@cosmicdrift/kumiko-samples 0.394.0 → 0.396.0

package/packages/bundled-features/src/managed-pages/seeding.ts

@@ -15,6 +15,8 @@ import {
 } from "@cosmicdrift/kumiko-framework/engine";
 import { runEventStoreSeed, type SeedIfExists } from "@cosmicdrift/kumiko-framework/seeding";
 
+import { type BodyFormat, DEFAULT_BODY_FORMAT } from "./constants.ts";
+import { sanitizePageBody } from "./handlers/page-body-issues.ts";
 import { type PageRow, pageEntity, pagesTable } from "./table.ts";
 
 const executor = createEventStoreExecutor(pagesTable, pageEntity, { entityName: "page" });
@@ -25,6 +27,7 @@ export type SeedPageOptions = {
   readonly lang: string;
   readonly title: string;
   readonly body?: string | null;
+  readonly bodyFormat?: BodyFormat;
   readonly description?: string | null;
   readonly ogImage?: string | null;
   readonly published?: boolean;
@@ -53,6 +56,12 @@ export async function seedPage(db: DbConnection, opts: SeedPageOptions): Promise
   const description = opts.description ?? null;
   const ogImage = opts.ogImage ?? null;
   const published = opts.published ?? false;
+  const bodyFormat = opts.bodyFormat ?? DEFAULT_BODY_FORMAT;
+  const sanitized = sanitizePageBody(opts.body, bodyFormat);
+  if (!sanitized.ok) {
+    throw new Error(`seedPage rejected the body: ${JSON.stringify(sanitized.issues)}`);
+  }
+  const { body } = sanitized;
 
   return runEventStoreSeed({
     existing,
@@ -63,7 +72,8 @@ export async function seedPage(db: DbConnection, opts: SeedPageOptions): Promise
           slug: opts.slug,
           lang: opts.lang,
           title: opts.title,
-          body: opts.body ?? null,
+          body,
+          bodyFormat,
           description,
           ogImage,
           published,
@@ -90,7 +100,8 @@ export async function seedPage(db: DbConnection, opts: SeedPageOptions): Promise
           version: row.version,
           changes: {
             title: opts.title,
-            body: opts.body ?? null,
+            body,
+            bodyFormat,
             description,
             ogImage,
             published,

package/packages/bundled-features/src/managed-pages/table.ts

@@ -2,12 +2,14 @@ import { buildEntityTable } from "@cosmicdrift/kumiko-framework/db";
 import {
   createBooleanField,
   createEntity,
+  createSelectField,
   createTextField,
 } from "@cosmicdrift/kumiko-framework/engine";
+import { BODY_FORMATS, type BodyFormat, DEFAULT_BODY_FORMAT } from "./constants.ts";
 
 // Page — a tenant-editable, server-rendered public page (landing,
 // about, custom). Exactly one row per (tenantId, slug, lang). The body is
-// Markdown, rendered securely on the server via page-render. `published`
+// Markdown or an editor document (bodyFormat), rendered securely on the server. `published`
 // gates delivery to anonymous visitors: drafts return 404. description and
 // ogImage support SEO and social previews. SYSTEM_TENANT_ID is used for
 // app-wide pages; otherwise the page belongs to the tenant resolved from the
@@ -15,7 +17,7 @@ import {
 export const pageEntity = createEntity({
   table: "read_pages",
   description:
-    "One tenant-editable public web page, unique per slug and language, holding a markdown body plus the title, SEO description and OG image, with a published flag that decides whether anonymous visitors are served it or get a 404.",
+    "One tenant-editable public web page, unique per slug and language, holding a markdown or document (HTML) body plus the title, SEO description and OG image, with a published flag that decides whether anonymous visitors are served it or get a 404.",
   fields: {
     slug: createTextField({
       required: true,
@@ -51,6 +53,7 @@ export const pageEntity = createEntity({
       personal: false,
       reason: "is_business_data",
     }),
+    bodyFormat: createSelectField({ options: BODY_FORMATS, default: DEFAULT_BODY_FORMAT }),
     description: createTextField({ maxLength: 500, personal: false, reason: "is_business_data" }),
     ogImage: createTextField({ maxLength: 2000, personal: false, reason: "is_business_data" }),
     published: createBooleanField({ default: false }),
@@ -71,6 +74,7 @@ export type PageRow = {
   readonly lang: string;
   readonly title: string;
   readonly body: string | null;
+  readonly bodyFormat: BodyFormat | null;
   readonly description: string | null;
   readonly ogImage: string | null;
   readonly published: boolean;

package/packages/bundled-features/src/managed-pages/web/client-plugin.tsx

@@ -1,12 +1,13 @@
-// Client feature factory for managed-pages. It provides ONLY translations —
-// the screens (page-list/page-edit/branding-settings) are schema-driven
-// (entityList/entityEdit/configEdit), so no custom React components are
-// registered. Apps mount it in createKumikoApp({ clientFeatures:
+// Client feature factory for managed-pages: translations plus the page-body
+// extension section (document editor) of the page-edit screen. The screens
+// themselves are schema-driven. Apps mount it in createKumikoApp({ clientFeatures:
 // [managedPagesClient()] }) so the admin labels render translated.
 
 import { mergeTranslations, type TranslationsByLocale } from "@cosmicdrift/kumiko-renderer";
 import type { ClientFeatureDefinition } from "@cosmicdrift/kumiko-renderer/web";
+import { PAGE_BODY_EXTENSION_NAME } from "./constants.ts";
 import { defaultTranslations } from "./default-translations.ts";
+import { PageBodySection } from "./page-body-section.tsx";
 
 export type ManagedPagesClientOptions = {
   /** Key-wise overrides of the default bundles (de/en). */
@@ -17,5 +18,6 @@ export function managedPagesClient(options?: ManagedPagesClientOptions): ClientF
   return {
     name: "managed-pages",
     translations: mergeTranslations(defaultTranslations, options?.translations ?? {}),
+    extensionSectionComponents: { [PAGE_BODY_EXTENSION_NAME]: PageBodySection },
   };
 }

package/packages/bundled-features/src/managed-pages/web/constants.ts

@@ -0,0 +1,14 @@
+import { isOneOf } from "@cosmicdrift/kumiko-types/type-guards";
+
+// Pure data shared by the server (screen, handlers, render) and the client plugin.
+export const PAGE_BODY_EXTENSION_NAME = "managed-pages:page-body";
+
+export const BODY_FORMATS = ["markdown", "document"] as const;
+export type BodyFormat = (typeof BODY_FORMATS)[number];
+
+// Rows and events written before bodyFormat existed carry no value.
+export const DEFAULT_BODY_FORMAT: BodyFormat = "markdown";
+
+export function effectiveBodyFormat(value: unknown): BodyFormat {
+  return isOneOf(BODY_FORMATS, value) ? value : DEFAULT_BODY_FORMAT;
+}

package/packages/bundled-features/src/managed-pages/web/i18n.ts

@@ -50,6 +50,19 @@ export const MANAGED_PAGES_I18N: Readonly<Record<string, LocalizedString>> = {
   "managed-pages:section.body": { en: "Content" },
   "managed-pages:branding.section.identity": { en: "Identity" },
 
+  // Document body: write-time rejection and the Markdown conversion warning
+  "managed-pages.errors.document.rejected": {
+    en: "The content contains elements that are not allowed: {detail}",
+  },
+  "managed-pages:body.lossy.warning": {
+    en: "This page was written in Markdown. Converting it to the editor drops: {features}. Check the result before saving.",
+  },
+  "managed-pages:body.lossy.image": { en: "images" },
+  "managed-pages:body.lossy.blockquote": { en: "block quotes" },
+  "managed-pages:body.lossy.code": { en: "code" },
+  "managed-pages:body.lossy.deepHeading": { en: "headings below level 3" },
+  "managed-pages:body.lossy.relativeLink": { en: "relative links" },
+
   // Row-Actions + Confirm (pageListScreen)
   "managed-pages:actions.edit": { en: "Edit" },
   "managed-pages:actions.delete": { en: "Delete" },

package/packages/bundled-features/src/managed-pages/web/lossy-markdown.ts

@@ -0,0 +1,71 @@
+import { isAllowedDocumentLinkHref } from "@cosmicdrift/kumiko-bundled-features/template-resolver/document-schema";
+import { Lexer, type Token } from "marked";
+
+export const LOSSY_MARKDOWN_FEATURES = [
+  "image",
+  "blockquote",
+  "code",
+  "deepHeading",
+  "relativeLink",
+] as const;
+export type LossyMarkdownFeature = (typeof LOSSY_MARKDOWN_FEATURES)[number];
+
+// The document editor has no image, quote or code nodes, only three heading
+// levels, and links must pass the document link policy (absolute http(s),
+// mailto, tel, placeholders).
+const MAX_DOCUMENT_HEADING_DEPTH = 3;
+
+function tokenList(value: unknown): readonly Token[] {
+  return Array.isArray(value) ? value : [];
+}
+
+function childTokens(token: Token): readonly Token[] {
+  const nested = [...tokenList("tokens" in token ? token.tokens : undefined)];
+  if (token.type === "list") nested.push(...tokenList("items" in token ? token.items : undefined));
+  return nested;
+}
+
+function isDeepHeading(token: Token): boolean {
+  return (
+    "depth" in token && typeof token.depth === "number" && token.depth > MAX_DOCUMENT_HEADING_DEPTH
+  );
+}
+
+function isRelativeLink(token: Token): boolean {
+  return (
+    "href" in token && typeof token.href === "string" && !isAllowedDocumentLinkHref(token.href)
+  );
+}
+
+function featuresOf(token: Token): readonly LossyMarkdownFeature[] {
+  switch (token.type) {
+    case "image":
+      return ["image"];
+    case "blockquote":
+      return ["blockquote"];
+    case "code":
+    case "codespan":
+      return ["code"];
+    case "heading":
+      return isDeepHeading(token) ? ["deepHeading"] : [];
+    case "link":
+      return isRelativeLink(token) ? ["relativeLink"] : [];
+    default:
+      return [];
+  }
+}
+
+function collect(tokens: readonly Token[], found: Set<LossyMarkdownFeature>): void {
+  for (const token of tokens) {
+    for (const feature of featuresOf(token)) found.add(feature);
+    collect(childTokens(token), found);
+  }
+}
+
+// Lexer options match the renderer used for conversion (gfm off), so the
+// warning lists exactly what the converted HTML loses.
+export function detectLossyMarkdown(markdown: string): readonly LossyMarkdownFeature[] {
+  const found = new Set<LossyMarkdownFeature>();
+  collect(new Lexer({ gfm: false, breaks: false }).lex(markdown), found);
+  return LOSSY_MARKDOWN_FEATURES.filter((feature) => found.has(feature));
+}

package/packages/bundled-features/src/managed-pages/web/markdown-to-document.ts

@@ -0,0 +1,27 @@
+import { isAllowedDocumentLinkHref } from "@cosmicdrift/kumiko-bundled-features/template-resolver/document-schema";
+import { escapeHtml } from "@cosmicdrift/kumiko-renderer/headless";
+import { Marked } from "marked";
+
+// The server sanitizer rejects what it cannot keep, so the conversion drops it up front and the
+// lossy banner stays true: a link outside the document link policy keeps its text, an image
+// (no uploaded resource to point at) is dropped, and raw HTML is shown as text.
+const converter = new Marked({ gfm: false, breaks: false });
+converter.use({
+  renderer: {
+    html({ text }) {
+      return escapeHtml(text);
+    },
+    link({ href, tokens }) {
+      return isAllowedDocumentLinkHref(href) ? false : this.parser.parseInline(tokens);
+    },
+    image() {
+      return "";
+    },
+  },
+});
+
+export function markdownToDocumentHtml(markdown: string): string {
+  const html = converter.parse(markdown, { async: false });
+  if (typeof html !== "string") throw new Error("marked returned a promise for a sync parse");
+  return html;
+}

package/packages/bundled-features/src/managed-pages/web/page-body-section.tsx

@@ -0,0 +1,73 @@
+import {
+  type ExtensionSectionProps,
+  usePrimitives,
+  useTranslation,
+} from "@cosmicdrift/kumiko-renderer";
+import { type ReactNode, useMemo, useState } from "react";
+import { DocumentContentEditor } from "../../template-resolver/web/index.ts";
+import { effectiveBodyFormat } from "./constants.ts";
+import { detectLossyMarkdown, type LossyMarkdownFeature } from "./lossy-markdown.ts";
+import { markdownToDocumentHtml } from "./markdown-to-document.ts";
+
+const LOSSY_LABEL_KEYS: Readonly<Record<LossyMarkdownFeature, string>> = {
+  image: "managed-pages:body.lossy.image",
+  blockquote: "managed-pages:body.lossy.blockquote",
+  code: "managed-pages:body.lossy.code",
+  deepHeading: "managed-pages:body.lossy.deepHeading",
+  relativeLink: "managed-pages:body.lossy.relativeLink",
+};
+
+const BODY_EDITOR_ID = "managed-pages-page-body";
+
+function stringValue(value: unknown): string {
+  return typeof value === "string" ? value : "";
+}
+
+// A Markdown body is converted for display only: nothing is patched until the
+// user edits, so merely opening a page never turns it into a document.
+export function PageBodySection({ values, patch }: ExtensionSectionProps): ReactNode {
+  const t = useTranslation();
+  const { Banner } = usePrimitives();
+  const body = stringValue(values?.["body"]);
+  const isMarkdown = effectiveBodyFormat(values?.["bodyFormat"]) === "markdown";
+  const [editedHtml, setEditedHtml] = useState<string | null>(null);
+  const [lossyAtFirstEdit, setLossyAtFirstEdit] = useState<readonly LossyMarkdownFeature[] | null>(
+    null,
+  );
+
+  const pristine = editedHtml === null;
+  const convertedHtml = useMemo(
+    () => (isMarkdown ? markdownToDocumentHtml(body) : body),
+    [isMarkdown, body],
+  );
+  const liveLossy = useMemo(
+    () => (pristine && isMarkdown ? detectLossyMarkdown(body) : []),
+    [pristine, isMarkdown, body],
+  );
+  const lossy = lossyAtFirstEdit ?? liveLossy;
+
+  const handleChange = (next: string): void => {
+    if (pristine) setLossyAtFirstEdit(liveLossy);
+    setEditedHtml(next);
+    patch?.({ body: next, bodyFormat: "document" });
+  };
+
+  return (
+    <>
+      {lossy.length > 0 && (
+        <Banner variant="warning">
+          {t("managed-pages:body.lossy.warning", {
+            features: lossy.map((feature) => t(LOSSY_LABEL_KEYS[feature])).join(", "),
+          })}
+        </Banner>
+      )}
+      <DocumentContentEditor
+        id={BODY_EDITOR_ID}
+        value={editedHtml ?? convertedHtml}
+        onChange={handleChange}
+        variables={[]}
+        readOnly={false}
+      />
+    </>
+  );
+}

package/packages/bundled-features/src/template-resolver/README.md

@@ -232,8 +232,8 @@ including SSE refresh, and an editor target with the `collectionId`. The app pas
 under an unmounted feature causes boot to fail instead of silently disappearing from the sidebar. Node
 visibility follows `access` unless `nav.access` specifies otherwise.
 
-A "+" on the node requires an explicit `nav.createAction`, whose target is usually
-`treeHandle.create`; without it, the collection only lists existing items. `nav.actions` adds hover actions to the row.
+A "+" on the node opens the built-in create form (`template-resolver:create`) unless
+`nav.createAction` points elsewhere, usually at `treeHandle.create`. `nav.actions` adds hover actions to the row.
 
 Saving **publishes immediately**, with status `active` and an empty `variableSchema`.
 Anyone who needs a draft stage or a variable schema uses

package/packages/bundled-features/src/template-resolver/changes.json

@@ -1,4 +1,12 @@
 [
+  {
+    "version": "0.395.0",
+    "type": "breaking",
+    "title": "Content collections edit in plain or document format; rich and markdown are gone",
+    "detail": "ContentEditorFormat is \"plain\" | \"document\". RichContentEditor and the old tiptap editor are removed from @cosmicdrift/kumiko-renderer/web; the document editor is DocumentContentEditor from @cosmicdrift/kumiko-bundled-features/template-resolver/web. A collection's storage format comes from its declaration on the server (plain stores plain, document stores html sanitized with sanitizeDocumentHtml for every collection kind) and the collection write no longer takes contentFormat. Saved content with {{name}} as text opens with variable nodes. Every collection gets a create form behind a \"+\" in its nav (unless it declares its own createAction); the collection write takes createOnly and answers an existing slug with the field error slug_exists. The text block editor and the secrets edit screen use FormScreenLayout, which takes an optional unsavedCount. useDispatchTarget is exported from @cosmicdrift/kumiko-renderer/web.",
+    "migration": "Run bun kumiko-upgrade --apply. It rewrites contentFormat \"rich\" and \"markdown\" in collection declarations to \"document\". Replace imports of RichContentEditor with DocumentContentEditor from @cosmicdrift/kumiko-bundled-features/template-resolver/web, and drop contentFormat from collection write payloads.",
+    "codemod": "scripts/codemod/content-collection-format.ts"
+  },
   {
     "version": "0.394.0",
     "type": "fix",

package/packages/bundled-features/src/template-resolver/document-sanitizer.ts

@@ -299,6 +299,18 @@ function isSanitizedHtmlKind(kind: string): boolean {
   return kind === "snippet" || isOneOf(DOCUMENT_HTML_KINDS, kind);
 }
 
+type SanitizeBodyInput = {
+  readonly kind: string;
+  readonly contentFormat: ContentFormat;
+  readonly content: string | null;
+  /** A document collection stores html whatever its kind, so its html is always rebuilt. */
+  readonly alwaysSanitizeHtml?: boolean;
+};
+
+function isSanitizedBody(input: SanitizeBodyInput): boolean {
+  return input.alwaysSanitizeHtml === true || isSanitizedHtmlKind(input.kind);
+}
+
 const HTML_ONLY_KINDS: ReadonlySet<string> = new Set(DOCUMENT_HTML_KINDS);
 
 function requiredFormatViolation(
@@ -319,14 +331,10 @@ const IMAGES_BLOCK_KIND = "document-pdf";
 
 // The node is part of the shared document model, so a mail body would keep it after the
 // rebuild; only a PDF resolves the record's images.
-function imagesBlockViolation(input: {
-  readonly kind: string;
-  readonly contentFormat: ContentFormat;
-  readonly content: string | null;
-}): DocumentViolation | null {
+function imagesBlockViolation(input: SanitizeBodyInput): DocumentViolation | null {
   if (
     input.kind === IMAGES_BLOCK_KIND ||
-    !isSanitizedHtmlKind(input.kind) ||
+    !isSanitizedBody(input) ||
     input.contentFormat !== "html" ||
     input.content === null
   ) {
@@ -345,20 +353,12 @@ function imagesBlockViolation(input: {
     : null;
 }
 
-export function sanitizeTemplateBody(input: {
-  readonly kind: string;
-  readonly contentFormat: ContentFormat;
-  readonly content: string | null;
-}): SanitizeBodyResult {
+export function sanitizeTemplateBody(input: SanitizeBodyInput): SanitizeBodyResult {
   const formatViolation = requiredFormatViolation(input.kind, input.contentFormat);
   if (formatViolation !== null) return { ok: false, violations: [formatViolation] };
   const imagesViolation = imagesBlockViolation(input);
   if (imagesViolation !== null) return { ok: false, violations: [imagesViolation] };
-  if (
-    !isSanitizedHtmlKind(input.kind) ||
-    input.contentFormat !== "html" ||
-    input.content === null
-  ) {
+  if (!isSanitizedBody(input) || input.contentFormat !== "html" || input.content === null) {
     return { ok: true, content: input.content };
   }
   const result = sanitizeDocumentHtml(input.content);

package/packages/bundled-features/src/template-resolver/feature.ts

@@ -2,6 +2,7 @@ import {
   type ContentCollectionDefinition,
   createSystemConfig,
   defineFeature,
+  type TreeAction,
 } from "@cosmicdrift/kumiko-framework/engine";
 import { bySlugQuery } from "./handlers/by-slug.query.ts";
 import { byTenantQuery } from "./handlers/by-tenant.query.ts";
@@ -109,6 +110,14 @@ function assertTenantEditableValid(entries: readonly TenantEditableTemplate[]):
   }
 }
 
+function newEntryAction(collectionId: string): TreeAction {
+  return {
+    icon: "plus",
+    label: "template-resolver.editor.newEntry",
+    target: { featureId: "template-resolver", action: "create", args: { collectionId } },
+  };
+}
+
 export function createTemplateResolverFeature(opts: TemplateResolverOptions = {}) {
   const collections = opts.collections ?? [];
   assertCollectionKindsAllowed(collections);
@@ -129,7 +138,7 @@ export function createTemplateResolverFeature(opts: TemplateResolverOptions = {}
         "Reading is one call — `ctx.templateResolver.resolveTemplate({ tenantId, slug, kind, locale })`. It walks four levels: tenant+locale, system+locale, tenant+fallback-locale, system+fallback-locale. A tenant overrides a system default by simply having its own record; no application code changes. Writing programmatically goes through the `upsertSystem`, `upsertTenant`, `publish` and `archive` write handlers; a SystemAdmin retires or restores a system default with `publishSystem` and `archiveSystem`, and a tenant drops its override with `resetToSystem`. Saving a draft over an active template keeps the active version served and stores the edit beside it (column `draft`); `publish` makes it the served version, `discardDraft` / `discardDraftSystem` throws it away.",
         'Editing templates is for SystemAdmin only. A TenantAdmin edits only the templates the app unlocks at the mount site, `createTemplateResolverFeature({ tenantEditable: [{ kind: "mail", slug: "status-update", access: { roles: ["TenantAdmin"] } }] })`, and every write handler enforces that on the server (override, draft, publish, archive, reset, copy-locale, import, resources, `set`). Each entry carries the `access` roles allowed to edit it, because a bundled feature cannot know the host\'s roles. The same list decides delivery: a tenant override is served (mail, PDF, layouts, text blocks) only while its template is listed in tenantEditable; otherwise the system version is served. A locked override stays stored, a SystemAdmin sees it in the overview marked as not delivered, and listing the template makes it effective again. Tenant rows of a collection mounted with `access` are always served. A collection mounted without `access` is SystemAdmin only.',
         "Text an editor should be able to change belongs in a collection, declared at mount: `createTemplateResolverFeature({ collections: [{ id, kind, access: { roles }, nav }] })`. It appears in the navigation, and `access` is part of the mount because a bundled feature cannot know the host's roles. Each collection gets its own `<id>-list` / `<id>-item` / `<id>-set` handlers, so the dispatcher enforces the separation.",
-        "How a collection is edited follows from `contentFormat`: `plain` gives a text area, `rich` a small WYSIWYG (bold, italic, headings, lists, links), `markdown` a text area that stores markdown text (same insertable chips as `plain`). All three offer the collection's `variableSchema` as insertable chips and a preview rendered with sample data — an editor sees what `{{firstName}}` becomes without sending a mail. An app can register its own editor for a format; the last `clientFeature` that registers a format wins (a conflict logs a warning).",
+        "How a collection is edited follows from `contentFormat`: `plain` gives a text area that stores text, `document` a WYSIWYG document editor that stores sanitized HTML (bold, italic, headings, lists, links, variable chips). Both offer the collection's `variableSchema` as insertable chips and a preview rendered with sample data — an editor sees what `{{firstName}}` becomes without sending a mail. An app can register its own editor for a format; the last `clientFeature` that registers a format wins (a conflict logs a warning).",
         'A collection is tenant-wide by default. With `ownership: "user"` every user keeps their own entries — mail signatures being the obvious case. Those rows live in the separate `user-content-entry` entity and count as user data, so mounting one also requires the `template-resolver-user-data` feature and a migration on the app side.',
         "`validate` dry-runs the write pipeline for a draft (sanitizer, layout rules, placeholders) and reports what the template uses and misses. `export-bundle` / `import-bundle` (and `import-bundle-system`) move one template with all locales and resource files between tenants or environments; `copy-locale` starts a translation from an existing locale. Layouts are structured: a mail or PDF layout is `data-header` / `data-content` / `data-signature` / `data-footer` regions, and mjml layout source is system-only.",
         "`preview` renders a draft (or the stored template) with sample values taken from the `example` of each declared variable, through the same gates and the same mail renderer as a real send, and returns subject, html, `displayHtml` (the html with cid images as data URIs for an editor), text, attachments (inline images and files) and `checks` (images resolved, plain text present, size under 10 MiB, required placeholders used); nothing is saved or sent. `send-test` mails that rendering to the calling user's own address only, subject prefixed with `[TEST]`, at most 10 per user and hour; it needs `delivery`, `channel-email` and `renderer-mail-html` to be mounted. `send-test-status` tells an editor beforehand whether that send can work for the caller (`canSend`, else `reason` `no_channel` or `no_address`), never returning the address.",
@@ -198,6 +207,10 @@ export function createTemplateResolverFeature(opts: TemplateResolverOptions = {}
       r.contentCollection({
         ...collection,
         access: collection.access ?? DEFAULT_COLLECTION_ACCESS,
+        nav: {
+          ...collection.nav,
+          createAction: collection.nav.createAction ?? newEntryAction(collection.id),
+        },
       });
       r.queryHandler(makeCollectionListQuery(collection));
       r.queryHandler(makeCollectionItemQuery(collection));

package/packages/bundled-features/src/template-resolver/handlers/collection-set.write.ts

@@ -11,8 +11,8 @@ import { systemTemplateExists } from "../api.ts";
 import { documentViolationsToFieldIssues, sanitizeTemplateBody } from "../document-sanitizer.ts";
 import { refuseTemplateEdit, type TemplateEditPolicy } from "../template-edit-policy.ts";
 import { DEFAULT_COLLECTION_ACCESS, isCollectionRefusedKind } from "../web/constants.ts";
-import { type CollectionEntryRow, collectionStore } from "./collection-shared.ts";
-import { contentFormatSchema, folderSchema, localeSchema, slugSchema } from "./shared.ts";
+import { type CollectionEntryRow, collectionStore, storageFormatOf } from "./collection-shared.ts";
+import { folderSchema, localeSchema, slugSchema } from "./shared.ts";
 
 // Upsert inside one collection. Mirrors set.write for text-blocks, but the
 // kind comes from the declaration and the access rule is the collection's own,
@@ -26,6 +26,7 @@ export function makeCollectionSetWrite(
   editPolicy: TemplateEditPolicy,
 ) {
   const store = collectionStore(collection);
+  const contentFormat = storageFormatOf(collection);
   return defineWriteHandler({
     name: `${collection.id}-set`,
     schema: z.object({
@@ -33,8 +34,9 @@ export function makeCollectionSetWrite(
       locale: localeSchema,
       title: z.string().min(1).max(200),
       content: z.string().max(200_000).nullable(),
-      contentFormat: contentFormatSchema.default("markdown"),
       folder: folderSchema.nullable().optional(),
+      /** The create form sets it so a taken slug is reported instead of overwritten. */
+      createOnly: z.boolean().optional(),
       /** Optional cross-tenant write — SystemAdmin only. */
       tenantIdOverride: z.string().min(1).optional(),
     }),
@@ -71,8 +73,9 @@ export function makeCollectionSetWrite(
 
       const body = sanitizeTemplateBody({
         kind: collection.kind,
-        contentFormat: event.payload.contentFormat,
+        contentFormat,
         content: event.payload.content,
+        alwaysSanitizeHtml: collection.contentFormat === "document",
       });
       if (!body.ok) {
         return writeFailure(
@@ -100,6 +103,21 @@ export function makeCollectionSetWrite(
         ...owner,
       });
 
+      if (existing && event.payload.createOnly === true) {
+        return writeFailure(
+          new ValidationError({
+            fields: [
+              {
+                path: "slug",
+                code: "slug_exists",
+                i18nKey: "templateResolver.errors.collection.slugExists",
+                params: { detail: event.payload.slug },
+              },
+            ],
+          }),
+        );
+      }
+
       if (existing) {
         const result = await store.executor.update(
           {
@@ -111,7 +129,7 @@ export function makeCollectionSetWrite(
             changes: {
               title: event.payload.title,
               content: body.content,
-              contentFormat: event.payload.contentFormat,
+              contentFormat,
               folder: event.payload.folder ?? null,
             },
           },
@@ -134,7 +152,7 @@ export function makeCollectionSetWrite(
           locale: event.payload.locale,
           title: event.payload.title,
           content: body.content,
-          contentFormat: event.payload.contentFormat,
+          contentFormat,
           folder: event.payload.folder ?? null,
           ...store.createDefaults(tenantId),
           ...owner,

package/packages/bundled-features/src/template-resolver/handlers/collection-shared.ts

@@ -14,6 +14,7 @@ import { SYSTEM_TENANT_ID } from "@cosmicdrift/kumiko-framework/engine";
 import type { Temporal } from "@cosmicdrift/kumiko-types/temporal";
 import { templateResourceEntity, templateResourcesTable } from "../table.ts";
 import { userContentEntriesTable, userContentEntryEntity } from "../user-content-table.ts";
+import type { ContentFormat } from "../web/constants.ts";
 
 const templateExecutor = createEventStoreExecutor(templateResourcesTable, templateResourceEntity, {
   entityName: "template-resource",
@@ -107,3 +108,9 @@ export function toCollectionEntry(row: CollectionEntryRow) {
     modifiedAt: row.modifiedAt,
   };
 }
+
+// The client never names the storage format: the declared editor decides it, so a
+// stale or tampered client cannot stamp a "plain" collection with html or the reverse.
+export function storageFormatOf(collection: ContentCollectionDefinition): ContentFormat {
+  return collection.contentFormat === "document" ? "html" : "plain";
+}

package/packages/bundled-features/src/template-resolver/handlers/set.write.ts

@@ -48,6 +48,7 @@ export function makeSetWrite(policy: TemplateEditPolicy) {
       kind: z.enum(TEMPLATE_KINDS).optional(),
       title: z.string().min(1).max(200),
       content: z.string().max(200_000).nullable(),
+      // Provisioning callers omit it and rely on markdown.
       contentFormat: contentFormatSchema.default("markdown"),
       /** Folder path for the content tree. Optional + null = root node. */
       folder: folderSchema.nullable().optional(),

package/packages/bundled-features/src/template-resolver/handlers/shared.ts

@@ -2,7 +2,13 @@ import { createEventStoreExecutor } from "@cosmicdrift/kumiko-framework/db";
 import * as z from "zod";
 import { templateResourceEntity, templateResourcesTable } from "../table.ts";
 import { templateSlugSchema } from "../template-meta.ts";
-import { CONTENT_FORMATS, TEMPLATE_STATUSES, UPSERT_KINDS } from "../web/constants.ts";
+import {
+  CONTENT_FORMATS,
+  SLUG_MAX_LENGTH,
+  SLUG_PATTERN,
+  TEMPLATE_STATUSES,
+  UPSERT_KINDS,
+} from "../web/constants.ts";
 
 // One executor per bundle, shared by all four handlers for create/update via
 // event store + optimistic lock.
@@ -14,8 +20,8 @@ export const executor = createEventStoreExecutor(templateResourcesTable, templat
 export const slugSchema = z
   .string()
   .min(1)
-  .max(80)
-  .regex(/^[a-z0-9][a-z0-9-]*$/, "slug must be kebab-case (lowercase, digits, dashes)");
+  .max(SLUG_MAX_LENGTH)
+  .regex(SLUG_PATTERN, "slug must be kebab-case (lowercase, digits, dashes)");
 
 export { templateSlugSchema };