@cosmicdrift/kumiko-samples 0.350.0 → 0.352.0

package/packages/bundled-features/src/tier-engine/index.ts

@@ -29,6 +29,13 @@ export {
   createTierEngineFeature,
   tierEngineFeature,
 } from "./feature.js";
+export {
+  createTierOptionGate,
+  type TierOptionAvailability,
+  type TierOptionGate,
+  type TierOptionGateDeps,
+  type TierOptionSpec,
+} from "./tier-option-gate.js";
 export {
   createTierResolver,
   type TierResolver,

package/packages/bundled-features/src/tier-engine/tier-option-gate.ts

@@ -0,0 +1,148 @@
+// Tier-gated options of a select field: one spec drives the availability query the
+// renderer shows (disabled option + "from <tier>" hint) and the write-path check that
+// actually enforces it, so the two cannot drift apart.
+
+import type { EntityTableMeta, SchemaTable, TenantDb } from "@cosmicdrift/kumiko-framework/db";
+import type { WriteHandlerDef } from "@cosmicdrift/kumiko-framework/engine";
+import {
+  UnprocessableError,
+  type WriteFailure,
+  writeFailure,
+} from "@cosmicdrift/kumiko-framework/errors";
+import { isPlainObject } from "@cosmicdrift/kumiko-framework/utils";
+import {
+  type CapGuardContext,
+  type CapLimitContext,
+  readPayloadField,
+} from "../cap-counter/index.js";
+
+export type TierOptionSpec<TCaps> = {
+  readonly field: string;
+  readonly options: readonly string[];
+  readonly isOptionAllowed: (option: string, caps: TCaps) => boolean;
+  readonly code: string;
+  readonly i18nKey: string;
+  /** Lets an update that resends the unchanged stored value of a no longer allowed
+   *  option pass (edit forms submit the whole row). Without it the stored value is not looked up. */
+  readonly table?: SchemaTable | EntityTableMeta;
+};
+
+export type TierOptionAvailability = {
+  readonly value: string;
+  readonly disabled: boolean;
+  readonly hint?: string;
+};
+
+export type TierOptionGateDeps<TTier extends string, TCaps> = {
+  /** Ascending: the first tier that allows an option is the one named as required. */
+  readonly tierOrder: readonly TTier[];
+  readonly capsForTier: (tier: TTier, context: CapLimitContext) => TCaps | Promise<TCaps>;
+  readonly resolveTier: (db: TenantDb) => Promise<TTier>;
+};
+
+export type TierOptionGate<TTier extends string, TCaps> = {
+  readonly optionAvailability: (
+    db: TenantDb,
+    context: CapLimitContext,
+    spec: Pick<TierOptionSpec<TCaps>, "options" | "isOptionAllowed">,
+    hintFor: (requiredTier: TTier) => string,
+  ) => Promise<readonly TierOptionAvailability[]>;
+  /** `recordId` is the id of the edited row; with `spec.table` it enables the unchanged-value pass. */
+  readonly checkTierOption: (
+    ctx: CapGuardContext,
+    value: unknown,
+    spec: TierOptionSpec<TCaps>,
+    recordId?: string,
+  ) => Promise<WriteFailure | null>;
+  readonly withTierOptionGate: (
+    handler: WriteHandlerDef,
+    spec: TierOptionSpec<TCaps>,
+  ) => WriteHandlerDef;
+};
+
+function limitContextOf(ctx: CapGuardContext): CapLimitContext {
+  return ctx.config ? { config: ctx.config } : {};
+}
+
+function recordIdOf(payload: unknown): string | undefined {
+  return isPlainObject(payload) && typeof payload["id"] === "string" ? payload["id"] : undefined;
+}
+
+export function createTierOptionGate<TTier extends string, TCaps>(
+  deps: TierOptionGateDeps<TTier, TCaps>,
+): TierOptionGate<TTier, TCaps> {
+  async function capsPerTier(
+    context: CapLimitContext,
+  ): Promise<readonly { readonly tier: TTier; readonly caps: TCaps }[]> {
+    return Promise.all(
+      deps.tierOrder.map(async (tier) => ({ tier, caps: await deps.capsForTier(tier, context) })),
+    );
+  }
+
+  async function optionAvailability(
+    db: TenantDb,
+    context: CapLimitContext,
+    spec: Pick<TierOptionSpec<TCaps>, "options" | "isOptionAllowed">,
+    hintFor: (requiredTier: TTier) => string,
+  ): Promise<readonly TierOptionAvailability[]> {
+    const currentCaps = await deps.capsForTier(await deps.resolveTier(db), context);
+    const tiers = await capsPerTier(context);
+    return spec.options.map((value) => {
+      if (spec.isOptionAllowed(value, currentCaps)) return { value, disabled: false };
+      const required = tiers.find(({ caps }) => spec.isOptionAllowed(value, caps));
+      return required === undefined
+        ? { value, disabled: true }
+        : { value, disabled: true, hint: hintFor(required.tier) };
+    });
+  }
+
+  async function storedValueMatches(
+    ctx: CapGuardContext,
+    spec: TierOptionSpec<TCaps>,
+    value: string,
+    recordId: string | undefined,
+  ): Promise<boolean> {
+    if (spec.table === undefined || recordId === undefined) return false;
+    const stored = await ctx.db.fetchOne<Record<string, unknown>>(spec.table, { id: recordId });
+    return stored?.[spec.field] === value;
+  }
+
+  async function checkTierOption(
+    ctx: CapGuardContext,
+    value: unknown,
+    spec: TierOptionSpec<TCaps>,
+    recordId?: string,
+  ): Promise<WriteFailure | null> {
+    // skip: an absent or non-string value is the schema's business, not a tier violation.
+    if (typeof value !== "string") return null;
+    const context = limitContextOf(ctx);
+    const currentCaps = await deps.capsForTier(await deps.resolveTier(ctx.db), context);
+    if (spec.isOptionAllowed(value, currentCaps)) return null;
+    if (await storedValueMatches(ctx, spec, value, recordId)) return null;
+    const required = (await capsPerTier(context)).find(({ caps }) =>
+      spec.isOptionAllowed(value, caps),
+    );
+    return writeFailure(
+      new UnprocessableError(spec.code, {
+        i18nKey: spec.i18nKey,
+        details: { field: spec.field, value, requiredTier: required?.tier },
+      }),
+    );
+  }
+
+  function withTierOptionGate(
+    handler: WriteHandlerDef,
+    spec: TierOptionSpec<TCaps>,
+  ): WriteHandlerDef {
+    return {
+      ...handler,
+      handler: async (event, ctx) => {
+        const value = readPayloadField(event.payload, spec.field);
+        const failure = await checkTierOption(ctx, value, spec, recordIdOf(event.payload));
+        return failure ?? handler.handler(event, ctx);
+      },
+    };
+  }
+
+  return { optionAvailability, checkTierOption, withTierOptionGate };
+}

package/packages/bundled-features/src/user-data-rights/db/queries/export-jobs.ts

@@ -1,7 +1,7 @@
 import { selectMany } from "@cosmicdrift/kumiko-framework/bun-db";
 import type { DbConnection } from "@cosmicdrift/kumiko-framework/db";
 import type { TenantId } from "@cosmicdrift/kumiko-framework/engine";
-import type { Temporal } from "temporal-polyfill";
+import type { Temporal } from "@cosmicdrift/kumiko-types/temporal";
 import { exportJobsTable } from "../../schema/export-job.js";
 
 export type ExportJobCleanupCandidate = {

package/packages/bundled-features/src/user-data-rights/db/queries/forget-cleanup.ts

@@ -1,22 +1,16 @@
 import { selectMany } from "@cosmicdrift/kumiko-framework/bun-db";
 import type { DbConnection } from "@cosmicdrift/kumiko-framework/db";
-// Value-only import, aliased to avoid shadowing the ambient global
-// `Temporal` TYPE that gracePeriodEndCutoff's parameter type resolves
-// against (same #1438 dual-package-hazard pattern as event-store.ts).
-import { Temporal as TemporalPolyfill } from "temporal-polyfill";
+import { Temporal } from "@cosmicdrift/kumiko-types/temporal";
 import { userTable } from "../../../user/index.js";
 
 export async function selectUsersDueForForgetCleanup(
   db: DbConnection,
   status: string,
-  gracePeriodEndCutoff: InstanceType<typeof TemporalPolyfill.Instant> | string,
+  gracePeriodEndCutoff: Temporal.Instant | string,
 ): Promise<readonly { id: string }[]> {
-  // @cast-boundary temporal-polyfill-vs-ambient: same TC39 Temporal.Instant
-  // at runtime, distinct nominal types across the two .d.ts sources (see
-  // event-store.ts). Only ever consumed via the `lte` comparison below.
   const cutoff =
     typeof gracePeriodEndCutoff === "string"
-      ? TemporalPolyfill.Instant.from(gracePeriodEndCutoff)
+      ? Temporal.Instant.from(gracePeriodEndCutoff)
       : gracePeriodEndCutoff;
   return selectMany<{ id: string }>(db, userTable, {
     status,

package/packages/bundled-features/src/user-data-rights/deletion-token.ts

@@ -7,7 +7,7 @@
 // The purpose string and the anchoring are unchanged from the hand-rolled
 // version this replaced, so tokens stay byte-compatible.
 
-import type { Temporal } from "temporal-polyfill";
+import type { Temporal } from "@cosmicdrift/kumiko-types/temporal";
 import {
   type RowBoundGrantResult,
   redeemRowBoundGrant,

package/packages/bundled-features/src/user-data-rights/email-templates.ts

@@ -5,7 +5,7 @@
 
 import { mailT, registerMailTranslations } from "@cosmicdrift/kumiko-framework/i18n";
 import { escapeHtml, escapeHtmlAttr } from "@cosmicdrift/kumiko-headless";
-import { Temporal } from "temporal-polyfill";
+import { Temporal } from "@cosmicdrift/kumiko-types/temporal";
 
 export type GdprMailLocale = string;
 

package/packages/bundled-features/src/user-data-rights/handlers/list-download-attempts.query.ts

@@ -1,6 +1,6 @@
 import { selectMany, type WhereObject } from "@cosmicdrift/kumiko-framework/bun-db";
 import { defineQueryHandler } from "@cosmicdrift/kumiko-framework/engine";
-import { Temporal } from "temporal-polyfill";
+import { Temporal } from "@cosmicdrift/kumiko-types/temporal";
 import * as z from "zod";
 import { downloadAttemptsTable } from "../schema/download-attempt.js";
 

package/packages/bundled-features/src/user-data-rights/handlers/my-audit-log.query.ts

@@ -1,7 +1,7 @@
 import { selectMany, type WhereObject } from "@cosmicdrift/kumiko-framework/bun-db";
 import { defineQueryHandler } from "@cosmicdrift/kumiko-framework/engine";
 import { eventsTable } from "@cosmicdrift/kumiko-framework/event-store";
-import { Temporal } from "temporal-polyfill";
+import { Temporal } from "@cosmicdrift/kumiko-types/temporal";
 import * as z from "zod";
 
 // DSGVO Art. 15 Selbstauskunft — User reads HIS OWN audit-log.

package/packages/bundled-features/src/user-data-rights-defaults/hooks/delivery-attempt.userdata-hook.ts

@@ -1,5 +1,12 @@
 import type { UserDataDeleteHook, UserDataExportHook } from "@cosmicdrift/kumiko-framework/engine";
-import { deliveryAttemptsTable } from "../../delivery/index.js";
+import {
+  appendEventInTenantDb,
+  getStreamVersionInTenantDb,
+} from "@cosmicdrift/kumiko-framework/event-store";
+import {
+  DELIVERY_ATTEMPT_ADDRESS_ERASED_EVENT,
+  deliveryAttemptsTable,
+} from "../../delivery/index.js";
 import { featureMounted } from "./feature-mounted.js";
 
 // userData-Hooks for delivery's attempt log (deferred from #797, closed by
@@ -28,9 +35,32 @@ export const deliveryAttemptExportHook: UserDataExportHook = async (ctx) => {
   };
 };
 
-export const deliveryAttemptDeleteHook: UserDataDeleteHook = async () => {
-  // Deliberate no-op: erasure runs via crypto-shredding — the forget pipeline
-  // erases the recipient's DEK, which makes recipientAddress unreadable in
-  // BOTH the append-only events and the projected rows (#799). A read-side
-  // UPDATE here would be wiped on the next projection rebuild anyway.
+// Both strategies erase the address. The DEK shredding of a forget covers KMS deployments; the
+// erase event also covers plaintext mode, and unlike a read-side UPDATE it survives a projection
+// rebuild. Rows without an address are skipped, which makes a second run a no-op.
+export const deliveryAttemptDeleteHook: UserDataDeleteHook = async (ctx) => {
+  // skip: delivery not mounted — its table doesn't exist, nothing to erase.
+  if (!featureMounted(ctx, "delivery")) return;
+  const rows = await ctx.db.selectMany<{ id: string; recipientAddress: string | null }>(
+    deliveryAttemptsTable,
+    {
+      tenantId: ctx.tenantId,
+      recipientId: ctx.userId,
+    },
+  );
+  for (const row of rows) {
+    if (row.recipientAddress === null) continue;
+    await appendEventInTenantDb(
+      ctx.db,
+      {
+        aggregateType: "deliveryAttempt",
+        aggregateId: row.id,
+        expectedVersion: await getStreamVersionInTenantDb(ctx.db, row.id),
+        type: DELIVERY_ATTEMPT_ADDRESS_ERASED_EVENT,
+        payload: {},
+        metadata: { userId: "system" },
+      },
+      { registry: ctx.registry },
+    );
+  }
 };

package/packages/bundled-features/src/waitlist/handlers/invite.write.ts

@@ -13,7 +13,7 @@ import {
   type WriteFailure,
   writeFailure,
 } from "@cosmicdrift/kumiko-framework/errors";
-import { Temporal } from "temporal-polyfill";
+import { Temporal } from "@cosmicdrift/kumiko-types/temporal";
 import { AuthErrors, AuthHandlers } from "../../auth-email-password/index.js";
 import { TenantHandlers, tenantTable } from "../../tenant/index.js";
 import { DEFAULT_OWN_TENANT_INVITE_ROLE, WAITLIST_STATUS, WaitlistErrors } from "../constants.js";

package/packages/bundled-features/src/waitlist/handlers/submit.write.ts

@@ -6,7 +6,7 @@ import {
   type WriteResult,
 } from "@cosmicdrift/kumiko-framework/engine";
 import { InternalError } from "@cosmicdrift/kumiko-framework/errors";
-import { Temporal } from "temporal-polyfill";
+import { Temporal } from "@cosmicdrift/kumiko-types/temporal";
 import { WAITLIST_NOTIFICATION_TYPES, WAITLIST_STATUS } from "../constants.js";
 import { normalizeEmail, platformActor, waitlistDb, waitlistExecutor } from "../lib.js";
 import {

package/samples/apps/marketing-demo/package.json

@@ -15,6 +15,7 @@
     "@cosmicdrift/kumiko-framework": "workspace:*",
     "@cosmicdrift/kumiko-headless": "workspace:*",
     "@cosmicdrift/kumiko-renderer-web": "workspace:*",
+    "@cosmicdrift/kumiko-types": "workspace:*",
     "react": "^19.2.6",
     "react-dom": "^19.2.6",
     "@cosmicdrift/kumiko-locale-de": "workspace:*"

package/samples/apps/marketing-demo/src/app/seed-data.ts

@@ -306,7 +306,7 @@ export const ASSET_TEMPLATES: ReadonlyArray<AssetTemplate> = [
 // treffen ohne Sonderfall. Wird nur für status==="lent" konsultiert.
 export const OWNERS: ReadonlyArray<string> = [
   "",
-  "Marc Frost",
+  "Alex Morgan",
   "Anna Weber",
   "Lars Bergmann",
   "Sina Klein",
@@ -435,7 +435,7 @@ export const REPORTERS: ReadonlyArray<string> = [
 // unzugewiesen damit die Liste nicht zu uniform aussieht.
 export const ASSIGNEES: ReadonlyArray<string> = [
   "",
-  "Marc Frost",
+  "Alex Morgan",
   "IT-Team",
   "Sysadmin",
   "Helpdesk-L1",

package/samples/apps/marketing-demo/src/app/seed.ts

@@ -10,7 +10,7 @@
 
 import type { SeedFn } from "@cosmicdrift/kumiko-dev-server";
 import { TestUsers } from "@cosmicdrift/kumiko-framework/stack";
-import { Temporal } from "temporal-polyfill";
+import { Temporal } from "@cosmicdrift/kumiko-types/temporal";
 import { countAssetsForTenant, countTicketsForTenant } from "../db/queries/seed-counts";
 import { ASSET_STATUSES } from "../features/assets/schema";
 import { TICKET_SEVERITIES, TICKET_STATUSES } from "../features/helpdesk/schema";

package/samples/apps/styleguide/src/app/shell.tsx

@@ -58,7 +58,7 @@ export function AppShell({
           ],
         ])
       }
-      sidebarFooter={<SidebarUser name="Marc Frost" email="marc@cosmicdrift.dev" />}
+      sidebarFooter={<SidebarUser name="Alex Morgan" email="alex@example.com" />}
     >
       {activeTarget !== undefined ? <EditorPanel resolvers={resolvers} /> : children}
     </DefaultAppShell>

package/samples/apps/styleguide/src/features/gallery/web/Gallery.tsx

@@ -606,20 +606,26 @@ export function Gallery(): ReactNode {
           <div className="flex flex-col gap-5 px-6 py-6">
             <div className="flex items-center gap-4">
               <div className="bg-muted text-foreground flex size-16 items-center justify-center rounded-full text-lg font-semibold">
-                MF
+                AM
               </div>
               <Button variant="secondary">Change avatar</Button>
             </div>
             <div className="grid gap-4 sm:grid-cols-2">
               <Field id="pf-name" label="Full name">
-                <Input kind="text" id="pf-name" name="pf-name" value="Marc Frost" onChange={noop} />
+                <Input
+                  kind="text"
+                  id="pf-name"
+                  name="pf-name"
+                  value="Alex Morgan"
+                  onChange={noop}
+                />
               </Field>
               <Field id="pf-email" label="Email">
                 <Input
                   kind="text"
                   id="pf-email"
                   name="pf-email"
-                  value="marc@cosmicdrift.dev"
+                  value="alex@example.com"
                   onChange={noop}
                 />
               </Field>

package/samples/apps/ui-walkthrough/src/app/assistant-action.tsx

@@ -1,4 +1,4 @@
-import { usePrimitives } from "@cosmicdrift/kumiko-renderer";
+import { usePrimitives, useTranslation } from "@cosmicdrift/kumiko-renderer";
 import { WandSparkles } from "lucide-react";
 import { type ReactNode, useEffect, useState } from "react";
 
@@ -6,6 +6,7 @@ const noop = (): void => {};
 
 export function AssistantAction(): ReactNode {
   const { Dialog } = usePrimitives();
+  const t = useTranslation();
   const [open, setOpen] = useState(false);
 
   // Registered here on purpose: an overflow menu that unmounts this component
@@ -30,7 +31,7 @@ export function AssistantAction(): ReactNode {
         className="inline-flex h-9 items-center gap-2 rounded-md border border-border bg-card px-3 text-sm font-medium text-foreground hover:bg-accent"
       >
         <WandSparkles className="h-4 w-4" aria-hidden="true" />
-        Assistent
+        {t("tasks.assistant.label")}
         <kbd className="rounded border border-border px-1 font-sans text-xs text-muted-foreground">
           ⌘K
         </kbd>
@@ -38,9 +39,9 @@ export function AssistantAction(): ReactNode {
       <Dialog
         open={open}
         onOpenChange={setOpen}
-        title="Assistent"
-        description="Der Assistent ist im Walkthrough nicht angebunden."
-        confirmLabel="Schließen"
+        title={t("tasks.assistant.label")}
+        description={t("tasks.assistant.description")}
+        confirmLabel={t("tasks.assistant.close")}
         onConfirm={noop}
         testId="assistant-dialog"
       />

package/samples/apps/ui-walkthrough/src/app/shell.tsx

@@ -13,6 +13,7 @@ import {
   SidebarBrand,
   ThemeMenuItem,
   ThemeToggle,
+  useTranslation,
 } from "@cosmicdrift/kumiko-renderer-web";
 import { MoonStar, Sun } from "lucide-react";
 import type { ReactNode } from "react";
@@ -20,7 +21,6 @@ import { AssistantAction } from "./assistant-action";
 import { BETA_TENANT_ID, DEV_TENANT_ID } from "./auth-constants";
 
 const APP_NAME = "Kumiko Walkthrough";
-const APP_TAGLINE = "Design-Referenz";
 
 const tenantName = (tenantId: string): string => {
   if (tenantId === DEV_TENANT_ID) return "Dev Tenant";
@@ -40,9 +40,10 @@ export function AppShell({
   readonly children: ReactNode;
   readonly schema: AppSchema;
 }): ReactNode {
+  const t = useTranslation();
   return (
     <DefaultAppShell
-      brand={<SidebarBrand name={APP_NAME} plan={APP_TAGLINE} />}
+      brand={<SidebarBrand name={APP_NAME} plan={t("tasks.shell.tagline")} />}
       schema={schema}
       headerActions={
         <>

package/samples/apps/ui-walkthrough/src/features/tasks/i18n.ts

@@ -5,6 +5,10 @@ import type { TranslationsByLocale } from "@cosmicdrift/kumiko-renderer";
 
 export const tasksTranslations: TranslationsByLocale = {
   de: {
+    "tasks.shell.tagline": "Design-Referenz",
+    "tasks.assistant.label": "Assistent",
+    "tasks.assistant.description": "Der Assistent ist im Walkthrough nicht angebunden.",
+    "tasks.assistant.close": "Schließen",
     "tasks.nav.group": "Allgemein",
     "tasks.nav.list": "Aufgaben",
     "tasks.nav.new": "Neue Aufgabe",
@@ -21,6 +25,10 @@ export const tasksTranslations: TranslationsByLocale = {
     "tasks:entity:task:field:notes": "Notizen",
   },
   en: {
+    "tasks.shell.tagline": "Design reference",
+    "tasks.assistant.label": "Assistant",
+    "tasks.assistant.description": "The assistant is not connected in the walkthrough.",
+    "tasks.assistant.close": "Close",
     "tasks.nav.group": "General",
     "tasks.nav.list": "Tasks",
     "tasks.nav.new": "New task",

package/samples/apps/use-all-bundled/package.json

@@ -22,6 +22,7 @@
     "@cosmicdrift/kumiko-headless": "workspace:*",
     "@cosmicdrift/kumiko-renderer-web": "workspace:*",
     "@cosmicdrift/kumiko-server-runtime": "workspace:*",
+    "@cosmicdrift/kumiko-types": "workspace:*",
     "react": "^19.2.6",
     "react-dom": "^19.2.6",
     "zod": "^4.4.3",

package/samples/apps/use-all-bundled/src/app/seed.ts

@@ -34,7 +34,7 @@ import {
 } from "@cosmicdrift/kumiko-framework/engine";
 import { TestUsers, unsafeCreateEntityTable } from "@cosmicdrift/kumiko-framework/stack";
 import { generateId } from "@cosmicdrift/kumiko-framework/utils";
-import { Temporal } from "temporal-polyfill";
+import { Temporal } from "@cosmicdrift/kumiko-types/temporal";
 import { ADMIN_EMAIL, BETA_TENANT_ID, DEMO_NOTE_ID, DEV_TENANT_ID } from "./auth-constants";
 import { noteEntity } from "./notes-feature";
 

package/samples/recipes/files-post-processing/package.json

@@ -7,6 +7,6 @@
     "@cosmicdrift/kumiko-framework": "workspace:*"
   },
   "devDependencies": {
-    "sharp": "^0.35.3"
+    "sharp": "^0.35.5"
   }
 }

package/samples/recipes/seed-migration/README.md

@@ -5,7 +5,7 @@ File-based migrations for Event-Sourcing operations — like `kumiko schema appl
 ## What it shows
 
 - **`seedsDir`-Option** in `runProdApp({ seedsDir: "./seeds" })` — beim Boot werden pending Files in chronologischer Reihenfolge angewendet und in `kumiko_es_operations` markiert.
-- **`SeedMigration`-Interface** — default-Export einer seed-File mit `description` + `run(ctx)`. ctx liefert `systemWriteAs` (System-User bypassed Access-Check) + Read-Helpers (`findUserByEmail`, `findMembershipsOfUser`, `findTenants`).
+- **`SeedMigration`-Interface** — default-Export einer seed-File mit `description` + `run(ctx)`. ctx liefert `systemWriteAs` (System-User bypassed Access-Check) + Read-Helpers (`findUserByEmail`, `findMembershipsOfUser`, `findTenants`, `findTemplateResources`).
 - **Idempotency** — Marker landet nach Erfolg in der Tracking-Tabelle, zweiter Boot skipped applied Seeds.
 - **Tx-Atomicity** — Jede Migration läuft in eigener Transaction; Failure rollt zurück + bricht Boot ab (kein Partial-Apply).
 - **Chronologische File-IDs** — Filename `<date>-<slug>.ts` (z.B. `2026-05-20-fix-admin-roles.ts`) ist die ID.
@@ -35,6 +35,18 @@ seed: 2026-05-20-fix-admin-roles.ts
 
 Bei typo / drift fail-t mit klarer message + exit-code 1 — CI nutzt es als prä-build-step. App-Author muss in `smoke.ts` den `features`-Array gegen die eigene App-Feature-Set tauschen (siehe TODO im File).
 
+### Archive template rows
+
+`findTemplateResources({ slug?, kind?, status?, locale?, tenantId? })` replaces a raw `SELECT … FROM read_template_resources`. It defaults to the system tenant and returns `[]` when template-resolver is not mounted:
+
+```ts
+for (const t of await ctx.findTemplateResources({ kind: "notification", status: "active" })) {
+  await ctx.systemWriteAs("template-resolver:write:archive", { id: t.id }, SYSTEM_TENANT_ID, [
+    "SystemAdmin",
+  ]);
+}
+```
+
 ## When to reach for it
 
 Du hast einen idempotent-Seeder der bei initialer Erstellung „Insert wenn nicht existiert" macht (z.B. `auth.admin.memberships`), und dann ändern sich die Soll-Daten — neue Rolle, anderer Tier, korrigierte Bezeichnung. Idempotent-Seeder skippen die existing Rows → DB driftet vom Code-Stand ab.