@cosmicdrift/kumiko-samples 0.363.0 → 0.364.0

package/packages/bundled-features/src/template-resolver/handlers/tenant-overrides.query.ts

@@ -3,14 +3,74 @@ import { defineQueryHandler, SYSTEM_TENANT_ID } from "@cosmicdrift/kumiko-framew
 import * as z from "zod";
 import { TenantQueries } from "../../tenant/index.js";
 import { type TemplateResourceRow, templateResourcesTable } from "../table.js";
+import { servedVersionOf } from "../template-draft.js";
+import { buildOverrideDiff } from "./override-diff.js";
 import { kindSchema, localeSchema, templateSlugSchema } from "./shared.js";
 
 const TENANT_OVERRIDES_REASON =
-  "SystemAdmin template overview counts how many tenants override one system template; it reads tenant-scope template rows of every tenant and returns only counts, never tenant ids or content";
+  "SystemAdmin template overview lists which tenants override one system template; it reads tenant-scope template rows of every tenant (and the system row for the optional per-tenant diff), which the tenant-scoped db cannot reach";
 
 const tenantIdsSchema = z.array(z.string());
+const directorySchema = z.object({
+  rows: z.array(z.object({ id: z.string(), label: z.string() })),
+});
+
+type OverrideStatus = "active" | "draft";
+
+function labelsOf(raw: unknown): ReadonlyMap<string, string> {
+  return new Map(directorySchema.parse(raw).rows.map((row) => [row.id, row.label]));
+}
+
+// One row per tenant: its active override wins over a draft, then the newest version.
+function isBetterRow(candidate: TemplateResourceRow, current: TemplateResourceRow): boolean {
+  if ((candidate.status === "active") !== (current.status === "active")) {
+    return candidate.status === "active";
+  }
+  return candidate.version > current.version;
+}
+
+function statusOf(row: TemplateResourceRow): OverrideStatus {
+  return row.status === "active" ? "active" : "draft";
+}
 
-type OverrideRow = Pick<TemplateResourceRow, "tenantId" | "status">;
+function isCountedTenantRow(
+  row: TemplateResourceRow,
+  enabledTenantIds: ReadonlySet<string> | null,
+): boolean {
+  if (row.tenantId === SYSTEM_TENANT_ID || row.status === "archived") return false;
+  return enabledTenantIds === null || enabledTenantIds.has(row.tenantId);
+}
+
+function pickBestRowPerTenant(
+  found: readonly TemplateResourceRow[],
+  enabledTenantIds: ReadonlySet<string> | null,
+): Map<string, TemplateResourceRow> {
+  const bestByTenant = new Map<string, TemplateResourceRow>();
+  for (const row of found) {
+    if (!isCountedTenantRow(row, enabledTenantIds)) continue;
+    const current = bestByTenant.get(row.tenantId);
+    if (current === undefined || isBetterRow(row, current)) bestByTenant.set(row.tenantId, row);
+  }
+  return bestByTenant;
+}
+
+function toOverrideRow(
+  row: TemplateResourceRow,
+  tenantLabels: ReadonlyMap<string, string>,
+  userLabels: ReadonlyMap<string, string>,
+) {
+  const changedById = row.modifiedById ?? row.insertedById;
+  return {
+    tenantId: row.tenantId,
+    tenantName: tenantLabels.get(row.tenantId) ?? row.tenantId,
+    templateId: String(row.id),
+    locale: row.locale,
+    status: statusOf(row),
+    version: servedVersionOf(row),
+    changedAt: (row.modifiedAt ?? row.insertedAt).toString(),
+    changedBy: changedById === null ? null : (userLabels.get(changedById) ?? null),
+  };
+}
 
 export const tenantOverridesQuery = defineQueryHandler({
   name: "tenant-overrides",
@@ -18,14 +78,17 @@ export const tenantOverridesQuery = defineQueryHandler({
     slug: templateSlugSchema,
     kind: kindSchema,
     locale: localeSchema.optional(),
+    /** Adds the block diff of this tenant's override against the system template. */
+    diffTenantId: z.string().min(1).optional(),
   }),
   access: { roles: ["SystemAdmin"] },
   description:
-    "Counts how many enabled tenants override one template with an active or a draft version, next to the number of enabled tenants; use it before changing a system template to see how many tenants keep their own copy. Returns counts only, no tenant ids.",
+    "Lists the enabled tenants that override one template with an active or a draft version (tenant name, status, version, last change and who made it), next to the counts and the number of enabled tenants; use it before changing a system template to see who keeps their own copy. With diffTenantId it also returns the block diff of that tenant's override against the system template.",
   escapeHatch: { grants: ["unsafeRaw"], reason: TENANT_OVERRIDES_REASON },
   handler: async (query, ctx) => {
-    const { slug, kind, locale } = query.payload;
-    const rows = await selectMany<OverrideRow>(ctx.db.unsafeRaw(), templateResourcesTable, {
+    const { slug, kind, locale, diffTenantId } = query.payload;
+    const raw = ctx.db.unsafeRaw();
+    const found = await selectMany<TemplateResourceRow>(raw, templateResourcesTable, {
       slug,
       kind,
       scope: "tenant",
@@ -38,18 +101,37 @@ export const tenantOverridesQuery = defineQueryHandler({
       ? new Set(tenantIdsSchema.parse(await ctx.query(TenantQueries.activeTenantIds, {})))
       : null;
 
-    const statusByTenant = new Map<string, "active" | "draft">();
-    for (const row of rows) {
-      if (row.tenantId === SYSTEM_TENANT_ID || row.status === "archived") continue;
-      if (enabledTenantIds !== null && !enabledTenantIds.has(row.tenantId)) continue;
-      if (statusByTenant.get(row.tenantId) === "active") continue;
-      statusByTenant.set(row.tenantId, row.status === "active" ? "active" : "draft");
+    const bestByTenant = pickBestRowPerTenant(found, enabledTenantIds);
+    const best = [...bestByTenant.values()];
+    const tenantLabels = hasTenantFeature
+      ? labelsOf(await ctx.query(TenantQueries.tenantDirectory, {}))
+      : new Map<string, string>();
+    const userLabels = hasTenantFeature
+      ? labelsOf(await ctx.query(TenantQueries.memberDirectory, {}))
+      : new Map<string, string>();
+
+    const rows = best
+      .map((row) => toOverrideRow(row, tenantLabels, userLabels))
+      .sort((a, b) => a.tenantName.localeCompare(b.tenantName));
+
+    let diff: ReturnType<typeof buildOverrideDiff> | null = null;
+    const diffRow = diffTenantId === undefined ? undefined : bestByTenant.get(diffTenantId);
+    if (diffRow !== undefined) {
+      const [systemRow] = await selectMany<TemplateResourceRow>(raw, templateResourcesTable, {
+        tenantId: SYSTEM_TENANT_ID,
+        slug,
+        kind,
+        locale: diffRow.locale,
+      });
+      if (systemRow !== undefined) diff = buildOverrideDiff(diffRow, systemRow);
     }
-    const statuses = [...statusByTenant.values()];
+
     return {
-      activeOverrides: statuses.filter((status) => status === "active").length,
-      draftOverrides: statuses.filter((status) => status === "draft").length,
+      activeOverrides: best.filter((row) => row.status === "active").length,
+      draftOverrides: best.filter((row) => row.status !== "active").length,
       totalTenants: enabledTenantIds === null ? null : enabledTenantIds.size,
+      rows,
+      diff,
     };
   },
 });

package/packages/bundled-features/src/template-resolver/handlers/toggle-status.write.ts

@@ -1,24 +1,25 @@
 import { fetchOne } from "@cosmicdrift/kumiko-framework/bun-db";
 import {
   defineWriteHandler,
-  type Registry,
+  type HandlerContext,
   SYSTEM_TENANT_ID,
 } from "@cosmicdrift/kumiko-framework/engine";
 import {
-  type FieldIssue,
   NotFoundError,
   ValidationError,
+  type WriteFailure,
   writeFailure,
 } from "@cosmicdrift/kumiko-framework/errors";
 import * as z from "zod";
 import { requireForTenant } from "../../shared/index.js";
 import type { TemplateResourceRow } from "../table.js";
 import { templateResourcesTable } from "../table.js";
+import { activationChanges, parseTemplateDraft, toWorkingRow } from "../template-draft.js";
 import { executor } from "./shared.js";
 import { publishGateIssues } from "./template-gates.js";
 
 type TemplateStatus = "active" | "archived";
-type StatusTarget = "own" | "system";
+export type StatusTarget = "own" | "system";
 
 function isRowOfTarget(row: TemplateResourceRow, target: StatusTarget, callerTenantId: string) {
   return target === "system"
@@ -26,41 +27,69 @@ function isRowOfTarget(row: TemplateResourceRow, target: StatusTarget, callerTen
     : row.tenantId === callerTenantId && row.scope === "tenant";
 }
 
+export function writeAccessFor(target: StatusTarget) {
+  return { roles: target === "system" ? ["SystemAdmin"] : ["TenantAdmin", "SystemAdmin"] };
+}
+
+// The tenant db also reads system rows; the row's own tenant must match the
+// target or the executor would append to a foreign event stream.
+export async function loadTargetRow(
+  ctx: HandlerContext,
+  target: StatusTarget,
+  user: { readonly tenantId: string },
+  id: string,
+) {
+  const scoped = target === "system" ? requireForTenant(ctx, SYSTEM_TENANT_ID) : null;
+  const db = scoped?.db ?? ctx.db;
+  const row = await fetchOne<TemplateResourceRow>(db, templateResourcesTable, { id });
+  return { db, scoped, row: row && isRowOfTarget(row, target, user.tenantId) ? row : null };
+}
+
+type StatusPlan =
+  | { readonly ok: true; readonly changes: Record<string, unknown> }
+  | { readonly ok: false; readonly failure: WriteFailure };
+
+// Publishing promotes an open draft (gated as the version that goes live); a row
+// without one is activated as stored. Archiving leaves the draft standing.
+function planStatusChange(
+  ctx: HandlerContext,
+  row: TemplateResourceRow,
+  status: TemplateStatus,
+): StatusPlan {
+  if (status === "archived") return { ok: true, changes: { status } };
+  const issues = publishGateIssues(ctx.registry, toWorkingRow(row, row.tenantId));
+  if (issues.length > 0) {
+    return { ok: false, failure: writeFailure(new ValidationError({ fields: [...issues] })) };
+  }
+  return { ok: true, changes: { ...parseTemplateDraft(row.draft), ...activationChanges(row) } };
+}
+
 function createStatusUpdateHandler(
   name: string,
   target: StatusTarget,
   status: TemplateStatus,
   description: string,
-  gate?: (registry: Registry, row: TemplateResourceRow) => readonly FieldIssue[],
 ) {
   return defineWriteHandler({
     name,
     schema: z.object({ id: z.string().min(1) }),
-    access: { roles: target === "system" ? ["SystemAdmin"] : ["TenantAdmin", "SystemAdmin"] },
+    access: writeAccessFor(target),
     // A system template change reaches every tenant without an override.
     ...(target === "system" ? { agent: { risk: "high" as const } } : {}),
     description,
     handler: async (event, ctx) => {
-      const scoped = target === "system" ? requireForTenant(ctx, SYSTEM_TENANT_ID) : null;
-      const db = scoped?.db ?? ctx.db;
-      // The tenant db also reads system rows; the row's own tenant must match
-      // the target or the executor would append to a foreign event stream.
-      const existing = await fetchOne<TemplateResourceRow>(db, templateResourcesTable, {
-        id: event.payload.id,
-      });
-      if (!existing || !isRowOfTarget(existing, target, event.user.tenantId)) {
-        return writeFailure(new NotFoundError("template-resource", event.payload.id));
-      }
-      const issues = gate?.(ctx.registry, existing) ?? [];
-      if (issues.length > 0) return writeFailure(new ValidationError({ fields: [...issues] }));
+      const { db, scoped, row } = await loadTargetRow(ctx, target, event.user, event.payload.id);
+      if (!row) return writeFailure(new NotFoundError("template-resource", event.payload.id));
+      const plan = planStatusChange(ctx, row, status);
+      if (!plan.ok) return plan.failure;
       const result = await executor.update(
-        { id: existing.id, version: existing.version, changes: { status } },
+        { id: row.id, version: row.version, changes: plan.changes },
         event.user,
         db,
         scoped ? { streamTenantId: scoped.streamTenantId } : undefined,
       );
       if (!result.isSuccess) return result;
-      return { isSuccess: true as const, data: { id: String(existing.id), status } };
+      return { isSuccess: true as const, data: { id: String(row.id), status } };
     },
   });
 }
@@ -69,14 +98,13 @@ export const archiveWrite = createStatusUpdateHandler(
   "archive",
   "own",
   "archived",
-  "Sets one template resource of the caller's tenant to archived so the resolver stops serving it while the row and its content survive; use it to retire a template reversibly instead of deleting it.",
+  "Sets one template resource of the caller's tenant to archived so the resolver stops serving it while the row and its content survive; use it to retire a template reversibly instead of deleting it. An open draft stays.",
 );
 export const publishWrite = createStatusUpdateHandler(
   "publish",
   "own",
   "active",
-  "Sets one template resource of the caller's tenant to active so the resolver starts serving it; use it to release a draft written by upsert-tenant, or to bring an archived template back; a mail template with unknown placeholders or unused required variables is refused.",
-  publishGateIssues,
+  "Sets one template resource of the caller's tenant to active so the resolver starts serving it; use it to release a draft written by upsert-tenant (a draft saved beside an active version replaces it), or to bring an archived template back; a version with unknown placeholders or unused required variables is refused and the served version stays.",
 );
 export const archiveSystemWrite = createStatusUpdateHandler(
   "archive-system",
@@ -88,6 +116,5 @@ export const publishSystemWrite = createStatusUpdateHandler(
   "publish-system",
   "system",
   "active",
-  "Sets one system-default template to active so the resolver serves it again to every tenant that has no override; SystemAdmin only, a mail template with unknown placeholders or unused required variables is refused.",
-  publishGateIssues,
+  "Sets one system-default template to active so the resolver serves it again to every tenant that has no override; an open draft beside the active version replaces it; SystemAdmin only, a version with unknown placeholders or unused required variables is refused.",
 );

package/packages/bundled-features/src/template-resolver/handlers/upsert-tenant.write.ts

@@ -17,7 +17,7 @@ export const upsertTenantWrite = defineWriteHandler({
   }),
   access: { roles: ["TenantAdmin", "SystemAdmin"] },
   description:
-    "Creates or overwrites a tenant-scoped template override with its variable schema, landing as a draft that only publish makes live; it refuses a system-tenant target, which is what upsert-system is for.",
+    "Creates or overwrites a tenant-scoped template override with its variable schema, landing as a draft that only publish makes live (over an active override the draft is stored beside it, the active version keeps being served until publish); it refuses a system-tenant target, which is what upsert-system is for.",
   handler: async (event, ctx) => {
     // @cast-boundary engine-payload — override aus Zod-parsed string,
     // event.user.tenantId schon TenantId-branded; union als TenantId casten

package/packages/bundled-features/src/template-resolver/handlers/usage.query.ts

@@ -1,17 +1,31 @@
+import { selectMany } from "@cosmicdrift/kumiko-framework/bun-db";
 import { defineQueryHandler } from "@cosmicdrift/kumiko-framework/engine";
 import * as z from "zod";
 import { TEMPLATE_KINDS } from "../constants.js";
+import { type TemplateResourceRow, templateResourcesTable } from "../table.js";
 import { templateSlugSchema } from "../template-meta.js";
 import { collectTemplateUsage } from "../template-usage.js";
+import { effectiveMailLayoutSlugs } from "./overview.query.js";
+
+const MAIL_ROW_LIMIT = 5000;
 
 export const usageQuery = defineQueryHandler({
   name: "usage",
   schema: z.object({ slug: templateSlugSchema, kind: z.enum(TEMPLATE_KINDS) }),
   access: { roles: ["TenantAdmin", "SystemAdmin"] },
   description:
-    "Lists the code-registered notifications that use one template: a mail template is used by the notification whose qualified name is its slug, a mail layout by every mail notification that names it in its meta or falls back to the default layout; use it to show what a change to a template affects.",
+    "Lists the code-registered notifications that use one template: a mail template is used by the notification whose qualified name is its slug and that has a code template, a mail layout by every mail notification whose effective template (own override, else system) names it, or whose code meta does when no stored template exists, or that falls back to the default layout; use it to show what a change to a template affects.",
   handler: async (query, ctx) => {
     const { slug, kind } = query.payload;
-    return { usedBy: collectTemplateUsage(ctx.registry, slug, kind) };
+    if (kind !== "mail-layout") return { usedBy: collectTemplateUsage(ctx.registry, slug, kind) };
+    const mailRows = await selectMany<TemplateResourceRow>(
+      ctx.db,
+      templateResourcesTable,
+      { kind: "mail" },
+      { limit: MAIL_ROW_LIMIT },
+    );
+    return {
+      usedBy: collectTemplateUsage(ctx.registry, slug, kind, effectiveMailLayoutSlugs(mailRows)),
+    };
   },
 });

package/packages/bundled-features/src/template-resolver/index.ts

@@ -21,7 +21,12 @@ export {
   FALLBACK_LOCALE,
   NON_RENDER_KINDS,
   type NonRenderKind,
+  PDF_DEFAULT_MARGIN_MM,
+  PDF_FOOTER_MARGIN_MM,
+  PDF_HEADER_MARGIN_MM,
+  PDF_ORIENTATIONS,
   PDF_PAGE_FORMATS,
+  type PdfOrientation,
   type PdfPageFormat,
   RENDER_KINDS,
   type RenderKind,
@@ -52,7 +57,6 @@ export {
   DocumentDivider,
   DocumentLink,
   DocumentPageBreak,
-  DocumentRepeatRow,
   DocumentResource,
   DocumentTable,
   DocumentTableCell,
@@ -77,6 +81,11 @@ export type {
   OverviewUsage,
 } from "./handlers/overview.query.js";
 export { localeSchema } from "./handlers/shared.js";
+export {
+  isHexColor,
+  type MailLayoutAppearance,
+  mailLayoutAppearance,
+} from "./layout-appearance.js";
 export {
   type LayoutRegions,
   readLayoutRegions,
@@ -116,10 +125,12 @@ export {
   type LayoutTemplateMeta,
   MAIL_CATEGORIES,
   type MailCategory,
+  type MailLayoutMeta,
   type MailTemplateMeta,
   type PdfTemplateMeta,
   parseTemplateMeta,
   pdfAttachmentFileNamePatternSchema,
+  readMailLayoutMeta,
   readPdfTemplateMeta,
   type TemplateMeta,
   type TemplateMetaIssue,

package/packages/bundled-features/src/template-resolver/layout-appearance.ts

@@ -0,0 +1,40 @@
+import { HEX_COLOR_PATTERN } from "./constants.js";
+import { type MailLayoutMeta, readMailLayoutMeta } from "./template-meta.js";
+
+// Every value is a member of a closed set, so it can be written into MJML and inline styles as is.
+export type MailLayoutAppearance = {
+  readonly width: number;
+  readonly fontFamily: string;
+  readonly outerBackground: string;
+  readonly accentLine: boolean;
+  readonly buttonStyle: string;
+};
+
+const FONT_FAMILIES = {
+  sans: "Arial, Helvetica, sans-serif",
+  serif: "Georgia, 'Times New Roman', serif",
+} as const;
+
+const BUTTON_COLOR = "#1f5468";
+const BUTTON_BASE = "display:inline-block;padding:10px 20px;font-weight:600;text-decoration:none";
+
+const BUTTON_STYLES = {
+  "filled-rounded": `${BUTTON_BASE};border-radius:6px;background-color:${BUTTON_COLOR};color:#ffffff`,
+  "filled-square": `${BUTTON_BASE};background-color:${BUTTON_COLOR};color:#ffffff`,
+  outline: `${BUTTON_BASE};border:2px solid ${BUTTON_COLOR};border-radius:6px;color:${BUTTON_COLOR}`,
+} as const;
+
+export function isHexColor(value: string): boolean {
+  return HEX_COLOR_PATTERN.test(value);
+}
+
+export function mailLayoutAppearance(meta: MailLayoutMeta | unknown): MailLayoutAppearance {
+  const parsed = readMailLayoutMeta(meta);
+  return {
+    width: parsed.width ?? 600,
+    fontFamily: FONT_FAMILIES[parsed.font ?? "sans"],
+    outerBackground: parsed.outerBackground ?? "#f5f5f5",
+    accentLine: (parsed.accentLine ?? "none") === "branding",
+    buttonStyle: BUTTON_STYLES[parsed.buttonStyle ?? "filled-rounded"],
+  };
+}

package/packages/bundled-features/src/template-resolver/pdf-constants.ts

@@ -0,0 +1,12 @@
+// @runtime client
+// No imports: web/ re-exports these, and constants.ts pulls in the framework engine.
+export const PDF_PAGE_FORMATS = ["A4", "Letter"] as const;
+export type PdfPageFormat = (typeof PDF_PAGE_FORMATS)[number];
+
+export const PDF_ORIENTATIONS = ["portrait", "landscape"] as const;
+export type PdfOrientation = (typeof PDF_ORIENTATIONS)[number];
+
+// Page margins in mm; the header/footer values apply when the layout contributes that region and the template sets no margin itself.
+export const PDF_DEFAULT_MARGIN_MM = 15;
+export const PDF_HEADER_MARGIN_MM = 30;
+export const PDF_FOOTER_MARGIN_MM = 20;

package/packages/bundled-features/src/template-resolver/qualified-names.ts

@@ -9,6 +9,8 @@ export const TemplateResolverHandlers = {
   archive: "template-resolver:write:archive",
   publishSystem: "template-resolver:write:publish-system",
   archiveSystem: "template-resolver:write:archive-system",
+  discardDraft: "template-resolver:write:discard-draft",
+  discardDraftSystem: "template-resolver:write:discard-draft-system",
   resetToSystem: "template-resolver:write:reset-to-system",
   set: "template-resolver:write:set",
   importBundle: "template-resolver:write:import-bundle",
@@ -53,10 +55,12 @@ export const TemplateResolverErrors = {
   invalidSlug: "invalid_slug",
   invalidLocale: "invalid_locale",
   systemAdminRequired: "system_admin_required",
+  noDraft: "no_draft",
   alreadyActive: "template_already_active",
   alreadyArchived: "template_already_archived",
   targetExists: "target_exists",
   systemResourcesNeedSystemTenant: "system_resources_need_system_tenant",
+  bundleLocalesDiffer: "bundle_locales_differ",
   resourceTooLarge: "template_resource_too_large",
   resourceUnsupportedImage: "template_resource_unsupported_image",
   attachmentUnsupportedType: "template_attachment_unsupported_type",

package/packages/bundled-features/src/template-resolver/seeding.ts

@@ -35,6 +35,7 @@ import { evaluateTemplateWrite } from "./handlers/template-gates.js";
 import { TEMPLATE_RESOLVER_FEATURE } from "./qualified-names.js";
 import { type TemplateResourceRow, templateResourcesTable } from "./table.js";
 import type { TemplateBundle } from "./template-bundle.js";
+import { activeStampChanges, servedStampChanges } from "./template-draft.js";
 import { templateSlugSchema } from "./template-meta.js";
 import { variablesFromSchema } from "./template-validation.js";
 
@@ -159,7 +160,11 @@ export async function seedSystemTemplate(
       return { id: String(row.id) };
     }
     const result = await executor.update(
-      { id: row.id, version: row.version, changes: rowFields },
+      {
+        id: row.id,
+        version: row.version,
+        changes: { ...rowFields, ...activeStampChanges(row) },
+      },
       by,
       tdb,
     );
@@ -174,7 +179,13 @@ export async function seedSystemTemplate(
     ifExists: opts.ifExists,
     create: async () => {
       const result = await executor.create(
-        { ...rowFields, linkedResources: linkedResources ?? "{}", tenantId },
+        {
+          ...rowFields,
+          ...activeStampChanges(null),
+          draft: null,
+          linkedResources: linkedResources ?? "{}",
+          tenantId,
+        },
         by,
         tdb,
       );
@@ -366,7 +377,13 @@ export async function seedTextBlock(
       {
         id: row.id,
         version: row.version,
-        changes: { title: fields.title, content: fields.content, folder: fields.folder },
+        changes: {
+          title: fields.title,
+          content: fields.content,
+          folder: fields.folder,
+          // A re-seed must not revive an archived block; only a served one gets a new served version.
+          ...(current?.status === "active" && servedStampChanges(row)),
+        },
       },
       by,
       tdb,
@@ -381,7 +398,11 @@ export async function seedTextBlock(
     existing,
     ifExists: opts.ifExists,
     create: async () => {
-      const result = await executor.create({ ...fields, tenantId: opts.tenantId }, by, tdb);
+      const result = await executor.create(
+        { ...fields, ...activeStampChanges(null), draft: null, tenantId: opts.tenantId },
+        by,
+        tdb,
+      );
       if (!result.isSuccess) {
         if (result.error?.code === "unique_violation") {
           const again = await fetchOne<TemplateResourceRow>(db, templateResourcesTable, {

package/packages/bundled-features/src/template-resolver/store-template-resource.ts

@@ -105,7 +105,7 @@ export async function storeTemplateResource(args: {
   const created = await createFileRefFromBytes(
     {
       db,
-      files: fileContextForTenant(ctx, tenantId),
+      files: fileContextForTenant(ctx, ctx.user.tenantId, tenantId),
       registry: ctx.registry,
       user: { ...user, tenantId },
     },
@@ -242,7 +242,7 @@ async function createAttachmentFileRef(args: {
   const created = await createFileRefFromBytes(
     {
       db,
-      files: fileContextForTenant(ctx, tenantId),
+      files: fileContextForTenant(ctx, ctx.user.tenantId, tenantId),
       registry: ctx.registry,
       user: { ...user, tenantId },
     },

package/packages/bundled-features/src/template-resolver/table.ts

@@ -2,8 +2,10 @@ import { buildEntityTable } from "@cosmicdrift/kumiko-framework/db";
 import {
   createEntity,
   createLongTextField,
+  createNumberField,
   createSelectField,
   createTextField,
+  createTimestampField,
 } from "@cosmicdrift/kumiko-framework/engine";
 import type { EntityEventMigration } from "@cosmicdrift/kumiko-types/fields";
 import type { Temporal } from "@cosmicdrift/kumiko-types/temporal";
@@ -24,7 +26,9 @@ const renameMailHtmlKind: EntityEventMigration = {
 // TemplateResource — strukturierte Template-Definition mit Tenant-
 // Override-Hierarchie, Locale-Fallback und Resource-Linking via
 // file-foundation. Pro (tenantId, slug, kind, locale) genau eine Row;
-// scope/status/version differenzieren Lifecycle.
+// scope/status/version differenzieren Lifecycle. Der Entwurf neben einer
+// aktiven Fassung liegt in `draft`; die Hauptfelder bleiben die ausgelieferte
+// Fassung.
 //
 // `variableSchema` + `linkedResources` sind JSON-Strings in longText
 // (Pattern aus compliance-profiles — kein dedizierter jsonbField im
@@ -58,6 +62,11 @@ export const templateResourceEntity = createEntity({
     scope: createSelectField({ required: true, options: [...TEMPLATE_SCOPES] }),
     parentTemplateId: createTextField({ personal: false, reason: "technical_reference" }),
     status: createSelectField({ required: true, options: [...TEMPLATE_STATUSES] }),
+    // JSON of the unpublished edit beside the active version (see template-draft.ts).
+    draft: createLongTextField({ personal: false, reason: "is_business_data" }),
+    // `version` counts every save including drafts; these two describe the served version.
+    activeVersion: createNumberField({ integer: true, min: 1 }),
+    activeSince: createTimestampField({}),
   },
   indexes: [
     {
@@ -101,4 +110,7 @@ export type TemplateResourceRow = {
   readonly scope: string;
   readonly parentTemplateId: string | null;
   readonly status: string;
+  readonly draft: string | null;
+  readonly activeVersion: number | null;
+  readonly activeSince: Temporal.Instant | null;
 } & EntityAuditColumns;