@cosmicdrift/kumiko-samples 0.378.0 → 0.380.0

package/packages/bundled-features/src/template-resolver/handlers/document-base.ts

@@ -5,10 +5,11 @@ import {
   SYSTEM_TENANT_ID,
 } from "@cosmicdrift/kumiko-framework/engine";
 import { isPlainObject } from "@cosmicdrift/kumiko-types/type-guards";
-import type { DocumentHtmlKind } from "../constants.ts";
 import { type TemplateResourceRow, templateResourcesTable } from "../table.ts";
+import { deliveryPolicyOf, isRowServedTo } from "../template-delivery-policy.ts";
 import { isHiddenSystemDraft, toWorkingRow } from "../template-draft.ts";
 import { isSystemOnlyTemplateHiddenFrom } from "../template-system-only.ts";
+import type { DocumentHtmlKind } from "../web/constants.ts";
 import { parseStoredJson } from "./template-gates.ts";
 
 export type DocumentBase = {
@@ -45,7 +46,12 @@ export async function loadDocumentBase(
     tenantId: user.tenantId,
     ...where,
   });
-  if (own !== undefined && !isSystemOnlyTemplateHiddenFrom(user, ctx.registry, own)) {
+  // A locked override is neither shown nor edited by a non-SystemAdmin; the served system default is.
+  const ownIsVisible =
+    own !== undefined &&
+    !isSystemOnlyTemplateHiddenFrom(user, ctx.registry, own) &&
+    isRowServedTo(deliveryPolicyOf(ctx.registry), user, own);
+  if (own !== undefined && ownIsVisible) {
     const working = toWorkingRow(own, user.tenantId);
     return {
       rowId: String(own.id),

package/packages/bundled-features/src/template-resolver/handlers/document-blocks.query.ts

@@ -1,11 +1,11 @@
 import { defineQueryHandler } from "@cosmicdrift/kumiko-framework/engine";
 import { NotFoundError } from "@cosmicdrift/kumiko-framework/errors";
 import * as z from "zod";
-import { DOCUMENT_HTML_KINDS } from "../constants.ts";
-import { documentBlocksForKind } from "../document-blocks.ts";
 import { documentBlocksOf } from "../document-ops.ts";
 import { parseDocumentJson } from "../document-sanitizer.ts";
 import { resolveTemplateVariables } from "../template-validation.ts";
+import { DOCUMENT_HTML_KINDS } from "../web/constants.ts";
+import { documentBlocksForKind } from "../web/document-blocks.ts";
 import { loadDocumentBase } from "./document-base.ts";
 import { localeSchema, templateSlugSchema } from "./shared.ts";
 import { knownResourceKeysFor } from "./validate.query.ts";

package/packages/bundled-features/src/template-resolver/handlers/export-bundle.query.ts

@@ -3,16 +3,18 @@ import { selectMany } from "@cosmicdrift/kumiko-framework/db";
 import { defineQueryHandler, SYSTEM_TENANT_ID } from "@cosmicdrift/kumiko-framework/engine";
 import { NotFoundError, ValidationError } from "@cosmicdrift/kumiko-framework/errors";
 import * as z from "zod";
+import { filterDeliveredTo } from "../api.ts";
 import {
   isFileAttachmentEntry,
   isPdfAttachmentLink,
   type LinkedResourceEntry,
   parseLinkedResourceEntries,
 } from "../linked-resources.ts";
-import { TemplateResolverErrors } from "../qualified-names.ts";
 import { type TemplateResourceRow, templateResourcesTable } from "../table.ts";
 import type { TemplateBundle } from "../template-bundle.ts";
+import { deliveryPolicyOf } from "../template-delivery-policy.ts";
 import { readTemplateResource } from "../template-resources.ts";
+import { TemplateResolverErrors } from "../web/qualified-names.ts";
 import { kindSchema, templateSlugSchema } from "./shared.ts";
 import { parseStoredJson, storedRecord } from "./template-gates.ts";
 
@@ -94,7 +96,8 @@ export const exportBundleQuery = defineQueryHandler({
         ? { tenantId: SYSTEM_TENANT_ID, slug, kind, scope: "system", status: "active" }
         : { tenantId: query.user.tenantId, slug, kind, scope: "tenant" },
     );
-    const rows = found
+    const policy = deliveryPolicyOf(ctx.registry);
+    const rows = (await filterDeliveredTo(ctx.db, policy, query.user, found))
       .filter((row) => row.status !== "archived")
       .sort((a, b) => a.locale.localeCompare(b.locale));
     const first = rows[0];

package/packages/bundled-features/src/template-resolver/handlers/find-by-id.query.ts

@@ -2,6 +2,7 @@ import { fetchOne } from "@cosmicdrift/kumiko-framework/db";
 import { defineQueryHandler } from "@cosmicdrift/kumiko-framework/engine";
 import * as z from "zod";
 import { type TemplateResourceRow, templateResourcesTable } from "../table.ts";
+import { deliveryPolicyOf, isRowServedTo } from "../template-delivery-policy.ts";
 import { draftViewerTenantId, isHiddenSystemDraft, toWorkingRow } from "../template-draft.ts";
 import { isSystemOnlyTemplateHiddenFrom } from "../template-system-only.ts";
 
@@ -15,7 +16,7 @@ export const findByIdQuery = defineQueryHandler({
   schema: z.object({ id: z.string().min(1) }),
   access: { roles: ["TenantAdmin", "SystemAdmin", "User"] },
   description:
-    "Reads the version of one template resource an editor works on, by row id: the open draft if there is one (status draft), else the stored version, with content, variable schema and scope, but only when it belongs to the caller's tenant or is a served system default (a never-served system draft is visible to a SystemAdmin only); `active` is the version number and since-time the resolver serves, null when none is served. Use it to load a template into the admin editor.",
+    "Reads the version of one template resource an editor works on, by row id: the open draft if there is one (status draft), else the stored version, with content, variable schema and scope, but only when it belongs to the caller's tenant or is a served system default (an override of a template that is not tenantEditable is not delivered and is visible to a SystemAdmin only) (a never-served system draft is visible to a SystemAdmin only); `active` is the version number and since-time the resolver serves, null when none is served. Use it to load a template into the admin editor.",
   handler: async (query, ctx) => {
     const stored = await fetchOne<TemplateResourceRow>(ctx.db, templateResourcesTable, {
       id: query.payload.id,
@@ -23,7 +24,8 @@ export const findByIdQuery = defineQueryHandler({
     if (
       !stored ||
       isHiddenSystemDraft(query.user, stored) ||
-      isSystemOnlyTemplateHiddenFrom(query.user, ctx.registry, stored)
+      isSystemOnlyTemplateHiddenFrom(query.user, ctx.registry, stored) ||
+      !isRowServedTo(deliveryPolicyOf(ctx.registry), query.user, stored)
     ) {
       return null;
     }

package/packages/bundled-features/src/template-resolver/handlers/layout-source.query.ts

@@ -1,9 +1,10 @@
 import { selectMany } from "@cosmicdrift/kumiko-framework/db";
 import { defineQueryHandler } from "@cosmicdrift/kumiko-framework/engine";
 import * as z from "zod";
-import { FALLBACK_LOCALE } from "../constants.ts";
+import { filterDeliveredTo } from "../api.ts";
 import { type LayoutRegions, readLayoutRegions } from "../layout-regions.ts";
 import { type TemplateResourceRow, templateResourcesTable } from "../table.ts";
+import { deliveryPolicyOf } from "../template-delivery-policy.ts";
 import {
   type ActiveInfo,
   draftViewerTenantId,
@@ -12,6 +13,7 @@ import {
   type WorkingRow,
 } from "../template-draft.ts";
 import { type MailLayoutMeta, readMailLayoutMeta } from "../template-meta.ts";
+import { FALLBACK_LOCALE } from "../web/constants.ts";
 import { localeSchema, templateSlugSchema } from "./shared.ts";
 import { parseStoredJson } from "./template-gates.ts";
 
@@ -141,10 +143,13 @@ export const layoutSourceQuery = defineQueryHandler({
   handler: async (query, ctx): Promise<LayoutSourceResponse> => {
     const { kind, slug, locale } = query.payload;
     const isSystemAdmin = query.user.roles.includes("SystemAdmin");
-    const rows = await selectMany<TemplateResourceRow>(ctx.db, templateResourcesTable, {
-      kind,
-      slug,
-    });
+    const policy = deliveryPolicyOf(ctx.registry);
+    const rows = await filterDeliveredTo(
+      ctx.db,
+      policy,
+      query.user,
+      await selectMany<TemplateResourceRow>(ctx.db, templateResourcesTable, { kind, slug }),
+    );
     const { tenantRow, systemRow } = pickEditedRows(rows, query.user, locale);
     return buildLayoutSource({ kind, locale, isSystemAdmin, tenantRow, systemRow });
   },

package/packages/bundled-features/src/template-resolver/handlers/list.query.ts

@@ -1,10 +1,11 @@
 import { selectMany } from "@cosmicdrift/kumiko-framework/db";
 import { defineQueryHandler } from "@cosmicdrift/kumiko-framework/engine";
 import * as z from "zod";
-import { TEMPLATE_KINDS, TEMPLATE_STATUSES } from "../constants.ts";
 import { type TemplateResourceRow, templateResourcesTable } from "../table.ts";
+import { deliveryPolicyOf, isRowServedTo } from "../template-delivery-policy.ts";
 import { isHiddenSystemDraft } from "../template-draft.ts";
 import { isSystemOnlyTemplateHiddenFrom } from "../template-system-only.ts";
+import { TEMPLATE_KINDS, TEMPLATE_STATUSES } from "../web/constants.ts";
 
 // ctx.db is tenant-scoped even for SystemAdmin: every caller sees its own
 // tenant's rows plus the system defaults, never another tenant's rows.
@@ -45,11 +46,13 @@ export const listQuery = defineQueryHandler({
       limit: 500,
     })) as TemplateResourceRow[];
 
+    const deliveryPolicy = deliveryPolicyOf(ctx.registry);
     return rows
       .filter(
         (row) =>
           !isHiddenSystemDraft(query.user, row) &&
-          !isSystemOnlyTemplateHiddenFrom(query.user, ctx.registry, row),
+          !isSystemOnlyTemplateHiddenFrom(query.user, ctx.registry, row) &&
+          isRowServedTo(deliveryPolicy, query.user, row),
       )
       .map((row) => ({
         id: String(row.id),

package/packages/bundled-features/src/template-resolver/handlers/overview.query.ts

@@ -1,8 +1,12 @@
 import { selectMany } from "@cosmicdrift/kumiko-framework/db";
 import { defineQueryHandler } from "@cosmicdrift/kumiko-framework/engine";
 import * as z from "zod";
-import { DEFAULT_MAIL_LAYOUT_SLUG, FALLBACK_LOCALE, type TemplateStatus } from "../constants.ts";
 import { type TemplateResourceRow, templateResourcesTable } from "../table.ts";
+import {
+  deliveryPolicyOf,
+  isTenantOverrideServed,
+  type TemplateDeliveryPolicy,
+} from "../template-delivery-policy.ts";
 import {
   activeSinceOf,
   activeVersionOf,
@@ -14,12 +18,18 @@ import {
 import { mayEditTemplate, type TemplateEditPolicy } from "../template-edit-policy.ts";
 import { isSystemOnlyTemplateHiddenFrom } from "../template-system-only.ts";
 import { collectTemplateUsage, type EffectiveMailLayoutSlugs } from "../template-usage.ts";
+import {
+  DEFAULT_MAIL_LAYOUT_SLUG,
+  FALLBACK_LOCALE,
+  type TemplateStatus,
+} from "../web/constants.ts";
 import { storedRecord } from "./template-gates.ts";
 
 const OVERVIEW_KINDS = ["mail", "document-pdf", "mail-layout", "pdf-layout"] as const;
 type OverviewKind = (typeof OVERVIEW_KINDS)[number];
 
 const OVERVIEW_ROW_LIMIT = 5000;
+const LOCKED_OVERRIDE_I18N_KEY = "templateResolver.overview.lockedOverride";
 
 export type OverviewOrigin = "tenant" | "system";
 export type OverviewKindGroup = "mail" | "pdf" | "layout";
@@ -45,6 +55,13 @@ export type OverviewRow = {
   readonly activeSince: string | null;
   readonly systemVersion: number | null;
   readonly layoutSlug: string | null;
+  /** SystemAdmin only: a tenant override is stored but not delivered because the template is not unlocked for tenants. */
+  readonly lockedOverride: boolean;
+  readonly lockedOverrideI18nKey: string | null;
+  /** Tenant row a reset acts on (resetToSystem takes a row id, the overview row is a slug group); set only while a system version exists to fall back to. */
+  readonly lockedOverrideId: string | null;
+  /** False when a locked override has no system version to fall back to, so a reset would be refused. */
+  readonly canResetLockedOverride: boolean;
   readonly modifiedAt: string;
   readonly usedBy: readonly OverviewUsage[];
   readonly usedByCount: number;
@@ -88,23 +105,54 @@ function preferredRow(rows: readonly TemplateResourceRow[]): TemplateResourceRow
   );
 }
 
-type EffectiveRows = { readonly origin: OverviewOrigin; readonly rows: TemplateResourceRow[] };
+type EffectiveRows = {
+  readonly origin: OverviewOrigin;
+  readonly rows: TemplateResourceRow[];
+  readonly lockedOverride: boolean;
+  readonly lockedOverrideId: string | null;
+};
 
-function effectiveRowsOf(rows: readonly TemplateResourceRow[]): EffectiveRows | null {
+// A tenant row of a template that is not unlocked is not delivered, so the system version is the effective one.
+function effectiveRowsOf(
+  rows: readonly TemplateResourceRow[],
+  policy: TemplateDeliveryPolicy,
+): EffectiveRows | null {
   const tenantRows = rows.filter((row) => row.scope === "tenant");
   const systemRows = rows.filter((row) => row.scope === "system");
   const live = (list: TemplateResourceRow[]) => list.filter((row) => row.status !== "archived");
   const liveTenant = live(tenantRows);
-  if (liveTenant.length > 0) return { origin: "tenant", rows: liveTenant };
+  const tenantServed = tenantRows.every((row) => isTenantOverrideServed(policy, row));
+  if (!tenantServed && liveTenant.length > 0) {
+    const liveSystem = live(systemRows);
+    if (systemRows.length === 0)
+      return { origin: "tenant", rows: liveTenant, lockedOverride: true, lockedOverrideId: null };
+    const lockedRow = preferredRow(liveTenant);
+    return {
+      origin: "system",
+      rows: liveSystem.length > 0 ? liveSystem : systemRows,
+      lockedOverride: true,
+      lockedOverrideId: lockedRow === undefined ? null : String(lockedRow.id),
+    };
+  }
+  if (liveTenant.length > 0)
+    return { origin: "tenant", rows: liveTenant, lockedOverride: false, lockedOverrideId: null };
   if (systemRows.length > 0) {
     const liveSystem = live(systemRows);
-    return { origin: "system", rows: liveSystem.length > 0 ? liveSystem : systemRows };
+    return {
+      origin: "system",
+      rows: liveSystem.length > 0 ? liveSystem : systemRows,
+      lockedOverride: false,
+      lockedOverrideId: null,
+    };
   }
-  return tenantRows.length > 0 ? { origin: "tenant", rows: tenantRows } : null;
+  return tenantRows.length > 0
+    ? { origin: "tenant", rows: tenantRows, lockedOverride: false, lockedOverrideId: null }
+    : null;
 }
 
 export function effectiveMailLayoutSlugs(
   rows: readonly TemplateResourceRow[],
+  policy: TemplateDeliveryPolicy,
 ): EffectiveMailLayoutSlugs {
   const byLocale = new Map<string, TemplateResourceRow[]>();
   for (const row of rows) {
@@ -114,7 +162,10 @@ export function effectiveMailLayoutSlugs(
   }
   const bySlug = new Map<string, Map<string, string>>();
   for (const group of byLocale.values()) {
-    const effective = effectiveRowsOf(group)?.rows[0];
+    const effectiveRows = effectiveRowsOf(group, policy);
+    // A locked tenant row without a system row is not delivered, so it names no layout.
+    if (effectiveRows?.lockedOverride && effectiveRows.origin === "tenant") continue;
+    const effective = effectiveRows?.rows[0];
     // All-archived: the renderer falls back to the code-registered template.
     if (effective === undefined || effective.status === "archived") continue;
     const locales = bySlug.get(effective.slug) ?? new Map<string, string>();
@@ -191,6 +242,7 @@ function versionFieldsOf(
 function buildDrafts(
   groups: ReadonlyMap<string, readonly TemplateResourceRow[]>,
   user: { readonly tenantId: string; readonly roles: readonly string[] },
+  policy: TemplateDeliveryPolicy,
 ): {
   readonly drafts: OverviewDraft[];
   readonly layoutSlugByDocument: Map<string, string>;
@@ -198,7 +250,7 @@ function buildDrafts(
   const layoutSlugByDocument = new Map<string, string>();
   const drafts: OverviewDraft[] = [];
   for (const [id, groupRows] of groups) {
-    const effective = effectiveRowsOf(groupRows);
+    const effective = effectiveRowsOf(groupRows, policy);
     const preferred = effective === null ? undefined : preferredRow(effective.rows);
     if (effective === null || preferred === undefined) continue;
     if (!isOverviewKind(preferred.kind) || !isTemplateStatus(preferred.status)) continue;
@@ -218,6 +270,10 @@ function buildDrafts(
       status: preferred.status,
       ...versionFieldsOf(user, preferred, groupRows),
       layoutSlug,
+      lockedOverride: effective.lockedOverride,
+      lockedOverrideI18nKey: effective.lockedOverride ? LOCKED_OVERRIDE_I18N_KEY : null,
+      lockedOverrideId: effective.lockedOverrideId,
+      canResetLockedOverride: effective.lockedOverrideId !== null,
       modifiedAt: modifiedAtOf(preferred),
     });
   }
@@ -287,7 +343,7 @@ export function makeOverviewQuery(policy: TemplateEditPolicy) {
     }),
     access: { roles: ["TenantAdmin", "SystemAdmin"] },
     description:
-      "Lists mail, PDF and layout templates as one row per slug and kind for the caller's tenant (optionally only the mails and PDFs using one layout slug): where the effective version comes from (own override or system), its locales, status and version (the served one; `draftVersion` is set when an unpublished draft waits beside it, `activeSince` says since when the served version applies), the system version it overrides, the layout it uses and which notifications or templates use it; templates of notifications registered with `systemOnly` are listed for SystemAdmins only, and a TenantAdmin sees only the templates the app lists in tenantEditable; use it to browse and filter all templates at a glance.",
+      "Lists mail, PDF and layout templates as one row per slug and kind for the caller's tenant (optionally only the mails and PDFs using one layout slug): where the effective version comes from (own override or system), its locales, status and version (the served one; `draftVersion` is set when an unpublished draft waits beside it, `activeSince` says since when the served version applies), the system version it overrides, the layout it uses and which notifications or templates use it; templates of notifications registered with `systemOnly` are listed for SystemAdmins only, and a TenantAdmin sees only the templates the app lists in tenantEditable; a tenant override of a template that is not listed is not delivered, so the row shows the system version with `lockedOverride` true (SystemAdmin only); use it to browse and filter all templates at a glance.",
     handler: async (query, ctx) => {
       const payload = query.payload;
       const fetchedRows = await selectMany<TemplateResourceRow>(
@@ -310,11 +366,13 @@ export function makeOverviewQuery(policy: TemplateEditPolicy) {
           !isSystemOnlyTemplateHiddenFrom(query.user, ctx.registry, row) &&
           mayEditTemplate(policy, query.user, row),
       );
+      const deliveryPolicy = deliveryPolicyOf(ctx.registry);
       const { drafts, layoutSlugByDocument } = buildDrafts(
         groupBySlugAndKind(visibleRows),
         query.user,
+        deliveryPolicy,
       );
-      const effectiveLayouts = effectiveMailLayoutSlugs(visibleRows);
+      const effectiveLayouts = effectiveMailLayoutSlugs(visibleRows, deliveryPolicy);
       const overviewRows = drafts.map((draft) =>
         withUsage(draft, layoutSlugByDocument, ctx.registry, effectiveLayouts),
       );

package/packages/bundled-features/src/template-resolver/handlers/patch-draft.write.ts

@@ -7,7 +7,6 @@ import {
   writeFailure,
 } from "@cosmicdrift/kumiko-framework/errors";
 import * as z from "zod";
-import { DOCUMENT_HTML_KINDS } from "../constants.ts";
 import { applyDocumentOps, documentOpsSchema } from "../document-ops.ts";
 import { parseDocumentJson, serializeDocumentJson } from "../document-sanitizer.ts";
 import {
@@ -16,6 +15,7 @@ import {
   templateEditAccess,
 } from "../template-edit-policy.ts";
 import { resolveTemplateVariables } from "../template-validation.ts";
+import { DOCUMENT_HTML_KINDS } from "../web/constants.ts";
 import { loadDocumentBase } from "./document-base.ts";
 import { localeSchema, templateSlugSchema } from "./shared.ts";
 import { writeTemplateRow } from "./template-write.ts";

package/packages/bundled-features/src/template-resolver/handlers/resource-shared.ts

@@ -1,6 +1,6 @@
 import type { TenantId } from "@cosmicdrift/kumiko-framework/engine";
 import * as z from "zod";
-import { isDocumentResourceKey } from "../document-schema.ts";
+import { isDocumentResourceKey } from "../web/document-schema.ts";
 
 export const RESOURCE_MAX_BYTES_CONFIG_KEY = "template-resolver:config:resource-max-bytes";
 export const DEFAULT_RESOURCE_MAX_BYTES = 2 * 1024 * 1024;

package/packages/bundled-features/src/template-resolver/handlers/resource-upload.write.ts

@@ -15,7 +15,6 @@ import {
   readFileRefContent,
 } from "../../file-foundation/index.ts";
 import { attachmentFileNameSchema } from "../../shared/index.ts";
-import { TemplateResolverErrors } from "../qualified-names.ts";
 import {
   type PreparedTemplateFile,
   prepareTemplateAttachmentBeforeTransaction,
@@ -31,6 +30,7 @@ import {
   type TemplateEditPolicy,
   templateEditAccess,
 } from "../template-edit-policy.ts";
+import { TemplateResolverErrors } from "../web/qualified-names.ts";
 import { RESOURCE_PURPOSES, resourceKeySchema, resourceTargetTenantId } from "./resource-shared.ts";
 
 type AttachmentTarget = {

package/packages/bundled-features/src/template-resolver/handlers/send-test.write.ts

@@ -1,14 +1,14 @@
 import { defineWriteHandler } from "@cosmicdrift/kumiko-framework/engine";
 import { UnprocessableError, writeFailure } from "@cosmicdrift/kumiko-framework/errors";
 import * as z from "zod";
-import { TEST_MAIL_SUBJECT_PREFIX } from "../constants.ts";
-import { TemplateResolverErrors } from "../qualified-names.ts";
 import {
   refuseTemplateEdit,
   type TemplateEditPolicy,
   templateEditAccess,
 } from "../template-edit-policy.ts";
 import { renderTemplatePreview } from "../template-preview.ts";
+import { TEST_MAIL_SUBJECT_PREFIX } from "../web/constants.ts";
+import { TemplateResolverErrors } from "../web/qualified-names.ts";
 import {
   emailChannelOf,
   resolveTestMailAddress,

package/packages/bundled-features/src/template-resolver/handlers/set.write.ts

@@ -7,7 +7,6 @@ import {
 import { isOneOf } from "@cosmicdrift/kumiko-types/type-guards";
 import * as z from "zod";
 import { requireForTenant } from "../../shared/index.ts";
-import { TEMPLATE_KINDS, TEXT_BLOCK_KIND, UPSERT_KINDS } from "../constants.ts";
 import { type TemplateResourceRow, templateResourcesTable } from "../table.ts";
 import {
   refuseTemplateEdit,
@@ -15,6 +14,7 @@ import {
   templateEditAccess,
 } from "../template-edit-policy.ts";
 import { resolveTemplateVariables } from "../template-validation.ts";
+import { TEMPLATE_KINDS, TEXT_BLOCK_KIND, UPSERT_KINDS } from "../web/constants.ts";
 import { contentFormatSchema, executor, folderSchema, localeSchema, slugSchema } from "./shared.ts";
 import { parseStoredJson, storedRecord } from "./template-gates.ts";
 import { gateTemplateWrite } from "./template-write.ts";

package/packages/bundled-features/src/template-resolver/handlers/shared.ts

@@ -1,8 +1,8 @@
 import { createEventStoreExecutor } from "@cosmicdrift/kumiko-framework/db";
 import * as z from "zod";
-import { CONTENT_FORMATS, TEMPLATE_STATUSES, UPSERT_KINDS } from "../constants.ts";
 import { templateResourceEntity, templateResourcesTable } from "../table.ts";
 import { templateSlugSchema } from "../template-meta.ts";
+import { CONTENT_FORMATS, TEMPLATE_STATUSES, UPSERT_KINDS } from "../web/constants.ts";
 
 // One executor per bundle, shared by all four handlers for create/update via
 // event store + optimistic lock.

package/packages/bundled-features/src/template-resolver/handlers/template-gates.ts

@@ -1,12 +1,6 @@
 import type { Registry, TemplateVariables } from "@cosmicdrift/kumiko-framework/engine";
 import type { FieldIssue } from "@cosmicdrift/kumiko-framework/errors";
 import { isOneOf } from "@cosmicdrift/kumiko-types/type-guards";
-import {
-  CONTENT_FORMATS,
-  type ContentFormat,
-  TEMPLATE_KINDS,
-  type TemplateKind,
-} from "../constants.ts";
 import { documentViolationsToFieldIssues } from "../document-sanitizer.ts";
 import { sanitizeTemplateWriteBody, type TemplateWriteScope } from "../layout-regions.ts";
 import { imageResourceKeysOf } from "../linked-resources.ts";
@@ -17,6 +11,12 @@ import {
   type TemplateValidation,
   validateTemplatePlaceholders,
 } from "../template-validation.ts";
+import {
+  CONTENT_FORMATS,
+  type ContentFormat,
+  TEMPLATE_KINDS,
+  type TemplateKind,
+} from "../web/constants.ts";
 
 const PLACEHOLDER_VALIDATED_KINDS: ReadonlySet<TemplateKind> = new Set([
   "mail",

package/packages/bundled-features/src/template-resolver/handlers/template-write.ts

@@ -16,13 +16,13 @@ import {
   writeFailure,
 } from "@cosmicdrift/kumiko-framework/errors";
 import { requireForTenant } from "../../shared/index.ts";
-import type { ContentFormat, TemplateKind } from "../constants.ts";
 import type { TemplateWriteScope } from "../layout-regions.ts";
-import { TemplateResolverErrors } from "../qualified-names.ts";
 import { type TemplateResourceRow, templateResourcesTable } from "../table.ts";
 import { activationChanges, serializeTemplateDraft } from "../template-draft.ts";
 import { isSystemOnlyTemplate } from "../template-system-only.ts";
 import type { TemplateValidation } from "../template-validation.ts";
+import type { ContentFormat, TemplateKind } from "../web/constants.ts";
+import { TemplateResolverErrors } from "../web/qualified-names.ts";
 import { executor } from "./shared.ts";
 import {
   evaluateTemplateWrite,

package/packages/bundled-features/src/template-resolver/handlers/usage.query.ts

@@ -1,10 +1,11 @@
 import { selectMany } from "@cosmicdrift/kumiko-framework/db";
 import { defineQueryHandler } from "@cosmicdrift/kumiko-framework/engine";
 import * as z from "zod";
-import { TEMPLATE_KINDS } from "../constants.ts";
 import { type TemplateResourceRow, templateResourcesTable } from "../table.ts";
+import { deliveryPolicyOf } from "../template-delivery-policy.ts";
 import { templateSlugSchema } from "../template-meta.ts";
 import { collectTemplateUsage } from "../template-usage.ts";
+import { TEMPLATE_KINDS } from "../web/constants.ts";
 import { effectiveMailLayoutSlugs } from "./overview.query.ts";
 
 const MAIL_ROW_LIMIT = 5000;
@@ -25,7 +26,12 @@ export const usageQuery = defineQueryHandler({
       { limit: MAIL_ROW_LIMIT },
     );
     return {
-      usedBy: collectTemplateUsage(ctx.registry, slug, kind, effectiveMailLayoutSlugs(mailRows)),
+      usedBy: collectTemplateUsage(
+        ctx.registry,
+        slug,
+        kind,
+        effectiveMailLayoutSlugs(mailRows, deliveryPolicyOf(ctx.registry)),
+      ),
     };
   },
 });

package/packages/bundled-features/src/template-resolver/handlers/validate.query.ts

@@ -6,12 +6,13 @@ import {
   SYSTEM_TENANT_ID,
 } from "@cosmicdrift/kumiko-framework/engine";
 import * as z from "zod";
-import type { ContentFormat, UpsertKind } from "../constants.ts";
 import type { TemplateWriteScope } from "../layout-regions.ts";
 import { imageResourceKeysOf } from "../linked-resources.ts";
 import { type TemplateResourceRow, templateResourcesTable } from "../table.ts";
+import { deliveryPolicyOf, isRowServedTo } from "../template-delivery-policy.ts";
 import { isSystemAdmin } from "../template-draft.ts";
 import { resolveTemplateVariables, systemPlaceholdersFor } from "../template-validation.ts";
+import type { ContentFormat, UpsertKind } from "../web/constants.ts";
 import { contentFormatSchema, kindSchema, localeSchema, templateSlugSchema } from "./shared.ts";
 import { evaluateTemplateWrite } from "./template-gates.ts";
 
@@ -67,7 +68,8 @@ export async function knownResourceKeysFor(
       scope: "system",
       locale,
     })),
-    ...(scope === "tenant"
+    ...(scope === "tenant" &&
+    isRowServedTo(deliveryPolicyOf(ctx.registry), user, { tenantId: user.tenantId, kind, slug })
       ? await knownResourceKeys(ctx.db, { tenantId: user.tenantId, slug, kind, scope, locale })
       : []),
   ];

package/packages/bundled-features/src/template-resolver/i18n.ts

@@ -0,0 +1,25 @@
+import { handlerTitleKey } from "@cosmicdrift/kumiko-framework/engine";
+import { TemplateResolverHandlers as H } from "./web/qualified-names.ts";
+
+// The AI assistant and its approval prompts name a handler by its title key; without
+// one the user reads the raw handler name. de/es/fr/it live in the locale packages.
+export const TEMPLATE_RESOLVER_I18N: Readonly<Record<string, { readonly en: string }>> = {
+  [handlerTitleKey(H.upsertSystem)]: { en: "Save system template" },
+  [handlerTitleKey(H.upsertTenant)]: { en: "Save template" },
+  [handlerTitleKey(H.publish)]: { en: "Publish template" },
+  [handlerTitleKey(H.archive)]: { en: "Archive template" },
+  [handlerTitleKey(H.publishSystem)]: { en: "Publish system template" },
+  [handlerTitleKey(H.archiveSystem)]: { en: "Archive system template" },
+  [handlerTitleKey(H.discardDraft)]: { en: "Discard draft" },
+  [handlerTitleKey(H.discardDraftSystem)]: { en: "Discard system template draft" },
+  [handlerTitleKey(H.resetToSystem)]: { en: "Reset to system template" },
+  [handlerTitleKey(H.set)]: { en: "Save text" },
+  [handlerTitleKey(H.importBundle)]: { en: "Import template" },
+  [handlerTitleKey(H.importBundleSystem)]: { en: "Import system template" },
+  [handlerTitleKey(H.copyLocale)]: { en: "Copy template to another language" },
+  [handlerTitleKey(H.resourceUpload)]: { en: "Upload image or attachment" },
+  [handlerTitleKey(H.resourceRemove)]: { en: "Remove image or attachment" },
+  [handlerTitleKey(H.resourceLinkPdf)]: { en: "Attach PDF template" },
+  [handlerTitleKey(H.sendTest)]: { en: "Send test mail" },
+  [handlerTitleKey(H.patchDraft)]: { en: "Edit template draft" },
+};