@cosmicdrift/kumiko-samples 0.377.0 → 0.379.0

package/packages/bundled-features/src/template-resolver/index.ts

@@ -1,3 +1,4 @@
+export { isResourceImageContentType } from "../shared/index.ts";
 export {
   createTemplateResolverApi,
   type ResolveRequest,
@@ -8,40 +9,11 @@ export {
 } from "./api.ts";
 export {
   type CompileDocumentBodyOptions,
+  collectDocumentImageVariables,
   collectDocumentResourceKeys,
   compileDocumentBodyToHandlebars,
   toResourceDataUri,
 } from "./compile-document-body.ts";
-export {
-  CONTENT_FORMATS,
-  type ContentFormat,
-  DEFAULT_MAIL_LAYOUT_SLUG,
-  DEFAULT_PDF_LAYOUT_SLUG,
-  DOCUMENT_HTML_KINDS,
-  type DocumentHtmlKind,
-  FALLBACK_LOCALE,
-  NON_RENDER_KINDS,
-  type NonRenderKind,
-  PDF_DEFAULT_MARGIN_MM,
-  PDF_FOOTER_MARGIN_MM,
-  PDF_HEADER_MARGIN_MM,
-  PDF_ORIENTATIONS,
-  PDF_PAGE_FORMATS,
-  type PdfOrientation,
-  type PdfPageFormat,
-  RENDER_KINDS,
-  type RenderKind,
-  SYSTEM_TENANT_ID,
-  TEMPLATE_KINDS,
-  TEMPLATE_SCOPES,
-  TEMPLATE_STATUSES,
-  TEXT_BLOCK_KIND,
-  type TemplateKind,
-  type TemplateScope,
-  type TemplateStatus,
-  UPSERT_KINDS,
-  type UpsertKind,
-} from "./constants.ts";
 export {
   type DocumentViolation,
   type DocumentViolationCode,
@@ -52,30 +24,7 @@ export {
   sanitizeDocumentHtml,
   sanitizeTemplateBody,
 } from "./document-sanitizer.ts";
-export {
-  DOCUMENT_CONDITION_ATTRIBUTE,
-  DOCUMENT_NODE_NAMES,
-  DOCUMENT_TEXT_ALIGNMENTS,
-  DocumentButton,
-  DocumentCondition,
-  DocumentDivider,
-  DocumentLink,
-  DocumentPageBreak,
-  DocumentResource,
-  DocumentTable,
-  DocumentTableCell,
-  DocumentTableHeader,
-  DocumentTableRow,
-  DocumentTextAlign,
-  type DocumentTextAlignment,
-  DocumentVariable,
-  documentExtensions,
-  isAllowedDocumentLinkHref,
-  isDocumentPlaceholderHref,
-  isDocumentReferenceName,
-  isDocumentResourceKey,
-} from "./document-schema.ts";
-export { createTemplateResolverFeature } from "./feature.ts";
+export { createTemplateResolverFeature, type TemplateResolverOptions } from "./feature.ts";
 export type { LayoutSourceResponse, LayoutSourceRow } from "./handlers/layout-source.query.ts";
 export type {
   OverviewKindGroup,
@@ -106,12 +55,6 @@ export {
   templatePdfAttachmentLinkSchema,
 } from "./linked-resources.ts";
 export { prepareDocumentForPrint } from "./print-document.ts";
-export {
-  TEMPLATE_RESOLVER_FEATURE,
-  TemplateResolverErrors,
-  TemplateResolverHandlers,
-  TemplateResolverQueries,
-} from "./qualified-names.ts";
 export { mapRecordToVariables } from "./record-mapping.ts";
 export {
   type PreparedTemplateImage,
@@ -126,6 +69,12 @@ export {
   templateResourcesTable,
 } from "./table.ts";
 export { type TemplateBundle, templateBundleSchema } from "./template-bundle.ts";
+export type { TemplateDeliveryPolicy } from "./template-delivery-policy.ts";
+export {
+  type TemplateEditPolicy,
+  type TenantEditableTemplate,
+  templateEditAccess,
+} from "./template-edit-policy.ts";
 export {
   isMailTemplateMeta,
   type LayoutTemplateMeta,
@@ -162,3 +111,62 @@ export {
   userContentEntriesTable,
   userContentEntryEntity,
 } from "./user-content-table.ts";
+export {
+  CONTENT_FORMATS,
+  type ContentFormat,
+  DEFAULT_MAIL_LAYOUT_SLUG,
+  DEFAULT_PDF_LAYOUT_SLUG,
+  DOCUMENT_HTML_KINDS,
+  type DocumentHtmlKind,
+  FALLBACK_LOCALE,
+  NON_RENDER_KINDS,
+  type NonRenderKind,
+  PDF_DEFAULT_MARGIN_MM,
+  PDF_FOOTER_MARGIN_MM,
+  PDF_HEADER_MARGIN_MM,
+  PDF_ORIENTATIONS,
+  PDF_PAGE_FORMATS,
+  type PdfOrientation,
+  type PdfPageFormat,
+  RENDER_KINDS,
+  type RenderKind,
+  SYSTEM_TENANT_ID,
+  TEMPLATE_KINDS,
+  TEMPLATE_SCOPES,
+  TEMPLATE_STATUSES,
+  TEXT_BLOCK_KIND,
+  type TemplateKind,
+  type TemplateScope,
+  type TemplateStatus,
+  UPSERT_KINDS,
+  type UpsertKind,
+} from "./web/constants.ts";
+export {
+  DOCUMENT_CONDITION_ATTRIBUTE,
+  DOCUMENT_NODE_NAMES,
+  DOCUMENT_TEXT_ALIGNMENTS,
+  DocumentButton,
+  DocumentCondition,
+  DocumentDivider,
+  DocumentLink,
+  DocumentPageBreak,
+  DocumentResource,
+  DocumentTable,
+  DocumentTableCell,
+  DocumentTableHeader,
+  DocumentTableRow,
+  DocumentTextAlign,
+  type DocumentTextAlignment,
+  DocumentVariable,
+  documentExtensions,
+  isAllowedDocumentLinkHref,
+  isDocumentPlaceholderHref,
+  isDocumentReferenceName,
+  isDocumentResourceKey,
+} from "./web/document-schema.ts";
+export {
+  TEMPLATE_RESOLVER_FEATURE,
+  TemplateResolverErrors,
+  TemplateResolverHandlers,
+  TemplateResolverQueries,
+} from "./web/qualified-names.ts";

package/packages/bundled-features/src/template-resolver/layout-appearance.ts

@@ -1,5 +1,5 @@
-import { HEX_COLOR_PATTERN } from "./constants.ts";
 import { type MailLayoutMeta, readMailLayoutMeta } from "./template-meta.ts";
+import { HEX_COLOR_PATTERN } from "./web/constants.ts";
 
 // Every value is a member of a closed set, so it can be written into MJML and inline styles as is.
 export type MailLayoutAppearance = {

package/packages/bundled-features/src/template-resolver/layout-regions.ts

@@ -4,7 +4,6 @@
 // the renderer did not plan for.
 
 import type { Element as ScanElement } from "happy-dom";
-import type { ContentFormat } from "./constants.ts";
 import {
   type DocumentViolation,
   type SanitizeBodyResult,
@@ -13,6 +12,7 @@ import {
   violation,
   withParsedDocument,
 } from "./document-sanitizer.ts";
+import type { ContentFormat } from "./web/constants.ts";
 
 const REGION_ATTRIBUTES = ["data-header", "data-content", "data-signature", "data-footer"] as const;
 type RegionAttribute = (typeof REGION_ATTRIBUTES)[number];

package/packages/bundled-features/src/template-resolver/seeding.ts

@@ -12,8 +12,6 @@
 import {
   createTenantDb,
   type DbConnection,
-  deleteMany,
-  type EntityTableMeta,
   fetchOne,
   type TenantDb,
 } from "@cosmicdrift/kumiko-framework/db";
@@ -25,21 +23,22 @@ import {
   type TenantId,
 } from "@cosmicdrift/kumiko-framework/engine";
 import {
+  deleteRowsWithoutReplayableStream,
   getStreamVersion,
   getUnscopedStreamMaxVersionForSeed,
 } from "@cosmicdrift/kumiko-framework/event-store";
 import type { Dispatcher } from "@cosmicdrift/kumiko-framework/pipeline";
 import { runEventStoreSeed, type SeedIfExists } from "@cosmicdrift/kumiko-framework/seeding";
 import { isPlainObject } from "@cosmicdrift/kumiko-types/type-guards";
-import { type ContentFormat, TEXT_BLOCK_KIND, type UpsertKind } from "./constants.ts";
 import { executor } from "./handlers/shared.ts";
 import { evaluateTemplateWrite } from "./handlers/template-gates.ts";
-import { TEMPLATE_RESOLVER_FEATURE, TemplateResolverHandlers } from "./qualified-names.ts";
 import { type TemplateResourceRow, templateResourcesTable } from "./table.ts";
 import type { TemplateBundle } from "./template-bundle.ts";
 import { activeStampChanges, servedStampChanges } from "./template-draft.ts";
 import { templateSlugSchema } from "./template-meta.ts";
 import { variablesFromSchema } from "./template-validation.ts";
+import { type ContentFormat, TEXT_BLOCK_KIND, type UpsertKind } from "./web/constants.ts";
+import { TEMPLATE_RESOLVER_FEATURE, TemplateResolverHandlers } from "./web/qualified-names.ts";
 
 /** Drop projection orphans (no events anywhere) so boot seeds can recreate. */
 async function resolveExistingForEventStoreSeed(
@@ -60,8 +59,7 @@ async function resolveExistingForEventStoreSeed(
         `seed orphan check: projection ${id} has no events for tenant ${tenantId} but unscoped stream version is ${unscoped} — refusing delete/recreate to avoid wiping a live stream`,
       );
     }
-    // The cast strips the executor-only brand that WritableTable rejects; the orphan row has no events, so no executor verb applies.
-    await deleteMany(tdb, templateResourcesTable as EntityTableMeta, { id, tenantId });
+    await deleteRowsWithoutReplayableStream(tdb, { table: templateResourcesTable, ids: [id] });
     return null;
   }
   return { id, version: streamVersion };
@@ -79,11 +77,21 @@ export type SeedSystemTemplateOptions = {
   readonly linkedResources?: Record<string, string>;
   readonly meta?: unknown;
   readonly title?: string;
+  /** Translatable title for the overview and designer, stored in the title column; the client
+   *  shows the translation and falls back to the key. Mutually exclusive with `title`. */
+  readonly titleI18nKey?: string;
   readonly parentTemplateId?: string | null;
   readonly by?: SessionUser;
   readonly ifExists?: SeedIfExists;
 };
 
+function seedTitleColumn(opts: SeedSystemTemplateOptions, label: string): string | null {
+  if (opts.title !== undefined && opts.titleI18nKey !== undefined) {
+    throw new Error(`${label} rejected: set either title or titleI18nKey, not both`);
+  }
+  return opts.titleI18nKey ?? opts.title ?? null;
+}
+
 export async function seedSystemTemplate(
   db: DbConnection,
   opts: SeedSystemTemplateOptions,
@@ -95,6 +103,7 @@ export async function seedSystemTemplate(
   const label = `seedSystemTemplate ${opts.slug}/${opts.kind}/${opts.locale}`;
   const slug = templateSlugSchema.safeParse(opts.slug);
   if (!slug.success) throw new Error(`${label} rejected: ${slug.error.issues[0]?.message}`);
+  const title = seedTitleColumn(opts, label);
   const evaluated = evaluateTemplateWrite({
     kind: opts.kind,
     scope: "system",
@@ -139,7 +148,7 @@ export async function seedSystemTemplate(
     variableSchema,
     ...(linkedResources !== undefined && { linkedResources }),
     meta,
-    title: opts.title ?? null,
+    title,
     folder: null,
     scope: "system" as const,
     parentTemplateId,

package/packages/bundled-features/src/template-resolver/store-template-resource.ts

@@ -21,7 +21,6 @@ import {
 } from "@cosmicdrift/kumiko-framework/files";
 import { fileContextForTenant } from "../file-foundation/index.ts";
 import { extensionForResourceContentType, requireForTenant } from "../shared/index.ts";
-import { ACTIVE_TEMPLATE_STATUS, SYSTEM_TENANT_ID } from "./constants.ts";
 import {
   DEFAULT_RESOURCE_MAX_BYTES,
   MAX_FILE_ATTACHMENTS_PER_TEMPLATE,
@@ -34,10 +33,11 @@ import {
   parseLinkedResourceEntries,
   templatePdfAttachmentLinkSchema,
 } from "./linked-resources.ts";
-import { TemplateResolverErrors } from "./qualified-names.ts";
 import { normalizeResourceImage } from "./resource-image.ts";
 import { type TemplateResourceRow, templateResourcesTable } from "./table.ts";
 import { readTemplateResource } from "./template-resources.ts";
+import { ACTIVE_TEMPLATE_STATUS, SYSTEM_TENANT_ID } from "./web/constants.ts";
+import { TemplateResolverErrors } from "./web/qualified-names.ts";
 
 export async function readTemplateResourceMaxBytes(
   config: ConfigAccessor | undefined,

package/packages/bundled-features/src/template-resolver/table.ts

@@ -14,7 +14,7 @@ import {
   TEMPLATE_KINDS,
   TEMPLATE_SCOPES,
   TEMPLATE_STATUSES,
-} from "./constants.ts";
+} from "./web/constants.ts";
 
 // Stored v1 events name the kind "mail-html", which is now "mail".
 const renameMailHtmlKind: EntityEventMigration = {

package/packages/bundled-features/src/template-resolver/template-bundle.ts

@@ -1,8 +1,8 @@
 import * as z from "zod";
-import { CONTENT_FORMATS, UPSERT_KINDS } from "./constants.ts";
-import { isDocumentResourceKey } from "./document-schema.ts";
 import { templatePdfAttachmentLinkSchema } from "./linked-resources.ts";
 import { templateSlugSchema } from "./template-meta.ts";
+import { CONTENT_FORMATS, UPSERT_KINDS } from "./web/constants.ts";
+import { isDocumentResourceKey } from "./web/document-schema.ts";
 
 const MAX_RESOURCES = 20;
 const MAX_LOCALES = 50;

package/packages/bundled-features/src/template-resolver/template-delivery-policy.ts

@@ -0,0 +1,82 @@
+import type { Registry } from "@cosmicdrift/kumiko-framework/engine";
+import { isPlainObject, propertyOf } from "@cosmicdrift/kumiko-types/type-guards";
+import { isSystemAdmin } from "./template-draft.ts";
+import { SYSTEM_TENANT_ID } from "./web/constants.ts";
+import { TEMPLATE_RESOLVER_FEATURE } from "./web/qualified-names.ts";
+
+type DeliveryTarget = { readonly kind: string; readonly slug: string };
+
+// What decides whether a tenant row may be served. Independent of who reads: delivery must not
+// change with the caller's roles, so this is not the edit policy.
+export type TemplateDeliveryPolicy = {
+  readonly tenantEditable: readonly DeliveryTarget[];
+  /** Kinds of collections mounted with an explicit `access`; their tenant rows are edited by design. */
+  readonly collectionKinds: readonly string[];
+};
+
+const NOTHING_UNLOCKED: TemplateDeliveryPolicy = { tenantEditable: [], collectionKinds: [] };
+
+export function isTenantOverrideServed(
+  policy: TemplateDeliveryPolicy,
+  target: DeliveryTarget,
+): boolean {
+  return (
+    policy.collectionKinds.includes(target.kind) ||
+    policy.tenantEditable.some((entry) => entry.kind === target.kind && entry.slug === target.slug)
+  );
+}
+
+// Served only because its kind belongs to a collection with `access`, not because the template
+// is listed in tenantEditable. For these a system row of the same slug must win.
+export function isServedByCollectionOnly(
+  policy: TemplateDeliveryPolicy,
+  target: DeliveryTarget,
+): boolean {
+  return (
+    policy.collectionKinds.includes(target.kind) &&
+    !policy.tenantEditable.some((entry) => entry.kind === target.kind && entry.slug === target.slug)
+  );
+}
+
+export function isRowServed(
+  policy: TemplateDeliveryPolicy,
+  row: DeliveryTarget & { readonly tenantId: string },
+): boolean {
+  return row.tenantId === SYSTEM_TENANT_ID || isTenantOverrideServed(policy, row);
+}
+
+// A SystemAdmin sees every stored row, so a locked override can still be reset; everyone else
+// sees only what is delivered, which keeps a locked override out of the template-resolver queries for a TenantAdmin (the audit log keeps the history).
+export function isRowServedTo(
+  policy: TemplateDeliveryPolicy,
+  user: { readonly roles: readonly string[] },
+  row: DeliveryTarget & { readonly tenantId: string },
+): boolean {
+  return isSystemAdmin(user) || isRowServed(policy, row);
+}
+
+function isDeliveryTarget(value: unknown): value is DeliveryTarget {
+  return (
+    typeof propertyOf(value, "kind") === "string" && typeof propertyOf(value, "slug") === "string"
+  );
+}
+
+function isTemplateDeliveryPolicy(value: unknown): value is TemplateDeliveryPolicy {
+  if (!isPlainObject(value)) return false;
+  const { tenantEditable, collectionKinds } = value;
+  return (
+    Array.isArray(tenantEditable) &&
+    tenantEditable.every(isDeliveryTarget) &&
+    Array.isArray(collectionKinds) &&
+    collectionKinds.every((kind) => typeof kind === "string")
+  );
+}
+
+// Fail closed: without the mounted feature (or its exports) no tenant row counts as unlocked.
+export function deliveryPolicyOf(registry: Registry): TemplateDeliveryPolicy {
+  const exported = propertyOf(
+    propertyOf(registry.getFeature(TEMPLATE_RESOLVER_FEATURE), "exports"),
+    "deliveryPolicy",
+  );
+  return isTemplateDeliveryPolicy(exported) ? exported : NOTHING_UNLOCKED;
+}

package/packages/bundled-features/src/template-resolver/template-draft.ts

@@ -1,7 +1,7 @@
 import { Temporal } from "@cosmicdrift/kumiko-types/temporal";
 import * as z from "zod";
-import { CONTENT_FORMATS, type ContentFormat } from "./constants.ts";
 import type { TemplateResourceRow } from "./table.ts";
+import { CONTENT_FORMATS, type ContentFormat } from "./web/constants.ts";
 
 const templateDraftSchema = z.object({
   content: z.string().nullable(),

package/packages/bundled-features/src/template-resolver/template-edit-policy.ts

@@ -0,0 +1,91 @@
+import { fetchOne } from "@cosmicdrift/kumiko-framework/db";
+import {
+  type HandlerContext,
+  hasAccess,
+  type RoleAccessRule,
+  type SessionUser,
+} from "@cosmicdrift/kumiko-framework/engine";
+import {
+  AccessDeniedError,
+  type WriteFailure,
+  writeFailure,
+} from "@cosmicdrift/kumiko-framework/errors";
+import { type TemplateResourceRow, templateResourcesTable } from "./table.ts";
+import { isSystemAdmin } from "./template-draft.ts";
+import type { TemplateKind } from "./web/constants.ts";
+import { TemplateResolverErrors } from "./web/qualified-names.ts";
+
+export type TenantEditableTemplate = {
+  readonly kind: TemplateKind;
+  readonly slug: string;
+  readonly access: RoleAccessRule;
+};
+
+export type TemplateEditPolicy = {
+  readonly tenantEditable: readonly TenantEditableTemplate[];
+};
+
+type EditTarget = { readonly slug: string; readonly kind: string };
+type EditUser = Pick<SessionUser, "roles">;
+
+const SYSTEM_ADMIN_ROLE = "SystemAdmin";
+
+export function templateEditAccess(entries: readonly TenantEditableTemplate[]): RoleAccessRule {
+  const roles = new Set<string>([SYSTEM_ADMIN_ROLE]);
+  for (const entry of entries) {
+    for (const role of entry.access.roles) roles.add(role);
+  }
+  return { roles: [...roles] };
+}
+
+export function mayEditTemplate(
+  policy: TemplateEditPolicy,
+  user: EditUser,
+  target: EditTarget,
+): boolean {
+  if (isSystemAdmin(user)) return true;
+  const entry = policy.tenantEditable.find(
+    (candidate) => candidate.slug === target.slug && candidate.kind === target.kind,
+  );
+  return entry !== undefined && hasAccess(user, entry.access);
+}
+
+export function refuseTemplateEdit(
+  policy: TemplateEditPolicy,
+  user: EditUser,
+  target: EditTarget,
+): WriteFailure | null {
+  if (mayEditTemplate(policy, user, target)) return null;
+  return writeFailure(
+    new AccessDeniedError({
+      i18nKey: "templateResolver.errors.templateNotTenantEditable",
+      details: { reason: TemplateResolverErrors.templateNotTenantEditable },
+    }),
+  );
+}
+
+// Fail closed: a missing row gives a non-SystemAdmin the same refusal as a locked one,
+// so the response never reveals whether an id exists. SystemAdmin keeps the 404.
+export function refuseMissingTemplate(
+  policy: TemplateEditPolicy,
+  user: EditUser,
+): WriteFailure | null {
+  return isSystemAdmin(user) ? null : refuseTemplateEdit(policy, user, { slug: "", kind: "" });
+}
+
+export async function refuseTemplateEditById(
+  db: HandlerContext["db"],
+  policy: TemplateEditPolicy,
+  user: EditUser,
+  tenantId: string,
+  templateId: string,
+): Promise<WriteFailure | null> {
+  if (isSystemAdmin(user)) return null;
+  const row = await fetchOne<TemplateResourceRow>(db, templateResourcesTable, {
+    tenantId,
+    id: templateId,
+  });
+  return row === undefined
+    ? refuseMissingTemplate(policy, user)
+    : refuseTemplateEdit(policy, user, row);
+}

package/packages/bundled-features/src/template-resolver/template-meta.ts

@@ -4,8 +4,8 @@ import {
   PDF_ORIENTATIONS,
   PDF_PAGE_FORMATS,
   type TemplateKind,
-} from "./constants.ts";
-import { MAIL_TONES, type MailTone } from "./mail-constants.ts";
+} from "./web/constants.ts";
+import { MAIL_TONES, type MailTone } from "./web/mail-constants.ts";
 
 // One or more kebab segments joined by ":" — notification templates are seeded
 // under their qualified name `feature:notify:name`.

package/packages/bundled-features/src/template-resolver/template-preview.ts

@@ -4,6 +4,7 @@ import {
   type SessionUser,
   type TemplateListVariableDef,
   type TemplateScalarVariableDef,
+  type TemplateVariableDef,
   type TemplateVariables,
   templateVariablesToZod,
 } from "@cosmicdrift/kumiko-framework/engine";
@@ -29,13 +30,6 @@ import {
 } from "../renderer-foundation/index.ts";
 import { createTemplateResolverApi, TemplateNotFoundError, type TemplateResource } from "./api.ts";
 import { collectDocumentResourceKeys } from "./compile-document-body.ts";
-import {
-  DEFAULT_MAIL_LAYOUT_SLUG,
-  DEFAULT_PDF_LAYOUT_SLUG,
-  MAIL_PREVIEW_MAX_BYTES,
-  SYSTEM_TENANT_ID,
-  type TemplateScope,
-} from "./constants.ts";
 import { parseStoredJson } from "./handlers/template-gates.ts";
 import { validateTemplateDraft } from "./handlers/validate.query.ts";
 import {
@@ -46,8 +40,8 @@ import {
 } from "./layout-regions.ts";
 import { type LinkedResourceEntry, parseLinkedResourceEntries } from "./linked-resources.ts";
 import { buildDisplayHtml } from "./preview-display-html.ts";
-import { TemplateResolverErrors } from "./qualified-names.ts";
 import { type TemplateResourceRow, templateResourcesTable } from "./table.ts";
+import { deliveryPolicyOf, isRowServedTo } from "./template-delivery-policy.ts";
 import {
   isMailTemplateMeta,
   type MailTemplateMeta,
@@ -55,6 +49,14 @@ import {
   parseTemplateMeta,
   readPdfTemplateMeta,
 } from "./template-meta.ts";
+import {
+  DEFAULT_MAIL_LAYOUT_SLUG,
+  DEFAULT_PDF_LAYOUT_SLUG,
+  MAIL_PREVIEW_MAX_BYTES,
+  SYSTEM_TENANT_ID,
+  type TemplateScope,
+} from "./web/constants.ts";
+import { TemplateResolverErrors } from "./web/qualified-names.ts";
 
 const SAMPLE_LINK = "https://example.com";
 const SAMPLE_DATE = "2026-01-15";
@@ -120,6 +122,12 @@ function sampleList(def: TemplateListVariableDef, labelText: LabelText): Record<
   return rows;
 }
 
+function sampleValueFor(name: string, def: TemplateVariableDef, labelText: LabelText): unknown {
+  // An images variable has no sample: file ids are record data, never preview content.
+  if (def.type === "images") return [];
+  return def.type === "list" ? sampleList(def, labelText) : sampleScalar(name, def, labelText);
+}
+
 // Declared examples win; the fallbacks are deterministic so a preview never differs between calls.
 export function sampleValuesFor(
   variables: TemplateVariables,
@@ -127,8 +135,7 @@ export function sampleValuesFor(
 ): Record<string, unknown> {
   const values: Record<string, unknown> = {};
   for (const [name, def] of Object.entries(variables)) {
-    values[name] =
-      def.type === "list" ? sampleList(def, labelText) : sampleScalar(name, def, labelText);
+    values[name] = sampleValueFor(name, def, labelText);
   }
   return values;
 }
@@ -228,7 +235,7 @@ async function loadStoredDraft(
   input: TemplatePreviewInput,
 ): Promise<TemplateResource | null> {
   try {
-    return await createTemplateResolverApi(ctx.db).resolveTemplate({
+    return await createTemplateResolverApi(ctx.db, ctx.registry).resolveTemplate({
       tenantId: user.tenantId,
       slug: input.slug,
       kind: input.kind,
@@ -320,6 +327,9 @@ async function loadEditedRowResources(
     { limit: 1 },
   );
   const row = rows[0];
+  if (row !== undefined && !isRowServedTo(deliveryPolicyOf(ctx.registry), user, row)) {
+    return undefined;
+  }
   return row === undefined ? undefined : parseLinkedResourceEntries(row.linkedResources);
 }
 
@@ -329,7 +339,7 @@ async function resolvePdfLayout(
   slug: string,
   locale: string,
 ): Promise<PreviewLayout | null> {
-  const api = createTemplateResolverApi(ctx.db);
+  const api = createTemplateResolverApi(ctx.db, ctx.registry);
   const find = async (tenantId: string): Promise<TemplateResource | null> => {
     try {
       return await api.resolveLayout({ tenantId, slug, kind: "pdf-layout", locale });

package/packages/bundled-features/src/template-resolver/template-usage.ts

@@ -3,7 +3,7 @@ import {
   parseQn,
   type Registry,
 } from "@cosmicdrift/kumiko-framework/engine";
-import { DEFAULT_MAIL_LAYOUT_SLUG, type TemplateKind } from "./constants.ts";
+import { DEFAULT_MAIL_LAYOUT_SLUG, type TemplateKind } from "./web/constants.ts";
 
 type UsageRole = "template" | "layout";