@cosmicdrift/kumiko-samples 0.386.0 → 0.388.0

package/packages/bundled-features/src/subscription-stripe/verify-webhook.ts

@@ -1,35 +1,34 @@
-// verifyAndParseStripeWebhook — Stripe-spezifische sig-verify +
-// event-mapping. Wird vom Plugin-Build (feature.ts) als
-// `verifyAndParseWebhook` registriert.
+// verifyAndParseStripeWebhook — Stripe-specific signature verification +
+// event mapping. Registered by the plugin build (feature.ts) as
+// `verifyAndParseWebhook`.
 //
 // **Steps:**
-//   1. Sig-verify via stripe.webhooks.constructEvent (HMAC-SHA-256
-//      gegen rawBody + Stripe-Signature-Header). Wirft bei mismatch
-//      oder älter als 5min (Replay-Protection).
+//   1. Verify the signature via stripe.webhooks.constructEvent (HMAC-SHA-256
+//      against rawBody + Stripe-Signature header). Throws on mismatch or
+//      timestamps older than 5 minutes (replay protection).
 //   1b. checkout.session.completed / .async_payment_succeeded branch off
 //       here into a PaymentEvent (one-off-payment, own aggregate) — see
-//       "One-off-payment" section below. Everything else falls through.
-//   2. Event-type-Filter: nur die 5 event-types die wir auf
-//      SubscriptionEventTypes mappen kommen weiter; alles andere
-//      returnt null (foundation antwortet 200 ignored).
-//   3. Stripe-payload → SubscriptionEvent normalisieren
-//      (status-mapping, tenant-id aus metadata, price-to-tier-Lookup).
+//       the "One-off-payment" section below. Everything else falls through.
+//   2. Event-type filter: only the 5 event types mapped to
+//      SubscriptionEventTypes continue; everything else returns null
+//      (the foundation responds with 200 ignored).
+//   3. Normalize the Stripe payload into a SubscriptionEvent
+//      (status mapping, tenant ID from metadata, price-to-tier lookup).
 //
-// **Runtime-keys (pre-tenant):** api-key + webhook-secret kommen NICHT
-// mehr aus einem mount-time-Closure, sondern werden zur Webhook-Zeit aus
-// dem `StripeWebhookRuntime` aufgelöst. Der foundation-webhook-handler
-// reicht einen system-scoped SecretsContext als 3. Arg durch; der runtime
-// liest beide Keys daraus (un-audited, system-internal) mit Fallback auf
-// die factory-options. Damit rotiert ein Key ohne Redeploy — und der
-// invoice-lazy-fetch (unten) nutzt denselben rotierten Client wie der
-// sig-verify, kein split-brain.
+// **Runtime keys (pre-tenant):** the API key and webhook secret no longer
+// come from a mount-time closure; they are resolved from `StripeWebhookRuntime`
+// at webhook time. The foundation webhook handler passes a system-scoped
+// SecretsContext as the third argument; the runtime reads both keys from it
+// (unaudited, system-internal), falling back to the factory options. This
+// allows key rotation without a redeploy, and the invoice lazy-fetch below
+// uses the same rotated client as signature verification, avoiding split-brain.
 //
 // **Invoice-event lazy-fetch:**
-// Invoice payloads carry only the subscription id (Stripe does not expand
-// subscription in webhooks), so the plugin lazy-fetches via
+// Invoice payloads carry only the subscription ID (Stripe does not expand
+// subscriptions in webhooks), so the plugin lazy-fetches via
 // `stripe.subscriptions.retrieve(subId)` to get the full subscription for
 // status/tier/period-end mapping. resource_missing (deleted between webhook
-// and retrieve) returns null; any other Stripe error becomes 503 so Stripe
+// and retrieval) returns null; any other Stripe error becomes 503 so Stripe
 // redelivers.
 
 import type {
@@ -77,18 +76,18 @@ function transientProviderRejection(error: unknown): ExtraRouteRejection {
 // =============================================================================
 
 export type StripeWebhookOptions = {
-  /** Price-to-tier-Map. Plugin liest die price-id aus dem event und
-   *  mapped auf tier-name. Fehlt die price-id im Mapping → null. App-
-   *  spezifisch, bleibt eine factory-option (kein Secret). */
+  /** Price-to-tier map. The plugin reads the price ID from the event and
+   *  maps it to a tier name. Returns null when the price ID is not mapped.
+   *  App-specific and remains a factory option, not a secret. */
   readonly priceToTier: Readonly<Record<string, string>>;
 };
 
 /**
- * Stripe-webhook-handler. Implementiert den Plugin-Contract
- * `verifyAndParseWebhook`. **Pre-tenant-resolution** — kein
- * HandlerContext; statt eines mount-time-Clients löst der `runtime` den
- * Stripe-Client + das webhook-secret zur Call-Zeit aus dem optionalen
- * system-SecretsContext (3. Arg) auf.
+ * Stripe webhook handler implementing the plugin contract
+ * `verifyAndParseWebhook`. **Pre-tenant resolution** — there is no
+ * HandlerContext; instead of using a mount-time client, `runtime` resolves
+ * the Stripe client and webhook secret at call time from the optional
+ * system SecretsContext (third argument).
  */
 export function verifyAndParseStripeWebhook(
   runtime: StripeWebhookRuntime,
@@ -104,16 +103,16 @@ export function verifyAndParseStripeWebhook(
       throw new Error("subscription-stripe: stripe-signature header missing");
     }
 
-    // 0. Runtime-resolve: api-key (für client + lazy-fetch) + webhook-
-    //    secret (für sig-verify) aus system-secrets, Fallback factory-
-    //    options. Wirft wenn beide unkonfiguriert.
+    // 0. Resolve at runtime: obtain the API key (for the client and lazy fetch)
+    //    and webhook secret (for signature verification) from system secrets,
+    //    falling back to the factory options. Throws if neither is configured.
     const { stripe, webhookSecret } = await runtime.resolve(systemSecrets);
 
-    // 1. Sig-verify. constructEvent throws bei mismatch (= invalid sig)
-    //    oder timestamp-tolerance-violation (default 5min). Foundation
-    //    mapped throw → HTTP 401. Applies to BOTH branches below — the
-    //    payment-branch only branches off AFTER this check; there's no
-    //    path that bypasses signature verification.
+    // 1. Verify the signature. constructEvent throws on a mismatch (invalid
+    //    signature) or timestamp-tolerance violation (default: 5 minutes).
+    //    The foundation maps the thrown error to HTTP 401. This applies to
+    //    BOTH branches below: the payment branch is selected only AFTER this
+    //    check, so no path bypasses signature verification.
     let event: Stripe.Event;
     try {
       event = await stripe.webhooks.constructEventAsync(rawBody, sigHeader, webhookSecret);
@@ -131,30 +130,29 @@ export function verifyAndParseStripeWebhook(
       return await parsePaymentEvent(event, stripe);
     }
 
-    // 2. Event-type-Filter — wir kennen nur 5.
+    // 2. Event-type filter — only 5 event types are supported.
     const normalizedType = mapStripeEventType(event.type);
     if (!normalizedType) {
       return null; // foundation returnt 200 ignored
     }
 
-    // 3. Payload-extraction. Stripe liefert je nach event.type
-    //    verschiedene data.object-shapes. Wir extrahieren die
-    //    Subscription-Daten — entweder direkt (subscription-events)
-    //    oder via lazy-fetch (invoice-events).
+    // 3. Extract the payload. Stripe uses different data.object shapes
+    //    depending on event.type. Extract subscription data either directly
+    //    (subscription events) or through a lazy fetch (invoice events).
     const sub = await extractSubscriptionFromEvent(event, stripe);
     if (!sub) {
-      // event-type war unter den 5 (oben gefiltert), aber payload-shape
-      // matched nicht — Stripe-SDK-Schema-Drift, defensive null.
+      // The event type passed the 5-item filter, but its payload shape did not
+      // match — treat this as Stripe SDK schema drift and return null defensively.
       return null;
     }
 
-    // 4. Tenant-resolution aus metadata. App-Builder setzt
-    //    `metadata.tenantId` beim createCheckoutSession-call.
+    // 4. Resolve the tenant from metadata. The app builder sets
+    //    `metadata.tenantId` when calling createCheckoutSession.
     const tenantId = sub.metadata?.["tenantId"];
     if (!tenantId || tenantId.length === 0) {
-      // Subscription ohne tenant-metadata → kann kein subscription
-      // erstellen ohne tenant-resolution. Drop the event silent
-      // (foundation 200 ignored). App-Owner-Bug, nicht foundation-Bug.
+      // A subscription without tenant metadata cannot be created without tenant
+      // resolution. Drop the event silently (the foundation responds with 200
+      // ignored). This is an app-owner error, not a foundation error.
       return null;
     }
 
@@ -218,7 +216,7 @@ export function mapStripeSubscriptionState(
   const periodEndUnixSec = sub.items.data[0]?.current_period_end ?? 0;
   // Stripe returns Unix-seconds; Temporal.Instant.fromEpochMilliseconds
   // expects ms. Multiply, then ISO. (No-Date-API-Guard forbids
-  // `new Date()` — static import above, not the ambient global, see #1490.)
+  // `new Date()` — static import above, not the ambient global.)
   const currentPeriodEnd = Temporal.Instant.fromEpochMilliseconds(
     periodEndUnixSec * 1000,
   ).toString();
@@ -264,9 +262,9 @@ export function mapStripeEventType(stripeType: string): SubscriptionEventType |
   }
 }
 
-/** Stripe-status → normalisiert. Defensive: unbekannte Status →
- *  incomplete (Plugin sollte das nicht erreichen, aber wir wollen
- *  kein ungültiger status-string in der DB). */
+/** Maps Stripe statuses to normalized statuses. Unknown statuses are
+ *  mapped defensively to incomplete; the plugin should not receive them, but
+ *  an invalid status string must not be stored in the database. */
 export function mapStripeStatus(stripeStatus: Stripe.Subscription.Status): SubscriptionStatus {
   switch (stripeStatus) {
     case "active":
@@ -293,9 +291,9 @@ export function mapStripeStatus(stripeStatus: Stripe.Subscription.Status): Subsc
   }
 }
 
-/** Holt die Subscription aus dem Event. Subscription-events haben sie
- *  direkt im data.object; invoice-events haben nur die subscription-id
- *  und brauchen einen lazy-fetch via stripe.subscriptions.retrieve. */
+/** Gets the subscription from the event. Subscription events include it
+ *  directly in data.object; invoice events include only the subscription ID
+ *  and require a lazy fetch via stripe.subscriptions.retrieve. */
 // @wrapper-known semantic-alias
 async function extractSubscriptionFromEvent(
   event: Stripe.Event,
@@ -308,16 +306,16 @@ async function extractSubscriptionFromEvent(
       return event.data.object as Stripe.Subscription; // @cast-boundary engine-bridge
     case StripeEventTypes.invoicePaid:
     case StripeEventTypes.invoicePaymentFailed: {
-      // Lazy-fetch der subscription. invoice.subscription ist eine
-      // string-id (Stripe-Webhooks expanden nicht auto). Wir holen das
-      // full subscription-Object damit der downstream-mapping
-      // (status, tier via priceId, period-end) konsistent funktioniert.
+      // Lazy-fetch the subscription. invoice.subscription is a string ID because
+      // Stripe webhooks do not expand it automatically. Fetch the full
+      // subscription so downstream status, tier via priceId, and period-end
+      // mapping remain consistent.
       const invoice = event.data.object as Stripe.Invoice; // @cast-boundary engine-bridge
       const subRef = (invoice as { subscription?: string | Stripe.Subscription | null }) // @cast-boundary engine-payload
         .subscription;
       if (!subRef) {
-        // Invoice ohne subscription-reference (= one-shot-invoice, nicht
-        // recurring). Nicht unsere Domain — ignorieren.
+        // An invoice without a subscription reference is a one-shot invoice, not a
+        // recurring invoice. It is outside this domain and should be ignored.
         return null;
       }
       const subId = typeof subRef === "string" ? subRef : subRef.id;

package/packages/bundled-features/src/tags/feature.ts

@@ -150,9 +150,9 @@ export type TagsFeatureOptions = {
   /** Row-level ownership on the tag-assignment rows themselves — orthogonal to
    *  `access`, which only gates whether a caller may dispatch assign/remove/list
    *  at all. `ownership.read` is no longer what keeps a caller from reading
-   *  assignments on host entities they can't see: that gate is default-on since
-   *  fw#2766 and derives from the entity's `parentRef`. Use `ownership.read` for
-   *  an ADDITIONAL row rule on the assignment row itself; it is AND-ed with the
+   *  assignments on host entities they can't see: that gate is default-on and
+   *  derives from the entity's `parentRef`. Use `ownership.read` for an
+   *  ADDITIONAL row rule on the assignment row itself; it is AND-ed with the
    *  host-visibility gate, never a replacement for it. Applies only to
    *  `tag-assignment`; the `tag` catalog stays tenant-wide by design.
    *

package/packages/bundled-features/src/tags/screens.ts

@@ -6,7 +6,7 @@ import {
 } from "@cosmicdrift/kumiko-framework/engine";
 import { DEFAULT_TAG_ACCESS, TAGS_EDIT_SCREEN_ID, TAGS_SCREEN_ID } from "./web/constants.ts";
 
-// Declarative catalog screens (Phase-3 / #2312). Access matches create/update/
+// Declarative catalog screens. Access matches create/update/
 // delete so createTagsFeature({ access|roles }) stays consistent. TagManager
 // remains for TagPicker/TagSection — only the standalone admin screen moved.
 

package/packages/bundled-features/src/template-resolver/api.ts

@@ -158,12 +158,14 @@ export function createTemplateResolverApi(
   };
 }
 
+type DeliveredRowKey = Pick<TemplateResourceRow, "tenantId" | "kind" | "slug">;
+
 // The one delivery rule for a stored row: unlocked, and a collection entry never shadows a system
 // template of the same slug that the app did not unlock.
 export async function isRowDelivered(
   db: DbRunner | TenantDb,
   policy: TemplateDeliveryPolicy,
-  row: TemplateResourceRow,
+  row: DeliveredRowKey,
 ): Promise<boolean> {
   if (!isRowServed(policy, row)) return false;
   if (row.tenantId === SYSTEM_TENANT_ID || !isServedByCollectionOnly(policy, row)) return true;
@@ -174,19 +176,44 @@ export async function isRowDeliveredTo(
   db: DbRunner | TenantDb,
   policy: TemplateDeliveryPolicy,
   user: { readonly roles: readonly string[] },
-  row: TemplateResourceRow,
+  row: DeliveredRowKey,
 ): Promise<boolean> {
   return isSystemAdmin(user) || (await isRowDelivered(db, policy, row));
 }
 
+// One system-slug lookup per kind instead of one query per row, because by-tenant is anonymous.
 export async function filterDeliveredTo(
   db: DbRunner | TenantDb,
   policy: TemplateDeliveryPolicy,
   user: { readonly roles: readonly string[] },
   rows: readonly TemplateResourceRow[],
 ): Promise<TemplateResourceRow[]> {
-  const flags = await Promise.all(rows.map((row) => isRowDeliveredTo(db, policy, user, row)));
-  return rows.filter((_, index) => flags[index]);
+  if (isSystemAdmin(user)) return [...rows];
+  const served = rows.filter((row) => isRowServed(policy, row));
+  const shadowable = served.filter(
+    (row) => row.tenantId !== SYSTEM_TENANT_ID && isServedByCollectionOnly(policy, row),
+  );
+  const slugsByKind = new Map<string, Set<string>>();
+  for (const row of shadowable) {
+    const slugs = slugsByKind.get(row.kind) ?? new Set<string>();
+    slugs.add(row.slug);
+    slugsByKind.set(row.kind, slugs);
+  }
+  const systemKeys = new Set<string>();
+  for (const [kind, slugs] of slugsByKind) {
+    const systemRows = await selectMany<TemplateResourceRow>(db, templateResourcesTable, {
+      tenantId: SYSTEM_TENANT_ID,
+      kind,
+      slug: [...slugs],
+    });
+    for (const systemRow of systemRows) systemKeys.add(`${kind}|${systemRow.slug}`);
+  }
+  return served.filter(
+    (row) =>
+      row.tenantId === SYSTEM_TENANT_ID ||
+      !isServedByCollectionOnly(policy, row) ||
+      !systemKeys.has(`${row.kind}|${row.slug}`),
+  );
 }
 
 export async function systemTemplateExists(
@@ -232,20 +259,20 @@ async function fetchTemplate(
     { limit: 1 },
   );
   // @cast-boundary db-row — db.select returnt unbenanntes unknown[],
-  // Row-Shape ist via templateResourcesTable + buildBaseColumns garantiert.
+  // The row shape is guaranteed by templateResourcesTable + buildBaseColumns.
   return (rows[0] as TemplateResourceRow | undefined) ?? null;
 }
 
 function toPublic(row: TemplateResourceRow): TemplateResource {
   // @cast-boundary db-row — Drizzle-Schema typisiert kind/contentFormat/
-  // scope/status als generic text. CHECK-Constraints in der DB schränken
-  // sie auf die Union-Types ein; Cast assertet das Schema-Wissen.
+  // scope/status as generic text. Database CHECK constraints restrict
+  // them to the union types; the cast asserts that schema knowledge.
   const kind = row.kind as TemplateKind;
-  // @cast-boundary db-row — siehe kind.
+  // @cast-boundary db-row — see kind.
   const contentFormat = row.contentFormat as ContentFormat;
-  // @cast-boundary db-row — siehe kind.
+  // @cast-boundary db-row — see kind.
   const scope = row.scope as "system" | "tenant";
-  // @cast-boundary db-row — siehe kind.
+  // @cast-boundary db-row — see kind.
   const status = row.status as "draft" | "active" | "archived";
   const linkedEntries = parseLinkedResourceEntries(row.linkedResources);
   return {
@@ -286,7 +313,7 @@ function parseJson(raw: string | null): Record<string, unknown> {
   try {
     const parsed = JSON.parse(raw);
     // @cast-boundary engine-payload — JSON.parse returnt unknown, typeof-Guard
-    // grenzt auf object ein; Record<string, unknown> ist der minimale common-shape.
+    // narrows it to object; Record<string, unknown> is the minimal common shape.
     return typeof parsed === "object" && parsed !== null ? (parsed as Record<string, unknown>) : {};
   } catch {
     return {};
@@ -302,14 +329,14 @@ export class TemplateNotFoundError extends Error {
   }
 }
 
-// Single point of truth für "dieser Handler braucht template-resolver".
-// Pattern symmetrisch zu requireTextContent.
+// Single source of truth for "this handler requires template-resolver".
+// Pattern symmetric with requireTextContent.
 export function requireTemplateResolver(
   ctx: { readonly templateResolver?: TemplateResolverApi } | object,
   callerName: string,
 ): TemplateResolverApi {
   // @cast-boundary engine-bridge — templateResolver kommt per extraContext
-  // aus App-Bootstrap, Framework-Container kennt das Feld nicht von sich aus.
+  // from App-Bootstrap; the framework container does not know this field on its own.
   const api = (ctx as { templateResolver?: TemplateResolverApi }).templateResolver;
   if (!api) {
     throw new InternalError({

package/packages/bundled-features/src/template-resolver/changes.json

@@ -1,4 +1,52 @@
 [
+  {
+    "version": "0.388.0",
+    "type": "fix",
+    "title": "Template overrides, key collisions and by-tenant queries",
+    "detail": "link-pdf refuses a key that already holds an inline image (key_in_use). by-tenant no longer runs a query per row, tenant-override-counts selects only the needed columns, and tenant-overrides resolves names beyond the first 200 tenants or users through the new ids filter of the tenant and member directories. Notification preference and form-draft cleanup queries bind array parameters as Postgres array literals."
+  },
+  {
+    "version": "0.388.0",
+    "type": "fix",
+    "title": "Re-seeding keeps archived system templates, drops stale drafts and adds only missing bundle locales",
+    "detail": "A boot-time re-seed no longer reactivates an archived system template and clears an open system draft when the seeded content changes. A bundle with resources seeded with ifExists skip imports only the missing locales instead of overwriting existing system rows. copy-locale fails with version_conflict when its source changed between the upload and the transaction, and releases the uploaded files."
+  },
+  {
+    "version": "0.388.0",
+    "type": "fix",
+    "title": "isCollectionRefusedKind is a type predicate",
+    "detail": "isCollectionRefusedKind accepts unknown and narrows to the refused kinds; tier-engine's isTierAssignmentSource shares the isOneOf implementation. Behavior is unchanged."
+  },
+  {
+    "version": "0.388.0",
+    "type": "fix",
+    "title": "Layout usage list matches the overview",
+    "detail": "The usage query of a mail layout filters the mail rows by the caller's visibility like the overview and logs a warning when the 5000-row limit cuts the result."
+  },
+  {
+    "version": "0.388.0",
+    "type": "fix",
+    "title": "Admin views follow the delivery rule of rendering",
+    "detail": "List, find-by-id, diff-to-system, validate, preview and the document base hide a collection row that a locked system template of the same slug shadows, as mail, PDF and the resolver already do."
+  },
+  {
+    "version": "0.388.0",
+    "type": "fix",
+    "title": "Seeded title key must look like a namespace:key",
+    "detail": "seedSystemTemplate rejects a titleI18nKey without a namespace prefix or with whitespace, so free text cannot pass as a key and show up raw in the UI."
+  },
+  {
+    "version": "0.388.0",
+    "type": "fix",
+    "title": "Failing release keeps the upload error",
+    "detail": "When releasing already uploaded files fails after a refused upload in copy-locale or bundle import, the release error is logged and the original error is returned, and the releases run once."
+  },
+  {
+    "version": "0.388.0",
+    "type": "fix",
+    "title": "Mail layout enums and hex color pattern are exported client-side",
+    "detail": "The layout editor imports the width, font, accent line and button style lists plus the hex pattern from the template-resolver web barrel instead of keeping copies, so editor and server validation cannot drift."
+  },
   {
     "version": "0.384.0",
     "type": "improvement",

package/packages/bundled-features/src/template-resolver/compile-document-body.ts

@@ -432,6 +432,7 @@ export function compileDocumentBodyToHandlebars(
     for (const element of Array.from(root.querySelectorAll("div[data-images]"))) {
       rewriteImagesBlock(element, state, options);
     }
+    // Order matters: the conditional wraps first so the row's #each lands inside the #if (evaluated once per list).
     for (const block of Array.from(root.querySelectorAll(`[${DOCUMENT_CONDITION_ATTRIBUTE}]`))) {
       rewriteConditionalBlock(block, state);
     }

package/packages/bundled-features/src/template-resolver/feature.ts

@@ -41,7 +41,7 @@ import {
 } from "./handlers/toggle-status.write.ts";
 import { upsertSystemWrite } from "./handlers/upsert-system.write.ts";
 import { makeUpsertTenantWrite } from "./handlers/upsert-tenant.write.ts";
-import { usageQuery } from "./handlers/usage.query.ts";
+import { makeUsageQuery } from "./handlers/usage.query.ts";
 import { validateQuery } from "./handlers/validate.query.ts";
 import { TEMPLATE_RESOLVER_I18N } from "./i18n.ts";
 import { templateResourceEntity } from "./table.ts";
@@ -181,7 +181,7 @@ export function createTemplateResolverFeature(opts: TemplateResolverOptions = {}
       list: r.queryHandler(listQuery),
       bySlug: r.queryHandler(bySlugQuery),
       byTenant: r.queryHandler(byTenantQuery),
-      usage: r.queryHandler(usageQuery),
+      usage: r.queryHandler(makeUsageQuery(policy)),
       overview: r.queryHandler(makeOverviewQuery(policy)),
       layoutSource: r.queryHandler(layoutSourceQuery),
       tenantOverrides: r.queryHandler(tenantOverridesQuery),

package/packages/bundled-features/src/template-resolver/handlers/bundle-import.ts

@@ -23,6 +23,7 @@ import {
   prepareTemplateResourceBeforeTransaction,
   type Release,
   readTemplateResourceMaxBytes,
+  releaseAfterFailure,
   releaseAll,
 } from "../store-template-resource.ts";
 import { type TemplateResourceRow, templateResourcesTable } from "../table.ts";
@@ -152,14 +153,14 @@ export async function prepareTemplateBundleBeforeTransaction(
             })
           : await prepareTemplateResourceBeforeTransaction(common);
       if (!result.isSuccess) {
-        await releaseAll(releases);
+        await releaseAfterFailure(args.ctx, releases);
         return result;
       }
       if (result.release) releases.push(result.release);
       prepared.set(key, result.data);
     }
   } catch (cause) {
-    await releaseAll(releases);
+    await releaseAfterFailure(args.ctx, releases);
     throw cause;
   }
   return { isSuccess: true, data: prepared, release: () => releaseAll(releases) };

package/packages/bundled-features/src/template-resolver/handlers/copy-locale.write.ts

@@ -11,6 +11,7 @@ import {
   AccessDeniedError,
   NotFoundError,
   ValidationError,
+  VersionConflictError,
   writeFailure,
 } from "@cosmicdrift/kumiko-framework/errors";
 import { isOneOf } from "@cosmicdrift/kumiko-types/type-guards";
@@ -172,13 +173,17 @@ export function makeCopyLocaleWrite(policy: TemplateEditPolicy) {
     beforeTransaction: async (event, ctx) => {
       const request = await checkCopyRequest(ctx, policy, event);
       if (!request.isSuccess) return request;
-      if (!request.data.sourceIsForeign) return { isSuccess: true, data: [] };
-      return prepareLinkedResourceCopiesBeforeTransaction({
+      const { source, tenantId, sourceIsForeign, sourceResources } = request.data;
+      const sourceStamp = { sourceId: source.id, sourceVersion: source.version };
+      if (!sourceIsForeign) return { isSuccess: true, data: { ...sourceStamp, copies: [] } };
+      const prepared = await prepareLinkedResourceCopiesBeforeTransaction({
         ctx,
         user: event.user,
-        tenantId: request.data.tenantId,
-        resources: request.data.sourceResources,
+        tenantId,
+        resources: sourceResources,
       });
+      if (!prepared.isSuccess) return prepared;
+      return { ...prepared, data: { ...sourceStamp, copies: prepared.data } };
     },
     handler: async (event, ctx) => {
       const { slug, kind, toLocale } = event.payload;
@@ -186,6 +191,20 @@ export function makeCopyLocaleWrite(policy: TemplateEditPolicy) {
       if (!request.isSuccess) return request;
       const { scope, tenantId, source, contentFormat, sourceResources, sourceIsForeign } =
         request.data;
+      // The uploads were prepared for the source as it was before the transaction; a source that
+      // changed since (own row created or deleted, edited) no longer matches them.
+      if (
+        event.prepared.sourceId !== source.id ||
+        event.prepared.sourceVersion !== source.version
+      ) {
+        return writeFailure(
+          new VersionConflictError({
+            entityId: source.id,
+            expectedVersion: event.prepared.sourceVersion,
+            currentVersion: source.version,
+          }),
+        );
+      }
 
       const variableSchema = storedRecord(source.variableSchema);
       const written = await writeTemplateRow({
@@ -209,7 +228,10 @@ export function makeCopyLocaleWrite(policy: TemplateEditPolicy) {
       });
       if (!written.isSuccess) return written;
       const resources = sourceIsForeign
-        ? await createLinkedResourceCopies({ ctx, user: event.user, tenantId }, event.prepared)
+        ? await createLinkedResourceCopies(
+            { ctx, user: event.user, tenantId },
+            event.prepared.copies,
+          )
         : { isSuccess: true as const, data: sourceResources };
       if (!resources.isSuccess) return resources;
       const attached = await attachTemplateResources(ctx, {

package/packages/bundled-features/src/template-resolver/handlers/diff-to-system.query.ts

@@ -2,8 +2,9 @@ import { fetchOne } from "@cosmicdrift/kumiko-framework/db";
 import { defineQueryHandler, SYSTEM_TENANT_ID } from "@cosmicdrift/kumiko-framework/engine";
 import { NotFoundError } from "@cosmicdrift/kumiko-framework/errors";
 import * as z from "zod";
+import { isRowDeliveredTo } from "../api.ts";
 import { type TemplateResourceRow, templateResourcesTable } from "../table.ts";
-import { deliveryPolicyOf, isRowServedTo } from "../template-delivery-policy.ts";
+import { deliveryPolicyOf } from "../template-delivery-policy.ts";
 import { isHiddenSystemDraft } from "../template-draft.ts";
 import { buildOverrideDiff } from "./override-diff.ts";
 
@@ -21,7 +22,7 @@ export const diffToSystemQuery = defineQueryHandler({
       !tenantRow ||
       tenantRow.tenantId !== query.user.tenantId ||
       tenantRow.scope !== "tenant" ||
-      !isRowServedTo(deliveryPolicyOf(ctx.registry), query.user, tenantRow)
+      !(await isRowDeliveredTo(ctx.db, deliveryPolicyOf(ctx.registry), query.user, tenantRow))
     ) {
       throw new NotFoundError("template-resource", query.payload.id);
     }

package/packages/bundled-features/src/template-resolver/handlers/document-base.ts

@@ -5,8 +5,9 @@ import {
   SYSTEM_TENANT_ID,
 } from "@cosmicdrift/kumiko-framework/engine";
 import { isPlainObject } from "@cosmicdrift/kumiko-types/type-guards";
+import { isRowDeliveredTo } from "../api.ts";
 import { type TemplateResourceRow, templateResourcesTable } from "../table.ts";
-import { deliveryPolicyOf, isRowServedTo } from "../template-delivery-policy.ts";
+import { deliveryPolicyOf } from "../template-delivery-policy.ts";
 import { isHiddenSystemDraft, toWorkingRow } from "../template-draft.ts";
 import { isSystemOnlyTemplateHiddenFrom } from "../template-system-only.ts";
 import type { DocumentHtmlKind } from "../web/constants.ts";
@@ -50,7 +51,7 @@ export async function loadDocumentBase(
   const ownIsVisible =
     own !== undefined &&
     !isSystemOnlyTemplateHiddenFrom(user, ctx.registry, own) &&
-    isRowServedTo(deliveryPolicyOf(ctx.registry), user, own);
+    (await isRowDeliveredTo(ctx.db, deliveryPolicyOf(ctx.registry), user, own));
   if (own !== undefined && ownIsVisible) {
     const working = toWorkingRow(own, user.tenantId);
     return {

package/packages/bundled-features/src/template-resolver/handlers/find-by-id.query.ts

@@ -1,16 +1,17 @@
 import { fetchOne } from "@cosmicdrift/kumiko-framework/db";
 import { defineQueryHandler } from "@cosmicdrift/kumiko-framework/engine";
 import * as z from "zod";
+import { isRowDeliveredTo } from "../api.ts";
 import { type TemplateResourceRow, templateResourcesTable } from "../table.ts";
-import { deliveryPolicyOf, isRowServedTo } from "../template-delivery-policy.ts";
+import { deliveryPolicyOf } from "../template-delivery-policy.ts";
 import { draftViewerTenantId, isHiddenSystemDraft, toWorkingRow } from "../template-draft.ts";
 import { isSystemOnlyTemplateHiddenFrom } from "../template-system-only.ts";
 
-// Admin-Lookup für UI-Edit-Flow. Returnt das raw Template inkl. draft/
-// archived Status. Tenant-Isolation: User sieht nur Templates des
-// eigenen Tenants oder SYSTEM_TENANT (system-defaults sind public-
-// readable); ctx.db is tenant-scoped for every role, so the check below is defense in depth. Anonymous bleibt aus — Public-
-// Read geht über resolveTemplate aus der API, nicht hier.
+// Admin lookup for the UI editing flow. Returns the raw template, including draft/
+// archived status. Tenant isolation: users see only templates belonging to their own
+// tenant or SYSTEM_TENANT (system defaults are publicly readable); ctx.db is tenant-
+// scoped for every role, so the check below is defense in depth. Anonymous access is
+// excluded—public reads go through resolveTemplate in the API, not here.
 export const findByIdQuery = defineQueryHandler({
   name: "find-by-id",
   schema: z.object({ id: z.string().min(1) }),
@@ -25,7 +26,7 @@ export const findByIdQuery = defineQueryHandler({
       !stored ||
       isHiddenSystemDraft(query.user, stored) ||
       isSystemOnlyTemplateHiddenFrom(query.user, ctx.registry, stored) ||
-      !isRowServedTo(deliveryPolicyOf(ctx.registry), query.user, stored)
+      !(await isRowDeliveredTo(ctx.db, deliveryPolicyOf(ctx.registry), query.user, stored))
     ) {
       return null;
     }