@cosmicdrift/kumiko-samples 0.363.0 → 0.364.0

package/packages/bundled-features/src/template-resolver/template-draft.ts

@@ -0,0 +1,106 @@
+import { Temporal } from "@cosmicdrift/kumiko-types/temporal";
+import * as z from "zod";
+import { CONTENT_FORMATS, type ContentFormat } from "./constants.js";
+import type { TemplateResourceRow } from "./table.js";
+
+const templateDraftSchema = z.object({
+  content: z.string().nullable(),
+  contentFormat: z.enum(CONTENT_FORMATS),
+  variableSchema: z.string(),
+  meta: z.string().nullable(),
+  title: z.string().nullable(),
+  folder: z.string().nullable(),
+  parentTemplateId: z.string().nullable(),
+});
+
+// An unpublished edit beside the active version; variableSchema and meta stay
+// JSON strings, exactly like the columns they replace on publish.
+export type TemplateDraft = {
+  readonly content: string | null;
+  readonly contentFormat: ContentFormat;
+  readonly variableSchema: string;
+  readonly meta: string | null;
+  readonly title: string | null;
+  readonly folder: string | null;
+  readonly parentTemplateId: string | null;
+};
+
+export function parseTemplateDraft(raw: string | null): TemplateDraft | null {
+  if (raw === null) return null;
+  try {
+    const parsed = templateDraftSchema.safeParse(JSON.parse(raw));
+    return parsed.success ? parsed.data : null;
+  } catch {
+    return null;
+  }
+}
+
+export function serializeTemplateDraft(draft: TemplateDraft): string {
+  return JSON.stringify(draft);
+}
+
+export function activeVersionOf(row: TemplateResourceRow): number {
+  return row.activeVersion ?? row.version;
+}
+
+// `version` also counts draft saves, so only a row without a served version shows it as its number.
+export function servedVersionOf(row: TemplateResourceRow): number {
+  return row.status === "active" ? activeVersionOf(row) : row.version;
+}
+
+export function activeSinceOf(row: TemplateResourceRow): Temporal.Instant {
+  return row.activeSince ?? row.modifiedAt ?? row.insertedAt;
+}
+
+export type ActiveInfo = { readonly version: number; readonly since: Temporal.Instant };
+
+export type WorkingRow = TemplateResourceRow & { readonly active: ActiveInfo | null };
+
+// A SystemAdmin edits system rows, so for them those rows count as their own.
+function isSystemAdmin(user: { readonly roles: readonly string[] }): boolean {
+  return user.roles.includes("SystemAdmin");
+}
+
+// A system row that was never served keeps its draft in the main fields, so only a SystemAdmin may read it.
+export function isHiddenSystemDraft(
+  user: { readonly roles: readonly string[] },
+  row: Pick<TemplateResourceRow, "scope" | "status">,
+): boolean {
+  return row.scope === "system" && row.status === "draft" && !isSystemAdmin(user);
+}
+
+export function draftViewerTenantId(
+  user: { readonly tenantId: string; readonly roles: readonly string[] },
+  row: TemplateResourceRow,
+): string {
+  return row.scope === "system" && isSystemAdmin(user) ? row.tenantId : user.tenantId;
+}
+
+// The version an editor works on: the open draft if there is one, else the stored row.
+// A draft is only shown to the tenant that owns the row, never through a system row.
+export function toWorkingRow(row: TemplateResourceRow, viewerTenantId: string): WorkingRow {
+  const active =
+    row.status === "active" ? { version: activeVersionOf(row), since: activeSinceOf(row) } : null;
+  const draft = row.tenantId === viewerTenantId ? parseTemplateDraft(row.draft) : null;
+  // Saves and discards of drafts raise row.version; an editor without a draft shows the served number.
+  if (draft === null) return { ...row, version: active?.version ?? row.version, active };
+  return { ...row, ...draft, status: "draft", active };
+}
+
+// Event changes that turn a row into a served one. Every value is explicit so a
+// rebuild reproduces the row without deriving anything.
+export function servedStampChanges(row: { readonly version: number } | null) {
+  return {
+    activeVersion: row === null ? 1 : row.version + 1,
+    activeSince: Temporal.Now.instant(),
+  };
+}
+
+export function activeStampChanges(row: { readonly version: number } | null) {
+  return { status: "active", ...servedStampChanges(row) };
+}
+
+// Publishing also consumes the open draft.
+export function activationChanges(row: TemplateResourceRow | null) {
+  return { ...activeStampChanges(row), draft: null };
+}

package/packages/bundled-features/src/template-resolver/template-meta.ts

@@ -1,5 +1,10 @@
 import * as z from "zod";
-import { PDF_PAGE_FORMATS, type TemplateKind } from "./constants.js";
+import {
+  HEX_COLOR_PATTERN,
+  PDF_ORIENTATIONS,
+  PDF_PAGE_FORMATS,
+  type TemplateKind,
+} from "./constants.js";
 
 // One or more kebab segments joined by ":" — notification templates are seeded
 // under their qualified name `feature:notify:name`.
@@ -22,21 +27,26 @@ const singleLine = (max: number) =>
     .max(max)
     .refine((value) => !/[\r\n]/.test(value), "must not contain line breaks");
 
-const mailMetaSchema = z
-  .object({
-    subject: singleLine(200).min(1),
-    previewText: singleLine(200).optional(),
-    layoutSlug: templateSlugSchema.optional(),
-    category: z.enum(MAIL_CATEGORIES).optional(),
-    sender: z
-      .string()
-      .max(60)
-      .regex(/^[a-z0-9]+(-[a-z0-9]+)*$/, "sender must be a kebab-case key")
-      .optional(),
-  })
-  .strict();
+// Rows saved before the sender key was dropped still carry it; discard it on read so they stay editable.
+function withoutLegacySender(raw: unknown): unknown {
+  if (typeof raw !== "object" || raw === null || !("sender" in raw)) return raw;
+  const { sender: _legacySender, ...rest } = raw;
+  return rest;
+}
 
-const PDF_ORIENTATIONS = ["portrait", "landscape"] as const;
+const mailMetaSchema = z.preprocess(
+  withoutLegacySender,
+  z
+    .object({
+      subject: singleLine(200).min(1),
+      previewText: singleLine(200).optional(),
+      layoutSlug: templateSlugSchema.optional(),
+      category: z.enum(MAIL_CATEGORIES).optional(),
+      senderName: singleLine(80).min(1).optional(),
+      replyTo: singleLine(254).pipe(z.email()).optional(),
+    })
+    .strict(),
+);
 
 const marginMm = z.number().finite().min(0).max(100).optional();
 
@@ -71,11 +81,26 @@ const pdfMetaSchema = z
   })
   .strict();
 
-const layoutMetaSchema = z.object({}).strict();
+const MAIL_LAYOUT_FONTS = ["sans", "serif"] as const;
+const MAIL_LAYOUT_ACCENT_LINES = ["branding", "none"] as const;
+const MAIL_LAYOUT_BUTTON_STYLES = ["filled-rounded", "filled-square", "outline"] as const;
+
+const mailLayoutMetaSchema = z
+  .object({
+    width: z.union([z.literal(560), z.literal(600), z.literal(640)]).optional(),
+    font: z.enum(MAIL_LAYOUT_FONTS).optional(),
+    outerBackground: z.string().regex(HEX_COLOR_PATTERN, "must be a #rrggbb color").optional(),
+    accentLine: z.enum(MAIL_LAYOUT_ACCENT_LINES).optional(),
+    buttonStyle: z.enum(MAIL_LAYOUT_BUTTON_STYLES).optional(),
+  })
+  .strict();
+
+const pdfLayoutMetaSchema = z.object({}).strict();
 
 export type MailTemplateMeta = z.infer<typeof mailMetaSchema>;
 export type PdfTemplateMeta = z.infer<typeof pdfMetaSchema>;
-export type LayoutTemplateMeta = z.infer<typeof layoutMetaSchema>;
+export type MailLayoutMeta = z.infer<typeof mailLayoutMetaSchema>;
+export type LayoutTemplateMeta = MailLayoutMeta | z.infer<typeof pdfLayoutMetaSchema>;
 export type TemplateMeta = MailTemplateMeta | PdfTemplateMeta | LayoutTemplateMeta;
 
 export function isMailTemplateMeta(meta: TemplateMeta | null): meta is MailTemplateMeta {
@@ -87,7 +112,29 @@ export function readPdfTemplateMeta(meta: TemplateMeta | null): PdfTemplateMeta
   return parsed.success ? parsed.data : null;
 }
 
-export type TemplateMetaIssue = { readonly path: string; readonly message: string };
+export function readMailLayoutMeta(meta: unknown): MailLayoutMeta {
+  const parsed = mailLayoutMetaSchema.safeParse(meta ?? {});
+  return parsed.success ? parsed.data : {};
+}
+
+export type TemplateMetaIssue = {
+  readonly path: string;
+  /** The setting the issue is about (`subject`), `meta` when it concerns the object as a whole. */
+  readonly field: string;
+  /** The value is absent or empty, as opposed to present and wrong. */
+  readonly missing: boolean;
+  /** Parser wording; for logs and tests, never for the UI. */
+  readonly message: string;
+};
+
+function valueAt(raw: unknown, path: readonly PropertyKey[]): unknown {
+  let current: unknown = raw;
+  for (const key of path) {
+    if (typeof current !== "object" || current === null) return undefined;
+    current = Object.entries(current).find(([name]) => name === String(key))?.[1];
+  }
+  return current;
+}
 
 export type TemplateMetaResult =
   | { readonly ok: true; readonly meta: TemplateMeta | null }
@@ -100,8 +147,9 @@ function schemaForKind(kind: TemplateKind) {
     case "document-pdf":
       return pdfMetaSchema;
     case "mail-layout":
+      return mailLayoutMetaSchema;
     case "pdf-layout":
-      return layoutMetaSchema;
+      return pdfLayoutMetaSchema;
     default:
       return null;
   }
@@ -114,16 +162,31 @@ export function parseTemplateMeta(kind: TemplateKind, raw: unknown): TemplateMet
   if (schema === null) {
     return raw === undefined || raw === null
       ? { ok: true, meta: null }
-      : { ok: false, issues: [{ path: "meta", message: `kind ${kind} does not take meta` }] };
+      : {
+          ok: false,
+          issues: [
+            {
+              path: "meta",
+              field: "meta",
+              missing: false,
+              message: `kind ${kind} does not take meta`,
+            },
+          ],
+        };
   }
   if ((raw === undefined || raw === null) && kind !== "mail") return { ok: true, meta: null };
   const parsed = schema.safeParse(raw ?? undefined);
   if (parsed.success) return { ok: true, meta: parsed.data };
   return {
     ok: false,
-    issues: parsed.error.issues.map((issue) => ({
-      path: ["meta", ...issue.path.map(String)].join("."),
-      message: issue.message,
-    })),
+    issues: parsed.error.issues.map((issue) => {
+      const value = valueAt(raw, issue.path);
+      return {
+        path: ["meta", ...issue.path.map(String)].join("."),
+        field: issue.path.length === 0 ? "meta" : String(issue.path[0]),
+        missing: value === undefined || value === "",
+        message: issue.message,
+      };
+    }),
   };
 }

package/packages/bundled-features/src/template-resolver/template-preview.ts

@@ -13,6 +13,7 @@ import {
   ValidationError,
 } from "@cosmicdrift/kumiko-framework/errors";
 import { fileRefsTable } from "@cosmicdrift/kumiko-framework/files";
+import { escapeHtml } from "@cosmicdrift/kumiko-headless";
 import { createEmailAttachmentReader, createTemplateMailRenderer } from "../delivery/index.js";
 import { fileContextForTenant } from "../file-foundation/index.js";
 import {
@@ -24,10 +25,20 @@ import {
 } from "../renderer-foundation/index.js";
 import { createTemplateResolverApi, TemplateNotFoundError, type TemplateResource } from "./api.js";
 import { collectDocumentResourceKeys } from "./compile-document-body.js";
-import { MAIL_PREVIEW_MAX_BYTES, SYSTEM_TENANT_ID, type TemplateScope } from "./constants.js";
+import {
+  DEFAULT_MAIL_LAYOUT_SLUG,
+  MAIL_PREVIEW_MAX_BYTES,
+  SYSTEM_TENANT_ID,
+  type TemplateScope,
+} from "./constants.js";
 import { parseStoredJson } from "./handlers/template-gates.js";
 import { validateTemplateDraft } from "./handlers/validate.query.js";
-import { type LayoutRegions, readLayoutRegions, sanitizeLayoutHtml } from "./layout-regions.js";
+import {
+  type LayoutRegions,
+  readLayoutRegions,
+  sanitizeLayoutHtml,
+  type TemplateWriteScope,
+} from "./layout-regions.js";
 import { type LinkedResourceEntry, parseLinkedResourceEntries } from "./linked-resources.js";
 import { buildDisplayHtml } from "./preview-display-html.js";
 import { TemplateResolverErrors } from "./qualified-names.js";
@@ -42,7 +53,7 @@ import {
 
 const SAMPLE_LINK = "https://example.com";
 const SAMPLE_DATE = "2026-01-15";
-const SAMPLE_LIST_ROWS = 2;
+const SAMPLE_LIST_ROWS = 3;
 const DEFAULT_PDF_LAYOUT_SLUG = "default";
 
 function sampleScalar(name: string, def: TemplateScalarVariableDef): unknown {
@@ -50,6 +61,8 @@ function sampleScalar(name: string, def: TemplateScalarVariableDef): unknown {
   switch (def.type) {
     case "text":
       return `[${def.label ?? name}]`;
+    case "richText":
+      return `<p>[${escapeHtml(def.label ?? name)}]</p>`;
     case "link":
       return SAMPLE_LINK;
     case "money":
@@ -141,6 +154,12 @@ export type TemplatePreview = {
   readonly text: string | null;
   readonly attachments: readonly PreviewAttachment[];
   readonly layout: PreviewLayout | null;
+  /** Mail only: which layout version the html was rendered through. */
+  readonly mailLayout?: {
+    readonly slug: string;
+    readonly scope: TemplateScope;
+    readonly version: number;
+  } | null;
   readonly sampleValues: Readonly<Record<string, unknown>>;
   readonly checks: readonly PreviewCheck[];
   readonly validation: ValidationResponse;
@@ -152,6 +171,7 @@ export type TemplatePreviewOutcome =
       readonly preview: TemplatePreview;
       /** What the send path needs to attach; kept out of the response shown to the editor. */
       readonly mailAttachments: readonly MailAttachmentRef[];
+      readonly sender: { readonly fromName?: string; readonly replyTo?: string };
     }
   | { readonly ok: false; readonly error: KumikoError };
 
@@ -180,7 +200,7 @@ async function loadStoredDraft(
 async function describeAttachments(
   ctx: HandlerContext,
   refs: readonly MailAttachmentRef[],
-): Promise<PreviewAttachment[]> {
+): Promise<{ readonly attachments: PreviewAttachment[]; readonly missing: string[] }> {
   const fileRefIds = refs.flatMap((ref) => (ref.kind === "rendered-pdf" ? [] : [ref.fileRefId]));
   const rows =
     fileRefIds.length === 0
@@ -191,7 +211,14 @@ async function describeAttachments(
   const sizeById = new Map(rows.map((row) => [row.id, Number(row.size)]));
   // An inline image is named by its content id because the stored file name is personal data and
   // may be ciphertext; a file attachment carries the name the admin gave it.
-  return refs.map((ref) => previewAttachmentOf(ref, sizeById));
+  const attachments = refs.map((ref) => previewAttachmentOf(ref, sizeById));
+  // A fileRef without a row has no known size: it is reported, not counted as 0 bytes.
+  const missing = refs.flatMap((ref, index) =>
+    ref.kind !== "rendered-pdf" && !sizeById.has(ref.fileRefId)
+      ? [attachments[index]?.name ?? ""]
+      : [],
+  );
+  return { attachments, missing };
 }
 
 function previewAttachmentOf(
@@ -213,8 +240,28 @@ function previewAttachmentOf(
   }
 }
 
+// Part headers and multipart boundary lines around one attachment in the MIME message.
+export const MIME_PART_OVERHEAD_BYTES = 512;
+
+// The provider cap applies to the encoded message: attachments travel base64-encoded.
+export function encodedAttachmentBytes(rawBytes: number): number {
+  return Math.ceil(rawBytes / 3) * 4 + MIME_PART_OVERHEAD_BYTES;
+}
+
 const attachmentSizeOf = (attachment: PreviewAttachment): number =>
-  attachment.kind === "rendered-pdf" ? 0 : attachment.sizeBytes;
+  attachment.kind === "rendered-pdf" ? 0 : encodedAttachmentBytes(attachment.sizeBytes);
+
+export function estimateMailBytes(args: {
+  readonly html: string;
+  readonly text: string;
+  readonly attachments: readonly PreviewAttachment[];
+}): number {
+  return (
+    utf8Bytes(args.html) +
+    utf8Bytes(args.text) +
+    args.attachments.reduce((sum, attachment) => sum + attachmentSizeOf(attachment), 0)
+  );
+}
 
 // The row an editor is working on, whatever its status: the stored template only resolves when
 // active, so a draft would otherwise lose the images and attachments uploaded to it.
@@ -328,6 +375,7 @@ async function renderDocumentPreview(
     return {
       ok: true,
       mailAttachments: [],
+      sender: {},
       preview: {
         kind: "document-pdf",
         subject: null,
@@ -362,7 +410,8 @@ async function renderDocumentPreview(
         registry: ctx.registry,
         tenantId: user.tenantId,
         ...(ctx.config !== undefined && { config: ctx.config }),
-        filesForTenant: (fileTenantId) => fileContextForTenant(ctx, fileTenantId),
+        filesForTenant: (fileTenantId) =>
+          fileContextForTenant(ctx, ctx.user.tenantId, fileTenantId),
       },
     );
   } catch (e) {
@@ -372,6 +421,7 @@ async function renderDocumentPreview(
   return {
     ok: true,
     mailAttachments: [],
+    sender: {},
     preview: {
       kind: "document-pdf",
       subject: null,
@@ -409,11 +459,12 @@ export type DocumentDraftOutcome =
     }
   | { readonly ok: false; readonly error: KumikoError };
 
-// A document draft is always tenant-scoped here, like in the preview: it passes the write gates
-// and a failing draft is rejected with the same problems as a save.
+// The caller derives `scope` once from the role (SystemAdmin edits the system row), so the write
+// gates and the print see the same row: a failing draft is rejected with the same problems as a save.
 export async function evaluateDocumentDraft(
   ctx: HandlerContext,
   user: SessionUser,
+  scope: TemplateWriteScope,
   draft: {
     readonly slug: string;
     readonly locale: string;
@@ -430,7 +481,7 @@ export async function evaluateDocumentDraft(
     meta: draft.meta,
     variableSchema: draft.variableSchema,
     locale: draft.locale,
-    scope: "tenant",
+    scope,
   });
   if (!evaluation.ok) {
     return { ok: false, error: new ValidationError({ fields: [...evaluation.issues] }) };
@@ -445,51 +496,39 @@ export async function evaluateDocumentDraft(
   };
 }
 
-// Renders a draft (or, without content, the stored template) with sample values, going through
-// the same write gates and the same mail renderer as a real send. Nothing is stored or sent.
-export async function renderTemplatePreview(
+type DraftSource = {
+  readonly content: string;
+  readonly meta: unknown;
+  readonly variableSchema: Readonly<Record<string, unknown>>;
+};
+
+// The posted draft when it carries content, else the stored template; null when none is stored.
+async function resolveDraftSource(
   ctx: HandlerContext,
   user: SessionUser,
   input: TemplatePreviewInput,
-): Promise<TemplatePreviewOutcome> {
-  let draftContent = input.content;
-  let draftMeta: unknown = input.meta;
-  let draftVariableSchema = input.variableSchema;
-  if (draftContent === undefined) {
-    const stored = await loadStoredDraft(ctx, user, input);
-    if (stored === null) return failed(new NotFoundError("template-resource", input.slug));
-    draftContent = stored.content;
-    draftMeta = stored.meta;
-    draftVariableSchema = stored.variableSchema;
+): Promise<DraftSource | null> {
+  if (input.content !== undefined) {
+    return { content: input.content, meta: input.meta, variableSchema: input.variableSchema };
   }
+  const stored = await loadStoredDraft(ctx, user, input);
+  if (stored === null) return null;
+  return { content: stored.content, meta: stored.meta, variableSchema: stored.variableSchema };
+}
 
-  const { response: validation, evaluation } = await validateTemplateDraft(ctx, user, {
-    slug: input.slug,
-    kind: input.kind,
-    contentFormat: "html",
-    content: draftContent,
-    meta: draftMeta,
+async function renderMailPreview(
+  ctx: HandlerContext,
+  user: SessionUser,
+  args: DocumentPreviewArgs,
+): Promise<TemplatePreviewOutcome> {
+  const {
+    input,
+    content,
+    meta,
+    validation,
+    sampleValues,
     variableSchema: draftVariableSchema,
-    locale: input.locale,
-    scope: "tenant",
-  });
-  if (!evaluation.ok) return failed(new ValidationError({ fields: [...evaluation.issues] }));
-
-  const content = evaluation.content ?? "";
-  const meta = parseTemplateMeta(input.kind, parseStoredJson(evaluation.metaJson));
-  const sampleValues = sampleValuesFor(validation.variables);
-
-  if (input.kind === "document-pdf") {
-    return renderDocumentPreview(ctx, user, {
-      input,
-      content,
-      meta,
-      variableSchema: draftVariableSchema,
-      sampleValues,
-      validation,
-    });
-  }
-
+  } = args;
   if (!meta.ok || !isMailTemplateMeta(meta.meta)) {
     return failed(
       new UnprocessableError(TemplateResolverErrors.previewRenderFailed, {
@@ -525,23 +564,27 @@ export async function renderTemplatePreview(
 
   const mailAttachments = rendered.attachments ?? [];
   const inline = mailAttachments.filter((ref) => ref.kind === "inline");
-  const attachments = await describeAttachments(ctx, mailAttachments);
+  const { attachments, missing: missingAttachments } = await describeAttachments(
+    ctx,
+    mailAttachments,
+  );
   const displayHtml = await buildDisplayHtml(
     rendered.html,
     inline,
     createEmailAttachmentReader(ctx.db, ctx.registry, user.tenantId, ctx.config, (tenantId) =>
-      fileContextForTenant(ctx, tenantId),
+      fileContextForTenant(ctx, ctx.user.tenantId, tenantId),
     ),
   );
   const resolvedCids = new Set(inline.map((ref) => ref.cid));
   const unresolved = collectDocumentResourceKeys(content).filter((key) => !resolvedCids.has(key));
-  const totalBytes =
-    utf8Bytes(rendered.html) +
-    utf8Bytes(rendered.text) +
-    attachments.reduce((sum, attachment) => sum + attachmentSizeOf(attachment), 0);
+  const totalBytes = estimateMailBytes({ html: rendered.html, text: rendered.text, attachments });
   return {
     ok: true,
     mailAttachments,
+    sender: {
+      ...(rendered.fromName !== undefined && { fromName: rendered.fromName }),
+      ...(rendered.replyTo !== undefined && { replyTo: rendered.replyTo }),
+    },
     preview: {
       kind: "mail",
       subject: rendered.subject,
@@ -551,9 +594,17 @@ export async function renderTemplatePreview(
       text: rendered.text,
       attachments,
       layout: null,
+      mailLayout:
+        rendered.layout === undefined
+          ? null
+          : {
+              slug: mailMeta.layoutSlug ?? DEFAULT_MAIL_LAYOUT_SLUG,
+              scope: rendered.layout.scope,
+              version: rendered.layout.templateVersion,
+            },
       sampleValues,
       checks: [
-        missingResourceCheck(unresolved),
+        missingResourceCheck([...unresolved, ...missingAttachments]),
         {
           code: "text_present",
           ok: rendered.text.trim() !== "",
@@ -571,3 +622,55 @@ export async function renderTemplatePreview(
     },
   };
 }
+
+// Renders a draft (or, without content, the stored template) with sample values, going through
+// the same write gates and the same mail renderer as a real send. Nothing is stored or sent.
+export async function renderTemplatePreview(
+  ctx: HandlerContext,
+  user: SessionUser,
+  input: TemplatePreviewInput,
+): Promise<TemplatePreviewOutcome> {
+  const draftSource = await resolveDraftSource(ctx, user, input);
+  if (draftSource === null) return failed(new NotFoundError("template-resource", input.slug));
+  const {
+    content: draftContent,
+    meta: draftMeta,
+    variableSchema: draftVariableSchema,
+  } = draftSource;
+
+  const { response: validation, evaluation } = await validateTemplateDraft(ctx, user, {
+    slug: input.slug,
+    kind: input.kind,
+    contentFormat: "html",
+    content: draftContent,
+    meta: draftMeta,
+    variableSchema: draftVariableSchema,
+    locale: input.locale,
+    scope: "tenant",
+  });
+  if (!evaluation.ok) return failed(new ValidationError({ fields: [...evaluation.issues] }));
+
+  const content = evaluation.content ?? "";
+  const meta = parseTemplateMeta(input.kind, parseStoredJson(evaluation.metaJson));
+  const sampleValues = sampleValuesFor(validation.variables);
+
+  if (input.kind === "document-pdf") {
+    return renderDocumentPreview(ctx, user, {
+      input,
+      content,
+      meta,
+      variableSchema: draftVariableSchema,
+      sampleValues,
+      validation,
+    });
+  }
+
+  return renderMailPreview(ctx, user, {
+    input,
+    content,
+    meta,
+    variableSchema: draftVariableSchema,
+    sampleValues,
+    validation,
+  });
+}

package/packages/bundled-features/src/template-resolver/template-resources.ts

@@ -6,7 +6,8 @@ import type {
   WriteResult,
 } from "@cosmicdrift/kumiko-framework/engine";
 import { NotFoundError, writeFailure } from "@cosmicdrift/kumiko-framework/errors";
-import { fileRefsTable } from "@cosmicdrift/kumiko-framework/files";
+import { createFileRefFromBytes, fileRefsTable } from "@cosmicdrift/kumiko-framework/files";
+import { fileContextForTenant } from "../file-foundation/index.js";
 import { requireForTenant } from "../shared/index.js";
 import { executor } from "./handlers/shared.js";
 import type { LinkedResourceEntry } from "./linked-resources.js";
@@ -35,13 +36,52 @@ export async function readTemplateResource(
     id: fileRefId,
     isDeleted: false,
   });
-  // ctx.files only reaches the caller's own key space.
-  if (!row?.storageKey.startsWith(`${ctx.user.tenantId}/`)) return null;
-  const handle = ctx.files.ref(row.storageKey);
+  if (!row) return null;
+  const handle = ctx.files.refFromFileRef(row);
   if (!(await handle.exists())) return null;
   return { fileName: row.fileName, contentType: row.mimeType, bytes: await handle.read() };
 }
 
+// Gives the target tenant its own copy of every file behind the entries, so a template that was
+// copied from the system default keeps working once the tenant exports it or measures its
+// attachments. Rendered-PDF links carry no file and pass through. An entry whose source file is
+// gone is left out: it could not be resolved at render time either.
+export async function duplicateLinkedResourceFiles(
+  ctx: HandlerContext,
+  args: {
+    readonly user: SessionUser;
+    readonly tenantId: TenantId;
+    readonly resources: Readonly<Record<string, LinkedResourceEntry>>;
+  },
+): Promise<WriteResult<Record<string, LinkedResourceEntry>>> {
+  const { user, tenantId } = args;
+  const { db } = requireForTenant(ctx, tenantId);
+  const copies: Record<string, LinkedResourceEntry> = {};
+  for (const [key, entry] of Object.entries(args.resources)) {
+    if (typeof entry !== "string" && entry.kind === "rendered-pdf") {
+      copies[key] = entry;
+      continue;
+    }
+    const sourceFileRefId = typeof entry === "string" ? entry : entry.fileRefId;
+    const file = await readTemplateResource(ctx, sourceFileRefId);
+    // skip: the source file is gone, there is nothing to copy
+    if (file === null) continue;
+    const created = await createFileRefFromBytes(
+      {
+        db,
+        files: fileContextForTenant(ctx, ctx.user.tenantId, tenantId),
+        registry: ctx.registry,
+        user: { ...user, tenantId },
+      },
+      { fileName: file.fileName, mimeType: file.contentType, data: file.bytes },
+    );
+    if (!created.isSuccess) return created;
+    copies[key] =
+      typeof entry === "string" ? created.data.id : { ...entry, fileRefId: created.data.id };
+  }
+  return { isSuccess: true, data: copies };
+}
+
 // Replaces the whole key map of one row with files that are already stored (bundle import,
 // copy-locale). Single keys go through storeTemplateResource and resource-remove.
 export async function attachTemplateResources(