@cosmicdrift/kumiko-bundled-features 0.126.0 → 0.128.0

package/src/billing-foundation/handlers/list-subscriptions.query.ts

@@ -4,8 +4,13 @@
 // tenant-scoped, gibt automatisch nur die row des Callers zurück).
 
 import { selectMany } from "@cosmicdrift/kumiko-framework/bun-db";
+import {
+  configuredPiiSubjectKms,
+  decryptPiiFieldValues,
+} from "@cosmicdrift/kumiko-framework/crypto";
 import type { QueryHandlerDef } from "@cosmicdrift/kumiko-framework/engine";
 import { z } from "zod";
+import { SUBSCRIPTION_PII_FIELDS } from "../entities";
 import { subscriptionsProjectionTable } from "../projection";
 
 const listSchema = z.object({}).strict();
@@ -18,6 +23,15 @@ export const listSubscriptionsQuery: QueryHandlerDef = {
     const rows = await selectMany(ctx.db.raw, subscriptionsProjectionTable, {
       tenantId: ctx.user.tenantId,
     });
-    return { rows };
+    const piiKms = configuredPiiSubjectKms();
+    if (!piiKms) return { rows };
+    const decryptedRows = await Promise.all(
+      rows.map((row) =>
+        decryptPiiFieldValues(row as Record<string, unknown>, SUBSCRIPTION_PII_FIELDS, piiKms, {
+          requestId: `billing-foundation:list-subscriptions:${ctx.user.tenantId}`,
+        }),
+      ),
+    );
+    return { rows: decryptedRows };
   },
 };

package/src/billing-foundation/handlers/process-event.write.ts

@@ -12,10 +12,15 @@
 //   3. ctx.unsafeAppendEvent — Inline-projection materialisiert die
 //      `read_subscriptions`-row in derselben TX.
 
+import {
+  configuredPiiSubjectKms,
+  encryptPiiFieldValues,
+} from "@cosmicdrift/kumiko-framework/crypto";
 import type { WriteHandlerDef } from "@cosmicdrift/kumiko-framework/engine";
 import { z } from "zod";
 import { subscriptionAggregateId } from "../aggregate-id";
 import { SubscriptionEventTypes, SubscriptionStatuses } from "../constants";
+import { SUBSCRIPTION_PII_FIELDS, subscriptionEntity } from "../entities";
 import {
   INVOICE_PAID_EVENT_QN,
   INVOICE_PAYMENT_FAILED_EVENT_QN,
@@ -125,13 +130,44 @@ export const processEventHandler: WriteHandlerDef = {
     }
 
     // ---------------------------------------------------------------
-    // 3. Append event auf den subscription-stream. Inline-projection
+    // 3. Encrypt the two provider-subject PII fields before they touch
+    //    storage — this is the ONLY write path onto the subscription
+    //    stream, so encrypting here covers both the event-log payload AND
+    //    (via projection.ts copying the event fields as-is) the
+    //    read_subscriptions row with a single call. The subject is the
+    //    TENANT (tenantOwned) — tenant-destroy's subject-keys stage
+    //    (eraseSubjectKeys) erases exactly this key, so both copies become
+    //    genuinely unreadable (#800) once that stage runs, not just
+    //    "encrypted at rest". No adapter configured = engine off (fields
+    //    stay plaintext, pre-#724-phase-C behavior) — mirrors how the
+    //    event-store-executor treats an absent piiKms().
+    // ---------------------------------------------------------------
+    const piiKms = configuredPiiSubjectKms();
+    const encryptedFields = piiKms
+      ? await encryptPiiFieldValues(
+          {
+            tenantId,
+            providerCustomerId: payload.providerCustomerId,
+            providerSubscriptionId: payload.providerSubscriptionId,
+          },
+          subscriptionEntity,
+          SUBSCRIPTION_PII_FIELDS,
+          piiKms,
+          { requestId: `billing-foundation:process-event:${payload.providerEventId}`, tenantId },
+        )
+      : {
+          providerCustomerId: payload.providerCustomerId,
+          providerSubscriptionId: payload.providerSubscriptionId,
+        };
+
+    // ---------------------------------------------------------------
+    // 4. Append event auf den subscription-stream. Inline-projection
     //    materialisiert die read_subscriptions-row in derselben TX.
     // ---------------------------------------------------------------
     const eventPayload: SubscriptionEventPayload = {
       providerName: payload.providerName,
-      providerCustomerId: payload.providerCustomerId,
-      providerSubscriptionId: payload.providerSubscriptionId,
+      providerCustomerId: encryptedFields["providerCustomerId"] as string,
+      providerSubscriptionId: encryptedFields["providerSubscriptionId"] as string,
       status: payload.status,
       tier: payload.tier,
       currentPeriodEndIso: payload.currentPeriodEndIso,

package/src/billing-foundation/tenant-destroy-hook.ts

@@ -1,11 +1,23 @@
-import { deleteMany, type EntityTableMeta } from "@cosmicdrift/kumiko-framework/db";
+import { deleteMany, type EntityTableMeta, updateMany } from "@cosmicdrift/kumiko-framework/db";
 import type { TenantId } from "@cosmicdrift/kumiko-framework/engine";
+import { archiveStream } from "@cosmicdrift/kumiko-framework/event-store";
 import { resolveProfileForTenant } from "../compliance-profiles";
 import { subscriptionAggregateId } from "./aggregate-id";
+import { SUBSCRIPTION_AGGREGATE_TYPE } from "./events";
 import { subscriptionsProjectionTable } from "./projection";
 
-/** Tenant-destroy hook for billing PII (#800). HGB keeps ciphertext row
- *  (subject-keys stage erases tenant DEK); other profiles hard-delete. */
+// No field-level encryption is wired up for `read_subscriptions` (see
+// entities.ts) — a crypto-shredding retention strategy would need that built
+// first (envelope-encrypt on write, decrypt on every read call site, backfill
+// existing rows). Redaction achieves the same GDPR outcome without it: HGB
+// needs the accounting facts (status/tier/period), not the Stripe/Mollie
+// subject identifiers.
+const REDACTED_PII_VALUE = "[erased]";
+
+/** Tenant-destroy hook for billing PII (#800). HGB retains the accounting
+ *  row but redacts the two provider-subject PII fields; other profiles
+ *  hard-delete the row. Either way the subscription stream is archived so a
+ *  future projection rebuild can't resurrect what was erased. */
 export async function subscriptionTenantDestroyHook(ctx: {
   readonly db: import("@cosmicdrift/kumiko-framework/db").DbRunner;
   readonly tenantId: TenantId;
@@ -14,11 +26,22 @@ export async function subscriptionTenantDestroyHook(ctx: {
     db: ctx.db,
     tenantId: ctx.tenantId,
   });
+  const aggregateId = subscriptionAggregateId(ctx.tenantId);
   if (profile.key === "de-hr-dsgvo-hgb") {
-    // skip: HGB retention — row stays until crypto-shredded by subject-keys stage
-    return;
+    await updateMany(
+      ctx.db,
+      subscriptionsProjectionTable as EntityTableMeta,
+      { providerCustomerId: REDACTED_PII_VALUE, providerSubscriptionId: REDACTED_PII_VALUE },
+      { id: aggregateId },
+    );
+  } else {
+    await deleteMany(ctx.db, subscriptionsProjectionTable as EntityTableMeta, { id: aggregateId });
   }
-  await deleteMany(ctx.db, subscriptionsProjectionTable as EntityTableMeta, {
-    id: subscriptionAggregateId(ctx.tenantId),
+  await archiveStream(ctx.db, {
+    tenantId: ctx.tenantId,
+    aggregateId,
+    aggregateType: SUBSCRIPTION_AGGREGATE_TYPE,
+    archivedBy: "tenant-lifecycle:destroy",
+    reason: "tenant_destroy",
   });
 }

package/src/cap-counter/entity.ts

@@ -40,7 +40,7 @@ import {
 export const capCounterEntity = createEntity({
   table: "read_cap_counters",
   fields: {
-    capName: createTextField({ required: true, maxLength: 100 }),
+    capName: createTextField({ required: true, maxLength: 100, sortable: true, searchable: true }),
     value: createNumberField({ required: true, default: 0 }),
     periodStart: createTimestampField({ required: true }),
     lastSoftWarnedAt: createTimestampField(),

package/src/cap-counter/feature.ts

@@ -60,6 +60,7 @@ import {
   rollingIncrementedSchema,
 } from "./handlers/increment-rolling.write";
 import { markSoftWarnedHandler } from "./handlers/mark-soft-warned.write";
+import { CAP_COUNTER_I18N } from "./i18n";
 
 const sysadminAccess = { access: { roles: ["SystemAdmin"] } } as const;
 
@@ -101,13 +102,20 @@ export const capCounterFeature = defineFeature(CAP_COUNTER_FEATURE, (r) => {
     type: "entityList",
     entity: "cap-counter",
     columns: ["capName", "value", "periodStart", "lastSoftWarnedAt"],
-    searchable: false,
+    defaultSort: { field: "capName", dir: "asc" },
+    searchable: true,
     access: { roles: ["SystemAdmin"] },
   });
   r.nav({
     id: "cap-list",
-    label: "Caps",
+    label: "cap-counter:nav.cap-list",
     screen: "cap-counter:screen:cap-list",
     order: 60,
   });
+  r.translations({
+    keys: {
+      ...CAP_COUNTER_I18N,
+      "cap-counter:nav.cap-list": { de: "Limits", en: "Caps" },
+    },
+  });
 });

package/src/cap-counter/i18n.ts

@@ -0,0 +1,12 @@
+type LocalizedString = { readonly de: string; readonly en: string };
+
+export const CAP_COUNTER_I18N: Readonly<Record<string, LocalizedString>> = {
+  "screen:cap-list.title": { de: "Nutzungslimits", en: "Usage caps" },
+  "cap-counter:entity:cap-counter:field:capName": { de: "Limit", en: "Cap" },
+  "cap-counter:entity:cap-counter:field:value": { de: "Wert", en: "Value" },
+  "cap-counter:entity:cap-counter:field:periodStart": { de: "Periodenstart", en: "Period start" },
+  "cap-counter:entity:cap-counter:field:lastSoftWarnedAt": {
+    de: "Letzte Soft-Warnung",
+    en: "Last soft warning",
+  },
+};

package/src/compliance-profiles/feature.ts

@@ -9,6 +9,7 @@ import { listProfilesQuery } from "./handlers/list-profiles.query";
 import { needsProfileQuery } from "./handlers/needs-profile.query";
 import { setProfileWrite } from "./handlers/set-profile.write";
 import { subProcessorsQuery } from "./handlers/sub-processors.query";
+import { COMPLIANCE_PROFILES_I18N } from "./i18n";
 import { tenantComplianceProfileEntity } from "./schema/profile-selection";
 
 export {
@@ -72,6 +73,8 @@ export function createComplianceProfilesFeature(): FeatureDefinition {
       order: 50,
     });
 
+    r.translations({ keys: COMPLIANCE_PROFILES_I18N });
+
     return { handlers, queries };
   });
 }

package/src/compliance-profiles/i18n.ts

@@ -0,0 +1,6 @@
+type LocalizedString = { readonly de: string; readonly en: string };
+
+export const COMPLIANCE_PROFILES_I18N: Readonly<Record<string, LocalizedString>> = {
+  "screen:profile-picker.title": { de: "Compliance-Profil", en: "Compliance profile" },
+  "compliance-profiles:nav.profilePicker": { de: "Compliance", en: "Compliance" },
+};

package/src/config/feature.ts

@@ -21,6 +21,7 @@ import { resetWrite } from "./handlers/reset.write";
 import { schemaQuery } from "./handlers/schema.query";
 import { setWrite } from "./handlers/set.write";
 import { valuesQuery } from "./handlers/values.query";
+import { CONFIG_FEATURE_I18N } from "./i18n";
 import type { ConfigResolver } from "./resolver";
 import { configValueEntity } from "./table";
 
@@ -63,6 +64,8 @@ export function createConfigFeature(): FeatureDefinition {
     // legacy CONFIG_ENCRYPTION_KEY.
     r.job("reencrypt", { trigger: { manual: true } }, reencryptJob);
 
+    r.translations({ keys: CONFIG_FEATURE_I18N });
+
     return { handlers, queries };
   });
 }

package/src/config/i18n.ts

@@ -0,0 +1,9 @@
+type LocalizedString = { readonly de: string; readonly en: string };
+
+/** Server boot keys for the auto-generated Settings-Hub (mirrors web/i18n.ts). */
+export const CONFIG_FEATURE_I18N: Readonly<Record<string, LocalizedString>> = {
+  "config.settings.title": { de: "Einstellungen", en: "Settings" },
+  "config.settings.system": { de: "Plattform", en: "Platform" },
+  "config.settings.tenant": { de: "Organisation", en: "Organization" },
+  "config.settings.user": { de: "Persönlich", en: "Personal" },
+};

package/src/delivery/feature.ts

@@ -10,6 +10,7 @@ import { deliveryAttemptSchema } from "./events";
 import { logQuery } from "./handlers/log.query";
 import { preferencesQuery } from "./handlers/preferences.query";
 import { setPreferenceWrite } from "./handlers/set-preference.write";
+import { DELIVERY_I18N } from "./i18n";
 import { deliveryRenderJob, deliverySendJob } from "./jobs";
 import {
   deliveryAttemptsTable,
@@ -134,6 +135,8 @@ export function createDeliveryFeature(): FeatureDefinition {
       order: 40,
     });
 
+    r.translations({ keys: DELIVERY_I18N });
+
     return { handlers, queries };
   });
 }

package/src/delivery/i18n.ts

@@ -0,0 +1,6 @@
+type LocalizedString = { readonly de: string; readonly en: string };
+
+export const DELIVERY_I18N: Readonly<Record<string, LocalizedString>> = {
+  "screen:delivery-log.title": { de: "Delivery-Log", en: "Delivery log" },
+  "delivery:nav.deliveryLog": { de: "Zustellungen", en: "Delivery" },
+};

package/src/feature-toggles/feature.ts

@@ -4,6 +4,7 @@ import { featureToggleSetSchema } from "./events";
 import { listQuery } from "./handlers/list.query";
 import { registeredQuery } from "./handlers/registered.query";
 import { createSetWriteHandler } from "./handlers/set.write";
+import { FEATURE_TOGGLES_I18N } from "./i18n";
 import type { GlobalFeatureToggleRuntime } from "./toggle-runtime";
 
 // IMPORTANT: feature-toggles itself is NOT r.toggleable. Making it
@@ -75,6 +76,8 @@ export function createFeatureTogglesFeature(
       order: 20,
     });
 
+    r.translations({ keys: FEATURE_TOGGLES_I18N });
+
     // toggle-cache-sync — multi-instance snapshot propagation. Every
     // API/worker instance runs its own dispatcher cursor on this MSP
     // (delivery: "per-instance") and converges its in-memory snapshot on

package/src/feature-toggles/i18n.ts

@@ -0,0 +1,6 @@
+type LocalizedString = { readonly de: string; readonly en: string };
+
+export const FEATURE_TOGGLES_I18N: Readonly<Record<string, LocalizedString>> = {
+  "screen:toggle-admin.title": { de: "Feature-Toggles", en: "Feature toggles" },
+  "feature-toggles:nav.toggleAdmin": { de: "Feature-Toggles", en: "Feature toggles" },
+};

package/src/jobs/i18n.ts

@@ -13,6 +13,10 @@ export const JOBS_I18N: Readonly<Record<string, LocalizedString>> = {
   "jobs.runs.open": { de: "Details", en: "Details" },
   "jobs.runs.filter.status": { de: "Status", en: "Status" },
   "jobs.runs.filter.all": { de: "Alle", en: "All" },
+  "jobs.runs.filter.completed": { de: "Abgeschlossen", en: "Completed" },
+  "jobs.runs.filter.failed": { de: "Fehlgeschlagen", en: "Failed" },
+  "jobs.runs.filter.running": { de: "Läuft", en: "Running" },
+  "jobs.runs.filter.queued": { de: "Wartend", en: "Queued" },
   "jobs.runs.col.job": { de: "Job", en: "Job" },
   "jobs.runs.col.status": { de: "Status", en: "Status" },
   "jobs.runs.col.started": { de: "Gestartet", en: "Started" },

package/src/jobs/web/job-runs-screen.tsx

@@ -24,11 +24,11 @@ type State =
   | { readonly kind: "ready"; readonly rows: readonly JobRunRow[] };
 
 const STATUS_FILTER_OPTIONS = [
-  { value: "", label: "all" },
-  { value: "completed", label: "completed" },
-  { value: "failed", label: "failed" },
-  { value: "running", label: "running" },
-  { value: "queued", label: "queued" },
+  { value: "", labelKey: "jobs.runs.filter.all" },
+  { value: "completed", labelKey: "jobs.runs.filter.completed" },
+  { value: "failed", labelKey: "jobs.runs.filter.failed" },
+  { value: "running", labelKey: "jobs.runs.filter.running" },
+  { value: "queued", labelKey: "jobs.runs.filter.queued" },
 ] as const;
 
 export function JobRunsScreen(): ReactNode {
@@ -41,7 +41,7 @@ export function JobRunsScreen(): ReactNode {
 
   const filterOptions = STATUS_FILTER_OPTIONS.map((opt) => ({
     value: opt.value,
-    label: opt.value === "" ? t("jobs.runs.filter.all") : opt.label,
+    label: t(opt.labelKey),
   }));
 
   const refresh = useCallback(async (): Promise<void> => {
@@ -98,13 +98,13 @@ export function JobRunsScreen(): ReactNode {
         <DataTable
           testId="job-runs-table"
           columns={[
-            { field: "job", label: t("jobs.runs.col.job"), type: "string", sortable: false },
-            { field: "status", label: t("jobs.runs.col.status"), type: "string", sortable: false },
+            { field: "job", label: t("jobs.runs.col.job"), type: "string", sortable: true },
+            { field: "status", label: t("jobs.runs.col.status"), type: "string", sortable: true },
             {
               field: "started",
               label: t("jobs.runs.col.started"),
               type: "string",
-              sortable: false,
+              sortable: true,
             },
             {
               field: "duration",

package/src/managed-pages/i18n.ts

@@ -24,6 +24,11 @@ export const MANAGED_PAGES_I18N: Readonly<Record<string, LocalizedString>> = {
   "managed-pages:entity:page:field:lang": { de: "Sprache", en: "Language" },
   "managed-pages:entity:page:field:title": { de: "Titel", en: "Title" },
   "managed-pages:entity:page:field:published": { de: "Veröffentlicht", en: "Published" },
+  "managed-pages:entity:page:field:published:option:true": {
+    de: "Veröffentlicht",
+    en: "Published",
+  },
+  "managed-pages:entity:page:field:published:option:false": { de: "Entwurf", en: "Draft" },
   "managed-pages:entity:page:field:description": { de: "Beschreibung", en: "Description" },
   "managed-pages:entity:page:field:ogImage": { de: "OG-Bild", en: "OG image" },
   "managed-pages:entity:page:field:body": { de: "Inhalt", en: "Content" },

package/src/managed-pages/screens/page-screens.ts

@@ -24,7 +24,11 @@ export const pageListScreen: EntityListScreenDefinition = {
     "title",
     {
       field: "published",
-      renderer: { format: "boolean", trueLabel: "Published", falseLabel: "Draft" },
+      renderer: {
+        format: "boolean",
+        trueLabel: "managed-pages:entity:page:field:published:option:true",
+        falseLabel: "managed-pages:entity:page:field:published:option:false",
+      },
     },
   ],
   defaultSort: { field: "slug", dir: "asc" },

package/src/personal-access-tokens/feature.ts

@@ -5,6 +5,7 @@ import { buildAvailableScopesQuery } from "./handlers/available-scopes.query";
 import { createPatWrite } from "./handlers/create.write";
 import { listPatQuery } from "./handlers/list.query";
 import { revokePatWrite } from "./handlers/revoke.write";
+import { PAT_FEATURE_I18N } from "./i18n";
 import { apiTokenEntity } from "./schema/api-token";
 import type { PatScopeConfig } from "./scopes";
 
@@ -75,6 +76,7 @@ export function createPersonalAccessTokensFeature(
       renderer: { react: { __component: "PatTokensScreen" } },
       access: { openToAll: true },
     });
+    r.translations({ keys: PAT_FEATURE_I18N });
 
     // scopes + rateLimit flow into feature.exports so run-prod-app builds the
     // resolver + limiter from the same declaration — single source of truth.

package/src/personal-access-tokens/i18n.ts

@@ -0,0 +1,5 @@
+type LocalizedString = { readonly de: string; readonly en: string };
+
+export const PAT_FEATURE_I18N: Readonly<Record<string, LocalizedString>> = {
+  "screen:api-tokens.title": { de: "Personal Access Tokens", en: "Personal Access Tokens" },
+};

package/src/personal-access-tokens/web/pat-tokens-screen.tsx

@@ -41,7 +41,11 @@ function isoDate(value: string | null): string | null {
   return typeof value === "string" && value.length >= 10 ? value.slice(0, 10) : null;
 }
 
-export function PatTokensScreen(): ReactNode {
+export function PatTokensScreen({
+  embedded = false,
+}: {
+  readonly embedded?: boolean;
+} = {}): ReactNode {
   const t = useTranslation();
   const { Form, Field, Input, Button, Banner, Card, Heading } = usePrimitives();
   const dispatcher = useDispatcher();
@@ -130,7 +134,7 @@ export function PatTokensScreen(): ReactNode {
   };
 
   return (
-    <div className="flex max-w-3xl flex-col gap-6 p-6">
+    <div className={embedded ? "flex flex-col gap-6" : "flex max-w-3xl flex-col gap-6 p-6"}>
       <Heading>{t("pat.title")}</Heading>
 
       {minted && (
@@ -232,7 +236,7 @@ export function PatTokensScreen(): ReactNode {
               <div className="flex items-center justify-between gap-3">
                 <div className="flex min-w-0 flex-col gap-0.5">
                   <span className="truncate text-sm font-semibold">{row.name}</span>
-                  <span className="truncate text-xs text-muted-foreground">
+                  <span className="whitespace-normal text-xs text-muted-foreground">
                     {revoked ? t("pat.list.revoked") : meta(row)}
                   </span>
                 </div>

package/src/subscription-stripe/feature.ts

@@ -172,6 +172,8 @@ export function createSubscriptionStripeFeature(
           de: "Stripe Billing live",
           en: "Stripe Billing Live",
         },
+        "subscription-stripe.settings": { de: "Stripe", en: "Stripe" },
+        "screen:subscription-stripe-system.title": { de: "Stripe", en: "Stripe" },
       },
     });
 

package/src/tags/feature.ts

@@ -29,6 +29,7 @@ import { createCreateTagHandler } from "./handlers/create-tag.write";
 import { createDeleteTagHandler } from "./handlers/delete-tag.write";
 import { createRemoveTagHandler } from "./handlers/remove-tag.write";
 import { createUpdateTagHandler } from "./handlers/update-tag.write";
+import { TAGS_FEATURE_I18N } from "./i18n";
 
 // Opt-in tier-gating: when set, the feature declares itself r.toggleable so the
 // dispatcher gate + feature-toggles + tier-engine can switch the WHOLE feature
@@ -76,6 +77,7 @@ function registerTags(
     renderer: { react: { __component: "TagsScreen" } },
     access,
   });
+  r.translations({ keys: TAGS_FEATURE_I18N });
 }
 
 export const tagsFeature = defineFeature(TAGS_FEATURE_NAME, (r) =>

package/src/tags/i18n.ts

@@ -0,0 +1,5 @@
+type LocalizedString = { readonly de: string; readonly en: string };
+
+export const TAGS_FEATURE_I18N: Readonly<Record<string, LocalizedString>> = {
+  "screen:tag-list.title": { de: "Tags", en: "Tags" },
+};

package/src/tenant/__tests__/tenant-security.integration.test.ts

@@ -197,12 +197,12 @@ describe("TenantAdmin can use members-admin HTTP surface", () => {
       { email: "pending@example.com", role: "Editor" },
       tenantAdminA(),
     );
-    const members = await stack.http.queryOk<readonly { userId: string }[]>(
-      TenantQueries.members,
-      {},
-      tenantAdminA(),
-    );
+    const members = await stack.http.queryOk<
+      readonly { userId: string; email: string | null; displayName: string | null }[]
+    >(TenantQueries.members, {}, tenantAdminA());
     expect(members.some((m) => m.userId === tenantAdminAId)).toBe(true);
+    const self = members.find((m) => m.userId === tenantAdminAId);
+    expect(self?.email).toBe("admin-a@example.com");
     const invitations = await stack.http.queryOk<readonly { email: string }[]>(
       TenantQueries.invitations,
       {},
@@ -211,6 +211,21 @@ describe("TenantAdmin can use members-admin HTTP surface", () => {
     expect(invitations).toHaveLength(1);
     expect(invitations[0]?.email).toBe("pending@example.com");
   });
+
+  test("members email is null when user row is missing", async () => {
+    const orphanUserId = "00000000-0000-4000-8000-00000000dead";
+    await seedTenantMembership(stack.db, {
+      userId: orphanUserId,
+      tenantId: TENANT_A_ID,
+      roles: ["User"],
+    });
+    const members = await stack.http.queryOk<readonly { userId: string; email: string | null }[]>(
+      TenantQueries.members,
+      {},
+      tenantAdminA(),
+    );
+    expect(members.find((m) => m.userId === orphanUserId)?.email).toBeNull();
+  });
 });
 
 describe("regular User is denied members-admin surface", () => {

package/src/tenant/feature.ts

@@ -23,6 +23,7 @@ import { resolveUserIdsQuery } from "./handlers/resolve-user-ids.query";
 import { disableWrite, enableWrite } from "./handlers/toggle-enabled.write";
 import { updateWrite } from "./handlers/update.write";
 import { updateMemberRolesWrite } from "./handlers/update-member-roles.write";
+import { TENANT_I18N } from "./i18n";
 import { tenantInvitationEntity } from "./invitation-table";
 import { tenantMembershipEntity } from "./membership-table";
 import { tenantEntity } from "./schema/tenant";
@@ -151,6 +152,8 @@ export function createTenantFeature(): FeatureDefinition {
       order: 20,
     });
 
+    r.translations({ keys: TENANT_I18N });
+
     return { handlers, queries };
   });
 }

package/src/tenant/handlers/members.query.ts

@@ -2,8 +2,11 @@ import { selectMany } from "@cosmicdrift/kumiko-framework/bun-db";
 import { access, defineQueryHandler } from "@cosmicdrift/kumiko-framework/engine";
 import { parseRoles } from "@cosmicdrift/kumiko-framework/utils";
 import { z } from "zod";
+import { userTable } from "../../user";
 import { tenantMembershipsTable } from "../membership-table";
 
+type UserRow = { readonly id: unknown; readonly email?: unknown; readonly displayName?: unknown };
+
 export const membersQuery = defineQueryHandler({
   name: "members",
   schema: z.object({}),
@@ -13,9 +16,21 @@ export const membersQuery = defineQueryHandler({
       tenantId: query.user.tenantId,
     });
 
-    return rows.map((row) => ({
-      ...row,
-      roles: parseRoles(row["roles"]),
-    }));
+    const userIds = [...new Set(rows.map((row) => row["userId"]))];
+    const users =
+      userIds.length > 0 ? await selectMany<UserRow>(ctx.db, userTable, { id: userIds }) : [];
+    const userById = new Map(users.map((u) => [String(u.id), u]));
+
+    return rows.map((row) => {
+      const user = userById.get(String(row["userId"]));
+      const email = typeof user?.email === "string" ? user.email : null;
+      const displayName = typeof user?.displayName === "string" ? user.displayName : null;
+      return {
+        ...row,
+        email,
+        displayName,
+        roles: parseRoles(row["roles"]),
+      };
+    });
   },
 });

package/src/tenant/i18n.ts

@@ -0,0 +1,28 @@
+type LocalizedString = { readonly de: string; readonly en: string };
+
+export const TENANT_I18N: Readonly<Record<string, LocalizedString>> = {
+  "screen:tenant-list.title": { de: "Mandanten", en: "Tenants" },
+  "screen:tenant-edit.title": { de: "Mandant bearbeiten", en: "Edit tenant" },
+  "screen:members.title": { de: "Team", en: "Team" },
+  "tenant.nav.members": { de: "Team", en: "Team" },
+  "tenant:entity:tenant:field:key": { de: "Schlüssel", en: "Key" },
+  "tenant:entity:tenant:field:name": { de: "Name", en: "Name" },
+  "tenant:entity:tenant:field:isEnabled": { de: "Aktiv", en: "Enabled" },
+  "tenant:entity:tenant:field:status": { de: "Status", en: "Status" },
+  "tenant:entity:tenant:field:status:option:active": { de: "Aktiv", en: "Active" },
+  "tenant:entity:tenant:field:status:option:destroyRequested": {
+    de: "Löschung angefordert",
+    en: "Destroy requested",
+  },
+  "tenant:entity:tenant:field:status:option:destroying": {
+    de: "Wird gelöscht",
+    en: "Destroying",
+  },
+  "tenant:entity:tenant:field:status:option:destroyFailed": {
+    de: "Löschung fehlgeschlagen",
+    en: "Destroy failed",
+  },
+  "tenant:entity:tenant:field:status:option:destroyed": { de: "Gelöscht", en: "Destroyed" },
+  "tenant:entity:tenant:field:isEnabled:option:true": { de: "Ja", en: "Yes" },
+  "tenant:entity:tenant:field:isEnabled:option:false": { de: "Nein", en: "No" },
+};

package/src/tenant/index.ts

@@ -8,7 +8,7 @@ export {
   tenantInvitationEntity,
   tenantInvitationsTable,
 } from "./invitation-table";
-export { tenantMembershipsTable } from "./membership-table";
+export { tenantMembershipEntity, tenantMembershipsTable } from "./membership-table";
 export {
   TENANT_LIFECYCLE_STATUSES,
   type TenantLifecycleStatus,

package/src/tenant/schema/tenant.ts

@@ -24,8 +24,8 @@ export const tenantEntity = createEntity({
   // UUID sein, sonst findet der tenants-Lookup nie. Default gen_random_uuid().
   fields: {
     key: createTextField({ required: true, maxLength: 50 }),
-    name: createTextField({ required: true, maxLength: 200, searchable: true }),
-    isEnabled: createBooleanField({ default: true }),
+    name: createTextField({ required: true, maxLength: 200, searchable: true, sortable: true }),
+    isEnabled: createBooleanField({ default: true, filterable: true }),
     // Tenant-destroy lifecycle (tenant-lifecycle feature). Defaults keep
     // existing tenants valid when the feature is not mounted.
     status: createSelectField({