@cosmicdrift/kumiko-samples 0.362.0 → 0.364.0

package/packages/bundled-features/src/template-resolver/handlers/collection-set.write.ts

@@ -4,8 +4,11 @@ import {
   defineWriteHandler,
   type TenantId,
 } from "@cosmicdrift/kumiko-framework/engine";
+import { ValidationError, writeFailure } from "@cosmicdrift/kumiko-framework/errors";
 import * as z from "zod";
 import { requireForTenant } from "../../shared/index.js";
+import { COLLECTION_REFUSED_KINDS } from "../constants.js";
+import { documentViolationsToFieldIssues, sanitizeTemplateBody } from "../document-sanitizer.js";
 import {
   type CollectionEntryRow,
   collectionStore,
@@ -40,6 +43,20 @@ export function makeCollectionSetWrite(collection: ContentCollectionDefinition)
         ? `Creates or overwrites the caller's own "${collection.id}" entry at a slug and locale, live on save with no draft stage; it always writes the acting user's entry, never another user's.`
         : `Creates or overwrites the tenant-wide "${collection.id}" entry at a slug and locale, live on save with no draft stage; the change is visible to everyone who may reach this shared collection.`,
     handler: async (event, ctx) => {
+      if (COLLECTION_REFUSED_KINDS.includes(collection.kind)) {
+        return writeFailure(
+          new ValidationError({
+            fields: [
+              {
+                path: "kind",
+                code: "kind_not_allowed",
+                i18nKey: "templateResolver.errors.collection.kindNotAllowed",
+                params: { detail: collection.kind },
+              },
+            ],
+          }),
+        );
+      }
       const override = event.payload.tenantIdOverride;
       // @cast-boundary engine-payload — override is a zod-validated string, the
       // user's own tenantId is already TenantId-branded.
@@ -50,6 +67,17 @@ export function makeCollectionSetWrite(collection: ContentCollectionDefinition)
       // someone else's signature.
       const owner = store.scopeOf(event.user);
 
+      const body = sanitizeTemplateBody({
+        kind: collection.kind,
+        contentFormat: event.payload.contentFormat,
+        content: event.payload.content,
+      });
+      if (!body.ok) {
+        return writeFailure(
+          new ValidationError({ fields: documentViolationsToFieldIssues(body.violations) }),
+        );
+      }
+
       const existing = await fetchOne<CollectionEntryRow>(db, store.table, {
         tenantId,
         slug: event.payload.slug,
@@ -68,7 +96,7 @@ export function makeCollectionSetWrite(collection: ContentCollectionDefinition)
             // the template upserts put on the row.
             changes: {
               title: event.payload.title,
-              content: event.payload.content,
+              content: body.content,
               contentFormat: event.payload.contentFormat,
               folder: event.payload.folder ?? null,
             },
@@ -91,7 +119,7 @@ export function makeCollectionSetWrite(collection: ContentCollectionDefinition)
           kind: collection.kind,
           locale: event.payload.locale,
           title: event.payload.title,
-          content: event.payload.content,
+          content: body.content,
           contentFormat: event.payload.contentFormat,
           folder: event.payload.folder ?? null,
           ...store.createDefaults(tenantId),

package/packages/bundled-features/src/template-resolver/handlers/copy-locale.write.ts

@@ -0,0 +1,160 @@
+import { fetchOne } from "@cosmicdrift/kumiko-framework/bun-db";
+import {
+  defineWriteHandler,
+  type HandlerContext,
+  SYSTEM_TENANT_ID,
+} from "@cosmicdrift/kumiko-framework/engine";
+import {
+  AccessDeniedError,
+  NotFoundError,
+  ValidationError,
+  writeFailure,
+} from "@cosmicdrift/kumiko-framework/errors";
+import { isOneOf } from "@cosmicdrift/kumiko-types/type-guards";
+import * as z from "zod";
+import { requireForTenant } from "../../shared/index.js";
+import { CONTENT_FORMATS } from "../constants.js";
+import { parseLinkedResourceEntries } from "../linked-resources.js";
+import { TemplateResolverErrors } from "../qualified-names.js";
+import { type TemplateResourceRow, templateResourcesTable } from "../table.js";
+import { toWorkingRow } from "../template-draft.js";
+import { attachTemplateResources, duplicateLinkedResourceFiles } from "../template-resources.js";
+import { resolveTemplateVariables } from "../template-validation.js";
+import { targetExistsIssue } from "./bundle-import.js";
+import { kindSchema, localeSchema, templateSlugSchema } from "./shared.js";
+import { parseStoredJson, storedRecord } from "./template-gates.js";
+import { refuseTenantScopeUnderSystemTenant, writeTemplateRow } from "./template-write.js";
+
+type CopyScope = "tenant" | "system";
+type WriteCtx = HandlerContext;
+
+function readDbFor(ctx: WriteCtx, scope: CopyScope) {
+  return scope === "system" ? requireForTenant(ctx, SYSTEM_TENANT_ID).db : ctx.db;
+}
+
+// A tenant copy may start from the system default; a system copy only from system rows.
+async function findCopySource(
+  ctx: WriteCtx,
+  where: {
+    scope: CopyScope;
+    tenantId: string;
+    slug: string;
+    kind: string;
+    locale: string;
+  },
+) {
+  const { scope, tenantId, slug, kind, locale } = where;
+  const readDb = readDbFor(ctx, scope);
+  const own = await fetchOne<TemplateResourceRow>(readDb, templateResourcesTable, {
+    tenantId,
+    slug,
+    kind,
+    locale,
+  });
+  // An archived tenant row is not an active source: the system default applies instead.
+  if (scope === "system" || (own && own.status !== "archived")) return own;
+  return fetchOne<TemplateResourceRow>(readDb, templateResourcesTable, {
+    tenantId: SYSTEM_TENANT_ID,
+    slug,
+    kind,
+    locale,
+    status: "active",
+  });
+}
+
+export const copyLocaleWrite = defineWriteHandler({
+  name: "copy-locale",
+  schema: z.object({
+    slug: templateSlugSchema,
+    kind: kindSchema,
+    fromLocale: localeSchema,
+    toLocale: localeSchema,
+    overwrite: z.boolean().default(false),
+    /** "system" copies between system-default rows; SystemAdmin only. */
+    scope: z.enum(["tenant", "system"]).default("tenant"),
+  }),
+  access: { roles: ["TenantAdmin", "SystemAdmin"] },
+  description:
+    "Copies the text of one locale of a template into another locale as a draft override of the caller's tenant, taking the tenant's own row or else the system default as the source; use it as the starting point for a translation. It refuses an existing target unless overwrite is set. With scope system (SystemAdmin only) both source and target are system-default rows and the target lands as a system draft; any other caller gets a 403.",
+  handler: async (event, ctx) => {
+    const { slug, kind, fromLocale, toLocale, overwrite, scope } = event.payload;
+    if (scope === "system" && !event.user.roles.includes("SystemAdmin")) {
+      return writeFailure(
+        new AccessDeniedError({
+          i18nKey: "errors.access.denied",
+          details: { reason: TemplateResolverErrors.systemAdminRequired },
+        }),
+      );
+    }
+    const tenantId = scope === "system" ? SYSTEM_TENANT_ID : event.user.tenantId;
+    const refused = refuseTenantScopeUnderSystemTenant(scope, tenantId);
+    if (refused !== null) return refused;
+
+    const readDb = readDbFor(ctx, scope);
+    const storedSource = await findCopySource(ctx, {
+      scope,
+      tenantId,
+      slug,
+      kind,
+      locale: fromLocale,
+    });
+    const source = storedSource && toWorkingRow(storedSource, tenantId);
+    if (!source || !isOneOf(CONTENT_FORMATS, source.contentFormat)) {
+      return writeFailure(new NotFoundError("template-resource", `${slug}/${fromLocale}`));
+    }
+
+    if (!overwrite) {
+      const target = await fetchOne<TemplateResourceRow>(readDb, templateResourcesTable, {
+        tenantId,
+        slug,
+        kind,
+        locale: toLocale,
+      });
+      if (target) {
+        return writeFailure(new ValidationError({ fields: [targetExistsIssue(toLocale)] }));
+      }
+    }
+
+    const variableSchema = storedRecord(source.variableSchema);
+    const written = await writeTemplateRow({
+      ctx,
+      user: event.user,
+      tenantId,
+      scope,
+      status: "draft",
+      variables: resolveTemplateVariables(ctx.registry, slug, variableSchema),
+      payload: {
+        slug,
+        kind,
+        locale: toLocale,
+        content: source.content,
+        contentFormat: source.contentFormat,
+        variableSchema,
+        meta: parseStoredJson(source.meta),
+        title: source.title,
+        folder: source.folder,
+      },
+    });
+    if (!written.isSuccess) return written;
+    const sourceResources = parseLinkedResourceEntries(source.linkedResources);
+    // A system source's files belong to the system tenant: the tenant gets its own copies so
+    // previews, exports and the tenant's override keep working independent of the system row.
+    const resources =
+      source.tenantId === tenantId
+        ? { isSuccess: true as const, data: sourceResources }
+        : await duplicateLinkedResourceFiles(ctx, {
+            user: event.user,
+            tenantId,
+            resources: sourceResources,
+          });
+    if (!resources.isSuccess) return resources;
+    const attached = await attachTemplateResources(ctx, {
+      user: event.user,
+      tenantId,
+      templateId: written.data.id,
+      resources: resources.data,
+    });
+    if (!attached.isSuccess) return attached;
+    return written;
+  },
+});

package/packages/bundled-features/src/template-resolver/handlers/diff-to-system.query.ts

@@ -0,0 +1,33 @@
+import { fetchOne } from "@cosmicdrift/kumiko-framework/bun-db";
+import { defineQueryHandler, SYSTEM_TENANT_ID } from "@cosmicdrift/kumiko-framework/engine";
+import { NotFoundError } from "@cosmicdrift/kumiko-framework/errors";
+import * as z from "zod";
+import { type TemplateResourceRow, templateResourcesTable } from "../table.js";
+import { isHiddenSystemDraft } from "../template-draft.js";
+import { buildOverrideDiff } from "./override-diff.js";
+
+export const diffToSystemQuery = defineQueryHandler({
+  name: "diff-to-system",
+  schema: z.object({ id: z.string().min(1) }),
+  access: { roles: ["TenantAdmin", "SystemAdmin"] },
+  description:
+    "Compares one tenant override with the system template of the same slug, kind and locale block by block and lists the changed meta settings; use it to show what an override changes before resetting it to the system version.",
+  handler: async (query, ctx) => {
+    const tenantRow = await fetchOne<TemplateResourceRow>(ctx.db, templateResourcesTable, {
+      id: query.payload.id,
+    });
+    if (!tenantRow || tenantRow.tenantId !== query.user.tenantId || tenantRow.scope !== "tenant") {
+      throw new NotFoundError("template-resource", query.payload.id);
+    }
+    const systemRow = await fetchOne<TemplateResourceRow>(ctx.db, templateResourcesTable, {
+      tenantId: SYSTEM_TENANT_ID,
+      slug: tenantRow.slug,
+      kind: tenantRow.kind,
+      locale: tenantRow.locale,
+    });
+    if (!systemRow || isHiddenSystemDraft(query.user, systemRow))
+      throw new NotFoundError("template-resource", tenantRow.slug);
+
+    return buildOverrideDiff(tenantRow, systemRow);
+  },
+});

package/packages/bundled-features/src/template-resolver/handlers/discard-draft.write.ts

@@ -0,0 +1,52 @@
+import { defineWriteHandler } from "@cosmicdrift/kumiko-framework/engine";
+import { NotFoundError, ValidationError, writeFailure } from "@cosmicdrift/kumiko-framework/errors";
+import * as z from "zod";
+import { TemplateResolverErrors } from "../qualified-names.js";
+import { executor } from "./shared.js";
+import { loadTargetRow, type StatusTarget, writeAccessFor } from "./toggle-status.write.js";
+
+function createDiscardDraftHandler(name: string, target: StatusTarget, description: string) {
+  return defineWriteHandler({
+    name,
+    schema: z.object({ id: z.string().min(1) }),
+    access: writeAccessFor(target),
+    ...(target === "system" ? { agent: { risk: "high" as const } } : {}),
+    description,
+    handler: async (event, ctx) => {
+      const { db, scoped, row } = await loadTargetRow(ctx, target, event.user, event.payload.id);
+      if (!row) return writeFailure(new NotFoundError("template-resource", event.payload.id));
+      if (row.draft === null) {
+        return writeFailure(
+          new ValidationError({
+            fields: [
+              {
+                path: "id",
+                code: TemplateResolverErrors.noDraft,
+                i18nKey: "templateResolver.errors.noDraft",
+              },
+            ],
+          }),
+        );
+      }
+      const result = await executor.update(
+        { id: row.id, version: row.version, changes: { draft: null } },
+        event.user,
+        db,
+        scoped ? { streamTenantId: scoped.streamTenantId } : undefined,
+      );
+      if (!result.isSuccess) return result;
+      return { isSuccess: true as const, data: { id: String(row.id), discarded: true } };
+    },
+  });
+}
+
+export const discardDraftWrite = createDiscardDraftHandler(
+  "discard-draft",
+  "own",
+  "Throws away the open draft of one template resource of the caller's tenant so the editor shows the active version again; the served version is untouched. Refused with no_draft when there is no draft.",
+);
+export const discardDraftSystemWrite = createDiscardDraftHandler(
+  "discard-draft-system",
+  "system",
+  "Throws away the open draft of one system-default template; the served version stays. SystemAdmin only, refused with no_draft when there is no draft.",
+);

package/packages/bundled-features/src/template-resolver/handlers/export-bundle.query.ts

@@ -0,0 +1,138 @@
+import { isDeepStrictEqual } from "node:util";
+import { selectMany } from "@cosmicdrift/kumiko-framework/bun-db";
+import { defineQueryHandler, SYSTEM_TENANT_ID } from "@cosmicdrift/kumiko-framework/engine";
+import { NotFoundError, ValidationError } from "@cosmicdrift/kumiko-framework/errors";
+import * as z from "zod";
+import {
+  isFileAttachmentEntry,
+  isPdfAttachmentLink,
+  type LinkedResourceEntry,
+  parseLinkedResourceEntries,
+} from "../linked-resources.js";
+import { TemplateResolverErrors } from "../qualified-names.js";
+import { type TemplateResourceRow, templateResourcesTable } from "../table.js";
+import type { TemplateBundle } from "../template-bundle.js";
+import { readTemplateResource } from "../template-resources.js";
+import { kindSchema, templateSlugSchema } from "./shared.js";
+import { parseStoredJson, storedRecord } from "./template-gates.js";
+
+// The files live in the system tenant's key space; readTemplateResource only
+// serves the caller's own tenant, so anyone else would end in a misleading NotFound.
+function assertSystemFilesReadable(
+  scope: "tenant" | "system",
+  entries: Iterable<LinkedResourceEntry>,
+  callerTenantId: string,
+): void {
+  // skip: tenant exports read the caller's own files.
+  if (scope === "tenant") return;
+  // skip: the system tenant reads its own key space.
+  if (callerTenantId === SYSTEM_TENANT_ID) return;
+  const hasFileResources = [...entries].some((entry) => !isPdfAttachmentLink(entry));
+  // skip: PDF attachment links carry no file to read.
+  if (!hasFileResources) return;
+  throw new ValidationError({
+    fields: [
+      {
+        path: "scope",
+        code: "system_resources_need_system_tenant",
+        i18nKey: "templateResolver.errors.template.systemResourcesNeedSystemTenant",
+      },
+    ],
+  });
+}
+
+// A bundle carries one contentFormat and one variableSchema for all locales; importing it would
+// relabel the rows that differ from the first.
+function assertLocalesShareFormat(rows: readonly TemplateResourceRow[]): void {
+  const [first, ...rest] = rows;
+  // skip: a bundle without rows has nothing to compare
+  if (first === undefined) return;
+  const firstSchema = storedRecord(first.variableSchema);
+  const differing = rest.find(
+    (row) =>
+      row.contentFormat !== first.contentFormat ||
+      !isDeepStrictEqual(storedRecord(row.variableSchema), firstSchema),
+  );
+  // skip: all locales agree
+  if (differing === undefined) return;
+  throw new ValidationError({
+    fields: [
+      {
+        path: "slug",
+        code: TemplateResolverErrors.bundleLocalesDiffer,
+        i18nKey: "templateResolver.errors.template.bundleLocalesDiffer",
+      },
+    ],
+  });
+}
+
+export const exportBundleQuery = defineQueryHandler({
+  name: "export-bundle",
+  schema: z.object({
+    slug: templateSlugSchema,
+    kind: kindSchema,
+    scope: z.enum(["tenant", "system"]).default("tenant"),
+  }),
+  access: { roles: ["TenantAdmin", "SystemAdmin"] },
+  description:
+    "Exports every locale of one template (the caller's own rows, or the active system rows) together with its linked resource files as a self-contained bundle that import-bundle can read back, for example to move a template between tenants or environments.",
+  handler: async (query, ctx) => {
+    const { slug, kind, scope } = query.payload;
+    const found = await selectMany<TemplateResourceRow>(
+      ctx.db,
+      templateResourcesTable,
+      scope === "system"
+        ? { tenantId: SYSTEM_TENANT_ID, slug, kind, scope: "system", status: "active" }
+        : { tenantId: query.user.tenantId, slug, kind, scope: "tenant" },
+    );
+    const rows = found
+      .filter((row) => row.status !== "archived")
+      .sort((a, b) => a.locale.localeCompare(b.locale));
+    const first = rows[0];
+    if (!first) throw new NotFoundError("template-resource", slug);
+    assertLocalesShareFormat(rows);
+
+    const locales: Record<string, { body: string; meta?: unknown }> = {};
+    const entryByKey = new Map<string, LinkedResourceEntry>();
+    for (const row of rows) {
+      const meta = parseStoredJson(row.meta);
+      locales[row.locale] = { body: row.content ?? "", ...(meta === undefined ? {} : { meta }) };
+      for (const [key, entry] of Object.entries(parseLinkedResourceEntries(row.linkedResources))) {
+        if (!entryByKey.has(key)) entryByKey.set(key, entry);
+      }
+    }
+
+    assertSystemFilesReadable(scope, entryByKey.values(), query.user.tenantId);
+
+    const resources: TemplateBundle["resources"] = {};
+    const pdfAttachments: TemplateBundle["pdfAttachments"] = {};
+    for (const [key, entry] of entryByKey) {
+      if (isPdfAttachmentLink(entry)) {
+        pdfAttachments[key] = { templateSlug: entry.templateSlug, fileName: entry.fileName };
+        continue;
+      }
+      const attachment = isFileAttachmentEntry(entry);
+      const file = await readTemplateResource(
+        { db: ctx.db, files: ctx.files, user: query.user },
+        attachment ? entry.fileRefId : entry,
+      );
+      if (!file) throw new NotFoundError("template-resource-file", key);
+      resources[key] = {
+        fileName: attachment ? entry.fileName : file.fileName,
+        contentType: file.contentType,
+        base64: Buffer.from(file.bytes).toString("base64"),
+        ...(attachment && { purpose: "attachment" as const }),
+      };
+    }
+
+    return {
+      slug,
+      kind,
+      contentFormat: first.contentFormat,
+      variableSchema: storedRecord(first.variableSchema),
+      locales,
+      resources,
+      pdfAttachments,
+    };
+  },
+});

package/packages/bundled-features/src/template-resolver/handlers/find-by-id.query.ts

@@ -2,27 +2,28 @@ import { fetchOne } from "@cosmicdrift/kumiko-framework/bun-db";
 import { defineQueryHandler } from "@cosmicdrift/kumiko-framework/engine";
 import * as z from "zod";
 import { type TemplateResourceRow, templateResourcesTable } from "../table.js";
+import { draftViewerTenantId, isHiddenSystemDraft, toWorkingRow } from "../template-draft.js";
 
 // Admin-Lookup für UI-Edit-Flow. Returnt das raw Template inkl. draft/
 // archived Status. Tenant-Isolation: User sieht nur Templates des
 // eigenen Tenants oder SYSTEM_TENANT (system-defaults sind public-
-// readable). SystemAdmin sieht alle. Anonymous bleibt aus — Public-
+// readable); ctx.db is tenant-scoped for every role, so the check below is defense in depth. Anonymous bleibt aus — Public-
 // Read geht über resolveTemplate aus der API, nicht hier.
 export const findByIdQuery = defineQueryHandler({
   name: "find-by-id",
   schema: z.object({ id: z.string().min(1) }),
   access: { roles: ["TenantAdmin", "SystemAdmin", "User"] },
   description:
-    "Reads one template resource by row id with its content, variable schema, scope and draft/archived status, but only when it belongs to the caller's tenant or is a system default; use it to load a template into the admin editor.",
+    "Reads the version of one template resource an editor works on, by row id: the open draft if there is one (status draft), else the stored version, with content, variable schema and scope, but only when it belongs to the caller's tenant or is a served system default (a never-served system draft is visible to a SystemAdmin only); `active` is the version number and since-time the resolver serves, null when none is served. Use it to load a template into the admin editor.",
   handler: async (query, ctx) => {
-    const row = await fetchOne<TemplateResourceRow>(ctx.db, templateResourcesTable, {
+    const stored = await fetchOne<TemplateResourceRow>(ctx.db, templateResourcesTable, {
       id: query.payload.id,
     });
-    if (!row) return null;
-    const isSystemAdmin = query.user.roles.includes("SystemAdmin");
+    if (!stored || isHiddenSystemDraft(query.user, stored)) return null;
+    const row = toWorkingRow(stored, draftViewerTenantId(query.user, stored));
     const isOwnTenant = row.tenantId === query.user.tenantId;
     const isSystemTemplate = row.scope === "system";
-    if (!isSystemAdmin && !isOwnTenant && !isSystemTemplate) return null;
+    if (!isOwnTenant && !isSystemTemplate) return null;
 
     return {
       id: String(row.id),
@@ -35,10 +36,12 @@ export const findByIdQuery = defineQueryHandler({
       contentFormat: row.contentFormat,
       variableSchema: row.variableSchema,
       linkedResources: row.linkedResources,
+      meta: row.meta,
       scope: row.scope,
       parentTemplateId: row.parentTemplateId,
       status: row.status,
       modifiedAt: row.modifiedAt,
+      active: row.active,
     };
   },
 });

package/packages/bundled-features/src/template-resolver/handlers/import-bundle-system.write.ts

@@ -0,0 +1,42 @@
+import { defineWriteHandler, SYSTEM_TENANT_ID } from "@cosmicdrift/kumiko-framework/engine";
+import { ValidationError, writeFailure } from "@cosmicdrift/kumiko-framework/errors";
+import * as z from "zod";
+import { templateBundleSchema } from "../template-bundle.js";
+import { importTemplateBundle } from "./bundle-import.js";
+
+export const importBundleSystemWrite = defineWriteHandler({
+  name: "import-bundle-system",
+  schema: z.object({ bundle: templateBundleSchema }),
+  access: { roles: ["SystemAdmin"] },
+  // A system template change reaches every tenant without an override.
+  agent: { risk: "high" as const },
+  description:
+    "Imports a template bundle as system-default templates, active straight away and overwriting existing system rows; SystemAdmin only. Bundles with resource files need a caller in the system tenant, because the files are stored in the caller's file space.",
+  handler: (event, ctx) => {
+    const { bundle } = event.payload;
+    if (Object.keys(bundle.resources).length > 0 && event.user.tenantId !== SYSTEM_TENANT_ID) {
+      return Promise.resolve(
+        writeFailure(
+          new ValidationError({
+            fields: [
+              {
+                path: "bundle.resources",
+                code: "system_resources_need_system_tenant",
+                i18nKey: "templateResolver.errors.template.systemResourcesNeedSystemTenant",
+              },
+            ],
+          }),
+        ),
+      );
+    }
+    return importTemplateBundle({
+      ctx,
+      user: event.user,
+      tenantId: SYSTEM_TENANT_ID,
+      scope: "system",
+      status: "active",
+      bundle,
+      overwrite: true,
+    });
+  },
+});

package/packages/bundled-features/src/template-resolver/handlers/import-bundle.write.ts

@@ -0,0 +1,22 @@
+import { defineWriteHandler } from "@cosmicdrift/kumiko-framework/engine";
+import * as z from "zod";
+import { templateBundleSchema } from "../template-bundle.js";
+import { importTemplateBundle } from "./bundle-import.js";
+
+export const importBundleWrite = defineWriteHandler({
+  name: "import-bundle",
+  schema: z.object({ bundle: templateBundleSchema, overwrite: z.boolean().default(false) }),
+  access: { roles: ["TenantAdmin", "SystemAdmin"] },
+  description:
+    "Imports a template bundle (all locales plus resource files, as produced by export-bundle) into the caller's tenant as drafts; it refuses a locale that already has an override unless overwrite is set, and publish makes the drafts live.",
+  handler: (event, ctx) =>
+    importTemplateBundle({
+      ctx,
+      user: event.user,
+      tenantId: event.user.tenantId,
+      scope: "tenant",
+      status: "draft",
+      bundle: event.payload.bundle,
+      overwrite: event.payload.overwrite,
+    }),
+});