@cosmicdrift/kumiko-samples 0.363.0 → 0.364.0

package/packages/bundled-features/src/template-resolver/web/i18n.ts

@@ -17,6 +17,7 @@ export const defaultTranslations: TranslationsByLocale = {
     "template-resolver.documentEditor.divider": "Divider",
     "template-resolver.documentEditor.heading3": "Heading 3",
     "template-resolver.documentEditor.image": "Image",
+    "template-resolver.documentEditor.imageBlock": "Image · inline",
     "template-resolver.documentEditor.imageAlt": "Alt text (optional)",
     "template-resolver.documentEditor.insert": "Insert",
     "template-resolver.documentEditor.insertPlaceholder": "Placeholder",
@@ -36,7 +37,6 @@ export const defaultTranslations: TranslationsByLocale = {
     "template-resolver.documentEditor.alignJustify": "Justified",
     "template-resolver.documentEditor.repeatBarList": "Repeat · {list}",
     "template-resolver.documentEditor.repeatHeader": "Repeat header row",
-    "template-resolver.documentEditor.keepRowsTogether": "Keep rows together",
     "template-resolver.documentEditor.paragraph": "Paragraph",
     "template-resolver.documentEditor.paragraphStyle": "Paragraph style",
     "template-resolver.documentEditor.placeholder": "Write your text…",
@@ -82,11 +82,31 @@ export const defaultTranslations: TranslationsByLocale = {
     "templateResolver.errors.resource.unsupportedImage":
       "This file is not a supported image. Use PNG, JPEG, WebP or GIF.",
     "templateResolver.errors.template.systemResourcesNeedSystemTenant":
-      "Resource files can only be imported as system templates by a user of the system tenant.",
+      "Resource files of system templates can only be imported or exported by a user of the system tenant.",
+    "templateResolver.errors.template.bundleLocalesDiffer":
+      "The locales of this template differ in content format or variables, so they cannot be exported as one bundle.",
     "templateResolver.errors.collection.kindNotAllowed":
       "“{detail}” templates are written through their own editor, not through a collection.",
     "templateResolver.errors.noSystemTemplate": "There is no active system template to reset to.",
-    "templateResolver.errors.template.invalidMeta": "Invalid template settings: {detail}",
+    "templateResolver.errors.noDraft": "There is no draft to discard.",
+    "templateResolver.errors.template.invalidMeta": "The template settings are invalid.",
+    "templateResolver.errors.template.meta.subject.required": "The subject is missing.",
+    "templateResolver.errors.template.meta.subject.invalid":
+      "The subject is invalid (at most 200 characters, no line breaks).",
+    "templateResolver.errors.template.meta.previewText.required": "The preview text is missing.",
+    "templateResolver.errors.template.meta.previewText.invalid":
+      "The preview text is invalid (at most 200 characters, no line breaks).",
+    "templateResolver.errors.template.meta.senderName.required": "The sender name is missing.",
+    "templateResolver.errors.template.meta.senderName.invalid":
+      "The sender name is invalid (at most 80 characters, no line breaks).",
+    "templateResolver.errors.template.meta.replyTo.required": "The reply-to address is missing.",
+    "templateResolver.errors.template.meta.replyTo.invalid":
+      "The reply-to address is not a valid email address.",
+    "templateResolver.errors.template.meta.layoutSlug.required": "The layout is missing.",
+    "templateResolver.errors.template.meta.layoutSlug.invalid": "The chosen layout is invalid.",
+    "templateResolver.errors.template.meta.fileName.required": "The file name is missing.",
+    "templateResolver.errors.template.meta.fileName.invalid":
+      "The file name is invalid: no slashes, quotes, semicolons or two dots in a row.",
     "templateResolver.errors.template.unknownPlaceholders": "Unknown placeholders: {detail}",
     "templateResolver.errors.template.missingRequiredPlaceholders":
       "Required placeholders are not used: {detail}",
@@ -112,7 +132,8 @@ export const defaultTranslations: TranslationsByLocale = {
       "There is no PDF template “{slug}” for this tenant or the system.",
     "template-resolver.documentEditor.htmlSource": "HTML source",
     "template-resolver.documentEditor.removeBlock": "Remove block",
-    "template-resolver.documentEditor.selectedBlock": "Selected block",
+    "template-resolver.documentEditor.list": "List",
+    "template-resolver.documentEditor.more": "More",
     "template-resolver.documentEditor.showHtml": "HTML",
     "template-resolver.documentEditor.underline": "Underline",
     "template-resolver.editor.saveFailed": "Save failed.",

package/packages/bundled-features/src/template-resolver/web/index.ts

@@ -5,6 +5,13 @@
 // `@cosmicdrift/kumiko-bundled-features/template-resolver` and has no React or
 // DOM deps.
 
+export {
+  PDF_DEFAULT_MARGIN_MM,
+  PDF_FOOTER_MARGIN_MM,
+  PDF_HEADER_MARGIN_MM,
+  PDF_ORIENTATIONS,
+  PDF_PAGE_FORMATS,
+} from "../pdf-constants.js";
 export {
   TemplateResolverErrors,
   TemplateResolverHandlers,

package/packages/bundled-features/src/template-resolver/web/placeholder-line-editor.tsx

@@ -26,6 +26,8 @@ export type PlaceholderLineEditorProps = {
   /** Placeholders shown as system chips (a different tint). */
   readonly systemVariables?: readonly string[];
   readonly readOnly?: boolean;
+  /** Drops the input frame so the line sits flat inside a label/value row. */
+  readonly flat?: boolean;
   readonly onEditorReady?: (handle: DocumentEditorHandle) => void;
   readonly "aria-label": string;
 };
@@ -50,6 +52,7 @@ function LineEditorBody({
   variableLabels,
   systemVariables,
   readOnly,
+  flat,
   onEditorReady,
   ariaLabel,
 }: {
@@ -59,6 +62,7 @@ function LineEditorBody({
   readonly variableLabels: Readonly<Record<string, string>>;
   readonly systemVariables: readonly string[];
   readonly readOnly: boolean;
+  readonly flat: boolean;
   readonly onEditorReady: ((handle: DocumentEditorHandle) => void) | undefined;
   readonly ariaLabel: string;
 }): ReactNode {
@@ -88,12 +92,12 @@ function LineEditorBody({
         undoRedo: false,
       }),
       DocumentVariable.extend({
-        addNodeView: () => createVariableView(variableLabels, systemVariables),
+        addNodeView: () => createVariableView(variableLabels, systemVariables, flat),
       }),
       UndoRedo,
       BlockLineBreaks,
     ],
-    [variableLabels, systemVariables],
+    [variableLabels, systemVariables, flat],
   );
 
   const editor = useEditor({
@@ -118,7 +122,8 @@ function LineEditorBody({
     <EditorContent
       editor={editor}
       className={cn(
-        "flex min-h-9 items-center rounded-md border border-input bg-transparent px-3 text-base md:text-sm",
+        "flex items-center bg-transparent text-base md:text-sm",
+        flat ? "min-h-10" : "min-h-9 rounded-md border border-input px-3",
         "[&_.ProseMirror]:w-full [&_.ProseMirror]:whitespace-nowrap [&_.ProseMirror]:outline-none",
         "[&_p]:m-0",
         readOnly && "opacity-60",
@@ -134,6 +139,7 @@ export default function PlaceholderLineEditor({
   variableLabels = NO_LABELS,
   systemVariables = NO_NAMES,
   readOnly = false,
+  flat = false,
   onEditorReady,
   "aria-label": ariaLabel,
 }: PlaceholderLineEditorProps): ReactNode {
@@ -162,6 +168,7 @@ export default function PlaceholderLineEditor({
       variableLabels={stableLabels}
       systemVariables={stableSystem}
       readOnly={readOnly}
+      flat={flat}
       onEditorReady={onEditorReady}
       ariaLabel={ariaLabel}
     />

package/packages/bundled-features/src/tier-engine/changes.json

@@ -1,4 +1,10 @@
 [
+  {
+    "version": "0.364.0",
+    "type": "fix",
+    "title": "Tier cache: stale single reload cannot overwrite a newer full resync",
+    "detail": "A single-tenant reload that started before a full resync and resolved after it could restore an outdated tier. The resync now advances the per-tenant ticket for deleted and adopted tenants too, and assignment changes are published remote-only."
+  },
   {
     "version": "0.354.0",
     "type": "fix",

package/packages/bundled-features/src/tier-engine/feature.ts

@@ -338,7 +338,8 @@ export function createTierEngineFeature<
     };
     const publishAssignmentChange = (tenantId: TenantId): void => {
       const message: TierAssignmentSyncMessage = { tenantId };
-      busHolder.bus?.publish(CACHE_SYNC_TOPICS.tierAssignment, message);
+      // The writer already updated its own cache; only other pods need to re-read.
+      busHolder.bus?.publish(CACHE_SYNC_TOPICS.tierAssignment, message, { remoteOnly: true });
     };
 
     // Trial: zeit-abgeleitet aus tenant.inserted_at (≈ Signup), live am
@@ -533,10 +534,17 @@ export function createTierEngineFeature<
           const isNewerThanSnapshot = (tenantId: TenantId): boolean =>
             (latestTicket.get(tenantId) ?? 0) > startedAtTicket;
           for (const tenantId of [...cache.keys()]) {
-            if (!loaded.has(tenantId) && !isNewerThanSnapshot(tenantId)) cache.delete(tenantId);
+            if (!loaded.has(tenantId) && !isNewerThanSnapshot(tenantId)) {
+              cache.delete(tenantId);
+              latestTicket.set(tenantId, startedAtTicket);
+            }
           }
           for (const [tenantId, features] of loaded) {
-            if (!isNewerThanSnapshot(tenantId)) cache.set(tenantId, features);
+            if (!isNewerThanSnapshot(tenantId)) {
+              cache.set(tenantId, features);
+              // Makes a single reload that started before this snapshot discard its older result.
+              latestTicket.set(tenantId, startedAtTicket);
+            }
           }
         };
 

package/packages/bundled-features/src/user/changes.json

@@ -1,4 +1,10 @@
 [
+  {
+    "version": "0.364.0",
+    "type": "fix",
+    "title": "resolveUserDisplayNames no longer swallows decrypt errors",
+    "detail": "A misconfigured or unavailable KMS made the delivery log silently show addresses or ids instead of names. Decrypt errors now propagate like in the member directory; users that are missing or have no display name are still left out."
+  },
   {
     "version": "0.361.0",
     "type": "improvement",

package/packages/bundled-features/src/user/resolve-display-names.ts

@@ -6,9 +6,10 @@ import { userTable } from "./schema/user.js";
 // Shares the KMS adapter's small dedicated pool, same as member-directory.
 const KMS_POOL_CONCURRENCY = 4;
 
-// One batched lookup for a page of user ids. Users that are missing, have no
-// display name, or whose name cannot be decrypted (e.g. crypto-shredded) are
-// left out, so callers fall back to the raw id instead of failing the page.
+// One batched lookup for a page of user ids. Users that are missing or have no
+// display name are left out, so callers fall back to the raw id. Decrypt errors
+// propagate (a misconfigured or unavailable KMS fails loudly, like member-directory);
+// crypto-shredding is handled by the KMS layer.
 export async function resolveUserDisplayNames(
   db: TenantDb,
   userIds: readonly string[],
@@ -18,18 +19,10 @@ export async function resolveUserDisplayNames(
   const users = await selectMany(db, userTable, { id: [...userIds] });
   const named = users.filter((user) => typeof user.displayName === "string");
   await mapWithConcurrency(named, KMS_POOL_CONCURRENCY, async (user) => {
-    try {
-      names.set(
-        String(user.id),
-        await decryptStoredPii(
-          String(user.displayName),
-          "displayName",
-          "user:resolve-display-names",
-        ),
-      );
-    } catch {
-      // Unreadable name: the caller's fallback applies.
-    }
+    names.set(
+      String(user.id),
+      await decryptStoredPii(String(user.displayName), "displayName", "user:resolve-display-names"),
+    );
   });
   return names;
 }

package/packages/bundled-features/src/user/seeding.ts

@@ -11,6 +11,7 @@
 // das Event UND schreibt die Projection-Zeile in einer TX.
 
 import { fetchOne } from "@cosmicdrift/kumiko-framework/bun-db";
+import { computeBlindIndex, configuredBlindIndexKey } from "@cosmicdrift/kumiko-framework/crypto";
 import {
   createEventStoreExecutor,
   createTenantDb,
@@ -139,12 +140,25 @@ export async function rewriteSeededUserEmail(
   if (typeof id !== "string") {
     throw new Error("rewriteSeededUserEmail: existing user row has no string id");
   }
+  const version = existingRow["version"];
+  if (typeof version !== "number") {
+    throw new Error("rewriteSeededUserEmail: existing user row has no numeric version");
+  }
+  // Every executor.update appends a user:updated event; skip when the stored
+  // blind index already matches so repeated boots do not grow the stream.
+  // Queried by the bidx column itself: fetchOne does not return it, and an
+  // `email` condition would also match a plaintext row with a blank index.
+  const blindIndexKey = configuredBlindIndexKey();
+  if (blindIndexKey !== undefined) {
+    const indexed = await fetchOne(db, userTable, {
+      id,
+      emailBidx: computeBlindIndex(blindIndexKey, email),
+    });
+    // skip: the stored blind index already matches, a rewrite would only append a no-op event.
+    if (indexed) return;
+  }
   const tdb = createTenantDb(db, by.tenantId, "system");
-  const result = await userExecutor.update(
-    { id, version: existingRow["version"] as number, changes: { email } },
-    by,
-    tdb,
-  );
+  const result = await userExecutor.update({ id, version, changes: { email } }, by, tdb);
   // version_conflict: a concurrent write already changed the row — fine for a seed helper.
   // unique_violation: a duplicate row already holds the blind index; the repair
   // has to wait for a manual duplicate cleanup.

package/packages/bundled-features/src/user-data-rights/changes.json

@@ -1,4 +1,10 @@
 [
+  {
+    "version": "0.364.0",
+    "type": "fix",
+    "title": "Regression tests prove that forget also shreds the previous email in user.updated events",
+    "detail": "No runtime change. Integration tests with a configured subject KMS show that after an email change followed by forget, the old and new email in user.updated changes and previous decrypt only to the erased sentinel and the subject key is gone. Without a configured KMS, event payloads stay plaintext by design."
+  },
   {
     "version": "0.363.0",
     "type": "breaking",

package/packages/bundled-features/src/user-profile/changes.json

@@ -16,7 +16,7 @@
     "type": "breaking",
     "title": "user-profile now registers its own profile screen (id user-profile:screen:profile); app-side profile screen registrations must be removed (fw#2312).",
     "detail": "`profile` is now a declarative `projectionDetail` screen bound to `user:query:user:me` instead of a custom React component: change-password and change-email stay `EditExtensionSection` components (re-auth flows a declarative action can't express), account deletion (request/cancel via `user-data-rights`, grace period) is now fully declarative fields + `actions: RowAction[]`, preserving the original confirm dialog and `visible: {field, eq/ne}` toggle 1:1. `userProfileClient()` now registers the two extension-section components via `extensionSectionComponents` instead of exposing a `ProfileScreen` component for apps to place in a `components` map. `ProfileScreen` is a dead export. New exports: `ChangeEmailSection`, `ChangePasswordSection` (the two surviving extension components, importable for tests but not meant to be placed manually). Known UI regression, accepted for this pass (same trade-off as `privacy-center`): the deletion confirm-dialog title is now always the action's `label`; the dynamically composed grace-period banner sentence is gone, replaced by a plain `gracePeriodEnd` date field; there is no cancel-deletion success toast.",
-    "migration": "The bundled feature now registers the `profile` screen itself (id `user-profile:screen:profile`) — an app's own `profile` custom-screen registration collides on boot with a duplicate short-id error. Delete the app-side registration entirely: `r.screen({ id: \"profile\", type: \"custom\", renderer: { react: { __component: \"UserProfileScreen\" } }, access: { openToAll: true } })` has no replacement to write, just remove the call. If you have an `r.nav({ screen: \"profile\" })` (or any other reference to the app-local `profile` screen id), repoint it at `\"user-profile:screen:profile\"`. Also remove `components: { UserProfileScreen: ProfileScreen }` from your renderer/client setup and the now-unused `ProfileScreen` import — the client no longer exposes that component. Known affected consumers (not modified here, out of this PR's scope): `money-horse` (`src/features/money-horse/feature.ts:286-292`) and `offlot-app` (`src/features/account/feature.ts:24-30`) both currently register their own `profile` custom screen this way."
+    "migration": "The bundled feature now registers the `profile` screen itself (id `user-profile:screen:profile`) — an app's own `profile` custom-screen registration collides on boot with a duplicate short-id error. Delete the app-side registration entirely: `r.screen({ id: \"profile\", type: \"custom\", renderer: { react: { __component: \"UserProfileScreen\" } }, access: { openToAll: true } })` has no replacement to write, just remove the call. If you have an `r.nav({ screen: \"profile\" })` (or any other reference to the app-local `profile` screen id), repoint it at `\"user-profile:screen:profile\"`. Also remove `components: { UserProfileScreen: ProfileScreen }` from your renderer/client setup and the now-unused `ProfileScreen` import — the client no longer exposes that component. Known affected consumers (not modified here, out of this PR's scope): `money-horse` and `offlot-app` both currently register their own `profile` custom screen this way."
   },
   {
     "version": "0.123.2",

package/packages/bundled-features/src/waitlist/options.ts

@@ -38,5 +38,5 @@ export const DEFAULT_SUBMIT_RATE_LIMIT: RateLimitOption = {
 };
 
 export const DEFAULT_SUBMIT_EMAIL_RATE_LIMITS: readonly PayloadRateLimitOption[] = [
-  { per: { payloadField: "email" }, limit: 3, windowSeconds: 24 * 60 * 60 },
+  { per: { payloadField: "email" }, limit: 3, windowSeconds: 24 * 60 * 60, normalize: "email" },
 ];

package/packages/bundled-features/src/workflow-runner/changes.json

@@ -1,4 +1,10 @@
 [
+  {
+    "version": "0.364.0",
+    "type": "fix",
+    "title": "Workflow run-failed and retry logs carry the original cause",
+    "detail": "The ops log used to print the generic `workflow step N failed` wrapper. It now prints the underlying error, while the persisted event still carries the error class only."
+  },
   {
     "version": "0.353.0",
     "type": "fix",

package/packages/bundled-features/src/workflow-runner/event-trigger.ts

@@ -22,6 +22,7 @@ import {
   describeWorkflowStepError,
   getStep,
   SYSTEM_TENANT_ID,
+  unwrapWorkflowStepError,
   WORKFLOW_AGGREGATE_TYPE,
   WORKFLOW_RUN_FAILED_TYPE,
   WorkflowStepError,
@@ -167,7 +168,7 @@ export function registerEventTrigger(r: FeatureRegistrar, workflow: WorkflowDefi
             runId,
             workflowName: workflow.name,
             stepIndex,
-            error: String(error),
+            error: String(unwrapWorkflowStepError(error)),
           });
           const failedPayload: WorkflowRunFailedPayload = {
             workflowName: workflow.name,

package/packages/bundled-features/src/workflow-runner/handlers/resume-run.write.ts

@@ -40,6 +40,7 @@ import {
   runStepList,
   type StepInstance,
   SYSTEM_ROLE,
+  unwrapWorkflowStepError,
   WORKFLOW_AGGREGATE_TYPE,
   WORKFLOW_RESUMED_TYPE,
   WORKFLOW_RETRY_SCHEDULED_TYPE,
@@ -392,7 +393,12 @@ async function runResumedPipeline(ctx: HandlerContext, input: ResumedPipelineInp
     });
     return { isSuccess: true as const, data: { outcome: "completed" as const } };
   } catch (error) {
-    log.warn("workflow run failed", { runId, workflowName, stepIndex, error: String(error) });
+    log.warn("workflow run failed", {
+      runId,
+      workflowName,
+      stepIndex,
+      error: String(unwrapWorkflowStepError(error)),
+    });
     // The input stepIndex is the suspended step; the failure happened at the step the resumed pass reached.
     const failedPayload: WorkflowRunFailedPayload = {
       workflowName,

package/samples/apps/ui-walkthrough/package.json

@@ -15,6 +15,7 @@
     "@cosmicdrift/kumiko-framework": "workspace:*",
     "@cosmicdrift/kumiko-headless": "workspace:*",
     "@cosmicdrift/kumiko-renderer-mail-html": "workspace:*",
+    "@cosmicdrift/kumiko-renderer-puppeteer-client": "workspace:*",
     "@cosmicdrift/kumiko-renderer-web": "workspace:*",
     "@cosmicdrift/kumiko-server-runtime": "workspace:*",
     "react": "^19.2.6",
@@ -24,5 +25,13 @@
   },
   "devDependencies": {
     "@cosmicdrift/kumiko-testing": "workspace:*"
+  },
+  "kumiko": {
+    "assets": [
+      {
+        "name": "logo-nordlicht.png",
+        "source": "src/app/assets/logo-nordlicht.png"
+      }
+    ]
   }
 }

package/samples/apps/ui-walkthrough/playwright.config.ts

@@ -7,18 +7,51 @@
 // setupTestStack-Default ist ephemeral (fresh kumiko_test_<random> DB),
 // deshalb braucht's keine DB-Reset-Logik hier.
 
-import { defineAppE2eConfig, PLAYWRIGHT_DEMO_ENV } from "@cosmicdrift/kumiko-testing/e2e";
+import {
+  defineAppE2eConfig,
+  E2E_TIMEOUT_MS,
+  PLAYWRIGHT_DEMO_ENV,
+} from "@cosmicdrift/kumiko-testing/e2e";
+import { chromium } from "@playwright/test";
 import { E2E_PORTS } from "../../e2e/e2e-ports";
 
 const PORT = E2E_PORTS["framework/ui-walkthrough"];
+const PRINT_SERVICE_PORT = E2E_PORTS["framework/ui-walkthrough-puppeteer-service"];
+// Both sides of the print service handshake; any value of 16+ characters will do for a local run.
+const PRINT_SERVICE_TOKEN = "ui-walkthrough-e2e-print-service";
 
+const appConfig = defineAppE2eConfig({
+  port: PORT,
+  serverEntry: "src/app/server.ts",
+  locale: "en-US",
+  env: {
+    ...PLAYWRIGHT_DEMO_ENV,
+    PUPPETEER_SERVICE_URL: `http://127.0.0.1:${PRINT_SERVICE_PORT}`,
+    PUPPETEER_AUTH_TOKEN: PRINT_SERVICE_TOKEN,
+  },
+});
+
+// The PDF preview of the template editor prints through the real puppeteer-service,
+// on the Chromium that `playwright install chromium` provides.
 export default {
-  ...defineAppE2eConfig({
-    port: PORT,
-    serverEntry: "src/app/server.ts",
-    locale: "en-US",
-    env: PLAYWRIGHT_DEMO_ENV,
-  }),
+  ...appConfig,
+  webServer: [
+    {
+      command: "bun run src/index.ts",
+      cwd: "../../../apps/puppeteer-service",
+      url: `http://127.0.0.1:${PRINT_SERVICE_PORT}/healthz`,
+      env: {
+        PORT: String(PRINT_SERVICE_PORT),
+        PUPPETEER_AUTH_TOKEN: PRINT_SERVICE_TOKEN,
+        PUPPETEER_EXECUTABLE_PATH: chromium.executablePath(),
+      },
+      reuseExistingServer: false,
+      timeout: E2E_TIMEOUT_MS.webServer,
+      stdout: "pipe",
+      stderr: "pipe",
+    },
+    ...[appConfig.webServer ?? []].flat(),
+  ],
   // globalSetup spawnt vor allen Tests einen bun-Subprozess der die
   // Registry auswertet und `e2e/.e2e-data.json` schreibt. Der eigent-
   // liche generated.spec.ts-Runner liest nur die JSON — framework-

package/samples/apps/ui-walkthrough/src/app/seed-templates.ts

@@ -12,6 +12,7 @@ import {
 import type { SeedFn } from "@cosmicdrift/kumiko-dev-server";
 import type { SessionUser, TenantId } from "@cosmicdrift/kumiko-framework/engine";
 import { DEFAULT_MAIL_LAYOUT_MJML } from "@cosmicdrift/kumiko-renderer-mail-html";
+import { readBundledAsset } from "@cosmicdrift/kumiko-server-runtime";
 import {
   NORDLICHT_TENANT_ID,
   NORDLICHT_TENANT_NAME,
@@ -23,6 +24,7 @@ import {
 import {
   INVOICE_CORRECTED_DRAFT,
   INVOICE_ISSUED_DRAFT_VERSIONS,
+  LOGO_RESOURCE_KEY,
   PAYMENT_REMINDER_TEMPLATES,
   type SeedTemplate,
   SYSTEM_AUTH_MAILS,
@@ -30,12 +32,18 @@ import {
   SYSTEM_INVOICE_ISSUED,
   SYSTEM_PDF_LAYOUT,
   SYSTEM_TENANCY_CERTIFICATE,
+  TENANT_INVOICE_OVERRIDES,
   TENANT_MAIL_LAYOUT_VERSIONS,
   TENANT_UTILITY_STATEMENT,
 } from "./template-seed-data";
 
 const NORDLICHT = NORDLICHT_TENANT_ID as TenantId;
 
+// Declared under `kumiko.assets` in this sample's package.json; looked up from the
+// package dir so the seed does not depend on the cwd the dev server was started in.
+const LOGO_ASSET_NAME = "logo-nordlicht.png";
+const SAMPLE_APP_DIR = new URL("../../", import.meta.url).pathname;
+
 const BRANDING = [
   [BRANDING_QN.title, "Nordlicht Mieterportal"],
   [BRANDING_QN.accentColor, "#205265"],
@@ -108,6 +116,35 @@ export const seedTemplates: SeedFn = async (stack) => {
       },
       user,
     );
+  // Real multipart upload; every resource link and the branding logo consume their own file.
+  const uploadLogo = async (user: SessionUser): Promise<string> => {
+    const logoPng = await readBundledAsset(LOGO_ASSET_NAME, { cwd: SAMPLE_APP_DIR });
+    const form = new FormData();
+    form.append(
+      "file",
+      new File([new Uint8Array(logoPng)], LOGO_RESOURCE_KEY, { type: "image/png" }),
+    );
+    const response = await stack.app.request("/api/files", {
+      method: "POST",
+      headers: {
+        Authorization: `Bearer ${await stack.jwt.sign(user)}`,
+      },
+      body: form,
+    });
+    if (response.status !== 201) throw new Error(`logo upload failed: HTTP ${response.status}`);
+    return ((await response.json()) as { id: string }).id;
+  };
+  const linkInvoicePdf = (templateId: string): Promise<unknown> =>
+    stack.http.writeOk(
+      TemplateResolverHandlers.resourceLinkPdf,
+      {
+        templateId,
+        key: "rechnung",
+        templateSlug: "billing:invoice",
+        fileName: "rechnung-{{invoiceNumber}}.pdf",
+      },
+      tenantAdmin,
+    );
   const upsertSystem = (template: SeedTemplate) =>
     upsert(TemplateResolverHandlers.upsertSystem, template, platformAdmin);
   const upsertTenant = (template: SeedTemplate, status: "draft" | "active") =>
@@ -139,16 +176,64 @@ export const seedTemplates: SeedFn = async (stack) => {
   for (const [key, value] of BRANDING) {
     await stack.http.writeOk("config:write:set", { key, value }, tenantAdmin);
   }
+  // The built-in "logo" placeholder of the layouts resolves to this file.
+  await stack.http.writeOk(
+    "config:write:set",
+    { key: BRANDING_QN.logoFile, value: await uploadLogo(tenantAdmin) },
+    tenantAdmin,
+  );
   // Each save is a new version of the same row; the second one makes the
   // layout "customised" for the overview and the first leaves history to diff.
   for (const content of TENANT_MAIL_LAYOUT_VERSIONS) {
     await upsertTenant(
-      { slug: "default", kind: "mail-layout", locale: "en", title: "Mail-Layout", content },
+      {
+        slug: "default",
+        kind: "mail-layout",
+        locale: "en",
+        title: "Mail-Layout",
+        content,
+        meta: { accentLine: "branding" },
+      },
       "active",
     );
   }
-  for (const draft of INVOICE_ISSUED_DRAFT_VERSIONS) await upsertTenant(draft, "draft");
+  let invoiceDraftId: string | null = null;
+  for (const draft of INVOICE_ISSUED_DRAFT_VERSIONS) {
+    const saved = await upsertTenant(draft, "draft");
+    if (invoiceDraftId === null) {
+      invoiceDraftId = saved.id;
+      await linkInvoicePdf(saved.id);
+    }
+  }
   await upsertTenant(INVOICE_CORRECTED_DRAFT, "draft");
   for (const reminder of PAYMENT_REMINDER_TEMPLATES) await upsertTenant(reminder, "active");
   await upsertTenant(TENANT_UTILITY_STATEMENT, "active");
+
+  // Other tenants with their own invoice copy: what the SystemAdmin sees in the overrides drawer.
+  for (const override of TENANT_INVOICE_OVERRIDES) {
+    const account = await seedAdmin(stack.db, {
+      email: override.adminEmail,
+      password: TENANT_ADMIN_PASSWORD,
+      displayName: override.adminName,
+      emailVerified: true,
+      memberships: [
+        {
+          tenantId: override.tenantId as TenantId,
+          tenantKey: override.tenantKey,
+          tenantName: override.tenantName,
+          roles: ["TenantAdmin"],
+        },
+      ],
+    });
+    const admin: SessionUser = {
+      id: account.id as SessionUser["id"],
+      tenantId: override.tenantId as TenantId,
+      roles: ["TenantAdmin"],
+    };
+    for (const version of override.versions) {
+      await upsert(TemplateResolverHandlers.upsertTenant, version, admin, {
+        status: override.status,
+      });
+    }
+  }
 };