@cosmicdrift/kumiko-bundled-features 1.0.0 → 2.0.0

package/src/tenant-settings/config.ts

@@ -0,0 +1,44 @@
+import {
+  access,
+  type ConfigKeyDefinition,
+  createTenantConfig,
+  DEFAULT_CURRENCIES,
+} from "@cosmicdrift/kumiko-framework/engine";
+
+// ISO-639-1, optional ISO-3166-1 region ("de" or "de-DE") — apps constrain
+// further via their own i18n setup; this only guards against garbage input.
+const LOCALE_PATTERN = { regex: "^[a-z]{2}(-[A-Z]{2})?$" } as const;
+
+export type TenantSettingsKeyOptions = {
+  /** Selectable currencies. Default: DEFAULT_CURRENCIES (engine). */
+  readonly currencies?: readonly string[];
+  /** Fallback when a tenant never set the key. Default: "EUR". */
+  readonly defaultCurrency?: string;
+  /** Fallback when a tenant never set the key. Default: "en". */
+  readonly defaultLocale?: string;
+  /** Who may change the tenant's settings. Default: access.admin. */
+  readonly write?: readonly string[];
+};
+
+export function buildTenantSettingsKeys(
+  opts: TenantSettingsKeyOptions = {},
+): Record<string, ConfigKeyDefinition> {
+  const write = opts.write ?? access.admin;
+  return {
+    // `mask` surfaces the key in the self-populating Settings-Hub (Tenant-
+    // Audience) without a hand-written r.screen/r.nav — see
+    // samples/recipes/managed-config for the mechanism.
+    currency: createTenantConfig("select", {
+      default: opts.defaultCurrency ?? "EUR",
+      options: opts.currencies ?? DEFAULT_CURRENCIES,
+      write,
+      mask: { title: "tenant-settings.currency", icon: "coins", order: 1 },
+    }),
+    locale: createTenantConfig("text", {
+      default: opts.defaultLocale ?? "en",
+      pattern: LOCALE_PATTERN,
+      write,
+      mask: { title: "tenant-settings.locale", icon: "languages", order: 2 },
+    }),
+  } satisfies Record<string, ConfigKeyDefinition>;
+}

package/src/tenant-settings/constants.ts

@@ -0,0 +1,16 @@
+// tenant-settings bundle constants — feature-name + qualified config names.
+//
+// Motivation (solon#P19): apps kept hard-coding a single currency/locale
+// literal per money/select field ("EUR", "de") instead of one per-tenant
+// setting — expensive to retrofit once a second tenant needs a different
+// default. This bundle is the one place that setting lives.
+
+export const TENANT_SETTINGS_FEATURE_NAME = "tenant-settings";
+
+// Qualified config key names (QN format: scope:config:name) for
+// ctx.config(...) reads. Clients reference the object instead of magic
+// strings (mirror tags' Handlers/Queries constants).
+export const TenantSettingsConfig = {
+  currency: "tenant-settings:config:currency",
+  locale: "tenant-settings:config:locale",
+} as const;

package/src/tenant-settings/feature.ts

@@ -0,0 +1,49 @@
+// tenant-settings — per-tenant Currency + Locale defaults.
+//
+// Any handler that needs a default (money-field currency, a locale-select
+// field, ...) reads it via `ctx.config(TenantSettingsConfig.currency)` /
+// `ctx.config(TenantSettingsConfig.locale)` — or use
+// `defineCreateWithTenantDefaults` (tenant-defaults.ts) to wire it into an
+// entity's create-handler without writing that plumbing by hand.
+//
+// No entities, no hand-written screen — `mask` on both keys makes them
+// surface in the self-populating Settings-Hub (Tenant-Audience) instead;
+// `buildConfigFeatureSchema` (config feature) derives the configEdit
+// screen + nav entry from the key's scope/type/mask, same mechanism as
+// samples/recipes/managed-config.
+
+import { defineFeature, type FeatureDefinition } from "@cosmicdrift/kumiko-framework/engine";
+import { buildTenantSettingsKeys, type TenantSettingsKeyOptions } from "./config";
+import { TENANT_SETTINGS_FEATURE_NAME } from "./constants";
+
+export type TenantSettingsFeatureOptions = TenantSettingsKeyOptions;
+
+export function createTenantSettingsFeature(
+  opts: TenantSettingsFeatureOptions = {},
+): FeatureDefinition {
+  return defineFeature(TENANT_SETTINGS_FEATURE_NAME, (r) => {
+    r.requires("config");
+    r.describe(
+      "Per-tenant Currency + Locale defaults, exposed as two config keys (tenant-settings:config:currency, tenant-settings:config:locale) that surface in the self-populating Settings-Hub via `mask`. Pair with defineCreateWithTenantDefaults to auto-fill a money field's currency or a locale field on create instead of hard-coding a literal per entity.",
+    );
+    r.config({ keys: buildTenantSettingsKeys(opts) });
+    r.translations({
+      keys: {
+        "tenant-settings.currency": { de: "Standard-Währung", en: "Default Currency" },
+        "tenant-settings.locale": { de: "Standard-Sprache", en: "Default Locale" },
+        // Settings-Hub-derived configEdit screen title (buildConfigFeatureSchema) —
+        // required by the i18n boot-validator whenever a feature masks config keys.
+        "screen:tenant-settings-system.title": {
+          de: "Tenant-Einstellungen",
+          en: "Tenant Settings",
+        },
+        "screen:tenant-settings-tenant.title": {
+          de: "Tenant-Einstellungen",
+          en: "Tenant Settings",
+        },
+      },
+    });
+  });
+}
+
+export const tenantSettingsFeature: FeatureDefinition = createTenantSettingsFeature();

package/src/tenant-settings/index.ts

@@ -0,0 +1,8 @@
+export { buildTenantSettingsKeys, type TenantSettingsKeyOptions } from "./config";
+export { TENANT_SETTINGS_FEATURE_NAME, TenantSettingsConfig } from "./constants";
+export {
+  createTenantSettingsFeature,
+  type TenantSettingsFeatureOptions,
+  tenantSettingsFeature,
+} from "./feature";
+export { defineCreateWithTenantDefaults } from "./tenant-defaults";

package/src/tenant-settings/tenant-defaults.ts

@@ -0,0 +1,67 @@
+// Wrapper around defineEntityCreateHandler: fills currency/locale fields from
+// tenant-settings config when the caller omits them — instead of repeating
+// field literals ("EUR"/"de") on every entity.
+//
+// buildInsertSchema always requires `currency` inside a money field (even when
+// the field itself is optional), so the caller cannot simply omit currency
+// without failing schema validation before the handler runs. This helper uses
+// a schema extension that makes those sub-keys optional, instead of the
+// generic defineEntityCreateHandler.
+
+import {
+  type AccessRule,
+  buildInsertSchema,
+  createEntityExecutor,
+  type EntityDefinition,
+  type WriteHandlerDef,
+} from "@cosmicdrift/kumiko-framework/engine";
+import { z } from "zod";
+import { TenantSettingsConfig } from "./constants";
+
+const OPTIONAL_CURRENCY_MONEY = z.object({ amount: z.number(), currency: z.string().optional() });
+
+export function defineCreateWithTenantDefaults(
+  entityName: string,
+  entity: EntityDefinition,
+  options: {
+    readonly access?: AccessRule;
+    /** Money field names whose `currency` is filled from tenant-settings when missing. */
+    readonly currencyFields?: readonly string[];
+    /** Field name (select/text) that receives the tenant locale when missing. */
+    readonly localeField?: string;
+  },
+): WriteHandlerDef {
+  const { executor } = createEntityExecutor(entityName, entity);
+  const relax: Record<string, z.ZodTypeAny> = {};
+  for (const field of options.currencyFields ?? []) {
+    const def = entity.fields[field];
+    if (!def) throw new Error(`defineCreateWithTenantDefaults: unknown field "${field}"`);
+    const isRequired = "required" in def && def.required === true;
+    relax[field] = isRequired ? OPTIONAL_CURRENCY_MONEY : OPTIONAL_CURRENCY_MONEY.optional();
+  }
+  const baseSchema = buildInsertSchema(entity);
+  const schema = Object.keys(relax).length > 0 ? baseSchema.extend(relax) : baseSchema;
+
+  return {
+    name: `${entityName}:create`,
+    schema,
+    ...(options.access && { access: options.access }),
+    handler: async (event, ctx) => {
+      const payload = { ...(event.payload as Record<string, unknown>) };
+
+      for (const field of options.currencyFields ?? []) {
+        const value = payload[field] as { amount?: number; currency?: string } | undefined;
+        if (value && typeof value === "object" && !value.currency) {
+          const currency = await ctx.config?.(TenantSettingsConfig.currency);
+          if (typeof currency === "string") payload[field] = { ...value, currency };
+        }
+      }
+      if (options.localeField && !payload[options.localeField]) {
+        const locale = await ctx.config?.(TenantSettingsConfig.locale);
+        if (typeof locale === "string") payload[options.localeField] = locale;
+      }
+
+      return executor.create(payload, event.user, ctx.db);
+    },
+  };
+}

package/src/text-content/web/__tests__/editor-read-only.test.tsx

@@ -9,7 +9,7 @@ import {
   PrimitivesProvider,
 } from "@cosmicdrift/kumiko-renderer";
 import { defaultPrimitives } from "@cosmicdrift/kumiko-renderer-web";
-import { render, screen } from "@testing-library/react";
+import { act, fireEvent, render, screen } from "@testing-library/react";
 import type { ReactNode } from "react";
 import { textContentClient } from "../client-plugin";
 
@@ -20,18 +20,23 @@ mock.module("@cosmicdrift/kumiko-bundled-features/auth-email-password/web", () =
 const actual_renderer = await import("@cosmicdrift/kumiko-renderer");
 mock.module("@cosmicdrift/kumiko-renderer", () => ({
   ...actual_renderer,
-  useDispatcher: mock(() => ({
-    write: mock(),
-    query: mock(),
-  })),
+  useDispatcher: mock(),
   useQuery: mock(() => ({
-    data: { slug: "imprint", lang: "de", title: "Impressum", body: "Inhalt" },
+    data: {
+      slug: "imprint",
+      lang: "de",
+      title: "Impressum",
+      body: "Inhalt",
+      folder: "legal",
+    },
     loading: false,
     error: null,
     refetch: mock(),
   })),
 }));
 
+const { useDispatcher } = await import("@cosmicdrift/kumiko-renderer");
+
 const TARGET = {
   featureId: "text-content",
   action: "edit",
@@ -109,3 +114,25 @@ describe("TextContentEditor — role-based write-access", () => {
     expect(screen.queryByRole("button", { name: /^speichern/i })).toBeNull();
   });
 });
+
+describe("TextContentEditor — handleSave", () => {
+  test("reicht das geladene folder unverändert an den Write-Payload durch (#898)", async () => {
+    // biome-ignore lint/suspicious/noExplicitAny: Bun mock function
+    (useShellUser as any).mockReturnValue({ id: "u1", roles: ["TenantAdmin"] });
+    const write = mock(() => Promise.resolve({ isSuccess: true, data: { isNew: false } }));
+    // biome-ignore lint/suspicious/noExplicitAny: Bun mock function
+    (useDispatcher as any).mockReturnValue({ write, query: mock() });
+
+    const Editor = getEditor();
+    render(<Editor target={TARGET} onClose={() => {}} />, { wrapper: Wrapper });
+
+    await act(async () => {
+      fireEvent.click(screen.getByRole("button", { name: /speichern/i }));
+      await Promise.resolve();
+    });
+
+    expect(write).toHaveBeenCalledTimes(1);
+    const [, payload] = write.mock.calls[0] as unknown as [unknown, { folder: string | null }];
+    expect(payload.folder).toBe("legal");
+  });
+});

package/src/text-content/web/__tests__/group-blocks.test.ts

@@ -53,7 +53,7 @@ describe("groupBlocksByFolder", () => {
       args: { slug: "imprint", lang: "de" },
     });
     expect(root.children).toBeUndefined();
-    expect(root.icon).toBeUndefined();
+    expect(root.icon).toBe("file");
   });
   test('folder="page" → Folder-Container mit child', () => {
     const nodes = inside(
@@ -101,7 +101,7 @@ describe("groupBlocksByFolder", () => {
     );
     expect(nodes).toHaveLength(2);
     expect(nodes[0]?.label).toBe("imprint");
-    expect(nodes[0]?.icon).toBeUndefined();
+    expect(nodes[0]?.icon).toBe("file");
     expect(nodes[1]?.label).toBe("page");
     expect(nodes[1]?.icon).toBe("folder");
   });
@@ -184,12 +184,37 @@ describe("groupBlocksByFolder", () => {
     const leaf = nodes[0];
     const folder = nodes[1];
     expect(leaf?.label).toBe("Page-Root");
-    expect(leaf?.icon).toBeUndefined();
+    expect(leaf?.icon).toBe("file");
     expect(leaf?.target).toBeDefined();
     expect(folder?.label).toBe("page");
     expect(folder?.icon).toBe("folder");
     expect(folder?.target).toBeUndefined();
   });
+  test("tenantIdOverride wird in die Edit-Target-Args gereicht (SystemAdmin SYSTEM-Tenant-Content)", () => {
+    const nodes = inside(
+      groupBlocksByFolder(
+        [block({ slug: "imprint", folder: null }), block({ slug: "hero", folder: "page" })],
+        "00000000-0000-4000-8000-000000000000",
+      ),
+    );
+    // Root-Leaf trägt den Override.
+    expect(nodes[0]?.target?.args).toEqual({
+      slug: "imprint",
+      lang: "de",
+      tenantIdOverride: "00000000-0000-4000-8000-000000000000",
+    });
+    // Auch der Leaf im Folder (rekursiv durchgereicht).
+    const folderChild = childrenArray(nodes[1]?.children)[0];
+    expect(folderChild?.target?.args).toEqual({
+      slug: "hero",
+      lang: "de",
+      tenantIdOverride: "00000000-0000-4000-8000-000000000000",
+    });
+  });
+  test("ohne tenantIdOverride bleiben die Args frei davon (Default: Session-Tenant)", () => {
+    const nodes = inside(groupBlocksByFolder([block({ slug: "imprint", folder: null })]));
+    expect(nodes[0]?.target?.args).toEqual({ slug: "imprint", lang: "de" });
+  });
   test("Wrapper-Folder 'Content' umschließt alle blocks", () => {
     // V.1.5d Wrapper-Convention: groupBlocksByFolder gibt EINEN Knoten
     // zurück (den Wrapper), Inhalt liegt eine Ebene tiefer.

package/src/text-content/web/client-plugin.tsx

@@ -74,13 +74,21 @@ function newFolderNode(): FolderNode {
   return { leaves: [], subFolders: new Map() };
 }
 
-function attachBlock(root: FolderNode, block: BlockSummary): void {
+function attachBlock(root: FolderNode, block: BlockSummary, tenantIdOverride?: string): void {
   const leaf: TreeNode = {
     label: block.title || block.slug,
+    icon: "file",
     target: {
       featureId: "text-content",
       action: "edit",
-      args: { slug: block.slug, lang: block.lang },
+      // tenantIdOverride travels with the node → the editor's by-slug read +
+      // set write target the same tenant the tree was loaded from (SystemAdmin
+      // editing SYSTEM-tenant content). Omitted → session tenant.
+      args: {
+        slug: block.slug,
+        lang: block.lang,
+        ...(tenantIdOverride !== undefined && { tenantIdOverride }),
+      },
     },
     state: block.body ? "filled" : "stub",
   };
@@ -116,10 +124,13 @@ function renderFolderNode(node: FolderNode): TreeNode[] {
   return result;
 }
 
-export function groupBlocksByFolder(blocks: readonly BlockSummary[]): readonly TreeNode[] {
+export function groupBlocksByFolder(
+  blocks: readonly BlockSummary[],
+  tenantIdOverride?: string,
+): readonly TreeNode[] {
   const root = newFolderNode();
   for (const block of blocks) {
-    attachBlock(root, block);
+    attachBlock(root, block, tenantIdOverride);
   }
   const rendered = renderFolderNode(root);
   if (rendered.length === 0) return [];
@@ -133,47 +144,52 @@ export function groupBlocksByFolder(blocks: readonly BlockSummary[]): readonly T
   ];
 }
 
-const treeProvider: TreeChildrenSubscribe = () => (emit, emitError) => {
-  // CSRF-Header bei authenticated requests pflicht (auth-middleware
-  // double-submit pattern). Anonymous/Pre-Login wäre csrf-token=undefined
-  // → header weggelassen → server lässt die anonymous-Variante durch.
-  const headers: Record<string, string> = { "content-type": "application/json" };
-  const csrf = readCsrfToken();
-  if (csrf !== undefined) headers[CSRF_HEADER_NAME] = csrf;
-  fetch("/api/query", {
-    method: "POST",
-    headers,
-    body: JSON.stringify({
-      type: TextContentQueries.byTenant,
-      payload: {},
-    }),
-  })
-    .then(async (r) => {
-      if (!r.ok) {
-        // 403 (CSRF/auth) oder 5xx — explicit error statt silent empty.
-        const text = await r.text().catch(() => r.statusText);
-        throw new Error(`text-content load failed: ${r.status} ${text}`);
-      }
-      return r.json();
-    })
-    .then((data: ByTenantResponse) => {
-      // Der App-seitige r.nav-Knoten IST der "Content"-Container → die
-      // Provider-Kinder sind die Folder/Leaves darunter, nicht der Wrapper.
-      const content = groupBlocksByFolder(data.data.blocks)[0];
-      emit(content !== undefined && Array.isArray(content.children) ? content.children : []);
+// tenantIdOverride (SystemAdmin-only) lets an app point the Content tree at a
+// tenant other than the session's — publicstatus seeds marketing/legal blocks
+// on SYSTEM_TENANT_ID, so its SystemAdmin must read that tenant, not their own.
+function makeTreeProvider(tenantIdOverride?: string): TreeChildrenSubscribe {
+  return () => (emit, emitError) => {
+    // CSRF-Header bei authenticated requests pflicht (auth-middleware
+    // double-submit pattern). Anonymous/Pre-Login wäre csrf-token=undefined
+    // → header weggelassen → server lässt die anonymous-Variante durch.
+    const headers: Record<string, string> = { "content-type": "application/json" };
+    const csrf = readCsrfToken();
+    if (csrf !== undefined) headers[CSRF_HEADER_NAME] = csrf;
+    fetch("/api/query", {
+      method: "POST",
+      headers,
+      body: JSON.stringify({
+        type: TextContentQueries.byTenant,
+        payload: tenantIdOverride !== undefined ? { tenantIdOverride } : {},
+      }),
     })
-    .catch((e) => {
-      // V.1.4: explicit error-Signal via emitError. ProviderBranch zeigt
-      // Banner + Retry-Button. Fallback auf emit([]) wenn der Consumer
-      // kein emitError unterstützt (Tests etc.).
-      if (emitError) {
-        emitError(e instanceof Error ? e : new Error(String(e)));
-      } else {
-        emit([]);
-      }
-    });
-  return () => {};
-};
+      .then(async (r) => {
+        if (!r.ok) {
+          // 403 (CSRF/auth) oder 5xx — explicit error statt silent empty.
+          const text = await r.text().catch(() => r.statusText);
+          throw new Error(`text-content load failed: ${r.status} ${text}`);
+        }
+        return r.json();
+      })
+      .then((data: ByTenantResponse) => {
+        // Der App-seitige r.nav-Knoten IST der "Content"-Container → die
+        // Provider-Kinder sind die Folder/Leaves darunter, nicht der Wrapper.
+        const content = groupBlocksByFolder(data.data.blocks, tenantIdOverride)[0];
+        emit(content !== undefined && Array.isArray(content.children) ? content.children : []);
+      })
+      .catch((e) => {
+        // V.1.4: explicit error-Signal via emitError. ProviderBranch zeigt
+        // Banner + Retry-Button. Fallback auf emit([]) wenn der Consumer
+        // kein emitError unterstützt (Tests etc.).
+        if (emitError) {
+          emitError(e instanceof Error ? e : new Error(String(e)));
+        } else {
+          emit([]);
+        }
+      });
+    return () => {};
+  };
+}
 
 // V.1.3 echte Edit-Form: lädt aktuelle Werte via by-slug-query, lässt
 // TenantAdmin/SystemAdmin title + body editieren, dispatcht set-write
@@ -195,6 +211,7 @@ type TextBlock = {
   readonly lang: string;
   readonly title: string;
   readonly body: string | null;
+  readonly folder: string | null;
   readonly updatedAt: string;
 };
 
@@ -202,9 +219,11 @@ type SetResponse = { readonly slug: string; readonly lang: string; readonly isNe
 
 function TextContentEditor({
   target,
-  onClose,
 }: {
   readonly target: TargetRef;
+  // onClose bleibt Teil des Resolver-Contracts (Visual-Panel liefert es),
+  // wird aber nicht mehr gebraucht: die Tree-Auswahl navigiert, kein
+  // Schließen-Button mehr. Nicht destrukturiert → kein unused binding.
   readonly onClose: () => void;
 }): ReactNode {
   // @cast-boundary visual-tree-args — TargetRef.args ist erased zu
@@ -213,9 +232,12 @@ function TextContentEditor({
   // zu Event-Payloads. Optional-Chain absorbiert fehlende Felder ohne
   // throw, damit der Editor auch bei manuellem URL-Tampering nicht
   // crasht (TargetRef könnte aus old localStorage / URL-State stammen).
-  const args = target.args as { slug?: string; lang?: string } | undefined;
+  const args = target.args as
+    | { slug?: string; lang?: string; tenantIdOverride?: string }
+    | undefined;
   const slug = args?.slug ?? "";
   const lang = args?.lang ?? "";
+  const tenantIdOverride = args?.tenantIdOverride;
 
   const { Form, Field, Input, Button, Banner } = usePrimitives();
   const dispatcher = useDispatcher();
@@ -232,7 +254,7 @@ function TextContentEditor({
     error: loadError,
   } = useQuery<TextBlock | null>(
     TextContentQueries.bySlug,
-    { slug, lang },
+    { slug, lang, ...(tenantIdOverride !== undefined && { tenantIdOverride }) },
     { enabled: slug !== "" && lang !== "" },
   );
 
@@ -266,6 +288,8 @@ function TextContentEditor({
         lang,
         title,
         body: body.length > 0 ? body : null,
+        folder: loaded?.folder ?? null,
+        ...(tenantIdOverride !== undefined && { tenantIdOverride }),
       });
       if (result.isSuccess) {
         setSavedMsg(result.data.isNew ? "Neu angelegt." : "Gespeichert.");
@@ -290,61 +314,53 @@ function TextContentEditor({
   const disabled = submitting || loading || !canWrite;
 
   return (
-    <div className="flex h-full flex-col">
-      <header className="flex items-center justify-between border-b px-6 py-4">
-        <div>
-          <h2 className="text-lg font-semibold">Text-Block bearbeiten</h2>
-          <p className="text-xs text-muted-foreground">
-            {slug || "—"} ({lang || "—"})
-          </p>
-        </div>
-        <Button variant="secondary" onClick={onClose}>
-          schlie&szlig;en
-        </Button>
-      </header>
-      <div className="flex-1 overflow-y-auto px-6 py-6">
-        <Form onSubmit={onSubmit}>
-          {loading && <Banner variant="loading">Lädt aktuellen Stand…</Banner>}
-          {loadError !== null && (
-            <Banner variant="error">Konnte Block nicht laden: {loadError.code}</Banner>
-          )}
-          {!canWrite && !loading && (
-            <Banner variant="info">
-              Read-only — TenantAdmin- oder SystemAdmin-Rolle f&uuml;r &Auml;nderungen erforderlich.
-            </Banner>
-          )}
-          <Field id="text-content-title" label="Titel" required>
-            <Input
-              kind="text"
-              id="text-content-title"
-              name="text-content-title"
-              value={title}
-              onChange={setTitle}
-              disabled={disabled}
-              required
-            />
-          </Field>
-          <Field id="text-content-body" label="Inhalt">
-            <Input
-              kind="textarea"
-              id="text-content-body"
-              name="text-content-body"
-              value={body}
-              onChange={setBody}
-              disabled={disabled}
-              rows={14}
-            />
-          </Field>
-          {saveError !== null && <Banner variant="error">{saveError}</Banner>}
-          {savedMsg !== null && <Banner variant="info">{savedMsg}</Banner>}
-          {canWrite && (
-            <Button type="submit" loading={submitting} disabled={disabled}>
-              {submitting ? "Speichern…" : "Speichern"}
-            </Button>
-          )}
-        </Form>
-      </div>
-    </div>
+    <Form
+      onSubmit={onSubmit}
+      testId="text-content-editor"
+      title={title || slug || "—"}
+      subtitle={lang !== "" ? `${slug} · (${lang})` : slug}
+      actions={
+        canWrite ? (
+          <Button type="submit" loading={submitting} disabled={disabled}>
+            {submitting ? "Speichern…" : "Speichern"}
+          </Button>
+        ) : undefined
+      }
+    >
+      {loading && <Banner variant="loading">Lädt aktuellen Stand…</Banner>}
+      {loadError !== null && (
+        <Banner variant="error">Konnte Block nicht laden: {loadError.code}</Banner>
+      )}
+      {!canWrite && !loading && (
+        <Banner variant="info">
+          Read-only — TenantAdmin- oder SystemAdmin-Rolle f&uuml;r &Auml;nderungen erforderlich.
+        </Banner>
+      )}
+      <Field id="text-content-title" label="Titel" required>
+        <Input
+          kind="text"
+          id="text-content-title"
+          name="text-content-title"
+          value={title}
+          onChange={setTitle}
+          disabled={disabled}
+          required
+        />
+      </Field>
+      <Field id="text-content-body" label="Inhalt">
+        <Input
+          kind="textarea"
+          id="text-content-body"
+          name="text-content-body"
+          value={body}
+          onChange={setBody}
+          disabled={disabled}
+          rows={14}
+        />
+      </Field>
+      {saveError !== null && <Banner variant="error">{saveError}</Banner>}
+      {savedMsg !== null && <Banner variant="info">{savedMsg}</Banner>}
+    </Form>
   );
 }
 
@@ -353,12 +369,18 @@ function TextContentEditor({
 // Label/Icon/Access des Knotens (managed-pages-Konvention) — das Feature
 // liefert nur die Kinder + den Editor. Ohne navId: nur der Resolver, kein
 // Sidebar-Knoten (server-only-Consumer wie money-horse leaken nichts).
-export function textContentClient(opts?: { readonly navId?: string }): ClientFeatureDefinition {
+// `tenantId` (SystemAdmin-only): welchen Tenant der Content-Tree + Editor
+// bedienen — SYSTEM_TENANT_ID für Apps, die Marketing/Legal dort seeden.
+// Weglassen → Session-Tenant (Default; kein Cross-Tenant-Zugriff).
+export function textContentClient(opts?: {
+  readonly navId?: string;
+  readonly tenantId?: string;
+}): ClientFeatureDefinition {
   const navId = opts?.navId;
   return {
     name: "text-content",
     ...(navId !== undefined && {
-      navProviders: { [navId]: treeProvider },
+      navProviders: { [navId]: makeTreeProvider(opts?.tenantId) },
       // SSE-Refresh: jedes text-block-Event re-fired den Provider → Tree live.
       navEntities: { [navId]: ["text-block"] },
     }),

package/src/tier-engine/__tests__/auto-default-tier.integration.test.ts

@@ -19,7 +19,6 @@
 //   3. Idempotency: tenant-update fired keinen weiteren row
 
 import { afterAll, beforeAll, describe, expect, test } from "bun:test";
-import { composeFeatures } from "@cosmicdrift/kumiko-dev-server/compose-features";
 import { selectMany } from "@cosmicdrift/kumiko-framework/bun-db";
 import { buildEntityTable } from "@cosmicdrift/kumiko-framework/db";
 import {
@@ -28,6 +27,7 @@ import {
   type TestStack,
   unsafePushTables,
 } from "@cosmicdrift/kumiko-framework/stack";
+import { composeFeatures } from "@cosmicdrift/kumiko-server-runtime/compose-features";
 import { configValuesTable } from "../../config";
 import { TenantHandlers, tenantMembershipsTable, tenantTable } from "../../tenant";
 import { userTable } from "../../user";

package/src/tier-engine/__tests__/resolver.integration.test.ts

@@ -20,7 +20,6 @@ import { tenantSecretsTable } from "@cosmicdrift/kumiko-bundled-features/secrets
 import { tenantMembershipsTable, tenantTable } from "@cosmicdrift/kumiko-bundled-features/tenant";
 import { seedTenant } from "@cosmicdrift/kumiko-bundled-features/tenant/seeding";
 import { userTable } from "@cosmicdrift/kumiko-bundled-features/user";
-import { composeFeatures } from "@cosmicdrift/kumiko-dev-server/compose-features";
 import { asRawClient } from "@cosmicdrift/kumiko-framework/bun-db";
 import { buildEntityTable } from "@cosmicdrift/kumiko-framework/db";
 import {
@@ -36,6 +35,7 @@ import {
   type TestStack,
   unsafePushTables,
 } from "@cosmicdrift/kumiko-framework/stack";
+import { composeFeatures } from "@cosmicdrift/kumiko-server-runtime/compose-features";
 import type { TierMap } from "../compose-app";
 import { tierAssignmentEntity } from "../entity";
 import { createTierEngineFeature } from "../feature";