@cosmicdrift/kumiko-samples 0.394.0 → 0.395.0

package/packages/bundled-features/src/template-resolver/web/use-collection-editor-context.ts

@@ -0,0 +1,42 @@
+import { useShellUser } from "@cosmicdrift/kumiko-bundled-features/auth-email-password/web";
+import {
+  type ContentEditorComponent,
+  useAppFeatures,
+  useContentEditor,
+} from "@cosmicdrift/kumiko-renderer";
+import {
+  type ContentCollectionSchema,
+  canWriteContent,
+  findCollection,
+} from "./collection-lookup.ts";
+import type { DocumentToolbarBlock } from "./document-blocks.ts";
+import { documentBlocksForKind } from "./document-toolbar-blocks.ts";
+
+export type CollectionEditorContext = {
+  readonly collection: ContentCollectionSchema | undefined;
+  readonly contentFormat: ContentCollectionSchema["contentFormat"];
+  readonly ContentEditor: ContentEditorComponent;
+  readonly documentBlocks: readonly DocumentToolbarBlock[];
+  /** The collection's fixed variable names with the example value the preview substitutes. */
+  readonly variableExamples: Readonly<Record<string, string>>;
+  readonly variables: readonly string[];
+  readonly canWrite: boolean;
+};
+
+// No collection (the hand-wired text-block tree) → plain editor, no variables.
+export function useCollectionEditorContext(collectionId?: string): CollectionEditorContext {
+  const features = useAppFeatures();
+  const user = useShellUser();
+  const collection = findCollection(features, collectionId);
+  const contentFormat = collection?.contentFormat;
+  const variableExamples = collection?.variableSchema ?? {};
+  return {
+    collection,
+    contentFormat,
+    ContentEditor: useContentEditor(contentFormat),
+    documentBlocks: documentBlocksForKind(collection?.kind),
+    variableExamples,
+    variables: Object.keys(variableExamples),
+    canWrite: canWriteContent(collection, user?.roles),
+  };
+}

package/packages/bundled-features/src/template-resolver/web/use-collection-entry-create.ts

@@ -0,0 +1,92 @@
+import type { TargetRef } from "@cosmicdrift/kumiko-framework/engine";
+import { useLocale, useTranslation } from "@cosmicdrift/kumiko-renderer";
+import { useDispatchTarget } from "@cosmicdrift/kumiko-renderer/web";
+import { useState } from "react";
+import { SLUG_MAX_LENGTH, SLUG_PATTERN } from "./constants.ts";
+import { refreshTree } from "./content-tree-provider.ts";
+import { collectionHandlerName } from "./qualified-names.ts";
+import { useCollectionEditorContext } from "./use-collection-editor-context.ts";
+import { useContentWrite } from "./use-content-write.ts";
+
+type CreateTargetArgs = { collectionId?: string; folder?: string };
+
+function readCreateTargetArgs(target: TargetRef): {
+  readonly collectionId: string | undefined;
+  readonly folder: string | null;
+} {
+  // @cast-boundary visual-tree-args — same de-erasure as the edit resolver; a missing
+  // collectionId (hand-edited URL) leaves the form without a collection to write to.
+  const args = target.args as CreateTargetArgs | undefined;
+  const folder = args?.folder !== undefined && args.folder !== "" ? args.folder : null;
+  return { collectionId: args?.collectionId, folder };
+}
+
+export function useCollectionEntryCreate(target: TargetRef, tenantId: string | undefined) {
+  const { collectionId, folder } = readCreateTargetArgs(target);
+  const t = useTranslation();
+  const locale = useLocale().locale();
+  const dispatchTarget = useDispatchTarget();
+  const editorContext = useCollectionEditorContext(collectionId);
+  const { collection, canWrite } = editorContext;
+  const { submitting, error, writeScoped } = useContentWrite();
+
+  const [slug, setSlug] = useState("");
+  const [title, setTitle] = useState("");
+  const [content, setContent] = useState("");
+
+  const slugValid = slug.length <= SLUG_MAX_LENGTH && SLUG_PATTERN.test(slug);
+  const disabled = submitting || !canWrite || collectionId === undefined;
+  const headerTitle = t("template-resolver.editor.newEntryTitle", {
+    label: collection !== undefined ? t(collection.nav.label) : "",
+  });
+
+  const create = async (): Promise<void> => {
+    // skip: nothing to write to, or the slug is invalid (the field already shows the issue)
+    if (collectionId === undefined || !slugValid) return;
+    const requestedOverride = collection?.ownership === "user" ? undefined : tenantId;
+    const written = await writeScoped(
+      collectionHandlerName(collectionId),
+      {
+        slug,
+        locale,
+        title,
+        content: content.length > 0 ? content : null,
+        folder,
+        createOnly: true,
+      },
+      requestedOverride,
+    );
+    // skip: useContentWrite already set the failure text
+    if (written === null) return;
+    const { response, tenantIdOverride } = written;
+    refreshTree(collectionId);
+    dispatchTarget({
+      featureId: "template-resolver",
+      action: "edit",
+      args: {
+        slug: response.slug,
+        locale: response.locale,
+        collectionId,
+        ...(tenantIdOverride !== undefined && { tenantIdOverride }),
+      },
+    });
+  };
+
+  return {
+    editorContext,
+    headerTitle,
+    slug,
+    setSlug,
+    title,
+    setTitle,
+    content,
+    setContent,
+    slugValid,
+    createDisabled: disabled || !slugValid || title === "",
+    slugInvalid: slug !== "" && !slugValid,
+    disabled,
+    submitting,
+    error,
+    create,
+  };
+}

package/packages/bundled-features/src/template-resolver/web/use-content-write.ts

@@ -0,0 +1,81 @@
+import { dispatcherErrorText, useDispatcher, useTranslation } from "@cosmicdrift/kumiko-renderer";
+import type { DispatcherError } from "@cosmicdrift/kumiko-renderer/headless";
+import { useCallback, useState } from "react";
+import { isTenantOverrideDeniedError } from "./tenant-override.ts";
+
+export type TenantScopedWrite = {
+  readonly response: ContentWriteResponse;
+  /** The override the write was accepted with; undefined after a denied override fell back to the session tenant. */
+  readonly tenantIdOverride: string | undefined;
+};
+
+export type ContentWriteResponse = {
+  readonly slug: string;
+  readonly locale: string;
+  readonly isNew: boolean;
+};
+
+type Translate = (key: string, params?: Readonly<Record<string, unknown>>) => string;
+
+// A validation failure names the offending field with its own message; prefer that over the generic one.
+function writeErrorText(error: DispatcherError, t: Translate): string {
+  const issue = error.details?.fields?.[0];
+  if (issue !== undefined) {
+    const translated = t(issue.i18nKey, issue.params);
+    if (translated !== issue.i18nKey) return translated;
+  }
+  return dispatcherErrorText(error, t) || t("template-resolver.editor.saveFailed");
+}
+
+// Dispatches a content set and keeps the submit state; `write` resolves to the response,
+// or null after the failure text has been set in `error`.
+export function useContentWrite() {
+  const dispatcher = useDispatcher();
+  const t = useTranslation();
+  const [submitting, setSubmitting] = useState(false);
+  const [error, setError] = useState<string | null>(null);
+
+  const writeScoped = async (
+    handler: string,
+    payload: Readonly<Record<string, unknown>>,
+    requestedOverride: string | undefined,
+  ): Promise<TenantScopedWrite | null> => {
+    setSubmitting(true);
+    setError(null);
+    try {
+      let tenantIdOverride = requestedOverride;
+      let result = await dispatcher.write<ContentWriteResponse>(handler, {
+        ...payload,
+        ...(tenantIdOverride !== undefined && { tenantIdOverride }),
+      });
+      if (
+        !result.isSuccess &&
+        tenantIdOverride !== undefined &&
+        isTenantOverrideDeniedError(result.error)
+      ) {
+        tenantIdOverride = undefined;
+        result = await dispatcher.write<ContentWriteResponse>(handler, payload);
+      }
+      if (result.isSuccess) return { response: result.data, tenantIdOverride };
+      setError(writeErrorText(result.error, t));
+      return null;
+    } catch (e) {
+      // Network blip / dispatcher throw — otherwise submitting stays true and
+      // the save button is locked forever with no feedback.
+      setError(e instanceof Error ? e.message : t("template-resolver.editor.networkError"));
+      return null;
+    } finally {
+      setSubmitting(false);
+    }
+  };
+
+  const write = async (
+    handler: string,
+    payload: Readonly<Record<string, unknown>>,
+  ): Promise<ContentWriteResponse | null> =>
+    (await writeScoped(handler, payload, undefined))?.response ?? null;
+
+  const clearError = useCallback(() => setError(null), []);
+
+  return { submitting, error, clearError, write, writeScoped };
+}

package/packages/bundled-features/src/template-resolver/web/use-text-block-editor.ts

@@ -0,0 +1,127 @@
+import type { TargetRef } from "@cosmicdrift/kumiko-framework/engine";
+import { useQuery, useTranslation } from "@cosmicdrift/kumiko-renderer";
+import { useEffect, useState } from "react";
+import { refreshTree, TEXT_BLOCK_TREE_KEY } from "./content-tree-provider.ts";
+import { convertLegacyVariableText } from "./legacy-variable-text.ts";
+import {
+  collectionHandlerName,
+  collectionQueryName,
+  TemplateResolverHandlers,
+  TemplateResolverQueries,
+} from "./qualified-names.ts";
+import { useCollectionEditorContext } from "./use-collection-editor-context.ts";
+import { useContentWrite } from "./use-content-write.ts";
+
+type TextBlock = {
+  readonly slug: string;
+  readonly locale: string;
+  readonly title: string | null;
+  readonly content: string | null;
+  readonly contentFormat: string;
+  readonly folder: string | null;
+  readonly modifiedAt: string | null;
+};
+
+type EditTargetArgs = {
+  slug?: string;
+  locale?: string;
+  collectionId?: string;
+  tenantIdOverride?: string;
+};
+
+export function useTextBlockEditor(target: TargetRef) {
+  // @cast-boundary visual-tree-args — TargetRef.args is erased to
+  // Record<string, unknown>; the resolver knows the action shape (see the
+  // treeActions.edit definition in feature.ts) and de-erases per action, the
+  // same way event payloads do. Optional chaining absorbs missing fields so a
+  // hand-edited URL cannot crash the editor.
+  const args = target.args as EditTargetArgs | undefined;
+  const slug = args?.slug ?? "";
+  const locale = args?.locale ?? "";
+  const tenantIdOverride = args?.tenantIdOverride;
+  // Which collection the node came from. Absent → the public text-block pair,
+  // which is what the hand-wired content tree uses.
+  const collectionId = args?.collectionId;
+
+  const t = useTranslation();
+  const editorContext = useCollectionEditorContext(collectionId);
+  const { contentFormat, canWrite } = editorContext;
+  const { submitting, error: saveError, clearError, write } = useContentWrite();
+
+  // Same split as the tree provider: a node without a collection reads through
+  // the public by-slug, a collection node through that collection's handlers.
+  const readQuery =
+    collectionId === undefined
+      ? TemplateResolverQueries.bySlug
+      : collectionQueryName(collectionId, "item");
+  const writeHandler =
+    collectionId === undefined ? TemplateResolverHandlers.set : collectionHandlerName(collectionId);
+  const {
+    data: loaded,
+    loading,
+    error: loadError,
+  } = useQuery<TextBlock | null>(
+    readQuery,
+    { slug, locale, ...(tenantIdOverride !== undefined && { tenantIdOverride }) },
+    { enabled: slug !== "" && locale !== "" },
+  );
+
+  const [title, setTitle] = useState("");
+  const [content, setContent] = useState("");
+  const [savedMsg, setSavedMsg] = useState<string | null>(null);
+
+  // Sync loaded data into the form state. loaded === null means the block does
+  // not exist yet — empty form for the create flow.
+  // kumiko-lint-ignore no-raw-hooks not yet converted to the framework hook set
+  useEffect(() => {
+    // skip: keep the form untouched until the query settles
+    if (loading) return;
+    const loadedContent = loaded?.content ?? "";
+    setTitle(loaded?.title ?? "");
+    setContent(
+      contentFormat === "document" ? convertLegacyVariableText(loadedContent) : loadedContent,
+    );
+    clearError();
+    setSavedMsg(null);
+  }, [loading, loaded, contentFormat, clearError]);
+
+  const save = async (): Promise<void> => {
+    setSavedMsg(null);
+    const response = await write(writeHandler, {
+      slug,
+      locale,
+      title,
+      content: content.length > 0 ? content : null,
+      folder: loaded?.folder ?? null,
+      // A collection derives its storage format on the server; the public set keeps what was saved.
+      ...(collectionId === undefined &&
+        loaded?.contentFormat !== undefined && { contentFormat: loaded.contentFormat }),
+      ...(tenantIdOverride !== undefined && { tenantIdOverride }),
+    });
+    // skip: useContentWrite already set the failure text
+    if (response === null) return;
+    refreshTree(collectionId ?? TEXT_BLOCK_TREE_KEY);
+    setSavedMsg(
+      response.isNew ? t("template-resolver.editor.created") : t("template-resolver.editor.saved"),
+    );
+  };
+
+  return {
+    slug,
+    locale,
+    editorContext,
+    canWrite,
+    loading,
+    loadError,
+    submitting,
+    saveError,
+    savedMsg,
+    disabled: submitting || loading || !canWrite,
+    saveLabelKey: submitting ? "template-resolver.editor.saving" : "template-resolver.editor.save",
+    title,
+    setTitle,
+    content,
+    setContent,
+    save,
+  };
+}

package/packages/bundled-features/src/tier-engine/changes.json

@@ -1,4 +1,10 @@
 [
+  {
+    "version": "0.395.0",
+    "type": "fix",
+    "title": "The tier resolver no longer keeps tier writes made before its build",
+    "detail": "A tier write that ran before build() cached a feature set without the always-on features, and a later build() left that entry in place, so the tenant got feature_disabled instead of the default fallback. build() now starts from an empty cache and writes before it are not cached."
+  },
   {
     "version": "0.392.0",
     "type": "fix",

package/packages/bundled-features/src/tier-engine/feature.ts

@@ -337,6 +337,7 @@ export function createTierEngineFeature<
       // reload result is applied only while its ticket is still the tenant's latest.
       let ticketCounter = 0;
       const latestTicket = new Map<TenantId, number>();
+      let isBuilt = false;
       const takeTicket = (tenantId: TenantId): number => {
         ticketCounter += 1;
         latestTicket.set(tenantId, ticketCounter);
@@ -370,7 +371,9 @@ export function createTierEngineFeature<
       // bus and re-read the row.
       const applyAssignment = (tenantId: TenantId, tier: string): void => {
         takeTicket(tenantId);
-        cache.set(tenantId, mergeAlwaysOn(alwaysOnHolder.set, featuresForTier(tierMap, tier)));
+        // Before build() the always-on set is empty; a cached entry would outlive into the next build.
+        if (isBuilt)
+          cache.set(tenantId, mergeAlwaysOn(alwaysOnHolder.set, featuresForTier(tierMap, tier)));
         publishAssignmentChange(tenantId);
       };
       onTierAssigned.fn = applyAssignment;
@@ -516,6 +519,11 @@ export function createTierEngineFeature<
             if (feature.toggleableDefault === undefined) computedAlwaysOn.add(feature.name);
           }
           alwaysOnHolder.set = computedAlwaysOn;
+          // One feature instance can serve several stacks in a process; rebuild state from this DB only.
+          // Safe vs. "never clear-then-refill": no request reaches this resolver before build() returns.
+          cache.clear();
+          latestTicket.clear();
+          isBuilt = true;
 
           // Pre-load all existing assignments into the cache. SaaS apps typically
           // have <100k tenants, so a single-pass scan is acceptable. The scaling

package/samples/apps/use-all-bundled/feature-manifest.json

@@ -1793,7 +1793,7 @@
     },
     {
       "name": "managed-pages",
-      "description": "Tenant-editable, server-rendered public pages with per-tenant branding. Stores one Markdown `page` per `(tenantId, slug, lang)` in the `read_pages` entity table with a `published` gate plus `description`/`ogImage` SEO meta. Registers an anonymous `GET {basePath}/:slug` route that resolves the tenant from the request Host via the app-supplied `resolveApexTenant`, serves only published pages (drafts → 404), renders Markdown through the hardened `page-render` core, and isolates per-tenant content with `Vary: Host`. Ships TenantAdmin/SystemAdmin admin screens (`entityList` + `entityEdit`) backed by convention CRUD handlers (`managed-pages:write:page:{create,update,delete}`, `managed-pages:query:page:{list,detail}`); the app wires nav/workspace onto `managed-pages:screen:page-list`. Also exposes `managed-pages:query:by-tenant-published` (anonymous, SQL-filtered on `published`) for sitemap/discovery consumers such as the `seo` feature. Branding (via `config`, scope tenant): `branding-{title,description,site-url,accent-color,logo-url,layout-preset,custom-css}` keys with write-time validation (hex color, https URLs), a `configEdit` self-service screen (`managed-pages:screen:branding-settings`), and a `managed-pages:query:branding` read that the render path applies as scoped `:root` CSS vars + a logo/title header. Also exposes `managed-pages:write:set` (idempotent slug-keyed upsert, SystemAdmin cross-tenant via `tenantIdOverride`) as a provisioning API. Requires `config` + `anonymousAccess` wired at app bootstrap.",
+      "description": "Tenant-editable, server-rendered public pages with per-tenant branding. Stores one `page` (Markdown or editor-document HTML body, per `bodyFormat`) per `(tenantId, slug, lang)` in the `read_pages` entity table with a `published` gate plus `description`/`ogImage` SEO meta. Registers an anonymous `GET {basePath}/:slug` route that resolves the tenant from the request Host via the app-supplied `resolveApexTenant`, serves only published pages (drafts → 404), renders Markdown through the hardened `page-render` core and document bodies through the template-resolver document sanitizer, and isolates per-tenant content with `Vary: Host`. Ships TenantAdmin/SystemAdmin admin screens (`entityList` + `entityEdit`) backed by convention CRUD handlers (`managed-pages:write:page:{create,update,delete}`, `managed-pages:query:page:{list,detail}`); the app wires nav/workspace onto `managed-pages:screen:page-list`. Also exposes `managed-pages:query:by-tenant-published` (anonymous, SQL-filtered on `published`) for sitemap/discovery consumers such as the `seo` feature. Branding (via `config`, scope tenant): `branding-{title,description,site-url,accent-color,logo-url,layout-preset,custom-css}` keys with write-time validation (hex color, https URLs), a `configEdit` self-service screen (`managed-pages:screen:branding-settings`), and a `managed-pages:query:branding` read that the render path applies as scoped `:root` CSS vars + a logo/title header. Also exposes `managed-pages:write:set` (idempotent slug-keyed upsert, SystemAdmin cross-tenant via `tenantIdOverride`) as a provisioning API. Requires `config` + `anonymousAccess` wired at app bootstrap.",
       "toggleableDefault": null,
       "adoptsBundledLists": true,
       "requires": [
@@ -2824,7 +2824,7 @@
     },
     {
       "name": "template-resolver",
-      "description": "Every piece of editable text lives here, in one entity: mail bodies, notification texts, PDF document templates, AI prompts and plain text blocks. What a record is used for is the `kind` (`notification`, `mail`, `mail-layout`, `document-pdf`, `pdf-layout`, `ai-prompt`, `text-block`, `snippet`, `image-snapshot`).\n\nReading is one call — `ctx.templateResolver.resolveTemplate({ tenantId, slug, kind, locale })`. It walks four levels: tenant+locale, system+locale, tenant+fallback-locale, system+fallback-locale. A tenant overrides a system default by simply having its own record; no application code changes. Writing programmatically goes through the `upsertSystem`, `upsertTenant`, `publish` and `archive` write handlers; a SystemAdmin retires or restores a system default with `publishSystem` and `archiveSystem`, and a tenant drops its override with `resetToSystem`. Saving a draft over an active template keeps the active version served and stores the edit beside it (column `draft`); `publish` makes it the served version, `discardDraft` / `discardDraftSystem` throws it away.\n\nEditing templates is for SystemAdmin only. A TenantAdmin edits only the templates the app unlocks at the mount site, `createTemplateResolverFeature({ tenantEditable: [{ kind: \"mail\", slug: \"status-update\", access: { roles: [\"TenantAdmin\"] } }] })`, and every write handler enforces that on the server (override, draft, publish, archive, reset, copy-locale, import, resources, `set`). Each entry carries the `access` roles allowed to edit it, because a bundled feature cannot know the host's roles. The same list decides delivery: a tenant override is served (mail, PDF, layouts, text blocks) only while its template is listed in tenantEditable; otherwise the system version is served. A locked override stays stored, a SystemAdmin sees it in the overview marked as not delivered, and listing the template makes it effective again. Tenant rows of a collection mounted with `access` are always served. A collection mounted without `access` is SystemAdmin only.\n\nText an editor should be able to change belongs in a collection, declared at mount: `createTemplateResolverFeature({ collections: [{ id, kind, access: { roles }, nav }] })`. It appears in the navigation, and `access` is part of the mount because a bundled feature cannot know the host's roles. Each collection gets its own `<id>-list` / `<id>-item` / `<id>-set` handlers, so the dispatcher enforces the separation.\n\nHow a collection is edited follows from `contentFormat`: `plain` gives a text area, `rich` a small WYSIWYG (bold, italic, headings, lists, links), `markdown` a text area that stores markdown text (same insertable chips as `plain`). All three offer the collection's `variableSchema` as insertable chips and a preview rendered with sample data — an editor sees what `{{firstName}}` becomes without sending a mail. An app can register its own editor for a format; the last `clientFeature` that registers a format wins (a conflict logs a warning).\n\nA collection is tenant-wide by default. With `ownership: \"user\"` every user keeps their own entries — mail signatures being the obvious case. Those rows live in the separate `user-content-entry` entity and count as user data, so mounting one also requires the `template-resolver-user-data` feature and a migration on the app side.\n\n`validate` dry-runs the write pipeline for a draft (sanitizer, layout rules, placeholders) and reports what the template uses and misses. `export-bundle` / `import-bundle` (and `import-bundle-system`) move one template with all locales and resource files between tenants or environments; `copy-locale` starts a translation from an existing locale. Layouts are structured: a mail or PDF layout is `data-header` / `data-content` / `data-signature` / `data-footer` regions, and mjml layout source is system-only.\n\n`preview` renders a draft (or the stored template) with sample values taken from the `example` of each declared variable, through the same gates and the same mail renderer as a real send, and returns subject, html, `displayHtml` (the html with cid images as data URIs for an editor), text, attachments (inline images and files) and `checks` (images resolved, plain text present, size under 10 MiB, required placeholders used); nothing is saved or sent. `send-test` mails that rendering to the calling user's own address only, subject prefixed with `[TEST]`, at most 10 per user and hour; it needs `delivery`, `channel-email` and `renderer-mail-html` to be mounted. `send-test-status` tells an editor beforehand whether that send can work for the caller (`canSend`, else `reason` `no_channel` or `no_address`), never returning the address.\n\nImages used by a template (`<img data-resource=\"logo\">`) are uploaded with `resourceUpload`, which re-encodes them, stores a file and links it under the key; `resourceRemove` unlinks it. `linkedResources` is written only through these two handlers. With `purpose: \"attachment\"` and a `fileName`, `resourceUpload` stores a PDF, PNG or JPEG as a file attachment of a mail template (original bytes, at most 10) that the mail renderer attaches after the inline images. `resourceLinkPdf` instead links a `document-pdf` template under a key: every mail sent from the template then carries that PDF, rendered at send time with the mail's own variables and locale, under a file name pattern such as `invoice-{{number}}.pdf`; files and linked PDFs share the limit of 10.\n\nReplaces the former `text-content` feature; its blocks now live here as kind `text-block`.",
+      "description": "Every piece of editable text lives here, in one entity: mail bodies, notification texts, PDF document templates, AI prompts and plain text blocks. What a record is used for is the `kind` (`notification`, `mail`, `mail-layout`, `document-pdf`, `pdf-layout`, `ai-prompt`, `text-block`, `snippet`, `image-snapshot`).\n\nReading is one call — `ctx.templateResolver.resolveTemplate({ tenantId, slug, kind, locale })`. It walks four levels: tenant+locale, system+locale, tenant+fallback-locale, system+fallback-locale. A tenant overrides a system default by simply having its own record; no application code changes. Writing programmatically goes through the `upsertSystem`, `upsertTenant`, `publish` and `archive` write handlers; a SystemAdmin retires or restores a system default with `publishSystem` and `archiveSystem`, and a tenant drops its override with `resetToSystem`. Saving a draft over an active template keeps the active version served and stores the edit beside it (column `draft`); `publish` makes it the served version, `discardDraft` / `discardDraftSystem` throws it away.\n\nEditing templates is for SystemAdmin only. A TenantAdmin edits only the templates the app unlocks at the mount site, `createTemplateResolverFeature({ tenantEditable: [{ kind: \"mail\", slug: \"status-update\", access: { roles: [\"TenantAdmin\"] } }] })`, and every write handler enforces that on the server (override, draft, publish, archive, reset, copy-locale, import, resources, `set`). Each entry carries the `access` roles allowed to edit it, because a bundled feature cannot know the host's roles. The same list decides delivery: a tenant override is served (mail, PDF, layouts, text blocks) only while its template is listed in tenantEditable; otherwise the system version is served. A locked override stays stored, a SystemAdmin sees it in the overview marked as not delivered, and listing the template makes it effective again. Tenant rows of a collection mounted with `access` are always served. A collection mounted without `access` is SystemAdmin only.\n\nText an editor should be able to change belongs in a collection, declared at mount: `createTemplateResolverFeature({ collections: [{ id, kind, access: { roles }, nav }] })`. It appears in the navigation, and `access` is part of the mount because a bundled feature cannot know the host's roles. Each collection gets its own `<id>-list` / `<id>-item` / `<id>-set` handlers, so the dispatcher enforces the separation.\n\nHow a collection is edited follows from `contentFormat`: `plain` gives a text area that stores text, `document` a WYSIWYG document editor that stores sanitized HTML (bold, italic, headings, lists, links, variable chips). Both offer the collection's `variableSchema` as insertable chips and a preview rendered with sample data — an editor sees what `{{firstName}}` becomes without sending a mail. An app can register its own editor for a format; the last `clientFeature` that registers a format wins (a conflict logs a warning).\n\nA collection is tenant-wide by default. With `ownership: \"user\"` every user keeps their own entries — mail signatures being the obvious case. Those rows live in the separate `user-content-entry` entity and count as user data, so mounting one also requires the `template-resolver-user-data` feature and a migration on the app side.\n\n`validate` dry-runs the write pipeline for a draft (sanitizer, layout rules, placeholders) and reports what the template uses and misses. `export-bundle` / `import-bundle` (and `import-bundle-system`) move one template with all locales and resource files between tenants or environments; `copy-locale` starts a translation from an existing locale. Layouts are structured: a mail or PDF layout is `data-header` / `data-content` / `data-signature` / `data-footer` regions, and mjml layout source is system-only.\n\n`preview` renders a draft (or the stored template) with sample values taken from the `example` of each declared variable, through the same gates and the same mail renderer as a real send, and returns subject, html, `displayHtml` (the html with cid images as data URIs for an editor), text, attachments (inline images and files) and `checks` (images resolved, plain text present, size under 10 MiB, required placeholders used); nothing is saved or sent. `send-test` mails that rendering to the calling user's own address only, subject prefixed with `[TEST]`, at most 10 per user and hour; it needs `delivery`, `channel-email` and `renderer-mail-html` to be mounted. `send-test-status` tells an editor beforehand whether that send can work for the caller (`canSend`, else `reason` `no_channel` or `no_address`), never returning the address.\n\nImages used by a template (`<img data-resource=\"logo\">`) are uploaded with `resourceUpload`, which re-encodes them, stores a file and links it under the key; `resourceRemove` unlinks it. `linkedResources` is written only through these two handlers. With `purpose: \"attachment\"` and a `fileName`, `resourceUpload` stores a PDF, PNG or JPEG as a file attachment of a mail template (original bytes, at most 10) that the mail renderer attaches after the inline images. `resourceLinkPdf` instead links a `document-pdf` template under a key: every mail sent from the template then carries that PDF, rendered at send time with the mail's own variables and locale, under a file name pattern such as `invoice-{{number}}.pdf`; files and linked PDFs share the limit of 10.\n\nReplaces the former `text-content` feature; its blocks now live here as kind `text-block`.",
       "toggleableDefault": null,
       "requires": [],
       "optionalRequires": [],

package/samples/apps/use-all-bundled/src/app/client.tsx

@@ -28,6 +28,7 @@ import { featureTogglesClient } from "@cosmicdrift/kumiko-bundled-features/featu
 import { foldersClient } from "@cosmicdrift/kumiko-bundled-features/folders/web";
 import { inboundMailFoundationClient } from "@cosmicdrift/kumiko-bundled-features/inbound-mail-foundation/web";
 import { jobsClient } from "@cosmicdrift/kumiko-bundled-features/jobs/web";
+import { managedPagesClient } from "@cosmicdrift/kumiko-bundled-features/managed-pages/web";
 import { sessionsClient } from "@cosmicdrift/kumiko-bundled-features/sessions/web";
 import { tagsClient } from "@cosmicdrift/kumiko-bundled-features/tags/web";
 import { textBlocksClient } from "@cosmicdrift/kumiko-bundled-features/template-resolver/web";
@@ -100,6 +101,9 @@ createKumikoApp({
   shell: AppShell,
   clientFeatures: [
     localeDeClient(),
+    userDataRightsClient({
+      publicDeletion: { requestPath: "/account/delete", confirmPath: "/account/delete/confirm" },
+    }),
     emailPasswordClient({ mfaVerifyScreen: MfaVerifyScreen }),
     authMfaClient(),
     adminShellClient(),
@@ -113,7 +117,6 @@ createKumikoApp({
     tierEngineClient(),
     capOverviewClient(),
     userProfileClient(),
-    userDataRightsClient(),
     customFieldsClient(),
     foldersClient(),
     inboundMailFoundationClient(),
@@ -122,6 +125,8 @@ createKumikoApp({
     // tag-list management screen (TagManager) + TagSection/TagFilter extension
     // slots + tag i18n. Required for the dev-only notesFeature host to render.
     tagsClient(),
+    // Document editor of the page-edit body section.
+    managedPagesClient(),
     // template-resolver text-block tree + editor under the app-owned "content"
     // nav node. Points at SYSTEM_TENANT because that is where the legal and
     // marketing copy is seeded.

package/samples/apps/use-all-bundled/src/app/seed.ts

@@ -335,7 +335,19 @@ export const seedScreenshotData: SeedFn = async (stack) => {
     slug: "about",
     lang: "en",
     title: "About Acme",
-    body: "# About Acme\n\nWe build calm software.",
+    body: [
+      "# About Acme",
+      "",
+      "We build calm software for small teams. Acme was founded in 2019 in Hamburg and now supports more than 400 companies across Europe.",
+      "",
+      "## What we stand for",
+      "",
+      "- Software that stays out of your way",
+      "- Fair, per-seat pricing without surprises",
+      "- Your data stays in the EU",
+      "",
+      "Read more about how we handle data in our [privacy policy](/legal/privacy).",
+    ].join("\n"),
     published: true,
   });
   await seedPage(stack.db, {

package/samples/apps/use-all-bundled/src/run-config.ts

@@ -316,10 +316,10 @@ export const APP_FEATURES = [
           label: "templateResolver:nav.snippets",
           workspaces: ["admin-shell:workspace:platform"],
         },
-        // rich + variableSchema so the smoke app renders the WYSIWYG with
+        // document + variableSchema so the smoke app renders the WYSIWYG with
         // insertable chips, not just the plain textarea — the preview
         // substitutes these example values for `{{customerName}}` & co.
-        contentFormat: "rich",
+        contentFormat: "document",
         variableSchema: {
           customerName: "Max Mustermann",
           orderId: "A-1042",
@@ -335,7 +335,7 @@ export const APP_FEATURES = [
           label: "templateResolver:nav.signatures",
           workspaces: ["admin-shell:workspace:platform"],
         },
-        contentFormat: "rich",
+        contentFormat: "document",
       },
     ],
   }),
@@ -352,12 +352,18 @@ export const APP_FEATURES = [
   // PUPPETEER_SERVICE_URL + PUPPETEER_AUTH_TOKEN and only asked when a PDF is generated.
   createRendererPuppeteerClientFeature(),
 
-  // managed-pages: requires config (auto-bundled). Smoke resolver never serves
-  // (boot-only). allowCustomCss:true boot-validates the CSS code path + emits
+  // managed-pages: requires config (auto-bundled). Every host resolves to the
+  // dev tenant so the document-editor e2e can read a saved page back from the
+  // public route. allowCustomCss:true boot-validates the CSS code path + emits
   // the branding-custom-css key into the manifest. The managed-pages-css
   // companion toggle is handler-less, has no subpath export, and is recipe-
   // covered — not standalone-mounted here (smoke = one mount per subpath-export).
-  createManagedPagesFeature({ resolveApexTenant: () => null, allowCustomCss: true }),
+  createManagedPagesFeature({
+    // Mapping every host to the dev tenant is for this sample and its e2e only; production maps
+    // its known hosts and returns null for any other.
+    resolveApexTenant: () => DEV_TENANT_ID as TenantId,
+    allowCustomCss: true,
+  }),
 
   // Template overview, layout editor and PDF template editor; needs template-resolver and managed-pages above.
   createDocumentDesignerFeature(),