@cosmicdrift/kumiko-samples 0.362.0 → 0.363.0

package/packages/bundled-features/src/template-resolver/handlers/send-test.write.ts

@@ -0,0 +1,106 @@
+import { defineWriteHandler, type Registry } from "@cosmicdrift/kumiko-framework/engine";
+import { UnprocessableError, writeFailure } from "@cosmicdrift/kumiko-framework/errors";
+import * as z from "zod";
+import {
+  collectChannels,
+  createEmailAttachmentReader,
+  EMAIL_CHANNEL_NAME,
+} from "../../delivery/index.js";
+import { fileContextForTenant } from "../../file-foundation/index.js";
+import { TEST_MAIL_NOTIFICATION_TYPE, TEST_MAIL_SUBJECT_PREFIX } from "../constants.js";
+import { TemplateResolverErrors } from "../qualified-names.js";
+import { renderTemplatePreview } from "../template-preview.js";
+import { localeSchema, templateSlugSchema } from "./shared.js";
+
+const TEST_MAIL_RATE_LIMIT = { limit: 10, windowSeconds: 3600 } as const;
+
+function emailChannelOf(registry: Registry) {
+  return collectChannels(registry).find((channel) => channel.name === EMAIL_CHANNEL_NAME);
+}
+
+// Transport errors can carry provider responses or the address, so the client only gets a fixed code.
+function testMailFailed(code: "channel_error" | "not_sent") {
+  return writeFailure(
+    new UnprocessableError(TemplateResolverErrors.testMailFailed, {
+      i18nKey: "templateResolver.errors.testMail.failed",
+      details: { code },
+    }),
+  );
+}
+
+// The only recipient is the caller's own address, resolved server-side, so the handler can never mail a third party.
+export const sendTestWrite = defineWriteHandler({
+  name: "send-test",
+  schema: z.object({
+    slug: templateSlugSchema,
+    locale: localeSchema,
+    content: z.string().max(200_000).optional(),
+    meta: z.unknown().optional(),
+    variableSchema: z.record(z.string(), z.unknown()).default({}),
+  }),
+  access: { roles: ["TenantAdmin", "SystemAdmin"] },
+  rateLimit: { per: "user+handler", ...TEST_MAIL_RATE_LIMIT },
+  description:
+    "Sends the rendered preview of a mail template draft, or of the stored template when no content is given, to the calling user's own address with the subject prefixed by [TEST], carrying the inline images and the files attached to the template; there is no recipient input, the sample values come from the declared variable examples, and a draft that fails the write rules is rejected without sending.",
+  handler: async (event, ctx) => {
+    const outcome = await renderTemplatePreview(ctx, event.user, {
+      ...event.payload,
+      kind: "mail",
+    });
+    if (!outcome.ok) return writeFailure(outcome.error);
+    const { preview, mailAttachments } = outcome;
+
+    const channel = emailChannelOf(ctx.registry);
+    if (channel === undefined) {
+      return writeFailure(
+        new UnprocessableError(TemplateResolverErrors.testMailNoChannel, {
+          i18nKey: "templateResolver.errors.testMail.noChannel",
+        }),
+      );
+    }
+    const channelContext = {
+      db: ctx.db,
+      registry: ctx.registry,
+      sseBroker: undefined,
+      tenantId: event.user.tenantId,
+      secrets: ctx.secrets,
+      readAttachment: createEmailAttachmentReader(
+        ctx.db,
+        ctx.registry,
+        event.user.tenantId,
+        ctx.config,
+        (tenantId) => fileContextForTenant(ctx, tenantId),
+      ),
+    };
+    const address = (await channel.resolve?.(event.user.id, channelContext)) ?? null;
+    if (address === null) {
+      return writeFailure(
+        new UnprocessableError(TemplateResolverErrors.testMailNoAddress, {
+          i18nKey: "templateResolver.errors.testMail.noAddress",
+        }),
+      );
+    }
+
+    const subject = `${TEST_MAIL_SUBJECT_PREFIX}${preview.subject ?? ""}`;
+    let sent: boolean;
+    try {
+      const result = await channel.send(
+        address,
+        {
+          notificationType: TEST_MAIL_NOTIFICATION_TYPE,
+          title: subject,
+          body: undefined,
+          data: undefined,
+          locale: event.payload.locale,
+        },
+        channelContext,
+        { subject, html: preview.html, text: preview.text ?? "", attachments: mailAttachments },
+      );
+      sent = result.status === "sent";
+    } catch {
+      return testMailFailed("channel_error");
+    }
+    if (!sent) return testMailFailed("not_sent");
+    return { isSuccess: true as const, data: { subject, checks: preview.checks } };
+  },
+});

package/packages/bundled-features/src/template-resolver/handlers/set.write.ts

@@ -4,11 +4,15 @@ import {
   SYSTEM_TENANT_ID,
   type TenantId,
 } from "@cosmicdrift/kumiko-framework/engine";
+import { isOneOf } from "@cosmicdrift/kumiko-types/type-guards";
 import * as z from "zod";
 import { requireForTenant } from "../../shared/index.js";
-import { TEMPLATE_KINDS, TEXT_BLOCK_KIND } from "../constants.js";
+import { TEMPLATE_KINDS, TEXT_BLOCK_KIND, UPSERT_KINDS } from "../constants.js";
 import { type TemplateResourceRow, templateResourcesTable } from "../table.js";
+import { resolveTemplateVariables } from "../template-validation.js";
 import { contentFormatSchema, executor, folderSchema, localeSchema, slugSchema } from "./shared.js";
+import { parseStoredJson, storedRecord } from "./template-gates.js";
+import { gateTemplateWrite } from "./template-write.js";
 
 // Upsert of a single resource, one operation per (tenantId, slug, kind,
 // locale). This is the content-tree authoring path: unlike upsertTenant it
@@ -26,6 +30,9 @@ import { contentFormatSchema, executor, folderSchema, localeSchema, slugSchema }
 // upsertTenant → publish draft stage. That is the deliberate split between
 // the two authoring routes — use upsertSystem/upsertTenant when a template
 // needs a draft or a variable schema.
+//
+// Kinds that upsertSystem/upsertTenant also write run the same validation
+// pipeline here, and because saving publishes, publish issues reject too.
 export const setWrite = defineWriteHandler({
   name: "set",
   schema: z.object({
@@ -63,17 +70,39 @@ export const setWrite = defineWriteHandler({
       locale: event.payload.locale,
     });
 
+    const scope = tenantId === SYSTEM_TENANT_ID ? ("system" as const) : ("tenant" as const);
+    let content = event.payload.content;
+    if (isOneOf(UPSERT_KINDS, kind)) {
+      const gated = gateTemplateWrite(
+        {
+          kind,
+          scope,
+          contentFormat: event.payload.contentFormat,
+          content,
+          rawMeta: parseStoredJson(existing?.meta ?? null),
+          variables: resolveTemplateVariables(
+            ctx.registry,
+            event.payload.slug,
+            storedRecord(existing?.variableSchema ?? null),
+          ),
+        },
+        "active",
+      );
+      if (!gated.ok) return gated.failure;
+      content = gated.evaluated.content;
+    }
+
     const fields = {
       slug: event.payload.slug,
       kind,
       locale: event.payload.locale,
       title: event.payload.title,
-      content: event.payload.content,
+      content,
       contentFormat: event.payload.contentFormat,
       folder: event.payload.folder ?? null,
       variableSchema: "{}",
       linkedResources: "{}",
-      scope: tenantId === SYSTEM_TENANT_ID ? ("system" as const) : ("tenant" as const),
+      scope,
       parentTemplateId: null,
       // Text blocks have no draft stage — saving publishes, so resolveTemplate
       // (which only returns active rows) finds them.

package/packages/bundled-features/src/template-resolver/handlers/shared.ts

@@ -2,6 +2,7 @@ import { createEventStoreExecutor } from "@cosmicdrift/kumiko-framework/db";
 import * as z from "zod";
 import { CONTENT_FORMATS, TEMPLATE_STATUSES, UPSERT_KINDS } from "../constants.js";
 import { templateResourceEntity, templateResourcesTable } from "../table.js";
+import { templateSlugSchema } from "../template-meta.js";
 
 // One executor per bundle, shared by all four handlers for create/update via
 // event store + optimistic lock.
@@ -16,6 +17,8 @@ export const slugSchema = z
   .max(80)
   .regex(/^[a-z0-9][a-z0-9-]*$/, "slug must be kebab-case (lowercase, digits, dashes)");
 
+export { templateSlugSchema };
+
 export const localeSchema = z
   .string()
   .min(2)
@@ -38,13 +41,15 @@ export const statusSchema = z.enum(TEMPLATE_STATUSES);
 // Common Upsert-Payload — geteilt zwischen upsertSystem + upsertTenant.
 // Unterschied: ACL + tenantId-Bestimmung, sonst identisch.
 export const upsertPayloadSchema = z.object({
-  slug: slugSchema,
+  slug: templateSlugSchema,
   kind: kindSchema,
   locale: localeSchema,
   content: z.string().max(200_000),
   contentFormat: contentFormatSchema,
   variableSchema: z.record(z.string(), z.unknown()).default({}),
-  linkedResources: z.record(z.string(), z.string()).default({}),
+  // Shape depends on kind; validated against template-meta.ts in the handler so
+  // problems surface as field issues on `meta.*`.
+  meta: z.unknown().optional(),
   parentTemplateId: z.string().min(1).optional(),
   title: titleSchema.nullable().optional(),
   folder: folderSchema.nullable().optional(),

package/packages/bundled-features/src/template-resolver/handlers/template-gates.ts

@@ -0,0 +1,184 @@
+import type { Registry, TemplateVariables } from "@cosmicdrift/kumiko-framework/engine";
+import type { FieldIssue } from "@cosmicdrift/kumiko-framework/errors";
+import { isOneOf } from "@cosmicdrift/kumiko-types/type-guards";
+import {
+  CONTENT_FORMATS,
+  type ContentFormat,
+  TEMPLATE_KINDS,
+  type TemplateKind,
+} from "../constants.js";
+import { documentViolationsToFieldIssues } from "../document-sanitizer.js";
+import { sanitizeTemplateWriteBody, type TemplateWriteScope } from "../layout-regions.js";
+import { imageResourceKeysOf } from "../linked-resources.js";
+import type { TemplateResourceRow } from "../table.js";
+import { parseTemplateMeta, type TemplateMetaIssue } from "../template-meta.js";
+import {
+  resolveTemplateVariables,
+  type TemplateValidation,
+  validateTemplatePlaceholders,
+} from "../template-validation.js";
+
+const PLACEHOLDER_VALIDATED_KINDS: ReadonlySet<TemplateKind> = new Set([
+  "mail",
+  "document-pdf",
+  "pdf-layout",
+]);
+
+function metaIssueToFieldIssue(issue: TemplateMetaIssue): FieldIssue {
+  return {
+    path: issue.path,
+    code: "invalid_meta",
+    i18nKey: "templateResolver.errors.template.invalidMeta",
+    params: { detail: issue.message },
+  };
+}
+
+export function placeholderIssues(
+  validation: TemplateValidation,
+  opts: { readonly requireAllRequired: boolean },
+): FieldIssue[] {
+  const issues: FieldIssue[] = [];
+  if (validation.unknown.length > 0) {
+    issues.push({
+      path: "content",
+      code: "unknown_placeholder",
+      i18nKey: "templateResolver.errors.template.unknownPlaceholders",
+      params: { detail: validation.unknown.join(", ") },
+    });
+  }
+  if (opts.requireAllRequired && validation.missingRequired.length > 0) {
+    issues.push({
+      path: "content",
+      code: "missing_required_placeholder",
+      i18nKey: "templateResolver.errors.template.missingRequiredPlaceholders",
+      params: { detail: validation.missingRequired.join(", ") },
+    });
+  }
+  return issues;
+}
+
+export type TemplateWriteInput = {
+  readonly kind: TemplateKind;
+  readonly scope: TemplateWriteScope;
+  readonly contentFormat: ContentFormat;
+  readonly content: string | null;
+  readonly rawMeta: unknown;
+  readonly variables: TemplateVariables;
+  /** Keys with an uploaded file besides the built-in `logo`; only feeds the unknownResources warning. */
+  readonly resourceKeys?: readonly string[];
+};
+
+export type TemplateWriteResult =
+  | {
+      readonly ok: true;
+      readonly content: string | null;
+      readonly metaJson: string | null;
+      readonly validation: TemplateValidation | null;
+      /** Problems that still allow a draft but block publishing. */
+      readonly publishIssues: readonly FieldIssue[];
+    }
+  | {
+      readonly ok: false;
+      readonly issues: readonly FieldIssue[];
+      /** Set when the placeholder scan ran, so callers can still list what it found. */
+      readonly validation: TemplateValidation | null;
+    };
+
+const NO_PUBLISH_ISSUES: readonly FieldIssue[] = [];
+
+function isPlaceholderValidated(kind: TemplateKind, contentFormat: ContentFormat): boolean {
+  if (kind === "mail-layout") return contentFormat === "html";
+  return PLACEHOLDER_VALIDATED_KINDS.has(kind);
+}
+
+// The single validation pipeline of every template write: sanitize and layout
+// rules, then meta, then placeholders.
+export function evaluateTemplateWrite(input: TemplateWriteInput): TemplateWriteResult {
+  const body = sanitizeTemplateWriteBody({
+    kind: input.kind,
+    scope: input.scope,
+    contentFormat: input.contentFormat,
+    content: input.content,
+  });
+  if (!body.ok)
+    return {
+      ok: false,
+      issues: documentViolationsToFieldIssues(body.violations),
+      validation: null,
+    };
+
+  const parsedMeta = parseTemplateMeta(input.kind, input.rawMeta);
+  if (!parsedMeta.ok) {
+    return { ok: false, issues: parsedMeta.issues.map(metaIssueToFieldIssue), validation: null };
+  }
+  const metaJson = parsedMeta.meta === null ? null : JSON.stringify(parsedMeta.meta);
+  if (!isPlaceholderValidated(input.kind, input.contentFormat)) {
+    return {
+      ok: true,
+      content: body.content,
+      metaJson,
+      validation: null,
+      publishIssues: NO_PUBLISH_ISSUES,
+    };
+  }
+
+  const validation = validateTemplatePlaceholders({
+    kind: input.kind,
+    body: body.content ?? "",
+    meta: parsedMeta.meta,
+    variables: input.variables,
+    resourceKeys: input.resourceKeys,
+  });
+  const issues = placeholderIssues(validation, { requireAllRequired: false });
+  if (issues.length > 0) return { ok: false, issues, validation };
+  return {
+    ok: true,
+    content: body.content,
+    metaJson,
+    validation,
+    publishIssues: placeholderIssues(validation, { requireAllRequired: true }),
+  };
+}
+
+function isTemplateKind(kind: string): kind is TemplateKind {
+  return isOneOf(TEMPLATE_KINDS, kind);
+}
+
+export function parseStoredJson(raw: string | null): unknown {
+  if (!raw) return undefined;
+  try {
+    return JSON.parse(raw);
+  } catch {
+    return undefined;
+  }
+}
+
+function isGatedKind(kind: string): kind is TemplateKind {
+  return isTemplateKind(kind) && (kind === "mail-layout" || PLACEHOLDER_VALIDATED_KINDS.has(kind));
+}
+
+export function storedRecord(raw: string | null): Readonly<Record<string, unknown>> {
+  const parsed = parseStoredJson(raw);
+  return typeof parsed === "object" && parsed !== null && !Array.isArray(parsed)
+    ? Object.fromEntries(Object.entries(parsed))
+    : {};
+}
+
+// Publishing makes a row servable, so a stored row must pass the same pipeline
+// as an active write would have.
+export function publishGateIssues(
+  registry: Registry,
+  row: TemplateResourceRow,
+): readonly FieldIssue[] {
+  if (!isGatedKind(row.kind) || !isOneOf(CONTENT_FORMATS, row.contentFormat)) return [];
+  const result = evaluateTemplateWrite({
+    kind: row.kind,
+    scope: row.scope === "system" ? "system" : "tenant",
+    contentFormat: row.contentFormat,
+    content: row.content,
+    rawMeta: parseStoredJson(row.meta),
+    variables: resolveTemplateVariables(registry, row.slug, storedRecord(row.variableSchema)),
+    resourceKeys: imageResourceKeysOf(row.linkedResources),
+  });
+  return result.ok ? result.publishIssues : result.issues;
+}

package/packages/bundled-features/src/template-resolver/handlers/template-write.ts

@@ -0,0 +1,183 @@
+import { fetchOne } from "@cosmicdrift/kumiko-framework/bun-db";
+import {
+  type HandlerContext,
+  type SessionUser,
+  SYSTEM_TENANT_ID,
+  type TemplateVariables,
+  type TenantId,
+  type WriteResult,
+} from "@cosmicdrift/kumiko-framework/engine";
+import {
+  AccessDeniedError,
+  ValidationError,
+  type WriteFailure,
+  writeFailure,
+} from "@cosmicdrift/kumiko-framework/errors";
+import { requireForTenant } from "../../shared/index.js";
+import type { ContentFormat, TemplateKind } from "../constants.js";
+import type { TemplateWriteScope } from "../layout-regions.js";
+import { type TemplateResourceRow, templateResourcesTable } from "../table.js";
+import type { TemplateValidation } from "../template-validation.js";
+import { executor } from "./shared.js";
+import {
+  evaluateTemplateWrite,
+  type TemplateWriteInput,
+  type TemplateWriteResult,
+} from "./template-gates.js";
+
+export type TemplateRowPayload = {
+  readonly slug: string;
+  readonly kind: TemplateKind;
+  readonly locale: string;
+  readonly content: string | null;
+  readonly contentFormat: ContentFormat;
+  readonly variableSchema: Readonly<Record<string, unknown>>;
+  readonly meta?: unknown;
+  readonly title?: string | null | undefined;
+  readonly folder?: string | null | undefined;
+  readonly parentTemplateId?: string | null | undefined;
+};
+
+export type WrittenTemplateRow = {
+  readonly id: string;
+  readonly slug: string;
+  readonly isNew: boolean;
+  readonly validation: TemplateValidation | null;
+};
+
+export type TemplateRowWrite = {
+  readonly ctx: HandlerContext;
+  readonly user: SessionUser;
+  readonly tenantId: TenantId;
+  readonly scope: TemplateWriteScope;
+  readonly status: "draft" | "active";
+  readonly variables: TemplateVariables;
+  readonly payload: TemplateRowPayload;
+};
+
+// The tenant-scope-under-system-tenant ban lives here so no write path can
+// create the inconsistent state the resolver does not model.
+export function refuseTenantScopeUnderSystemTenant(
+  scope: TemplateWriteScope,
+  tenantId: string,
+): WriteResult<never> | null {
+  if (scope !== "tenant" || tenantId !== SYSTEM_TENANT_ID) return null;
+  return writeFailure(
+    new AccessDeniedError({
+      i18nKey: "templateResolver.errors.useUpsertSystemForSystemTenant",
+      details: { reason: "system_tenant_override_not_allowed_use_upsert_system" },
+    }),
+  );
+}
+
+export type GatedTemplateWrite =
+  | { readonly ok: true; readonly evaluated: Extract<TemplateWriteResult, { ok: true }> }
+  | { readonly ok: false; readonly failure: WriteFailure };
+
+// Evaluation plus the publish rule: a row that goes active must not carry
+// publish issues, a draft may.
+export function gateTemplateWrite(
+  input: TemplateWriteInput,
+  status: "draft" | "active",
+): GatedTemplateWrite {
+  const evaluated = evaluateTemplateWrite(input);
+  if (!evaluated.ok) {
+    return {
+      ok: false,
+      failure: writeFailure(new ValidationError({ fields: [...evaluated.issues] })),
+    };
+  }
+  if (status === "active" && evaluated.publishIssues.length > 0) {
+    return {
+      ok: false,
+      failure: writeFailure(new ValidationError({ fields: [...evaluated.publishIssues] })),
+    };
+  }
+  return { ok: true, evaluated };
+}
+
+// Shared by every template write: validate through the one pipeline, then
+// create or update the (tenant, slug, kind, locale) row via the event-store
+// executor. linkedResources is never part of an update; resources are attached
+// separately.
+export async function writeTemplateRow(
+  args: TemplateRowWrite,
+): Promise<WriteResult<WrittenTemplateRow>> {
+  const { ctx, user, tenantId, scope, status, payload } = args;
+  const refused = refuseTenantScopeUnderSystemTenant(scope, tenantId);
+  if (refused !== null) return refused;
+  const { db, streamTenantId } = requireForTenant(ctx, tenantId);
+
+  const gated = gateTemplateWrite(
+    {
+      kind: payload.kind,
+      scope,
+      contentFormat: payload.contentFormat,
+      content: payload.content,
+      rawMeta: payload.meta,
+      variables: args.variables,
+    },
+    status,
+  );
+  if (!gated.ok) return gated.failure;
+  const { evaluated } = gated;
+
+  const existing = await fetchOne<TemplateResourceRow>(db, templateResourcesTable, {
+    tenantId,
+    slug: payload.slug,
+    kind: payload.kind,
+    locale: payload.locale,
+  });
+
+  const fields = {
+    slug: payload.slug,
+    kind: payload.kind,
+    locale: payload.locale,
+    content: evaluated.content,
+    contentFormat: payload.contentFormat,
+    variableSchema: JSON.stringify(payload.variableSchema),
+    meta: evaluated.metaJson,
+    title: payload.title ?? null,
+    folder: payload.folder ?? null,
+    scope,
+    parentTemplateId: payload.parentTemplateId ?? null,
+    status,
+  };
+
+  if (existing) {
+    const result = await executor.update(
+      { id: existing.id, version: existing.version, changes: fields },
+      user,
+      db,
+      { streamTenantId },
+    );
+    if (!result.isSuccess) return result;
+    return {
+      isSuccess: true,
+      data: {
+        id: String(existing.id),
+        slug: payload.slug,
+        isNew: false,
+        validation: evaluated.validation,
+      },
+    };
+  }
+
+  const result = await executor.create({ ...fields, linkedResources: "{}", tenantId }, user, db, {
+    streamTenantId,
+  });
+  if (!result.isSuccess) return result;
+  // @cast-boundary db-row — executor.create returnt Record-row aus
+  // INSERT RETURNING; shape { id } ist garantiert weil PK in der
+  // Returning-Klausel ist.
+  const createdRow = result.data as { id: string | number };
+  return {
+    isSuccess: true,
+    data: {
+      id: String(createdRow.id),
+      slug: payload.slug,
+      isNew: true,
+      validation: evaluated.validation,
+    },
+  };
+}

package/packages/bundled-features/src/template-resolver/handlers/tenant-overrides.query.ts

@@ -0,0 +1,55 @@
+import { selectMany } from "@cosmicdrift/kumiko-framework/bun-db";
+import { defineQueryHandler, SYSTEM_TENANT_ID } from "@cosmicdrift/kumiko-framework/engine";
+import * as z from "zod";
+import { TenantQueries } from "../../tenant/index.js";
+import { type TemplateResourceRow, templateResourcesTable } from "../table.js";
+import { kindSchema, localeSchema, templateSlugSchema } from "./shared.js";
+
+const TENANT_OVERRIDES_REASON =
+  "SystemAdmin template overview counts how many tenants override one system template; it reads tenant-scope template rows of every tenant and returns only counts, never tenant ids or content";
+
+const tenantIdsSchema = z.array(z.string());
+
+type OverrideRow = Pick<TemplateResourceRow, "tenantId" | "status">;
+
+export const tenantOverridesQuery = defineQueryHandler({
+  name: "tenant-overrides",
+  schema: z.object({
+    slug: templateSlugSchema,
+    kind: kindSchema,
+    locale: localeSchema.optional(),
+  }),
+  access: { roles: ["SystemAdmin"] },
+  description:
+    "Counts how many enabled tenants override one template with an active or a draft version, next to the number of enabled tenants; use it before changing a system template to see how many tenants keep their own copy. Returns counts only, no tenant ids.",
+  escapeHatch: { grants: ["unsafeRaw"], reason: TENANT_OVERRIDES_REASON },
+  handler: async (query, ctx) => {
+    const { slug, kind, locale } = query.payload;
+    const rows = await selectMany<OverrideRow>(ctx.db.unsafeRaw(), templateResourcesTable, {
+      slug,
+      kind,
+      scope: "tenant",
+      ...(locale === undefined ? {} : { locale }),
+    });
+
+    const hasTenantFeature =
+      ctx.registry.getQueryHandler(TenantQueries.activeTenantIds) !== undefined;
+    const enabledTenantIds = hasTenantFeature
+      ? new Set(tenantIdsSchema.parse(await ctx.query(TenantQueries.activeTenantIds, {})))
+      : null;
+
+    const statusByTenant = new Map<string, "active" | "draft">();
+    for (const row of rows) {
+      if (row.tenantId === SYSTEM_TENANT_ID || row.status === "archived") continue;
+      if (enabledTenantIds !== null && !enabledTenantIds.has(row.tenantId)) continue;
+      if (statusByTenant.get(row.tenantId) === "active") continue;
+      statusByTenant.set(row.tenantId, row.status === "active" ? "active" : "draft");
+    }
+    const statuses = [...statusByTenant.values()];
+    return {
+      activeOverrides: statuses.filter((status) => status === "active").length,
+      draftOverrides: statuses.filter((status) => status === "draft").length,
+      totalTenants: enabledTenantIds === null ? null : enabledTenantIds.size,
+    };
+  },
+});