@cosmicdrift/kumiko-samples 0.362.0 → 0.364.0

package/packages/bundled-features/src/waitlist/mail.ts

@@ -1,4 +1,10 @@
-import type { AuthMailContent } from "../auth-email-password/index.js";
+import {
+  type NotificationLocalizedTemplate,
+  type NotificationRecordMapping,
+  type TemplateVariables,
+  templateVariable,
+} from "@cosmicdrift/kumiko-framework/engine";
+import { mailHeading, mailParagraph, mailRepeatedRows } from "../shared/index.js";
 
 export type WaitlistMailLocale = "en" | "de" | "es";
 
@@ -72,43 +78,88 @@ export function resolveWaitlistMailLocale(locale: string | undefined): WaitlistM
   return isConfirmationLocale(language) ? language : "en";
 }
 
+export const WAITLIST_CONFIRMATION_VARIABLES: TemplateVariables = {
+  subject: templateVariable.text({ required: true }),
+  intro: templateVariable.text({ required: true }),
+  footer: templateVariable.text({ required: true }),
+};
+
+// Only `name` is a plain entry field; the details rows are composed from several fields.
+export const WAITLIST_ADMIN_NOTICE_RECORD: NotificationRecordMapping = {
+  entity: "waitlistEntry",
+  map: { name: "name" },
+};
+
+export const WAITLIST_ADMIN_NOTICE_VARIABLES: TemplateVariables = {
+  name: templateVariable.text({ required: true }),
+  details: templateVariable.list(
+    { text: templateVariable.text({ required: true }) },
+    { required: true },
+  ),
+};
+
+// The app name is optional, so the sentences that mention it are computed in
+// code and handed over as variables; the template keeps heading and structure.
 // The submitter's name stays out: the address is unverified, so any text in
 // this mail could be planted by whoever typed someone else's email.
-export function renderWaitlistConfirmationEmail(args: {
+export function waitlistConfirmationVariables(args: {
   readonly locale: string | undefined;
   readonly appName?: string | undefined;
-}): AuthMailContent {
+}): { readonly subject: string; readonly intro: string; readonly footer: string } {
   const t = CONFIRMATION_STRINGS[resolveWaitlistMailLocale(args.locale)];
   return {
     subject: t.subject(args.appName),
-    header: t.header,
-    sections: [{ text: t.intro(args.appName) }],
+    intro: t.intro(args.appName),
     footer: t.footer(args.appName),
   };
 }
 
+export function waitlistConfirmationTemplate(): NotificationLocalizedTemplate {
+  return Object.fromEntries(
+    Object.entries(CONFIRMATION_STRINGS).map(([locale, t]) => [
+      locale,
+      {
+        body: [mailHeading(t.header), mailParagraph("{intro}"), mailParagraph("{footer}")].join(""),
+        meta: { subject: "{{subject}}", category: "transactional" as const },
+      },
+    ]),
+  );
+}
+
 // Operator-facing, so the entrant's locale does not apply: en/de, en default.
 export function resolveWaitlistAdminMailLocale(adminLocale: string | undefined): "en" | "de" {
   return languageOf(adminLocale) === "de" ? "de" : "en";
 }
 
-export function renderWaitlistAdminNoticeEmail(args: {
+export function waitlistAdminNoticeVariables(args: {
   readonly name: string;
   readonly email: string;
   readonly company: string | undefined;
   readonly message: string | undefined;
-  readonly adminLocale: string | undefined;
-}): AuthMailContent {
-  const t = ADMIN_NOTICE_STRINGS[resolveWaitlistAdminMailLocale(args.adminLocale)];
-  const details = [
-    `${args.name} <${args.email}>`,
-    ...(args.company ? [args.company] : []),
-    ...(args.message ? [args.message] : []),
-  ];
+}): { readonly name: string; readonly details: readonly { readonly text: string }[] } {
   return {
-    subject: t.subject(args.name),
-    header: t.header,
-    sections: [{ text: t.intro }, { text: details.join("\n") }],
-    footer: t.footer,
+    name: args.name,
+    details: [
+      `${args.name} <${args.email}>`,
+      ...(args.company ? [args.company] : []),
+      ...(args.message ? [args.message] : []),
+    ].map((text) => ({ text })),
   };
 }
+
+export function waitlistAdminNoticeTemplate(): NotificationLocalizedTemplate {
+  return Object.fromEntries(
+    Object.entries(ADMIN_NOTICE_STRINGS).map(([locale, t]) => [
+      locale,
+      {
+        body: [
+          mailHeading(t.header),
+          mailParagraph(t.intro),
+          mailRepeatedRows("details", "text"),
+          mailParagraph(t.footer),
+        ].join(""),
+        meta: { subject: t.subject("{{name}}"), category: "transactional" as const },
+      },
+    ]),
+  );
+}

package/packages/bundled-features/src/waitlist/options.ts

@@ -38,5 +38,5 @@ export const DEFAULT_SUBMIT_RATE_LIMIT: RateLimitOption = {
 };
 
 export const DEFAULT_SUBMIT_EMAIL_RATE_LIMITS: readonly PayloadRateLimitOption[] = [
-  { per: { payloadField: "email" }, limit: 3, windowSeconds: 24 * 60 * 60 },
+  { per: { payloadField: "email" }, limit: 3, windowSeconds: 24 * 60 * 60, normalize: "email" },
 ];

package/packages/bundled-features/src/workflow-runner/changes.json

@@ -1,4 +1,10 @@
 [
+  {
+    "version": "0.364.0",
+    "type": "fix",
+    "title": "Workflow run-failed and retry logs carry the original cause",
+    "detail": "The ops log used to print the generic `workflow step N failed` wrapper. It now prints the underlying error, while the persisted event still carries the error class only."
+  },
   {
     "version": "0.353.0",
     "type": "fix",

package/packages/bundled-features/src/workflow-runner/event-trigger.ts

@@ -22,7 +22,7 @@ import {
   describeWorkflowStepError,
   getStep,
   SYSTEM_TENANT_ID,
-  type TenantId,
+  unwrapWorkflowStepError,
   WORKFLOW_AGGREGATE_TYPE,
   WORKFLOW_RUN_FAILED_TYPE,
   WorkflowStepError,
@@ -71,7 +71,7 @@ export function assertEventTriggerStepsSupported(workflow: WorkflowDefinition):
     steps = buildPipelineSteps(workflow.pipelineDef, {
       type: "workflow-registration-probe",
       payload: {},
-      user: createSystemUser(SYSTEM_TENANT_ID as TenantId),
+      user: createSystemUser(SYSTEM_TENANT_ID),
     });
   } catch (error) {
     throw new Error(
@@ -168,7 +168,7 @@ export function registerEventTrigger(r: FeatureRegistrar, workflow: WorkflowDefi
             runId,
             workflowName: workflow.name,
             stepIndex,
-            error: String(error),
+            error: String(unwrapWorkflowStepError(error)),
           });
           const failedPayload: WorkflowRunFailedPayload = {
             workflowName: workflow.name,

package/packages/bundled-features/src/workflow-runner/handlers/resume-run.write.ts

@@ -40,6 +40,7 @@ import {
   runStepList,
   type StepInstance,
   SYSTEM_ROLE,
+  unwrapWorkflowStepError,
   WORKFLOW_AGGREGATE_TYPE,
   WORKFLOW_RESUMED_TYPE,
   WORKFLOW_RETRY_SCHEDULED_TYPE,
@@ -392,7 +393,12 @@ async function runResumedPipeline(ctx: HandlerContext, input: ResumedPipelineInp
     });
     return { isSuccess: true as const, data: { outcome: "completed" as const } };
   } catch (error) {
-    log.warn("workflow run failed", { runId, workflowName, stepIndex, error: String(error) });
+    log.warn("workflow run failed", {
+      runId,
+      workflowName,
+      stepIndex,
+      error: String(unwrapWorkflowStepError(error)),
+    });
     // The input stepIndex is the suspended step; the failure happened at the step the resumed pass reached.
     const failedPayload: WorkflowRunFailedPayload = {
       workflowName,

package/samples/apps/ui-walkthrough/package.json

@@ -10,9 +10,12 @@
   "dependencies": {
     "@cosmicdrift/kumiko-bundled-features": "workspace:*",
     "@cosmicdrift/kumiko-dev-server": "workspace:*",
+    "@cosmicdrift/kumiko-document-designer": "workspace:*",
     "@cosmicdrift/kumiko-dispatcher-live": "workspace:*",
     "@cosmicdrift/kumiko-framework": "workspace:*",
     "@cosmicdrift/kumiko-headless": "workspace:*",
+    "@cosmicdrift/kumiko-renderer-mail-html": "workspace:*",
+    "@cosmicdrift/kumiko-renderer-puppeteer-client": "workspace:*",
     "@cosmicdrift/kumiko-renderer-web": "workspace:*",
     "@cosmicdrift/kumiko-server-runtime": "workspace:*",
     "react": "^19.2.6",
@@ -22,5 +25,13 @@
   },
   "devDependencies": {
     "@cosmicdrift/kumiko-testing": "workspace:*"
+  },
+  "kumiko": {
+    "assets": [
+      {
+        "name": "logo-nordlicht.png",
+        "source": "src/app/assets/logo-nordlicht.png"
+      }
+    ]
   }
 }

package/samples/apps/ui-walkthrough/playwright.config.ts

@@ -7,18 +7,51 @@
 // setupTestStack-Default ist ephemeral (fresh kumiko_test_<random> DB),
 // deshalb braucht's keine DB-Reset-Logik hier.
 
-import { defineAppE2eConfig, PLAYWRIGHT_DEMO_ENV } from "@cosmicdrift/kumiko-testing/e2e";
+import {
+  defineAppE2eConfig,
+  E2E_TIMEOUT_MS,
+  PLAYWRIGHT_DEMO_ENV,
+} from "@cosmicdrift/kumiko-testing/e2e";
+import { chromium } from "@playwright/test";
 import { E2E_PORTS } from "../../e2e/e2e-ports";
 
 const PORT = E2E_PORTS["framework/ui-walkthrough"];
+const PRINT_SERVICE_PORT = E2E_PORTS["framework/ui-walkthrough-puppeteer-service"];
+// Both sides of the print service handshake; any value of 16+ characters will do for a local run.
+const PRINT_SERVICE_TOKEN = "ui-walkthrough-e2e-print-service";
 
+const appConfig = defineAppE2eConfig({
+  port: PORT,
+  serverEntry: "src/app/server.ts",
+  locale: "en-US",
+  env: {
+    ...PLAYWRIGHT_DEMO_ENV,
+    PUPPETEER_SERVICE_URL: `http://127.0.0.1:${PRINT_SERVICE_PORT}`,
+    PUPPETEER_AUTH_TOKEN: PRINT_SERVICE_TOKEN,
+  },
+});
+
+// The PDF preview of the template editor prints through the real puppeteer-service,
+// on the Chromium that `playwright install chromium` provides.
 export default {
-  ...defineAppE2eConfig({
-    port: PORT,
-    serverEntry: "src/app/server.ts",
-    locale: "en-US",
-    env: PLAYWRIGHT_DEMO_ENV,
-  }),
+  ...appConfig,
+  webServer: [
+    {
+      command: "bun run src/index.ts",
+      cwd: "../../../apps/puppeteer-service",
+      url: `http://127.0.0.1:${PRINT_SERVICE_PORT}/healthz`,
+      env: {
+        PORT: String(PRINT_SERVICE_PORT),
+        PUPPETEER_AUTH_TOKEN: PRINT_SERVICE_TOKEN,
+        PUPPETEER_EXECUTABLE_PATH: chromium.executablePath(),
+      },
+      reuseExistingServer: false,
+      timeout: E2E_TIMEOUT_MS.webServer,
+      stdout: "pipe",
+      stderr: "pipe",
+    },
+    ...[appConfig.webServer ?? []].flat(),
+  ],
   // globalSetup spawnt vor allen Tests einen bun-Subprozess der die
   // Registry auswertet und `e2e/.e2e-data.json` schreibt. Der eigent-
   // liche generated.spec.ts-Runner liest nur die JSON — framework-

package/samples/apps/ui-walkthrough/src/app/auth-constants.ts

@@ -18,3 +18,12 @@ export const ADMIN_PASSWORD = "kumiko-admin";
 // `as TenantId`-Cast lokal.
 export const DEV_TENANT_ID = "00000000-0000-4000-8000-000000000001";
 export const BETA_TENANT_ID = "00000000-0000-4000-8000-000000000002";
+
+// Nordlicht Immobilien GmbH: the tenant the document-designer walkthrough runs
+// in. Both users are new; the admin above stays untouched.
+export const NORDLICHT_TENANT_ID = "00000000-0000-4000-8000-000000000003";
+export const NORDLICHT_TENANT_NAME = "Nordlicht Immobilien GmbH";
+export const TENANT_ADMIN_EMAIL = "a.berger@nordlicht-immobilien.de";
+export const TENANT_ADMIN_PASSWORD = "nordlicht-berger";
+export const PLATFORM_ADMIN_EMAIL = "plattform@kumiko.dev";
+export const PLATFORM_ADMIN_PASSWORD = "kumiko-plattform";

package/samples/apps/ui-walkthrough/src/app/client.tsx

@@ -2,8 +2,11 @@
 // übergibt Shell + clientFeatures an createKumikoApp.
 
 import { emailPasswordClient } from "@cosmicdrift/kumiko-bundled-features/auth-email-password/web";
+import { textBlocksClient } from "@cosmicdrift/kumiko-bundled-features/template-resolver/web";
+import { documentDesignerClient } from "@cosmicdrift/kumiko-document-designer/web";
 import { localeDeClient } from "@cosmicdrift/kumiko-locale-de/web";
 import { createKumikoApp } from "@cosmicdrift/kumiko-renderer-web";
+import { billingClient } from "../features/billing/web";
 import { rentalClient } from "../features/rental/web";
 import { tasksClient } from "../features/tasks/web";
 import { vehiclesClient } from "../features/vehicles/web";
@@ -17,5 +20,8 @@ createKumikoApp({
     tasksClient,
     rentalClient,
     vehiclesClient,
+    billingClient,
+    textBlocksClient(),
+    documentDesignerClient(),
   ],
 });

package/samples/apps/ui-walkthrough/src/app/seed-templates.ts

@@ -0,0 +1,239 @@
+// Nordlicht Immobilien GmbH for the document-designer walkthrough: a tenant
+// admin, a platform admin, branding and a realistic set of mail and PDF
+// templates. Everything goes through the template write handlers (or the
+// system-template seed), never straight into the tables.
+
+import { seedAdmin } from "@cosmicdrift/kumiko-bundled-features/auth-email-password/seeding";
+import { BRANDING_QN } from "@cosmicdrift/kumiko-bundled-features/managed-pages";
+import {
+  TemplateResolverHandlers,
+  TemplateResolverQueries,
+} from "@cosmicdrift/kumiko-bundled-features/template-resolver";
+import type { SeedFn } from "@cosmicdrift/kumiko-dev-server";
+import type { SessionUser, TenantId } from "@cosmicdrift/kumiko-framework/engine";
+import { DEFAULT_MAIL_LAYOUT_MJML } from "@cosmicdrift/kumiko-renderer-mail-html";
+import { readBundledAsset } from "@cosmicdrift/kumiko-server-runtime";
+import {
+  NORDLICHT_TENANT_ID,
+  NORDLICHT_TENANT_NAME,
+  PLATFORM_ADMIN_EMAIL,
+  PLATFORM_ADMIN_PASSWORD,
+  TENANT_ADMIN_EMAIL,
+  TENANT_ADMIN_PASSWORD,
+} from "./auth-constants";
+import {
+  INVOICE_CORRECTED_DRAFT,
+  INVOICE_ISSUED_DRAFT_VERSIONS,
+  LOGO_RESOURCE_KEY,
+  PAYMENT_REMINDER_TEMPLATES,
+  type SeedTemplate,
+  SYSTEM_AUTH_MAILS,
+  SYSTEM_INVOICE_DOCUMENTS,
+  SYSTEM_INVOICE_ISSUED,
+  SYSTEM_PDF_LAYOUT,
+  SYSTEM_TENANCY_CERTIFICATE,
+  TENANT_INVOICE_OVERRIDES,
+  TENANT_MAIL_LAYOUT_VERSIONS,
+  TENANT_UTILITY_STATEMENT,
+} from "./template-seed-data";
+
+const NORDLICHT = NORDLICHT_TENANT_ID as TenantId;
+
+// Declared under `kumiko.assets` in this sample's package.json; looked up from the
+// package dir so the seed does not depend on the cwd the dev server was started in.
+const LOGO_ASSET_NAME = "logo-nordlicht.png";
+const SAMPLE_APP_DIR = new URL("../../", import.meta.url).pathname;
+
+const BRANDING = [
+  [BRANDING_QN.title, "Nordlicht Mieterportal"],
+  [BRANDING_QN.accentColor, "#205265"],
+  [BRANDING_QN.siteUrl, "https://nordlicht-immobilien.de"],
+  [BRANDING_QN.logoUrl, "https://nordlicht-immobilien.de/logo-nordlicht.png"],
+] as const;
+
+export const seedTemplates: SeedFn = async (stack) => {
+  const membership = (roles: readonly string[]) => [
+    {
+      tenantId: NORDLICHT,
+      tenantKey: "nordlicht",
+      tenantName: NORDLICHT_TENANT_NAME,
+      roles,
+    },
+  ];
+  const tenantAdminAccount = await seedAdmin(stack.db, {
+    email: TENANT_ADMIN_EMAIL,
+    password: TENANT_ADMIN_PASSWORD,
+    displayName: "A. Berger",
+    emailVerified: true,
+    memberships: membership(["TenantAdmin"]),
+  });
+  const platformAdminAccount = await seedAdmin(stack.db, {
+    email: PLATFORM_ADMIN_EMAIL,
+    password: PLATFORM_ADMIN_PASSWORD,
+    displayName: "Plattform-Admin",
+    emailVerified: true,
+    globalRoles: ["SystemAdmin"],
+    memberships: membership(["TenantAdmin"]),
+  });
+  // The session re-derives roles from the membership row on every request, so
+  // the roles here only have to match what the account really has.
+  const tenantAdmin: SessionUser = {
+    id: tenantAdminAccount.id as SessionUser["id"],
+    tenantId: NORDLICHT,
+    roles: ["TenantAdmin"],
+  };
+  const platformAdmin: SessionUser = {
+    id: platformAdminAccount.id as SessionUser["id"],
+    tenantId: NORDLICHT,
+    roles: ["TenantAdmin", "SystemAdmin"],
+  };
+
+  const overview = await stack.http.queryOk<{ rows: { origin: string }[] }>(
+    TemplateResolverQueries.overview,
+    {},
+    tenantAdmin,
+  );
+  if (overview.rows.some((row) => row.origin === "tenant")) return;
+
+  const upsert = (
+    handler: string,
+    template: SeedTemplate,
+    user: SessionUser,
+    extra: Record<string, unknown> = {},
+  ) =>
+    stack.http.writeOk<{ id: string }>(
+      handler,
+      {
+        slug: template.slug,
+        kind: template.kind,
+        locale: template.locale,
+        contentFormat: "html",
+        content: template.content,
+        ...(template.title !== undefined && { title: template.title }),
+        ...(template.meta !== undefined && { meta: template.meta }),
+        ...(template.variableSchema !== undefined && { variableSchema: template.variableSchema }),
+        ...extra,
+      },
+      user,
+    );
+  // Real multipart upload; every resource link and the branding logo consume their own file.
+  const uploadLogo = async (user: SessionUser): Promise<string> => {
+    const logoPng = await readBundledAsset(LOGO_ASSET_NAME, { cwd: SAMPLE_APP_DIR });
+    const form = new FormData();
+    form.append(
+      "file",
+      new File([new Uint8Array(logoPng)], LOGO_RESOURCE_KEY, { type: "image/png" }),
+    );
+    const response = await stack.app.request("/api/files", {
+      method: "POST",
+      headers: {
+        Authorization: `Bearer ${await stack.jwt.sign(user)}`,
+      },
+      body: form,
+    });
+    if (response.status !== 201) throw new Error(`logo upload failed: HTTP ${response.status}`);
+    return ((await response.json()) as { id: string }).id;
+  };
+  const linkInvoicePdf = (templateId: string): Promise<unknown> =>
+    stack.http.writeOk(
+      TemplateResolverHandlers.resourceLinkPdf,
+      {
+        templateId,
+        key: "rechnung",
+        templateSlug: "billing:invoice",
+        fileName: "rechnung-{{invoiceNumber}}.pdf",
+      },
+      tenantAdmin,
+    );
+  const upsertSystem = (template: SeedTemplate) =>
+    upsert(TemplateResolverHandlers.upsertSystem, template, platformAdmin);
+  const upsertTenant = (template: SeedTemplate, status: "draft" | "active") =>
+    upsert(TemplateResolverHandlers.upsertTenant, template, tenantAdmin, { status });
+
+  await stack.http.writeOk(
+    TemplateResolverHandlers.upsertSystem,
+    {
+      slug: "default",
+      kind: "mail-layout",
+      locale: "en",
+      contentFormat: "mjml",
+      content: DEFAULT_MAIL_LAYOUT_MJML,
+      title: "Mail-Layout",
+    },
+    platformAdmin,
+  );
+  await upsertSystem(SYSTEM_PDF_LAYOUT);
+  for (const mail of SYSTEM_AUTH_MAILS) await upsertSystem(mail);
+  await upsertSystem(SYSTEM_INVOICE_ISSUED);
+  for (const document of SYSTEM_INVOICE_DOCUMENTS) await upsertSystem(document);
+  const certificate = await upsertSystem(SYSTEM_TENANCY_CERTIFICATE);
+  await stack.http.writeOk(
+    TemplateResolverHandlers.archiveSystem,
+    { id: certificate.id },
+    platformAdmin,
+  );
+
+  for (const [key, value] of BRANDING) {
+    await stack.http.writeOk("config:write:set", { key, value }, tenantAdmin);
+  }
+  // The built-in "logo" placeholder of the layouts resolves to this file.
+  await stack.http.writeOk(
+    "config:write:set",
+    { key: BRANDING_QN.logoFile, value: await uploadLogo(tenantAdmin) },
+    tenantAdmin,
+  );
+  // Each save is a new version of the same row; the second one makes the
+  // layout "customised" for the overview and the first leaves history to diff.
+  for (const content of TENANT_MAIL_LAYOUT_VERSIONS) {
+    await upsertTenant(
+      {
+        slug: "default",
+        kind: "mail-layout",
+        locale: "en",
+        title: "Mail-Layout",
+        content,
+        meta: { accentLine: "branding" },
+      },
+      "active",
+    );
+  }
+  let invoiceDraftId: string | null = null;
+  for (const draft of INVOICE_ISSUED_DRAFT_VERSIONS) {
+    const saved = await upsertTenant(draft, "draft");
+    if (invoiceDraftId === null) {
+      invoiceDraftId = saved.id;
+      await linkInvoicePdf(saved.id);
+    }
+  }
+  await upsertTenant(INVOICE_CORRECTED_DRAFT, "draft");
+  for (const reminder of PAYMENT_REMINDER_TEMPLATES) await upsertTenant(reminder, "active");
+  await upsertTenant(TENANT_UTILITY_STATEMENT, "active");
+
+  // Other tenants with their own invoice copy: what the SystemAdmin sees in the overrides drawer.
+  for (const override of TENANT_INVOICE_OVERRIDES) {
+    const account = await seedAdmin(stack.db, {
+      email: override.adminEmail,
+      password: TENANT_ADMIN_PASSWORD,
+      displayName: override.adminName,
+      emailVerified: true,
+      memberships: [
+        {
+          tenantId: override.tenantId as TenantId,
+          tenantKey: override.tenantKey,
+          tenantName: override.tenantName,
+          roles: ["TenantAdmin"],
+        },
+      ],
+    });
+    const admin: SessionUser = {
+      id: account.id as SessionUser["id"],
+      tenantId: override.tenantId as TenantId,
+      roles: ["TenantAdmin"],
+    };
+    for (const version of override.versions) {
+      await upsert(TemplateResolverHandlers.upsertTenant, version, admin, {
+        status: override.status,
+      });
+    }
+  }
+};

package/samples/apps/ui-walkthrough/src/app/server.ts

@@ -11,10 +11,12 @@
 
 import { runDevApp } from "@cosmicdrift/kumiko-dev-server";
 import type { TenantId } from "@cosmicdrift/kumiko-framework/engine";
+import { createInMemoryFileProvider } from "@cosmicdrift/kumiko-framework/files";
 import { APP_FEATURES } from "../run-config";
 import { ADMIN_EMAIL, ADMIN_PASSWORD, BETA_TENANT_ID, DEV_TENANT_ID } from "./auth-constants";
 import { seedTasks } from "./seed";
 import { seedRental } from "./seed-rental";
+import { seedTemplates } from "./seed-templates";
 import { seedVehicles } from "./seed-vehicles";
 
 // Zwei feste Tenants — Admin ist in beiden Mitglied damit der
@@ -25,10 +27,12 @@ import { seedVehicles } from "./seed-vehicles";
 
 await runDevApp({
   features: [...APP_FEATURES],
-  seeds: [seedTasks, seedRental, seedVehicles],
+  seeds: [seedTasks, seedRental, seedVehicles, seedTemplates],
   // PORT env-var override für Playwright-e2e-Runs (config zeigt auf 4174);
   // sonst lokal-Default 4173.
   port: Number.parseInt(process.env["PORT"] ?? "4173", 10),
+  // Logo and attachment uploads of the mail editor need a file store.
+  files: { storageProvider: createInMemoryFileProvider() },
   clientEntry: "./src/app/client.tsx",
   htmlPath: "./public/index.html",
   watchDirs: ["./src", "../../../packages/*/src"],

package/samples/apps/ui-walkthrough/src/app/shell.tsx

@@ -5,6 +5,7 @@
 import {
   TenantMenuItems,
   UserMenu,
+  useSession,
 } from "@cosmicdrift/kumiko-bundled-features/auth-email-password/web";
 import {
   type AppSchema,
@@ -18,13 +19,19 @@ import {
 import { MoonStar, Sun } from "lucide-react";
 import type { ReactNode } from "react";
 import { AssistantAction } from "./assistant-action";
-import { BETA_TENANT_ID, DEV_TENANT_ID } from "./auth-constants";
+import {
+  BETA_TENANT_ID,
+  DEV_TENANT_ID,
+  NORDLICHT_TENANT_ID,
+  NORDLICHT_TENANT_NAME,
+} from "./auth-constants";
 
 const APP_NAME = "Kumiko Walkthrough";
 
 const tenantName = (tenantId: string): string => {
   if (tenantId === DEV_TENANT_ID) return "Dev Tenant";
   if (tenantId === BETA_TENANT_ID) return "Beta Tenant";
+  if (tenantId === NORDLICHT_TENANT_ID) return NORDLICHT_TENANT_NAME;
   return tenantId.slice(0, 8);
 };
 
@@ -41,10 +48,14 @@ export function AppShell({
   readonly schema: AppSchema;
 }): ReactNode {
   const t = useTranslation();
+  const session = useSession();
+  // Without the user the shell hides role-gated navs and KumikoScreen denies role-gated screens.
+  const user = session.user !== null ? { id: session.user.id, roles: session.roles } : undefined;
   return (
     <DefaultAppShell
       brand={<SidebarBrand name={APP_NAME} plan={t("tasks.shell.tagline")} />}
       schema={schema}
+      {...(user !== undefined && { user })}
       headerActions={
         <>
           <AssistantAction />