@cosmicdrift/kumiko-samples 0.387.0 → 0.388.0

package/packages/bundled-features/src/subscription-dodo/verify-webhook.ts

@@ -0,0 +1,262 @@
+// Dodo Payments webhook: Standard Webhooks signature verification plus mapping
+// of Dodo's event envelope onto the foundation's normalized events.
+//
+// Verification always runs against the raw body string; re-serialized JSON
+// would change whitespace and break the HMAC. The signature check happens
+// before any parsing, so no path bypasses it.
+
+import { createHmac, timingSafeEqual } from "node:crypto";
+import {
+  BillingEventKinds,
+  type PaymentEvent,
+  parseProviderConsentId,
+  type SubscriptionEvent,
+  type SubscriptionEventType,
+  SubscriptionEventTypes,
+  type SubscriptionStatus,
+  SubscriptionStatuses,
+} from "@cosmicdrift/kumiko-bundled-features/billing-foundation";
+import type { SecretsContext } from "@cosmicdrift/kumiko-framework/secrets";
+import { parseJsonOrThrow } from "@cosmicdrift/kumiko-framework/utils";
+import { Temporal } from "@cosmicdrift/kumiko-types/temporal";
+import * as z from "zod";
+import { DODO_PROVIDER_NAME } from "./constants.ts";
+import type { DodoWebhookRuntime } from "./runtime.ts";
+
+export const WEBHOOK_TOLERANCE_SECONDS = 300;
+
+const SECRET_PREFIX = "whsec_";
+const SIGNATURE_VERSION = "v1";
+const TIMESTAMP_PATTERN = /^\d+$/;
+
+export type StandardWebhookHeaders = Readonly<Record<string, string>>;
+
+function signatureFor(secretKey: Buffer, signedContent: string): Buffer {
+  return createHmac("sha256", secretKey).update(signedContent).digest();
+}
+
+function matchesAnyV1Signature(header: string, expected: Buffer): boolean {
+  return header.split(" ").some((entry) => {
+    const [version, encoded] = entry.split(",");
+    if (version !== SIGNATURE_VERSION || !encoded) return false;
+    const candidate = Buffer.from(encoded, "base64");
+    return candidate.length === expected.length && timingSafeEqual(candidate, expected);
+  });
+}
+
+/** Throws unless the Standard Webhooks signature over `rawBody` is valid and
+ *  the timestamp is within the tolerance in both directions. */
+export function verifyStandardWebhook(
+  rawBody: string,
+  headers: StandardWebhookHeaders,
+  secret: string,
+  nowSeconds: number,
+): void {
+  const id = headers["webhook-id"];
+  const timestamp = headers["webhook-timestamp"];
+  const signatureHeader = headers["webhook-signature"];
+  if (!id || !timestamp || !signatureHeader) {
+    throw new Error(
+      "subscription-dodo: webhook-id, webhook-timestamp or webhook-signature missing",
+    );
+  }
+  if (!TIMESTAMP_PATTERN.test(timestamp)) {
+    throw new Error("subscription-dodo: webhook-timestamp is not a Unix timestamp in seconds");
+  }
+  if (Math.abs(nowSeconds - Number(timestamp)) > WEBHOOK_TOLERANCE_SECONDS) {
+    throw new Error("subscription-dodo: webhook timestamp outside the tolerance window");
+  }
+  const secretKey = Buffer.from(
+    secret.startsWith(SECRET_PREFIX) ? secret.slice(SECRET_PREFIX.length) : secret,
+    "base64",
+  );
+  const expected = signatureFor(secretKey, `${id}.${timestamp}.${rawBody}`);
+  if (!matchesAnyV1Signature(signatureHeader, expected)) {
+    throw new Error("subscription-dodo: webhook signature verify failed");
+  }
+}
+
+// =============================================================================
+// Event mapping
+// =============================================================================
+
+const DODO_SUBSCRIPTION_EVENT_TYPES: Readonly<Record<string, SubscriptionEventType>> = {
+  "subscription.active": SubscriptionEventTypes.created,
+  "subscription.updated": SubscriptionEventTypes.updated,
+  "subscription.plan_changed": SubscriptionEventTypes.updated,
+  "subscription.paused": SubscriptionEventTypes.updated,
+  "subscription.unpaused": SubscriptionEventTypes.updated,
+  "subscription.update_payment_method": SubscriptionEventTypes.updated,
+  "subscription.renewed": SubscriptionEventTypes.invoicePaid,
+  "subscription.past_due": SubscriptionEventTypes.invoicePaymentFailed,
+  "subscription.on_hold": SubscriptionEventTypes.invoicePaymentFailed,
+  "subscription.cancelled": SubscriptionEventTypes.canceled,
+  "subscription.expired": SubscriptionEventTypes.canceled,
+  "subscription.failed": SubscriptionEventTypes.canceled,
+};
+
+const DODO_SUBSCRIPTION_STATUSES: Readonly<Record<string, SubscriptionStatus>> = {
+  pending: SubscriptionStatuses.incomplete,
+  active: SubscriptionStatuses.active,
+  on_hold: SubscriptionStatuses.pastDue,
+  past_due: SubscriptionStatuses.pastDue,
+  paused: SubscriptionStatuses.pastDue,
+  cancelled: SubscriptionStatuses.canceled,
+  failed: SubscriptionStatuses.canceled,
+  expired: SubscriptionStatuses.canceled,
+};
+
+const PAYMENT_SUCCEEDED = "payment.succeeded";
+
+const metadataSchema = z.record(z.string(), z.unknown()).nullish();
+const customerSchema = z.object({ customer_id: z.string().min(1) });
+
+const envelopeSchema = z.object({
+  type: z.string(),
+  timestamp: z.iso.datetime({ offset: true }),
+  data: z.unknown(),
+});
+
+export const dodoSubscriptionSchema = z.object({
+  subscription_id: z.string().min(1),
+  product_id: z.string().min(1),
+  status: z.string(),
+  customer: customerSchema,
+  metadata: metadataSchema,
+  next_billing_date: z.iso.datetime({ offset: true }),
+  cancel_at_next_billing_date: z.boolean().nullish(),
+});
+export type DodoSubscription = z.infer<typeof dodoSubscriptionSchema>;
+
+const dodoPaymentSchema = z.object({
+  subscription_id: z.string().nullish(),
+  checkout_session_id: z.string().nullish(),
+  customer: customerSchema,
+  metadata: metadataSchema,
+  product_cart: z.array(z.object({ product_id: z.string().min(1) })).nullish(),
+});
+
+function metadataString(metadata: DodoSubscription["metadata"], key: string): string | undefined {
+  const value = metadata?.[key];
+  return typeof value === "string" && value.length > 0 ? value : undefined;
+}
+
+export type MappedDodoSubscriptionState = {
+  readonly status: SubscriptionStatus;
+  readonly tier: string;
+  readonly currentPeriodEnd: string;
+  readonly cancelAt: string | null;
+};
+
+/** Shared by the webhook and retrieveSubscription so both map Dodo state
+ *  identically. Null when the status is unknown or the product is not in
+ *  `priceToTier` (SubscriptionEvent.tier is required). */
+export function mapDodoSubscriptionState(
+  sub: DodoSubscription,
+  priceToTier: Readonly<Record<string, string>>,
+): MappedDodoSubscriptionState | null {
+  const status = DODO_SUBSCRIPTION_STATUSES[sub.status];
+  const tier = priceToTier[sub.product_id];
+  if (!status || !tier) return null;
+  return {
+    status,
+    tier,
+    currentPeriodEnd: sub.next_billing_date,
+    cancelAt: sub.cancel_at_next_billing_date === true ? sub.next_billing_date : null,
+  };
+}
+
+export type DodoWebhookOptions = {
+  readonly priceToTier: Readonly<Record<string, string>>;
+  /** Test seam: Unix seconds. Defaults to the wall clock. */
+  readonly nowSeconds?: () => number;
+};
+
+function currentUnixSeconds(): number {
+  return Math.floor(Temporal.Now.instant().epochMilliseconds / 1000);
+}
+
+function parsePaymentEvent(providerEventId: string, data: unknown): PaymentEvent | null {
+  const parsed = dodoPaymentSchema.safeParse(data);
+  if (!parsed.success) return null;
+  const payment = parsed.data;
+  // A subscription's own payments are covered by its subscription.* events.
+  if (payment.subscription_id) return null;
+  const tenantId = metadataString(payment.metadata, "tenantId");
+  const priceId = payment.product_cart?.[0]?.product_id;
+  if (!tenantId || !priceId) return null;
+  const consentId = parseProviderConsentId(payment.metadata?.["consentId"]);
+  return {
+    kind: BillingEventKinds.payment,
+    providerEventId,
+    providerName: DODO_PROVIDER_NAME,
+    tenantId,
+    ...(consentId !== undefined && { consentId }),
+    ...(payment.checkout_session_id && { providerCheckoutId: payment.checkout_session_id }),
+    providerCustomerId: payment.customer.customer_id,
+    priceId,
+  };
+}
+
+function parseSubscriptionEvent(
+  providerEventId: string,
+  type: SubscriptionEventType,
+  providerEventAt: string,
+  data: unknown,
+  priceToTier: Readonly<Record<string, string>>,
+): SubscriptionEvent | null {
+  const parsed = dodoSubscriptionSchema.safeParse(data);
+  if (!parsed.success) return null;
+  const sub = parsed.data;
+  const tenantId = metadataString(sub.metadata, "tenantId");
+  const state = mapDodoSubscriptionState(sub, priceToTier);
+  if (!tenantId || !state) return null;
+  const consentId = parseProviderConsentId(sub.metadata?.["consentId"]);
+  return {
+    providerEventId,
+    providerName: DODO_PROVIDER_NAME,
+    type,
+    tenantId,
+    ...(consentId !== undefined && { consentId }),
+    providerCustomerId: sub.customer.customer_id,
+    providerSubscriptionId: sub.subscription_id,
+    providerEventAt,
+    ...state,
+  };
+}
+
+export function verifyAndParseDodoWebhook(
+  runtime: DodoWebhookRuntime,
+  options: DodoWebhookOptions,
+): (
+  rawBody: string,
+  headers: Record<string, string>,
+  systemSecrets?: SecretsContext,
+) => Promise<SubscriptionEvent | PaymentEvent | null> {
+  const nowSeconds = options.nowSeconds ?? currentUnixSeconds;
+  return async (rawBody, headers, systemSecrets) => {
+    const secret = await runtime.resolveWebhookSecret(systemSecrets);
+    verifyStandardWebhook(rawBody, headers, secret, nowSeconds());
+
+    // Past verification the body is trusted to be Dodo's; a malformed shape is
+    // schema drift, so it is dropped (200 ignored) instead of answered with a 401.
+    const envelope = envelopeSchema.safeParse(
+      parseJsonOrThrow<unknown>(rawBody, "subscription-dodo webhook body"),
+    );
+    // verifyStandardWebhook has checked webhook-id is present.
+    const providerEventId = headers["webhook-id"];
+    if (!envelope.success || !providerEventId) return null;
+
+    const { type, timestamp, data } = envelope.data;
+    if (type === PAYMENT_SUCCEEDED) return parsePaymentEvent(providerEventId, data);
+    const normalizedType = DODO_SUBSCRIPTION_EVENT_TYPES[type];
+    if (!normalizedType) return null;
+    return parseSubscriptionEvent(
+      providerEventId,
+      normalizedType,
+      timestamp,
+      data,
+      options.priceToTier,
+    );
+  };
+}

package/packages/bundled-features/src/subscription-stripe/changes.json

@@ -1,4 +1,16 @@
 [
+  {
+    "version": "0.388.0",
+    "type": "improvement",
+    "title": "Stripe plugin has a displayName",
+    "detail": "The Stripe plugin sets displayName \"Stripe\", which the provider choice in the billing panel shows."
+  },
+  {
+    "version": "0.388.0",
+    "type": "fix",
+    "title": "A malformed stored credential no longer leaks into the error",
+    "detail": "A stored api-key or webhook-secret that is not valid JSON used to raise the JSON parser's own message, which repeats the value into logs and the webhook 401 body. The error now has a fixed text and names no input. subscription-dodo behaves the same."
+  },
   {
     "version": "0.370.0",
     "type": "improvement",

package/packages/bundled-features/src/subscription-stripe/feature.ts

@@ -250,6 +250,7 @@ export function createSubscriptionStripeFeature(
     const portalConfigurationCache = new Map<string, string>();
 
     const plugin: SubscriptionProviderPlugin = {
+      displayName: "Stripe",
       verifyAndParseWebhook: verifyAndParseStripeWebhook(runtimes.webhook, {
         priceToTier: options.priceToTier ?? {},
       }),

package/packages/bundled-features/src/subscription-stripe/runtime.ts

@@ -33,7 +33,7 @@ import {
 } from "@cosmicdrift/kumiko-framework/engine";
 import { FeatureDisabledError, UnconfiguredError } from "@cosmicdrift/kumiko-framework/errors";
 import type { SecretsContext } from "@cosmicdrift/kumiko-framework/secrets";
-import { parseJsonOrThrow } from "@cosmicdrift/kumiko-framework/utils";
+import { parseJsonSafe } from "@cosmicdrift/kumiko-framework/utils";
 import Stripe from "stripe";
 import { SUBSCRIPTION_STRIPE_FEATURE } from "./constants.ts";
 
@@ -68,13 +68,14 @@ export type StripeRuntimeDeps = {
 // (the un-audited webhook path + the audited ctx read here) therefore returns
 // the JSON-quoted string and must parse it back. The factory fallback is a
 // plain env string and stays raw — so parsing is applied only to the store
-// read, never to the fallback.
+// read, never to the fallback. The error must not carry the input: the JSON
+// parser's own message would repeat the credential into logs and the 401 body.
 function parseStoredSecret(raw: string | undefined): string | undefined {
   if (raw === undefined || raw.length === 0) return undefined;
-  // parseJsonOrThrow is the sanctioned safe-parse (same helper the config
-  // resolver's deserializeValue uses for this very value) — mirrors how the
-  // store round-trips a backing:"secrets" text value.
-  const parsed = parseJsonOrThrow<unknown>(raw, "subscription-stripe credential (backing:secrets)");
+  const parsed = parseJsonSafe<unknown>(raw, undefined);
+  if (parsed === undefined) {
+    throw new Error("subscription-stripe credential (backing:secrets) is not valid JSON");
+  }
   return typeof parsed === "string" && parsed.length > 0 ? parsed : undefined;
 }
 

package/packages/bundled-features/src/template-resolver/api.ts

@@ -158,12 +158,14 @@ export function createTemplateResolverApi(
   };
 }
 
+type DeliveredRowKey = Pick<TemplateResourceRow, "tenantId" | "kind" | "slug">;
+
 // The one delivery rule for a stored row: unlocked, and a collection entry never shadows a system
 // template of the same slug that the app did not unlock.
 export async function isRowDelivered(
   db: DbRunner | TenantDb,
   policy: TemplateDeliveryPolicy,
-  row: TemplateResourceRow,
+  row: DeliveredRowKey,
 ): Promise<boolean> {
   if (!isRowServed(policy, row)) return false;
   if (row.tenantId === SYSTEM_TENANT_ID || !isServedByCollectionOnly(policy, row)) return true;
@@ -174,19 +176,44 @@ export async function isRowDeliveredTo(
   db: DbRunner | TenantDb,
   policy: TemplateDeliveryPolicy,
   user: { readonly roles: readonly string[] },
-  row: TemplateResourceRow,
+  row: DeliveredRowKey,
 ): Promise<boolean> {
   return isSystemAdmin(user) || (await isRowDelivered(db, policy, row));
 }
 
+// One system-slug lookup per kind instead of one query per row, because by-tenant is anonymous.
 export async function filterDeliveredTo(
   db: DbRunner | TenantDb,
   policy: TemplateDeliveryPolicy,
   user: { readonly roles: readonly string[] },
   rows: readonly TemplateResourceRow[],
 ): Promise<TemplateResourceRow[]> {
-  const flags = await Promise.all(rows.map((row) => isRowDeliveredTo(db, policy, user, row)));
-  return rows.filter((_, index) => flags[index]);
+  if (isSystemAdmin(user)) return [...rows];
+  const served = rows.filter((row) => isRowServed(policy, row));
+  const shadowable = served.filter(
+    (row) => row.tenantId !== SYSTEM_TENANT_ID && isServedByCollectionOnly(policy, row),
+  );
+  const slugsByKind = new Map<string, Set<string>>();
+  for (const row of shadowable) {
+    const slugs = slugsByKind.get(row.kind) ?? new Set<string>();
+    slugs.add(row.slug);
+    slugsByKind.set(row.kind, slugs);
+  }
+  const systemKeys = new Set<string>();
+  for (const [kind, slugs] of slugsByKind) {
+    const systemRows = await selectMany<TemplateResourceRow>(db, templateResourcesTable, {
+      tenantId: SYSTEM_TENANT_ID,
+      kind,
+      slug: [...slugs],
+    });
+    for (const systemRow of systemRows) systemKeys.add(`${kind}|${systemRow.slug}`);
+  }
+  return served.filter(
+    (row) =>
+      row.tenantId === SYSTEM_TENANT_ID ||
+      !isServedByCollectionOnly(policy, row) ||
+      !systemKeys.has(`${row.kind}|${row.slug}`),
+  );
 }
 
 export async function systemTemplateExists(

package/packages/bundled-features/src/template-resolver/changes.json

@@ -1,4 +1,52 @@
 [
+  {
+    "version": "0.388.0",
+    "type": "fix",
+    "title": "Template overrides, key collisions and by-tenant queries",
+    "detail": "link-pdf refuses a key that already holds an inline image (key_in_use). by-tenant no longer runs a query per row, tenant-override-counts selects only the needed columns, and tenant-overrides resolves names beyond the first 200 tenants or users through the new ids filter of the tenant and member directories. Notification preference and form-draft cleanup queries bind array parameters as Postgres array literals."
+  },
+  {
+    "version": "0.388.0",
+    "type": "fix",
+    "title": "Re-seeding keeps archived system templates, drops stale drafts and adds only missing bundle locales",
+    "detail": "A boot-time re-seed no longer reactivates an archived system template and clears an open system draft when the seeded content changes. A bundle with resources seeded with ifExists skip imports only the missing locales instead of overwriting existing system rows. copy-locale fails with version_conflict when its source changed between the upload and the transaction, and releases the uploaded files."
+  },
+  {
+    "version": "0.388.0",
+    "type": "fix",
+    "title": "isCollectionRefusedKind is a type predicate",
+    "detail": "isCollectionRefusedKind accepts unknown and narrows to the refused kinds; tier-engine's isTierAssignmentSource shares the isOneOf implementation. Behavior is unchanged."
+  },
+  {
+    "version": "0.388.0",
+    "type": "fix",
+    "title": "Layout usage list matches the overview",
+    "detail": "The usage query of a mail layout filters the mail rows by the caller's visibility like the overview and logs a warning when the 5000-row limit cuts the result."
+  },
+  {
+    "version": "0.388.0",
+    "type": "fix",
+    "title": "Admin views follow the delivery rule of rendering",
+    "detail": "List, find-by-id, diff-to-system, validate, preview and the document base hide a collection row that a locked system template of the same slug shadows, as mail, PDF and the resolver already do."
+  },
+  {
+    "version": "0.388.0",
+    "type": "fix",
+    "title": "Seeded title key must look like a namespace:key",
+    "detail": "seedSystemTemplate rejects a titleI18nKey without a namespace prefix or with whitespace, so free text cannot pass as a key and show up raw in the UI."
+  },
+  {
+    "version": "0.388.0",
+    "type": "fix",
+    "title": "Failing release keeps the upload error",
+    "detail": "When releasing already uploaded files fails after a refused upload in copy-locale or bundle import, the release error is logged and the original error is returned, and the releases run once."
+  },
+  {
+    "version": "0.388.0",
+    "type": "fix",
+    "title": "Mail layout enums and hex color pattern are exported client-side",
+    "detail": "The layout editor imports the width, font, accent line and button style lists plus the hex pattern from the template-resolver web barrel instead of keeping copies, so editor and server validation cannot drift."
+  },
   {
     "version": "0.384.0",
     "type": "improvement",

package/packages/bundled-features/src/template-resolver/compile-document-body.ts

@@ -432,6 +432,7 @@ export function compileDocumentBodyToHandlebars(
     for (const element of Array.from(root.querySelectorAll("div[data-images]"))) {
       rewriteImagesBlock(element, state, options);
     }
+    // Order matters: the conditional wraps first so the row's #each lands inside the #if (evaluated once per list).
     for (const block of Array.from(root.querySelectorAll(`[${DOCUMENT_CONDITION_ATTRIBUTE}]`))) {
       rewriteConditionalBlock(block, state);
     }

package/packages/bundled-features/src/template-resolver/feature.ts

@@ -41,7 +41,7 @@ import {
 } from "./handlers/toggle-status.write.ts";
 import { upsertSystemWrite } from "./handlers/upsert-system.write.ts";
 import { makeUpsertTenantWrite } from "./handlers/upsert-tenant.write.ts";
-import { usageQuery } from "./handlers/usage.query.ts";
+import { makeUsageQuery } from "./handlers/usage.query.ts";
 import { validateQuery } from "./handlers/validate.query.ts";
 import { TEMPLATE_RESOLVER_I18N } from "./i18n.ts";
 import { templateResourceEntity } from "./table.ts";
@@ -181,7 +181,7 @@ export function createTemplateResolverFeature(opts: TemplateResolverOptions = {}
       list: r.queryHandler(listQuery),
       bySlug: r.queryHandler(bySlugQuery),
       byTenant: r.queryHandler(byTenantQuery),
-      usage: r.queryHandler(usageQuery),
+      usage: r.queryHandler(makeUsageQuery(policy)),
       overview: r.queryHandler(makeOverviewQuery(policy)),
       layoutSource: r.queryHandler(layoutSourceQuery),
       tenantOverrides: r.queryHandler(tenantOverridesQuery),

package/packages/bundled-features/src/template-resolver/handlers/bundle-import.ts

@@ -23,6 +23,7 @@ import {
   prepareTemplateResourceBeforeTransaction,
   type Release,
   readTemplateResourceMaxBytes,
+  releaseAfterFailure,
   releaseAll,
 } from "../store-template-resource.ts";
 import { type TemplateResourceRow, templateResourcesTable } from "../table.ts";
@@ -152,14 +153,14 @@ export async function prepareTemplateBundleBeforeTransaction(
             })
           : await prepareTemplateResourceBeforeTransaction(common);
       if (!result.isSuccess) {
-        await releaseAll(releases);
+        await releaseAfterFailure(args.ctx, releases);
         return result;
       }
       if (result.release) releases.push(result.release);
       prepared.set(key, result.data);
     }
   } catch (cause) {
-    await releaseAll(releases);
+    await releaseAfterFailure(args.ctx, releases);
     throw cause;
   }
   return { isSuccess: true, data: prepared, release: () => releaseAll(releases) };

package/packages/bundled-features/src/template-resolver/handlers/copy-locale.write.ts

@@ -11,6 +11,7 @@ import {
   AccessDeniedError,
   NotFoundError,
   ValidationError,
+  VersionConflictError,
   writeFailure,
 } from "@cosmicdrift/kumiko-framework/errors";
 import { isOneOf } from "@cosmicdrift/kumiko-types/type-guards";
@@ -172,13 +173,17 @@ export function makeCopyLocaleWrite(policy: TemplateEditPolicy) {
     beforeTransaction: async (event, ctx) => {
       const request = await checkCopyRequest(ctx, policy, event);
       if (!request.isSuccess) return request;
-      if (!request.data.sourceIsForeign) return { isSuccess: true, data: [] };
-      return prepareLinkedResourceCopiesBeforeTransaction({
+      const { source, tenantId, sourceIsForeign, sourceResources } = request.data;
+      const sourceStamp = { sourceId: source.id, sourceVersion: source.version };
+      if (!sourceIsForeign) return { isSuccess: true, data: { ...sourceStamp, copies: [] } };
+      const prepared = await prepareLinkedResourceCopiesBeforeTransaction({
         ctx,
         user: event.user,
-        tenantId: request.data.tenantId,
-        resources: request.data.sourceResources,
+        tenantId,
+        resources: sourceResources,
       });
+      if (!prepared.isSuccess) return prepared;
+      return { ...prepared, data: { ...sourceStamp, copies: prepared.data } };
     },
     handler: async (event, ctx) => {
       const { slug, kind, toLocale } = event.payload;
@@ -186,6 +191,20 @@ export function makeCopyLocaleWrite(policy: TemplateEditPolicy) {
       if (!request.isSuccess) return request;
       const { scope, tenantId, source, contentFormat, sourceResources, sourceIsForeign } =
         request.data;
+      // The uploads were prepared for the source as it was before the transaction; a source that
+      // changed since (own row created or deleted, edited) no longer matches them.
+      if (
+        event.prepared.sourceId !== source.id ||
+        event.prepared.sourceVersion !== source.version
+      ) {
+        return writeFailure(
+          new VersionConflictError({
+            entityId: source.id,
+            expectedVersion: event.prepared.sourceVersion,
+            currentVersion: source.version,
+          }),
+        );
+      }
 
       const variableSchema = storedRecord(source.variableSchema);
       const written = await writeTemplateRow({
@@ -209,7 +228,10 @@ export function makeCopyLocaleWrite(policy: TemplateEditPolicy) {
       });
       if (!written.isSuccess) return written;
       const resources = sourceIsForeign
-        ? await createLinkedResourceCopies({ ctx, user: event.user, tenantId }, event.prepared)
+        ? await createLinkedResourceCopies(
+            { ctx, user: event.user, tenantId },
+            event.prepared.copies,
+          )
         : { isSuccess: true as const, data: sourceResources };
       if (!resources.isSuccess) return resources;
       const attached = await attachTemplateResources(ctx, {

package/packages/bundled-features/src/template-resolver/handlers/diff-to-system.query.ts

@@ -2,8 +2,9 @@ import { fetchOne } from "@cosmicdrift/kumiko-framework/db";
 import { defineQueryHandler, SYSTEM_TENANT_ID } from "@cosmicdrift/kumiko-framework/engine";
 import { NotFoundError } from "@cosmicdrift/kumiko-framework/errors";
 import * as z from "zod";
+import { isRowDeliveredTo } from "../api.ts";
 import { type TemplateResourceRow, templateResourcesTable } from "../table.ts";
-import { deliveryPolicyOf, isRowServedTo } from "../template-delivery-policy.ts";
+import { deliveryPolicyOf } from "../template-delivery-policy.ts";
 import { isHiddenSystemDraft } from "../template-draft.ts";
 import { buildOverrideDiff } from "./override-diff.ts";
 
@@ -21,7 +22,7 @@ export const diffToSystemQuery = defineQueryHandler({
       !tenantRow ||
       tenantRow.tenantId !== query.user.tenantId ||
       tenantRow.scope !== "tenant" ||
-      !isRowServedTo(deliveryPolicyOf(ctx.registry), query.user, tenantRow)
+      !(await isRowDeliveredTo(ctx.db, deliveryPolicyOf(ctx.registry), query.user, tenantRow))
     ) {
       throw new NotFoundError("template-resource", query.payload.id);
     }

package/packages/bundled-features/src/template-resolver/handlers/document-base.ts

@@ -5,8 +5,9 @@ import {
   SYSTEM_TENANT_ID,
 } from "@cosmicdrift/kumiko-framework/engine";
 import { isPlainObject } from "@cosmicdrift/kumiko-types/type-guards";
+import { isRowDeliveredTo } from "../api.ts";
 import { type TemplateResourceRow, templateResourcesTable } from "../table.ts";
-import { deliveryPolicyOf, isRowServedTo } from "../template-delivery-policy.ts";
+import { deliveryPolicyOf } from "../template-delivery-policy.ts";
 import { isHiddenSystemDraft, toWorkingRow } from "../template-draft.ts";
 import { isSystemOnlyTemplateHiddenFrom } from "../template-system-only.ts";
 import type { DocumentHtmlKind } from "../web/constants.ts";
@@ -50,7 +51,7 @@ export async function loadDocumentBase(
   const ownIsVisible =
     own !== undefined &&
     !isSystemOnlyTemplateHiddenFrom(user, ctx.registry, own) &&
-    isRowServedTo(deliveryPolicyOf(ctx.registry), user, own);
+    (await isRowDeliveredTo(ctx.db, deliveryPolicyOf(ctx.registry), user, own));
   if (own !== undefined && ownIsVisible) {
     const working = toWorkingRow(own, user.tenantId);
     return {

package/packages/bundled-features/src/template-resolver/handlers/find-by-id.query.ts

@@ -1,8 +1,9 @@
 import { fetchOne } from "@cosmicdrift/kumiko-framework/db";
 import { defineQueryHandler } from "@cosmicdrift/kumiko-framework/engine";
 import * as z from "zod";
+import { isRowDeliveredTo } from "../api.ts";
 import { type TemplateResourceRow, templateResourcesTable } from "../table.ts";
-import { deliveryPolicyOf, isRowServedTo } from "../template-delivery-policy.ts";
+import { deliveryPolicyOf } from "../template-delivery-policy.ts";
 import { draftViewerTenantId, isHiddenSystemDraft, toWorkingRow } from "../template-draft.ts";
 import { isSystemOnlyTemplateHiddenFrom } from "../template-system-only.ts";
 
@@ -25,7 +26,7 @@ export const findByIdQuery = defineQueryHandler({
       !stored ||
       isHiddenSystemDraft(query.user, stored) ||
       isSystemOnlyTemplateHiddenFrom(query.user, ctx.registry, stored) ||
-      !isRowServedTo(deliveryPolicyOf(ctx.registry), query.user, stored)
+      !(await isRowDeliveredTo(ctx.db, deliveryPolicyOf(ctx.registry), query.user, stored))
     ) {
       return null;
     }