@cosmicdrift/kumiko-bundled-features 0.215.6 → 0.216.0

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@cosmicdrift/kumiko-bundled-features",
-  "version": "0.215.6",
+  "version": "0.216.0",
   "description": "Built-in features — tenant, user, auth, delivery. The stuff you'd rewrite anyway, already typed.",
   "license": "BUSL-1.1",
   "author": "Marc Frost <marc@cosmicdriftgamestudio.com>",
@@ -126,12 +126,12 @@
     "./step-dispatcher": "./src/step-dispatcher/index.ts"
   },
   "dependencies": {
-    "@cosmicdrift/kumiko-dispatcher-live": "0.215.6",
-    "@cosmicdrift/kumiko-framework": "0.215.6",
-    "@cosmicdrift/kumiko-headless": "0.215.6",
-    "@cosmicdrift/kumiko-renderer": "0.215.6",
-    "@cosmicdrift/kumiko-renderer-web": "0.215.6",
-    "@cosmicdrift/kumiko-types": "0.215.6",
+    "@cosmicdrift/kumiko-dispatcher-live": "0.216.0",
+    "@cosmicdrift/kumiko-framework": "0.216.0",
+    "@cosmicdrift/kumiko-headless": "0.216.0",
+    "@cosmicdrift/kumiko-renderer": "0.216.0",
+    "@cosmicdrift/kumiko-renderer-web": "0.216.0",
+    "@cosmicdrift/kumiko-types": "0.216.0",
     "@mollie/api-client": "^4.5.0",
     "@node-rs/argon2": "^2.0.2",
     "@types/mailparser": "^3.4.6",
@@ -160,6 +160,7 @@
   "devDependencies": {
     "@testing-library/user-event": "^14.6.1",
     "@types/qrcode": "^1.5.5",
-    "@cosmicdrift/kumiko-locale-de": "0.215.6"
+    "@cosmicdrift/kumiko-locale-de": "0.216.0",
+    "@cosmicdrift/kumiko-locale-es": "0.216.0"
   }
 }

package/src/__tests__/access-invalidation-consumer.integration.test.ts

@@ -24,7 +24,7 @@ import { afterAll, beforeAll, beforeEach, describe, expect, test } from "bun:tes
 import { randomBytes } from "node:crypto";
 import { authFoundationFeature } from "@cosmicdrift/kumiko-bundled-features/auth-foundation";
 import type { SessionCreator } from "@cosmicdrift/kumiko-framework/api";
-import { selectMany } from "@cosmicdrift/kumiko-framework/bun-db";
+import { fetchOne, selectMany } from "@cosmicdrift/kumiko-framework/bun-db";
 import { createEventsTable, eventsTable } from "@cosmicdrift/kumiko-framework/event-store";
 import {
   setupTestStack,
@@ -54,7 +54,7 @@ import { createTenantFeature } from "../tenant";
 import { TenantHandlers } from "../tenant/constants";
 import { tenantMembershipsTable } from "../tenant/membership-table";
 import { tenantEntity } from "../tenant/schema/tenant";
-import { UserHandlers } from "../user";
+import { UserHandlers, UserQueries } from "../user";
 import { createUserFeature } from "../user/feature";
 import { userEntity, userTable } from "../user/schema/user";
 
@@ -276,4 +276,37 @@ describe("access-invalidation event consumer", () => {
 
     expect(invalidated).toEqual([userId]);
   });
+
+  test("user:update (global role change) revokes sessions and pushes an invalidation", async () => {
+    const { userId } = await h.seedUser("globalrolechange@example.com", "pw-long-enough");
+    const { sid } = await h.login("globalrolechange@example.com", "pw-long-enough");
+    trackInvalidation(userId);
+
+    const admin = await withMintedSession(sessionCreator, TestUsers.systemAdmin);
+    const detail = await stack.http.queryOk<Record<string, unknown>>(
+      UserQueries.detail,
+      { id: userId },
+      admin,
+    );
+
+    const result = await stack.http.writeOk(
+      UserHandlers.update,
+      {
+        id: userId,
+        version: detail["version"],
+        changes: { roles: JSON.stringify(["SystemAdmin"]) },
+      },
+      admin,
+    );
+    expect(result).toBeTruthy();
+
+    await stack.eventDispatcher?.runOnce();
+
+    expect(invalidated).toEqual([userId]);
+
+    const sessionRow = await fetchOne<{ revokedAt: unknown }>(stack.db, userSessionTable, {
+      id: sid,
+    });
+    expect(sessionRow?.revokedAt).not.toBeNull();
+  });
 });

package/src/auth-email-password/__tests__/invite-flow.integration.test.ts

@@ -660,10 +660,9 @@ describe("invitations-query (pending list)", () => {
 // merges flat into the session and unlocks the SystemAdmin-gated cross-tenant
 // handler surface (hasAccess can't tell membership roles from global ones).
 describe("privilege escalation via invite role", () => {
-  // Each forbidden value is a platform-global/reserved role that must never
-  // reach a tenant membership. Proven exploitable before the fix: inviting
-  // "SystemAdmin" gave the invitee a JWT carrying SystemAdmin flat, which
-  // passed every SystemAdmin gate cross-tenant.
+  // Reserved / global roles: must NEVER reach a tenant invitation. hasAccess
+  // is flat, so a tenant-member invite for SystemAdmin would escalate on
+  // login/switch without any cross-tenant check.
   const FORBIDDEN_ROLES = ["SystemAdmin", "system", "all", "anonymous"];
 
   test("invite-create rejects reserved/global roles — no invitation persisted, no mail", async () => {
@@ -673,49 +672,100 @@ describe("privilege escalation via invite role", () => {
         { email: CAROL_EMAIL, role },
         aliceSession(),
       );
-      expect(err.code).toBe("access_denied");
+      expect(err.details).toMatchObject({ reason: "reserved_membership_role", role });
       const rows = await selectMany(stack.db, tenantInvitationsTable, { email: CAROL_EMAIL });
       expect(rows).toHaveLength(0);
+      expect(emailTransport.sent).toHaveLength(0);
     }
-    // The forbidden-role check fires before the mail dispatch.
-    expect(emailTransport.sent).toHaveLength(0);
   });
 
   test("legitimate tenant role still issues an invitation", async () => {
     const result = (await stack.http.writeOk(
       AuthHandlers.inviteCreate,
-      { email: CAROL_EMAIL, role: "Editor" },
+      { email: CAROL_EMAIL, role: "Admin" },
       aliceSession(),
     )) as { role: string };
-    expect(result.role).toBe("Editor");
+    expect(result.role).toBe("Admin");
   });
 
-  // Regression guard for the opt-in canAssignRole hook (#security): this
-  // stack's invite feature was mounted WITHOUT canAssignRole, so any
-  // non-reserved app-defined role must still go through unchanged — the
-  // hierarchy gate below is a separate, opt-in stack, not a default.
-  test("without canAssignRole configured, any non-reserved app-defined role is still assignable", async () => {
-    const result = (await stack.http.writeOk(
+  test("TenantAdmin can invite TenantAdmin, Admin, Editor, and User", async () => {
+    const tenantAdminSession: SessionUser = {
+      id: aliceId,
+      tenantId: TENANT_A_ID,
+      roles: ["TenantAdmin"],
+    };
+    for (const role of ["TenantAdmin", "Admin", "Editor", "User"]) {
+      const email = `target-${role.toLowerCase()}@example.com`;
+      const result = (await stack.http.writeOk(
+        AuthHandlers.inviteCreate,
+        { email, role },
+        tenantAdminSession,
+      )) as { role: string };
+      expect(result.role).toBe(role);
+    }
+  });
+
+  test("Admin cannot invite TenantAdmin (elevation guard default)", async () => {
+    const err = await stack.http.writeErr(
       AuthHandlers.inviteCreate,
-      { email: "dpo-candidate@example.com", role: "DPO" },
+      { email: "elevate-target@example.com", role: "TenantAdmin" },
+      aliceSession(), // roles: ["Admin"]
+    );
+    expect(err.details).toMatchObject({
+      reason: "unassignable_membership_role",
+      role: "TenantAdmin",
+    });
+    const rows = await selectMany(stack.db, tenantInvitationsTable, {
+      email: "elevate-target@example.com",
+    });
+    expect(rows).toHaveLength(0);
+    expect(emailTransport.sent).toHaveLength(0);
+  });
+
+  test("TenantAdmin cannot invite SystemAdmin (rejected by reserved role guard)", async () => {
+    const tenantAdminSession: SessionUser = {
+      id: aliceId,
+      tenantId: TENANT_A_ID,
+      roles: ["TenantAdmin"],
+    };
+    const err = await stack.http.writeErr(
+      AuthHandlers.inviteCreate,
+      { email: "sysadmin-target@example.com", role: "SystemAdmin" },
+      tenantAdminSession,
+    );
+    expect(err.details).toMatchObject({
+      reason: "reserved_membership_role",
+      role: "SystemAdmin",
+    });
+    const rows = await selectMany(stack.db, tenantInvitationsTable, {
+      email: "sysadmin-target@example.com",
+    });
+    expect(rows).toHaveLength(0);
+  });
+
+  test("rejects unknown/unranked roles fail-closed", async () => {
+    const err = await stack.http.writeErr(
+      AuthHandlers.inviteCreate,
+      { email: "unknown-role@example.com", role: "CustomRole" },
       aliceSession(),
-    )) as { role: string };
-    expect(result.role).toBe("DPO");
+    );
+    expect(err.details).toMatchObject({
+      reason: "unassignable_membership_role",
+      role: "CustomRole",
+    });
   });
 });
 
-// canAssignRole is a role-hierarchy gate that must live in the app (roles are
-// app-defined strings, not a framework concept) — a separate stack mounts the
-// invite feature WITH the hook to prove it's actually enforced, distinct from
-// the framework-reserved-role check covered above.
+// canAssignRole further restricts ranked roles after the default elevation
+// guard — a separate stack mounts the invite feature WITH the hook.
 describe("invite-create role-hierarchy gate (opt-in canAssignRole)", () => {
   let gateStack: TestStack;
   let gateAliceId: string;
   let gateTenantId: TenantId;
   const gateTransport = createInMemoryTransport();
 
-  function gateAliceSession(): SessionUser {
-    return { id: gateAliceId, tenantId: gateTenantId, roles: ["Admin"] };
+  function gateAliceSession(roles: readonly string[] = ["TenantAdmin"]): SessionUser {
+    return { id: gateAliceId, tenantId: gateTenantId, roles: [...roles] };
   }
 
   beforeAll(async () => {
@@ -737,11 +787,9 @@ describe("invite-create role-hierarchy gate (opt-in canAssignRole)", () => {
           invite: {
             tokenTtlMinutes: 60,
             appUrl: APP_ACCEPT_URL,
-            // Only "Admin" may grant "DPO" — everything else may only grant
-            // non-DPO roles. A minimal, deliberately app-shaped hierarchy;
-            // the framework itself knows nothing about "DPO".
+            // Custom app policy: only TenantAdmin with special flag may grant "Admin"
             canAssignRole: (inviterRoles, targetRole) =>
-              targetRole !== "DPO" || inviterRoles.includes("Admin"),
+              targetRole !== "Admin" || inviterRoles.includes("SpecialAdmin"),
           },
         }),
       ],
@@ -784,7 +832,7 @@ describe("invite-create role-hierarchy gate (opt-in canAssignRole)", () => {
     await seedTenantMembership(gateStack.db, {
       userId: gateAliceId,
       tenantId: gateTenantId,
-      roles: ["Admin"],
+      roles: ["TenantAdmin"],
     });
   });
 
@@ -793,14 +841,14 @@ describe("invite-create role-hierarchy gate (opt-in canAssignRole)", () => {
   });
 
   test("canAssignRole → false blocks invite-create with a role-hierarchy error, no invitation persisted", async () => {
-    // TenantAdmin clears the handler's own access.admin gate but canAssignRole
-    // above only lets literal "Admin" grant "DPO" — the case this hook exists for.
+    // TenantAdmin clears the handler's own access.admin gate and default elevation
+    // guard for "Admin", but canAssignRole blocks "Admin" because Alice lacks "SpecialAdmin".
     const err = await gateStack.http.writeErr(
       AuthHandlers.inviteCreate,
-      { email: "blocked-target@example.com", role: "DPO" },
-      { id: gateAliceId, tenantId: gateTenantId, roles: ["TenantAdmin"] },
+      { email: "blocked-target@example.com", role: "Admin" },
+      gateAliceSession(),
     );
-    expect(err.details).toMatchObject({ reason: "unassignable_membership_role", role: "DPO" });
+    expect(err.details).toMatchObject({ reason: "unassignable_membership_role", role: "Admin" });
     const rows = await selectMany(gateStack.db, tenantInvitationsTable, {
       email: "blocked-target@example.com",
     });
@@ -809,11 +857,12 @@ describe("invite-create role-hierarchy gate (opt-in canAssignRole)", () => {
   });
 
   test("canAssignRole → true allows invite-create through", async () => {
+    // Elevation alone would allow TenantAdmin → Admin; hook requires SpecialAdmin.
     const result = (await gateStack.http.writeOk(
       AuthHandlers.inviteCreate,
-      { email: "allowed-target@example.com", role: "DPO" },
-      gateAliceSession(),
+      { email: "allowed-target@example.com", role: "Admin" },
+      gateAliceSession(["TenantAdmin", "SpecialAdmin"]),
     )) as { role: string };
-    expect(result.role).toBe("DPO");
+    expect(result.role).toBe("Admin");
   });
 });

package/src/auth-email-password/handlers/invite-create.write.ts

@@ -33,6 +33,7 @@ import {
 // kumiko-lint-ignore cross-feature-import membership-role validation owned by tenant-feature
 import {
   findForbiddenMembershipRole,
+  findForbiddenRoleAssignment,
   reservedMembershipRoleError,
   unassignableMembershipRoleError,
 } from "../../tenant/membership-roles";
@@ -71,9 +72,10 @@ export type InviteCreateOptions = {
    *  carries no locale signal (no X-Locale header, no usable
    *  Accept-Language) — see the locale resolution in the handler below. */
   readonly locale?: AuthMailLocale;
-  // Opt-in role-hierarchy gate. Roles are app-defined strings, not a framework
-  // concept, so the hierarchy itself must live in the app — this hook lets it
-  // plug in without the framework hardcoding any role names.
+  // Optional app policy on top of the default elevation guard
+  // (findForbiddenRoleAssignment). Cannot authorize reserved or unranked
+  // roles, and cannot raise above the inviter's max framework rank — only
+  // further restrict assignable ranked roles.
   readonly canAssignRole?: (inviterRoles: readonly string[], targetRole: string) => boolean;
 };
 
@@ -101,6 +103,13 @@ export function createInviteCreateHandler(opts: InviteCreateOptions) {
         return writeFailure(reservedMembershipRoleError(forbiddenRole));
       }
 
+      const elevationForbidden = findForbiddenRoleAssignment(event.user.roles, [
+        event.payload.role,
+      ]);
+      if (elevationForbidden !== undefined) {
+        return writeFailure(unassignableMembershipRoleError(elevationForbidden));
+      }
+
       if (opts.canAssignRole && !opts.canAssignRole(event.user.roles, event.payload.role)) {
         return writeFailure(unassignableMembershipRoleError(event.payload.role));
       }

package/src/cap-counter/__tests__/cap-list.boot.test.ts

@@ -11,6 +11,10 @@ describe("cap-counter list screen + handler access alignment", () => {
     expect(() => validateBoot(features)).not.toThrow();
   });
 
+  test("cap-list nav declares icon gauge", () => {
+    expect(capCounterFeature.navs["cap-list"]?.icon).toBe("gauge");
+  });
+
   test("cap-list screen is entityList, SystemAdmin-gated", () => {
     const screen = capCounterFeature.screens[CAP_COUNTER_LIST_SCREEN_ID];
     expect(screen?.type).toBe("entityList");

package/src/cap-counter/feature.ts

@@ -110,6 +110,7 @@ export const capCounterFeature = defineFeature(CAP_COUNTER_FEATURE, (r) => {
     id: "cap-list",
     label: "cap-counter:nav.cap-list",
     screen: "cap-counter:screen:cap-list",
+    icon: "gauge",
     order: 60,
   });
   r.translations({

package/src/delivery/__tests__/delivery-security.integration.test.ts

@@ -1,6 +1,6 @@
 import { afterAll, beforeAll, describe, expect, test } from "bun:test";
 import { insertMany } from "@cosmicdrift/kumiko-framework/bun-db";
-import { access, createRegistry } from "@cosmicdrift/kumiko-framework/engine";
+import { access, createRegistry, SYSTEM_TENANT_ID } from "@cosmicdrift/kumiko-framework/engine";
 import {
   createTestUser,
   setupTestStack,
@@ -105,6 +105,144 @@ describe("delivery log tenant isolation", () => {
   });
 });
 
+describe("delivery log SystemAdmin cross-tenant scope", () => {
+  // Platform waitlist confirmations are dispatched under SYSTEM_TENANT_ID
+  // (anonymous submit). SystemAdmin must see those rows even when their
+  // session tenant is a demo tenant; TenantAdmin must not.
+  const WAITLIST_CONFIRMATION = "waitlist:notify:confirmation";
+
+  test("SystemAdmin sees waitlist confirmation under SYSTEM_TENANT_ID and other tenants, with tenantId on each row", async () => {
+    const demoTenant = testTenantId(51);
+    const otherTenant = testTenantId(52);
+    const systemConfirmationId = crypto.randomUUID();
+    const demoActivationId = crypto.randomUUID();
+    const otherTenantId = crypto.randomUUID();
+    const failedConfirmationId = crypto.randomUUID();
+
+    await insertMany(stack.db, deliveryAttemptsTable, [
+      {
+        id: systemConfirmationId,
+        tenantId: SYSTEM_TENANT_ID,
+        notificationType: WAITLIST_CONFIRMATION,
+        channel: "email",
+        recipientAddress: null,
+        status: "sent",
+      },
+      {
+        id: failedConfirmationId,
+        tenantId: SYSTEM_TENANT_ID,
+        notificationType: WAITLIST_CONFIRMATION,
+        channel: "email",
+        recipientAddress: null,
+        status: "failed",
+        error: "smtp down",
+      },
+      {
+        id: demoActivationId,
+        tenantId: demoTenant,
+        notificationType: "auth-email-password:signup-activation",
+        channel: "email",
+        recipientAddress: null,
+        status: "sent",
+      },
+      {
+        id: otherTenantId,
+        tenantId: otherTenant,
+        notificationType: "welcome",
+        channel: "email",
+        recipientAddress: null,
+        status: "sent",
+      },
+    ]);
+
+    // Session on demo tenant — mirrors SystemAdmin browsing a tenant panel.
+    const systemAdmin = createTestUser({
+      id: 51,
+      roles: ["SystemAdmin"],
+      tenantId: demoTenant,
+    });
+    const res = await stack.http.queryOk<{
+      rows: readonly {
+        id: string;
+        tenantId: string;
+        type: string;
+        status: string;
+        error: string | null;
+      }[];
+    }>(DeliveryQueries.log, {}, systemAdmin);
+
+    const byId = new Map(res.rows.map((r) => [r.id, r]));
+    expect(byId.get(systemConfirmationId)?.tenantId).toBe(SYSTEM_TENANT_ID);
+    expect(byId.get(systemConfirmationId)?.type).toBe(WAITLIST_CONFIRMATION);
+    expect(byId.get(demoActivationId)?.tenantId).toBe(demoTenant);
+    expect(byId.get(otherTenantId)?.tenantId).toBe(otherTenant);
+
+    const failed = byId.get(failedConfirmationId);
+    expect(failed?.tenantId).toBe(SYSTEM_TENANT_ID);
+    expect(failed?.type).toBe(WAITLIST_CONFIRMATION);
+    // Failure path: confirmation delivery errors must surface in the log so
+    // SystemAdmin can diagnose SMTP/channel outages (status=failed).
+    expect(failed?.status).toBe("failed");
+
+    expect(res.rows.every((r) => typeof r.tenantId === "string" && r.tenantId.length > 0)).toBe(
+      true,
+    );
+  });
+
+  test("TenantAdmin cannot read SYSTEM_TENANT_ID or foreign-tenant delivery attempts", async () => {
+    const demoTenant = testTenantId(61);
+    const otherTenant = testTenantId(62);
+    await insertMany(stack.db, deliveryAttemptsTable, [
+      {
+        id: crypto.randomUUID(),
+        tenantId: SYSTEM_TENANT_ID,
+        notificationType: WAITLIST_CONFIRMATION,
+        channel: "email",
+        recipientAddress: null,
+        status: "sent",
+      },
+      {
+        id: crypto.randomUUID(),
+        tenantId: otherTenant,
+        notificationType: "welcome",
+        channel: "email",
+        recipientAddress: null,
+        status: "sent",
+      },
+      {
+        id: crypto.randomUUID(),
+        tenantId: demoTenant,
+        notificationType: "welcome",
+        channel: "email",
+        recipientAddress: null,
+        status: "sent",
+      },
+    ]);
+
+    const tenantAdmin = createTestUser({
+      id: 61,
+      roles: ["TenantAdmin"],
+      tenantId: demoTenant,
+    });
+    const res = await stack.http.queryOk<{ rows: readonly { tenantId: string }[] }>(
+      DeliveryQueries.log,
+      {},
+      tenantAdmin,
+    );
+
+    expect(res.rows.length).toBeGreaterThan(0);
+    expect(res.rows.every((r) => r.tenantId === demoTenant)).toBe(true);
+    expect(res.rows.some((r) => r.tenantId === SYSTEM_TENANT_ID)).toBe(false);
+    expect(res.rows.some((r) => r.tenantId === otherTenant)).toBe(false);
+  });
+
+  test("tenant User cannot query delivery log (negative authz)", async () => {
+    const demoTenant = testTenantId(71);
+    const user = createTestUser({ id: 71, roles: ["User"], tenantId: demoTenant });
+    expect((await stack.http.query(DeliveryQueries.log, {}, user)).status).toBe(403);
+  });
+});
+
 describe("delivery preferences tenant isolation", () => {
   // A userId is not tenant-unique — the same person can be a member of
   // several tenants (tenant:write:add-member takes {userId, tenantId}).

package/src/delivery/feature.ts

@@ -143,6 +143,7 @@ export function createDeliveryFeature(options?: DeliveryFeatureOptions): Feature
       type: "projectionList",
       query: DeliveryQueries.log,
       columns: [
+        { field: "tenantId", label: "delivery.log.col.tenantId" },
         { field: "type", label: "delivery.log.col.type" },
         { field: "channel", label: "delivery.log.col.channel" },
         { field: "recipient", label: "delivery.log.col.recipient" },

package/src/delivery/handlers/log.query.ts

@@ -81,8 +81,15 @@ export const logQuery = definePagedQueryHandler({
     // delivery is r.systemScope()'d, so the TenantDb is system-mode (reads
     // unfiltered). assertTenantMatch is a self-check on the caller's own
     // tenantId, not a query filter — it returns that same unfiltered db, so
-    // the explicit `where` below still does the actual tenant scoping.
-    const db = ctx.systemDb.assertTenantMatch(query.user.tenantId);
+    // the explicit `where` below still does the actual tenant scoping for
+    // non-SystemAdmin callers. SystemAdmin acknowledges cross-tenant read
+    // (PII-bearing delivery logs across all tenants incl. SYSTEM_TENANT_ID).
+    const isSystemAdmin = query.user.roles.includes("SystemAdmin");
+    const db = isSystemAdmin
+      ? ctx.systemDb.acknowledgeCrossTenant(
+          "SystemAdmin reads delivery attempts across all tenants including SYSTEM_TENANT_ID",
+        )
+      : ctx.systemDb.assertTenantMatch(query.user.tenantId);
 
     const requestedSort = query.payload.sort;
     const sortField: DeliveryLogSortField =
@@ -92,7 +99,9 @@ export const logQuery = definePagedQueryHandler({
     const sortDirection = query.payload.sortDirection ?? "desc";
     const sortColumn = DELIVERY_LOG_SORT_COLUMNS[sortField];
 
-    const where: WhereObject = { tenantId: query.user.tenantId };
+    // TenantAdmin/Admin stay strictly tenant-scoped; SystemAdmin sees every
+    // tenant's attempts (platform waitlist confirmations live on SYSTEM_TENANT_ID).
+    const where: WhereObject = isSystemAdmin ? {} : { tenantId: query.user.tenantId };
     if (query.payload.cursor) {
       where[sortColumn] = {
         [sortDirection === "asc" ? "gt" : "lt"]: decodeSortCursor(sortColumn, query.payload.cursor),

package/src/delivery/i18n.ts

@@ -3,6 +3,7 @@ type LocalizedString = { readonly en: string };
 export const DELIVERY_I18N: Readonly<Record<string, LocalizedString>> = {
   "screen:delivery-log.title": { en: "Delivery log" },
   "delivery:nav.deliveryLog": { en: "Delivery" },
+  "delivery.log.col.tenantId": { en: "Tenant" },
   "delivery.log.col.type": { en: "Type" },
   "delivery.log.col.channel": { en: "Channel" },
   "delivery.log.col.recipient": { en: "Recipient" },

package/src/jobs/is-manual-trigger.test.ts

@@ -0,0 +1,17 @@
+import { describe, expect, test } from "bun:test";
+import { isManualTrigger } from "./is-manual-trigger";
+
+describe("isManualTrigger", () => {
+  test("manual trigger → true", () => {
+    expect(isManualTrigger({ manual: true })).toBe(true);
+  });
+
+  test("cron trigger → false", () => {
+    expect(isManualTrigger({ cron: "*/5 * * * *" })).toBe(false);
+  });
+
+  test("event trigger → false", () => {
+    expect(isManualTrigger({ on: "entity.created" })).toBe(false);
+    expect(isManualTrigger({ on: ["entity.created", "entity.updated"] })).toBe(false);
+  });
+});

package/src/shared/map-with-concurrency.test.ts

@@ -68,7 +68,7 @@ describe("mapWithConcurrency", () => {
       // for a real unhandled rejection (if any) to fire.
       await new Promise((resolve) => setTimeout(resolve, 50));
     } finally {
-      process.off("unhandledRejection", onUnhandledRejection);
+      process.off("unhandledRejection" as never, onUnhandledRejection);
     }
     expect(unhandled).toEqual([]);
   });

package/src/shared/session-locale-field.test.ts

@@ -0,0 +1,16 @@
+import { describe, expect, test } from "bun:test";
+import { sessionLocaleField } from "./session-locale-field";
+
+describe("sessionLocaleField", () => {
+  test("set locale → { locale }", () => {
+    expect(sessionLocaleField("de-DE")).toEqual({ locale: "de-DE" });
+  });
+
+  test("null locale → empty object", () => {
+    expect(sessionLocaleField(null)).toEqual({});
+  });
+
+  test("undefined locale → empty object", () => {
+    expect(sessionLocaleField(undefined)).toEqual({});
+  });
+});

package/src/shared/session-timezone-field.test.ts

@@ -0,0 +1,16 @@
+import { describe, expect, test } from "bun:test";
+import { sessionTimezoneField } from "./session-timezone-field";
+
+describe("sessionTimezoneField", () => {
+  test("set timezone → { timezone }", () => {
+    expect(sessionTimezoneField("Europe/Berlin")).toEqual({ timezone: "Europe/Berlin" });
+  });
+
+  test("null timezone → empty object", () => {
+    expect(sessionTimezoneField(null)).toEqual({});
+  });
+
+  test("undefined timezone → empty object", () => {
+    expect(sessionTimezoneField(undefined)).toEqual({});
+  });
+});