@cosmicdrift/kumiko-samples 0.378.0 → 0.379.0

package/packages/bundled-features/src/template-resolver/README.md

@@ -23,7 +23,7 @@ const features = [
 const app = createKumikoApp({
   features,
   extraContext: ({ db }) => ({
-    templateResolver: createTemplateResolverApi(db),
+    templateResolver: createTemplateResolverApi(db, registry),
   }),
 });
 ```

package/packages/bundled-features/src/template-resolver/api.ts

@@ -4,12 +4,10 @@
 
 import type { DbRunner, TenantDb } from "@cosmicdrift/kumiko-framework/db";
 import { selectMany } from "@cosmicdrift/kumiko-framework/db";
-import type { SessionUser, TenantId } from "@cosmicdrift/kumiko-framework/engine";
+import type { Registry, SessionUser, TenantId } from "@cosmicdrift/kumiko-framework/engine";
 import { InternalError } from "@cosmicdrift/kumiko-framework/errors";
 import type { Temporal } from "@cosmicdrift/kumiko-types/temporal";
 import type { FileAttachmentRef } from "../renderer-foundation/index.ts";
-import type { ContentFormat, TemplateKind } from "./constants.ts";
-import { FALLBACK_LOCALE, SYSTEM_TENANT_ID } from "./constants.ts";
 import {
   fileAttachmentsOf,
   imageLinksOf,
@@ -18,8 +16,16 @@ import {
   type TemplatePdfAttachmentLink,
 } from "./linked-resources.ts";
 import { type TemplateResourceRow, templateResourcesTable } from "./table.ts";
-import { activeVersionOf, servedVersionOf } from "./template-draft.ts";
+import {
+  deliveryPolicyOf,
+  isRowServed,
+  isServedByCollectionOnly,
+  type TemplateDeliveryPolicy,
+} from "./template-delivery-policy.ts";
+import { activeVersionOf, isSystemAdmin, servedVersionOf } from "./template-draft.ts";
 import { parseTemplateMeta, type TemplateMeta } from "./template-meta.ts";
+import type { ContentFormat, TemplateKind } from "./web/constants.ts";
+import { FALLBACK_LOCALE, SYSTEM_TENANT_ID } from "./web/constants.ts";
 
 // Public TemplateResource: what consumers see. Hides DB-internal columns
 // (insertedById, internal id-type) but keeps the fields needed for rendering.
@@ -68,15 +74,11 @@ export type ResolveLayoutRequest = {
 
 export type TemplateResolverApi = {
   /**
-   * Findet ein konkretes Template by (tenantId, slug, kind, locale).
-   * Kein Locale-Fallback, keine Override-Hierarchie — Raw-Lookup für
-   * Admin-UI-Edits und Konformitäts-Tests. Für Render-Aufrufe immer
-   * `resolveTemplate` nutzen.
+   * Raw lookup by (tenantId, slug, kind, locale): no locale fallback, no override
+   * hierarchy. Render paths must use `resolveTemplate`. `scope: "system"` forces
+   * SYSTEM_TENANT_ID and ignores the passed tenantId.
    *
-   * `scope: "system"` zwingt Lookup gegen SYSTEM_TENANT_ID (ignoriert
-   * den übergebenen tenantId). Default = Lookup gegen den übergebenen
-   * tenantId direkt (Caller wählt entweder Tenant oder System per
-   * tenantId).
+   * Tenant rows of a template that is not tenantEditable are not returned.
    */
   readonly findExact: (args: {
     readonly tenantId: TenantId;
@@ -87,18 +89,10 @@ export type TemplateResolverApi = {
   }) => Promise<TemplateResource | null>;
 
   /**
-   * Resolver mit 4-Stufen-Fallback (siehe template-resolver.md):
-   *   1. tenant + requested-locale
-   *   2. system + requested-locale
-   *   3. tenant + FALLBACK_LOCALE
-   *   4. system + FALLBACK_LOCALE
-   * Resource-Substitution wird hier NICHT ausgeführt — das macht der
-   * Caller (renderer-foundation-Plugin) je nach kind-passendem Modus
-   * (inline-base64 vs. signed-url). API liefert TemplateResource pur.
-   *
-   * **Caller-Invariante:** `tenantId` MUSS vom Server kommen (typisch
-   * `ctx.user.tenantId`). Niemals direkt aus User-Input — sonst kann
-   * User cross-tenant Templates abfragen (Tenant-Isolation gebrochen).
+   * Four-step fallback: tenant+locale, system+locale, tenant+FALLBACK_LOCALE,
+   * system+FALLBACK_LOCALE (see template-resolver.md).
+   * Tenant rows count only for templates unlocked for tenants (tenantEditable,
+   * or a collection with access); locked overrides are skipped but stay stored.
    */
   readonly resolveTemplate: (args: ResolveRequest) => Promise<TemplateResource>;
 
@@ -114,12 +108,18 @@ export type TemplateResolverApi = {
   readonly resolveLayout: (args: ResolveLayoutRequest) => Promise<TemplateResource>;
 };
 
-export function createTemplateResolverApi(db: DbRunner | TenantDb): TemplateResolverApi {
+export function createTemplateResolverApi(
+  db: DbRunner | TenantDb,
+  registry: Registry,
+): TemplateResolverApi {
+  const deliveryPolicy = deliveryPolicyOf(registry);
+  // A collection entry must not shadow a system template of the same slug that the app did not unlock.
+  const isServed = (row: TemplateResourceRow) => isRowDelivered(db, deliveryPolicy, row);
   return {
     findExact: async ({ tenantId, slug, kind, locale, scope }) => {
       const effectiveTenantId = scope === "system" ? SYSTEM_TENANT_ID : tenantId;
       const row = await fetchTemplate(db, effectiveTenantId, slug, kind, locale);
-      return row ? toPublic(row) : null;
+      return row && (await isServed(row)) ? toPublic(row) : null;
     },
 
     resolveTemplate: async ({ tenantId, slug, kind, locale }) => {
@@ -135,14 +135,16 @@ export function createTemplateResolverApi(db: DbRunner | TenantDb): TemplateReso
           : []),
       ];
       for (const c of candidates) {
+        if (!isRowServed(deliveryPolicy, { tenantId: c.tid, kind, slug })) continue;
         const row = await fetchTemplate(db, c.tid, slug, kind, c.loc);
-        if (row && row.status === "active") return toPublic(row);
+        if (row && row.status === "active" && (await isServed(row))) return toPublic(row);
       }
       throw new TemplateNotFoundError({ slug, kind, locale });
     },
 
     resolveLayout: async ({ tenantId, slug, kind, locale }) => {
       for (const tid of [tenantId, SYSTEM_TENANT_ID]) {
+        if (!isRowServed(deliveryPolicy, { tenantId: tid, kind, slug })) continue;
         const rows = await selectMany<TemplateResourceRow>(db, templateResourcesTable, {
           tenantId: tid,
           slug,
@@ -156,6 +158,51 @@ export function createTemplateResolverApi(db: DbRunner | TenantDb): TemplateReso
   };
 }
 
+// The one delivery rule for a stored row: unlocked, and a collection entry never shadows a system
+// template of the same slug that the app did not unlock.
+export async function isRowDelivered(
+  db: DbRunner | TenantDb,
+  policy: TemplateDeliveryPolicy,
+  row: TemplateResourceRow,
+): Promise<boolean> {
+  if (!isRowServed(policy, row)) return false;
+  if (row.tenantId === SYSTEM_TENANT_ID || !isServedByCollectionOnly(policy, row)) return true;
+  return !(await systemTemplateExists(db, row.kind, row.slug));
+}
+
+export async function isRowDeliveredTo(
+  db: DbRunner | TenantDb,
+  policy: TemplateDeliveryPolicy,
+  user: { readonly roles: readonly string[] },
+  row: TemplateResourceRow,
+): Promise<boolean> {
+  return isSystemAdmin(user) || (await isRowDelivered(db, policy, row));
+}
+
+export async function filterDeliveredTo(
+  db: DbRunner | TenantDb,
+  policy: TemplateDeliveryPolicy,
+  user: { readonly roles: readonly string[] },
+  rows: readonly TemplateResourceRow[],
+): Promise<TemplateResourceRow[]> {
+  const flags = await Promise.all(rows.map((row) => isRowDeliveredTo(db, policy, user, row)));
+  return rows.filter((_, index) => flags[index]);
+}
+
+export async function systemTemplateExists(
+  db: DbRunner | TenantDb,
+  kind: string,
+  slug: string,
+): Promise<boolean> {
+  const rows = await selectMany(
+    db,
+    templateResourcesTable,
+    { tenantId: SYSTEM_TENANT_ID, slug, kind },
+    { limit: 1 },
+  );
+  return rows.length > 0;
+}
+
 function pickActiveLayoutRow(
   rows: readonly TemplateResourceRow[],
   locale: string,
@@ -268,7 +315,7 @@ export function requireTemplateResolver(
     throw new InternalError({
       message:
         `[${callerName}] ctx.templateResolver missing — App-Bootstrap muss ` +
-        `extraContext: { templateResolver: createTemplateResolverApi(db) } setzen ` +
+        `extraContext: { templateResolver: createTemplateResolverApi(db, registry) } setzen ` +
         `(siehe template-resolver/README.md).`,
     });
   }

package/packages/bundled-features/src/template-resolver/changes.json

@@ -1,4 +1,47 @@
 [
+  {
+    "version": "0.379.0",
+    "type": "improvement",
+    "title": "Titles for the template-resolver write handlers",
+    "detail": "Every agent-callable template-resolver write handler now has a title in de, en, es, fr and it, so the AI assistant names actions such as \"Edit template draft\" instead of \"template-resolver:write:patch-draft\". The handlers of mounted content collections (`<id>-set`) stay untitled because their names depend on the app. The empty-field hint of the placeholder line editor now ends in an ellipsis inside the field instead of running past it."
+  },
+  {
+    "version": "0.379.0",
+    "type": "breaking",
+    "title": "Overrides of locked templates are no longer served",
+    "detail": "A tenant override of a mail, PDF or layout template is delivered (mail send, PDF render, linked PDFs, layouts, previews, export bundles, document blocks, overview, text blocks) only while the template is listed in tenantEditable. A locked override stays stored and has no effect; listing the template makes it effective again, nothing is deleted. A SystemAdmin sees locked overrides in the overview (`lockedOverride`, `lockedOverrideI18nKey`) and can reset or archive them with the existing handlers; the template-resolver queries do not show them to a TenantAdmin; the audit log keeps the history. Tenant rows of a collection mounted with `access` are served, except for a slug that has a system template outside tenantEditable: that system template wins, and the collection `-set` handler refuses such a slug for a non-SystemAdmin. createTemplateResolverApi(db) became createTemplateResolverApi(db, registry) because the delivery policy is read from the mounted feature; without the mounted feature no tenant override is served.",
+    "migration": "Overrides of templates that are not tenantEditable are no longer served; enable the template via tenantEditable to keep using them. Pass the registry as second argument to createTemplateResolverApi (ctx.registry in handlers, stack.registry in tests). Tenant rows without a system counterpart (for example text blocks seeded directly into a tenant) are hidden as well unless listed in tenantEditable."
+  },
+  {
+    "version": "0.379.0",
+    "type": "improvement",
+    "title": "Overview label for locked template overrides",
+    "detail": "Adds templateResolver.overview.lockedOverride."
+  },
+  {
+    "version": "0.379.0",
+    "type": "improvement",
+    "title": "Mail rendering follows the template delivery policy",
+    "detail": "Resolves templates through createTemplateResolverApi(db, registry); overrides of locked templates fall back to the system version."
+  },
+  {
+    "version": "0.379.0",
+    "type": "improvement",
+    "title": "PDF rendering follows the template delivery policy",
+    "detail": "Resolves templates through createTemplateResolverApi(db, registry); overrides of locked templates fall back to the system version."
+  },
+  {
+    "version": "0.379.0",
+    "type": "improvement",
+    "title": "Samples follow the createTemplateResolverApi(db, registry) signature",
+    "detail": "Recipes and sample apps build the template resolver API with the registry as second argument."
+  },
+  {
+    "version": "0.379.0",
+    "type": "improvement",
+    "title": "seedSystemTemplate accepts titleI18nKey",
+    "detail": "A seeded template can store an i18n key as its title (titleI18nKey, exclusive with title). The overview returns the key; the document-designer overview, mail editor and PDF link modal translate it and fall back to the raw text. Templates without a key behave as before; no migration."
+  },
   {
     "version": "0.378.0",
     "type": "improvement",

package/packages/bundled-features/src/template-resolver/compile-document-body.ts

@@ -11,7 +11,7 @@ import {
   isDocumentPlaceholderHref,
   isDocumentReferenceName,
   isDocumentResourceKey,
-} from "./document-schema.ts";
+} from "./web/document-schema.ts";
 
 // Private-use characters mark where a Handlebars expression goes. Author text
 // is scrubbed of them first and every `{`/`}` is entity-encoded before the

package/packages/bundled-features/src/template-resolver/compile-steps-block.ts

@@ -1,7 +1,7 @@
 import type { Element as ScanElement } from "happy-dom";
-import { isDocumentReferenceName } from "./document-schema.ts";
-import { readDocumentSteps } from "./document-steps.ts";
 import { isHexColor } from "./layout-appearance.ts";
+import { isDocumentReferenceName } from "./web/document-schema.ts";
+import { readDocumentSteps } from "./web/document-steps.ts";
 
 export const DEFAULT_STEPS_COLOR = "#1f5468";
 const TODO_BAR_COLOR = "#ECEDEA";

package/packages/bundled-features/src/template-resolver/document-ops.ts

@@ -1,17 +1,17 @@
 import type { FieldIssue } from "@cosmicdrift/kumiko-framework/errors";
 import { getSchema, type JSONContent } from "@tiptap/core";
 import * as z from "zod";
-import type { DocumentHtmlKind } from "./constants.ts";
-import { documentBlocksForKind } from "./document-blocks.ts";
+import { toVariableDef } from "./template-validation.ts";
+import type { DocumentHtmlKind } from "./web/constants.ts";
+import { documentBlocksForKind } from "./web/document-blocks.ts";
 import {
   DOCUMENT_TEXT_ALIGNMENTS,
   documentExtensions,
   isDocumentPlaceholderHref,
   isDocumentReferenceName,
   isDocumentResourceKey,
-} from "./document-schema.ts";
-import { contentToLine, lineToContent, singleLine } from "./placeholder-text.ts";
-import { toVariableDef } from "./template-validation.ts";
+} from "./web/document-schema.ts";
+import { contentToLine, lineToContent, singleLine } from "./web/placeholder-text.ts";
 
 export const MAX_DOCUMENT_OPS = 50;
 

package/packages/bundled-features/src/template-resolver/document-sanitizer.ts

@@ -5,8 +5,8 @@ import { isOneOf } from "@cosmicdrift/kumiko-types/type-guards";
 import type { JSONContent } from "@tiptap/core";
 import { generateHTML, generateJSON } from "@tiptap/html/server";
 import { type Element as ScanElement, Window } from "happy-dom";
-import type { ContentFormat } from "./constants.ts";
-import { DOCUMENT_HTML_KINDS } from "./constants.ts";
+import type { ContentFormat } from "./web/constants.ts";
+import { DOCUMENT_HTML_KINDS } from "./web/constants.ts";
 import {
   DOCUMENT_CONDITION_ATTRIBUTE,
   documentExtensions,
@@ -14,8 +14,8 @@ import {
   isDocumentPlaceholderHref,
   isDocumentReferenceName,
   isDocumentResourceKey,
-} from "./document-schema.ts";
-import { isDocumentStepKey } from "./document-steps.ts";
+} from "./web/document-schema.ts";
+import { isDocumentStepKey } from "./web/document-steps.ts";
 
 export type DocumentViolationCode =
   | "script_element"

package/packages/bundled-features/src/template-resolver/feature.ts

@@ -3,7 +3,6 @@ import {
   createSystemConfig,
   defineFeature,
 } from "@cosmicdrift/kumiko-framework/engine";
-import { DEFAULT_COLLECTION_ACCESS, isCollectionRefusedKind } from "./constants.ts";
 import { bySlugQuery } from "./handlers/by-slug.query.ts";
 import { byTenantQuery } from "./handlers/by-tenant.query.ts";
 import { makeCollectionItemQuery } from "./handlers/collection-item.query.ts";
@@ -43,9 +42,12 @@ import { upsertSystemWrite } from "./handlers/upsert-system.write.ts";
 import { makeUpsertTenantWrite } from "./handlers/upsert-tenant.write.ts";
 import { usageQuery } from "./handlers/usage.query.ts";
 import { validateQuery } from "./handlers/validate.query.ts";
+import { TEMPLATE_RESOLVER_I18N } from "./i18n.ts";
 import { templateResourceEntity } from "./table.ts";
+import type { TemplateDeliveryPolicy } from "./template-delivery-policy.ts";
 import type { TenantEditableTemplate } from "./template-edit-policy.ts";
 import { userContentEntryEntity } from "./user-content-table.ts";
+import { DEFAULT_COLLECTION_ACCESS, isCollectionRefusedKind } from "./web/constants.ts";
 
 // template-resolver — structured template storage with tenant-override
 // hierarchy, locale fallback and resource linking via file-foundation.
@@ -112,13 +114,19 @@ export function createTemplateResolverFeature(opts: TemplateResolverOptions = {}
   const tenantEditable = opts.tenantEditable ?? [];
   assertTenantEditableValid(tenantEditable);
   const policy = { tenantEditable };
+  const deliveryPolicy: TemplateDeliveryPolicy = {
+    tenantEditable: tenantEditable.map(({ kind, slug }) => ({ kind, slug })),
+    collectionKinds: collections
+      .filter((c) => c.ownership !== "user" && c.access !== undefined)
+      .map((c) => c.kind),
+  };
   const hasUserOwned = collections.some((c) => c.ownership === "user");
   return defineFeature("template-resolver", (r) => {
     r.describe(
       [
         "Every piece of editable text lives here, in one entity: mail bodies, notification texts, PDF document templates, AI prompts and plain text blocks. What a record is used for is the `kind` (`notification`, `mail`, `mail-layout`, `document-pdf`, `pdf-layout`, `ai-prompt`, `text-block`, `snippet`, `image-snapshot`).",
         "Reading is one call — `ctx.templateResolver.resolveTemplate({ tenantId, slug, kind, locale })`. It walks four levels: tenant+locale, system+locale, tenant+fallback-locale, system+fallback-locale. A tenant overrides a system default by simply having its own record; no application code changes. Writing programmatically goes through the `upsertSystem`, `upsertTenant`, `publish` and `archive` write handlers; a SystemAdmin retires or restores a system default with `publishSystem` and `archiveSystem`, and a tenant drops its override with `resetToSystem`. Saving a draft over an active template keeps the active version served and stores the edit beside it (column `draft`); `publish` makes it the served version, `discardDraft` / `discardDraftSystem` throws it away.",
-        'Editing templates is for SystemAdmin only. A TenantAdmin edits only the templates the app unlocks at the mount site, `createTemplateResolverFeature({ tenantEditable: [{ kind: "mail", slug: "status-update", access: { roles: ["TenantAdmin"] } }] })`, and every write handler enforces that on the server (override, draft, publish, archive, reset, copy-locale, import, resources, `set`). Each entry carries the `access` roles allowed to edit it, because a bundled feature cannot know the host\'s roles. Reading and delivery do not depend on it: a tenant override that exists is served. A collection mounted without `access` is SystemAdmin only.',
+        'Editing templates is for SystemAdmin only. A TenantAdmin edits only the templates the app unlocks at the mount site, `createTemplateResolverFeature({ tenantEditable: [{ kind: "mail", slug: "status-update", access: { roles: ["TenantAdmin"] } }] })`, and every write handler enforces that on the server (override, draft, publish, archive, reset, copy-locale, import, resources, `set`). Each entry carries the `access` roles allowed to edit it, because a bundled feature cannot know the host\'s roles. The same list decides delivery: a tenant override is served (mail, PDF, layouts, text blocks) only while its template is listed in tenantEditable; otherwise the system version is served. A locked override stays stored, a SystemAdmin sees it in the overview marked as not delivered, and listing the template makes it effective again. Tenant rows of a collection mounted with `access` are always served. A collection mounted without `access` is SystemAdmin only.',
         "Text an editor should be able to change belongs in a collection, declared at mount: `createTemplateResolverFeature({ collections: [{ id, kind, access: { roles }, nav }] })`. It appears in the navigation, and `access` is part of the mount because a bundled feature cannot know the host's roles. Each collection gets its own `<id>-list` / `<id>-item` / `<id>-set` handlers, so the dispatcher enforces the separation.",
         "How a collection is edited follows from `contentFormat`: `plain` gives a text area, `rich` a small WYSIWYG (bold, italic, headings, lists, links), `markdown` a text area that stores markdown text (same insertable chips as `plain`). All three offer the collection's `variableSchema` as insertable chips and a preview rendered with sample data — an editor sees what `{{firstName}}` becomes without sending a mail. An app can register its own editor for a format; the last `clientFeature` that registers a format wins (a conflict logs a warning).",
         'A collection is tenant-wide by default. With `ownership: "user"` every user keeps their own entries — mail signatures being the obvious case. Those rows live in the separate `user-content-entry` entity and count as user data, so mounting one also requires the `template-resolver-user-data` feature and a migration on the app side.',
@@ -138,6 +146,7 @@ export function createTemplateResolverFeature(opts: TemplateResolverOptions = {}
         resourceMaxBytes: createSystemConfig("number", { default: 2_097_152, bounds: { min: 1 } }),
       },
     });
+    r.translations({ keys: TEMPLATE_RESOLVER_I18N });
     r.entity({ name: "template-resource", ...templateResourceEntity });
     // Only when the app actually mounts a user-owned collection: the entity's
     // `content` is `userOwned`, which makes it subject data — the boot guard
@@ -190,7 +199,7 @@ export function createTemplateResolverFeature(opts: TemplateResolverOptions = {}
       });
       r.queryHandler(makeCollectionListQuery(collection));
       r.queryHandler(makeCollectionItemQuery(collection));
-      r.writeHandler(makeCollectionSetWrite(collection));
+      r.writeHandler(makeCollectionSetWrite(collection, policy));
     }
 
     // Visual-tree actions for the text-block content tree. The handle is
@@ -204,6 +213,6 @@ export function createTemplateResolverFeature(opts: TemplateResolverOptions = {}
       create: { args: { folder: emptyString } },
     });
 
-    return { handlers, queries, treeHandle };
+    return { handlers, queries, treeHandle, deliveryPolicy };
   });
 }

package/packages/bundled-features/src/template-resolver/handlers/by-slug.query.ts

@@ -1,8 +1,10 @@
 import { fetchOne } from "@cosmicdrift/kumiko-framework/db";
 import { defineQueryHandler } from "@cosmicdrift/kumiko-framework/engine";
 import * as z from "zod";
-import { TEXT_BLOCK_KIND } from "../constants.ts";
+import { isRowDeliveredTo } from "../api.ts";
 import { type TemplateResourceRow, templateResourcesTable } from "../table.ts";
+import { deliveryPolicyOf } from "../template-delivery-policy.ts";
+import { TEXT_BLOCK_KIND } from "../web/constants.ts";
 
 // Public read of a single text-block by (tenantId, slug, locale). Anonymous
 // must be listed explicitly — `openToAll` alone is auth-only (regression
@@ -39,6 +41,9 @@ export const bySlugQuery = defineQueryHandler({
     });
 
     if (!row) return null;
+    if (!(await isRowDeliveredTo(ctx.db, deliveryPolicyOf(ctx.registry), query.user, row))) {
+      return null;
+    }
     return {
       slug: row.slug,
       locale: row.locale,

package/packages/bundled-features/src/template-resolver/handlers/by-tenant.query.ts

@@ -2,8 +2,10 @@ import { castTenantRows, selectMany } from "@cosmicdrift/kumiko-framework/db";
 import { defineQueryHandler } from "@cosmicdrift/kumiko-framework/engine";
 import type { Temporal } from "@cosmicdrift/kumiko-types/temporal";
 import * as z from "zod";
-import { TEXT_BLOCK_KIND } from "../constants.ts";
+import { filterDeliveredTo } from "../api.ts";
 import { type TemplateResourceRow, templateResourcesTable } from "../table.ts";
+import { deliveryPolicyOf } from "../template-delivery-policy.ts";
+import { TEXT_BLOCK_KIND } from "../web/constants.ts";
 
 // All text-blocks of one tenant — feeds the public content tree sidebar.
 // Anonymous is listed explicitly so no-JWT visitors get the sidebar on public
@@ -39,8 +41,10 @@ export const byTenantQuery = defineQueryHandler({
     const rows = castTenantRows<TemplateResourceRow>(
       await selectMany(ctx.db, templateResourcesTable, { tenantId, kind: TEXT_BLOCK_KIND }),
     );
+    const policy = deliveryPolicyOf(ctx.registry);
+    const served = await filterDeliveredTo(ctx.db, policy, query.user, rows);
     return {
-      blocks: rows.map((row) => ({
+      blocks: served.map((row) => ({
         slug: row.slug,
         locale: row.locale,
         title: row.title,

package/packages/bundled-features/src/template-resolver/handlers/collection-item.query.ts

@@ -4,7 +4,7 @@ import {
   defineQueryHandler,
 } from "@cosmicdrift/kumiko-framework/engine";
 import * as z from "zod";
-import { DEFAULT_COLLECTION_ACCESS } from "../constants.ts";
+import { DEFAULT_COLLECTION_ACCESS } from "../web/constants.ts";
 import {
   type CollectionEntryRow,
   collectionStore,

package/packages/bundled-features/src/template-resolver/handlers/collection-list.query.ts

@@ -4,7 +4,7 @@ import {
   defineQueryHandler,
 } from "@cosmicdrift/kumiko-framework/engine";
 import * as z from "zod";
-import { DEFAULT_COLLECTION_ACCESS } from "../constants.ts";
+import { DEFAULT_COLLECTION_ACCESS } from "../web/constants.ts";
 import {
   type CollectionEntryRow,
   collectionStore,

package/packages/bundled-features/src/template-resolver/handlers/collection-set.write.ts

@@ -7,8 +7,10 @@ import {
 import { ValidationError, writeFailure } from "@cosmicdrift/kumiko-framework/errors";
 import * as z from "zod";
 import { requireForTenant } from "../../shared/index.ts";
-import { DEFAULT_COLLECTION_ACCESS, isCollectionRefusedKind } from "../constants.ts";
+import { systemTemplateExists } from "../api.ts";
 import { documentViolationsToFieldIssues, sanitizeTemplateBody } from "../document-sanitizer.ts";
+import { refuseTemplateEdit, type TemplateEditPolicy } from "../template-edit-policy.ts";
+import { DEFAULT_COLLECTION_ACCESS, isCollectionRefusedKind } from "../web/constants.ts";
 import { type CollectionEntryRow, collectionStore } from "./collection-shared.ts";
 import { contentFormatSchema, folderSchema, localeSchema, slugSchema } from "./shared.ts";
 
@@ -19,7 +21,10 @@ import { contentFormatSchema, folderSchema, localeSchema, slugSchema } from "./s
 //
 // Like set.write this publishes on save (status active, empty variableSchema)
 // — the draft stage lives on upsertTenant + publish.
-export function makeCollectionSetWrite(collection: ContentCollectionDefinition) {
+export function makeCollectionSetWrite(
+  collection: ContentCollectionDefinition,
+  editPolicy: TemplateEditPolicy,
+) {
   const store = collectionStore(collection);
   return defineWriteHandler({
     name: `${collection.id}-set`,
@@ -75,6 +80,18 @@ export function makeCollectionSetWrite(collection: ContentCollectionDefinition)
         );
       }
 
+      // The collection's access must not open a system template that the app did not unlock.
+      if (
+        collection.ownership !== "user" &&
+        (await systemTemplateExists(db, collection.kind, event.payload.slug))
+      ) {
+        const refused = refuseTemplateEdit(editPolicy, event.user, {
+          slug: event.payload.slug,
+          kind: collection.kind,
+        });
+        if (refused) return refused;
+      }
+
       const existing = await fetchOne<CollectionEntryRow>(db, store.table, {
         tenantId,
         slug: event.payload.slug,

package/packages/bundled-features/src/template-resolver/handlers/copy-locale.write.ts

@@ -16,9 +16,7 @@ import {
 import { isOneOf } from "@cosmicdrift/kumiko-types/type-guards";
 import * as z from "zod";
 import { requireForTenant } from "../../shared/index.ts";
-import { CONTENT_FORMATS, type ContentFormat } from "../constants.ts";
 import { type LinkedResourceEntry, parseLinkedResourceEntries } from "../linked-resources.ts";
-import { TemplateResolverErrors } from "../qualified-names.ts";
 import {
   createLinkedResourceCopies,
   prepareLinkedResourceCopiesBeforeTransaction,
@@ -32,6 +30,8 @@ import {
 } from "../template-edit-policy.ts";
 import { attachTemplateResources } from "../template-resources.ts";
 import { resolveTemplateVariables } from "../template-validation.ts";
+import { CONTENT_FORMATS, type ContentFormat } from "../web/constants.ts";
+import { TemplateResolverErrors } from "../web/qualified-names.ts";
 import { targetExistsIssue } from "./bundle-import.ts";
 import { kindSchema, localeSchema, templateSlugSchema } from "./shared.ts";
 import { parseStoredJson, storedRecord } from "./template-gates.ts";

package/packages/bundled-features/src/template-resolver/handlers/diff-to-system.query.ts

@@ -3,6 +3,7 @@ import { defineQueryHandler, SYSTEM_TENANT_ID } from "@cosmicdrift/kumiko-framew
 import { NotFoundError } from "@cosmicdrift/kumiko-framework/errors";
 import * as z from "zod";
 import { type TemplateResourceRow, templateResourcesTable } from "../table.ts";
+import { deliveryPolicyOf, isRowServedTo } from "../template-delivery-policy.ts";
 import { isHiddenSystemDraft } from "../template-draft.ts";
 import { buildOverrideDiff } from "./override-diff.ts";
 
@@ -16,7 +17,12 @@ export const diffToSystemQuery = defineQueryHandler({
     const tenantRow = await fetchOne<TemplateResourceRow>(ctx.db, templateResourcesTable, {
       id: query.payload.id,
     });
-    if (!tenantRow || tenantRow.tenantId !== query.user.tenantId || tenantRow.scope !== "tenant") {
+    if (
+      !tenantRow ||
+      tenantRow.tenantId !== query.user.tenantId ||
+      tenantRow.scope !== "tenant" ||
+      !isRowServedTo(deliveryPolicyOf(ctx.registry), query.user, tenantRow)
+    ) {
       throw new NotFoundError("template-resource", query.payload.id);
     }
     const systemRow = await fetchOne<TemplateResourceRow>(ctx.db, templateResourcesTable, {

package/packages/bundled-features/src/template-resolver/handlers/discard-draft.write.ts

@@ -1,12 +1,12 @@
 import { defineWriteHandler } from "@cosmicdrift/kumiko-framework/engine";
 import { NotFoundError, ValidationError, writeFailure } from "@cosmicdrift/kumiko-framework/errors";
 import * as z from "zod";
-import { TemplateResolverErrors } from "../qualified-names.ts";
 import {
   refuseMissingTemplate,
   refuseTemplateEdit,
   type TemplateEditPolicy,
 } from "../template-edit-policy.ts";
+import { TemplateResolverErrors } from "../web/qualified-names.ts";
 import { executor } from "./shared.ts";
 import { loadTargetRow, type StatusTarget, writeAccessFor } from "./toggle-status.write.ts";
 

package/packages/bundled-features/src/template-resolver/handlers/document-base.ts

@@ -5,10 +5,11 @@ import {
   SYSTEM_TENANT_ID,
 } from "@cosmicdrift/kumiko-framework/engine";
 import { isPlainObject } from "@cosmicdrift/kumiko-types/type-guards";
-import type { DocumentHtmlKind } from "../constants.ts";
 import { type TemplateResourceRow, templateResourcesTable } from "../table.ts";
+import { deliveryPolicyOf, isRowServedTo } from "../template-delivery-policy.ts";
 import { isHiddenSystemDraft, toWorkingRow } from "../template-draft.ts";
 import { isSystemOnlyTemplateHiddenFrom } from "../template-system-only.ts";
+import type { DocumentHtmlKind } from "../web/constants.ts";
 import { parseStoredJson } from "./template-gates.ts";
 
 export type DocumentBase = {
@@ -45,7 +46,12 @@ export async function loadDocumentBase(
     tenantId: user.tenantId,
     ...where,
   });
-  if (own !== undefined && !isSystemOnlyTemplateHiddenFrom(user, ctx.registry, own)) {
+  // A locked override is neither shown nor edited by a non-SystemAdmin; the served system default is.
+  const ownIsVisible =
+    own !== undefined &&
+    !isSystemOnlyTemplateHiddenFrom(user, ctx.registry, own) &&
+    isRowServedTo(deliveryPolicyOf(ctx.registry), user, own);
+  if (own !== undefined && ownIsVisible) {
     const working = toWorkingRow(own, user.tenantId);
     return {
       rowId: String(own.id),

package/packages/bundled-features/src/template-resolver/handlers/document-blocks.query.ts

@@ -1,11 +1,11 @@
 import { defineQueryHandler } from "@cosmicdrift/kumiko-framework/engine";
 import { NotFoundError } from "@cosmicdrift/kumiko-framework/errors";
 import * as z from "zod";
-import { DOCUMENT_HTML_KINDS } from "../constants.ts";
-import { documentBlocksForKind } from "../document-blocks.ts";
 import { documentBlocksOf } from "../document-ops.ts";
 import { parseDocumentJson } from "../document-sanitizer.ts";
 import { resolveTemplateVariables } from "../template-validation.ts";
+import { DOCUMENT_HTML_KINDS } from "../web/constants.ts";
+import { documentBlocksForKind } from "../web/document-blocks.ts";
 import { loadDocumentBase } from "./document-base.ts";
 import { localeSchema, templateSlugSchema } from "./shared.ts";
 import { knownResourceKeysFor } from "./validate.query.ts";

package/packages/bundled-features/src/template-resolver/handlers/export-bundle.query.ts

@@ -3,16 +3,18 @@ import { selectMany } from "@cosmicdrift/kumiko-framework/db";
 import { defineQueryHandler, SYSTEM_TENANT_ID } from "@cosmicdrift/kumiko-framework/engine";
 import { NotFoundError, ValidationError } from "@cosmicdrift/kumiko-framework/errors";
 import * as z from "zod";
+import { filterDeliveredTo } from "../api.ts";
 import {
   isFileAttachmentEntry,
   isPdfAttachmentLink,
   type LinkedResourceEntry,
   parseLinkedResourceEntries,
 } from "../linked-resources.ts";
-import { TemplateResolverErrors } from "../qualified-names.ts";
 import { type TemplateResourceRow, templateResourcesTable } from "../table.ts";
 import type { TemplateBundle } from "../template-bundle.ts";
+import { deliveryPolicyOf } from "../template-delivery-policy.ts";
 import { readTemplateResource } from "../template-resources.ts";
+import { TemplateResolverErrors } from "../web/qualified-names.ts";
 import { kindSchema, templateSlugSchema } from "./shared.ts";
 import { parseStoredJson, storedRecord } from "./template-gates.ts";
 
@@ -94,7 +96,8 @@ export const exportBundleQuery = defineQueryHandler({
         ? { tenantId: SYSTEM_TENANT_ID, slug, kind, scope: "system", status: "active" }
         : { tenantId: query.user.tenantId, slug, kind, scope: "tenant" },
     );
-    const rows = found
+    const policy = deliveryPolicyOf(ctx.registry);
+    const rows = (await filterDeliveredTo(ctx.db, policy, query.user, found))
       .filter((row) => row.status !== "archived")
       .sort((a, b) => a.locale.localeCompare(b.locale));
     const first = rows[0];

package/packages/bundled-features/src/template-resolver/handlers/find-by-id.query.ts

@@ -2,6 +2,7 @@ import { fetchOne } from "@cosmicdrift/kumiko-framework/db";
 import { defineQueryHandler } from "@cosmicdrift/kumiko-framework/engine";
 import * as z from "zod";
 import { type TemplateResourceRow, templateResourcesTable } from "../table.ts";
+import { deliveryPolicyOf, isRowServedTo } from "../template-delivery-policy.ts";
 import { draftViewerTenantId, isHiddenSystemDraft, toWorkingRow } from "../template-draft.ts";
 import { isSystemOnlyTemplateHiddenFrom } from "../template-system-only.ts";
 
@@ -15,7 +16,7 @@ export const findByIdQuery = defineQueryHandler({
   schema: z.object({ id: z.string().min(1) }),
   access: { roles: ["TenantAdmin", "SystemAdmin", "User"] },
   description:
-    "Reads the version of one template resource an editor works on, by row id: the open draft if there is one (status draft), else the stored version, with content, variable schema and scope, but only when it belongs to the caller's tenant or is a served system default (a never-served system draft is visible to a SystemAdmin only); `active` is the version number and since-time the resolver serves, null when none is served. Use it to load a template into the admin editor.",
+    "Reads the version of one template resource an editor works on, by row id: the open draft if there is one (status draft), else the stored version, with content, variable schema and scope, but only when it belongs to the caller's tenant or is a served system default (an override of a template that is not tenantEditable is not delivered and is visible to a SystemAdmin only) (a never-served system draft is visible to a SystemAdmin only); `active` is the version number and since-time the resolver serves, null when none is served. Use it to load a template into the admin editor.",
   handler: async (query, ctx) => {
     const stored = await fetchOne<TemplateResourceRow>(ctx.db, templateResourcesTable, {
       id: query.payload.id,
@@ -23,7 +24,8 @@ export const findByIdQuery = defineQueryHandler({
     if (
       !stored ||
       isHiddenSystemDraft(query.user, stored) ||
-      isSystemOnlyTemplateHiddenFrom(query.user, ctx.registry, stored)
+      isSystemOnlyTemplateHiddenFrom(query.user, ctx.registry, stored) ||
+      !isRowServedTo(deliveryPolicyOf(ctx.registry), query.user, stored)
     ) {
       return null;
     }