids: existingIds };
         }
+        // import-bundle-system always overwrites, so only the missing locales go in: a
+        // hand-edited system row of an already seeded locale must survive the new-locale boot.
+        bundleToImport = {
+            ...bundle,
+            locales: Object.fromEntries(Object.entries(bundle.locales).filter(([locale]) => !(locale in existingIds))),
+        };
     }
-    const result = await dispatcher.write(TemplateResolverHandlers.importBundleSystem, { bundle }, opts.by ?? createSystemUser(SYSTEM_TENANT_ID, ["SystemAdmin"]));
+    const result = await dispatcher.write(TemplateResolverHandlers.importBundleSystem, { bundle: bundleToImport }, opts.by ?? createSystemUser(SYSTEM_TENANT_ID, ["SystemAdmin"]));
     if (!result.isSuccess) {
         throw new Error(`${label} failed: ${result.error.code}: ${result.error.message}`);
     }
-    return { ids: importedIds(result.data) };
+    return { ids: { ...existingIds, ...importedIds(result.data) } };
 }
 function importedIds(data) {
     const ids = isPlainObject(data) ? data["ids"] : undefined;

package/dist/template-resolver/store-template-resource.d.ts

@@ -42,6 +42,7 @@ export declare function prepareTemplateResourceBeforeTransaction(args: {
 }): Promise<BeforeTransactionResult<PreparedTemplateImage>>;
 export type Release = () => Promise<void>;
 export declare function releaseAll(releases: readonly Release[]): Promise<void>;
+export declare function releaseAfterFailure(ctx: HandlerContext, releases: readonly Release[]): Promise<void>;
 export type PreparedLinkedResourceCopy = {
     readonly key: string;
     readonly entry: LinkedResourceEntry;

package/dist/template-resolver/store-template-resource.js

@@ -24,6 +24,9 @@ function keyInUse() {
         details: { code: "key_in_use" },
     }));
 }
+function isImageKey(links, key) {
+    return typeof links[key] === "string";
+}
 function isAttachmentKey(links, key) {
     const occupant = links[key];
     return occupant !== undefined && typeof occupant !== "string";
@@ -129,6 +132,17 @@ export async function releaseAll(releases) {
     if (rejected?.status === "rejected")
         throw rejected.reason;
 }
+// Failure paths: a failing release must not replace the upload error the caller needs to see.
+export async function releaseAfterFailure(ctx, releases) {
+    try {
+        await releaseAll(releases);
+    }
+    catch (releaseError) {
+        ctx.log?.warn("template upload rollback: releasing stored files failed", {
+            error: releaseError instanceof Error ? releaseError.message : String(releaseError),
+        });
+    }
+}
 // beforeTransaction half: copies the file behind every entry into the target tenant's storage, so a
 // template copied from the system default keeps working once the tenant exports it or measures its
 // attachments. An entry whose source file is gone is left out: it could not be resolved at render
@@ -148,7 +162,7 @@ export async function prepareLinkedResourceCopiesBeforeTransaction(args) {
                 continue;
             const uploaded = await uploadToTenant({ ctx, user, tenantId }, { fileName: file.fileName, mimeType: file.contentType, data: file.bytes });
             if (!uploaded.isSuccess) {
-                await releaseAll(releases);
+                await releaseAfterFailure(ctx, releases);
                 return uploaded;
             }
             if (uploaded.release)
@@ -157,7 +171,7 @@ export async function prepareLinkedResourceCopiesBeforeTransaction(args) {
         }
     }
     catch (cause) {
-        await releaseAll(releases);
+        await releaseAfterFailure(ctx, releases);
         throw cause;
     }
     return { isSuccess: true, data: copies, release: () => releaseAll(releases) };
@@ -275,8 +289,7 @@ async function checkAttachmentTarget(args) {
     if (otherAttachmentCount(linked, key) >= MAX_FILE_ATTACHMENTS_PER_TEMPLATE) {
         return attachmentLimitFailure();
     }
-    const occupant = linked[key];
-    if (occupant !== undefined && typeof occupant === "string")
+    if (isImageKey(linked, key))
         return keyInUse();
     return { isSuccess: true, data: { row, linked } };
 }
@@ -387,6 +400,8 @@ export async function linkTemplatePdfAttachment(args) {
     if (row.kind !== "mail")
         return attachmentNeedsMailTemplate();
     const linked = parseLinkedResourceEntries(row.linkedResources);
+    if (isImageKey(linked, key))
+        return keyInUse();
     if (otherAttachmentCount(linked, key) >= MAX_FILE_ATTACHMENTS_PER_TEMPLATE) {
         return attachmentLimitFailure();
     }

package/dist/template-resolver/table.js

@@ -7,16 +7,15 @@ const renameMailHtmlKind = {
     toVersion: 2,
     transform: (fields) => (fields["kind"] === "mail-html" ? { ...fields, kind: "mail" } : fields),
 };
-// TemplateResource — strukturierte Template-Definition mit Tenant-
-// Override-Hierarchie, Locale-Fallback und Resource-Linking via
-// file-foundation. Pro (tenantId, slug, kind, locale) genau eine Row;
-// scope/status/version differenzieren Lifecycle. Der Entwurf neben einer
-// aktiven Fassung liegt in `draft`; die Hauptfelder bleiben die ausgelieferte
-// Fassung.
+// TemplateResource — structured template definition with tenant override
+// hierarchy, locale fallback, and resource linking via file-foundation. Exactly
+// one row per (tenantId, slug, kind, locale); scope/status/version distinguish
+// lifecycle states. The draft alongside an active revision is stored in `draft`;
+// the main fields remain the served revision.
 //
-// `variableSchema` + `linkedResources` sind JSON-Strings in longText
-// (Pattern aus compliance-profiles — kein dedizierter jsonbField im
-// createEntity-DSL). App-Layer parsed JSON, persistiert wieder als String.
+// `variableSchema` + `linkedResources` are JSON strings in longText
+// (following compliance-profiles because the createEntity DSL has no dedicated
+// jsonbField). The application layer parses the JSON and persists it as a string.
 export const templateResourceEntity = createEntity({
     table: "read_template_resources",
     fields: {
@@ -31,8 +30,8 @@ export const templateResourceEntity = createEntity({
         // Folder path for the content tree, `/`-separated ("page/marketing").
         // null = root node.
         folder: createTextField({ personal: false, reason: "technical_reference" }),
-        // Template-body is authored by TenantAdmin/Operator (email-templates etc.),
-        // business data — kein end-user UGC.
+        // Template body is authored by TenantAdmin/Operator (email-templates, etc.),
+        // and is business data—not end-user UGC.
         content: createLongTextField({
             personal: false,
             reason: "is_business_data",

package/dist/template-resolver/template-delivery-policy.d.ts

@@ -13,10 +13,5 @@ export declare function isServedByCollectionOnly(policy: TemplateDeliveryPolicy,
 export declare function isRowServed(policy: TemplateDeliveryPolicy, row: DeliveryTarget & {
     readonly tenantId: string;
 }): boolean;
-export declare function isRowServedTo(policy: TemplateDeliveryPolicy, user: {
-    readonly roles: readonly string[];
-}, row: DeliveryTarget & {
-    readonly tenantId: string;
-}): boolean;
 export declare function deliveryPolicyOf(registry: Registry): TemplateDeliveryPolicy;
 export {};

package/dist/template-resolver/template-delivery-policy.js

@@ -1,5 +1,4 @@
 import { isPlainObject, propertyOf } from "@cosmicdrift/kumiko-types/type-guards";
-import { isSystemAdmin } from "./template-draft.js";
 import { SYSTEM_TENANT_ID } from "./web/constants.js";
 import { TEMPLATE_RESOLVER_FEATURE } from "./web/qualified-names.js";
 const NOTHING_UNLOCKED = { tenantEditable: [], collectionKinds: [] };
@@ -16,11 +15,6 @@ export function isServedByCollectionOnly(policy, target) {
 export function isRowServed(policy, row) {
     return row.tenantId === SYSTEM_TENANT_ID || isTenantOverrideServed(policy, row);
 }
-// A SystemAdmin sees every stored row, so a locked override can still be reset; everyone else
-// sees only what is delivered, which keeps a locked override out of the template-resolver queries for a TenantAdmin (the audit log keeps the history).
-export function isRowServedTo(policy, user, row) {
-    return isSystemAdmin(user) || isRowServed(policy, row);
-}
 function isDeliveryTarget(value) {
     return (typeof propertyOf(value, "kind") === "string" && typeof propertyOf(value, "slug") === "string");
 }