@cosmicdrift/kumiko-samples 0.362.0 → 0.363.0

package/packages/bundled-features/src/template-resolver/handlers/overview.query.ts

@@ -0,0 +1,250 @@
+import { selectMany } from "@cosmicdrift/kumiko-framework/bun-db";
+import { defineQueryHandler } from "@cosmicdrift/kumiko-framework/engine";
+import * as z from "zod";
+import { DEFAULT_MAIL_LAYOUT_SLUG, FALLBACK_LOCALE, type TemplateStatus } from "../constants.js";
+import { type TemplateResourceRow, templateResourcesTable } from "../table.js";
+import { collectTemplateUsage } from "../template-usage.js";
+import { storedRecord } from "./template-gates.js";
+
+const OVERVIEW_KINDS = ["mail", "document-pdf", "mail-layout", "pdf-layout"] as const;
+type OverviewKind = (typeof OVERVIEW_KINDS)[number];
+
+const OVERVIEW_ROW_LIMIT = 5000;
+
+export type OverviewOrigin = "tenant" | "system";
+export type OverviewKindGroup = "mail" | "pdf" | "layout";
+
+export type OverviewUsage = {
+  readonly qualifiedName: string;
+  readonly feature: string;
+  readonly notification: string;
+  readonly trigger: string | null;
+};
+
+export type OverviewRow = {
+  readonly id: string;
+  readonly slug: string;
+  readonly kind: OverviewKind;
+  readonly kindGroup: OverviewKindGroup;
+  readonly title: string;
+  readonly origin: OverviewOrigin;
+  readonly locales: readonly string[];
+  readonly status: TemplateStatus;
+  readonly version: number;
+  readonly systemVersion: number | null;
+  readonly layoutSlug: string | null;
+  readonly modifiedAt: string;
+  readonly usedBy: readonly OverviewUsage[];
+  readonly usedByCount: number;
+};
+
+export type OverviewResponse = {
+  readonly rows: readonly OverviewRow[];
+  readonly nextCursor: null;
+  readonly total: number;
+};
+
+const SORT_FIELDS = ["title", "slug", "kind", "origin", "status", "modifiedAt"] as const;
+type SortField = (typeof SORT_FIELDS)[number];
+
+const KIND_GROUP: Readonly<Record<OverviewKind, OverviewKindGroup>> = {
+  mail: "mail",
+  "document-pdf": "pdf",
+  "mail-layout": "layout",
+  "pdf-layout": "layout",
+};
+
+function isOverviewKind(kind: string): kind is OverviewKind {
+  return OVERVIEW_KINDS.some((candidate) => candidate === kind);
+}
+
+function isTemplateStatus(status: string): status is TemplateStatus {
+  return status === "draft" || status === "active" || status === "archived";
+}
+
+function layoutSlugOf(row: TemplateResourceRow): string {
+  const layoutSlug = storedRecord(row.meta)["layoutSlug"];
+  return typeof layoutSlug === "string" ? layoutSlug : DEFAULT_MAIL_LAYOUT_SLUG;
+}
+
+function preferredRow(rows: readonly TemplateResourceRow[]): TemplateResourceRow | undefined {
+  return (
+    rows.find((row) => row.locale === FALLBACK_LOCALE) ??
+    [...rows].sort((a, b) => a.locale.localeCompare(b.locale))[0]
+  );
+}
+
+type EffectiveRows = { readonly origin: OverviewOrigin; readonly rows: TemplateResourceRow[] };
+
+function effectiveRowsOf(rows: readonly TemplateResourceRow[]): EffectiveRows | null {
+  const tenantRows = rows.filter((row) => row.scope === "tenant");
+  const systemRows = rows.filter((row) => row.scope === "system");
+  const live = (list: TemplateResourceRow[]) => list.filter((row) => row.status !== "archived");
+  const liveTenant = live(tenantRows);
+  if (liveTenant.length > 0) return { origin: "tenant", rows: liveTenant };
+  if (systemRows.length > 0) {
+    const liveSystem = live(systemRows);
+    return { origin: "system", rows: liveSystem.length > 0 ? liveSystem : systemRows };
+  }
+  return tenantRows.length > 0 ? { origin: "tenant", rows: tenantRows } : null;
+}
+
+function modifiedAtOf(row: TemplateResourceRow): string {
+  return (row.modifiedAt ?? row.insertedAt).toString();
+}
+
+function splitDocumentSlug(slug: string): { feature: string; notification: string } {
+  const separator = slug.indexOf(":");
+  return separator === -1
+    ? { feature: "", notification: slug }
+    : { feature: slug.slice(0, separator), notification: slug.slice(separator + 1) };
+}
+
+function compareBy(field: SortField, a: OverviewRow, b: OverviewRow): number {
+  return String(a[field]).localeCompare(String(b[field]));
+}
+
+function isSortField(value: string): value is SortField {
+  return SORT_FIELDS.some((candidate) => candidate === value);
+}
+
+type OverviewDraft = Omit<OverviewRow, "usedBy" | "usedByCount">;
+type OverviewFilter = {
+  readonly field: "kindGroup" | "kind" | "origin" | "status";
+  readonly value: readonly string[];
+};
+
+function groupBySlugAndKind(
+  rows: readonly TemplateResourceRow[],
+): Map<string, TemplateResourceRow[]> {
+  const groups = new Map<string, TemplateResourceRow[]>();
+  for (const row of rows) {
+    if (!isOverviewKind(row.kind)) continue;
+    const key = `${row.kind}|${row.slug}`;
+    groups.set(key, [...(groups.get(key) ?? []), row]);
+  }
+  return groups;
+}
+
+function buildDrafts(groups: ReadonlyMap<string, readonly TemplateResourceRow[]>): {
+  readonly drafts: OverviewDraft[];
+  readonly layoutSlugByDocument: Map<string, string>;
+} {
+  const layoutSlugByDocument = new Map<string, string>();
+  const drafts: OverviewDraft[] = [];
+  for (const [id, groupRows] of groups) {
+    const effective = effectiveRowsOf(groupRows);
+    const preferred = effective === null ? undefined : preferredRow(effective.rows);
+    if (effective === null || preferred === undefined) continue;
+    if (!isOverviewKind(preferred.kind) || !isTemplateStatus(preferred.status)) continue;
+    const systemSameLocale = groupRows.find(
+      (row) => row.scope === "system" && row.locale === preferred.locale,
+    );
+    const isDocument = preferred.kind === "mail" || preferred.kind === "document-pdf";
+    const layoutSlug = isDocument ? layoutSlugOf(preferred) : null;
+    if (layoutSlug !== null && preferred.kind === "document-pdf") {
+      layoutSlugByDocument.set(preferred.slug, layoutSlug);
+    }
+    drafts.push({
+      id,
+      slug: preferred.slug,
+      kind: preferred.kind,
+      kindGroup: KIND_GROUP[preferred.kind],
+      title: preferred.title ?? preferred.slug,
+      origin: effective.origin,
+      locales: [...new Set(effective.rows.map((row) => row.locale))].sort(),
+      status: preferred.status,
+      version: preferred.version,
+      systemVersion: systemSameLocale?.version ?? null,
+      layoutSlug,
+      modifiedAt: modifiedAtOf(preferred),
+    });
+  }
+  return { drafts, layoutSlugByDocument };
+}
+
+function withUsage(
+  draft: OverviewDraft,
+  layoutSlugByDocument: ReadonlyMap<string, string>,
+  registry: Parameters<typeof collectTemplateUsage>[0],
+): OverviewRow {
+  let usedBy: OverviewUsage[] = [];
+  if (draft.kind === "mail" || draft.kind === "mail-layout") {
+    usedBy = collectTemplateUsage(registry, draft.slug, draft.kind).map((entry) => ({
+      qualifiedName: entry.qualifiedName,
+      feature: entry.feature,
+      notification: entry.notification,
+      trigger: entry.trigger,
+    }));
+  } else if (draft.kind === "pdf-layout") {
+    usedBy = [...layoutSlugByDocument]
+      .filter(([, layoutSlug]) => layoutSlug === draft.slug)
+      .map(([documentSlug]) => ({
+        qualifiedName: documentSlug,
+        ...splitDocumentSlug(documentSlug),
+        trigger: null,
+      }));
+  }
+  return { ...draft, usedBy, usedByCount: usedBy.length };
+}
+
+function filterRows(
+  rows: readonly OverviewRow[],
+  search: string | undefined,
+  filters: readonly OverviewFilter[],
+): OverviewRow[] {
+  const needle = search?.trim().toLowerCase() ?? "";
+  return rows.filter((row) => {
+    if (needle !== "" && !`${row.title} ${row.slug}`.toLowerCase().includes(needle)) return false;
+    return filters.every((filter) => filter.value.includes(String(row[filter.field])));
+  });
+}
+
+const filterSchema = z.object({
+  field: z.enum(["kindGroup", "kind", "origin", "status"]),
+  op: z.literal("in"),
+  value: z.array(z.string()),
+});
+
+export const overviewQuery = defineQueryHandler({
+  name: "overview",
+  schema: z.object({
+    search: z.string().optional(),
+    filters: z.array(filterSchema).optional(),
+    sort: z.string().optional(),
+    sortDirection: z.enum(["asc", "desc"]).optional(),
+    limit: z.number().int().min(1).max(200).default(50),
+    offset: z.number().int().min(0).optional(),
+    totalCount: z.boolean().optional(),
+  }),
+  access: { roles: ["TenantAdmin", "SystemAdmin"] },
+  description:
+    "Lists mail, PDF and layout templates as one row per slug and kind for the caller's tenant: where the effective version comes from (own override or system), its locales, status and version, the system version it overrides, the layout it uses and which notifications or templates use it; use it to browse and filter all templates at a glance.",
+  handler: async (query, ctx) => {
+    const payload = query.payload;
+    const rows = await selectMany<TemplateResourceRow>(
+      ctx.db,
+      templateResourcesTable,
+      { kind: { in: [...OVERVIEW_KINDS] } },
+      { limit: OVERVIEW_ROW_LIMIT },
+    );
+
+    const { drafts, layoutSlugByDocument } = buildDrafts(groupBySlugAndKind(rows));
+    const overviewRows = drafts.map((draft) =>
+      withUsage(draft, layoutSlugByDocument, ctx.registry),
+    );
+    const filtered = filterRows(overviewRows, payload.search, payload.filters ?? []);
+
+    const sortField: SortField =
+      payload.sort !== undefined && isSortField(payload.sort) ? payload.sort : "modifiedAt";
+    const direction = (payload.sortDirection ?? "desc") === "desc" ? -1 : 1;
+    filtered.sort((a, b) => direction * compareBy(sortField, a, b) || a.id.localeCompare(b.id));
+
+    const offset = payload.offset ?? 0;
+    return {
+      rows: filtered.slice(offset, offset + payload.limit),
+      nextCursor: null,
+      total: filtered.length,
+    } satisfies OverviewResponse;
+  },
+});

package/packages/bundled-features/src/template-resolver/handlers/preview.query.ts

@@ -0,0 +1,25 @@
+import { defineQueryHandler } from "@cosmicdrift/kumiko-framework/engine";
+import * as z from "zod";
+import { renderTemplatePreview } from "../template-preview.js";
+import { localeSchema, templateSlugSchema } from "./shared.js";
+
+export const previewQuery = defineQueryHandler({
+  name: "preview",
+  schema: z.object({
+    slug: templateSlugSchema,
+    kind: z.enum(["mail", "document-pdf"]),
+    locale: localeSchema,
+    /** Without content the stored template is previewed. */
+    content: z.string().max(200_000).optional(),
+    meta: z.unknown().optional(),
+    variableSchema: z.record(z.string(), z.unknown()).default({}),
+  }),
+  access: { roles: ["TenantAdmin", "SystemAdmin"] },
+  description:
+    "Renders a template draft, or the stored template when no content is given, with sample values taken from the declared variable examples, without saving or sending anything: returns the mail subject, html and plain text with its inline images (a PDF template returns its body and layout regions instead), the sample values used, and checks for unresolved images, missing plain text, mail size and unused required placeholders; a draft that fails the write rules is rejected with the same problems as a save.",
+  handler: async (query, ctx) => {
+    const outcome = await renderTemplatePreview(ctx, query.user, query.payload);
+    if (!outcome.ok) throw outcome.error;
+    return outcome.preview;
+  },
+});

package/packages/bundled-features/src/template-resolver/handlers/reset-to-system.write.ts

@@ -0,0 +1,58 @@
+import { fetchOne } from "@cosmicdrift/kumiko-framework/bun-db";
+import { defineWriteHandler, SYSTEM_TENANT_ID } from "@cosmicdrift/kumiko-framework/engine";
+import { NotFoundError, ValidationError, writeFailure } from "@cosmicdrift/kumiko-framework/errors";
+import * as z from "zod";
+import type { TemplateResourceRow } from "../table.js";
+import { templateResourcesTable } from "../table.js";
+import { executor } from "./shared.js";
+
+export const resetToSystemWrite = defineWriteHandler({
+  name: "reset-to-system",
+  schema: z.object({ id: z.string().min(1) }),
+  access: { roles: ["TenantAdmin", "SystemAdmin"] },
+  description:
+    "Retires a tenant override by archiving it so the resolver serves the active system template again; the override and its content survive and can be published again. Refused when there is no active system template to fall back to.",
+  handler: async (event, ctx) => {
+    const existing = await fetchOne<TemplateResourceRow>(ctx.db, templateResourcesTable, {
+      id: event.payload.id,
+    });
+    if (!existing || existing.tenantId !== event.user.tenantId || existing.scope !== "tenant") {
+      return writeFailure(new NotFoundError("template-resource", event.payload.id));
+    }
+    const systemRow = await fetchOne<TemplateResourceRow>(ctx.db, templateResourcesTable, {
+      tenantId: SYSTEM_TENANT_ID,
+      slug: existing.slug,
+      kind: existing.kind,
+      locale: existing.locale,
+      status: "active",
+    });
+    if (!systemRow) {
+      return writeFailure(
+        new ValidationError({
+          fields: [
+            {
+              path: "id",
+              code: "no_system_template",
+              i18nKey: "templateResolver.errors.noSystemTemplate",
+            },
+          ],
+        }),
+      );
+    }
+    const response = {
+      isSuccess: true as const,
+      data: {
+        id: String(existing.id),
+        status: "archived" as const,
+        systemTemplateId: String(systemRow.id),
+      },
+    };
+    if (existing.status === "archived") return response;
+    const result = await executor.update(
+      { id: existing.id, version: existing.version, changes: { status: "archived" } },
+      event.user,
+      ctx.db,
+    );
+    return result.isSuccess ? response : result;
+  },
+});

package/packages/bundled-features/src/template-resolver/handlers/resource-link-pdf.write.ts

@@ -0,0 +1,34 @@
+import { defineWriteHandler } from "@cosmicdrift/kumiko-framework/engine";
+import * as z from "zod";
+import { linkTemplatePdfAttachment } from "../store-template-resource.js";
+import { resourceKeySchema, resourceTargetTenantId } from "./resource-shared.js";
+
+export const resourceLinkPdfWrite = defineWriteHandler({
+  name: "resource-link-pdf",
+  schema: z.object({
+    templateId: z.string().min(1),
+    key: resourceKeySchema,
+    /** Slug of a document-pdf template of the tenant or the system. */
+    templateSlug: z.string().min(1),
+    /** Name pattern of the attached PDF; may hold {{placeholders}}, must end with .pdf. */
+    fileName: z.string().min(1),
+    /** Cross-tenant target — SystemAdmin only. */
+    tenantIdOverride: z.string().min(1).optional(),
+  }),
+  access: { roles: ["TenantAdmin", "SystemAdmin"] },
+  description:
+    "Links a PDF rendered from a document-pdf template into a mail template under the key. Every mail sent from the template then carries that PDF, rendered at send time with the mail's own variables and locale; nothing is uploaded or stored. fileName is a pattern that may use the mail's {{placeholders}} and must end with .pdf. The document template must exist for the tenant or the system. Counts toward the 10 attachments per mail template together with uploaded files.",
+  handler: async (event, ctx) => {
+    const { templateId, key, templateSlug, fileName } = event.payload;
+    const tenantId = resourceTargetTenantId(event.payload.tenantIdOverride, event.user.tenantId);
+    return linkTemplatePdfAttachment({
+      ctx,
+      user: event.user,
+      tenantId,
+      templateId,
+      key,
+      templateSlug,
+      fileName,
+    });
+  },
+});

package/packages/bundled-features/src/template-resolver/handlers/resource-remove.write.ts

@@ -0,0 +1,50 @@
+import { fetchOne } from "@cosmicdrift/kumiko-framework/bun-db";
+import { defineWriteHandler } from "@cosmicdrift/kumiko-framework/engine";
+import { NotFoundError, writeFailure } from "@cosmicdrift/kumiko-framework/errors";
+import * as z from "zod";
+import { requireForTenant } from "../../shared/index.js";
+import { parseLinkedResourceEntries } from "../linked-resources.js";
+import { type TemplateResourceRow, templateResourcesTable } from "../table.js";
+import { resourceKeySchema, resourceTargetTenantId } from "./resource-shared.js";
+import { executor } from "./shared.js";
+
+// The FileRef itself stays: copy-locale and tenant overrides can share ids and there is
+// no reference count to tell when the last user is gone.
+export const resourceRemoveWrite = defineWriteHandler({
+  name: "resource-remove",
+  schema: z.object({
+    templateId: z.string().min(1),
+    key: resourceKeySchema,
+    /** Cross-tenant target — SystemAdmin only. */
+    tenantIdOverride: z.string().min(1).optional(),
+  }),
+  access: { roles: ["TenantAdmin", "SystemAdmin"] },
+  description:
+    "Unlinks a resource key from a template, whether it holds an image, an attached file or a linked PDF template; removing a key the template does not have succeeds without a change.",
+  handler: async (event, ctx) => {
+    const { templateId, key } = event.payload;
+    const tenantId = resourceTargetTenantId(event.payload.tenantIdOverride, event.user.tenantId);
+    const { db, streamTenantId } = requireForTenant(ctx, tenantId);
+    const row = await fetchOne<TemplateResourceRow>(db, templateResourcesTable, {
+      tenantId,
+      id: templateId,
+    });
+    if (row === undefined) return writeFailure(new NotFoundError("template-resource", templateId));
+
+    const { [key]: removed, ...remaining } = parseLinkedResourceEntries(row.linkedResources);
+    if (removed === undefined) return { isSuccess: true as const, data: { key, removed: false } };
+
+    const updated = await executor.update(
+      {
+        id: row.id,
+        version: row.version,
+        changes: { linkedResources: JSON.stringify(remaining) },
+      },
+      event.user,
+      db,
+      { streamTenantId },
+    );
+    if (!updated.isSuccess) return updated;
+    return { isSuccess: true as const, data: { key, removed: true } };
+  },
+});

package/packages/bundled-features/src/template-resolver/handlers/resource-shared.ts

@@ -0,0 +1,24 @@
+import type { TenantId } from "@cosmicdrift/kumiko-framework/engine";
+import * as z from "zod";
+import { isDocumentResourceKey } from "../document-schema.js";
+
+export const RESOURCE_MAX_BYTES_CONFIG_KEY = "template-resolver:config:resource-max-bytes";
+export const DEFAULT_RESOURCE_MAX_BYTES = 2 * 1024 * 1024;
+
+export const resourceKeySchema = z.string().min(1).max(64).refine(isDocumentResourceKey, {
+  message: "resource key must be letters, digits, dot, dash or underscore",
+});
+
+export const RESOURCE_PURPOSES = ["image", "attachment"] as const;
+export type ResourcePurpose = (typeof RESOURCE_PURPOSES)[number];
+
+export const MAX_FILE_ATTACHMENTS_PER_TEMPLATE = 10;
+
+export function resourceTargetTenantId(
+  tenantIdOverride: string | undefined,
+  sessionTenantId: TenantId,
+): TenantId {
+  // @cast-boundary engine-payload — override is a zod-validated string; forTenant
+  // rejects it for non-SystemAdmins.
+  return (tenantIdOverride ?? sessionTenantId) as TenantId;
+}

package/packages/bundled-features/src/template-resolver/handlers/resource-upload.write.ts

@@ -0,0 +1,135 @@
+import { defineWriteHandler, type WriteResult } from "@cosmicdrift/kumiko-framework/engine";
+import {
+  NotFoundError,
+  UnprocessableError,
+  writeFailure,
+} from "@cosmicdrift/kumiko-framework/errors";
+import * as z from "zod";
+import {
+  FileRefTooLargeError,
+  fileContextForTenant,
+  readFileRefContent,
+} from "../../file-foundation/index.js";
+import { attachmentFileNameSchema } from "../../shared/index.js";
+import { TemplateResolverErrors } from "../qualified-names.js";
+import {
+  readTemplateResourceMaxBytes,
+  type StoredTemplateAttachment,
+  type StoredTemplateResource,
+  storeTemplateAttachment,
+  storeTemplateResource,
+} from "../store-template-resource.js";
+import { RESOURCE_PURPOSES, resourceKeySchema, resourceTargetTenantId } from "./resource-shared.js";
+
+type AttachmentTarget = {
+  readonly templateId: string;
+  readonly key: string;
+  readonly fileName: string;
+};
+
+function attachmentTargetOf(input: {
+  readonly templateId: string | undefined;
+  readonly key: string | undefined;
+  readonly fileName: string | undefined;
+}): AttachmentTarget | null {
+  const { templateId, key, fileName } = input;
+  if (templateId === undefined || key === undefined || fileName === undefined) return null;
+  const parsedName = attachmentFileNameSchema.safeParse(fileName);
+  return parsedName.success ? { templateId, key, fileName: parsedName.data } : null;
+}
+
+// Purpose "image": stores a re-encoded image as a FileRef and, with templateId + key, links it into
+// the template; without templateId it only creates the FileRef (the branding logo upload path).
+// Purpose "attachment": stores the file as uploaded and links it as a mail attachment.
+export const resourceUploadWrite = defineWriteHandler({
+  name: "resource-upload",
+  schema: z
+    .object({
+      templateId: z.string().min(1).optional(),
+      key: resourceKeySchema.optional(),
+      /** An unclaimed upload of the caller (POST /api/files without entityType). */
+      sourceFileRefId: z.uuid(),
+      /** Cross-tenant target — SystemAdmin only. */
+      tenantIdOverride: z.string().min(1).optional(),
+      /** "attachment" links a PDF/PNG/JPEG as a file attached to every mail of the template. */
+      purpose: z.enum(RESOURCE_PURPOSES).default("image"),
+      /** Name the recipient sees; required for purpose "attachment". */
+      fileName: z.string().optional(),
+    })
+    .refine(
+      (p) => p.purpose === "attachment" || (p.templateId === undefined) === (p.key === undefined),
+      {
+        message: "templateId and key must be given together",
+        path: ["key"],
+      },
+    ),
+  access: { roles: ["TenantAdmin", "SystemAdmin"] },
+  description:
+    "Turns a file uploaded via POST /api/files (multipart, no entityType) into a template resource. With purpose image (default) the upload is checked against the resource-max-bytes cap, re-encoded to a supported image format and stored as a new file; with templateId and key it is linked into that template under the key, without them only the file is created. With purpose attachment, templateId, key and fileName are required: a PDF, PNG or JPEG is stored unchanged and linked into a mail template as a file attached to every mail sent from it, at most 10 per template. A cap above the files route's maxUploadSize has no effect.",
+  handler: async (
+    event,
+    ctx,
+  ): Promise<WriteResult<StoredTemplateResource | StoredTemplateAttachment>> => {
+    const { templateId, key, sourceFileRefId, purpose, fileName } = event.payload;
+    const attachmentTarget =
+      purpose === "attachment" ? attachmentTargetOf({ templateId, key, fileName }) : null;
+    if (purpose === "attachment" && attachmentTarget === null) {
+      return writeFailure(
+        new UnprocessableError(TemplateResolverErrors.attachmentInvalid, {
+          i18nKey: "templateResolver.errors.attachment.invalid",
+          details: { code: "target_required" },
+        }),
+      );
+    }
+    const maxBytes = await readTemplateResourceMaxBytes(ctx.config, ctx.registry);
+
+    // The source is read from the session tenant only: with tenantIdOverride the upload
+    // sits in the admin's own tenant while the normalized file lands in the target tenant.
+    // Only the caller's own unclaimed upload qualifies, so a record-attached image of
+    // someone else cannot be copied into a template.
+    let source: Awaited<ReturnType<typeof readFileRefContent>>;
+    try {
+      source = await readFileRefContent({
+        db: ctx.db,
+        filesForTenant: (tid) => fileContextForTenant(ctx, tid),
+        fileRefId: sourceFileRefId,
+        allowedTenantIds: [event.user.tenantId],
+        unclaimedUploadOf: event.user.id,
+        maxBytes,
+      });
+    } catch (cause) {
+      if (cause instanceof FileRefTooLargeError) {
+        return writeFailure(
+          new UnprocessableError(TemplateResolverErrors.resourceTooLarge, {
+            i18nKey: "templateResolver.errors.resource.tooLarge",
+            details: { maxBytes, size: cause.size },
+          }),
+        );
+      }
+      throw cause;
+    }
+    if (source === null) return writeFailure(new NotFoundError("file-ref", sourceFileRefId));
+
+    // The source upload stays as an unclaimed file: bundled-features cannot reach the fileRef executor to delete it.
+    const tenantId = resourceTargetTenantId(event.payload.tenantIdOverride, event.user.tenantId);
+    if (attachmentTarget !== null) {
+      return storeTemplateAttachment({
+        ctx,
+        user: event.user,
+        tenantId,
+        bytes: source.content,
+        maxBytes,
+        ...attachmentTarget,
+      });
+    }
+    return storeTemplateResource({
+      ctx,
+      user: event.user,
+      tenantId,
+      bytes: source.content,
+      maxBytes,
+      ...(templateId !== undefined && { templateId }),
+      ...(key !== undefined && { key }),
+    });
+  },
+});