@cosmicdrift/kumiko-bundled-features 0.125.2 → 0.127.0

package/src/billing-foundation/handlers/create-portal-session.write.ts

@@ -10,10 +10,15 @@
 // kennt.
 
 import { selectMany } from "@cosmicdrift/kumiko-framework/bun-db";
+import {
+  configuredPiiSubjectKms,
+  decryptPiiFieldValues,
+} from "@cosmicdrift/kumiko-framework/crypto";
 import type { WriteHandlerDef } from "@cosmicdrift/kumiko-framework/engine";
 import { z } from "zod";
 import { subscriptionAggregateId } from "../aggregate-id";
 import { SUBSCRIPTION_PROVIDER_EXTENSION } from "../constants";
+import { SUBSCRIPTION_PII_FIELDS } from "../entities";
 import { subscriptionsProjectionTable as subTable } from "../projection";
 import type { SubscriptionProviderPlugin } from "../types";
 
@@ -41,8 +46,19 @@ export const createPortalSessionHandler: WriteHandlerDef = {
         "subscription-foundation: no active subscription for this tenant. Create one via create-checkout-session first.",
       );
     }
+    const piiKms = configuredPiiSubjectKms();
+    const decrypted = piiKms
+      ? await decryptPiiFieldValues(
+          row as Record<string, unknown>,
+          SUBSCRIPTION_PII_FIELDS,
+          piiKms,
+          {
+            requestId: `billing-foundation:create-portal-session:${tenantId}`,
+          },
+        )
+      : (row as Record<string, unknown>);
     const providerName = row["providerName"] as string; // @cast-boundary db-row
-    const providerCustomerId = row["providerCustomerId"] as string; // @cast-boundary db-row
+    const providerCustomerId = decrypted["providerCustomerId"] as string; // @cast-boundary db-row
 
     // 2. Plugin-Lookup
     const usages = ctx.registry.getExtensionUsages(SUBSCRIPTION_PROVIDER_EXTENSION);

package/src/billing-foundation/handlers/list-subscriptions.query.ts

@@ -4,8 +4,13 @@
 // tenant-scoped, gibt automatisch nur die row des Callers zurück).
 
 import { selectMany } from "@cosmicdrift/kumiko-framework/bun-db";
+import {
+  configuredPiiSubjectKms,
+  decryptPiiFieldValues,
+} from "@cosmicdrift/kumiko-framework/crypto";
 import type { QueryHandlerDef } from "@cosmicdrift/kumiko-framework/engine";
 import { z } from "zod";
+import { SUBSCRIPTION_PII_FIELDS } from "../entities";
 import { subscriptionsProjectionTable } from "../projection";
 
 const listSchema = z.object({}).strict();
@@ -18,6 +23,15 @@ export const listSubscriptionsQuery: QueryHandlerDef = {
     const rows = await selectMany(ctx.db.raw, subscriptionsProjectionTable, {
       tenantId: ctx.user.tenantId,
     });
-    return { rows };
+    const piiKms = configuredPiiSubjectKms();
+    if (!piiKms) return { rows };
+    const decryptedRows = await Promise.all(
+      rows.map((row) =>
+        decryptPiiFieldValues(row as Record<string, unknown>, SUBSCRIPTION_PII_FIELDS, piiKms, {
+          requestId: `billing-foundation:list-subscriptions:${ctx.user.tenantId}`,
+        }),
+      ),
+    );
+    return { rows: decryptedRows };
   },
 };

package/src/billing-foundation/handlers/process-event.write.ts

@@ -12,10 +12,15 @@
 //   3. ctx.unsafeAppendEvent — Inline-projection materialisiert die
 //      `read_subscriptions`-row in derselben TX.
 
+import {
+  configuredPiiSubjectKms,
+  encryptPiiFieldValues,
+} from "@cosmicdrift/kumiko-framework/crypto";
 import type { WriteHandlerDef } from "@cosmicdrift/kumiko-framework/engine";
 import { z } from "zod";
 import { subscriptionAggregateId } from "../aggregate-id";
 import { SubscriptionEventTypes, SubscriptionStatuses } from "../constants";
+import { SUBSCRIPTION_PII_FIELDS, subscriptionEntity } from "../entities";
 import {
   INVOICE_PAID_EVENT_QN,
   INVOICE_PAYMENT_FAILED_EVENT_QN,
@@ -125,13 +130,44 @@ export const processEventHandler: WriteHandlerDef = {
     }
 
     // ---------------------------------------------------------------
-    // 3. Append event auf den subscription-stream. Inline-projection
+    // 3. Encrypt the two provider-subject PII fields before they touch
+    //    storage — this is the ONLY write path onto the subscription
+    //    stream, so encrypting here covers both the event-log payload AND
+    //    (via projection.ts copying the event fields as-is) the
+    //    read_subscriptions row with a single call. The subject is the
+    //    TENANT (tenantOwned) — tenant-destroy's subject-keys stage
+    //    (eraseSubjectKeys) erases exactly this key, so both copies become
+    //    genuinely unreadable (#800) once that stage runs, not just
+    //    "encrypted at rest". No adapter configured = engine off (fields
+    //    stay plaintext, pre-#724-phase-C behavior) — mirrors how the
+    //    event-store-executor treats an absent piiKms().
+    // ---------------------------------------------------------------
+    const piiKms = configuredPiiSubjectKms();
+    const encryptedFields = piiKms
+      ? await encryptPiiFieldValues(
+          {
+            tenantId,
+            providerCustomerId: payload.providerCustomerId,
+            providerSubscriptionId: payload.providerSubscriptionId,
+          },
+          subscriptionEntity,
+          SUBSCRIPTION_PII_FIELDS,
+          piiKms,
+          { requestId: `billing-foundation:process-event:${payload.providerEventId}`, tenantId },
+        )
+      : {
+          providerCustomerId: payload.providerCustomerId,
+          providerSubscriptionId: payload.providerSubscriptionId,
+        };
+
+    // ---------------------------------------------------------------
+    // 4. Append event auf den subscription-stream. Inline-projection
     //    materialisiert die read_subscriptions-row in derselben TX.
     // ---------------------------------------------------------------
     const eventPayload: SubscriptionEventPayload = {
       providerName: payload.providerName,
-      providerCustomerId: payload.providerCustomerId,
-      providerSubscriptionId: payload.providerSubscriptionId,
+      providerCustomerId: encryptedFields["providerCustomerId"] as string,
+      providerSubscriptionId: encryptedFields["providerSubscriptionId"] as string,
       status: payload.status,
       tier: payload.tier,
       currentPeriodEndIso: payload.currentPeriodEndIso,

package/src/billing-foundation/tenant-destroy-hook.ts

@@ -0,0 +1,47 @@
+import { deleteMany, type EntityTableMeta, updateMany } from "@cosmicdrift/kumiko-framework/db";
+import type { TenantId } from "@cosmicdrift/kumiko-framework/engine";
+import { archiveStream } from "@cosmicdrift/kumiko-framework/event-store";
+import { resolveProfileForTenant } from "../compliance-profiles";
+import { subscriptionAggregateId } from "./aggregate-id";
+import { SUBSCRIPTION_AGGREGATE_TYPE } from "./events";
+import { subscriptionsProjectionTable } from "./projection";
+
+// No field-level encryption is wired up for `read_subscriptions` (see
+// entities.ts) — a crypto-shredding retention strategy would need that built
+// first (envelope-encrypt on write, decrypt on every read call site, backfill
+// existing rows). Redaction achieves the same GDPR outcome without it: HGB
+// needs the accounting facts (status/tier/period), not the Stripe/Mollie
+// subject identifiers.
+const REDACTED_PII_VALUE = "[erased]";
+
+/** Tenant-destroy hook for billing PII (#800). HGB retains the accounting
+ *  row but redacts the two provider-subject PII fields; other profiles
+ *  hard-delete the row. Either way the subscription stream is archived so a
+ *  future projection rebuild can't resurrect what was erased. */
+export async function subscriptionTenantDestroyHook(ctx: {
+  readonly db: import("@cosmicdrift/kumiko-framework/db").DbRunner;
+  readonly tenantId: TenantId;
+}): Promise<void> {
+  const { profile } = await resolveProfileForTenant({
+    db: ctx.db,
+    tenantId: ctx.tenantId,
+  });
+  const aggregateId = subscriptionAggregateId(ctx.tenantId);
+  if (profile.key === "de-hr-dsgvo-hgb") {
+    await updateMany(
+      ctx.db,
+      subscriptionsProjectionTable as EntityTableMeta,
+      { providerCustomerId: REDACTED_PII_VALUE, providerSubscriptionId: REDACTED_PII_VALUE },
+      { id: aggregateId },
+    );
+  } else {
+    await deleteMany(ctx.db, subscriptionsProjectionTable as EntityTableMeta, { id: aggregateId });
+  }
+  await archiveStream(ctx.db, {
+    tenantId: ctx.tenantId,
+    aggregateId,
+    aggregateType: SUBSCRIPTION_AGGREGATE_TYPE,
+    archivedBy: "tenant-lifecycle:destroy",
+    reason: "tenant_destroy",
+  });
+}

package/src/cap-counter/entity.ts

@@ -40,7 +40,7 @@ import {
 export const capCounterEntity = createEntity({
   table: "read_cap_counters",
   fields: {
-    capName: createTextField({ required: true, maxLength: 100 }),
+    capName: createTextField({ required: true, maxLength: 100, sortable: true, searchable: true }),
     value: createNumberField({ required: true, default: 0 }),
     periodStart: createTimestampField({ required: true }),
     lastSoftWarnedAt: createTimestampField(),

package/src/cap-counter/feature.ts

@@ -60,6 +60,7 @@ import {
   rollingIncrementedSchema,
 } from "./handlers/increment-rolling.write";
 import { markSoftWarnedHandler } from "./handlers/mark-soft-warned.write";
+import { CAP_COUNTER_I18N } from "./i18n";
 
 const sysadminAccess = { access: { roles: ["SystemAdmin"] } } as const;
 
@@ -101,13 +102,20 @@ export const capCounterFeature = defineFeature(CAP_COUNTER_FEATURE, (r) => {
     type: "entityList",
     entity: "cap-counter",
     columns: ["capName", "value", "periodStart", "lastSoftWarnedAt"],
-    searchable: false,
+    defaultSort: { field: "capName", dir: "asc" },
+    searchable: true,
     access: { roles: ["SystemAdmin"] },
   });
   r.nav({
     id: "cap-list",
-    label: "Caps",
+    label: "cap-counter:nav.cap-list",
     screen: "cap-counter:screen:cap-list",
     order: 60,
   });
+  r.translations({
+    keys: {
+      ...CAP_COUNTER_I18N,
+      "cap-counter:nav.cap-list": { de: "Limits", en: "Caps" },
+    },
+  });
 });

package/src/cap-counter/i18n.ts

@@ -0,0 +1,12 @@
+type LocalizedString = { readonly de: string; readonly en: string };
+
+export const CAP_COUNTER_I18N: Readonly<Record<string, LocalizedString>> = {
+  "screen:cap-list.title": { de: "Nutzungslimits", en: "Usage caps" },
+  "cap-counter:entity:cap-counter:field:capName": { de: "Limit", en: "Cap" },
+  "cap-counter:entity:cap-counter:field:value": { de: "Wert", en: "Value" },
+  "cap-counter:entity:cap-counter:field:periodStart": { de: "Periodenstart", en: "Period start" },
+  "cap-counter:entity:cap-counter:field:lastSoftWarnedAt": {
+    de: "Letzte Soft-Warnung",
+    en: "Last soft warning",
+  },
+};

package/src/compliance-profiles/feature.ts

@@ -9,6 +9,7 @@ import { listProfilesQuery } from "./handlers/list-profiles.query";
 import { needsProfileQuery } from "./handlers/needs-profile.query";
 import { setProfileWrite } from "./handlers/set-profile.write";
 import { subProcessorsQuery } from "./handlers/sub-processors.query";
+import { COMPLIANCE_PROFILES_I18N } from "./i18n";
 import { tenantComplianceProfileEntity } from "./schema/profile-selection";
 
 export {
@@ -72,6 +73,8 @@ export function createComplianceProfilesFeature(): FeatureDefinition {
       order: 50,
     });
 
+    r.translations({ keys: COMPLIANCE_PROFILES_I18N });
+
     return { handlers, queries };
   });
 }

package/src/compliance-profiles/i18n.ts

@@ -0,0 +1,6 @@
+type LocalizedString = { readonly de: string; readonly en: string };
+
+export const COMPLIANCE_PROFILES_I18N: Readonly<Record<string, LocalizedString>> = {
+  "screen:profile-picker.title": { de: "Compliance-Profil", en: "Compliance profile" },
+  "compliance-profiles:nav.profilePicker": { de: "Compliance", en: "Compliance" },
+};

package/src/config/feature.ts

@@ -21,6 +21,7 @@ import { resetWrite } from "./handlers/reset.write";
 import { schemaQuery } from "./handlers/schema.query";
 import { setWrite } from "./handlers/set.write";
 import { valuesQuery } from "./handlers/values.query";
+import { CONFIG_FEATURE_I18N } from "./i18n";
 import type { ConfigResolver } from "./resolver";
 import { configValueEntity } from "./table";
 
@@ -63,6 +64,8 @@ export function createConfigFeature(): FeatureDefinition {
     // legacy CONFIG_ENCRYPTION_KEY.
     r.job("reencrypt", { trigger: { manual: true } }, reencryptJob);
 
+    r.translations({ keys: CONFIG_FEATURE_I18N });
+
     return { handlers, queries };
   });
 }

package/src/config/i18n.ts

@@ -0,0 +1,9 @@
+type LocalizedString = { readonly de: string; readonly en: string };
+
+/** Server boot keys for the auto-generated Settings-Hub (mirrors web/i18n.ts). */
+export const CONFIG_FEATURE_I18N: Readonly<Record<string, LocalizedString>> = {
+  "config.settings.title": { de: "Einstellungen", en: "Settings" },
+  "config.settings.system": { de: "Plattform", en: "Platform" },
+  "config.settings.tenant": { de: "Organisation", en: "Organization" },
+  "config.settings.user": { de: "Persönlich", en: "Personal" },
+};

package/src/delivery/feature.ts

@@ -10,6 +10,7 @@ import { deliveryAttemptSchema } from "./events";
 import { logQuery } from "./handlers/log.query";
 import { preferencesQuery } from "./handlers/preferences.query";
 import { setPreferenceWrite } from "./handlers/set-preference.write";
+import { DELIVERY_I18N } from "./i18n";
 import { deliveryRenderJob, deliverySendJob } from "./jobs";
 import {
   deliveryAttemptsTable,
@@ -134,6 +135,8 @@ export function createDeliveryFeature(): FeatureDefinition {
       order: 40,
     });
 
+    r.translations({ keys: DELIVERY_I18N });
+
     return { handlers, queries };
   });
 }

package/src/delivery/i18n.ts

@@ -0,0 +1,6 @@
+type LocalizedString = { readonly de: string; readonly en: string };
+
+export const DELIVERY_I18N: Readonly<Record<string, LocalizedString>> = {
+  "screen:delivery-log.title": { de: "Delivery-Log", en: "Delivery log" },
+  "delivery:nav.deliveryLog": { de: "Zustellungen", en: "Delivery" },
+};

package/src/feature-toggles/feature.ts

@@ -4,6 +4,7 @@ import { featureToggleSetSchema } from "./events";
 import { listQuery } from "./handlers/list.query";
 import { registeredQuery } from "./handlers/registered.query";
 import { createSetWriteHandler } from "./handlers/set.write";
+import { FEATURE_TOGGLES_I18N } from "./i18n";
 import type { GlobalFeatureToggleRuntime } from "./toggle-runtime";
 
 // IMPORTANT: feature-toggles itself is NOT r.toggleable. Making it
@@ -75,6 +76,8 @@ export function createFeatureTogglesFeature(
       order: 20,
     });
 
+    r.translations({ keys: FEATURE_TOGGLES_I18N });
+
     // toggle-cache-sync — multi-instance snapshot propagation. Every
     // API/worker instance runs its own dispatcher cursor on this MSP
     // (delivery: "per-instance") and converges its in-memory snapshot on

package/src/feature-toggles/i18n.ts

@@ -0,0 +1,6 @@
+type LocalizedString = { readonly de: string; readonly en: string };
+
+export const FEATURE_TOGGLES_I18N: Readonly<Record<string, LocalizedString>> = {
+  "screen:toggle-admin.title": { de: "Feature-Toggles", en: "Feature toggles" },
+  "feature-toggles:nav.toggleAdmin": { de: "Feature-Toggles", en: "Feature toggles" },
+};

package/src/jobs/i18n.ts

@@ -13,6 +13,10 @@ export const JOBS_I18N: Readonly<Record<string, LocalizedString>> = {
   "jobs.runs.open": { de: "Details", en: "Details" },
   "jobs.runs.filter.status": { de: "Status", en: "Status" },
   "jobs.runs.filter.all": { de: "Alle", en: "All" },
+  "jobs.runs.filter.completed": { de: "Abgeschlossen", en: "Completed" },
+  "jobs.runs.filter.failed": { de: "Fehlgeschlagen", en: "Failed" },
+  "jobs.runs.filter.running": { de: "Läuft", en: "Running" },
+  "jobs.runs.filter.queued": { de: "Wartend", en: "Queued" },
   "jobs.runs.col.job": { de: "Job", en: "Job" },
   "jobs.runs.col.status": { de: "Status", en: "Status" },
   "jobs.runs.col.started": { de: "Gestartet", en: "Started" },

package/src/jobs/web/job-runs-screen.tsx

@@ -24,11 +24,11 @@ type State =
   | { readonly kind: "ready"; readonly rows: readonly JobRunRow[] };
 
 const STATUS_FILTER_OPTIONS = [
-  { value: "", label: "all" },
-  { value: "completed", label: "completed" },
-  { value: "failed", label: "failed" },
-  { value: "running", label: "running" },
-  { value: "queued", label: "queued" },
+  { value: "", labelKey: "jobs.runs.filter.all" },
+  { value: "completed", labelKey: "jobs.runs.filter.completed" },
+  { value: "failed", labelKey: "jobs.runs.filter.failed" },
+  { value: "running", labelKey: "jobs.runs.filter.running" },
+  { value: "queued", labelKey: "jobs.runs.filter.queued" },
 ] as const;
 
 export function JobRunsScreen(): ReactNode {
@@ -41,7 +41,7 @@ export function JobRunsScreen(): ReactNode {
 
   const filterOptions = STATUS_FILTER_OPTIONS.map((opt) => ({
     value: opt.value,
-    label: opt.value === "" ? t("jobs.runs.filter.all") : opt.label,
+    label: t(opt.labelKey),
   }));
 
   const refresh = useCallback(async (): Promise<void> => {
@@ -98,13 +98,13 @@ export function JobRunsScreen(): ReactNode {
         <DataTable
           testId="job-runs-table"
           columns={[
-            { field: "job", label: t("jobs.runs.col.job"), type: "string", sortable: false },
-            { field: "status", label: t("jobs.runs.col.status"), type: "string", sortable: false },
+            { field: "job", label: t("jobs.runs.col.job"), type: "string", sortable: true },
+            { field: "status", label: t("jobs.runs.col.status"), type: "string", sortable: true },
             {
               field: "started",
               label: t("jobs.runs.col.started"),
               type: "string",
-              sortable: false,
+              sortable: true,
             },
             {
               field: "duration",

package/src/managed-pages/i18n.ts

@@ -24,6 +24,11 @@ export const MANAGED_PAGES_I18N: Readonly<Record<string, LocalizedString>> = {
   "managed-pages:entity:page:field:lang": { de: "Sprache", en: "Language" },
   "managed-pages:entity:page:field:title": { de: "Titel", en: "Title" },
   "managed-pages:entity:page:field:published": { de: "Veröffentlicht", en: "Published" },
+  "managed-pages:entity:page:field:published:option:true": {
+    de: "Veröffentlicht",
+    en: "Published",
+  },
+  "managed-pages:entity:page:field:published:option:false": { de: "Entwurf", en: "Draft" },
   "managed-pages:entity:page:field:description": { de: "Beschreibung", en: "Description" },
   "managed-pages:entity:page:field:ogImage": { de: "OG-Bild", en: "OG image" },
   "managed-pages:entity:page:field:body": { de: "Inhalt", en: "Content" },

package/src/managed-pages/screens/page-screens.ts

@@ -24,7 +24,11 @@ export const pageListScreen: EntityListScreenDefinition = {
     "title",
     {
       field: "published",
-      renderer: { format: "boolean", trueLabel: "Published", falseLabel: "Draft" },
+      renderer: {
+        format: "boolean",
+        trueLabel: "managed-pages:entity:page:field:published:option:true",
+        falseLabel: "managed-pages:entity:page:field:published:option:false",
+      },
     },
   ],
   defaultSort: { field: "slug", dir: "asc" },

package/src/personal-access-tokens/feature.ts

@@ -5,6 +5,7 @@ import { buildAvailableScopesQuery } from "./handlers/available-scopes.query";
 import { createPatWrite } from "./handlers/create.write";
 import { listPatQuery } from "./handlers/list.query";
 import { revokePatWrite } from "./handlers/revoke.write";
+import { PAT_FEATURE_I18N } from "./i18n";
 import { apiTokenEntity } from "./schema/api-token";
 import type { PatScopeConfig } from "./scopes";
 
@@ -75,6 +76,7 @@ export function createPersonalAccessTokensFeature(
       renderer: { react: { __component: "PatTokensScreen" } },
       access: { openToAll: true },
     });
+    r.translations({ keys: PAT_FEATURE_I18N });
 
     // scopes + rateLimit flow into feature.exports so run-prod-app builds the
     // resolver + limiter from the same declaration — single source of truth.

package/src/personal-access-tokens/i18n.ts

@@ -0,0 +1,5 @@
+type LocalizedString = { readonly de: string; readonly en: string };
+
+export const PAT_FEATURE_I18N: Readonly<Record<string, LocalizedString>> = {
+  "screen:api-tokens.title": { de: "Personal Access Tokens", en: "Personal Access Tokens" },
+};

package/src/personal-access-tokens/web/pat-tokens-screen.tsx

@@ -41,7 +41,11 @@ function isoDate(value: string | null): string | null {
   return typeof value === "string" && value.length >= 10 ? value.slice(0, 10) : null;
 }
 
-export function PatTokensScreen(): ReactNode {
+export function PatTokensScreen({
+  embedded = false,
+}: {
+  readonly embedded?: boolean;
+} = {}): ReactNode {
   const t = useTranslation();
   const { Form, Field, Input, Button, Banner, Card, Heading } = usePrimitives();
   const dispatcher = useDispatcher();
@@ -130,7 +134,7 @@ export function PatTokensScreen(): ReactNode {
   };
 
   return (
-    <div className="flex max-w-3xl flex-col gap-6 p-6">
+    <div className={embedded ? "flex flex-col gap-6" : "flex max-w-3xl flex-col gap-6 p-6"}>
       <Heading>{t("pat.title")}</Heading>
 
       {minted && (
@@ -232,7 +236,7 @@ export function PatTokensScreen(): ReactNode {
               <div className="flex items-center justify-between gap-3">
                 <div className="flex min-w-0 flex-col gap-0.5">
                   <span className="truncate text-sm font-semibold">{row.name}</span>
-                  <span className="truncate text-xs text-muted-foreground">
+                  <span className="whitespace-normal text-xs text-muted-foreground">
                     {revoked ? t("pat.list.revoked") : meta(row)}
                   </span>
                 </div>

package/src/subscription-mollie/__tests__/mollie-foundation.integration.test.ts

@@ -39,6 +39,10 @@ import type {
   Subscription as MollieSubscription,
 } from "@mollie/api-client";
 import { Hono } from "hono";
+import { createComplianceProfilesFeature } from "../../compliance-profiles";
+import { createConfigFeature } from "../../config";
+import { createTenantFeature } from "../../tenant/feature";
+import { createTenantLifecycleFeature } from "../../tenant-lifecycle";
 import { createSubscriptionMollieFeature } from "../feature";
 import type { MollieClientShape } from "../verify-webhook";
 
@@ -133,7 +137,14 @@ beforeAll(async () => {
   });
 
   stack = await setupTestStack({
-    features: [billingFoundationFeature, mollieFeature],
+    features: [
+      createConfigFeature(),
+      createTenantFeature(),
+      createComplianceProfilesFeature(),
+      createTenantLifecycleFeature(),
+      billingFoundationFeature,
+      mollieFeature,
+    ],
   });
   db = stack.db;
   // subscriptionsProjectionTable wird von setupTestStack automatisch

package/src/subscription-stripe/__tests__/stripe-foundation.integration.test.ts

@@ -34,6 +34,7 @@ import {
 import { createTestEnvelopeCipher } from "@cosmicdrift/kumiko-framework/testing";
 import { Hono } from "hono";
 import Stripe from "stripe";
+import { createComplianceProfilesFeature } from "../../compliance-profiles";
 import { configValuesTable, createConfigFeature } from "../../config";
 import { createConfigAccessorFactory } from "../../config/feature";
 import { createConfigResolver } from "../../config/resolver";
@@ -43,6 +44,8 @@ import {
   type SecretsContext,
   tenantSecretsTable,
 } from "../../secrets";
+import { createTenantFeature } from "../../tenant/feature";
+import { createTenantLifecycleFeature } from "../../tenant-lifecycle";
 import { createSubscriptionStripeFeature } from "../feature";
 
 // Qualified-names der runtime-keys (drift-pin: müssen 1:1 dem entsprechen,
@@ -93,6 +96,9 @@ beforeAll(async () => {
     features: [
       createConfigFeature(),
       createSecretsFeature(),
+      createTenantFeature(),
+      createComplianceProfilesFeature(),
+      createTenantLifecycleFeature(),
       billingFoundationFeature,
       stripeFeature,
     ],
@@ -483,6 +489,9 @@ describe("scenario 6: billing-live gate end-to-end (#104)", () => {
       features: [
         createConfigFeature(),
         createSecretsFeature(),
+        createTenantFeature(),
+        createComplianceProfilesFeature(),
+        createTenantLifecycleFeature(),
         billingFoundationFeature,
         stripeFeature,
       ],

package/src/subscription-stripe/feature.ts

@@ -172,6 +172,8 @@ export function createSubscriptionStripeFeature(
           de: "Stripe Billing live",
           en: "Stripe Billing Live",
         },
+        "subscription-stripe.settings": { de: "Stripe", en: "Stripe" },
+        "screen:subscription-stripe-system.title": { de: "Stripe", en: "Stripe" },
       },
     });
 

package/src/tags/feature.ts

@@ -29,6 +29,7 @@ import { createCreateTagHandler } from "./handlers/create-tag.write";
 import { createDeleteTagHandler } from "./handlers/delete-tag.write";
 import { createRemoveTagHandler } from "./handlers/remove-tag.write";
 import { createUpdateTagHandler } from "./handlers/update-tag.write";
+import { TAGS_FEATURE_I18N } from "./i18n";
 
 // Opt-in tier-gating: when set, the feature declares itself r.toggleable so the
 // dispatcher gate + feature-toggles + tier-engine can switch the WHOLE feature
@@ -76,6 +77,7 @@ function registerTags(
     renderer: { react: { __component: "TagsScreen" } },
     access,
   });
+  r.translations({ keys: TAGS_FEATURE_I18N });
 }
 
 export const tagsFeature = defineFeature(TAGS_FEATURE_NAME, (r) =>

package/src/tags/i18n.ts

@@ -0,0 +1,5 @@
+type LocalizedString = { readonly de: string; readonly en: string };
+
+export const TAGS_FEATURE_I18N: Readonly<Record<string, LocalizedString>> = {
+  "screen:tag-list.title": { de: "Tags", en: "Tags" },
+};

package/src/tenant/__tests__/members-screens.boot.test.ts

@@ -5,6 +5,7 @@ import { AuthHandlers } from "../../auth-email-password/constants";
 import { createConfigFeature } from "../../config/feature";
 import { MEMBERS_SCREEN_ID, TenantHandlers, TenantQueries } from "../constants";
 import { createTenantFeature } from "../feature";
+import { defaultTranslations } from "../web/i18n";
 
 describe("tenant members screen + handler access alignment", () => {
   const features = [createConfigFeature(), createTenantFeature()];
@@ -34,6 +35,12 @@ describe("tenant members screen + handler access alignment", () => {
     void TenantQueries;
   });
 
+  test("members nav label uses tenantClient i18n key (not feature:nav.* alias)", () => {
+    const nav = createTenantFeature().navs["members"];
+    expect(nav?.label).toBe("tenant.nav.members");
+    expect(defaultTranslations["de"]?.["tenant.nav.members"]).toBe("Team");
+  });
+
   test("updateMemberRoles stays SystemAdmin/system-only (not on members screen)", () => {
     const tenant = createTenantFeature();
     expect(rolesOf(tenant.writeHandlers["updateMemberRoles"]?.access)).toEqual([

package/src/tenant/__tests__/tenant-security.integration.test.ts

@@ -197,12 +197,12 @@ describe("TenantAdmin can use members-admin HTTP surface", () => {
       { email: "pending@example.com", role: "Editor" },
       tenantAdminA(),
     );
-    const members = await stack.http.queryOk<readonly { userId: string }[]>(
-      TenantQueries.members,
-      {},
-      tenantAdminA(),
-    );
+    const members = await stack.http.queryOk<
+      readonly { userId: string; email: string | null; displayName: string | null }[]
+    >(TenantQueries.members, {}, tenantAdminA());
     expect(members.some((m) => m.userId === tenantAdminAId)).toBe(true);
+    const self = members.find((m) => m.userId === tenantAdminAId);
+    expect(self?.email).toBe("admin-a@example.com");
     const invitations = await stack.http.queryOk<readonly { email: string }[]>(
       TenantQueries.invitations,
       {},
@@ -211,6 +211,21 @@ describe("TenantAdmin can use members-admin HTTP surface", () => {
     expect(invitations).toHaveLength(1);
     expect(invitations[0]?.email).toBe("pending@example.com");
   });
+
+  test("members email is null when user row is missing", async () => {
+    const orphanUserId = "00000000-0000-4000-8000-00000000dead";
+    await seedTenantMembership(stack.db, {
+      userId: orphanUserId,
+      tenantId: TENANT_A_ID,
+      roles: ["User"],
+    });
+    const members = await stack.http.queryOk<readonly { userId: string; email: string | null }[]>(
+      TenantQueries.members,
+      {},
+      tenantAdminA(),
+    );
+    expect(members.find((m) => m.userId === orphanUserId)?.email).toBeNull();
+  });
 });
 
 describe("regular User is denied members-admin surface", () => {