@cosmicdrift/kumiko-bundled-features 0.387.0 → 0.388.0

package/dist/subscription-dodo/verify-webhook.d.ts

@@ -0,0 +1,37 @@
+import { type PaymentEvent, type SubscriptionEvent, type SubscriptionStatus } from "@cosmicdrift/kumiko-bundled-features/billing-foundation";
+import type { SecretsContext } from "@cosmicdrift/kumiko-framework/secrets";
+import * as z from "zod";
+import type { DodoWebhookRuntime } from "./runtime.ts";
+export declare const WEBHOOK_TOLERANCE_SECONDS = 300;
+export type StandardWebhookHeaders = Readonly<Record<string, string>>;
+/** Throws unless the Standard Webhooks signature over `rawBody` is valid and
+ *  the timestamp is within the tolerance in both directions. */
+export declare function verifyStandardWebhook(rawBody: string, headers: StandardWebhookHeaders, secret: string, nowSeconds: number): void;
+export declare const dodoSubscriptionSchema: z.ZodObject<{
+    subscription_id: z.ZodString;
+    product_id: z.ZodString;
+    status: z.ZodString;
+    customer: z.ZodObject<{
+        customer_id: z.ZodString;
+    }, z.core.$strip>;
+    metadata: z.ZodOptional<z.ZodNullable<z.ZodRecord<z.ZodString, z.ZodUnknown>>>;
+    next_billing_date: z.ZodISODateTime;
+    cancel_at_next_billing_date: z.ZodOptional<z.ZodNullable<z.ZodBoolean>>;
+}, z.core.$strip>;
+export type DodoSubscription = z.infer<typeof dodoSubscriptionSchema>;
+export type MappedDodoSubscriptionState = {
+    readonly status: SubscriptionStatus;
+    readonly tier: string;
+    readonly currentPeriodEnd: string;
+    readonly cancelAt: string | null;
+};
+/** Shared by the webhook and retrieveSubscription so both map Dodo state
+ *  identically. Null when the status is unknown or the product is not in
+ *  `priceToTier` (SubscriptionEvent.tier is required). */
+export declare function mapDodoSubscriptionState(sub: DodoSubscription, priceToTier: Readonly<Record<string, string>>): MappedDodoSubscriptionState | null;
+export type DodoWebhookOptions = {
+    readonly priceToTier: Readonly<Record<string, string>>;
+    /** Test seam: Unix seconds. Defaults to the wall clock. */
+    readonly nowSeconds?: () => number;
+};
+export declare function verifyAndParseDodoWebhook(runtime: DodoWebhookRuntime, options: DodoWebhookOptions): (rawBody: string, headers: Record<string, string>, systemSecrets?: SecretsContext) => Promise<SubscriptionEvent | PaymentEvent | null>;

package/dist/subscription-dodo/verify-webhook.js

@@ -0,0 +1,189 @@
+// Dodo Payments webhook: Standard Webhooks signature verification plus mapping
+// of Dodo's event envelope onto the foundation's normalized events.
+//
+// Verification always runs against the raw body string; re-serialized JSON
+// would change whitespace and break the HMAC. The signature check happens
+// before any parsing, so no path bypasses it.
+import { createHmac, timingSafeEqual } from "node:crypto";
+import { BillingEventKinds, parseProviderConsentId, SubscriptionEventTypes, SubscriptionStatuses, } from "@cosmicdrift/kumiko-bundled-features/billing-foundation";
+import { parseJsonOrThrow } from "@cosmicdrift/kumiko-framework/utils";
+import { Temporal } from "@cosmicdrift/kumiko-types/temporal";
+import * as z from "zod";
+import { DODO_PROVIDER_NAME } from "./constants.js";
+export const WEBHOOK_TOLERANCE_SECONDS = 300;
+const SECRET_PREFIX = "whsec_";
+const SIGNATURE_VERSION = "v1";
+const TIMESTAMP_PATTERN = /^\d+$/;
+function signatureFor(secretKey, signedContent) {
+    return createHmac("sha256", secretKey).update(signedContent).digest();
+}
+function matchesAnyV1Signature(header, expected) {
+    return header.split(" ").some((entry) => {
+        const [version, encoded] = entry.split(",");
+        if (version !== SIGNATURE_VERSION || !encoded)
+            return false;
+        const candidate = Buffer.from(encoded, "base64");
+        return candidate.length === expected.length && timingSafeEqual(candidate, expected);
+    });
+}
+/** Throws unless the Standard Webhooks signature over `rawBody` is valid and
+ *  the timestamp is within the tolerance in both directions. */
+export function verifyStandardWebhook(rawBody, headers, secret, nowSeconds) {
+    const id = headers["webhook-id"];
+    const timestamp = headers["webhook-timestamp"];
+    const signatureHeader = headers["webhook-signature"];
+    if (!id || !timestamp || !signatureHeader) {
+        throw new Error("subscription-dodo: webhook-id, webhook-timestamp or webhook-signature missing");
+    }
+    if (!TIMESTAMP_PATTERN.test(timestamp)) {
+        throw new Error("subscription-dodo: webhook-timestamp is not a Unix timestamp in seconds");
+    }
+    if (Math.abs(nowSeconds - Number(timestamp)) > WEBHOOK_TOLERANCE_SECONDS) {
+        throw new Error("subscription-dodo: webhook timestamp outside the tolerance window");
+    }
+    const secretKey = Buffer.from(secret.startsWith(SECRET_PREFIX) ? secret.slice(SECRET_PREFIX.length) : secret, "base64");
+    const expected = signatureFor(secretKey, `${id}.${timestamp}.${rawBody}`);
+    if (!matchesAnyV1Signature(signatureHeader, expected)) {
+        throw new Error("subscription-dodo: webhook signature verify failed");
+    }
+}
+// =============================================================================
+// Event mapping
+// =============================================================================
+const DODO_SUBSCRIPTION_EVENT_TYPES = {
+    "subscription.active": SubscriptionEventTypes.created,
+    "subscription.updated": SubscriptionEventTypes.updated,
+    "subscription.plan_changed": SubscriptionEventTypes.updated,
+    "subscription.paused": SubscriptionEventTypes.updated,
+    "subscription.unpaused": SubscriptionEventTypes.updated,
+    "subscription.update_payment_method": SubscriptionEventTypes.updated,
+    "subscription.renewed": SubscriptionEventTypes.invoicePaid,
+    "subscription.past_due": SubscriptionEventTypes.invoicePaymentFailed,
+    "subscription.on_hold": SubscriptionEventTypes.invoicePaymentFailed,
+    "subscription.cancelled": SubscriptionEventTypes.canceled,
+    "subscription.expired": SubscriptionEventTypes.canceled,
+    "subscription.failed": SubscriptionEventTypes.canceled,
+};
+const DODO_SUBSCRIPTION_STATUSES = {
+    pending: SubscriptionStatuses.incomplete,
+    active: SubscriptionStatuses.active,
+    on_hold: SubscriptionStatuses.pastDue,
+    past_due: SubscriptionStatuses.pastDue,
+    paused: SubscriptionStatuses.pastDue,
+    cancelled: SubscriptionStatuses.canceled,
+    failed: SubscriptionStatuses.canceled,
+    expired: SubscriptionStatuses.canceled,
+};
+const PAYMENT_SUCCEEDED = "payment.succeeded";
+const metadataSchema = z.record(z.string(), z.unknown()).nullish();
+const customerSchema = z.object({ customer_id: z.string().min(1) });
+const envelopeSchema = z.object({
+    type: z.string(),
+    timestamp: z.iso.datetime({ offset: true }),
+    data: z.unknown(),
+});
+export const dodoSubscriptionSchema = z.object({
+    subscription_id: z.string().min(1),
+    product_id: z.string().min(1),
+    status: z.string(),
+    customer: customerSchema,
+    metadata: metadataSchema,
+    next_billing_date: z.iso.datetime({ offset: true }),
+    cancel_at_next_billing_date: z.boolean().nullish(),
+});
+const dodoPaymentSchema = z.object({
+    subscription_id: z.string().nullish(),
+    checkout_session_id: z.string().nullish(),
+    customer: customerSchema,
+    metadata: metadataSchema,
+    product_cart: z.array(z.object({ product_id: z.string().min(1) })).nullish(),
+});
+function metadataString(metadata, key) {
+    const value = metadata?.[key];
+    return typeof value === "string" && value.length > 0 ? value : undefined;
+}
+/** Shared by the webhook and retrieveSubscription so both map Dodo state
+ *  identically. Null when the status is unknown or the product is not in
+ *  `priceToTier` (SubscriptionEvent.tier is required). */
+export function mapDodoSubscriptionState(sub, priceToTier) {
+    const status = DODO_SUBSCRIPTION_STATUSES[sub.status];
+    const tier = priceToTier[sub.product_id];
+    if (!status || !tier)
+        return null;
+    return {
+        status,
+        tier,
+        currentPeriodEnd: sub.next_billing_date,
+        cancelAt: sub.cancel_at_next_billing_date === true ? sub.next_billing_date : null,
+    };
+}
+function currentUnixSeconds() {
+    return Math.floor(Temporal.Now.instant().epochMilliseconds / 1000);
+}
+function parsePaymentEvent(providerEventId, data) {
+    const parsed = dodoPaymentSchema.safeParse(data);
+    if (!parsed.success)
+        return null;
+    const payment = parsed.data;
+    // A subscription's own payments are covered by its subscription.* events.
+    if (payment.subscription_id)
+        return null;
+    const tenantId = metadataString(payment.metadata, "tenantId");
+    const priceId = payment.product_cart?.[0]?.product_id;
+    if (!tenantId || !priceId)
+        return null;
+    const consentId = parseProviderConsentId(payment.metadata?.["consentId"]);
+    return {
+        kind: BillingEventKinds.payment,
+        providerEventId,
+        providerName: DODO_PROVIDER_NAME,
+        tenantId,
+        ...(consentId !== undefined && { consentId }),
+        ...(payment.checkout_session_id && { providerCheckoutId: payment.checkout_session_id }),
+        providerCustomerId: payment.customer.customer_id,
+        priceId,
+    };
+}
+function parseSubscriptionEvent(providerEventId, type, providerEventAt, data, priceToTier) {
+    const parsed = dodoSubscriptionSchema.safeParse(data);
+    if (!parsed.success)
+        return null;
+    const sub = parsed.data;
+    const tenantId = metadataString(sub.metadata, "tenantId");
+    const state = mapDodoSubscriptionState(sub, priceToTier);
+    if (!tenantId || !state)
+        return null;
+    const consentId = parseProviderConsentId(sub.metadata?.["consentId"]);
+    return {
+        providerEventId,
+        providerName: DODO_PROVIDER_NAME,
+        type,
+        tenantId,
+        ...(consentId !== undefined && { consentId }),
+        providerCustomerId: sub.customer.customer_id,
+        providerSubscriptionId: sub.subscription_id,
+        providerEventAt,
+        ...state,
+    };
+}
+export function verifyAndParseDodoWebhook(runtime, options) {
+    const nowSeconds = options.nowSeconds ?? currentUnixSeconds;
+    return async (rawBody, headers, systemSecrets) => {
+        const secret = await runtime.resolveWebhookSecret(systemSecrets);
+        verifyStandardWebhook(rawBody, headers, secret, nowSeconds());
+        // Past verification the body is trusted to be Dodo's; a malformed shape is
+        // schema drift, so it is dropped (200 ignored) instead of answered with a 401.
+        const envelope = envelopeSchema.safeParse(parseJsonOrThrow(rawBody, "subscription-dodo webhook body"));
+        // verifyStandardWebhook has checked webhook-id is present.
+        const providerEventId = headers["webhook-id"];
+        if (!envelope.success || !providerEventId)
+            return null;
+        const { type, timestamp, data } = envelope.data;
+        if (type === PAYMENT_SUCCEEDED)
+            return parsePaymentEvent(providerEventId, data);
+        const normalizedType = DODO_SUBSCRIPTION_EVENT_TYPES[type];
+        if (!normalizedType)
+            return null;
+        return parseSubscriptionEvent(providerEventId, normalizedType, timestamp, data, options.priceToTier);
+    };
+}

package/dist/subscription-stripe/feature.js

@@ -172,6 +172,7 @@ export function createSubscriptionStripeFeature(options = {}) {
         const priceCache = createStripePriceCache();
         const portalConfigurationCache = new Map();
         const plugin = {
+            displayName: "Stripe",
             verifyAndParseWebhook: verifyAndParseStripeWebhook(runtimes.webhook, {
                 priceToTier: options.priceToTier ?? {},
             }),

package/dist/subscription-stripe/runtime.js

@@ -27,7 +27,7 @@
 import { requireSecretsContext } from "@cosmicdrift/kumiko-bundled-features/secrets";
 import { SYSTEM_TENANT_ID, } from "@cosmicdrift/kumiko-framework/engine";
 import { FeatureDisabledError, UnconfiguredError } from "@cosmicdrift/kumiko-framework/errors";
-import { parseJsonOrThrow } from "@cosmicdrift/kumiko-framework/utils";
+import { parseJsonSafe } from "@cosmicdrift/kumiko-framework/utils";
 import Stripe from "stripe";
 import { SUBSCRIPTION_STRIPE_FEATURE } from "./constants.js";
 const API_KEY_HINT = "Set the Stripe API key via config:write:set on `subscription-stripe:config:api-key` (or seed it from STRIPE_API_KEY during the env bridge).";
@@ -52,14 +52,15 @@ export function createStripeClientCache() {
 // (the un-audited webhook path + the audited ctx read here) therefore returns
 // the JSON-quoted string and must parse it back. The factory fallback is a
 // plain env string and stays raw — so parsing is applied only to the store
-// read, never to the fallback.
+// read, never to the fallback. The error must not carry the input: the JSON
+// parser's own message would repeat the credential into logs and the 401 body.
 function parseStoredSecret(raw) {
     if (raw === undefined || raw.length === 0)
         return undefined;
-    // parseJsonOrThrow is the sanctioned safe-parse (same helper the config
-    // resolver's deserializeValue uses for this very value) — mirrors how the
-    // store round-trips a backing:"secrets" text value.
-    const parsed = parseJsonOrThrow(raw, "subscription-stripe credential (backing:secrets)");
+    const parsed = parseJsonSafe(raw, undefined);
+    if (parsed === undefined) {
+        throw new Error("subscription-stripe credential (backing:secrets) is not valid JSON");
+    }
     return typeof parsed === "string" && parsed.length > 0 ? parsed : undefined;
 }
 export function createStripeRuntimes(deps) {

package/dist/template-resolver/api.d.ts

@@ -80,10 +80,11 @@ export type TemplateResolverApi = {
     readonly resolveLayout: (args: ResolveLayoutRequest) => Promise<TemplateResource>;
 };
 export declare function createTemplateResolverApi(db: DbRunner | TenantDb, registry: Registry): TemplateResolverApi;
-export declare function isRowDelivered(db: DbRunner | TenantDb, policy: TemplateDeliveryPolicy, row: TemplateResourceRow): Promise<boolean>;
+type DeliveredRowKey = Pick<TemplateResourceRow, "tenantId" | "kind" | "slug">;
+export declare function isRowDelivered(db: DbRunner | TenantDb, policy: TemplateDeliveryPolicy, row: DeliveredRowKey): Promise<boolean>;
 export declare function isRowDeliveredTo(db: DbRunner | TenantDb, policy: TemplateDeliveryPolicy, user: {
     readonly roles: readonly string[];
-}, row: TemplateResourceRow): Promise<boolean>;
+}, row: DeliveredRowKey): Promise<boolean>;
 export declare function filterDeliveredTo(db: DbRunner | TenantDb, policy: TemplateDeliveryPolicy, user: {
     readonly roles: readonly string[];
 }, rows: readonly TemplateResourceRow[]): Promise<TemplateResourceRow[]>;

package/dist/template-resolver/api.js

@@ -69,9 +69,31 @@ export async function isRowDelivered(db, policy, row) {
 export async function isRowDeliveredTo(db, policy, user, row) {
     return isSystemAdmin(user) || (await isRowDelivered(db, policy, row));
 }
+// One system-slug lookup per kind instead of one query per row, because by-tenant is anonymous.
 export async function filterDeliveredTo(db, policy, user, rows) {
-    const flags = await Promise.all(rows.map((row) => isRowDeliveredTo(db, policy, user, row)));
-    return rows.filter((_, index) => flags[index]);
+    if (isSystemAdmin(user))
+        return [...rows];
+    const served = rows.filter((row) => isRowServed(policy, row));
+    const shadowable = served.filter((row) => row.tenantId !== SYSTEM_TENANT_ID && isServedByCollectionOnly(policy, row));
+    const slugsByKind = new Map();
+    for (const row of shadowable) {
+        const slugs = slugsByKind.get(row.kind) ?? new Set();
+        slugs.add(row.slug);
+        slugsByKind.set(row.kind, slugs);
+    }
+    const systemKeys = new Set();
+    for (const [kind, slugs] of slugsByKind) {
+        const systemRows = await selectMany(db, templateResourcesTable, {
+            tenantId: SYSTEM_TENANT_ID,
+            kind,
+            slug: [...slugs],
+        });
+        for (const systemRow of systemRows)
+            systemKeys.add(`${kind}|${systemRow.slug}`);
+    }
+    return served.filter((row) => row.tenantId === SYSTEM_TENANT_ID ||
+        !isServedByCollectionOnly(policy, row) ||
+        !systemKeys.has(`${row.kind}|${row.slug}`));
 }
 export async function systemTemplateExists(db, kind, slug) {
     const rows = await selectMany(db, templateResourcesTable, { tenantId: SYSTEM_TENANT_ID, slug, kind }, { limit: 1 });

package/dist/template-resolver/compile-document-body.js

@@ -320,6 +320,7 @@ export function compileDocumentBodyToHandlebars(html, variables, options = {}) {
         for (const element of Array.from(root.querySelectorAll("div[data-images]"))) {
             rewriteImagesBlock(element, state, options);
         }
+        // Order matters: the conditional wraps first so the row's #each lands inside the #if (evaluated once per list).
         for (const block of Array.from(root.querySelectorAll(`[${DOCUMENT_CONDITION_ATTRIBUTE}]`))) {
             rewriteConditionalBlock(block, state);
         }

package/dist/template-resolver/feature.js

@@ -29,7 +29,7 @@ import { tenantOverridesQuery } from "./handlers/tenant-overrides.query.js";
 import { makeArchiveSystemWrite, makeArchiveWrite, makePublishSystemWrite, makePublishWrite, } from "./handlers/toggle-status.write.js";
 import { upsertSystemWrite } from "./handlers/upsert-system.write.js";
 import { makeUpsertTenantWrite } from "./handlers/upsert-tenant.write.js";
-import { usageQuery } from "./handlers/usage.query.js";
+import { makeUsageQuery } from "./handlers/usage.query.js";
 import { validateQuery } from "./handlers/validate.query.js";
 import { TEMPLATE_RESOLVER_I18N } from "./i18n.js";
 import { templateResourceEntity } from "./table.js";
@@ -127,7 +127,7 @@ export function createTemplateResolverFeature(opts = {}) {
             list: r.queryHandler(listQuery),
             bySlug: r.queryHandler(bySlugQuery),
             byTenant: r.queryHandler(byTenantQuery),
-            usage: r.queryHandler(usageQuery),
+            usage: r.queryHandler(makeUsageQuery(policy)),
             overview: r.queryHandler(makeOverviewQuery(policy)),
             layoutSource: r.queryHandler(layoutSourceQuery),
             tenantOverrides: r.queryHandler(tenantOverridesQuery),

package/dist/template-resolver/handlers/bundle-import.js

@@ -1,7 +1,7 @@
 import { fetchOne } from "@cosmicdrift/kumiko-framework/db";
 import { ValidationError, writeFailure, } from "@cosmicdrift/kumiko-framework/errors";
 import { requireForTenant } from "../../shared/index.js";
-import { attachmentLimitFailure, attachmentNeedsMailTemplate, createPreparedBundleResourceEntry, prepareTemplateAttachmentBeforeTransaction, prepareTemplateResourceBeforeTransaction, readTemplateResourceMaxBytes, releaseAll, } from "../store-template-resource.js";
+import { attachmentLimitFailure, attachmentNeedsMailTemplate, createPreparedBundleResourceEntry, prepareTemplateAttachmentBeforeTransaction, prepareTemplateResourceBeforeTransaction, readTemplateResourceMaxBytes, releaseAfterFailure, releaseAll, } from "../store-template-resource.js";
 import { templateResourcesTable } from "../table.js";
 import { attachTemplateResources } from "../template-resources.js";
 import { resolveTemplateVariables } from "../template-validation.js";
@@ -94,7 +94,7 @@ export async function prepareTemplateBundleBeforeTransaction(args) {
                 })
                 : await prepareTemplateResourceBeforeTransaction(common);
             if (!result.isSuccess) {
-                await releaseAll(releases);
+                await releaseAfterFailure(args.ctx, releases);
                 return result;
             }
             if (result.release)
@@ -103,7 +103,7 @@ export async function prepareTemplateBundleBeforeTransaction(args) {
         }
     }
     catch (cause) {
-        await releaseAll(releases);
+        await releaseAfterFailure(args.ctx, releases);
         throw cause;
     }
     return { isSuccess: true, data: prepared, release: () => releaseAll(releases) };

package/dist/template-resolver/handlers/copy-locale.write.d.ts

@@ -17,4 +17,8 @@ export declare function makeCopyLocaleWrite(policy: TemplateEditPolicy): import(
         system: "system";
         tenant: "tenant";
     }>>;
-}, z.core.$strip>, import("./template-write.ts").WrittenTemplateRow, import("@cosmicdrift/kumiko-types/event-type-map").KumikoEventTypeMap, readonly import("../store-template-resource.ts").PreparedLinkedResourceCopy[]>;
+}, z.core.$strip>, import("./template-write.ts").WrittenTemplateRow, import("@cosmicdrift/kumiko-types/event-type-map").KumikoEventTypeMap, {
+    sourceId: string | number;
+    sourceVersion: number;
+    copies: readonly import("../store-template-resource.ts").PreparedLinkedResourceCopy[];
+}>;

package/dist/template-resolver/handlers/copy-locale.write.js

@@ -1,6 +1,6 @@
 import { fetchOne } from "@cosmicdrift/kumiko-framework/db";
 import { defineWriteHandler, SYSTEM_TENANT_ID, } from "@cosmicdrift/kumiko-framework/engine";
-import { AccessDeniedError, NotFoundError, ValidationError, writeFailure, } from "@cosmicdrift/kumiko-framework/errors";
+import { AccessDeniedError, NotFoundError, ValidationError, VersionConflictError, writeFailure, } from "@cosmicdrift/kumiko-framework/errors";
 import { isOneOf } from "@cosmicdrift/kumiko-types/type-guards";
 import * as z from "zod";
 import { requireForTenant } from "../../shared/index.js";
@@ -111,14 +111,19 @@ export function makeCopyLocaleWrite(policy) {
             const request = await checkCopyRequest(ctx, policy, event);
             if (!request.isSuccess)
                 return request;
-            if (!request.data.sourceIsForeign)
-                return { isSuccess: true, data: [] };
-            return prepareLinkedResourceCopiesBeforeTransaction({
+            const { source, tenantId, sourceIsForeign, sourceResources } = request.data;
+            const sourceStamp = { sourceId: source.id, sourceVersion: source.version };
+            if (!sourceIsForeign)
+                return { isSuccess: true, data: { ...sourceStamp, copies: [] } };
+            const prepared = await prepareLinkedResourceCopiesBeforeTransaction({
                 ctx,
                 user: event.user,
-                tenantId: request.data.tenantId,
-                resources: request.data.sourceResources,
+                tenantId,
+                resources: sourceResources,
             });
+            if (!prepared.isSuccess)
+                return prepared;
+            return { ...prepared, data: { ...sourceStamp, copies: prepared.data } };
         },
         handler: async (event, ctx) => {
             const { slug, kind, toLocale } = event.payload;
@@ -126,6 +131,16 @@ export function makeCopyLocaleWrite(policy) {
             if (!request.isSuccess)
                 return request;
             const { scope, tenantId, source, contentFormat, sourceResources, sourceIsForeign } = request.data;
+            // The uploads were prepared for the source as it was before the transaction; a source that
+            // changed since (own row created or deleted, edited) no longer matches them.
+            if (event.prepared.sourceId !== source.id ||
+                event.prepared.sourceVersion !== source.version) {
+                return writeFailure(new VersionConflictError({
+                    entityId: source.id,
+                    expectedVersion: event.prepared.sourceVersion,
+                    currentVersion: source.version,
+                }));
+            }
             const variableSchema = storedRecord(source.variableSchema);
             const written = await writeTemplateRow({
                 ctx,
@@ -149,7 +164,7 @@ export function makeCopyLocaleWrite(policy) {
             if (!written.isSuccess)
                 return written;
             const resources = sourceIsForeign
-                ? await createLinkedResourceCopies({ ctx, user: event.user, tenantId }, event.prepared)
+                ? await createLinkedResourceCopies({ ctx, user: event.user, tenantId }, event.prepared.copies)
                 : { isSuccess: true, data: sourceResources };
             if (!resources.isSuccess)
                 return resources;

package/dist/template-resolver/handlers/diff-to-system.query.js

@@ -2,8 +2,9 @@ import { fetchOne } from "@cosmicdrift/kumiko-framework/db";
 import { defineQueryHandler, SYSTEM_TENANT_ID } from "@cosmicdrift/kumiko-framework/engine";
 import { NotFoundError } from "@cosmicdrift/kumiko-framework/errors";
 import * as z from "zod";
+import { isRowDeliveredTo } from "../api.js";
 import { templateResourcesTable } from "../table.js";
-import { deliveryPolicyOf, isRowServedTo } from "../template-delivery-policy.js";
+import { deliveryPolicyOf } from "../template-delivery-policy.js";
 import { isHiddenSystemDraft } from "../template-draft.js";
 import { buildOverrideDiff } from "./override-diff.js";
 export const diffToSystemQuery = defineQueryHandler({
@@ -18,7 +19,7 @@ export const diffToSystemQuery = defineQueryHandler({
         if (!tenantRow ||
             tenantRow.tenantId !== query.user.tenantId ||
             tenantRow.scope !== "tenant" ||
-            !isRowServedTo(deliveryPolicyOf(ctx.registry), query.user, tenantRow)) {
+            !(await isRowDeliveredTo(ctx.db, deliveryPolicyOf(ctx.registry), query.user, tenantRow))) {
             throw new NotFoundError("template-resource", query.payload.id);
         }
         const systemRow = await fetchOne(ctx.db, templateResourcesTable, {

package/dist/template-resolver/handlers/document-base.js

@@ -1,8 +1,9 @@
 import { fetchOne } from "@cosmicdrift/kumiko-framework/db";
 import { SYSTEM_TENANT_ID, } from "@cosmicdrift/kumiko-framework/engine";
 import { isPlainObject } from "@cosmicdrift/kumiko-types/type-guards";
+import { isRowDeliveredTo } from "../api.js";
 import { templateResourcesTable } from "../table.js";
-import { deliveryPolicyOf, isRowServedTo } from "../template-delivery-policy.js";
+import { deliveryPolicyOf } from "../template-delivery-policy.js";
 import { isHiddenSystemDraft, toWorkingRow } from "../template-draft.js";
 import { isSystemOnlyTemplateHiddenFrom } from "../template-system-only.js";
 import { parseStoredJson } from "./template-gates.js";
@@ -20,7 +21,7 @@ export async function loadDocumentBase(ctx, user, where) {
     // A locked override is neither shown nor edited by a non-SystemAdmin; the served system default is.
     const ownIsVisible = own !== undefined &&
         !isSystemOnlyTemplateHiddenFrom(user, ctx.registry, own) &&
-        isRowServedTo(deliveryPolicyOf(ctx.registry), user, own);
+        (await isRowDeliveredTo(ctx.db, deliveryPolicyOf(ctx.registry), user, own));
     if (own !== undefined && ownIsVisible) {
         const working = toWorkingRow(own, user.tenantId);
         return {

package/dist/template-resolver/handlers/find-by-id.query.js

@@ -1,8 +1,9 @@
 import { fetchOne } from "@cosmicdrift/kumiko-framework/db";
 import { defineQueryHandler } from "@cosmicdrift/kumiko-framework/engine";
 import * as z from "zod";
+import { isRowDeliveredTo } from "../api.js";
 import { templateResourcesTable } from "../table.js";
-import { deliveryPolicyOf, isRowServedTo } from "../template-delivery-policy.js";
+import { deliveryPolicyOf } from "../template-delivery-policy.js";
 import { draftViewerTenantId, isHiddenSystemDraft, toWorkingRow } from "../template-draft.js";
 import { isSystemOnlyTemplateHiddenFrom } from "../template-system-only.js";
 // Admin lookup for the UI editing flow. Returns the raw template, including draft/
@@ -22,7 +23,7 @@ export const findByIdQuery = defineQueryHandler({
         if (!stored ||
             isHiddenSystemDraft(query.user, stored) ||
             isSystemOnlyTemplateHiddenFrom(query.user, ctx.registry, stored) ||
-            !isRowServedTo(deliveryPolicyOf(ctx.registry), query.user, stored)) {
+            !(await isRowDeliveredTo(ctx.db, deliveryPolicyOf(ctx.registry), query.user, stored))) {
             return null;
         }
         const row = toWorkingRow(stored, draftViewerTenantId(query.user, stored));

package/dist/template-resolver/handlers/list.query.js

@@ -1,8 +1,9 @@
 import { selectMany } from "@cosmicdrift/kumiko-framework/db";
 import { defineQueryHandler } from "@cosmicdrift/kumiko-framework/engine";
 import * as z from "zod";
+import { filterDeliveredTo } from "../api.js";
 import { templateResourcesTable } from "../table.js";
-import { deliveryPolicyOf, isRowServedTo } from "../template-delivery-policy.js";
+import { deliveryPolicyOf } from "../template-delivery-policy.js";
 import { isHiddenSystemDraft } from "../template-draft.js";
 import { isSystemOnlyTemplateHiddenFrom } from "../template-system-only.js";
 import { TEMPLATE_KINDS, TEMPLATE_STATUSES } from "../web/constants.js";
@@ -41,11 +42,9 @@ export const listQuery = defineQueryHandler({
             limit: 500,
         }));
         const deliveryPolicy = deliveryPolicyOf(ctx.registry);
-        return rows
-            .filter((row) => !isHiddenSystemDraft(query.user, row) &&
-            !isSystemOnlyTemplateHiddenFrom(query.user, ctx.registry, row) &&
-            isRowServedTo(deliveryPolicy, query.user, row))
-            .map((row) => ({
+        const candidates = rows.filter((row) => !isHiddenSystemDraft(query.user, row) &&
+            !isSystemOnlyTemplateHiddenFrom(query.user, ctx.registry, row));
+        return (await filterDeliveredTo(ctx.db, deliveryPolicy, query.user, candidates)).map((row) => ({
             id: String(row.id),
             tenantId: row.tenantId,
             slug: row.slug,

package/dist/template-resolver/handlers/overview.query.d.ts

@@ -1,7 +1,9 @@
 import * as z from "zod";
 import { type TemplateResourceRow } from "../table.ts";
 import { type TemplateDeliveryPolicy } from "../template-delivery-policy.ts";
+import { isHiddenSystemDraft } from "../template-draft.ts";
 import { type TemplateEditPolicy } from "../template-edit-policy.ts";
+import { isSystemOnlyTemplateHiddenFrom } from "../template-system-only.ts";
 import { type EffectiveMailLayoutSlugs } from "../template-usage.ts";
 import { type TemplateStatus } from "../web/constants.ts";
 declare const OVERVIEW_KINDS: readonly ["mail", "document-pdf", "mail-layout", "pdf-layout"];
@@ -51,6 +53,7 @@ export type OverviewResponse = {
     /** True when the tenant has more template rows than the overview reads; rows and total are then incomplete. */
     readonly truncated: boolean;
 };
+export declare function isRowVisibleToCaller(policy: TemplateEditPolicy, user: Parameters<typeof isHiddenSystemDraft>[0], registry: Parameters<typeof isSystemOnlyTemplateHiddenFrom>[1], row: TemplateResourceRow): boolean;
 export declare function effectiveMailLayoutSlugs(rows: readonly TemplateResourceRow[], policy: TemplateDeliveryPolicy): EffectiveMailLayoutSlugs;
 export declare function makeOverviewQuery(policy: TemplateEditPolicy): import("@cosmicdrift/kumiko-types/define-handler").QueryHandlerDefinition<"overview", z.ZodObject<{
     search: z.ZodOptional<z.ZodString>;

package/dist/template-resolver/handlers/overview.query.js

@@ -69,6 +69,11 @@ function effectiveRowsOf(rows, policy) {
         ? { origin: "tenant", rows: tenantRows, lockedOverride: false, lockedOverrideId: null }
         : null;
 }
+export function isRowVisibleToCaller(policy, user, registry, row) {
+    return (!isHiddenSystemDraft(user, row) &&
+        !isSystemOnlyTemplateHiddenFrom(user, registry, row) &&
+        mayEditTemplate(policy, user, row));
+}
 export function effectiveMailLayoutSlugs(rows, policy) {
     const byLocale = new Map();
     for (const row of rows) {
@@ -242,9 +247,7 @@ export function makeOverviewQuery(policy) {
                     limit: OVERVIEW_ROW_LIMIT,
                 });
             }
-            const visibleRows = rows.filter((row) => !isHiddenSystemDraft(query.user, row) &&
-                !isSystemOnlyTemplateHiddenFrom(query.user, ctx.registry, row) &&
-                mayEditTemplate(policy, query.user, row));
+            const visibleRows = rows.filter((row) => isRowVisibleToCaller(policy, query.user, ctx.registry, row));
             const deliveryPolicy = deliveryPolicyOf(ctx.registry);
             const { drafts, layoutSlugByDocument } = buildDrafts(groupBySlugAndKind(visibleRows), query.user, deliveryPolicy);
             const effectiveLayouts = effectiveMailLayoutSlugs(visibleRows, deliveryPolicy);

package/dist/template-resolver/handlers/tenant-override-counts.query.js

@@ -14,9 +14,7 @@ export const tenantOverrideCountsQuery = defineQueryHandler({
     description: "Counts, per template slug and kind, the enabled tenants that override it with an active version, next to the number of enabled tenants; one query for the whole template overview instead of one tenant-overrides call per row.",
     escapeHatch: { grants: ["unsafeRaw"], reason: TENANT_OVERRIDES_REASON },
     handler: async (_query, ctx) => {
-        const found = await selectMany(ctx.db.unsafeRaw(), templateResourcesTable, {
-            scope: "tenant",
-        });
+        const found = await selectMany(ctx.db.unsafeRaw(), templateResourcesTable, { scope: "tenant" }, { fields: ["tenantId", "slug", "kind", "status", "version"] });
         const enabledTenantIds = await loadEnabledTenantIds(ctx);
         const rowsBySlugAndKind = new Map();
         for (const row of found) {

package/dist/template-resolver/handlers/tenant-override-selection.d.ts

@@ -8,5 +8,6 @@ type TenantIdQueryContext = {
 };
 /** Null when the tenant feature is not installed: every tenant row then counts. */
 export declare function loadEnabledTenantIds(ctx: TenantIdQueryContext): Promise<ReadonlySet<string> | null>;
-export declare function pickBestRowPerTenant(found: readonly TemplateResourceRow[], enabledTenantIds: ReadonlySet<string> | null): Map<string, TemplateResourceRow>;
+export type OverrideCandidate = Pick<TemplateResourceRow, "tenantId" | "status" | "version">;
+export declare function pickBestRowPerTenant<TRow extends OverrideCandidate>(found: readonly TRow[], enabledTenantIds: ReadonlySet<string> | null): Map<string, TRow>;
 export {};